@intentius/terragucci 0.4.45 → 0.4.46

package/dist/estate.schema.json

@@ -124,6 +124,23 @@
               "call": { "type": "string", "description": "For a module, the call's address in the root." }
             }
           }
+        },
+        "compat": {
+          "type": "object",
+          "description": "For a module version a choudoufu root runs: the known-module catalog's answer from chant's terraform lexicon, the static tier of choudoufu's module table. Every figure is from the tier it names. Absent when the installed chant has no catalog.",
+          "required": ["tier", "status", "examples", "refused", "refusals", "page"],
+          "properties": {
+            "tier": { "type": "string" },
+            "status": { "enum": ["unknown-module", "unknown-version", "clear", "refused"] },
+            "examples": { "type": "integer", "minimum": 0 },
+            "refused": { "type": "integer", "minimum": 0 },
+            "refusals": {
+              "type": "array",
+              "items": { "type": "object", "required": ["id", "sites"], "properties": { "id": { "type": "string" }, "sites": { "type": "integer", "minimum": 0 } } }
+            },
+            "measured": { "type": "array", "items": { "type": "string" } },
+            "page": { "type": "string" }
+          }
         }
       }
     },

package/dist/registry-edge-lambda.mjs

@@ -0,0 +1,9 @@
+import{readFileSync as de}from"node:fs";var x=".well-known/terraform.json";var h=(e,t)=>{let n=(e??"").replace(/^\/+|\/+$/g,"");return n?`${n}/${t}`:t};var P="X-Terraform-Get";function W(e){return`${JSON.stringify({location:e})}
+`}function E(e){if(e)try{let t=JSON.parse(e).location;return typeof t=="string"&&t?t:void 0}catch{return}}function $(e){return{status:200,headers:{"content-type":"application/json",[P]:e},body:W(e)}}var y=e=>/(^|\/)v1\/modules\/[^/]+\/[^/]+\/[^/]+\/[^/]+\/download$/.test(e.split("?")[0]);var J="providers",b=e=>new RegExp(`(^|/)${J}/[^/]+/[^/]+/[^/]+/(?!index\\.json$)[^/]+\\.json$`).test(e.split("?")[0]);var R="expires",T="signature",O=300,w=new TextEncoder,V=e=>{let t="";for(let n of new Uint8Array(e))t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")},N=async(e,t)=>{let n=await crypto.subtle.importKey("raw",w.encode(e),{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return V(await crypto.subtle.sign("HMAC",n,w.encode(t)))},D=(e,t)=>{let n=w.encode(e),r=w.encode(t),o=n.length^r.length;for(let s=0;s<Math.max(n.length,r.length);s++)o|=(n[s]??0)^(r[s]??0);return o===0},A=e=>e.signingKey||e.tokens.find(t=>!!t),v=(e,t)=>`${e}
+${t}`;async function G(e,t,n,r=O){let o=new URL(e),s=Math.floor(n/1e3)+r;return o.searchParams.delete(R),o.searchParams.delete(T),o.searchParams.set(R,String(s)),o.searchParams.set(T,await N(t,v(o.pathname,s))),o.toString()}async function q(e,t,n){let r=Number(e.searchParams.get(R)),o=e.searchParams.get(T);return!o||!Number.isInteger(r)||r*1e3<n?!1:D(o,await N(t,v(e.pathname,r)))}function B(e,t){let n=/^Bearer\s+(.+)$/i.exec(e.headers.get("authorization")??"");if(!n)return!1;let r=n[1].trim(),o=!1;for(let s of t)s&&D(r,s)&&(o=!0);return o}var X=()=>new Response(`${JSON.stringify({errors:["a token is required: set TF_TOKEN_<host> or a credentials block for this host"]})}
+`,{status:401,headers:{"content-type":"application/json","www-authenticate":'Bearer realm="terraform-registry"'}}),Z=(e,t)=>e.origin===t.origin&&/\.(tar\.gz|tgz|zip)$/.test(e.pathname);function _(e){let t=e.now??Date.now;return async n=>{let r=new URL(n.url),o=n.method.toUpperCase(),s=p=>(e.log?.(`${o} ${r.pathname} -> ${p.status}`),p),i=r.pathname.replace(/^\/+/,""),d=e.auth;if(d){let p=i===x||y(i)||/(^|\/)versions$/.test(i),m=B(n,d.tokens),f=A(d);if(!m&&!p&&f&&(m=await q(r,f,t())),!m)return s(X())}if(o!=="GET"&&o!=="HEAD")return;if(d&&b(i))return Q(n,r,i,e,d,t(),s);if(!y(i))return;let c;try{c=await e.files(h(e.prefix,i))}catch{return s(new Response(null,{status:502}))}if(c.body===void 0)return s(new Response(null,{status:404}));let a=E(typeof c.body=="string"?c.body:new TextDecoder().decode(c.body));if(!a)return;let u=d?A(d):void 0;if(d&&u){let p=new URL(a,r);Z(p,r)&&(a=await G(p.toString(),u,t(),d.ttl))}let l=$(a);return s(new Response(o==="HEAD"?null:l.body,{status:l.status,headers:l.headers}))}}async function Q(e,t,n,r,o,s,i){let d=A(o);if(!d)return;let c;try{c=await r.files(h(r.prefix,n))}catch{return i(new Response(null,{status:502}))}if(c.body===void 0)return i(new Response(null,{status:404}));let a;try{a=JSON.parse(typeof c.body=="string"?c.body:new TextDecoder().decode(c.body))}catch{return}for(let l of Object.values(a.archives??{})){if(!l||typeof l.url!="string")continue;let p=new URL(l.url,t);p.origin===t.origin&&(l.url=await G(p.toString(),d,s,o.ttl))}let u=`${JSON.stringify(a)}
+`;return i(new Response(e.method.toUpperCase()==="HEAD"?null:u,{status:200,headers:{"content-type":"application/json"}}))}function k(e,t=(n,r)=>fetch(n,r)){let n=e.replace(/\/+$/,"");return async r=>{let o=await t(`${n}/${r.split("/").map(encodeURIComponent).join("/")}`,{method:"GET"});if(o.status===404||o.status===403)return{};if(!o.ok)throw new Error(`origin answered ${o.status}`);return{body:new Uint8Array(await o.arrayBuffer())}}}var S=e=>(e??"").split(/[\n,]/).map(t=>t.trim()).filter(t=>!!t);var I=new TextEncoder,j=e=>[...new Uint8Array(e)].map(t=>t.toString(16).padStart(2,"0")).join(""),U=async e=>j(await crypto.subtle.digest("SHA-256",I.encode(e)));async function C(e,t){let n=typeof e=="string"?I.encode(e):e,r=await crypto.subtle.importKey("raw",n,{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return crypto.subtle.sign("HMAC",r,I.encode(t))}var H=e=>encodeURIComponent(e).replace(/[!'()*]/g,t=>`%${t.charCodeAt(0).toString(16).toUpperCase()}`);function ee(e){let t=[];return e.searchParams.forEach((n,r)=>t.push([H(r),H(n)])),t.sort((n,r)=>n[0]===r[0]?n[1]<r[1]?-1:n[1]>r[1]?1:0:n[0]<r[0]?-1:1),t.map(([n,r])=>`${n}=${r}`).join("&")}async function F(e){let t=new URL(e.url),n=e.now.toISOString().replace(/[-:]/g,"").replace(/\.\d{3}/,""),r=n.slice(0,8),o=await U(e.body),s={};for(let[f,z]of Object.entries(e.headers))s[f.toLowerCase()]=z.trim().replace(/\s+/g," ");s.host=t.host,s["x-amz-date"]=n,e.credentials.sessionToken&&(s["x-amz-security-token"]=e.credentials.sessionToken);let i=Object.keys(s).sort(),d=i.map(f=>`${f}:${s[f]}
+`).join(""),c=i.join(";"),a=[e.method.toUpperCase(),t.pathname||"/",ee(t),d,c,o].join(`
+`),u=`${r}/${e.region}/${e.service}/aws4_request`,l=["AWS4-HMAC-SHA256",n,u,await U(a)].join(`
+`),p=await C(`AWS4${e.credentials.secretAccessKey}`,r);for(let f of[e.region,e.service,"aws4_request"])p=await C(p,f);let m=j(await C(p,l));return s.authorization=`AWS4-HMAC-SHA256 Credential=${e.credentials.accessKeyId}/${u}, SignedHeaders=${c}, Signature=${m}`,s}var te=300,ne=3600,re=5e3;function oe(e){let t=e.trim();if(t.startsWith("{")){let n;try{n=JSON.parse(t)}catch{throw new Error("the stored tokens look like JSON but do not parse")}return{tokens:Array.isArray(n.tokens)?n.tokens.filter(o=>typeof o=="string").map(o=>o.trim()).filter(o=>!!o):typeof n.tokens=="string"?S(n.tokens):[],...typeof n.signingKey=="string"&&n.signingKey?{signingKey:n.signingKey}:{}}}return{tokens:S(t)}}function se(){let e=globalThis.process?.env??{},t=e.AWS_ACCESS_KEY_ID,n=e.AWS_SECRET_ACCESS_KEY;if(!t||!n)throw new Error("no AWS credentials in the function's runtime (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)");return{accessKeyId:t,secretAccessKey:n,...e.AWS_SESSION_TOKEN?{sessionToken:e.AWS_SESSION_TOKEN}:{}}}var ae=(e,t)=>fetch(e,t);async function ie(e,t=new Date){let n=e.region??"us-east-1",r=e.kind==="ssm"?"ssm":"secretsmanager",o=`https://${r}.${n}.amazonaws.com/`,s=e.kind==="ssm"?"AmazonSSM.GetParameter":"secretsmanager.GetSecretValue",i=JSON.stringify(e.kind==="ssm"?{Name:e.name,WithDecryption:!0}:{SecretId:e.secretId}),d=typeof e.credentials=="function"?await e.credentials():e.credentials??se(),c=await F({method:"POST",url:o,headers:{"content-type":"application/x-amz-json-1.1","x-amz-target":s},body:i,region:n,service:r,credentials:d,now:t}),a=await(e.fetch??ae)(o,{method:"POST",headers:c,body:i}),u=await a.text(),l=e.kind==="ssm"?`SSM parameter ${e.name}`:`secret ${e.secretId}`;if(!a.ok){let f="";try{f=String(JSON.parse(u).__type??"").split("#").pop()??""}catch{}throw new Error(`reading ${l} in ${n} answered ${a.status}${f?` ${f}`:""}`)}let p;try{let f=JSON.parse(u);p=e.kind==="ssm"?f.Parameter?.Value:f.SecretString}catch{throw new Error(`reading ${l} answered something other than JSON`)}if(typeof p!="string")throw new Error(`${l} has no text value${e.kind==="secrets-manager"?" (a binary secret is not read)":""}`);let m=oe(p);if(m.tokens.length===0)throw new Error(`${l} holds no token`);return m}function K(e,t=Date.now){let n=Math.min(Math.max(e.cacheSeconds??te,0),ne)*1e3,r,o=()=>{let s=ie(e,new Date(t())),i={until:Number.POSITIVE_INFINITY,result:s};return r=i,s.then(()=>{i.until=t()+n},()=>{i.until=t()+re}),s};return o().catch(()=>{}),{get:()=>r&&t()<r.until?r.result:o()}}function L(e){let{config:t,request:n}=e.Records[0].cf,r=n.headers.host?.[0]?.value??t?.distributionDomainName??"localhost",o=new Headers;for(let s of Object.values(n.headers))for(let i of s)i.key&&o.append(i.key,i.value);return new Request(`https://${r}${n.uri}${n.querystring?`?${n.querystring}`:""}`,{method:n.method,headers:o})}async function Y(e){let t={};e.headers.forEach((r,o)=>{t[o.toLowerCase()]=[{key:o,value:r}]});let n=e.body?await e.text():void 0;return{status:String(e.status),headers:t,...n!==void 0?{body:n}:{}}}var ce=()=>({status:"503",statusDescription:"Service Unavailable",headers:{"content-type":[{key:"Content-Type",value:"application/json"}],"cache-control":[{key:"Cache-Control",value:"no-store"}]},body:`${JSON.stringify({errors:["the registry cannot check tokens right now"]})}
+`});function M(e){let{auth:t,...n}=e,r=t?.source??{kind:"zip"},o=c=>{let a=c.Records[0].cf.request;return t?{...a,querystring:""}:a},s=(c,a)=>({tokens:c,...a||t?.signingKey?{signingKey:a||t?.signingKey}:{},...t?.ttl!==void 0?{ttl:t.ttl}:{}});if(!t||r.kind==="zip"){let c=_({...n,...t?{auth:s(t.tokens??[])}:{}});return async a=>{let u=await c(L(a));return u?Y(u):o(a)}}let i=K(r,n.now),d;return async c=>{let a;try{a=await i.get()}catch(l){return n.log?.(`token store: ${l.message}`),ce()}d?.stored!==a&&(d={stored:a,gate:_({...n,auth:s(a.tokens,a.signingKey)})});let u=await d.gate(L(c));return u?Y(u):o(c)}}var g=JSON.parse(de(new URL("./registry-edge.json",import.meta.url),"utf8")),Be=M({files:k(g.origin),...g.prefix?{prefix:g.prefix}:{},...g.auth?{auth:g.auth}:{}});export{Be as handler};

package/dist/registry-edge-token-stores

@@ -0,0 +1 @@
+chant#4590

package/dist/registry-edge-worker.mjs

@@ -0,0 +1,6 @@
+var S=".well-known/terraform.json";var f=(e,t)=>{let n=(e??"").replace(/^\/+|\/+$/g,"");return n?`${n}/${t}`:t};var G="X-Terraform-Get";function U(e){return`${JSON.stringify({location:e})}
+`}function h(e){if(e)try{let t=JSON.parse(e).location;return typeof t=="string"&&t?t:void 0}catch{return}}function g(e){return{status:200,headers:{"content-type":"application/json",[G]:e},body:U(e)}}var m=e=>/(^|\/)v1\/modules\/[^/]+\/[^/]+\/[^/]+\/[^/]+\/download$/.test(e.split("?")[0]);var H={".html":"text/html; charset=utf-8",".css":"text/css; charset=utf-8",".js":"text/javascript; charset=utf-8",".svg":"image/svg+xml"},K=e=>{if(e.endsWith(".tar.gz")||e.endsWith(".tgz"))return"application/gzip";if(e.endsWith(".json")||/(^|\/)(versions|download)$/.test(e))return"application/json";let t=e.lastIndexOf(".");return t>e.lastIndexOf("/")&&H[e.slice(t).toLowerCase()]||"application/octet-stream"},j=e=>typeof e=="string"?e:new TextDecoder().decode(e);function _(e,t={}){return async n=>{let o=new URL(n.url),r=n.method.toUpperCase(),s=d=>(t.log?.(`${r} ${o.pathname} -> ${d.status}`),d);if(r!=="GET"&&r!=="HEAD")return s(new Response(null,{status:405,headers:{allow:"GET, HEAD"}}));let a;try{a=decodeURIComponent(o.pathname).replace(/^\/+/,"")}catch{return s(new Response(null,{status:400}))}if(!a||a.split("/").includes(".."))return s(new Response(null,{status:404}));let c=f(t.prefix,a),{body:i}=await e(c);if(i===void 0)return s(new Response(null,{status:404}));if(m(a)){let d=h(j(i));if(d){let p=g(d);return s(new Response(r==="HEAD"?null:p.body,{status:p.status,headers:p.headers}))}}let l=typeof i=="string"?new TextEncoder().encode(i):i,u={"content-type":K(c),"content-length":String(l.byteLength)};return s(new Response(r==="HEAD"?null:new Uint8Array(l),{status:200,headers:u}))}}var L="providers",k=e=>new RegExp(`(^|/)${L}/[^/]+/[^/]+/[^/]+/(?!index\\.json$)[^/]+\\.json$`).test(e.split("?")[0]);var x="expires",E="signature",R=300,y=new TextEncoder,F=e=>{let t="";for(let n of new Uint8Array(e))t+=String.fromCharCode(n);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")},C=async(e,t)=>{let n=await crypto.subtle.importKey("raw",y.encode(e),{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return F(await crypto.subtle.sign("HMAC",n,y.encode(t)))},I=(e,t)=>{let n=y.encode(e),o=y.encode(t),r=n.length^o.length;for(let s=0;s<Math.max(n.length,o.length);s++)r|=(n[s]??0)^(o[s]??0);return r===0},$=e=>e.signingKey||e.tokens.find(t=>!!t),b=(e,t)=>`${e}
+${t}`;async function O(e,t,n,o=R){let r=new URL(e),s=Math.floor(n/1e3)+o;return r.searchParams.delete(x),r.searchParams.delete(E),r.searchParams.set(x,String(s)),r.searchParams.set(E,await C(t,b(r.pathname,s))),r.toString()}async function Y(e,t,n){let o=Number(e.searchParams.get(x)),r=e.searchParams.get(E);return!r||!Number.isInteger(o)||o*1e3<n?!1:I(r,await C(t,b(e.pathname,o)))}function M(e,t){let n=/^Bearer\s+(.+)$/i.exec(e.headers.get("authorization")??"");if(!n)return!1;let o=n[1].trim(),r=!1;for(let s of t)s&&I(o,s)&&(r=!0);return r}var z=()=>new Response(`${JSON.stringify({errors:["a token is required: set TF_TOKEN_<host> or a credentials block for this host"]})}
+`,{status:401,headers:{"content-type":"application/json","www-authenticate":'Bearer realm="terraform-registry"'}}),P=(e,t)=>e.origin===t.origin&&/\.(tar\.gz|tgz|zip)$/.test(e.pathname);function N(e){let t=e.now??Date.now;return async n=>{let o=new URL(n.url),r=n.method.toUpperCase(),s=p=>(e.log?.(`${r} ${o.pathname} -> ${p.status}`),p),a=o.pathname.replace(/^\/+/,""),c=e.auth;if(c){let p=a===S||m(a)||/(^|\/)versions$/.test(a),w=M(n,c.tokens),A=$(c);if(!w&&!p&&A&&(w=await Y(o,A,t())),!w)return s(z())}if(r!=="GET"&&r!=="HEAD")return;if(c&&k(a))return W(n,o,a,e,c,t(),s);if(!m(a))return;let i;try{i=await e.files(f(e.prefix,a))}catch{return s(new Response(null,{status:502}))}if(i.body===void 0)return s(new Response(null,{status:404}));let l=h(typeof i.body=="string"?i.body:new TextDecoder().decode(i.body));if(!l)return;let u=c?$(c):void 0;if(c&&u){let p=new URL(l,o);P(p,o)&&(l=await O(p.toString(),u,t(),c.ttl))}let d=g(l);return s(new Response(r==="HEAD"?null:d.body,{status:d.status,headers:d.headers}))}}async function W(e,t,n,o,r,s,a){let c=$(r);if(!c)return;let i;try{i=await o.files(f(o.prefix,n))}catch{return a(new Response(null,{status:502}))}if(i.body===void 0)return a(new Response(null,{status:404}));let l;try{l=JSON.parse(typeof i.body=="string"?i.body:new TextDecoder().decode(i.body))}catch{return}for(let d of Object.values(l.archives??{})){if(!d||typeof d.url!="string")continue;let p=new URL(d.url,t);p.origin===t.origin&&(d.url=await O(p.toString(),c,s,r.ttl))}let u=`${JSON.stringify(l)}
+`;return a(new Response(e.method.toUpperCase()==="HEAD"?null:u,{status:200,headers:{"content-type":"application/json"}}))}function D(e){let t=N(e),n=_(e.files,{prefix:e.prefix,log:e.log});return async o=>await t(o)??n(o)}function v(e,t=(n,o)=>fetch(n,o)){let n=e.replace(/\/+$/,"");return async o=>{let r=await t(`${n}/${o.split("/").map(encodeURIComponent).join("/")}`,{method:"GET"});if(r.status===404||r.status===403)return{};if(!r.ok)throw new Error(`origin answered ${r.status}`);return{body:new Uint8Array(await r.arrayBuffer())}}}var T=e=>(e??"").split(/[\n,]/).map(t=>t.trim()).filter(t=>!!t);var J=e=>async t=>{let n=await e.get(t);return n?{body:new Uint8Array(await n.arrayBuffer())}:{}};function V(e){if((e.REGISTRY_AUTH??"").trim().toLowerCase()!=="token")return;let t=Number(e.REGISTRY_URL_TTL);return{tokens:T(e.REGISTRY_TOKENS),...e.REGISTRY_SIGNING_KEY?{signingKey:e.REGISTRY_SIGNING_KEY}:{},ttl:Number.isInteger(t)&&t>0?t:R}}async function q(e,t){let n=t.REGISTRY_BUCKET?J(t.REGISTRY_BUCKET):t.REGISTRY_ORIGIN?v(t.REGISTRY_ORIGIN):void 0;return n?D({files:n,prefix:t.REGISTRY_PREFIX,auth:V(t)})(e):new Response(`the registry worker needs a REGISTRY_BUCKET binding or REGISTRY_ORIGIN
+`,{status:500})}var B={fetch:q};var xe=new TextEncoder;export{B as default};

package/dist/report.schema.json

@@ -450,6 +450,16 @@
             "items": { "type": "string" },
             "description": "The roots whose on_failure: approve step failed: the gate holds the wave whatever the gate policy says, when it changes anything (minor 17)."
           },
+          "covered": {
+            "type": "object",
+            "required": ["digest", "filled_inputs"],
+            "additionalProperties": false,
+            "properties": {
+              "digest": { "type": "string", "description": "The set digest of the pull request's plan the wave's plan is covered by: its approval stands for the wave." },
+              "filled_inputs": { "type": "array", "items": { "type": "string" }, "description": "The inputs the pull request planned as known after apply, as <upstream>.<output>." }
+            },
+            "description": "A tf-apply wave that planned again after its upstreams applied, covered by the pull request's plan of the same roots (minor 49)."
+          },
           "cost": {
             "type": "object",
             "description": "The wave's monthly cost, when cost is on (minor 19): the sums over its roots estimated, and with cost.approve_above at base whether the change is over it, so the wave waits for an approval whatever the gate.",
@@ -592,7 +602,20 @@
       "description": "waves.compose (minor 38), on a tf-plan and on a tf-apply wave's report when the run's config turns it on: the roots it covers, and the wave that composes them or why the change applies in waves.",
       "required": ["roots", "max"],
       "properties": {
-        "roots": { "type": "array", "items": { "type": "string" }, "description": "The roots the change reaches plus the roots they read, followed upstream, sorted." },
+        "roots": { "type": "array", "items": { "type": "string" }, "description": "The roots the change reaches plus the roots they read, followed upstream, sorted. With left_out, the roots of the run only." },
+        "left_out": {
+          "type": "array",
+          "description": "The roots left out of a run that composes the rest (minor 50), each with its kind and reason: each applies in its own wave.",
+          "items": {
+            "type": "object",
+            "required": ["kind", "reason"],
+            "properties": {
+              "kind": { "type": "string" },
+              "root": { "type": "string" },
+              "reason": { "type": "string" }
+            }
+          }
+        },
         "max": { "type": "integer", "description": "waves.compose_max." },
         "wave": { "type": "integer", "description": "The wave whose run composes them. Absent when the change applies in waves." },
         "estate": { "const": true, "description": "Every root is a choudoufu estate, composed as one run (minor 48): no state is pulled, split or written back, and each estate's records are written as its resources apply." },