@intentius/terragucci 0.4.6 → 0.4.8

package/dist/terragucci.schema.json

@@ -57,10 +57,11 @@
     "gate": {
       "enum": [
         "always",
-        "on-destroy",
-        "never"
+        "on-destructive",
+        "never",
+        "on-destroy"
       ],
-      "description": "When a wave waits for an approval."
+      "description": "When a wave waits for an approval. on-destroy is an older name for on-destructive."
     },
     "approval": {
       "enum": [
@@ -121,6 +122,10 @@
               "pattern": "^[^\\s,;=']+$"
             }
           }
+        },
+        "point": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9-]*$"
         }
       },
       "additionalProperties": false,
@@ -986,6 +991,30 @@
       "additionalProperties": false,
       "description": "Policy checks over each plan."
     },
+    "sources": {
+      "type": "object",
+      "properties": {
+        "modules": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "pattern": "^[^\\s,;'\"]+$"
+          }
+        },
+        "providers": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "pattern": "^[^\\s,;'\"]+$"
+          }
+        }
+      },
+      "additionalProperties": false,
+      "minProperties": 1,
+      "description": "Globs of the module sources and provider addresses a root may use, checked before init."
+    },
     "atlantis_comments": {
       "type": "boolean",
       "description": "Read atlantis plan and atlantis apply comments as terragucci's."
@@ -1445,10 +1474,11 @@
         "gate": {
           "enum": [
             "always",
-            "on-destroy",
-            "never"
+            "on-destructive",
+            "never",
+            "on-destroy"
           ],
-          "description": "When a wave waits for an approval."
+          "description": "When a wave waits for an approval. on-destroy is an older name for on-destructive."
         },
         "approval": {
           "enum": [
@@ -1509,6 +1539,10 @@
                   "pattern": "^[^\\s,;=']+$"
                 }
               }
+            },
+            "point": {
+              "type": "string",
+              "pattern": "^[a-z][a-z0-9-]*$"
             }
           },
           "additionalProperties": false,
@@ -2366,6 +2400,30 @@
           "additionalProperties": false,
           "description": "Policy checks over each plan."
         },
+        "sources": {
+          "type": "object",
+          "properties": {
+            "modules": {
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "type": "string",
+                "pattern": "^[^\\s,;'\"]+$"
+              }
+            },
+            "providers": {
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "type": "string",
+                "pattern": "^[^\\s,;'\"]+$"
+              }
+            }
+          },
+          "additionalProperties": false,
+          "minProperties": 1,
+          "description": "Globs of the module sources and provider addresses a root may use, checked before init."
+        },
         "atlantis_comments": {
           "type": "boolean",
           "description": "Read atlantis plan and atlantis apply comments as terragucci's."

package/dist/types.d.ts

@@ -2,7 +2,15 @@ import { type GenerateSettings } from "./generate-config";
 export { ROOTS_NOT_ATMOS, ROOTS_NOT_TERRAGRUNT, SYNTH_DRIFT_PR, SYNTH_DRIFT_PR_SHORT, SYNTH_GENERATE, SYNTH_ROLLOUTS } from "./refusals";
 export declare const BINARIES: readonly ["terraform", "tofu", "choudoufu"];
 export declare const FORGES: readonly ["github", "gitlab", "forgejo"];
-export declare const GATES: readonly ["always", "on-destroy", "never"];
+export declare const GATES: readonly ["always", "on-destructive", "never"];
+/** Older spellings of a gate policy, still accepted from terragucci.yml and --gate: `on-destroy` is `on-destructive`. */
+export declare const GATE_ALIASES: {
+    readonly "on-destroy": "on-destructive";
+};
+/** Every gate name terragucci accepts: the policies and their older spellings. */
+export declare const GATE_NAMES: readonly GateName[];
+/** The policy a gate name means, or undefined when it names none. */
+export declare function normalizeGate(v: unknown): Gate | undefined;
 /**
  * What counts as the approval of a waiting wave (`approval:`). `ledger` (the
  * default): any `chant approve` of the wave's set digest on chant/lifecycle,
@@ -43,6 +51,8 @@ export declare const APPLY_REQUIRES: readonly ["approved", "mergeable", "undiver
 export type Binary = (typeof BINARIES)[number];
 export type ForgeName = (typeof FORGES)[number];
 export type Gate = (typeof GATES)[number];
+/** A gate as terragucci.yml or --gate may spell it: a policy, or an older name for one. */
+export type GateName = Gate | keyof typeof GATE_ALIASES;
 export type Approval = (typeof APPROVALS)[number];
 /**
  * `gitlab.token`: how a GitLab project keeps its forge token. `unprotected`
@@ -120,6 +130,14 @@ export interface ApplySettings {
      * here matches. Plain roots only, with `when: merge`.
      */
     branches?: Record<string, string[]>;
+    /**
+     * The workspace decision point every wave gate asks instead of waiting for
+     * `terragucci approve` (chant's "A gate that asks a decision point"). The
+     * point declares `gate.planDigest`, so each plan is its own question, and
+     * its deciders and quorum decide. Read at base, like `approval:`, which
+     * stays `ledger`.
+     */
+    point?: string;
 }
 /**
  * Policy as code, off unless set. `tf-plan` runs the engine over each planned
@@ -352,8 +370,8 @@ export interface ProjectSettings {
     forge?: ForgeName;
     /** Where the project lives, for a forge not on https or the default port. */
     url?: string;
-    /** When a wave waits for an approval. */
-    gate?: Gate;
+    /** When a wave waits for an approval. A loaded config holds the policy's current name: on-destroy reads as on-destructive. */
+    gate?: GateName;
     /** What counts as a waiting wave's approval; see APPROVALS. Read from the config at base, never the applied commit's own. */
     approval?: Approval;
     /** When a change applies; see ApplySettings. */
@@ -490,6 +508,8 @@ export interface ProjectSettings {
     atmos?: AtmosSettings;
     /** Opt-in policy checks over each plan; see PolicySettings. */
     policy?: PolicySettings;
+    /** The module and provider sources a root may use, checked before init; see SourcesSettings. Off when absent. */
+    sources?: SourcesSettings;
     /**
      * `atlantis plan` and `atlantis apply` comments read as `/terragucci plan`
      * and `/terragucci apply`. Off by default. The alias changes the words
@@ -612,7 +632,7 @@ export declare const BUILT_IN: ResolvedSettings;
  * own clone URL and `rollouts` belongs to a single repo, so `defaults`
  * refuses both.
  */
-export declare const PROJECT_FILE_KEYS: readonly ["policy", "reports", "approval", "gate", "roots", "waves", "parallelism", "synth", "steps", "drift", "cost", "tips", "runtime", "telemetry", "respond", "review", "decide", "audit_region", "modules", "terragrunt", "token_env", "generate", "ephemeral"];
+export declare const PROJECT_FILE_KEYS: readonly ["policy", "sources", "reports", "approval", "gate", "roots", "waves", "parallelism", "synth", "steps", "drift", "cost", "tips", "runtime", "telemetry", "respond", "review", "decide", "audit_region", "modules", "terragrunt", "token_env", "generate", "ephemeral"];
 export declare class ConfigError extends Error {
     /** Every problem found, when the error is a validation failure. */
     readonly problems?: string[];
@@ -629,6 +649,9 @@ export declare const RELEASE_VERSION: RegExp;
 /** The settings of `notify`, `policy`, `oidc`, `telemetry`, `gitlab`, `cost`, `pass` and `agent`. */
 export declare const NOTIFY_KEYS: string[];
 export declare const POLICY_KEYS: string[];
+export declare const SOURCES_KEYS: string[];
+/** One `sources` entry: a glob with no whitespace, commas, semicolons or quotes. */
+export declare const SOURCE_GLOB = "^[^\\s,;'\"]+$";
 export declare const OIDC_KEYS: string[];
 export declare const TELEMETRY_KEYS: string[];
 export declare const TOKEN_PROTECTION_KEYS: string[];
@@ -666,6 +689,18 @@ export interface ModulesSettings {
     /** Write each release as the Terraform module registry protocol, as static files a bucket or a Pages site serves. */
     registry?: RegistrySettings;
 }
+/**
+ * `sources`: the module and provider sources a root may use (./sources.ts).
+ * A list that is set refuses every source of its kind that no glob in it
+ * matches, before `init` downloads anything; a list that is not set checks
+ * nothing of its kind. Read at base, as `policy` is.
+ */
+export interface SourcesSettings {
+    /** Globs of module sources, as written and without their `?` query, such as `./**` for local paths. */
+    modules?: string[];
+    /** Globs of provider addresses, such as `hashicorp/*` or `registry.example.com/acme/*`. */
+    providers?: string[];
+}
 /** `modules.registry`: the module registry protocol as static files. */
 export interface RegistrySettings {
     /** The bucket the files go to: `s3://<bucket>`, `gs://<bucket>` or `az://<account>/<container>`. */
@@ -733,6 +768,8 @@ export declare const OWN_JOB_NAME: RegExp;
 export declare function ownJobsProblems(v: unknown, where: string): string[];
 export declare const EPHEMERAL_KEYS: string[];
 export declare const APPLY_KEYS: string[];
+/** A decision point's name, as chant's points file declares it. */
+export declare const POINT_NAME: RegExp;
 /** A branch name `apply.branches` may name: what a forge's rule and the job's shell both take as it is. */
 export declare const APPLY_BRANCH: RegExp;
 /** Why `apply.branches` is refused with `apply.when: pull-request`. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/terragucci",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "The whole Terraform lifecycle, handled: one config file, generated pipelines for GitHub, GitLab and Forgejo.",
   "license": "Apache-2.0",
   "type": "module",
@@ -34,7 +34,7 @@
     "build": "node ../../scripts/build-cli.mjs"
   },
   "dependencies": {
-    "@intentius/chant": "0.109.0"
+    "@intentius/chant": "0.124.18"
   },
   "peerDependencies": {
     "@intentius/tsad-reference": "2.x",
@@ -50,10 +50,10 @@
   },
   "devDependencies": {
     "@cdktn/hcl2json": "0.24.0",
-    "@intentius/chant-lexicon-forgejo": "0.109.0",
-    "@intentius/chant-lexicon-github": "0.109.0",
-    "@intentius/chant-lexicon-gitlab": "0.109.0",
-    "@intentius/chant-lexicon-terraform": "0.109.0",
+    "@intentius/chant-lexicon-forgejo": "0.124.18",
+    "@intentius/chant-lexicon-github": "0.124.18",
+    "@intentius/chant-lexicon-gitlab": "0.124.18",
+    "@intentius/chant-lexicon-terraform": "0.124.18",
     "@intentius/tsad-reference": "2.1.0",
     "@modelcontextprotocol/sdk": "1.30.1"
   }