@suss/contract-terraform 0.31.2 → 0.33.0

package/dist/index.cjs

@@ -33,6 +33,7 @@ __export(index_exports, {
   filterCalls: () => filterCalls,
   filterTerms: () => filterTerms,
   filterValuesFor: () => filterValuesFor,
+  jsonAttributeValue: () => jsonAttributeValue,
   parseFilterQuery: () => parseFilterQuery,
   terraformFileToSummaries: () => terraformFileToSummaries,
   terraformToSummaries: () => terraformToSummaries
@@ -40,10 +41,360 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 var import_node_fs = __toESM(require("fs"), 1);
 var import_node_path = __toESM(require("path"), 1);
-var import_hcl2_parser = __toESM(require("hcl2-parser"), 1);
 var import_semver = __toESM(require("semver"), 1);
 var import_behavioral_ir = require("@suss/behavioral-ir");
 
+// src/hclDocument.ts
+var import_hcl2_parser = __toESM(require("hcl2-parser"), 1);
+var WRAPPER = "value";
+function parseHclDocument(source) {
+  let read;
+  try {
+    const [parsed] = import_hcl2_parser.default.parseToObject(source);
+    read = parsed;
+  } catch {
+    return null;
+  }
+  return typeof read === "object" && read !== null && !Array.isArray(read) ? read : null;
+}
+function parseHclExpression(expression) {
+  return parseHclDocument(`${WRAPPER} = ${expression}`)?.[WRAPPER] ?? null;
+}
+
+// src/hclValue.ts
+function arrayOf(value) {
+  if (value === void 0 || value === null) {
+    return [];
+  }
+  return Array.isArray(value) ? value : [value];
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+function stringOf(value) {
+  return typeof value === "string" ? value : null;
+}
+function recordsIn(value) {
+  return arrayOf(value).map(asRecord).filter((record) => record !== null);
+}
+function mapStrings(value, leaf) {
+  if (typeof value === "string") {
+    return leaf(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => mapStrings(entry, leaf));
+  }
+  const record = asRecord(value);
+  if (record === null) {
+    return value;
+  }
+  return Object.fromEntries(
+    Object.entries(record).map(([name, entry]) => [
+      name,
+      mapStrings(entry, leaf)
+    ])
+  );
+}
+function someString(value, test) {
+  if (typeof value === "string") {
+    return test(value);
+  }
+  if (Array.isArray(value)) {
+    return value.some((entry) => someString(entry, test));
+  }
+  return Object.values(asRecord(value) ?? {}).some(
+    (entry) => someString(entry, test)
+  );
+}
+
+// src/mapValue.ts
+var WHOLE_INTERPOLATION = /^\$\{([\s\S]*)\}$/;
+var MERGE_CALL = /^merge\(([\s\S]*)\)$/;
+var LOCAL_MAP = /^local\.([A-Za-z_][\w-]*)$/;
+var VARIABLE_MAP = /^var\.([A-Za-z_][\w-]*)$/;
+var CHAIN_LIMIT = 4;
+var OPENERS = "([{";
+var CLOSERS = ")]}";
+function statedMap(value, scope) {
+  return mapFrom(value, scope, 0);
+}
+function mapFrom(value, scope, depth) {
+  if (depth > CHAIN_LIMIT) {
+    return null;
+  }
+  const record = asRecord(value);
+  if (record !== null) {
+    return record;
+  }
+  if (typeof value !== "string") {
+    return null;
+  }
+  const inner = WHOLE_INTERPOLATION.exec(value.trim());
+  return inner === null ? null : mapFromExpression(inner[1].trim(), scope, depth);
+}
+function mapFromExpression(expression, scope, depth) {
+  const merged = MERGE_CALL.exec(expression);
+  if (merged !== null) {
+    return mergedMaps(splitArguments(merged[1]), scope, depth);
+  }
+  const local = LOCAL_MAP.exec(expression);
+  if (local !== null) {
+    return mapFrom(scope.locals[local[1]], scope, depth + 1);
+  }
+  const variable = VARIABLE_MAP.exec(expression);
+  if (variable !== null) {
+    const name = variable[1];
+    return mapFrom(scope.arguments[name], scope, depth + 1) ?? mapFrom(scope.defaults[name], scope, depth + 1);
+  }
+  return null;
+}
+function mergedMaps(argumentTexts, scope, depth) {
+  const merged = {};
+  for (const text of argumentTexts) {
+    const stated = mapFrom(parseHclExpression(text), scope, depth + 1);
+    if (stated === null) {
+      return null;
+    }
+    Object.assign(merged, stated);
+  }
+  return merged;
+}
+function splitArguments(text) {
+  const found = [];
+  let depth = 0;
+  let quoted = false;
+  let start = 0;
+  for (let at = 0; at < text.length; at += 1) {
+    const character = text[at];
+    if (quoted) {
+      quoted = character !== '"' || text[at - 1] === "\\";
+      continue;
+    }
+    if (character === '"') {
+      quoted = true;
+    } else if (OPENERS.includes(character)) {
+      depth += 1;
+    } else if (CLOSERS.includes(character)) {
+      depth -= 1;
+    } else if (character === "," && depth === 0) {
+      found.push(text.slice(start, at));
+      start = at + 1;
+    }
+  }
+  found.push(text.slice(start));
+  return found.map((argument) => argument.trim()).filter((argument) => argument.length > 0);
+}
+
+// src/references.ts
+var SUB_TOKEN = /\$\{([^}]*)\}/g;
+function replaceInterpolations(text, settle) {
+  return text.replace(
+    SUB_TOKEN,
+    (written, inner) => settle(inner.trim()) ?? written
+  );
+}
+function interpolatedReferences(text) {
+  return [...text.matchAll(SUB_TOKEN)].map(
+    (match) => match[1].trim()
+  );
+}
+var RESOURCE_ATTRIBUTE = /^([A-Za-z][\w-]*)\.([A-Za-z_][\w-]*)\.([A-Za-z_][\w-]*)$/;
+var WHOLE_REFERENCE = /^\$\{([^}]*)\}$/;
+var LOCAL_VALUE = /^local\.([A-Za-z_][\w-]*)$/;
+var VARIABLE_VALUE = /^var\.([A-Za-z_][\w-]*)$/;
+var CHAIN_LIMIT2 = 4;
+function referenceScope(opts) {
+  const resources = /* @__PURE__ */ new Map();
+  for (const [resourceType, label, body] of opts.resources) {
+    const address = `${resourceType}.${label}`;
+    if (!resources.has(address)) {
+      resources.set(address, body);
+    }
+  }
+  return {
+    resources,
+    locals: firstOfEach(opts.locals ?? []),
+    arguments: opts.arguments ?? {},
+    defaults: opts.defaults ?? {},
+    namePrefix: opts.namePrefix ?? ""
+  };
+}
+function firstOfEach(blocks) {
+  const stated = {};
+  for (const block of blocks) {
+    for (const [name, value] of Object.entries(block)) {
+      if (!(name in stated)) {
+        stated[name] = value;
+      }
+    }
+  }
+  return stated;
+}
+function referencedResource(value, scope) {
+  const whole = WHOLE_REFERENCE.exec(value.trim());
+  if (whole === null) {
+    return null;
+  }
+  const parsed = RESOURCE_ATTRIBUTE.exec(whole[1].trim());
+  if (parsed === null) {
+    return null;
+  }
+  const [, resourceType, label] = parsed;
+  return scope.resources.has(`${resourceType}.${label}`) ? `${scope.namePrefix}${label}` : null;
+}
+function resolveReferences(value, scope) {
+  return expand(value, scope, []) ?? value;
+}
+function expand(value, scope, resolving) {
+  let cycled = false;
+  const expandOne = (reference) => {
+    if (resolving.includes(reference)) {
+      cycled = true;
+      return null;
+    }
+    const stated = statedValue(reference, scope);
+    if (stated === null || resolving.length >= CHAIN_LIMIT2) {
+      return null;
+    }
+    const nested = expand(stated, scope, [...resolving, reference]);
+    if (nested === null) {
+      cycled = true;
+      return null;
+    }
+    return nested;
+  };
+  const expanded = replaceInterpolations(value, expandOne);
+  return cycled ? null : expanded;
+}
+function statedValue(reference, scope) {
+  const local = LOCAL_VALUE.exec(reference);
+  if (local !== null) {
+    return stringOrNull(scope.locals[local[1]]);
+  }
+  const variable = VARIABLE_VALUE.exec(reference);
+  if (variable !== null) {
+    return stringOrNull(scope.arguments[variable[1]]);
+  }
+  const parsed = RESOURCE_ATTRIBUTE.exec(reference);
+  if (parsed === null) {
+    return null;
+  }
+  const [, resourceType, label, attribute] = parsed;
+  return stringOrNull(
+    scope.resources.get(`${resourceType}.${label}`)?.[attribute]
+  );
+}
+function stringOrNull(value) {
+  return typeof value === "string" ? value : null;
+}
+
+// src/blockExpansion.ts
+var DYNAMIC = "dynamic";
+var BARE_NAME = /^\$\{([A-Za-z_][\w-]*)\}$/;
+var FOR_EXPRESSION = /^\$\{\s*\[\s*for\s+([A-Za-z_]\w*)\s*,\s*([A-Za-z_]\w*)\s+in\s+([^:]+):([\s\S]*)\]\s*\}$/;
+function dynamicBlocks(body, block, scope) {
+  const written = [];
+  const labelled = arrayOf(body[DYNAMIC]).flatMap(
+    (entry) => recordsIn(asRecord(entry)?.[block])
+  );
+  for (const declared of labelled) {
+    const stated = statedMap(declared.for_each, scope);
+    if (stated === null) {
+      continue;
+    }
+    const iterator = iteratorName(declared, block);
+    for (const [key, value] of Object.entries(stated)) {
+      const settle = entrySettle(iterator, key, value);
+      for (const content of recordsIn(declared.content)) {
+        written.push(...filledBlock(content, settle, [iterator]));
+      }
+    }
+  }
+  return written;
+}
+function filledBlock(content, settle, iterators) {
+  const filled = substituted(content, settle);
+  return mentions(filled, iterators) ? [] : [filled];
+}
+function iteratedRecords(value, scope) {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const parsed = FOR_EXPRESSION.exec(value.trim());
+  if (parsed === null) {
+    return null;
+  }
+  const [, keyName, valueName, collection, body] = parsed;
+  const stated = statedMap(`\${${collection.trim()}}`, scope);
+  if (stated === null) {
+    return null;
+  }
+  const template = parseBody(body);
+  if (template === null) {
+    return null;
+  }
+  return Object.entries(stated).flatMap(
+    ([key, entry]) => filledBlock(
+      template,
+      pairSettle(keyName, valueName, key, entry),
+      [keyName, valueName]
+    )
+  );
+}
+function parseBody(body) {
+  const trimmed = body.trim();
+  return trimmed.startsWith("{") ? asRecord(parseHclExpression(trimmed)) : null;
+}
+function iteratorName(declared, block) {
+  const stated = declared.iterator;
+  if (typeof stated !== "string") {
+    return block;
+  }
+  const bare = BARE_NAME.exec(stated.trim());
+  return bare === null ? block : bare[1];
+}
+function entrySettle(iterator, key, value) {
+  return (reference) => {
+    const steps = reference.split(".");
+    if (steps[0] !== iterator) {
+      return null;
+    }
+    if (steps.length === 2 && steps[1] === "key") {
+      return key;
+    }
+    return steps[1] === "value" ? fieldOf(value, steps.slice(2)) : null;
+  };
+}
+function pairSettle(keyName, valueName, key, value) {
+  return (reference) => {
+    const steps = reference.split(".");
+    if (steps.length === 1 && steps[0] === keyName) {
+      return key;
+    }
+    return steps[0] === valueName ? fieldOf(value, steps.slice(1)) : null;
+  };
+}
+function fieldOf(value, steps) {
+  if (steps.length === 0) {
+    return typeof value === "string" ? value : null;
+  }
+  if (steps.length > 1) {
+    return null;
+  }
+  const field = asRecord(value)?.[steps[0]];
+  return typeof field === "string" ? field : null;
+}
+function substituted(value, settle) {
+  const fill = (text) => replaceInterpolations(text, settle);
+  return mapStrings(value, fill);
+}
+function mentions(value, iterators) {
+  const mentionsOne = (text) => interpolatedReferences(text).some(
+    (reference) => iterators.includes(reference.split(".")[0] ?? "")
+  );
+  return someString(value, mentionsOne);
+}
+
 // src/filterQuery.ts
 var OPERATORS = ["!=", ">=", "<=", "=", ">", "<", ":"];
 var KEYWORDS = /* @__PURE__ */ new Set(["AND", "OR", "NOT"]);
@@ -305,96 +656,147 @@ var TokenReader = class {
   }
 };
 
-// src/references.ts
-var SUB_TOKEN = /\$\{([^}]*)\}/g;
-var RESOURCE_ATTRIBUTE = /^([A-Za-z][\w-]*)\.([A-Za-z_][\w-]*)\.([A-Za-z_][\w-]*)$/;
-var LOCAL_VALUE = /^local\.([A-Za-z_][\w-]*)$/;
-var LOCALS = "local";
-var CHAIN_LIMIT = 4;
-function referenceScope(resources, locals = []) {
-  const scope = /* @__PURE__ */ new Map();
-  for (const [resourceType, label, body] of resources) {
-    const address = `${resourceType}.${label}`;
-    if (!scope.has(address)) {
-      scope.set(address, body);
-    }
+// src/jsonAttribute.ts
+var JSON_ENCODE = /^\$\{\s*jsonencode\((.*)\)\s*\}$/s;
+function jsonAttributeValue(value) {
+  if (typeof value !== "string") {
+    return null;
   }
-  const stated = {};
-  for (const block of locals) {
-    for (const [name, value] of Object.entries(block)) {
-      if (!(name in stated)) {
-        stated[name] = value;
-      }
-    }
+  const literal = parseJson(value);
+  if (literal !== null) {
+    return literal;
   }
-  scope.set(LOCALS, stated);
-  return scope;
-}
-function resolveReferences(value, scope) {
-  return expand(value, scope, []) ?? value;
-}
-function expand(value, scope, resolving) {
-  let cycled = false;
-  const expanded = value.replace(SUB_TOKEN, (written, inner) => {
-    const reference = inner.trim();
-    if (resolving.includes(reference)) {
-      cycled = true;
-      return written;
-    }
-    const stated = statedValue(reference, scope);
-    if (stated === null || resolving.length >= CHAIN_LIMIT) {
-      return written;
-    }
-    const nested = expand(stated, scope, [...resolving, reference]);
-    if (nested === null) {
-      cycled = true;
-      return written;
-    }
-    return nested;
-  });
-  return cycled ? null : expanded;
+  const encoded = JSON_ENCODE.exec(value);
+  return encoded === null ? null : parseHclExpression(encoded[1]);
 }
-function statedValue(reference, scope) {
-  const local = LOCAL_VALUE.exec(reference);
-  if (local !== null) {
-    const stated2 = scope.get(LOCALS)?.[local[1]];
-    return typeof stated2 === "string" ? stated2 : null;
-  }
-  const parsed = RESOURCE_ATTRIBUTE.exec(reference);
-  if (parsed === null) {
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
     return null;
   }
-  const [, resourceType, label, attribute] = parsed;
-  const stated = scope.get(`${resourceType}.${label}`)?.[attribute];
-  return typeof stated === "string" ? stated : null;
 }
 
 // src/index.ts
 function terraformToSummaries(source, sourceFile, options) {
-  return summariesForFiles([{ source, sourceFile }], options);
+  return moduleSummaries(
+    moduleOf({
+      files: [{ source, sourceFile }],
+      directory: import_node_path.default.dirname(sourceFile),
+      namePrefix: "",
+      arguments: {},
+      ancestors: []
+    }),
+    options
+  );
 }
 function terraformFileToSummaries(target, options) {
-  const files = import_node_fs.default.statSync(target).isDirectory() ? import_node_fs.default.readdirSync(target).filter((name) => name.endsWith(".tf")).map((name) => import_node_path.default.join(target, name)) : [target];
-  return summariesForFiles(
-    files.map((file) => ({
-      source: import_node_fs.default.readFileSync(file, "utf8"),
-      sourceFile: file
-    })),
+  const directory = import_node_fs.default.statSync(target).isDirectory() ? target : import_node_path.default.dirname(target);
+  const files = import_node_fs.default.statSync(target).isDirectory() ? sourceFilesIn(target) : [readSourceFile(target)];
+  return moduleSummaries(
+    moduleOf({
+      files,
+      directory,
+      namePrefix: "",
+      arguments: {},
+      ancestors: [directory]
+    }),
     options
   );
 }
-function summariesForFiles(files, options) {
-  const parsed = files.map((file) => parseSource(file)).filter((file) => file !== null);
-  const scope = referenceScope(
-    parsed.flatMap((file) => file.resources),
-    parsed.flatMap((file) => file.locals)
-  );
+var LOCAL_SOURCE = /^\.\.?[/\\]/;
+var MODULE_SOURCE = "source";
+var MODULE_DEPTH_LIMIT = 8;
+function sourceFilesIn(directory) {
+  return import_node_fs.default.readdirSync(directory).filter((name) => name.endsWith(".tf")).map((name) => readSourceFile(import_node_path.default.join(directory, name)));
+}
+function readSourceFile(file) {
+  return { source: import_node_fs.default.readFileSync(file, "utf8"), sourceFile: file };
+}
+function moduleOf(opts) {
+  const files = opts.files.map((file) => parseSource(file)).filter((file) => file !== null);
+  const scope = referenceScope({
+    resources: files.flatMap((file) => file.resources),
+    locals: files.flatMap((file) => file.locals),
+    defaults: Object.assign({}, ...files.map((file) => file.defaults)),
+    arguments: opts.arguments,
+    namePrefix: opts.namePrefix
+  });
+  const children = [];
+  for (const [label, call] of files.flatMap((file) => file.modules)) {
+    const child = childModule({ ...opts, scope, label, call });
+    if (child === null) {
+      continue;
+    }
+    children.push(child);
+    scope.resources.set(`module.${label}`, outputValues(child));
+  }
+  return { files, scope, children };
+}
+function childModule(opts) {
+  const source = stringOf(opts.call[MODULE_SOURCE]);
+  if (source === null || !LOCAL_SOURCE.test(source)) {
+    return null;
+  }
+  const directory = import_node_path.default.resolve(opts.directory, source);
+  if (opts.ancestors.includes(directory) || opts.ancestors.length >= MODULE_DEPTH_LIMIT || !isDirectory(directory)) {
+    return null;
+  }
+  return moduleOf({
+    files: sourceFilesIn(directory),
+    directory,
+    namePrefix: `${opts.namePrefix}module.${opts.label}.`,
+    arguments: passedArguments(opts.call, opts.scope),
+    ancestors: [...opts.ancestors, directory]
+  });
+}
+function isDirectory(target) {
+  return import_node_fs.default.existsSync(target) && import_node_fs.default.statSync(target).isDirectory();
+}
+function passedArguments(call, parent) {
+  const passed = {};
+  for (const [name, value] of Object.entries(call)) {
+    if (name === MODULE_SOURCE) {
+      continue;
+    }
+    const stated = asRecord(value);
+    if (stated !== null) {
+      passed[name] = resolvedThroughout(stated, parent);
+      continue;
+    }
+    const written = stringOf(value);
+    const settled = written === null ? null : resolveReferences(written, parent);
+    if (settled !== null && !settled.includes("${")) {
+      passed[name] = settled;
+    }
+  }
+  return passed;
+}
+function resolvedThroughout(value, scope) {
+  const resolveHere = (text) => resolveReferences(text, scope);
+  return mapStrings(value, resolveHere);
+}
+function outputValues(child) {
+  const stated = {};
+  for (const [name, value] of child.files.flatMap((file) => file.outputs)) {
+    const written = stringOf(value);
+    if (written === null || name in stated) {
+      continue;
+    }
+    const settled = resolveReferences(written, child.scope);
+    if (!settled.includes("${")) {
+      stated[name] = settled;
+    }
+  }
+  return stated;
+}
+function moduleSummaries(module2, options) {
   const summaries = [];
-  for (const file of parsed) {
+  for (const file of module2.files) {
     for (const [resourceType, label, body] of file.resources) {
       for (const pack of options.packs) {
-        const pattern = patternFor(pack, resourceType, file.constraints);
-        if (pattern === void 0 || !entryApplies(pattern, body)) {
+        const pattern = patternFor(pack, resourceType, file.constraints, body);
+        if (pattern === void 0) {
           continue;
         }
         summaries.push(
@@ -404,23 +806,20 @@ function summariesForFiles(files, options) {
             body,
             sourceFile: file.sourceFile,
             resourceType,
-            scope
+            scope: module2.scope,
+            options
           })
         );
       }
     }
   }
+  for (const child of module2.children) {
+    summaries.push(...moduleSummaries(child, options));
+  }
   return summaries;
 }
 function parseSource(file) {
-  let read;
-  try {
-    const [parsed] = import_hcl2_parser.default.parseToObject(file.source);
-    read = parsed;
-  } catch {
-    return null;
-  }
-  const document = asRecord(read);
+  const document = parseHclDocument(file.source);
   if (document === null) {
     return null;
   }
@@ -428,9 +827,43 @@ function parseSource(file) {
     sourceFile: file.sourceFile,
     constraints: providerConstraints(document),
     resources: resourcesIn(document),
-    locals: localsIn(document)
+    locals: localsIn(document),
+    defaults: variableDefaults(document),
+    modules: labelledBlocks(document.module),
+    outputs: labelledBlocks(document.output).map(([name, block]) => [
+      name,
+      block.value
+    ])
   };
 }
+function labelledBlocks(declared) {
+  const found = [];
+  for (const group of arrayOf(declared)) {
+    for (const [label, bodies] of Object.entries(asRecord(group) ?? {})) {
+      for (const body of arrayOf(bodies)) {
+        const read = asRecord(body);
+        if (read !== null) {
+          found.push([label, read]);
+        }
+      }
+    }
+  }
+  return found;
+}
+function variableDefaults(document) {
+  const defaults = {};
+  for (const group of arrayOf(document.variable)) {
+    for (const [name, declared] of Object.entries(asRecord(group) ?? {})) {
+      for (const block of arrayOf(declared)) {
+        const stated = asRecord(block)?.default;
+        if (stated !== void 0 && !(name in defaults)) {
+          defaults[name] = stated;
+        }
+      }
+    }
+  }
+  return defaults;
+}
 function providerConstraints(document) {
   const constraints = /* @__PURE__ */ new Map();
   for (const block of arrayOf(document.terraform)) {
@@ -451,23 +884,21 @@ function providerConstraints(document) {
   }
   return constraints;
 }
-function patternFor(pack, resourceType, constraints) {
+function patternFor(pack, resourceType, constraints, body) {
   const pinned = constraints.get(pack.provider);
-  return pack.resources.find((pattern) => {
-    if (pattern.resource !== resourceType) {
-      return false;
-    }
-    if (pinned === void 0) {
-      return true;
-    }
-    try {
-      return import_semver.default.intersects(pinned, pattern.providerVersions, {
-        loose: true
-      });
-    } catch {
-      return true;
-    }
-  });
+  return pack.resources.find(
+    (pattern) => pattern.resource === resourceType && versionAllows(pinned, pattern.providerVersions) && entryApplies(pattern, body)
+  );
+}
+function versionAllows(pinned, providerVersions) {
+  if (pinned === void 0) {
+    return true;
+  }
+  try {
+    return import_semver.default.intersects(pinned, providerVersions, { loose: true });
+  } catch {
+    return true;
+  }
 }
 function entryApplies(pattern, body) {
   const gate = pattern.appliesWhen;
@@ -479,7 +910,7 @@ function entryApplies(pattern, body) {
     return gate.whenUnset === "read";
   }
   const text = stringOf(value);
-  return text !== null && gate.equals.includes(text);
+  return text !== null && (gate.equals ?? []).includes(text);
 }
 var READERS = {
   storage: (site, boundary) => {
@@ -490,7 +921,8 @@ var READERS = {
   },
   "message-bus": (site, boundary) => [busSummary({ ...site, boundary })],
   metric: (site, boundary) => [metricSummary({ ...site, boundary })],
-  "metric-reading": (site, boundary) => readingSummaries({ ...site, boundary })
+  "metric-reading": (site, boundary) => readingSummaries({ ...site, boundary }),
+  deployable: (site, boundary) => deployableSummaries({ ...site, boundary })
 };
 function summariesFor(opts) {
   const { pattern, ...site } = opts;
@@ -499,9 +931,11 @@ function summariesFor(opts) {
 }
 function storageSummary(opts) {
   const { boundary, label, shape, types } = opts;
-  const address = `${opts.resourceType}.${label}`;
+  const address = `${opts.scope.namePrefix}${opts.resourceType}.${label}`;
+  const storageSystem = storageSystemOf(opts.body, boundary, opts.scope);
   const declaresContainer = boundary.declares !== "store";
   const physicalTable = !declaresContainer || boundary.nameAttribute === void 0 ? null : namePattern(opts.body[boundary.nameAttribute], opts.scope);
+  const listedFields = jsonFields(opts.body, boundary);
   return {
     kind: "library",
     location: {
@@ -514,35 +948,102 @@ function storageSummary(opts) {
       exportPath: null,
       boundaryBinding: (0, import_behavioral_ir.storageBinding)({
         recognition: "terraform",
-        storageSystem: boundary.storageSystem,
+        storageSystem,
         ...boundary.transport !== void 0 ? { transport: boundary.transport } : {},
-        scope: "default",
+        scope: containerScope(opts.body, boundary, opts.scope),
         container: declaresContainer ? label : null,
         accessPath: shape.accessPath
       })
     },
     inputs: [],
     transitions: [],
-    gaps: [],
+    gaps: unknownEngineGaps(storageSystem, boundary),
     confidence: { source: "declared", level: "high" },
     metadata: {
       storageContract: {
-        // A way in that copies part of an item has every field it will
-        // ever have, whatever the container itself stores.
-        fieldSet: shape.serves === null ? boundary.fieldSet : "exhaustive",
-        ...boundary.identifies === void 0 ? {} : {
-          identifies: { kind: "keyFields", fields: shape.keyFields },
-          fields: (shape.serves ?? shape.keyFields).map((field) => ({
-            name: field,
-            ...types.has(field) ? { type: types.get(field) } : {},
-            ...shape.keyFields.includes(field) ? { primary: true } : {}
-          }))
-        },
+        fieldSet: declaredFieldSet(boundary, shape, listedFields),
+        ...contractFields(boundary, shape, types, listedFields),
         ...physicalTable !== null ? { physicalTable } : {}
       }
     }
   };
 }
+function storageSystemOf(body, boundary, scope) {
+  const spec = boundary.storageSystem;
+  if (typeof spec === "string") {
+    return spec;
+  }
+  return meaningOf(body, spec, scope) ?? null;
+}
+function unknownEngineGaps(storageSystem, boundary) {
+  const spec = boundary.storageSystem;
+  if (storageSystem !== null || typeof spec === "string") {
+    return [];
+  }
+  return [
+    {
+      type: "unreadOutcome",
+      conditions: [],
+      consequence: "unknown",
+      description: `"${spec.attribute}" states an engine this run could not settle, so which store this is stays unknown and it pairs with an access on any engine.`
+    }
+  ];
+}
+function contractFields(boundary, shape, types, listedFields) {
+  if (boundary.identifies !== void 0) {
+    return {
+      identifies: { kind: "keyFields", fields: shape.keyFields },
+      fields: (shape.serves ?? shape.keyFields).map((field) => ({
+        name: field,
+        ...types.has(field) ? { type: types.get(field) } : {},
+        ...shape.keyFields.includes(field) ? { primary: true } : {}
+      }))
+    };
+  }
+  return listedFields === null ? {} : { fields: listedFields };
+}
+function declaredFieldSet(boundary, shape, listedFields) {
+  if (shape.serves !== null) {
+    return "exhaustive";
+  }
+  return listedFields === null ? boundary.fieldSet : "exhaustive";
+}
+function jsonFields(body, boundary) {
+  const spec = boundary.fieldsFromJson;
+  if (spec === void 0) {
+    return null;
+  }
+  const stated = jsonAttributeValue(valueAt(body, spec.attribute));
+  if (!Array.isArray(stated)) {
+    return null;
+  }
+  const fields = stated.flatMap((entry) => {
+    const field = asRecord(entry);
+    const name = field === null ? null : stringOf(field[spec.nameKey]);
+    if (field === null || name === null) {
+      return [];
+    }
+    const type = spec.typeKey === void 0 ? null : stringOf(field[spec.typeKey]);
+    return [
+      {
+        name,
+        ...type !== null ? { type } : {},
+        ...spec.requires === void 0 ? {} : { nullable: !alwaysSet(field, spec.requires) }
+      }
+    ];
+  });
+  return fields.length === 0 ? null : fields;
+}
+function alwaysSet(field, requires) {
+  const stated = stringOf(field[requires.key]);
+  return stated !== null && requires.values.includes(stated);
+}
+function containerScope(body, boundary, scope) {
+  if (boundary.scopeAttribute === void 0) {
+    return "default";
+  }
+  return namePattern(valueAt(body, boundary.scopeAttribute), scope) ?? "default";
+}
 function busSummary(opts) {
   const { boundary, label } = opts;
   const physicalName = boundary.nameAttribute === void 0 ? null : namePattern(opts.body[boundary.nameAttribute], opts.scope);
@@ -554,7 +1055,7 @@ function busSummary(opts) {
       exportName: null
     },
     identity: {
-      name: `${opts.resourceType}.${label}`,
+      name: `${opts.scope.namePrefix}${opts.resourceType}.${label}`,
       exportPath: null,
       boundaryBinding: (0, import_behavioral_ir.messageBusBinding)({
         recognition: "terraform",
@@ -575,14 +1076,26 @@ function busSummary(opts) {
     }
   };
 }
-var NAME_HOLE = "{name}";
+var TEMPLATE_HOLE = /\{([^{}]+)\}/g;
+function metricTypeFrom(template, body, scope) {
+  let missing = false;
+  const spelled = template.replace(TEMPLATE_HOLE, (_whole, path2) => {
+    const stated = namePattern(valueAt(body, path2), scope);
+    if (stated === null) {
+      missing = true;
+      return "";
+    }
+    return stated;
+  });
+  return missing ? null : spelled;
+}
 function metricSummary(opts) {
   const { boundary } = opts;
-  const declaredName = namePattern(
-    opts.body[boundary.nameAttribute],
+  const metricType = metricTypeFrom(
+    boundary.metricTypeTemplate,
+    opts.body,
     opts.scope
   );
-  const metricType = declaredName === null ? null : boundary.metricTypeTemplate.replace(NAME_HOLE, declaredName);
   return {
     kind: "library",
     location: {
@@ -591,7 +1104,7 @@ function metricSummary(opts) {
       exportName: null
     },
     identity: {
-      name: `${opts.resourceType}.${opts.label}`,
+      name: `${opts.scope.namePrefix}${opts.resourceType}.${opts.label}`,
       exportPath: null,
       boundaryBinding: (0, import_behavioral_ir.metricBinding)({
         recognition: "terraform",
@@ -603,12 +1116,14 @@ function metricSummary(opts) {
     transitions: [],
     gaps: [],
     confidence: { source: "declared", level: "high" },
-    metadata: { metricContract: metricContract(opts.body, boundary) }
+    metadata: {
+      metricContract: metricContract(opts.body, boundary, opts.scope)
+    }
   };
 }
-function metricContract(body, boundary) {
-  const values = meaningOf(body, boundary.values);
-  const accumulates = meaningOf(body, boundary.accumulates);
+function metricContract(body, boundary, scope) {
+  const values = meaningOf(body, boundary.values, scope);
+  const accumulates = meaningOf(body, boundary.accumulates, scope);
   return {
     ...values !== void 0 ? { values } : {},
     ...accumulates !== void 0 ? { accumulates } : {}
@@ -617,11 +1132,14 @@ function metricContract(body, boundary) {
 function readingSummaries(opts) {
   const { boundary } = opts;
   const summaries = [];
-  for (const reading of blocksAt(opts.body, boundary.readingBlocks)) {
-    const query = stringOf(valueAt(reading, boundary.queryAttribute));
-    for (const metricType of metricTypesIn(
-      query,
-      boundary.queryIdentityKey,
+  for (const reading of blocksAt(
+    opts.body,
+    boundary.readingBlocks,
+    opts.scope
+  )) {
+    for (const metricType of metricsRead(
+      reading,
+      boundary.identifies,
       opts.scope
     )) {
       summaries.push({
@@ -632,7 +1150,7 @@ function readingSummaries(opts) {
           exportName: null
         },
         identity: {
-          name: `${opts.resourceType}.${opts.label}#${summaries.length}`,
+          name: `${opts.scope.namePrefix}${opts.resourceType}.${opts.label}#${summaries.length}`,
           exportPath: null,
           boundaryBinding: (0, import_behavioral_ir.metricBinding)({
             recognition: "terraform",
@@ -644,12 +1162,28 @@ function readingSummaries(opts) {
         transitions: [],
         gaps: [],
         confidence: { source: "declared", level: "high" },
-        metadata: { metricReading: metricReading(reading, boundary) }
+        metadata: {
+          metricReading: metricReading(reading, boundary, opts.scope)
+        }
       });
     }
   }
   return summaries;
 }
+var READING_IDENTITIES = {
+  attributes: (reading, identity, scope) => [
+    metricTypeFrom(identity.template, reading, scope)
+  ],
+  query: (reading, identity, scope) => metricTypesIn(
+    stringOf(valueAt(reading, identity.attribute)),
+    identity.key,
+    scope
+  )
+};
+function metricsRead(reading, identity, scope) {
+  const read = READING_IDENTITIES[identity.from];
+  return read(reading, identity, scope);
+}
 function metricTypesIn(query, identityKey, scope) {
   if (query === null) {
     return [null];
@@ -661,23 +1195,212 @@ function metricTypesIn(query, identityKey, scope) {
   const found = filterValuesFor(parsed.query, identityKey).map((value) => namePattern(value, scope)).filter((value) => value !== null);
   return found.length === 0 ? [null] : found;
 }
-function metricReading(reading, boundary) {
+function metricReading(reading, boundary, scope) {
   const compares = boundary.comparesTo;
   const comparesTo = compares !== void 0 && valueAt(reading, compares.attribute) !== void 0 ? compares.whenSet : void 0;
   const reduces = boundary.reducesTo;
-  const reducesTo = meaningOf(reading, reduces);
+  const reducesTo = meaningOf(reading, reduces, scope);
   return {
     ...comparesTo !== void 0 ? { comparesTo } : {},
     ...reducesTo !== void 0 ? { reducesTo } : {},
     ...reduces === void 0 ? {} : { reduction: { setting: reduces.attribute, leaves: reduces.means } }
   };
 }
-function meaningOf(body, spec) {
+function deployableSummaries(opts) {
+  const { boundary, label } = opts;
+  return deployedProcesses(opts.body, boundary, opts.scope).map(
+    (process) => deployableSummary({
+      ...opts,
+      boundary,
+      process,
+      instanceName: process.containerName === null ? label : (0, import_behavioral_ir.ecsContainerInstanceName)(label, process.containerName)
+    })
+  );
+}
+function deployableSummary(opts) {
+  const { boundary, instanceName, process } = opts;
+  const declared = declaredEnv(process.body, boundary.env ?? [], opts.scope);
+  const platform = boundary.platformEnvVars ?? import_behavioral_ir.PLATFORM_INJECTED_ENV_VARS[boundary.deploymentTarget];
+  const code = codePointer(process.body, boundary, opts.scope);
+  const image = attributePattern(
+    process.body,
+    boundary.code?.imageAttribute,
+    opts.scope
+  );
+  const runtime = attributePattern(
+    process.body,
+    boundary.runtimeAttribute,
+    opts.scope
+  );
+  const prefix = opts.scope.namePrefix;
+  const deployableUnit = {
+    deploymentTarget: boundary.deploymentTarget,
+    instanceName: `${prefix}${instanceName}`
+  };
+  return {
+    kind: "library",
+    location: {
+      file: opts.sourceFile,
+      range: { start: 1, end: 1 },
+      exportName: null
+    },
+    identity: {
+      name: `${prefix}${opts.resourceType}.${instanceName.replace("/", "#")}`,
+      exportPath: null,
+      boundaryBinding: (0, import_behavioral_ir.runtimeConfigBinding)({
+        recognition: "terraform",
+        ...deployableUnit
+      }),
+      deployableUnit
+    },
+    inputs: [],
+    transitions: [],
+    gaps: [],
+    confidence: { source: "declared", level: "high" },
+    metadata: (0, import_behavioral_ir.withRuntimeContractMetadata)(
+      {
+        codeScope: declaredCodeScope(
+          opts.options.codeScopes?.[deployableUnit.instanceName],
+          code.entry
+        )
+      },
+      {
+        envVars: [.../* @__PURE__ */ new Set([...declared.names, ...platform])].sort(),
+        envVarSources: envVarSources(declared.names, platform),
+        ...Object.keys(declared.targets).length > 0 ? { envVarTargets: declared.targets } : {},
+        ...Object.keys(declared.values).length > 0 ? { envVarValues: declared.values } : {},
+        ...code.entryPoint !== null ? { entryPoint: code.entryPoint } : {},
+        ...image !== null ? { image } : {},
+        ...runtime !== null ? { runtime } : {}
+      }
+    )
+  };
+}
+function declaredCodeScope(directory, entry) {
+  const written = entry !== null ? { entry } : {};
+  if (directory !== void 0) {
+    return { kind: "codeUri", path: directory, ...written };
+  }
+  return { kind: "unknown", ...written };
+}
+function envVarSources(declared, platform) {
+  const sources = {};
+  for (const name of declared) {
+    sources[name] = "template";
+  }
+  for (const name of platform) {
+    sources[name] ??= "platform";
+  }
+  return sources;
+}
+function deployedProcesses(body, boundary, scope) {
+  const containers = boundary.containers;
+  if (containers === void 0) {
+    return [{ body, containerName: null }];
+  }
+  return blocksAt(body, containers.blocks, scope).map((container) => ({
+    body: container,
+    containerName: containers.nameAttribute === void 0 ? null : stringOf(container[containers.nameAttribute])
+  }));
+}
+var HANDLER_MODULE = {
+  "module.export": (written) => (0, import_behavioral_ir.parseHandler)(written)?.modulePath ?? null,
+  name: () => null
+};
+function codePointer(body, boundary, scope) {
+  const spec = boundary.code?.handler;
+  const written = attributePattern(body, spec?.attribute, scope);
+  if (spec === void 0 || written === null) {
+    return { entryPoint: null, entry: null };
+  }
+  return {
+    entryPoint: written,
+    entry: (0, import_behavioral_ir.hasNameHole)(written) ? null : HANDLER_MODULE[spec.spelling](written)
+  };
+}
+var ENV_READERS = {
+  map: (body, declaration, into, scope) => {
+    const stated = asRecord(valueAt(body, declaration.attribute)) ?? {};
+    for (const [name, value] of Object.entries(stated)) {
+      setVariable(into, name, stringOf(value), scope);
+    }
+  },
+  entries: (body, declaration, into, scope) => {
+    for (const entry of blocksAt(body, declaration.block.split("."), scope)) {
+      const name = stringOf(entry[declaration.nameAttribute]);
+      if (name === null) {
+        continue;
+      }
+      setVariable(
+        into,
+        name,
+        attributeText(entry, declaration.valueAttribute),
+        scope
+      );
+      setTarget(
+        into,
+        name,
+        attributeText(entry, declaration.secretAttribute),
+        scope
+      );
+    }
+  }
+};
+function declaredEnv(body, declarations, scope) {
+  const declared = { names: [], values: {}, targets: {} };
+  for (const declaration of declarations) {
+    const read = ENV_READERS[declaration.style];
+    read(body, declaration, declared, scope);
+  }
+  return declared;
+}
+function setVariable(into, name, written, scope) {
+  if (!into.names.includes(name)) {
+    into.names.push(name);
+  }
+  if (written === null) {
+    return;
+  }
+  const pattern = namePattern(written, scope);
+  if (pattern !== null) {
+    into.values[name] = pattern;
+  }
+  setTarget(into, name, written, scope);
+}
+function setTarget(into, name, written, scope) {
+  const target = written === null ? null : referencedResource(written, scope);
+  if (target !== null) {
+    into.targets[name] = { kind: "ref", logicalId: target };
+  }
+}
+function attributeText(body, attribute) {
+  return attribute === void 0 ? null : stringOf(valueAt(body, attribute));
+}
+function attributePattern(body, attribute, scope) {
+  return attribute === void 0 ? null : namePattern(valueAt(body, attribute), scope);
+}
+var MEANING_KEYS = {
+  value: (stated, keys) => keys.find((key) => key === stated),
+  prefix: (stated, keys) => keys.find((key) => stated.startsWith(key))
+};
+function meaningOf(body, spec, scope) {
   if (spec === void 0) {
     return void 0;
   }
-  const stated = stringOf(valueAt(body, spec.attribute));
-  return stated === null ? void 0 : spec.means[stated];
+  const value = valueAt(body, spec.attribute);
+  if (value === void 0) {
+    return spec.whenUnset;
+  }
+  const written = stringOf(value);
+  const stated = written === null ? null : resolveReferences(written, scope);
+  if (stated === null || stated.includes("${")) {
+    return void 0;
+  }
+  const key = MEANING_KEYS[spec.matches ?? "value"](
+    stated,
+    Object.keys(spec.means)
+  );
+  return key === void 0 ? void 0 : spec.means[key];
 }
 function valueAt(body, path2) {
   const steps = path2.split(".");
@@ -692,15 +1415,24 @@ function valueAt(body, path2) {
   }
   return current[last];
 }
-function blocksAt(body, blocks) {
+function blocksAt(body, blocks, scope) {
   let found = [body];
   for (const block of blocks) {
-    found = found.flatMap(
-      (record) => arrayOf(record[block]).map(asRecord).filter((nested) => nested !== null)
-    );
+    found = found.flatMap((record) => [
+      ...nestedRecords(record[block], scope),
+      ...dynamicBlocks(record, block, scope)
+    ]);
   }
   return found;
 }
+function nestedRecords(value, scope) {
+  const iterated = iteratedRecords(value, scope);
+  if (iterated !== null) {
+    return iterated;
+  }
+  const stated = typeof value === "string" ? jsonAttributeValue(value) : value;
+  return arrayOf(stated).map(asRecord).filter((nested) => nested !== null);
+}
 function keyedShapes(body, boundary) {
   if (boundary.identifies === void 0) {
     return [{ accessPath: null, keyFields: [], serves: null }];
@@ -806,23 +1538,12 @@ function namePattern(value, scope) {
     typeof value === "string" ? resolveReferences(value, scope) : value
   );
 }
-function arrayOf(value) {
-  if (value === void 0 || value === null) {
-    return [];
-  }
-  return Array.isArray(value) ? value : [value];
-}
-function asRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
-}
-function stringOf(value) {
-  return typeof value === "string" ? value : null;
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   filterCalls,
   filterTerms,
   filterValuesFor,
+  jsonAttributeValue,
   parseFilterQuery,
   terraformFileToSummaries,
   terraformToSummaries