@suss/contract-terraform 0.31.2 → 0.33.0

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { MessageBusTechnology, MetricValueShape, MetricAccumulation, BehavioralSummary } from '@suss/behavioral-ir';
+import { DeployableUnit, MessageBusTechnology, MetricValueShape, MetricAccumulation, BehavioralSummary } from '@suss/behavioral-ir';
 
 /**
  * What a pack says about the resources one Terraform provider declares.
@@ -13,11 +13,36 @@ import { MessageBusTechnology, MetricValueShape, MetricAccumulation, BehavioralS
  * pack to ship code the reader cannot see into.
  */
 
+/**
+ * An attribute whose value the pack translates into one of suss's own
+ * words. The reader takes the value at `attribute` and looks it up in
+ * `means`; a value the pack did not list says nothing, and so does one
+ * the configuration builds at deploy time.
+ */
+interface AttributeMeaning<T extends string> {
+    /** The attribute path whose value says which one it is. */
+    attribute: string;
+    /** What each value the provider can write there means. */
+    means: Record<string, T>;
+    /**
+     * Whether a value has to equal a key of `means` or start with one.
+     * Cloud SQL writes an engine and a release together, `POSTGRES_15`,
+     * and the releases change every quarter, so a pack lists the prefix.
+     */
+    matches?: "value" | "prefix";
+    /** What the resource means when it never set the attribute at all. */
+    whenUnset?: T;
+}
 /** A store a caller addresses by container and key. */
 interface StorageResource {
     kind: "storage";
-    /** Which store this is: dynamodb, s3. */
-    storageSystem: string;
+    /**
+     * Which store this is: dynamodb, s3. A resource that runs whichever
+     * engine one of its attributes picks says which attribute instead,
+     * and a value the pack does not list leaves the store with no engine
+     * on it rather than dropping the resource.
+     */
+    storageSystem: string | AttributeMeaning<string>;
     /** How a caller reaches it, when that is not the store's own name. */
     transport?: string;
     /**
@@ -33,6 +58,12 @@ interface StorageResource {
     declares?: "container" | "store";
     /** The attribute that says what the resource is called once deployed. */
     nameAttribute?: string;
+    /**
+     * The attribute naming the namespace a container belongs to. A
+     * BigQuery table is always addressed through its dataset, so two
+     * tables called `orders` in two datasets are two containers.
+     */
+    scopeAttribute?: string;
     /** Whether the fields it declares are every field an item has. */
     fieldSet: "exhaustive" | "partial" | "none";
     /** The attributes that state what identifies an item, in key order. */
@@ -45,6 +76,24 @@ interface StorageResource {
         nameAttribute: string;
         typeAttribute: string;
     };
+    /**
+     * An attribute stating every field as JSON, one object per field. A
+     * schema written this way is every field the item has, so reading one
+     * makes the contract exhaustive whatever `fieldSet` says.
+     */
+    fieldsFromJson?: {
+        /** The attribute whose value is a JSON list of field objects. */
+        attribute: string;
+        /** The key of one entry that says what the field is called. */
+        nameKey: string;
+        /** The key of one entry that gives the field its type. */
+        typeKey?: string;
+        /** The key that says a field is always set, and the values that do. */
+        requires?: {
+            key: string;
+            values: string[];
+        };
+    };
     /**
      * How another way in says what it can serve. A DynamoDB index copies
      * some of an item rather than all of it, and a reader asking for
@@ -67,35 +116,42 @@ interface MessageBusResource {
     nameAttribute?: string;
 }
 /**
- * An attribute whose value the pack translates into one of suss's own
- * words. The reader takes the value at `attribute` and looks it up in
- * `means`; a value the pack did not list says nothing, the same as an
- * attribute the configuration never set.
+ * How the deployed metric type is spelled, with each `{...}` standing
+ * for the value at that attribute. A CloudWatch metric is identified by
+ * its namespace and its name together, so a template says where both
+ * come from: `"{metric_transformation.namespace}/{metric_transformation.name}"`.
+ * A hole the resource leaves unset makes the whole identity unknown, so
+ * the summary pairs with nothing rather than with a half-spelled name.
  */
-interface AttributeMeaning<T extends string> {
-    /** The attribute path whose value says which one it is. */
-    attribute: string;
-    /** What each value the provider can write there means. */
-    means: Record<string, T>;
-}
+type MetricTypeTemplate = string;
 /** A named series of measurements a resource declares. */
 interface MetricResource {
     kind: "metric";
     /** Which system the series lives in: cloud-monitoring. */
     metricSystem: string;
-    /** The attribute that says what the metric is called. */
-    nameAttribute: string;
-    /**
-     * How the deployed metric type is spelled, with `{name}` standing
-     * for the declared name. That string is what a resource reading the
-     * metric spells, so it is the identity the two sides share.
-     */
-    metricTypeTemplate: string;
+    /** How the string both sides spell is built from the resource. */
+    metricTypeTemplate: MetricTypeTemplate;
     /** Which attribute says whether one measurement is a number or a histogram. */
     values?: AttributeMeaning<MetricValueShape>;
     /** Which attribute says what a measurement covers. */
     accumulates?: AttributeMeaning<MetricAccumulation>;
 }
+/**
+ * How a reading says which metric it is about. A CloudWatch alarm
+ * writes the namespace and the name in attributes of its own; a Cloud
+ * Monitoring condition states a query, and the metric is one value
+ * inside it.
+ */
+type MetricIdentity = {
+    from: "attributes";
+    template: MetricTypeTemplate;
+} | {
+    from: "query";
+    /** The attribute whose query says which metric this is about. */
+    attribute: string;
+    /** The key inside that query whose value is the metric's type. */
+    key: string;
+};
 /**
  * A resource that reads a metric another resource declares. One
  * resource usually states several readings, each in its own block and
@@ -104,12 +160,13 @@ interface MetricResource {
 interface MetricReadingResource {
     kind: "metric-reading";
     metricSystem: string;
-    /** The blocks one reading is written inside, outermost first. */
+    /**
+     * The blocks one reading is written inside, outermost first. An empty
+     * list means the resource is itself one reading.
+     */
     readingBlocks: string[];
-    /** The attribute whose query says which metric the reading is about. */
-    queryAttribute: string;
-    /** The key inside that query whose value is the metric's type. */
-    queryIdentityKey: string;
+    /** How the reading spells the metric it is about. */
+    identifies: MetricIdentity;
     /**
      * The attribute whose presence means the reading compares the series
      * against a value of this shape. A condition states a threshold, so
@@ -122,23 +179,98 @@ interface MetricReadingResource {
     /** Which attribute says what the reading reduces each window to first. */
     reducesTo?: AttributeMeaning<MetricValueShape>;
 }
-type TerraformResource = StorageResource | MessageBusResource | MetricResource | MetricReadingResource;
+/**
+ * Where a provider writes one process's environment. A map attribute
+ * gives the names as its keys; repeated entries each say what one
+ * variable is called and then what supplies it, a literal or a secret.
+ */
+type EnvDeclaration = {
+    style: "map";
+    attribute: string;
+} | {
+    style: "entries";
+    /** The block one entry is written as, as a dotted path. */
+    block: string;
+    /** The attribute stating what the variable is called. */
+    nameAttribute: string;
+    /** The attribute stating the value, for an entry that writes one. */
+    valueAttribute?: string;
+    /** The attribute stating which secret supplies the value. */
+    secretAttribute?: string;
+};
+/**
+ * How a platform spells the string that says which code it calls.
+ * `"module.export"` is a module path and an exported name split at the
+ * last dot, which is what Lambda takes. `"name"` is an exported name on
+ * its own, which says nothing about which file it is in.
+ */
+type HandlerSpelling = "module.export" | "name";
+/** What the provider says one process runs. */
+interface DeployableCode {
+    /** The attribute that says which function the platform calls. */
+    handler?: {
+        attribute: string;
+        spelling: HandlerSpelling;
+    };
+    /** The attribute that says which image a container runs. */
+    imageAttribute?: string;
+}
+/** A resource that deploys several processes, each with its own environment. */
+interface DeployableContainers {
+    /** The blocks one container is written inside, outermost first. */
+    blocks: string[];
+    /** The attribute inside a container that says what it is called. */
+    nameAttribute?: string;
+}
+/**
+ * Something that gets deployed and runs: a function, a container, a
+ * job. What it declares is the environment the process starts with, so
+ * code reading a variable the deployment never sets is a defect either
+ * side can be shown.
+ *
+ * The unit is the resource's label rather than the name it deploys
+ * under. The label is what the rest of the configuration refers to it
+ * as, the way a logical id is in CloudFormation, and it is what a
+ * variable pointing at the resource resolves to.
+ */
+interface DeployableResource {
+    kind: "deployable";
+    /** Which medium runs it, in the words a deployable unit is keyed by. */
+    deploymentTarget: DeployableUnit["deploymentTarget"];
+    /** Where each process is written, for a resource that deploys several. */
+    containers?: DeployableContainers;
+    /** Where the environment is written, inside the process. */
+    env?: EnvDeclaration[];
+    /** What the provider says the process runs. */
+    code?: DeployableCode;
+    /** The attribute stating the language runtime, verbatim. */
+    runtimeAttribute?: string;
+    /**
+     * Names the platform sets whatever the configuration says. An entry
+     * that states none takes the list for its deployment target, which
+     * is the one every other reader of that target uses. A product with
+     * a list of its own, Cloud Run against a bare container, states it.
+     */
+    platformEnvVars?: readonly string[];
+}
+type TerraformResource = StorageResource | MessageBusResource | MetricResource | MetricReadingResource | DeployableResource;
 /** One resource type, as one version range of one provider declares it. */
 interface TerraformResourcePattern {
     /** The resource type, spelled the way the provider spells it. */
     resource: string;
     /**
      * An attribute that decides whether the entry describes the resource
-     * at all. `aws_elasticache_cluster` deploys whichever engine its
-     * `engine` attribute picks, and only some engines are the store the
-     * entry describes. A value outside `equals`, or one built at deploy
-     * time, means the resource is not read, rather than read as
-     * something it may not be. `whenUnset` says what an absent attribute
-     * means; the default is not to read the resource.
+     * at all. A Firestore database in Datastore mode speaks a different
+     * API, so it is not the store the Firestore entry describes. A value
+     * outside `equals`, or one built at deploy time, means the resource
+     * is not read, rather than read as something it may not be.
+     * `whenUnset` says what an absent attribute means; the default is not
+     * to read the resource.
      */
     appliesWhen?: {
         attribute: string;
-        equals: string[];
+        /** The values that mean the entry describes this resource. */
+        equals?: string[];
         whenUnset?: "read" | "skip";
     };
     /**
@@ -221,6 +353,26 @@ declare function filterCalls(query: FilterQuery): FilterCall[];
 /** Read one filter string, or say what stopped the reading. */
 declare function parseFilterQuery(source: string): FilterParse;
 
+/**
+ * An attribute whose value is JSON.
+ *
+ * Several providers take a structure as a string rather than as blocks:
+ * a BigQuery table's schema, an ECS task's container definitions, an
+ * IAM policy document. Terraform gives an author two ways to write one,
+ * a literal string (usually a heredoc) and `jsonencode` over an HCL
+ * value, and the two arrive at this reader looking nothing alike. This
+ * turns both into the value the provider will see.
+ *
+ * A schema a file or a variable supplies is not written down anywhere
+ * this can read, so it comes back as null and the caller records
+ * nothing rather than guessing.
+ */
+/**
+ * The value an attribute states as JSON, or null when the attribute is
+ * missing or states something only a deploy can settle.
+ */
+declare function jsonAttributeValue(value: unknown): unknown;
+
 /**
  * The boundaries a Terraform configuration declares.
  *
@@ -240,10 +392,21 @@ declare function parseFilterQuery(source: string): FilterParse;
 interface TerraformReadOptions {
     /** The packs that say what this configuration's resources are. */
     packs: TerraformPack[];
+    /**
+     * The directory each deployable unit's code is in, by the instance
+     * name the unit is keyed by. A configuration says which handler runs
+     * and never which directory the artifact was built from, so a
+     * container whose image is built elsewhere has no code at all until
+     * somebody says where it is.
+     */
+    codeScopes?: Record<string, string>;
 }
 /** Every boundary one Terraform configuration declares. */
 declare function terraformToSummaries(source: string, sourceFile: string, options: TerraformReadOptions): BehavioralSummary[];
-/** Read one `.tf` file, or every one directly inside a directory. */
+/**
+ * Read one `.tf` file, or every one directly inside a directory, and
+ * every local module the configuration calls.
+ */
 declare function terraformFileToSummaries(target: string, options: TerraformReadOptions): BehavioralSummary[];
 
-export { type AttributeMeaning, type FilterCall, type FilterParse, type FilterQuery, type FilterTerm, type MessageBusResource, type MetricReadingResource, type MetricResource, type StorageResource, type TerraformPack, type TerraformReadOptions, type TerraformResource, type TerraformResourcePattern, filterCalls, filterTerms, filterValuesFor, parseFilterQuery, terraformFileToSummaries, terraformToSummaries };
+export { type AttributeMeaning, type DeployableCode, type DeployableContainers, type DeployableResource, type EnvDeclaration, type FilterCall, type FilterParse, type FilterQuery, type FilterTerm, type HandlerSpelling, type MessageBusResource, type MetricIdentity, type MetricReadingResource, type MetricResource, type MetricTypeTemplate, type StorageResource, type TerraformPack, type TerraformReadOptions, type TerraformResource, type TerraformResourcePattern, filterCalls, filterTerms, filterValuesFor, jsonAttributeValue, parseFilterQuery, terraformFileToSummaries, terraformToSummaries };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { MessageBusTechnology, MetricValueShape, MetricAccumulation, BehavioralSummary } from '@suss/behavioral-ir';
+import { DeployableUnit, MessageBusTechnology, MetricValueShape, MetricAccumulation, BehavioralSummary } from '@suss/behavioral-ir';
 
 /**
  * What a pack says about the resources one Terraform provider declares.
@@ -13,11 +13,36 @@ import { MessageBusTechnology, MetricValueShape, MetricAccumulation, BehavioralS
  * pack to ship code the reader cannot see into.
  */
 
+/**
+ * An attribute whose value the pack translates into one of suss's own
+ * words. The reader takes the value at `attribute` and looks it up in
+ * `means`; a value the pack did not list says nothing, and so does one
+ * the configuration builds at deploy time.
+ */
+interface AttributeMeaning<T extends string> {
+    /** The attribute path whose value says which one it is. */
+    attribute: string;
+    /** What each value the provider can write there means. */
+    means: Record<string, T>;
+    /**
+     * Whether a value has to equal a key of `means` or start with one.
+     * Cloud SQL writes an engine and a release together, `POSTGRES_15`,
+     * and the releases change every quarter, so a pack lists the prefix.
+     */
+    matches?: "value" | "prefix";
+    /** What the resource means when it never set the attribute at all. */
+    whenUnset?: T;
+}
 /** A store a caller addresses by container and key. */
 interface StorageResource {
     kind: "storage";
-    /** Which store this is: dynamodb, s3. */
-    storageSystem: string;
+    /**
+     * Which store this is: dynamodb, s3. A resource that runs whichever
+     * engine one of its attributes picks says which attribute instead,
+     * and a value the pack does not list leaves the store with no engine
+     * on it rather than dropping the resource.
+     */
+    storageSystem: string | AttributeMeaning<string>;
     /** How a caller reaches it, when that is not the store's own name. */
     transport?: string;
     /**
@@ -33,6 +58,12 @@ interface StorageResource {
     declares?: "container" | "store";
     /** The attribute that says what the resource is called once deployed. */
     nameAttribute?: string;
+    /**
+     * The attribute naming the namespace a container belongs to. A
+     * BigQuery table is always addressed through its dataset, so two
+     * tables called `orders` in two datasets are two containers.
+     */
+    scopeAttribute?: string;
     /** Whether the fields it declares are every field an item has. */
     fieldSet: "exhaustive" | "partial" | "none";
     /** The attributes that state what identifies an item, in key order. */
@@ -45,6 +76,24 @@ interface StorageResource {
         nameAttribute: string;
         typeAttribute: string;
     };
+    /**
+     * An attribute stating every field as JSON, one object per field. A
+     * schema written this way is every field the item has, so reading one
+     * makes the contract exhaustive whatever `fieldSet` says.
+     */
+    fieldsFromJson?: {
+        /** The attribute whose value is a JSON list of field objects. */
+        attribute: string;
+        /** The key of one entry that says what the field is called. */
+        nameKey: string;
+        /** The key of one entry that gives the field its type. */
+        typeKey?: string;
+        /** The key that says a field is always set, and the values that do. */
+        requires?: {
+            key: string;
+            values: string[];
+        };
+    };
     /**
      * How another way in says what it can serve. A DynamoDB index copies
      * some of an item rather than all of it, and a reader asking for
@@ -67,35 +116,42 @@ interface MessageBusResource {
     nameAttribute?: string;
 }
 /**
- * An attribute whose value the pack translates into one of suss's own
- * words. The reader takes the value at `attribute` and looks it up in
- * `means`; a value the pack did not list says nothing, the same as an
- * attribute the configuration never set.
+ * How the deployed metric type is spelled, with each `{...}` standing
+ * for the value at that attribute. A CloudWatch metric is identified by
+ * its namespace and its name together, so a template says where both
+ * come from: `"{metric_transformation.namespace}/{metric_transformation.name}"`.
+ * A hole the resource leaves unset makes the whole identity unknown, so
+ * the summary pairs with nothing rather than with a half-spelled name.
  */
-interface AttributeMeaning<T extends string> {
-    /** The attribute path whose value says which one it is. */
-    attribute: string;
-    /** What each value the provider can write there means. */
-    means: Record<string, T>;
-}
+type MetricTypeTemplate = string;
 /** A named series of measurements a resource declares. */
 interface MetricResource {
     kind: "metric";
     /** Which system the series lives in: cloud-monitoring. */
     metricSystem: string;
-    /** The attribute that says what the metric is called. */
-    nameAttribute: string;
-    /**
-     * How the deployed metric type is spelled, with `{name}` standing
-     * for the declared name. That string is what a resource reading the
-     * metric spells, so it is the identity the two sides share.
-     */
-    metricTypeTemplate: string;
+    /** How the string both sides spell is built from the resource. */
+    metricTypeTemplate: MetricTypeTemplate;
     /** Which attribute says whether one measurement is a number or a histogram. */
     values?: AttributeMeaning<MetricValueShape>;
     /** Which attribute says what a measurement covers. */
     accumulates?: AttributeMeaning<MetricAccumulation>;
 }
+/**
+ * How a reading says which metric it is about. A CloudWatch alarm
+ * writes the namespace and the name in attributes of its own; a Cloud
+ * Monitoring condition states a query, and the metric is one value
+ * inside it.
+ */
+type MetricIdentity = {
+    from: "attributes";
+    template: MetricTypeTemplate;
+} | {
+    from: "query";
+    /** The attribute whose query says which metric this is about. */
+    attribute: string;
+    /** The key inside that query whose value is the metric's type. */
+    key: string;
+};
 /**
  * A resource that reads a metric another resource declares. One
  * resource usually states several readings, each in its own block and
@@ -104,12 +160,13 @@ interface MetricResource {
 interface MetricReadingResource {
     kind: "metric-reading";
     metricSystem: string;
-    /** The blocks one reading is written inside, outermost first. */
+    /**
+     * The blocks one reading is written inside, outermost first. An empty
+     * list means the resource is itself one reading.
+     */
     readingBlocks: string[];
-    /** The attribute whose query says which metric the reading is about. */
-    queryAttribute: string;
-    /** The key inside that query whose value is the metric's type. */
-    queryIdentityKey: string;
+    /** How the reading spells the metric it is about. */
+    identifies: MetricIdentity;
     /**
      * The attribute whose presence means the reading compares the series
      * against a value of this shape. A condition states a threshold, so
@@ -122,23 +179,98 @@ interface MetricReadingResource {
     /** Which attribute says what the reading reduces each window to first. */
     reducesTo?: AttributeMeaning<MetricValueShape>;
 }
-type TerraformResource = StorageResource | MessageBusResource | MetricResource | MetricReadingResource;
+/**
+ * Where a provider writes one process's environment. A map attribute
+ * gives the names as its keys; repeated entries each say what one
+ * variable is called and then what supplies it, a literal or a secret.
+ */
+type EnvDeclaration = {
+    style: "map";
+    attribute: string;
+} | {
+    style: "entries";
+    /** The block one entry is written as, as a dotted path. */
+    block: string;
+    /** The attribute stating what the variable is called. */
+    nameAttribute: string;
+    /** The attribute stating the value, for an entry that writes one. */
+    valueAttribute?: string;
+    /** The attribute stating which secret supplies the value. */
+    secretAttribute?: string;
+};
+/**
+ * How a platform spells the string that says which code it calls.
+ * `"module.export"` is a module path and an exported name split at the
+ * last dot, which is what Lambda takes. `"name"` is an exported name on
+ * its own, which says nothing about which file it is in.
+ */
+type HandlerSpelling = "module.export" | "name";
+/** What the provider says one process runs. */
+interface DeployableCode {
+    /** The attribute that says which function the platform calls. */
+    handler?: {
+        attribute: string;
+        spelling: HandlerSpelling;
+    };
+    /** The attribute that says which image a container runs. */
+    imageAttribute?: string;
+}
+/** A resource that deploys several processes, each with its own environment. */
+interface DeployableContainers {
+    /** The blocks one container is written inside, outermost first. */
+    blocks: string[];
+    /** The attribute inside a container that says what it is called. */
+    nameAttribute?: string;
+}
+/**
+ * Something that gets deployed and runs: a function, a container, a
+ * job. What it declares is the environment the process starts with, so
+ * code reading a variable the deployment never sets is a defect either
+ * side can be shown.
+ *
+ * The unit is the resource's label rather than the name it deploys
+ * under. The label is what the rest of the configuration refers to it
+ * as, the way a logical id is in CloudFormation, and it is what a
+ * variable pointing at the resource resolves to.
+ */
+interface DeployableResource {
+    kind: "deployable";
+    /** Which medium runs it, in the words a deployable unit is keyed by. */
+    deploymentTarget: DeployableUnit["deploymentTarget"];
+    /** Where each process is written, for a resource that deploys several. */
+    containers?: DeployableContainers;
+    /** Where the environment is written, inside the process. */
+    env?: EnvDeclaration[];
+    /** What the provider says the process runs. */
+    code?: DeployableCode;
+    /** The attribute stating the language runtime, verbatim. */
+    runtimeAttribute?: string;
+    /**
+     * Names the platform sets whatever the configuration says. An entry
+     * that states none takes the list for its deployment target, which
+     * is the one every other reader of that target uses. A product with
+     * a list of its own, Cloud Run against a bare container, states it.
+     */
+    platformEnvVars?: readonly string[];
+}
+type TerraformResource = StorageResource | MessageBusResource | MetricResource | MetricReadingResource | DeployableResource;
 /** One resource type, as one version range of one provider declares it. */
 interface TerraformResourcePattern {
     /** The resource type, spelled the way the provider spells it. */
     resource: string;
     /**
      * An attribute that decides whether the entry describes the resource
-     * at all. `aws_elasticache_cluster` deploys whichever engine its
-     * `engine` attribute picks, and only some engines are the store the
-     * entry describes. A value outside `equals`, or one built at deploy
-     * time, means the resource is not read, rather than read as
-     * something it may not be. `whenUnset` says what an absent attribute
-     * means; the default is not to read the resource.
+     * at all. A Firestore database in Datastore mode speaks a different
+     * API, so it is not the store the Firestore entry describes. A value
+     * outside `equals`, or one built at deploy time, means the resource
+     * is not read, rather than read as something it may not be.
+     * `whenUnset` says what an absent attribute means; the default is not
+     * to read the resource.
      */
     appliesWhen?: {
         attribute: string;
-        equals: string[];
+        /** The values that mean the entry describes this resource. */
+        equals?: string[];
         whenUnset?: "read" | "skip";
     };
     /**
@@ -221,6 +353,26 @@ declare function filterCalls(query: FilterQuery): FilterCall[];
 /** Read one filter string, or say what stopped the reading. */
 declare function parseFilterQuery(source: string): FilterParse;
 
+/**
+ * An attribute whose value is JSON.
+ *
+ * Several providers take a structure as a string rather than as blocks:
+ * a BigQuery table's schema, an ECS task's container definitions, an
+ * IAM policy document. Terraform gives an author two ways to write one,
+ * a literal string (usually a heredoc) and `jsonencode` over an HCL
+ * value, and the two arrive at this reader looking nothing alike. This
+ * turns both into the value the provider will see.
+ *
+ * A schema a file or a variable supplies is not written down anywhere
+ * this can read, so it comes back as null and the caller records
+ * nothing rather than guessing.
+ */
+/**
+ * The value an attribute states as JSON, or null when the attribute is
+ * missing or states something only a deploy can settle.
+ */
+declare function jsonAttributeValue(value: unknown): unknown;
+
 /**
  * The boundaries a Terraform configuration declares.
  *
@@ -240,10 +392,21 @@ declare function parseFilterQuery(source: string): FilterParse;
 interface TerraformReadOptions {
     /** The packs that say what this configuration's resources are. */
     packs: TerraformPack[];
+    /**
+     * The directory each deployable unit's code is in, by the instance
+     * name the unit is keyed by. A configuration says which handler runs
+     * and never which directory the artifact was built from, so a
+     * container whose image is built elsewhere has no code at all until
+     * somebody says where it is.
+     */
+    codeScopes?: Record<string, string>;
 }
 /** Every boundary one Terraform configuration declares. */
 declare function terraformToSummaries(source: string, sourceFile: string, options: TerraformReadOptions): BehavioralSummary[];
-/** Read one `.tf` file, or every one directly inside a directory. */
+/**
+ * Read one `.tf` file, or every one directly inside a directory, and
+ * every local module the configuration calls.
+ */
 declare function terraformFileToSummaries(target: string, options: TerraformReadOptions): BehavioralSummary[];
 
-export { type AttributeMeaning, type FilterCall, type FilterParse, type FilterQuery, type FilterTerm, type MessageBusResource, type MetricReadingResource, type MetricResource, type StorageResource, type TerraformPack, type TerraformReadOptions, type TerraformResource, type TerraformResourcePattern, filterCalls, filterTerms, filterValuesFor, parseFilterQuery, terraformFileToSummaries, terraformToSummaries };
+export { type AttributeMeaning, type DeployableCode, type DeployableContainers, type DeployableResource, type EnvDeclaration, type FilterCall, type FilterParse, type FilterQuery, type FilterTerm, type HandlerSpelling, type MessageBusResource, type MetricIdentity, type MetricReadingResource, type MetricResource, type MetricTypeTemplate, type StorageResource, type TerraformPack, type TerraformReadOptions, type TerraformResource, type TerraformResourcePattern, filterCalls, filterTerms, filterValuesFor, jsonAttributeValue, parseFilterQuery, terraformFileToSummaries, terraformToSummaries };