check

type ClassCount struct {
	Class   OnboardingClass `json:"class"`
	Configs int             `json:"configs"`
}

type Context struct {
	// Schemas are the provider's managed resource type schemas, keyed by
	// type name.
	//
	// Running without them is supported and is materially less accurate,
	// in one direction that matters to this instrument specifically: a
	// type absent from the generated admission table is refused as
	// unadmitted when the provider's own identity schema would have
	// settled it. That single rule would then top any ranking built from
	// the result, which is the one outcome #102 exists to prevent. So
	// [Report.Schemas] records whether they were present and every front
	// end says so.
	Schemas map[string]providers.Schema

	// ProviderManagedTypes is which managed resource types each provider's
	// own schema declares, attributed to the provider - which [Schemas],
	// merged and provider-less by construction, cannot say.
	//
	// It exists so that this instrument and a real live-plan draw the
	// data-read phase's provider boundary in the same place. That boundary
	// (see [dataread.LiveProviders]) refuses a data source whose provider
	// serves no managed resource type at all - hashicorp/external, whose
	// read runs a program named by its own arguments, is the shape it is
	// there for - and it can only be evaluated by a caller that has the
	// per-provider schemas. Without this, live-check reports such a site as
	// "Resolves at plan time via a data-source read" for a plan that then
	// refuses it, which is the polarity this package works hardest to avoid.
	//
	// Nil is supported and means today's answer: the boundary fails open,
	// exactly as it does for any provider a run has no schema for. The two
	// corpus instruments (tools/refusal-probe, tools/corpus-gen) leave it
	// nil today, so their count for that refusal is a floor.
	ProviderManagedTypes map[addrs.Provider]map[string]bool

	// ManagedResults are values a caller obtained from the provider for
	// resources whose computed attributes the configuration references -
	// [projection.PlanInstances] produces them, keyed by resource address.
	//
	// This package stays provider-free on purpose. Analyze is the offline
	// instrument that tools/refusal-probe and tools/corpus-gen fold into a
	// ranking, and a pass that reached out to a provider on its own would
	// make every one of those runs depend on a subprocess. So the caller
	// that already has a provider in hand does the asking, and hands the
	// answers in - the same seam [identity.Context.ManagedResults] has had
	// since #187, under the same name.
	//
	// Empty is the ordinary case and means exactly today's behaviour: a
	// for_each over a computed attribute refuses, as it always has.
	ManagedResults map[string]cty.Value
}

type Corpus struct {
	// Entries are the per-configuration results, in the order added.
	Entries []CorpusEntry `json:"entries"`

	// Refusals is every refusal in [Catalog], ranked, including the ones
	// that fired nowhere.
	//
	// Carrying the zeroes is the point of building this from the catalog
	// rather than from what was observed. A refusal that blocks nothing in
	// a corpus of real configurations is evidence about where not to spend
	// the next campaign, and it is invisible to any instrument that only
	// records what it saw fire.
	Refusals []CorpusRefusal `json:"refusals"`

	// Totals are the corpus-wide counts.
	Totals CorpusTotals `json:"totals"`

	// Populations are the per-origin counts, where blocked and clean live.
	Populations []PopulationTotals `json:"populations"`

	// Ladder is #175's roll-up over the rate-capable entries: counts per
	// onboarding class and the unadmitted-type demand table. Nil when the
	// corpus has no rate-capable population.
	Ladder *LadderSummary `json:"ladder,omitempty"`

	// Checked, Partial and Unchecked are the layers behind every number
	// above, repeated here so the artifact carries its own scope. See
	// [PartiallyCheckedLayers] for why there are three lists rather than
	// two.
	//
	// Partial is the schema-backed list - [PartiallyCheckedLayers], "2 of
	// 27" for projection - which is what every [CorpusEntry] whose own
	// Schemas is true actually ran. PartialWithoutSchemas
	// ([PartiallyCheckedLayersFor](false), "1 of 27") is what an entry with
	// Schemas false ran instead: GitHub issue #265, one list read as true of
	// every entry overstated the ones this corpus measured with no provider
	// at all. Totals.WithoutSchemas ("configs_without_schemas") is how many
	// of Entries that was; this corpus can and does mix both in one run, so
	// neither list alone describes it, and the artifact carries both rather
	// than picking one to be silently wrong about the other's entries.
	Checked               []Layer        `json:"checked_layers"`
	Partial               []PartialLayer `json:"partially_checked_layers"`
	PartialWithoutSchemas []PartialLayer `json:"partially_checked_layers_without_schemas"`
	Unchecked             []Layer        `json:"unchecked_layers"`
}

type CorpusEntry struct {
	// Name identifies the configuration, as the runner was told it.
	Name string `json:"name"`

	// Origin is the population this configuration belongs to (the
	// manifest's own vocabulary: "in-repo fixture", "terraform-aws-modules",
	// ...). Populations are totalled separately; see [PopulationTotals].
	Origin string `json:"origin,omitempty"`

	// Blocked is whether anything refused it.
	Blocked bool `json:"blocked"`

	// Loaded is whether the configuration could be read at all. A false
	// here is itself a measurement (see [Load]), not a skipped row.
	Loaded bool `json:"loaded"`

	// LoadError is the first load diagnostic, when Loaded is false.
	LoadError string `json:"load_error,omitempty"`

	// Instances is how many managed resource instances resolved.
	Instances int `json:"instances"`

	// Sites is how many refused sites it had.
	Sites int `json:"sites"`

	// UnresolvedModules is how many module calls could not be read without
	// installing them. Their contents are not measured in this row.
	UnresolvedModules int `json:"unresolved_modules"`

	// UnsetVariables is how many required root variables had no value.
	UnsetVariables int `json:"unset_variables"`

	// Schemas is whether provider schemas were available for this entry.
	Schemas bool `json:"schemas"`

	// Shadowed is how many identity refusals landed on a construct lint
	// had already refused. See [Report.Shadowed].
	Shadowed int `json:"shadowed,omitempty"`

	// VarFiles are the repository-root-relative tfvars files this entry
	// was measured with, in the order applied, when the manifest source
	// named or derived any (#183). Empty means the entry was measured
	// bare, with only whatever tfvars sit in its own directory - the
	// ordinary case for every entry but the ones the corpus runner
	// supplied files for. Present so a reader of this artifact can never
	// mistake a vars-supplied measurement for what a plain checkout of
	// that directory produces.
	VarFiles []string `json:"var_files,omitempty"`

	// Profile is the per-estate section (#175): refusal IDs with site
	// counts, unset-variable attribution, unadmitted types and the
	// onboarding class. Present exactly when the entry's origin is in
	// rateCapableOrigins - the ranking-only populations measure fixtures
	// and module examples, and a per-entry profile over them would measure
	// the fixtures.
	Profile *EntryProfile `json:"profile,omitempty"`

	// ProviderSchemas is the schema-acquisition status for every provider
	// this entry's own configuration declared or implied (#211's fix: a
	// corpus run used to acquire hashicorp/aws schemas alone and hand every
	// entry that same map regardless of what it actually required, so a
	// google_* or tfe_* type read as unadmitted for a reason belonging to
	// the run rather than to the corpus - the schema fallback
	// (identity.SynthesizeTypeIdentity) never got a chance to run for it.
	// One row per provider [configs.Config.ProviderRequirements] resolved
	// for this entry (built-in providers excluded - they need no schema
	// fetch), Present true when the fallback actually had that provider's
	// schemas available. Empty when the run carried no schemas at all - see
	// the artifact-level schema note for that case instead of a blank row
	// repeated on every entry.
	ProviderSchemas []EntryProviderSchema `json:"provider_schemas,omitempty"`
}

type CorpusEntryRef struct {
	// Name identifies the configuration in the artifact, relative to the
	// repository root and slash-separated so it reads the same on every
	// platform.
	Name string

	// Dir is where to read it from.
	Dir string

	// Origin is its source's origin string.
	Origin string

	// VarFiles is its source's [ManifestSource.VarFiles] plus whatever
	// [ManifestSource.VarFileLayout] derived for this specific directory,
	// repository-root relative and unresolved - the caller joins each
	// entry against whatever root it is itself running under, the same
	// way it already does for Name. Nil when the source named neither and
	// its layout (if any) derived nothing that exists.
	VarFiles []string
}

type CorpusRefusal struct {
	Layer Layer  `json:"layer"`
	ID    string `json:"id"`
	Title string `json:"title"`

	// What describes the shape that trips it, where the source table has
	// one.
	What string `json:"what,omitempty"`

	// DocsRef is the shipped document explaining it. Empty is a documented
	// gap, not an oversight here; see [Refusal.DocsRef].
	DocsRef string `json:"docs_ref,omitempty"`

	// RaisedBy names the package that constructs the diagnostic, which is
	// not always the layer it surfaces in. See [Refusal.RaisedBy].
	RaisedBy string `json:"raised_by,omitempty"`

	// Configs is how many corpus configurations this refusal blocked, and
	// the number the table is ranked by.
	Configs int `json:"configs"`

	// Sites is how many places it fired across the whole corpus.
	Sites int `json:"sites"`

	// Types is the per-resource-type breakdown, for the type-shaped rules
	// only. See [Finding.Types].
	Types []TypeCount `json:"types,omitempty"`

	// Examples are a few "file:line" sites, for a reader who wants to see
	// one. Capped: this artifact is a work queue, not a log.
	Examples []string `json:"examples,omitempty"`

	// Registered is false for a refusal that fired but is in neither
	// source table.
	//
	// These exist. identity's TestRefusalsRegistered scans that package's
	// own source for Summary literals, so a diagnostic raised by the
	// static evaluator and passed through - "Unknown variable", for one -
	// reaches a user as a refusal while appearing in no registry. Counting
	// them here is how the gap becomes a number instead of a surprise;
	// closing it is GitHub issue #110's.
	Registered bool `json:"registered"`
}

type CorpusTotals struct {
	Configs        int `json:"configs"`
	Loaded         int `json:"loaded"`
	Instances      int `json:"instances"`
	Sites          int `json:"sites"`
	RefusalsFired  int `json:"refusals_fired"`
	RefusalsInSet  int `json:"refusals_in_set"`
	WithoutSchemas int `json:"configs_without_schemas"`

	// Unregistered is how many refusals fired that are in neither source
	// table. See [CorpusRefusal.Registered].
	Unregistered int `json:"refusals_unregistered"`
}

type EntryProfile struct {
	// Class is the entry's [OnboardingClass].
	Class OnboardingClass `json:"onboarding_class"`

	// Refusals is every refusal that fired on this entry, sorted by layer
	// then ID.
	Refusals []EntryRefusal `json:"refusals,omitempty"`

	// UnadmittedTypes are the resource types this entry's own configuration
	// declares that the checker refused as unadmitted, sorted.
	//
	// They are read from the lint-layer unadmitted-type finding's per-site
	// types, which is the loaded configuration seen through the same
	// admission judgment (generated table plus provider identity schemas)
	// the verdict itself used - not a regex over files. That choice bounds
	// what the list can cover in both directions. Covered: the root module
	// and every child module the loader resolved locally, so module-sourced
	// resources within the tree are counted. Not covered: resources inside
	// module calls the loader could not read without installing them (the
	// entry's unresolved_modules count bounds that), and .tf files on disk
	// that no module block references - the loader never reads them, and
	// neither does any live-path verdict.
	UnadmittedTypes []string `json:"unadmitted_types,omitempty"`
}

type EntryProviderSchema struct {
	// Provider is the FQN this entry's own configuration resolved to, for
	// display ("hashicorp/google" - the default registry's hostname is
	// omitted the same way [addrs.Provider.ForDisplay] omits it).
	Provider string `json:"provider"`

	// Present is whether this entry's report actually received this
	// provider's resource type schemas.
	Present bool `json:"present"`

	// Error is why not, when Present is false and a fetch was genuinely
	// attempted for this provider and failed - the third state #211 asks
	// for, distinct from "schemas were off for the whole run" (Error empty)
	// and from "the fallback ran and the type still isn't admitted" (Present
	// true, and the type shows up in unadmitted_types anyway).
	Error string `json:"error,omitempty"`
}

type EntryRefusal struct {
	Layer Layer  `json:"layer"`
	ID    string `json:"id"`

	// Sites is how many places it fired in this entry.
	Sites int `json:"sites"`

	// UnsetVarOnly is true when every one of this refusal's sites references
	// a required root variable that had no value - the whole refusal may be
	// an artifact of running without the operator's tfvars rather than a
	// fact about the configuration. Set only when the caller ran
	// [Report.AttributeUnsetVariables] before folding the report in; false
	// otherwise, which understates rather than invents.
	UnsetVarOnly bool `json:"unset_var_only,omitempty"`

	// Categories breaks this refusal's sites down by reference-subject
	// category (see [configs.ReferenceCategory]) - populated only for
	// [configs.staticScopeData.StaticValidateReferences]'s refusals, and omitted entirely
	// when none of this refusal's sites carried one, so every other rule's
	// row in the artifact stays exactly as small as it was before #178.
	Categories map[configs.ReferenceCategory]int `json:"categories,omitempty"`
}

type Finding struct {
	Refusal

	// Sites are where it fired, ordered by file and line.
	Sites []Site

	// Registered is false when the refusal's identity was not in
	// [Catalog]. It means this package and identity's registry have
	// drifted, and the finding is reported under its raw summary rather
	// than dropped.
	Registered bool

	// UnsetVarRefs are the required input variables with no value that this
	// refusal's sites reference, sorted, and UnsetVarSites how many of its
	// sites reference one. Both are set by
	// [Report.AttributeUnsetVariables] and are zero until it runs.
	//
	// UnsetVarSites < len(Sites) is the interesting case and the reason
	// this is a count rather than a flag: a refusal that fires in six
	// places, two of which read an unset variable, is still a real refusal
	// in four.
	UnsetVarRefs  []string
	UnsetVarSites int
}

type LadderSummary struct {
	// Origins are the rate-capable origins the summary is computed over.
	Origins []string `json:"origins"`

	// Classes counts profiled entries per rung, in rung order, zeros
	// included so the shape is stable across regenerations.
	Classes []ClassCount `json:"classes"`

	// UnadmittedDemand is the admission shortlist: each unadmitted type,
	// with how many profiled entries declare it, sorted by that count and
	// then by name. Demand is counted over every profiled entry - a
	// language-blocked estate's types still count, because admitting them
	// is still work that estate needs.
	UnadmittedDemand []TypeDemand `json:"unadmitted_demand,omitempty"`
}

type Layer string

type LoadResult struct {
	// Config is the configuration tree, or nil when loading failed. A nil
	// Config with diagnostics is an ordinary outcome for the corpus: a
	// configuration written for a Terraform version this fork's parser
	// does not accept is a measurement, not a crash.
	Config *configs.Config

	// Diags are the parse and build diagnostics. Errors here mean Config is
	// nil.
	Diags hcl.Diagnostics

	// UnresolvedModules are the module calls that could not be read without
	// installing them, sorted by module address. Their contents are absent
	// from every count in the report that follows.
	UnresolvedModules []UnresolvedModule
	// contains filtered or unexported fields
}

type Manifest struct {
	Sources []ManifestSource `json:"sources"`
}

type ManifestFetch struct {
	// Dir is where the source is materialized, relative to the repository
	// root. It is expected to be ignored by git: the corpus is pinned by
	// commit, so checking the contents in as well would only add weight
	// and third-party licenses.
	Dir string `json:"dir"`

	// Repo is the clone URL.
	Repo string `json:"repo"`

	// Tag is the human-recognizable version, e.g. "v6.6.1". Empty for a
	// source that publishes no tags; the commit alone pins it then.
	Tag string `json:"tag,omitempty"`

	// Commit is the exact object fetched: what Tag must resolve to when
	// one is recorded, or the checkout target itself when there is none.
	Commit string `json:"commit"`
}

type ManifestSource struct {
	// Glob is a filepath.Glob pattern, relative to the repository root
	// unless absolute. Globs rather than a list of paths, because a
	// hand-maintained path list is the kind of manual wiring this
	// repository's charter is against: adding a configuration to the
	// corpus should mean adding the configuration.
	Glob string `json:"glob"`

	// Origin says where these configurations came from, in words a reader
	// can weigh: "in-repo fixture", "terraform-aws-modules", "internal
	// estate". It is copied into the artifact and never interpreted.
	//
	// It is the field that decides what a ranking is worth. Configurations
	// this project wrote measure this project's own idea of what works;
	// only third-party ones measure the product promise. An artifact that
	// did not carry this would let the two be confused later, which is how
	// a fixture count becomes a compatibility claim.
	Origin string `json:"origin"`

	// Fetch, when set, is how a source outside this repository is
	// obtained. Absent for in-repo sources.
	Fetch *ManifestFetch `json:"fetch,omitempty"`

	// VarFiles, when set, names tfvars files - each relative to the
	// repository root, like Glob - applied on top of whatever the matched
	// directory itself holds, the corpus runner's equivalent of repeated
	// "-var-file" arguments (#183), later entries taking precedence over
	// earlier ones exactly as stock OpenTofu applies repeated -var-file.
	//
	// Every file it names must be the estate's own, discovered from its
	// repository layout - never a value this project composed (the
	// parity ruling of #178/#183: an operator runs stock OpenTofu with
	// -var-file pointing at files their repo contains, and that is the
	// bar). For a layout expressible as a rule, prefer [VarFileLayout]
	// over hand-listing files here: a per-directory VarFiles table does
	// not survive the next corpus refresh, and a layout rule does.
	//
	// Scoped to the one directory the source names, not to every directory
	// its Glob matches: a wildcard source's var files would silently reach
	// every sibling directory it happens to expand to. To aim var files at
	// one estate under a wildcarded source, add a second, narrower source
	// for that one directory (Glob with no wildcard, same Origin, no
	// Fetch) ahead of the wildcard source in this list - [Manifest.Resolve]
	// dedupes by matched path in list order, so the narrow source's entry
	// wins and the wildcard source fills in everything else unchanged.
	VarFiles []string `json:"var_files,omitempty"`

	// VarFileLayout, when set, derives each matched directory's var files
	// from its own name, rather than naming them by hand. It implements
	// one shape: a directory named "<name>" pairs with
	// "<VariablesDir>/<Env>/<name>.tfvars" (the deployment's own file) and
	// "<VariablesDir>/<Env>/common.tfvars" (the environment's shared
	// file), each included only when the estate actually ships it -
	// common first, then the deployment's own file, so the deployment's
	// value wins over the shared one for anything both set, the same
	// later-wins order stock -var-file applies. See [VarFileLayout] for
	// which of the repository's own layouts this shape fits.
	//
	// Applies to every directory the source's Glob matches - unlike
	// VarFiles, a layout rule is meant to reach a whole wildcarded source,
	// because it reads each directory's own files rather than composing
	// anything.
	VarFileLayout *VarFileLayout `json:"var_file_layout,omitempty"`
}

type OnboardingClass string

type PartialLayer struct {
	// Layer is the stage.
	Layer Layer `json:"layer"`

	// Refusals are the refusal IDs [Analyze] computes offline, sorted. A
	// finding under this layer is always one of these; anything else in the
	// stage's registry is still unseen.
	Refusals []string `json:"refusals"`

	// Total is how many refusals the stage's registry carries, so a reader
	// of a report can see the share rather than take "partly" on trust.
	Total int `json:"total"`
}

type PopulationTotals struct {
	Origin    string `json:"origin"`
	Configs   int    `json:"configs"`
	Loaded    int    `json:"loaded"`
	Blocked   int    `json:"blocked"`
	Clean     int    `json:"clean"`
	Instances int    `json:"instances"`
	Sites     int    `json:"sites"`

	// ReadsAs says what Blocked/Configs means for this population.
	ReadsAs string `json:"reads_as"`
}

type Refusal struct {
	// Layer is which pass produces it.
	Layer Layer

	// ID is the refusal's stable identity: a [lint.Rule] string, or the
	// Summary an identity diagnostic carries. Reports group and rank on
	// this, never on message text.
	ID string

	// Title is the one-line summary a user sees at the head of the
	// refusal: [lint.Rule.Summary] for a lint rule, the Summary itself for
	// an identity refusal, which is already written as one.
	Title string

	// What describes the configuration shape that trips it, where the
	// source table has one. [identity.Refusal.What] fills this; lint keeps
	// its equivalent per-issue rather than per-rule, so a lint refusal
	// leaves it empty and the report shows the first site's detail
	// instead.
	What string

	// DocsRef is the shipped document that explains it, in the form all
	// three source tables use.
	//
	// It was once empty for most identity refusals, and the count of empties
	// was how the repository measured its own documentation gap. Since #110
	// every refusal has an entry in live/LIMITATIONS.md - generated from
	// these same tables - so the field is always set and the check that
	// matters is whether the entry it names exists. That is
	// TestEveryRefusalDocsRefIsResolvable, which is a stronger contract than
	// counting empties ever was: a reference to a heading nobody wrote used
	// to pass.
	DocsRef string

	// RaisedBy is the import path of the package that constructs the
	// diagnostic.
	//
	// For the two live registries it restates [Refusal.Layer] and carries
	// nothing new. It exists for the third: a pass-through refusal surfaces
	// during identity resolution but is written by internal/configs' static
	// evaluator, internal/addrs' reference parser or HCL itself, and that
	// distinction is the whole reason those refusals were invisible to
	// every instrument until #110. A reader of the artifact should be able
	// to see it without knowing the history.
	RaisedBy string
}

type Report struct {
	// Findings are the refusals that fired, ranked by how many sites each
	// blocks. Empty means every checked pass accepted the configuration.
	Findings []Finding

	// Warnings are the non-fatal diagnostics, ranked the same way. They do
	// not affect [Report.Blocked].
	Warnings []Finding

	// Instances is how many managed resource instances resolved.
	Instances int

	// Identities is what those instances resolved TO: every
	// [identity.Resolution] the run produced, ordered by address.
	//
	// It exists because Instances is a count, and so is every other field
	// on this struct. The whole of this package, the corpus ranking, the
	// cohort ratchet and the refusal probe measure predicates over a
	// verdict - "did we refuse?", "how many sites?" - and the product's
	// actual output is none of those things. It is a string written into a
	// cloud tag and handed to an import. A resolution that renders the
	// wrong string is not a refusal, so it raises no finding, moves no
	// count, and reads as a success everywhere: GitHub issue #251 turned a
	// refusal into a marker naming a queue that does not exist, and
	// Instances went UP.
	//
	// The resolution was already computed here and discarded after
	// result.Len() was read. Carrying it out is what lets a test assert on
	// the value; see TestIdentityGolden.
	Identities []identity.Resolution

	// Shadowed is how many identity refusals fell on a construct lint had
	// already refused, and were therefore not counted as findings. It is
	// reported rather than dropped silently so that the dedupe rule can be
	// checked against a run instead of taken on trust.
	Shadowed int

	// Schemas records whether provider schemas were available. See
	// [Context.Schemas] for why a report is worth less without them.
	Schemas bool

	// Load carries what loading the directory cost, when the caller used
	// [Load]. Unresolved modules and unset variables both bound what the
	// findings below can be trusted to cover.
	Load LoadResult

	// Checked, Partial and Unchecked are the live-path stages this analysis
	// ran in full, ran part of, and did not run. All three are reported,
	// always: a verdict that named only what passed would read as a promise
	// about stages nobody looked at, and one that called a stage unchecked
	// when it computes two of that stage's refusals understates itself in
	// the other direction. See [PartiallyCheckedLayers].
	Checked   []Layer
	Partial   []PartialLayer
	Unchecked []Layer
}

type Site struct {
	// Address is the offending construct in address form, where the rule
	// has one. For a lint issue this is [lint.Issue.Construct]; for an
	// identity or data-read refusal (GitHub issue #290) it is the resource
	// instance address recovered from the diagnostic's
	// [identity.InstanceFailure] tag, in [addrs.AbsResourceInstance.String]
	// form, when the diagnostic carries one.
	Address string

	// Type is the managed resource type. Set for the type-shaped lint
	// rules (see [lint.Issue.Type] and [Finding.Types]), and, since issue
	// #290, for any identity or data-read site whose diagnostic carries an
	// [identity.InstanceFailure] - which is every error identity.ResolveWith
	// raises while working on one instance. Left empty rather than guessed
	// when neither source applies.
	Type string

	// Module is the module path the site is in; empty for the root.
	Module string

	// Detail is the per-site explanation, which is also the remedy text
	// #101's audit put into these messages.
	Detail string

	// Category classifies the reference-subject shape behind this site -
	// [configs.ReferenceCategory], read off the raising diagnostic's Extra
	// field rather than parsed from Detail. Set only for
	// [configs.staticScopeData.StaticValidateReferences]'s refusals; every
	// other rule leaves it empty rather than guessing. See #178.
	Category configs.ReferenceCategory

	// File, Line and Column locate it.
	File   string
	Line   int
	Column int

	// StartByte and EndByte bound the offending construct in File, kept so
	// that its source text can be recovered after the fact. Line and Column
	// locate it for a reader; these locate it for a program.
	StartByte int
	EndByte   int

	// UnsetVarRefs are the required input variables with no value that this
	// site's own source text references, sorted. Non-empty means this
	// refusal may be an artifact of the missing value rather than of the
	// configuration - see [Report.AttributeUnsetVariables].
	UnsetVarRefs []string
}

type TypeCount struct {
	Type  string `json:"type"`
	Sites int    `json:"sites"`
}

type TypeDemand struct {
	Type    string `json:"type"`
	Configs int    `json:"configs"`
}

type UnresolvedModule struct {
	// Path is the module call's address, as "vpc" or "vpc.subnets".
	Path string

	// Source is the source address as written.
	Source string

	// Reason says which of the two resolutions failed, in a form a report
	// can print without rewording.
	Reason string
}

type VarFileLayout struct {
	// VariablesDir is the repository-root-relative directory holding one
	// subdirectory per environment, e.g.
	// ".corpus/govuk-infrastructure/terraform/variables".
	VariablesDir string `json:"variables_dir"`

	// Env selects one of VariablesDir's environment subdirectories. Which
	// environment to read is a convention choice, not something derivable
	// from the layout alone - see live/corpus-manifest.json's own comment
	// for which one this manifest picks and why.
	Env string `json:"env"`
}