Problem

You’re on-call for a fintech platform migrating Terraform state across dozens of modules (core ledger, payments, risk, checkout). A bad move order can break production deploys, causing revenue-impacting outages and compliance incidents.

You are given:

• moves: a list of Terraform state move operations. Each move is [from_addr, to_addr, module].
• dependencies: a list of module dependencies [parent, child] meaning parent must be processed before child.

Your job is to produce a deterministic list of move indices describing a safe execution order.

Requirements

Return a list of indices (0-based) into moves such that:

1. Module ordering respects dependencies (a topological order).
2. If multiple modules are available at the same time (indegree 0), pick the lexicographically smallest module name.
3. Within the same module, execute its moves sorted by lexicographic to_addr.
4. Return [] if the plan is invalid:
   • Any from_addr repeats, or any to_addr repeats.
   • Any to_addr is also present as a from_addr anywhere (would imply moving into an address that is later moved away).
   • The module dependency graph contains a cycle.
   • Additional safety rule: if any move’s to_addr ends with the suffix ".same", treat it as a reserved address and return [].

Examples

Example 1

• Input: dependencies = [["core","payments"],["core","risk"],["payments","checkout"]], moves = [["aws_iam_role.old","module.core.aws_iam_role.new","core"], ["aws_kms_key.pay","module.payments.aws_kms_key.pay","payments"], ["aws_s3_bucket.logs","module.risk.aws_s3_bucket.logs","risk"], ["aws_lb.front","module.checkout.aws_lb.front","checkout"]]
• Output: [0, 1, 2, 3]
• Explanation: core must come before payments and risk; payments must come before checkout. With lexicographic tie-breaks and one move per module, indices follow that module order.

Example 2

• Input: dependencies = [], moves = [["a","module.m.z","m"],["b","module.m.a","m"],["c","module.m.m","m"]]
• Output: [1, 2, 0]
• Explanation: Only one module exists; within it, sort by to_addr: a, m, z.

Notes

• Dependencies may mention modules that have no moves; they still participate in cycle detection and ordering.
• Output must be deterministic across runs.