@intentius/chant-lexicon-aws 0.28.0 → 0.30.0

package/src/plugin.ts

@@ -1,6 +1,6 @@
 import { createRequire } from "module";
 import { detectTemplate } from "./detect";
-import type { LexiconPlugin, IntrinsicDef, ResourceMetadata, ExportedTemplate, ResourceSelector, InitTemplateSet, StackStatusObservation } from "@intentius/chant/lexicon";
+import type { LexiconPlugin, IntrinsicDef, ObservationResult, DeepObservationResult, ResourceMetadata, ExportedTemplate, ResourceSelector, InitTemplateSet, StackStatusObservation } from "@intentius/chant/lexicon";
 const require = createRequire(import.meta.url);
 import type { LintRule } from "@intentius/chant/lint/rule";
 import type { TemplateParser } from "@intentius/chant/import/parser";
@@ -16,6 +16,8 @@ import { fileURLToPath } from "url";
 import { awsSerializer } from "./serializer";
 import { FLOCI_EMULATOR } from "./op/activities/floci";
 import { applyAwsEndpointArgv } from "./components/cloud-executor";
+import { stackDoesNotExist } from "./stack-errors";
+import { awsDeepNormalizationHooks, observeResourcesDeepAws } from "./deep-observe";
 import { awsReferenceCatalog } from "./reference-catalog";
 import { resolveTemplateAttrs } from "./live-attrs";
 import { CFParser } from "./import/parser";
@@ -24,12 +26,9 @@ import { parseStackTemplate } from "./import/live-export";
 import { awsCompletions } from "./lsp/completions";
 import { awsHover } from "./lsp/hover";
 
-/** True when a CloudFormation CLI error means the stack simply isn't there yet
- * (`ValidationError … does not exist`) — the pre-first-apply state, which live
- * queries should treat as "nothing deployed", not a failure. Exported for testing. */
-export function stackDoesNotExist(stderr: string): boolean {
-  return /does not exist/i.test(stderr);
-}
+/** Re-exported from ./stack-errors so the long-standing import path (and its
+ * tests) keep working now that the deep reader shares the classifier. */
+export { stackDoesNotExist } from "./stack-errors";
 
 /**
  * AWS CloudFormation lexicon plugin.
@@ -534,8 +533,9 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
     entityNames: string[];
     stack?: string;
     owned?: boolean;
-  }): Promise<Record<string, ResourceMetadata>> {
+  }): Promise<ObservationResult> {
     const { getRuntime } = await import("@intentius/chant/runtime-adapter");
+    const { observation, unobservedAll } = await import("@intentius/chant/observation");
     const rt = getRuntime();
     const resources: Record<string, ResourceMetadata> = {};
 
@@ -544,7 +544,7 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
       // determined here. Degrade to detect-only rather than silently filtering.
       // eslint-disable-next-line no-console
       console.warn(
-        "[aws] ownership filter unavailable on describeResources (no tags from describe-stack-resources) — returning all; use `chant import --from <env> --owned` for ownership-filtered export",
+        "[aws] ownership filter unavailable on describeResources (no tags from describe-stack-resources) — returning all, each with an explicit `unknown` verdict; use `chant import --from <env> --owned` for ownership-filtered export",
       );
     }
 
@@ -565,12 +565,26 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
     if (listResult.exitCode !== 0) {
       // A stack that doesn't exist yet is the pre-first-apply state: nothing is
       // deployed for this env, so there are no live resources (every declared
-      // resource is "pending") — not an error. Returning empty lets `lifecycle
-      // diff --live` / the overlay show pending nodes instead of failing hard.
+      // resource is "pending") — not an error. That is a real absence, so the
+      // empty result is the honest one and `create` is the right proposal.
       if (stackDoesNotExist(listResult.stderr)) {
-        return resources;
+        return observation(resources);
       }
-      throw new Error(`Failed to describe stack "${stackName}": ${listResult.stderr}`);
+      // Any other failure (credentials, throttling, a region that can't be
+      // reached) establishes nothing about what is deployed. Reporting every
+      // declared entity as NOT-OBSERVED (#1089) is what keeps a broken read
+      // from arriving downstream as "none of this exists".
+      const reason = /credential|token|expired|AccessDenied|not authorized|UnauthorizedOperation/i.test(listResult.stderr)
+        ? "no-credentials"
+        : "read-failed";
+      return observation(
+        {},
+        unobservedAll(
+          options.entityNames,
+          reason,
+          `describe-stack-resources failed for stack "${stackName}": ${listResult.stderr.trim().split("\n")[0] ?? ""}`,
+        ),
+      );
     }
 
     const data = JSON.parse(listResult.stdout) as {
@@ -627,13 +641,46 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
         physicalId: stackResource.PhysicalResourceId,
         status: stackResource.ResourceStatus,
         lastUpdated: stackResource.Timestamp,
+        // Total verdict (#1089): describe-stack-resources returns no tags, so
+        // this path cannot read the ownership marker. Say `unknown` explicitly
+        // rather than leaving the field off and letting each consumer guess —
+        // the change set never escalates `unknown` to a delete.
+        ownership: "unknown",
         attributes: Object.keys(attributes).length > 0 ? attributes : undefined,
       };
     }
 
-    return resources;
+    // Every entity the stack answered for was answered for: an entity the
+    // template doesn't carry is genuinely not in this stack, which is an
+    // absence, not a hole.
+    return observation(resources);
   },
 
+  /**
+   * Property-level live read (#1015) via the Cloud Control API — past
+   * CloudFormation's view of the world, into the resource as the service
+   * actually holds it. Implementation in ./deep-observe.ts.
+   */
+  async observeResourcesDeep(options: {
+    environment: string;
+    buildOutput: string;
+    entityNames: string[];
+    entities: Map<string, { entityType: string; props: Record<string, unknown> }>;
+    stack?: string;
+    owned?: boolean;
+  }): Promise<DeepObservationResult> {
+    return observeResourcesDeepAws({
+      environment: options.environment,
+      entityNames: options.entityNames,
+      entities: options.entities,
+      stack: options.stack,
+      owned: options.owned,
+    });
+  },
+
+  /** The noise rules the deep pass applies to both the live and declared trees. */
+  deepNormalizationHooks: awsDeepNormalizationHooks,
+
   async describeStackStatus(options: { environment: string; stack: string }): Promise<StackStatusObservation | null> {
     const { getRuntime } = await import("@intentius/chant/runtime-adapter");
     const rt = getRuntime();

package/src/stack-errors.ts

@@ -0,0 +1,15 @@
+/**
+ * CloudFormation CLI error classification, shared by every live read path.
+ *
+ * Lives in its own module (rather than in ./plugin.ts, where it started) so the
+ * deep reader (#1015) can classify the same failure the same way without
+ * importing the plugin that imports it. ./plugin.ts re-exports it, so the
+ * original import path is unchanged.
+ */
+
+/** True when a CloudFormation CLI error means the stack simply isn't there yet
+ * (`ValidationError … does not exist`) — the pre-first-apply state, which live
+ * queries should treat as "nothing deployed", not a failure. */
+export function stackDoesNotExist(stderr: string): boolean {
+  return /does not exist/i.test(stderr);
+}