@intentius/chant-lexicon-terraform 0.124.31 → 0.124.32

package/dist/lint/secret-shape.js

@@ -0,0 +1,149 @@
+/**
+ * The two heuristics the secrets rules of the TF family share: does this
+ * attribute's NAME read like a credential, and does its VALUE look like one.
+ *
+ * tfsec shipped `general-secrets-sensitive-in-variable`,
+ * `-in-local` and `-in-attribute`, and trivy dropped all three when it
+ * absorbed tfsec, so no maintained tool checks them today (#2107's survey).
+ * TF007, TF008, TF009 and TF022 are chant's versions, and they only stay
+ * consistent with each other if "secret-shaped" means one thing. That is what
+ * this module is.
+ *
+ * Nothing here re-implements a detector `packages/core/src/audit/secrets.ts`
+ * already has. The value heuristic runs a candidate through `scanForSecrets`
+ * first, so every vendor prefix the SEC family knows (AWS key ids, GitHub,
+ * Slack, Google, Stripe), the PEM block shape and the connection-string shape
+ * are recognised here for free, and it reuses that module's placeholder
+ * vocabulary, its identifier-slug filter and its entropy function. What it
+ * adds is what a Terraform attribute needs and a raw text scan does not: the
+ * JWT and bare PEM-header shapes, and a lower length floor than SEC010's 24
+ * characters, because an attribute value is already a single token rather
+ * than a line of prose to fish tokens out of.
+ */
+import { looksLikeIdentifierSlug, looksLikePlaceholder, scanForSecrets, shannonEntropy, } from "@intentius/chant/audit/secrets";
+/**
+ * Credential words, matched against the whole attribute name on `_`
+ * boundaries, so `db_password` and `access_key` match but `keystore` and
+ * `tokenizer` do not.
+ */
+const SECRET_NAME_RE = /(^|_)(password|passwd|secret|token|api_key|private_key|access_key)(_|$)/;
+/**
+ * Suffixes that turn a credential word into a REFERENCE to a credential:
+ * `secret_arn`, `db_password_file`, `api_key_id`, `private_key_path`,
+ * `token_name`. The value under one of these is a locator, and a locator is
+ * exactly what the fix for the other rules asks for, so flagging it would
+ * flag the remediation.
+ */
+const LOCATOR_SUFFIX_RE = /_(file|path|arn|id|name)$/;
+/** Minimum length for a value to be worth judging at all. */
+export const MIN_SECRET_LENGTH = 8;
+/** Minimum length for the generic high-entropy shape (below it, entropy says nothing). */
+const MIN_ENTROPY_LENGTH = 16;
+/** Bits per character above which a token of that length reads as random. */
+const ENTROPY_THRESHOLD = 3.5;
+/** `eyJ...header.eyJ...payload.signature`. An unsigned JWT still carries claims. */
+const JWT_RE = /^ey[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}(\.[A-Za-z0-9_-]*)?$/;
+/** A PEM header on its own, without the closing block `scanForSecrets` requires. */
+const PEM_HEADER_RE = /-----BEGIN ([A-Z]+ )?PRIVATE KEY-----/;
+/** Normalize an attribute or variable name for the name heuristic. */
+function normalizeName(name) {
+    return name.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+/**
+ * Does this attribute or variable name read like a credential? Case-insensitive
+ * and word-bounded, with the locator suffixes excluded.
+ */
+export function isSecretName(name) {
+    const normalized = normalizeName(name);
+    if (LOCATOR_SUFFIX_RE.test(normalized))
+        return false;
+    return SECRET_NAME_RE.test(normalized);
+}
+/**
+ * Is this a plain string literal, as opposed to an expression? `hcl2json`
+ * renders every expression as a `"${...}"` template, so a value carrying one
+ * is a reference (`var.db_password`, `data.aws_secretsmanager_secret_version.x.secret_string`)
+ * or an interpolation, never a committed constant. Those are the fix, not the
+ * finding.
+ */
+export function isLiteralString(value) {
+    return typeof value === "string" && !value.includes("${");
+}
+/**
+ * A placeholder rather than a credential. Core's list is checked twice: once
+ * as written, once with separators stripped, so the `CHANGE_ME` and
+ * `YOUR_API_KEY` spellings land on the same `changeme` / `your-api-key`
+ * entries as the unseparated ones.
+ */
+export function isPlaceholderValue(value) {
+    return looksLikePlaceholder(value) || looksLikePlaceholder(value.replace(/[-_\s]/g, ""));
+}
+/** At least 3 of {lower, upper, digit, symbol}, which cuts plain words and pure hex. */
+function hasClassDiversity(value) {
+    let classes = 0;
+    if (/[a-z]/.test(value))
+        classes++;
+    if (/[A-Z]/.test(value))
+        classes++;
+    if (/[0-9]/.test(value))
+        classes++;
+    if (/[^A-Za-z0-9]/.test(value))
+        classes++;
+    return classes >= 3;
+}
+/** The generic shape: a long, diverse, high-entropy token that isn't a slug. */
+function isHighEntropyToken(value) {
+    if (value.length < MIN_ENTROPY_LENGTH)
+        return false;
+    if (!/^[A-Za-z0-9+/=_-]+$/.test(value))
+        return false;
+    if (!hasClassDiversity(value))
+        return false;
+    if (looksLikeIdentifierSlug(value))
+        return false;
+    return shannonEntropy(value) >= ENTROPY_THRESHOLD;
+}
+/**
+ * Does this value look like a live credential on its own, whatever it is
+ * called? A known vendor shape (through core's detectors), a JWT, a PEM key,
+ * or a high-entropy token.
+ */
+export function isCredentialShapedValue(value) {
+    if (!isLiteralString(value))
+        return false;
+    if (value.length < MIN_SECRET_LENGTH)
+        return false;
+    if (isPlaceholderValue(value))
+        return false;
+    if (JWT_RE.test(value))
+        return true;
+    if (PEM_HEADER_RE.test(value))
+        return true;
+    // Core's own scan, over the single value: every SEC00x detector plus its
+    // high-entropy catch-all, with no file to walk.
+    if (scanForSecrets([{ path: "value", content: value }]).length > 0)
+        return true;
+    return isHighEntropyToken(value);
+}
+/**
+ * The combined test the rules use: is `value`, assigned to an attribute called
+ * `name`, a committed secret? Either heuristic is enough, but both sides of the
+ * gate are the same, since the value has to be a literal, long enough to be a
+ * credential, and not a placeholder, so `sensitive = true`-style
+ * remediation advice is never given for `password = "changeme"`.
+ *
+ * Findings never carry the value. Callers get the reason and the length.
+ */
+export function secretShapedAssignment(name, value) {
+    if (!isLiteralString(value))
+        return undefined;
+    if (value.length < MIN_SECRET_LENGTH)
+        return undefined;
+    if (isPlaceholderValue(value))
+        return undefined;
+    if (isCredentialShapedValue(value))
+        return { reason: "value", length: value.length };
+    if (isSecretName(name))
+        return { reason: "name", length: value.length };
+    return undefined;
+}

package/dist/live-ownership.js

@@ -0,0 +1,57 @@
+/**
+ * The live root's ownership channel (#2104): choudoufu's two marker tags.
+ *
+ * Sibling of `./state-ownership.ts`, and here for the same mechanical reason:
+ * `plugin.ts` declares `ownershipChannel` eagerly while `describeResources`
+ * is behind a dynamic import, so the key names cannot live in the reader
+ * without dragging the reader, and `node:child_process` with it, into every
+ * plugin load.
+ *
+ * ## Why the keys are declared and the verdicts are set by hand
+ *
+ * The issue that added this asked which of two ways to go: widen core's
+ * `OwnershipChannel` so a lexicon can supply its own classifier, or declare
+ * the keys for discoverability and set the verdicts in the reader, the way
+ * `lexicons/fly/src/ownership.ts` does for its two tiers. The second, and the
+ * reason is that the first buys nothing.
+ *
+ * Core's `classifyOwnership` tests one thing: does `tags[keys.managedBy]`
+ * equal the literal `"chant"`. Nothing in core ever calls it on a lexicon's
+ * behalf. `packages/core/src/ownership.ts` exports it, every lexicon calls it
+ * itself where the test happens to fit, and the ones it does not fit, fly's
+ * app boundary and aws's stack tags, already set verdicts directly. Adding a
+ * `classify` member to `OwnershipChannel` would give core a field only this
+ * lexicon passes and only this lexicon reads back, which is a longer way of
+ * writing the function `./describe-resources.ts` already has.
+ *
+ * What the declaration is still for is the claim it makes. Declaring
+ * `describeResources` on the channel is what turns the observation
+ * conformance suite's ownership assertion from a shape check into a
+ * behavioural one, and that claim holds on a live root exactly as it does on
+ * a stock one, from a different reading. The suite runs for both modes in
+ * `./describe-resources.test.ts`.
+ *
+ * ## The keys, and the slot that does not fit
+ *
+ * `ChannelKeys` is a managed-by / stack / env triple, because everywhere else
+ * chant stamps three tags. choudoufu's marker is two tags and no managed-by
+ * key at all: per `live/MARKERS.md`'s "Ownership semantics", a resource
+ * carrying `tofu-estate` belongs to that estate and there is no secondary
+ * check, so `tofu-estate` is both the managed-by claim and the stack
+ * identity. `tofu-address` takes the third slot because it is the marker's
+ * other half, not because it is an environment: a choudoufu marker has no
+ * environment in it, which is why `ResourceMetadata.marker` on a live read
+ * carries the estate as its `stack` and leaves `env` absent rather than
+ * filling it with an address.
+ */
+/**
+ * The two tag keys `live/MARKERS.md` spec version 1 defines, named here so a
+ * reader of the plugin can see what a live root's verdict is read from.
+ * `./hcl/marker.ts` holds the constants the reader itself uses, along with
+ * the escaping and the ownership semantics that go with them.
+ */
+export const TERRAFORM_LIVE_MARKER_KEYS = {
+    managedBy: "tofu-estate",
+    stack: "tofu-estate",
+    env: "tofu-address",
+};

package/dist/lsp/completions.js

@@ -0,0 +1,95 @@
+/**
+ * LSP completions for the terraform lexicon (#2088).
+ *
+ * k3s's shape (a generated `LexiconIndex` over typed resource classes) does
+ * not fit here: terraform's declarables are lightweight per-HCL-block
+ * entities `buildRoots()` produces at build time, not authored TypeScript
+ * types — there is nothing to generate a completion index from. What an
+ * ops-only lexicon can honestly complete is the surface an `*.op.ts` author
+ * actually types:
+ *
+ *   - `terraform.roots` names, read from the reachable `chant.config.*` (see
+ *     `./context.ts`) — completed inside a root-name position, e.g.
+ *     `terraformPlan("` or `root: "`.
+ *   - the composite/builder option keys (`./option-keys.ts`) — completed
+ *     inside the relevant call's options object.
+ *
+ * Root names complete only when a `chant.config.*` is reachable from the
+ * document's own `uri` and declares at least one; there is no synchronous,
+ * safe way to evaluate `chant.config.ts` (project-authored code) from inside
+ * a completion request, so an unreachable config yields no root-name
+ * completions rather than a guessed one. Option keys need no config at all
+ * and complete unconditionally.
+ */
+import { contentUpToCursor, enclosingCallName, enclosingKeyPath, innermostObjectKey, resolveRootsForUri } from "./context.js";
+import { APPLY_OP_KEYS, BUILDER_OPTS_BY_CALL, COMPENSATE_KEYS, CONFIG_NAMESPACE_KEYS, ROOT_ENTRY_KEYS } from "./option-keys.js";
+/** `terraformPlan("` / `terraformApply(` — the first positional string arg, which every builder types as `root`. */
+const ROOT_POSITIONAL_ARG = new RegExp(`\\b(${Object.keys(BUILDER_OPTS_BY_CALL).join("|")})\\(\\s*["'](\\w*)$`);
+/** `root: "` — the named field, in `TerraformApplyOp({ ... })` or a raw `activity("terraformPlan", { root: "..." })`. */
+const ROOT_NAMED_FIELD = /\broot\s*:\s*["'](\w*)$/;
+function keyCompletions(keys, prefix) {
+    const lower = prefix.toLowerCase();
+    return keys
+        .filter((k) => !lower || k.key.toLowerCase().startsWith(lower))
+        .map((k) => ({
+        label: k.key,
+        insertText: k.key,
+        kind: "property",
+        documentation: k.detail,
+    }));
+}
+function rootCompletions(uri, prefix) {
+    const roots = resolveRootsForUri(uri);
+    if (!roots)
+        return [];
+    const lower = prefix.toLowerCase();
+    return Object.entries(roots)
+        .filter(([name]) => !lower || name.toLowerCase().startsWith(lower))
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([name, root]) => ({
+        label: name,
+        insertText: name,
+        kind: "value",
+        detail: root.dir,
+        documentation: [
+            root.dir ? `dir: ${root.dir}` : undefined,
+            root.workspace ? `workspace: ${root.workspace}` : undefined,
+            root.varFiles?.length ? `varFiles: ${root.varFiles.join(", ")}` : undefined,
+        ]
+            .filter((line) => Boolean(line))
+            .join("\n"),
+    }));
+}
+export function completions(ctx) {
+    const linePrefix = ctx.linePrefix ?? "";
+    const positional = ROOT_POSITIONAL_ARG.exec(linePrefix);
+    if (positional)
+        return rootCompletions(ctx.uri, positional[2]);
+    const namedField = ROOT_NAMED_FIELD.exec(linePrefix);
+    if (namedField)
+        return rootCompletions(ctx.uri, namedField[1]);
+    const upToCursor = contentUpToCursor(ctx.content ?? "", ctx.position?.line ?? 0);
+    const prefix = ctx.wordAtCursor ?? "";
+    const call = enclosingCallName(upToCursor);
+    if (call === "TerraformApplyOp")
+        return keyCompletions(APPLY_OP_KEYS, prefix);
+    if (call && call in BUILDER_OPTS_BY_CALL)
+        return keyCompletions(BUILDER_OPTS_BY_CALL[call], prefix);
+    // `compensate: { <cursor>` — checked independent of the call chain above,
+    // since `compensate` itself sits inside `TerraformApplyOp({ ... })`'s own
+    // argument object, which `enclosingKeyPath` below refuses to walk through.
+    if (innermostObjectKey(upToCursor) === "compensate")
+        return keyCompletions(COMPENSATE_KEYS, prefix);
+    // The remaining contexts are all plain nested object literals with no call
+    // in the chain — `chant.config.ts`'s own `terraform: { ... }` namespace.
+    const path = enclosingKeyPath(upToCursor);
+    if (path) {
+        const last = path[path.length - 1];
+        const parent = path[path.length - 2];
+        if (parent === "roots")
+            return keyCompletions(ROOT_ENTRY_KEYS, prefix);
+        if (last === "terraform")
+            return keyCompletions(CONFIG_NAMESPACE_KEYS, prefix);
+    }
+    return [];
+}

package/dist/lsp/context.js

@@ -0,0 +1,358 @@
+/**
+ * Shared parsing for the terraform LSP pair (#2088).
+ *
+ * There is no generated `LexiconIndex` here (see `completions.ts`'s module
+ * doc for why), so both providers work off two different sources instead:
+ *
+ *   - `terraform.roots`, read out of the project's `chant.config.{ts,json}`.
+ *     `chant.config.ts` is project-authored code (`config.ts`'s own doc:
+ *     "where it is evaluated is a security question"), and evaluating it is
+ *     an async, sandboxed operation — `loadChantConfigUpward` — while
+ *     `completionProvider`/`hoverProvider` are synchronous. So this reads the
+ *     file's *text* and extracts the `terraform.roots` object literal with a
+ *     small brace-matching scanner, never `eval`/`import()`. A shape the
+ *     scanner cannot follow (roots built by a loop, spread from a helper)
+ *     yields no roots rather than a wrong guess — the same "reachable or
+ *     nothing" rule the config-loading code documents elsewhere.
+ *   - the option keys a `*.op.ts` author types: `TerraformApplyOpConfig`
+ *     (`composites/terraform-apply-op.ts`) and the four builders' own opts
+ *     (`op/builders.ts`, `op/activities/terraform.ts`). Those are a fixed
+ *     table, not read from any file.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * Every unmatched opener in `text`, in nesting order (outermost first),
+ * ignoring anything inside a string or template literal. This is the one
+ * pass every context-detection helper below walks backward over — cheap
+ * enough per keystroke since an `*.op.ts` file and a `chant.config.ts` are
+ * both small.
+ */
+function unmatchedOpeners(text) {
+    const stack = [];
+    let inString = null;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (inString) {
+            if (ch === "\\") {
+                i++;
+            }
+            else if (ch === inString) {
+                inString = null;
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === "`") {
+            inString = ch;
+        }
+        else if (ch === "{" || ch === "(" || ch === "[") {
+            stack.push({ char: ch, index: i });
+        }
+        else if (ch === "}" || ch === ")" || ch === "]") {
+            stack.pop();
+        }
+    }
+    return stack;
+}
+/**
+ * The `{ ... }` body starting at `text[openIndex] === "{"`, and the index of
+ * its matching `}`. A single forward pass tracking overall nesting depth —
+ * `{`/`(`/`[` all count the same way, which is safe here because the only
+ * question this asks is "where does *this* brace close," never which bracket
+ * kind matched which.
+ */
+function braceBody(text, openIndex) {
+    if (text[openIndex] !== "{")
+        return undefined;
+    let depth = 0;
+    let inString = null;
+    for (let i = openIndex; i < text.length; i++) {
+        const ch = text[i];
+        if (inString) {
+            if (ch === "\\")
+                i++;
+            else if (ch === inString)
+                inString = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === "`") {
+            inString = ch;
+        }
+        else if (ch === "{" || ch === "(" || ch === "[") {
+            depth++;
+        }
+        else if (ch === "}" || ch === ")" || ch === "]") {
+            depth--;
+            if (depth === 0)
+                return { body: text.slice(openIndex + 1, i), closeIndex: i };
+        }
+    }
+    return undefined;
+}
+/** The `{ ... }` body immediately after the first top-level `key\s*:\s*` in `text`. */
+function findKeyBlock(text, key) {
+    const re = new RegExp(`(?:^|[\\s,{])${key}\\s*:\\s*\\{`, "m");
+    const m = re.exec(text);
+    if (!m)
+        return undefined;
+    const openIndex = m.index + m[0].length - 1;
+    return braceBody(text, openIndex)?.body;
+}
+/** One key/value pair per top-level entry of an object-literal body. */
+function parseEntries(objText) {
+    const entries = new Map();
+    let i = 0;
+    const len = objText.length;
+    while (i < len) {
+        while (i < len && /[\s,]/.test(objText[i]))
+            i++;
+        if (i >= len)
+            break;
+        let key;
+        if (objText[i] === '"' || objText[i] === "'") {
+            const quote = objText[i];
+            let j = i + 1;
+            while (j < len && objText[j] !== quote)
+                j++;
+            key = objText.slice(i + 1, j);
+            i = j + 1;
+        }
+        else {
+            const m = /^[A-Za-z_$][\w$]*/.exec(objText.slice(i));
+            if (!m)
+                break;
+            key = m[0];
+            i += m[0].length;
+        }
+        while (i < len && /\s/.test(objText[i]))
+            i++;
+        if (objText[i] !== ":")
+            break;
+        i++;
+        while (i < len && /\s/.test(objText[i]))
+            i++;
+        if (objText[i] === "{") {
+            const block = braceBody(objText, i);
+            if (!block)
+                break;
+            // Stored without the braces: every caller re-parses an object value as
+            // another set of entries (`parseTerraformRoots` does, one root at a
+            // time), and `parseEntries` itself only knows how to walk a flat
+            // `key: value` sequence, not a single `{ ... }`-wrapped one.
+            entries.set(key, block.body);
+            i = block.closeIndex + 1;
+        }
+        else {
+            let depth = 0;
+            let inString = null;
+            let j = i;
+            while (j < len) {
+                const ch = objText[j];
+                if (inString) {
+                    if (ch === "\\")
+                        j++;
+                    else if (ch === inString)
+                        inString = null;
+                }
+                else if (ch === '"' || ch === "'" || ch === "`") {
+                    inString = ch;
+                }
+                else if (ch === "[" || ch === "(") {
+                    depth++;
+                }
+                else if (ch === "]" || ch === ")") {
+                    depth--;
+                }
+                else if (ch === "," && depth === 0) {
+                    break;
+                }
+                j++;
+            }
+            entries.set(key, objText.slice(i, j));
+            i = j;
+        }
+    }
+    return entries;
+}
+function unquote(raw) {
+    if (raw === undefined)
+        return undefined;
+    const trimmed = raw.trim();
+    const m = /^["'`]([\s\S]*)["'`]$/.exec(trimmed);
+    return m ? m[1] : trimmed;
+}
+function parseStringArray(raw) {
+    if (raw === undefined)
+        return undefined;
+    const inner = raw.trim().replace(/^\[/, "").replace(/\]$/, "");
+    const values = inner
+        .split(",")
+        .map((s) => unquote(s))
+        .filter((s) => typeof s === "string" && s.length > 0);
+    return values.length > 0 ? values : undefined;
+}
+/**
+ * `terraform.roots`, extracted from a `chant.config.ts`/`.json`'s raw text.
+ * Never executes the file. `format` distinguishes the two because JSON's
+ * `roots` value is already a plain object — no brace-matching needed.
+ */
+export function parseTerraformRoots(configText, format) {
+    if (format === "json") {
+        try {
+            const parsed = JSON.parse(configText);
+            const roots = parsed.terraform?.roots;
+            if (!roots || typeof roots !== "object" || Array.isArray(roots))
+                return undefined;
+            const result = {};
+            for (const [name, entry] of Object.entries(roots)) {
+                const e = (entry ?? {});
+                result[name] = {
+                    dir: typeof e.dir === "string" ? e.dir : undefined,
+                    workspace: typeof e.workspace === "string" ? e.workspace : undefined,
+                    varFiles: Array.isArray(e.varFiles) ? e.varFiles.filter((v) => typeof v === "string") : undefined,
+                };
+            }
+            return Object.keys(result).length > 0 ? result : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const terraformBlock = findKeyBlock(configText, "terraform");
+    if (terraformBlock === undefined)
+        return undefined;
+    const rootsBlock = findKeyBlock(terraformBlock, "roots");
+    if (rootsBlock === undefined)
+        return undefined;
+    const result = {};
+    for (const [name, body] of parseEntries(rootsBlock)) {
+        const fields = parseEntries(body);
+        result[name] = {
+            dir: unquote(fields.get("dir")),
+            workspace: unquote(fields.get("workspace")),
+            varFiles: parseStringArray(fields.get("varFiles")),
+        };
+    }
+    return Object.keys(result).length > 0 ? result : undefined;
+}
+function directoryFromUri(uri) {
+    if (!uri.startsWith("file://"))
+        return undefined;
+    try {
+        return dirname(fileURLToPath(uri));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Walk upward from `startDir` for the nearest `chant.config.{ts,json}`. */
+function findConfigUpward(startDir) {
+    let dir = startDir;
+    for (let i = 0; i < 32; i++) {
+        const tsPath = join(dir, "chant.config.ts");
+        if (existsSync(tsPath))
+            return tsPath;
+        const jsonPath = join(dir, "chant.config.json");
+        if (existsSync(jsonPath))
+            return jsonPath;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+    return undefined;
+}
+/**
+ * `terraform.roots`, resolved from the project config reachable from the
+ * document at `uri`. `undefined` when `uri` is not a `file://` URI, no
+ * `chant.config.*` is reachable by walking up from it, or the namespace
+ * declares no roots — every case where root-name completion has nothing
+ * honest to offer, so callers fall back to the option-key completions
+ * instead of fabricating a root list.
+ */
+export function resolveRootsForUri(uri) {
+    const startDir = directoryFromUri(uri);
+    if (!startDir)
+        return undefined;
+    const configPath = findConfigUpward(startDir);
+    if (!configPath)
+        return undefined;
+    try {
+        const text = readFileSync(configPath, "utf-8");
+        return parseTerraformRoots(text, configPath.endsWith(".json") ? "json" : "ts");
+    }
+    catch {
+        return undefined;
+    }
+}
+// ── Call/field context detection ────────────────────────────────────────────
+/** Content of the open document up to (and a little past) the cursor line, mirroring core's `lexiconCompletions`. */
+export function contentUpToCursor(content, line) {
+    return content.split("\n").slice(0, line + 1).join("\n");
+}
+/**
+ * The name of the call whose parenthesized argument list holds the innermost
+ * unmatched `{` before the cursor — `TerraformApplyOp({ ↵ name: "x", ↵ <cursor>`
+ * and `terraformPlan("app", { ↵ <cursor>` both resolve to their call name,
+ * regardless of which positional argument the object is.
+ */
+export function enclosingCallName(text) {
+    const stack = unmatchedOpeners(text);
+    const top = stack[stack.length - 1];
+    if (!top || top.char !== "{")
+        return undefined;
+    const parent = stack[stack.length - 2];
+    if (!parent || parent.char !== "(")
+        return undefined;
+    let k = parent.index - 1;
+    while (k >= 0 && /\s/.test(text[k]))
+        k--;
+    const end = k + 1;
+    while (k >= 0 && /[\w$]/.test(text[k]))
+        k--;
+    const name = text.slice(k + 1, end);
+    return name.length > 0 ? name : undefined;
+}
+/** The `key` immediately before the `{` at `braceIndex`, from `key: {`. */
+function precedingObjectKey(text, braceIndex) {
+    const before = text.slice(0, braceIndex);
+    const m = /(?:^|[\s,{])(["'`]?)([\w$-]+)\1\s*:\s*$/.exec(before);
+    return m?.[2];
+}
+/**
+ * The key of the innermost enclosing object literal, regardless of what
+ * encloses *that* — `compensate: { <cursor>` resolves to `"compensate"` even
+ * though the whole thing sits inside `TerraformApplyOp({ ... })`'s own
+ * argument object, which `enclosingKeyPath` would refuse to walk through (a
+ * call anywhere in the chain ends it there).
+ */
+export function innermostObjectKey(text) {
+    const stack = unmatchedOpeners(text);
+    const top = stack[stack.length - 1];
+    if (!top || top.char !== "{")
+        return undefined;
+    return precedingObjectKey(text, top.index);
+}
+/**
+ * The chain of object-literal keys enclosing the cursor, outermost first —
+ * `["terraform", "roots", "app"]` inside `terraform: { roots: { app: { <cursor>` —
+ * for the plain-object contexts (`chant.config.ts`) that `enclosingCallName`
+ * does not cover, since there is no call there at all. A brace with no `key:`
+ * before it (the module's own `export default {`) contributes nothing to the
+ * path rather than ending it — only a `(` anywhere in the chain does, since
+ * `chant.config.ts` builds one object literal and calling anything
+ * mid-declaration is not a shape this needs to follow.
+ */
+export function enclosingKeyPath(text) {
+    const stack = unmatchedOpeners(text);
+    const path = [];
+    for (const frame of stack) {
+        if (frame.char !== "{")
+            return undefined;
+        const key = precedingObjectKey(text, frame.index);
+        if (key)
+            path.push(key);
+    }
+    return path;
+}