@intentius/chant-lexicon-terraform 0.124.31 → 0.124.33

package/dist/lsp/hover.js

@@ -0,0 +1,45 @@
+/**
+ * LSP hover for the terraform lexicon (#2088). See `./completions.ts`'s
+ * module doc for why this reads `chant.config.*` as text rather than a
+ * generated index, and completes/documents the same two things: a
+ * `terraform.roots` name (when the word under the cursor is quoted next to
+ * it, so an ordinary identifier never gets mistaken for a root) and one of
+ * the composite/builder option keys (`./option-keys.ts`), the latter needing
+ * no reachable config at all.
+ */
+import { resolveRootsForUri } from "./context.js";
+import { ALL_OPTION_KEYS } from "./option-keys.js";
+/** `"app"` or `'app'` — the word is only a root reference if it sits inside a quote pair on the line. */
+function isQuoted(lineText, word) {
+    if (!word)
+        return false;
+    return new RegExp(`["']${word}["']`).test(lineText);
+}
+function rootHover(uri, word, lineText) {
+    if (!isQuoted(lineText, word))
+        return undefined;
+    const roots = resolveRootsForUri(uri);
+    const root = roots?.[word];
+    if (!root)
+        return undefined;
+    const lines = [`**${word}**`, "", "terraform root (`terraform.roots." + word + "`)"];
+    if (root.dir)
+        lines.push("", `\`dir\`: \`${root.dir}\``);
+    if (root.workspace)
+        lines.push("", `\`workspace\`: \`${root.workspace}\``);
+    if (root.varFiles?.length)
+        lines.push("", `\`varFiles\`: ${root.varFiles.map((f) => `\`${f}\``).join(", ")}`);
+    return { contents: lines.join("\n") };
+}
+function optionKeyHover(word) {
+    const detail = ALL_OPTION_KEYS.get(word);
+    if (!detail)
+        return undefined;
+    return { contents: `**${word}**\n\n${detail}` };
+}
+export function hover(ctx) {
+    const word = ctx.word ?? "";
+    if (!word)
+        return undefined;
+    return rootHover(ctx.uri, word, ctx.lineText ?? "") ?? optionKeyHover(word);
+}

package/dist/lsp/option-keys.js

@@ -0,0 +1,93 @@
+/**
+ * The option keys a `*.op.ts` or `chant.config.ts` author types against this
+ * lexicon's config schema (`../config.ts`), its composite
+ * (`../composites/terraform-apply-op.ts`) and its four builders
+ * (`../op/builders.ts`, `../op/activities/terraform.ts`). A fixed table, not
+ * read from any generated registry — there is no upstream schema here (see
+ * `plugin.ts`'s module doc), so this is the same set of fields those files
+ * already document in their own TSDoc, restated once for the editor.
+ */
+/** `TerraformConfig`'s own top-level keys (`terraform: { <here> }`). */
+export const CONFIG_NAMESPACE_KEYS = [
+    { key: "binary", detail: '"terraform" | "tofu" | "choudoufu" — which CLI drives the roots. Default: "terraform".' },
+    { key: "roots", detail: "Named root modules. The name is the entity-key prefix." },
+];
+/** `TerraformRootConfig`'s keys — one entry of `terraform.roots.<name>: { <here> }`. */
+export const ROOT_ENTRY_KEYS = [
+    { key: "dir", detail: "Root module directory, relative to the project root. Required." },
+    { key: "workspace", detail: "Terraform workspace to select for this root. Omitted means `default`." },
+    { key: "varFiles", detail: "`-var-file` arguments, in order, relative to `dir`." },
+    { key: "backendConfig", detail: "`-backend-config` key/value pairs handed to `init`." },
+    { key: "delete", detail: '"never" | "owned-only" | "gated" — this root\'s delete mode, mapped onto choudoufu\'s policy block on a live root.' },
+];
+/** `TerraformApplyOpConfig`'s keys (`TerraformApplyOp({ <here> })`). */
+export const APPLY_OP_KEYS = [
+    { key: "name", detail: "Op name (kebab-case). `gateName` defaults to `approve-<name>`." },
+    { key: "root", detail: "Key into the project's `terraform.roots`." },
+    { key: "planFile", detail: "Plan file written by Plan and consumed by Apply. Default: `chant.tfplan`." },
+    { key: "gate", detail: '"on-destroy" | "always" | "never" — when to emit the approval gate. Default: "on-destroy".' },
+    { key: "gateName", detail: "The gate's name. Default: `approve-<name>`." },
+    { key: "signalName", detail: "Deprecated spelling of `gateName` (#2202). Accepted through 0.59.0, removed in 0.60.0." },
+    { key: "gateTimeout", detail: "How long a recorded pending gate stays valid, as a duration string. Default: core's own (48h)." },
+    { key: "gateDescription", detail: "Override the gate description shown to the approver." },
+    { key: "upgrade", detail: "`-upgrade` on the Init step: re-resolve provider and module versions." },
+    { key: "cwd", detail: "Directory each step starts the `chant.config.*` search from." },
+    { key: "compensate", detail: "Saga-style rollback on a failed apply: `true` with no command throws; supply `{ command }`." },
+];
+/** `compensate`'s own shape when it is an object: `compensate: { <here> }`. */
+export const COMPENSATE_KEYS = [
+    { key: "command", detail: "Shell command that undoes a failed apply — terraform has no automatic rollback." },
+];
+/** Extra opts every builder wrapper accepts alongside its activity's own fields. */
+const STEP_OPTS = [
+    { key: "profile", detail: "Activity profile override (defaults are set per builder)." },
+    { key: "id", detail: 'Step id — required for `.out` references, e.g. `plan.out.planFile`.' },
+];
+/** `terraformInit(root, { <here> })`'s opts — `TerraformInitArgs` minus `root`, plus step opts. */
+export const INIT_OPTS_KEYS = [
+    { key: "upgrade", detail: "`-upgrade`: re-resolve provider and module versions within constraints." },
+    { key: "reconfigure", detail: "`-reconfigure`: ignore any existing backend state and configure afresh." },
+    { key: "cwd", detail: "Directory to start the `chant.config.*` search from." },
+    ...STEP_OPTS,
+];
+/** `terraformPlan(root, { <here> })`'s opts — `TerraformPlanArgs` minus `root`, plus step opts. */
+export const PLAN_OPTS_KEYS = [
+    { key: "planFile", detail: "Plan file to write, relative to the root directory. Default: `chant.tfplan`." },
+    { key: "destroy", detail: "`-destroy`: plan the removal of everything the root manages." },
+    { key: "cwd", detail: "Directory to start the `chant.config.*` search from." },
+    ...STEP_OPTS,
+];
+/** `terraformApply(root, { <here> })`'s opts — `TerraformApplyArgs` minus `root`, plus step opts. */
+export const APPLY_OPTS_KEYS = [
+    {
+        key: "planFile",
+        detail: "The saved plan file to apply. Required on either kind of root; on a live root it is the approval " +
+            "artifact the apply re-plans against and refuses on a mismatch (choudoufu #878).",
+    },
+    { key: "cwd", detail: "Directory to start the `chant.config.*` search from." },
+    ...STEP_OPTS,
+];
+/** `terraformShow(root, { <here> })`'s opts — `TerraformShowArgs` minus `root`, plus step opts. */
+export const SHOW_OPTS_KEYS = [
+    { key: "planFile", detail: "Show this saved plan file. Omitted, the activity shows current state." },
+    { key: "cwd", detail: "Directory to start the `chant.config.*` search from." },
+    ...STEP_OPTS,
+];
+/** Every builder call name mapped to its opts table, for completion inside `(root, { <here> })`. */
+export const BUILDER_OPTS_BY_CALL = {
+    terraformInit: INIT_OPTS_KEYS,
+    terraformPlan: PLAN_OPTS_KEYS,
+    terraformApply: APPLY_OPTS_KEYS,
+    terraformShow: SHOW_OPTS_KEYS,
+};
+/** Every option key across every table, keyed by name, for hover lookup. Last writer wins on a name shared across tables (`cwd`, `planFile`) — the detail text is the same fact restated per activity, so any one of them is a correct hover. */
+export const ALL_OPTION_KEYS = new Map([
+    ...CONFIG_NAMESPACE_KEYS,
+    ...ROOT_ENTRY_KEYS,
+    ...APPLY_OP_KEYS,
+    ...COMPENSATE_KEYS,
+    ...INIT_OPTS_KEYS,
+    ...PLAN_OPTS_KEYS,
+    ...APPLY_OPTS_KEYS,
+    ...SHOW_OPTS_KEYS,
+].map((o) => [o.key, o.detail]));

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.124.31",
+  "version": "0.124.33",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/op/activities/index.js

@@ -0,0 +1,30 @@
+/**
+ * terraform Op activities — resolved by the core activity registry when a
+ * project's `chant.config.ts` lists the `terraform` lexicon. `loadActivities`
+ * (`packages/core/src/op/activity-registry.ts`) imports
+ * `@intentius/chant-lexicon-terraform/op/activities` and keys every exported
+ * function by its name, so there is no plugin member to register:
+ *
+ *   - terraformInit — `init` with the root's `backendConfig`.
+ *   - terraformPlan — `plan -detailed-exitcode -out=<planFile>`, plus both
+ *     `show` renders of the written plan.
+ *   - terraformApply: `apply <planFile>` on a stock root, a saved plan only;
+ *     `apply -auto-approve` with no plan file on a live root (#2103).
+ *   - terraformShow — state, or a saved plan, as JSON and as text.
+ *   - choudoufuLivePlan: `live-plan -detailed-exitcode -json -estate=<estate>`,
+ *     plus a second `live-plan` for the human render (#2103).
+ *   - choudoufuLiveLs: `live-ls -estate=<estate> -json [-consistent]` (#2103).
+ *   - choudoufuLiveCheck: `live-check -json`, no cloud calls (#2103).
+ *   - choudoufuAdopt: the tag writes that claim an adoption ledger's matches (#2105).
+ *   - terraformPinRollout: one run of a pin-bump rollout, opening at most one
+ *     wave's pull request (#3189). It loads the HCL parser on first call.
+ *
+ * The module is dependency-light on purpose: it shells out to the configured
+ * binary and reads the `terraform` config namespace, and never touches the
+ * lexicon's HCL parse or serializer, so `loadActivities` imports it cheaply at
+ * run time. The pure command and environment builders are exported alongside
+ * the activities because they are what the tests assert on.
+ */
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, choudoufuLivePlanCommand, choudoufuLiveLsCommand, choudoufuLiveCheckCommand, terraformEnvironment, terraformBinary, countPlanChanges, countLivePlanUnowned, isOlderVersion, parseChoudoufuVersion, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, DEFAULT_LIVE_PLAN_DOCUMENT_FILE, MIN_CHOUDOUFU_VERSION, classifyApprovalRefusal, CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, CHOUDOUFU_APPROVAL_EXIT_CODE, CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL, CHOUDOUFU_WRONG_ESTATE_REFUSAL, } from "./terraform.js";
+export { detectLiveEstate } from "./live-detect.js";
+export { terraformPinRollout } from "./pin-rollout.js";

package/dist/op/activities/live-detect.js

@@ -0,0 +1,143 @@
+/**
+ * A fast, regex-based read of whether a root module directory declares a
+ * live estate: an `estate.chdf.hcl` sidecar, or a `live { ... }` block nested
+ * inside a `terraform { ... }` block of some `.tf` file (#2103).
+ *
+ * Deliberately separate from `../../hcl/parse.ts`'s AST-accurate detection
+ * (`blocksToEntities`'s `liveBlocksIn`), which the build and lint paths use.
+ * `op/activities/terraform.ts` is imported by core's activity registry at run
+ * time and is dependency-light on purpose, since it shells out to the
+ * configured binary and never touches the lexicon's HCL parse or serializer,
+ * so it never pulls in
+ * the ~1.8 MB `@cdktn/hcl2json` wasm parser just to decide whether an apply
+ * should run `apply -auto-approve` with no plan file. Plain text and a
+ * hand-rolled brace counter are enough for that narrower question, and the
+ * literal sidecar filename below is kept in sync with `LIVE_SIDECAR_FILENAME`
+ * in `../../hcl/parse.ts` by hand rather than by importing it, for the same
+ * reason.
+ */
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+/** Kept in sync with `LIVE_SIDECAR_FILENAME` in `../../hcl/parse.ts`. */
+const LIVE_SIDECAR_FILENAME = "estate.chdf.hcl";
+/**
+ * Find `keyword {` and return the matching `{ ... }` body's inner text, via
+ * brace counting rather than a regex (HCL bodies nest, and a lone regex
+ * cannot match balanced braces).
+ */
+function extractBalancedBlock(source, keyword) {
+    const re = new RegExp(`\\b${keyword}\\s*\\{`);
+    const opening = re.exec(source);
+    if (!opening)
+        return undefined;
+    let depth = 0;
+    let start = -1;
+    for (let i = opening.index; i < source.length; i++) {
+        const ch = source[i];
+        if (ch === "{") {
+            if (depth === 0)
+                start = i + 1;
+            depth++;
+        }
+        else if (ch === "}") {
+            depth--;
+            if (depth === 0)
+                return source.slice(start, i);
+        }
+    }
+    return undefined; // unbalanced, malformed HCL, not this function's problem to diagnose
+}
+/** Pull a quoted `estate = "..."` attribute's value out of a block's inner text. */
+function extractEstateAttr(body) {
+    const match = /estate\s*=\s*"([^"]*)"/.exec(body);
+    return match && match[1] !== "" ? match[1] : undefined;
+}
+/** Pull a quoted `<key> = "..."` attribute's value out of a block's inner text. */
+function extractQuotedAttr(body, key) {
+    const match = new RegExp(`\\b${key}\\s*=\\s*"([^"]*)"`).exec(body);
+    return match && match[1] !== "" ? match[1] : undefined;
+}
+/**
+ * The declared estate name for the root module directory `dir`, or
+ * `undefined` when none is declared. Checks the `estate.chdf.hcl` sidecar
+ * first (cheaper: one file, no brace matching), then every `.tf` file in
+ * directory order for a `live { }` block nested in a `terraform { }` block.
+ * Returns the first estate name found; a directory with no `.tf` files and
+ * no sidecar (or one this function cannot read) yields `undefined` rather
+ * than throwing, since this is a best-effort check, not the authoritative parse.
+ */
+export function detectLiveEstate(dir) {
+    const sidecarPath = join(dir, LIVE_SIDECAR_FILENAME);
+    if (existsSync(sidecarPath)) {
+        try {
+            const estate = extractEstateAttr(readFileSync(sidecarPath, "utf-8"));
+            if (estate)
+                return estate;
+        }
+        catch {
+            // fall through to the in-block form
+        }
+    }
+    let names;
+    try {
+        names = readdirSync(dir)
+            .filter((f) => f.endsWith(".tf"))
+            .sort();
+    }
+    catch {
+        return undefined;
+    }
+    for (const name of names) {
+        let source;
+        try {
+            source = readFileSync(join(dir, name), "utf-8");
+        }
+        catch {
+            continue;
+        }
+        const terraformBlock = extractBalancedBlock(source, "terraform");
+        if (terraformBlock === undefined)
+            continue;
+        const liveBlock = extractBalancedBlock(terraformBlock, "live");
+        if (liveBlock === undefined)
+            continue;
+        const estate = extractEstateAttr(liveBlock);
+        if (estate)
+            return estate;
+    }
+    return undefined;
+}
+export function detectLivePolicyVerbs(dir) {
+    let names;
+    try {
+        names = readdirSync(dir)
+            .filter((f) => f.endsWith(".tf"))
+            .sort();
+    }
+    catch {
+        return undefined;
+    }
+    for (const name of names) {
+        let source;
+        try {
+            source = readFileSync(join(dir, name), "utf-8");
+        }
+        catch {
+            continue;
+        }
+        const terraformBlock = extractBalancedBlock(source, "terraform");
+        if (terraformBlock === undefined)
+            continue;
+        const liveBlock = extractBalancedBlock(terraformBlock, "live");
+        if (liveBlock === undefined)
+            continue;
+        const policyBlock = extractBalancedBlock(liveBlock, "policy");
+        if (policyBlock === undefined)
+            continue;
+        return {
+            undeclaredTagged: extractQuotedAttr(policyBlock, "undeclared_tagged"),
+            undeclaredUntagged: extractQuotedAttr(policyBlock, "undeclared_untagged"),
+        };
+    }
+    return undefined;
+}

package/dist/op/activities/pin-rollout.js

@@ -0,0 +1,45 @@
+/**
+ * `terraformPinRollout`: one run of a pin-bump rollout (#3189), as an Op
+ * activity. `chant terraform pin-rollout` calls the same function.
+ *
+ * Each run reads where the rollout stands on the forge and opens at most one
+ * wave's pull request (`../../pin/rollout.ts`). Run it again, by hand or on
+ * an Op `schedule`, to move on once a wave's PR has merged and its roots have
+ * applied. A run that finds a failed root or a PR closed without merging
+ * throws, naming it, so the run fails rather than reporting success.
+ *
+ * The HCL parser, the pin code and the TypeScript editor load on first call,
+ * so importing the activities loads none of them.
+ */
+import { readFileSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+/** Run one step of a pin-bump rollout. Throws when the rollout has stopped. */
+export async function terraformPinRollout(args) {
+    const result = await readPinRollout(args);
+    if (result.status === "stopped")
+        throw new Error(`pin rollout stopped: ${result.stop}\n${result.summary}`);
+    return result;
+}
+/** The same run, returning a stopped rollout instead of throwing. `chant terraform pin-rollout` calls this. */
+export async function readPinRollout(args) {
+    const { loadHcl2json } = await import("@intentius/chant/terraform/hcl2json");
+    const { runPinRollout, wavesFromChoudoufu } = await import("../../pin/index.js");
+    const { editPinsInTs } = await import("../../pin/edit-ts.js");
+    const cwd = args.cwd ?? process.cwd();
+    const waves = args.wavesFrom ? wavesFromChoudoufu(JSON.parse(readFileSync(isAbsolute(args.wavesFrom) ? args.wavesFrom : join(cwd, args.wavesFrom), "utf-8")), args.wavesPrefix) : undefined;
+    return runPinRollout({
+        module: args.module,
+        from: args.from,
+        to: args.to,
+        cwd,
+        parser: await loadHcl2json(),
+        editTs: editPinsInTs,
+        ...(args.roots ? { roots: args.roots } : {}),
+        ...(args.canaries ? { canaries: args.canaries } : {}),
+        ...(waves ? { waves } : {}),
+        ...(args.mode ? { mode: args.mode } : {}),
+        ...(args.base ? { base: args.base } : {}),
+        ...(args.remote ? { remote: args.remote } : {}),
+        ...(args.appliedCheck ? { appliedCheck: args.appliedCheck } : {}),
+    });
+}