@intentius/chant-lexicon-terraform 0.124.44 → 0.124.46

package/src/redact-ir.e2e.test.ts

@@ -0,0 +1,79 @@
+/**
+ * A sensitive variable's literal default stays out of what the commands print
+ * (chant #4377): the real `chant graph --format ir` and `chant search --show`
+ * over `__fixtures__/sensitive-default`, and `chant workspace graph` over a
+ * workspace holding the same file, each grepped for every secret.
+ */
+import { cpSync, readFileSync, symlinkSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { afterAll, afterEach, describe, expect, it, vi } from "vitest";
+import { runGraph } from "@intentius/chant/cli/handlers/graph";
+import { runSearch } from "@intentius/chant/cli/handlers/search";
+import { cleanScratch, declaration, REPO, repo } from "../../../packages/core/src/workspace/__fixtures__/contract-repo";
+import { workspaceGraph } from "../../../packages/core/src/workspace/graph-cli";
+import { SENSITIVE_PLACEHOLDER } from "./hcl/redact";
+import { terraformPlugin } from "./plugin";
+
+const FIXTURE = join(dirname(fileURLToPath(import.meta.url)), "__fixtures__", "sensitive-default");
+const SECRETS = ["tok-string-9f3a", "5432917", "admin-map-77", "pw-map-c0ffee"];
+
+async function inFixture(run: () => Promise<number>): Promise<{ exit: number; out: string; err: string }> {
+  const out: string[] = [];
+  const err: string[] = [];
+  vi.spyOn(console, "log").mockImplementation((line: unknown) => void out.push(String(line)));
+  vi.spyOn(console, "error").mockImplementation((line: unknown) => void err.push(String(line)));
+  const cwd = process.cwd();
+  process.chdir(FIXTURE);
+  try {
+    return { exit: await run(), out: out.join("\n"), err: err.join("\n") };
+  } finally {
+    process.chdir(cwd);
+    vi.restoreAllMocks();
+  }
+}
+
+afterEach(() => vi.restoreAllMocks());
+
+describe("the fixture's secrets stay out of the commands' output", () => {
+  it("chant graph --format ir", async () => {
+    const r = await inFixture(() =>
+      runGraph({ args: { command: "graph", path: ".", format: "ir" } as never, plugins: [terraformPlugin], serializers: [] }),
+    );
+    expect(r.exit, r.err).toBe(0);
+    expect(r.out).toContain(SENSITIVE_PLACEHOLDER);
+    expect(r.out).toContain("us-east-1");
+    for (const secret of SECRETS) expect(r.out).not.toContain(secret);
+  });
+
+  it("chant search --show body,source", async () => {
+    const r = await inFixture(() =>
+      runSearch({ args: { path: "kind:Terraform::Variable", show: "body,source", json: true } as never, plugins: [terraformPlugin], serializers: [] }),
+    );
+    expect(r.exit, r.err).toBe(0);
+    expect(r.out).toContain("api_token");
+    expect(r.out).toContain(SENSITIVE_PLACEHOLDER);
+    for (const secret of SECRETS) expect(r.out).not.toContain(secret);
+  });
+});
+
+describe("chant workspace graph", () => {
+  afterAll(cleanScratch);
+
+  it("composes a terraform member without its sensitive defaults", async () => {
+    const version = (JSON.parse(readFileSync(join(REPO, "lexicons", "terraform", "package.json"), "utf-8")) as { version: string }).version;
+    const root = repo({
+      "chant.workspace.json": declaration([{ name: "net", dir: "estates/net", kind: "terraform" }], {
+        pins: [{ package: "@intentius/chant-lexicon-terraform", version }],
+      }),
+      ".gitignore": "node_modules\n",
+    });
+    cpSync(join(FIXTURE, "net", "main.tf"), join(root, "estates", "net", "main.tf"), { recursive: true });
+    symlinkSync(join(REPO, "node_modules"), join(root, "node_modules"), "dir");
+    const { doc } = await workspaceGraph({ cwd: root });
+    const text = JSON.stringify(doc);
+    expect(text).toContain("net/net/var.api_token");
+    expect(text).toContain(SENSITIVE_PLACEHOLDER);
+    for (const secret of SECRETS) expect(text).not.toContain(secret);
+  }, 240_000);
+});

package/src/redact.test.ts

@@ -0,0 +1,111 @@
+/**
+ * A sensitive variable's literal default is left out of the IR (chant #4377).
+ *
+ * Unit tests on the scanner and on `blocksToEntities`. The commands' output
+ * is grepped in redact-ir.e2e.test.ts.
+ */
+import { describe, expect, it } from "vitest";
+import { redactSensitiveSource, SENSITIVE_PLACEHOLDER } from "./hcl/redact";
+import { blocksToEntities, type TerraformEntity } from "./hcl/parse";
+
+const FILE = `variable "token" {
+  type      = string
+  default   = "hunter2"
+  sensitive = true
+}
+
+variable "port" {
+  default   = 5432
+  sensitive = true
+}
+
+variable "creds" {
+  sensitive = true
+  default = {
+    user = "admin"
+    pass = "s3cret"
+    note = <<-EOT
+      heredoc } with "quotes"
+    EOT
+  }
+  validation {
+    condition     = length(var.creds) > 0
+    error_message = "default = \\"nope\\""
+  }
+}
+
+variable "region" {
+  default = "us-east-1"
+}
+
+variable "plain" {
+  default   = "visible"
+  sensitive = false
+}
+
+resource "aws_db_instance" "main" {
+  password = var.token # default = "hunter2"
+}
+`;
+
+describe("redactSensitiveSource", () => {
+  const out = redactSensitiveSource(FILE);
+
+  it("replaces a string, a number and a multi-line map default", () => {
+    expect(out).toContain("default   = (sensitive)\n  sensitive = true\n}\n\nvariable \"port\"");
+    expect(out).toContain("default   = (sensitive)\n  sensitive = true\n}\n\nvariable \"creds\"");
+    expect(out).toContain("sensitive = true\n  default = (sensitive)\n  validation {");
+    for (const secret of ["hunter2\"\n  sensitive", "5432", "s3cret", "admin", "heredoc"]) expect(out).not.toContain(secret);
+  });
+
+  it("leaves everything else byte for byte", () => {
+    expect(out).toContain('default = "us-east-1"');
+    expect(out).toContain('default   = "visible"');
+    expect(out).toContain('error_message = "default = \\"nope\\""');
+    expect(out).toContain('password = var.token # default = "hunter2"');
+  });
+
+  it("handles a one-line block", () => {
+    expect(redactSensitiveSource('variable "t" { default = "hunter2", sensitive = true }')).toBe('variable "t" { default = (sensitive), sensitive = true }');
+    expect(redactSensitiveSource('variable "t" { sensitive = true, default = "hunter2" }')).toBe('variable "t" { sensitive = true, default = (sensitive) }');
+  });
+});
+
+describe("blocksToEntities", () => {
+  const source = `variable "s" {
+  default   = "str-secret"
+  sensitive = true
+}
+variable "n" {
+  default   = 424242
+  sensitive = true
+}
+variable "m" {
+  sensitive = true
+  default = {
+    a = "map-secret"
+    b = 7
+  }
+}
+variable "open" {
+  default = "visible-default"
+}
+`;
+
+  it("redacts default in source and body but keeps the key, for a string, a number and a map", async () => {
+    const entities = await blocksToEntities([{ name: "main.tf", source }], "app");
+    for (const name of ["s", "n", "m"]) {
+      const e = entities.get(`app/var.${name}`) as TerraformEntity;
+      expect("default" in e.props.body).toBe(true);
+      expect(e.props.body.default).toBe(SENSITIVE_PLACEHOLDER);
+      for (const secret of ["str-secret", "424242", "map-secret"]) expect(JSON.stringify(e.props)).not.toContain(secret);
+    }
+  });
+
+  it("leaves a non-sensitive default alone, in body and source", async () => {
+    const entities = await blocksToEntities([{ name: "main.tf", source }], "app");
+    const e = entities.get("app/var.open") as TerraformEntity;
+    expect(e.props.body.default).toBe("visible-default");
+    expect(e.props.source).toContain('default = "visible-default"');
+  });
+});

package/src/search-build-roots.test.ts

@@ -0,0 +1,125 @@
+/**
+ * `chant search` answers over the graph `chant graph` draws, on a project
+ * whose only entities are a `terraform.roots` root (chant #4365, #4368).
+ *
+ * The fixture is `__fixtures__/search-roots/`: one root, `net`, with a VPC,
+ * two subnets, three security groups, a rule and two instances. It is
+ * lint-clean, because `chant graph --format ir` refuses lint-dirty source. Every assertion runs the real `runSearch` and the real
+ * `runGraph --format ir` in that directory, so the node ids compared are the
+ * ones each command prints.
+ */
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+import type { GraphIR } from "@intentius/chant/graph-ir";
+import { runGraph } from "@intentius/chant/cli/handlers/graph";
+import { runSearch, type SearchJson } from "@intentius/chant/cli/handlers/search";
+import type { LexiconPlugin } from "@intentius/chant/lexicon";
+import { terraformPlugin } from "./plugin";
+
+const FIXTURE = join(dirname(fileURLToPath(import.meta.url)), "__fixtures__", "search-roots");
+
+/** Run one command in the fixture with stdout and stderr captured. */
+async function inFixture(
+  run: () => Promise<number>,
+): Promise<{ exit: number; out: string[]; err: string[] }> {
+  const out: string[] = [];
+  const err: string[] = [];
+  vi.spyOn(console, "log").mockImplementation((line: unknown) => void out.push(String(line)));
+  vi.spyOn(console, "error").mockImplementation((line: unknown) => void err.push(String(line)));
+  const cwd = process.cwd();
+  process.chdir(FIXTURE);
+  try {
+    return { exit: await run(), out, err };
+  } finally {
+    process.chdir(cwd);
+    vi.restoreAllMocks();
+  }
+}
+
+async function search(query: string, plugins: LexiconPlugin[] = [terraformPlugin]): Promise<{ exit: number; json?: SearchJson; out: string[]; err: string[] }> {
+  const r = await inFixture(() => runSearch({ args: { path: query, json: true } as never, plugins, serializers: [] }));
+  return { ...r, ...(r.exit === 0 ? { json: JSON.parse(r.out.join("\n")) as SearchJson } : {}) };
+}
+
+const ids = (json: SearchJson | undefined): string[] => (json?.matches ?? []).map((m) => m.id).sort();
+
+let graph: GraphIR;
+
+beforeAll(async () => {
+  const r = await inFixture(() =>
+    runGraph({ args: { command: "graph", path: ".", format: "ir" } as never, plugins: [terraformPlugin], serializers: [] }),
+  );
+  expect(r.exit, r.err.join("\n")).toBe(0);
+  graph = JSON.parse(r.out.join("\n")) as GraphIR;
+});
+
+afterEach(() => vi.restoreAllMocks());
+
+describe("search over a terraform.roots project (#4365, #4368)", () => {
+  it("kind:Terraform::Resource returns one row per resource graph --format ir lists, with the same ids", async () => {
+    const { exit, json } = await search("kind:Terraform::Resource");
+    expect(exit).toBe(0);
+    const drawn = graph.nodes.filter((n) => n.kind === "Terraform::Resource").map((n) => n.id).sort();
+    expect(drawn.length).toBe(9);
+    expect(ids(json)).toEqual(drawn);
+  });
+
+  it("attr:address=aws_security_group. returns the root's three security groups under graph's ids", async () => {
+    const { json } = await search("attr:address=aws_security_group.");
+    expect(ids(json)).toEqual(["net/aws_security_group.batch", "net/aws_security_group.db", "net/aws_security_group.web"]);
+    const drawn = new Set(graph.nodes.map((n) => n.id));
+    for (const id of ids(json)) expect(drawn.has(id)).toBe(true);
+  });
+
+  it("-> and <- follow the edges graph draws", async () => {
+    // Every group references the VPC through vpc_id.
+    const out = await search("attr:address=aws_security_group. ->[via=vpc_id]attr:address=aws_vpc.main");
+    expect(ids(out.json)).toEqual(["net/aws_security_group.batch", "net/aws_security_group.db", "net/aws_security_group.web"]);
+    const edge = graph.edges.find((e) => e.from === "net/aws_security_group.db" && e.to === "net/aws_vpc.main");
+    expect(edge?.viaAttr).toBe("vpc_id");
+
+    // The rule names db as its group and web as its source; the qualifier
+    // keeps only the first.
+    const ruled = await search("attr:address=aws_security_group. <-attr:address=aws_security_group_rule.");
+    expect(ids(ruled.json)).toEqual(["net/aws_security_group.db", "net/aws_security_group.web"]);
+    const owned = await search("attr:address=aws_security_group. <-[via=security_group_id]attr:address=aws_security_group_rule.");
+    expect(ids(owned.json)).toEqual(["net/aws_security_group.db"]);
+
+    // Transitive (#4359): the instance reaches the VPC through its subnet.
+    const deep = await search("attr:address=aws_instance.db ->{2}attr:address=aws_vpc.main");
+    expect(ids(deep.json)).toEqual(["net/aws_instance.db"]);
+    expect(deep.json!.matches[0].paths[0].hops.length).toBe(2);
+  });
+
+  it("a bare word searches the block, not the whole .tf file in its source attribute", async () => {
+    // Every node in the fixture shares one main.tf, which mentions
+    // aws_security_group, so searching `source` matched all nine.
+    const { json } = await search("aws_security_group");
+    expect(ids(json)).toEqual([
+      // References to a group in the block's body still match.
+      "net/aws_instance.db",
+      "net/aws_instance.web",
+      "net/aws_security_group.batch",
+      "net/aws_security_group.db",
+      "net/aws_security_group.web",
+      "net/aws_security_group_rule.db_pg",
+    ]);
+    // The file is still searchable when that is what the caller asks for.
+    const inFile = await search("attr:source=aws_security_group");
+    expect(ids(inFile.json)).toContain("net/aws_vpc.main");
+  });
+
+  it("a contributor error fails the search with that error, not (no matches)", async () => {
+    const broken: LexiconPlugin = {
+      ...terraformPlugin,
+      buildRoots: async () => {
+        throw new Error("terraform.roots.net: hcl2json could not parse main.tf");
+      },
+    };
+    const { exit, out, err } = await search("kind:Terraform::Resource", [broken]);
+    expect(exit).toBe(1);
+    expect(out.join("\n")).not.toContain("no matches");
+    expect(err.join("\n")).toContain("hcl2json could not parse main.tf");
+  });
+});

package/src/search-count.test.ts

@@ -0,0 +1,144 @@
+/**
+ * `chant search --count-by` on Terraform roots (chant #4360), run through the
+ * real handler: the roots are read by this lexicon's `buildRoots()`, joined to
+ * discovery the way `chant graph` joins them, and grouped by core.
+ *
+ * The fixture is `src/__fixtures__/graph-roots/` (two roots, `app` calling a
+ * local `cdn` module), copied to a temporary project with a `chant.config.ts`
+ * naming both roots.
+ */
+
+import { cpSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
+import { runSearch } from "@intentius/chant/cli/handlers/search";
+import type { CommandContext } from "@intentius/chant/cli/registry";
+import { terraformPlugin } from "./plugin";
+
+const TREE = join(dirname(fileURLToPath(import.meta.url)), "__fixtures__", "graph-roots");
+
+let dir: string;
+let cwd: string;
+
+beforeAll(() => {
+  dir = mkdtempSync(join(tmpdir(), "chant-search-count-"));
+  cpSync(join(TREE, "app"), join(dir, "app"), { recursive: true });
+  cpSync(join(TREE, "network"), join(dir, "network"), { recursive: true });
+  writeFileSync(
+    join(dir, "chant.config.ts"),
+    `export default { lexicons: ["terraform"], terraform: { binary: "terraform", roots: { app: { dir: "./app" }, network: { dir: "./network" } } } };\n`,
+  );
+  cwd = process.cwd();
+  process.chdir(dir);
+});
+
+afterAll(() => {
+  process.chdir(cwd);
+  rmSync(dir, { recursive: true, force: true });
+});
+
+/** Run `chant search` and return its exit code and stdout lines. */
+async function search(args: Partial<CommandContext["args"]>): Promise<{ code: number; out: string[] }> {
+  const out: string[] = [];
+  const log = vi.spyOn(console, "log").mockImplementation((...a: unknown[]) => void out.push(a.join(" ")));
+  const err = vi.spyOn(console, "error").mockImplementation(() => {});
+  try {
+    const code = await runSearch({ args: { path: "", ...args }, plugins: [terraformPlugin], serializers: [] } as unknown as CommandContext);
+    return { code, out };
+  } finally {
+    log.mockRestore();
+    err.mockRestore();
+  }
+}
+
+/** The group lines of a grouped answer, as `[count, group]`. */
+function groups(out: string[]): Array<[number, string]> {
+  return out
+    .map((l) => /^\s*(\d+)\s{2}(.+)$/.exec(l))
+    .filter((m): m is RegExpExecArray => !!m)
+    .map((m) => [Number(m[1]), m[2]]);
+}
+
+/** The total printed on the `— N total` line. */
+function total(out: string[]): number {
+  const line = out.find((l) => /^— \d+ total/.test(l));
+  return Number(/^— (\d+) total/.exec(line ?? "")?.[1]);
+}
+
+describe("chant search on a Terraform project", () => {
+  it("sees the roots' blocks at all", async () => {
+    const { code, out } = await search({ path: "kind:Terraform::Resource" });
+    expect(code).toBe(0);
+    expect(out).toContain("app/aws_instance.web  aws_instance");
+    expect(out).toContain("network/aws_vpc.main  aws_vpc");
+  });
+});
+
+describe("--count-by on a Terraform project", () => {
+  it("module comes from the address, root-module blocks are (root), qualified per root", async () => {
+    const { code, out } = await search({ countBy: "module" });
+    expect(code).toBe(0);
+    const g = groups(out);
+    expect(g).toContainEqual([2, "app/module.cdn"]);
+    expect(g.find(([, name]) => name === "app/(root)")).toBeDefined();
+    expect(g.find(([, name]) => name === "network/(root)")).toBeDefined();
+    expect(g.reduce((s, [c]) => s + c, 0)).toBe(total(out));
+  });
+
+  it("kind groups Terraform resources by resource type", async () => {
+    const { out } = await search({ path: "kind:Terraform::Resource", countBy: "kind" });
+    const g = groups(out);
+    expect(g.map(([, name]) => name)).toEqual(["aws_cloudfront_distribution", "aws_instance", "aws_s3_bucket", "aws_vpc"]);
+    expect(total(out)).toBe(4);
+  });
+
+  it("combined with a query, counts only the matches", async () => {
+    const all = await search({ countBy: "module" });
+    const resources = await search({ path: "kind:Terraform::Resource", countBy: "module" });
+    expect(total(resources.out)).toBe(4);
+    expect(total(all.out)).toBeGreaterThan(4);
+    expect(groups(resources.out)).toEqual([
+      [2, "app/(root)"],
+      [1, "app/module.cdn"],
+      [1, "network/(root)"],
+    ]);
+  });
+
+  it("an attribute most blocks lack is counted under (none), and the groups add up", async () => {
+    const { out } = await search({ countBy: "attr:expansion" });
+    const g = groups(out);
+    expect(g).toContainEqual([1, "count"]);
+    expect(g.find(([, name]) => name === "(none)")).toBeDefined();
+    expect(g.reduce((s, [c]) => s + c, 0)).toBe(total(out));
+  });
+
+  it("with --json, prints the groups and the total as one object", async () => {
+    const { code, out } = await search({ path: "kind:Terraform::Resource", countBy: "module", json: true });
+    expect(code).toBe(0);
+    expect(out).toHaveLength(1);
+    const body = JSON.parse(out[0]);
+    expect(body).toMatchObject({ countBy: "module", total: 4, source: { kind: "declared" } });
+    expect(body.groups).toEqual([
+      { group: "app/(root)", count: 2, ids: ["app/aws_instance.web", "app/aws_s3_bucket.assets"] },
+      { group: "app/module.cdn", count: 1, ids: ["app/module.cdn/aws_cloudfront_distribution.cdn"] },
+      { group: "network/(root)", count: 1, ids: ["network/aws_vpc.main"] },
+    ]);
+    expect(body.matches).toBeUndefined();
+    // #4367: the provenance line rides beside the groups.
+    expect(body.provenance).toBe("declared only · no observation · physical ids unavailable");
+  });
+
+  it("with --json, a grouping it cannot read is a document with error (#4367)", async () => {
+    const { code, out } = await search({ countBy: "provider", json: true });
+    expect(code).toBe(1);
+    expect(out).toHaveLength(1);
+    expect(JSON.parse(out[0]).error.message).toBeTruthy();
+  });
+
+  it("refuses a grouping it cannot read", async () => {
+    const { code } = await search({ countBy: "provider" });
+    expect(code).toBe(1);
+  });
+});

package/src/search-kind-type.test.ts

@@ -0,0 +1,136 @@
+/**
+ * `chant search "kind:<terraform type>"` (chant #4366).
+ *
+ * Every terraform resource is `Terraform::Resource` on the IR, so `kind:` used
+ * to match nothing finer than that. The lexicon now carries each resource's
+ * type and name as `attrs.type` and `attrs.name`, and `kind:` reads the type
+ * with the `::`-boundary rule moved onto `_`. The fixture
+ * (`src/__fixtures__/kind-type/`) holds two `aws_instance`, an `aws_iam_role`
+ * and an `aws_iam_role_policy`, whose type begins with the role's, and one
+ * `data "aws_ami"`. `--count-by kind` (#4360) groups by the same type, through
+ * the same function, which the last test holds it to.
+ */
+
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+import { buildGraphIr, type GraphIR, type IRNode } from "@intentius/chant/graph-ir";
+import { enrichEffectiveTopology } from "@intentius/chant/graph-effective";
+import { __searchInternals, resolveKindTerms, runSearch } from "@intentius/chant/cli/handlers/search";
+import { countGroups } from "@intentius/chant/cli/handlers/search-count";
+import { renderTerraformRoots } from "./hcl/roots";
+import { terraformPlugin } from "./plugin";
+
+const FIXTURE = join(dirname(fileURLToPath(import.meta.url)), "__fixtures__", "kind-type");
+const { parseQuery, matchTerm, explain } = __searchInternals;
+
+let ir: GraphIR;
+
+beforeAll(async () => {
+  const rendered = await renderTerraformRoots({ projectRoot: FIXTURE, roots: { app: { dir: "./app" } } });
+  expect(rendered.warnings).toEqual([]);
+  ir = enrichEffectiveTopology(buildGraphIr(rendered.entities));
+});
+
+function search(query: string, graph: GraphIR = ir): string[] {
+  const terms = parseQuery(query);
+  resolveKindTerms(terms, graph.nodes);
+  const byId = new Map(graph.nodes.map((n) => [n.id, n]));
+  return graph.nodes.filter((n) => terms.every((t) => matchTerm(n, t, graph, byId))).map((n) => n.id).sort();
+}
+
+describe("the lexicon's resource labels", () => {
+  it("carries type and name on a resource", () => {
+    const web = ir.nodes.find((n) => n.id === "app/aws_instance.web")!;
+    expect(web.kind).toBe("Terraform::Resource");
+    expect(web.attrs.type).toBe("aws_instance");
+    expect(web.attrs.name).toBe("web");
+  });
+
+  it("carries them on a data source, without the data. prefix", () => {
+    const ami = ir.nodes.find((n) => n.id === "app/data.aws_ami.base")!;
+    expect(ami.attrs.type).toBe("aws_ami");
+    expect(ami.attrs.name).toBe("base");
+  });
+
+  it("carries neither on any other block", () => {
+    const other = ir.nodes.filter((n) => n.kind !== "Terraform::Resource" && n.kind !== "Terraform::Data");
+    expect(other.length).toBeGreaterThan(0);
+    for (const n of other) expect(n.attrs.type).toBeUndefined();
+  });
+});
+
+describe('search "kind:<terraform type>"', () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  it("kind:aws_instance returns exactly the two instances", () => {
+    expect(search("kind:aws_instance")).toEqual(["app/aws_instance.web", "app/aws_instance.worker"]);
+  });
+
+  it("kind:aws_iam_role stops at the type and leaves out aws_iam_role_policy", () => {
+    expect(search("kind:aws_iam_role")).toEqual(["app/aws_iam_role.app"]);
+  });
+
+  it("kind:aws_iam_role matches nothing on a graph with a policy and no role", () => {
+    const noRole = { ...ir, nodes: ir.nodes.filter((n) => n.id !== "app/aws_iam_role.app") };
+    expect(search("kind:aws_iam_role", noRole)).toEqual([]);
+  });
+
+  it("a trailing _ or a bare provider name is a prefix, like kind:EC2", () => {
+    expect(search("kind:aws_iam_")).toEqual(["app/aws_iam_role.app", "app/aws_iam_role_policy.app"]);
+    expect(search("kind:aws")).toHaveLength(4);
+  });
+
+  it("a data source is data.<type>, and kind:<type> alone is only resources", () => {
+    expect(search("kind:data.aws_ami")).toEqual(["app/data.aws_ami.base"]);
+    expect(search("kind:aws_ami")).toEqual([]);
+    expect(search("kind:Terraform::Data")).toEqual(["app/data.aws_ami.base"]);
+  });
+
+  it("kind:<group> returns exactly what --count-by kind counts in that group (#4360)", () => {
+    const groups = countGroups(ir.nodes, { by: "kind" });
+    expect(groups.map((g) => g.group)).toEqual(expect.arrayContaining(["aws_instance", "aws_iam_role", "aws_iam_role_policy", "data.aws_ami"]));
+    for (const { group, count } of groups) expect(search(`kind:${group}`), group).toHaveLength(count);
+  });
+
+  it("kind:Terraform::Resource still returns every resource", () => {
+    expect(search("kind:Terraform::Resource")).toHaveLength(4);
+    expect(search("kind:Resource")).toHaveLength(4);
+  });
+
+  it("composes with negation and edges", () => {
+    expect(search("kind:aws_iam_ !kind:aws_iam_role")).toEqual(["app/aws_iam_role_policy.app"]);
+    expect(search("kind:aws_iam_role_policy ->kind:aws_iam_role")).toEqual(["app/aws_iam_role_policy.app"]);
+  });
+
+  it("reads a node with no attrs.type from its address, as a live or older node", () => {
+    const bare: IRNode = { id: "app/aws_instance.legacy", kind: "Terraform::Resource", lexicon: "terraform", attrs: { address: "aws_instance.legacy" } };
+    expect(search("kind:aws_instance", { ...ir, nodes: [...ir.nodes, bare] })).toContain("app/aws_instance.legacy");
+  });
+
+  it("--explain counts against the type", () => {
+    const lines: string[] = [];
+    vi.spyOn(console, "log").mockImplementation((line: unknown) => void lines.push(String(line)));
+    const terms = parseQuery("kind:aws_instance attr:name=web");
+    resolveKindTerms(terms, ir.nodes);
+    const byId = new Map(ir.nodes.map((n) => [n.id, n]));
+    const matches = ir.nodes.filter((n) => terms.every((t) => matchTerm(n, t, ir, byId)));
+    explain(terms, matches, ir, byId, "kind:aws_instance attr:name=web");
+    expect(lines[0]).toBe("— 1 of 2 aws_instance matched  (query: kind:aws_instance attr:name=web)");
+    expect(lines).toContain("  · excluded app/aws_instance.worker — fails attr:name=web");
+  });
+
+  it("end to end: the row shows the type", async () => {
+    const lines: string[] = [];
+    vi.spyOn(console, "log").mockImplementation((line: unknown) => void lines.push(String(line)));
+    const cwd = process.cwd();
+    process.chdir(FIXTURE);
+    try {
+      const exit = await runSearch({ args: { path: "kind:aws_instance" } as never, plugins: [terraformPlugin], serializers: [] });
+      expect(exit).toBe(0);
+    } finally {
+      process.chdir(cwd);
+    }
+    expect(lines.filter((l) => l.startsWith("app/"))).toEqual(["app/aws_instance.web  aws_instance", "app/aws_instance.worker  aws_instance"]);
+  });
+});