@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/src/testdata/pulumi-member/stack-export.json

@@ -1,53 +0,0 @@
-{
-  "version": 3,
-  "deployment": {
-    "manifest": { "time": "2026-10-20T12:00:00Z", "magic": "x", "version": "v3.100.0" },
-    "resources": [
-      { "urn": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev", "custom": false, "type": "pulumi:pulumi:Stack" },
-      { "urn": "urn:pulumi:dev::app::pulumi:providers:aws::default", "custom": true, "id": "p1", "type": "pulumi:providers:aws" },
-      {
-        "urn": "urn:pulumi:dev::app::aws:s3/bucket:Bucket::assets",
-        "custom": true,
-        "id": "assets-1",
-        "type": "aws:s3/bucket:Bucket",
-        "parent": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev",
-        "provider": "urn:pulumi:dev::app::pulumi:providers:aws::default::p1",
-        "inputs": { "acl": "private" }
-      },
-      {
-        "urn": "urn:pulumi:dev::app::aws:iam/role:Role::web",
-        "custom": true,
-        "id": "web-1",
-        "type": "aws:iam/role:Role",
-        "parent": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev"
-      },
-      {
-        "urn": "urn:pulumi:dev::app::aws:iam/rolePolicy:RolePolicy::webReadsAssets",
-        "custom": true,
-        "id": "web-1:read",
-        "type": "aws:iam/rolePolicy:RolePolicy",
-        "parent": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev",
-        "dependencies": [
-          "urn:pulumi:dev::app::aws:iam/role:Role::web",
-          "urn:pulumi:dev::app::aws:s3/bucket:Bucket::assets",
-          "urn:pulumi:dev::app::aws:s3/bucket:Bucket::elsewhere"
-        ],
-        "inputs": { "policy": { "4dabf18193072939515568f2c6568e55": "1b47061264138c4ac30d75fd1eb44270", "ciphertext": "secret" } }
-      },
-      {
-        "urn": "urn:pulumi:dev::app::my:mod:Web$aws:lambda/function:Function::handler",
-        "custom": true,
-        "id": "fn",
-        "type": "aws:lambda/function:Function",
-        "parent": "urn:pulumi:dev::app::my:mod:Web::web-app",
-        "dependencies": ["urn:pulumi:dev::app::aws:iam/role:Role::web"]
-      },
-      {
-        "urn": "urn:pulumi:dev::app::my:mod:Web::web-app",
-        "custom": false,
-        "type": "my:mod:Web",
-        "parent": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev"
-      }
-    ]
-  }
-}

package/src/testdata/pulumi-unexported/Pulumi.yaml

@@ -1,2 +0,0 @@
-name: app
-runtime: nodejs

package/src/workspace-member.test.ts

@@ -1,89 +0,0 @@
-/**
- * The pulumi member kind's graph block (#3179): the reader project the kind's
- * graph config describes, run through chant graph over a checked-in
- * `pulumi stack export`. Nothing here runs Pulumi.
- */
-import { afterEach, describe, expect, test, vi } from "vitest";
-import { dirname, join } from "node:path";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import type { GraphIR } from "@intentius/chant/graph-ir";
-import { runGraph } from "@intentius/chant/cli/handlers/graph";
-import { readPackageKinds, substituteGraphConfig } from "../../../packages/core/src/workspace/kinds";
-import { terraformPlugin } from "./plugin";
-
-const packageDir = join(import.meta.dirname, "..");
-const member = join(import.meta.dirname, "testdata", "pulumi-member");
-
-const scratch: string[] = [];
-afterEach(async () => {
-  vi.restoreAllMocks();
-  await Promise.all(scratch.splice(0).map((d) => rm(d, { recursive: true, force: true })));
-});
-
-async function graphOf(dir: string): Promise<{ ir: GraphIR; err: string[]; exit: number }> {
-  const graph = readPackageKinds(packageDir).kinds.find((k) => k.name === "pulumi")!.graph!;
-  expect(graph.lexicon).toBe("terraform");
-  const config = substituteGraphConfig(graph.config, { member: "infra", dir, workspace: dirname(dir) });
-  const project = await mkdtemp(join(tmpdir(), "chant-pulumi-member-"));
-  scratch.push(project);
-  await writeFile(join(project, "chant.config.json"), JSON.stringify({ lexicons: ["terraform"], terraform: config, graph: { lint: "report" } }));
-  const out: string[] = [];
-  const err: string[] = [];
-  vi.spyOn(console, "log").mockImplementation((line: unknown) => void out.push(String(line)));
-  vi.spyOn(console, "error").mockImplementation((line: unknown) => void err.push(String(line)));
-  const cwd = process.cwd();
-  process.chdir(project);
-  try {
-    const exit = await runGraph({ args: { command: "graph", path: ".", format: "ir" } as never, plugins: [terraformPlugin], serializers: [] });
-    return { ir: exit === 0 ? (JSON.parse(out.join("\n")) as GraphIR) : { nodes: [], edges: [], groups: {} }, err, exit };
-  } finally {
-    process.chdir(cwd);
-  }
-}
-
-describe("pulumi member graph block (#3179)", () => {
-  test("the export's resources are nodes; provider resources are left out", async () => {
-    const { ir, err, exit } = await graphOf(member);
-    expect(exit, err.join("\n")).toBe(0);
-    expect(ir.nodes.map((n) => [n.id, n.kind]).sort()).toEqual([
-      ["infra/aws:iam/role:Role::web", "aws:iam/role:Role"],
-      ["infra/aws:iam/rolePolicy:RolePolicy::webReadsAssets", "aws:iam/rolePolicy:RolePolicy"],
-      ["infra/aws:s3/bucket:Bucket::assets", "aws:s3/bucket:Bucket"],
-      ["infra/my:mod:Web$aws:lambda/function:Function::handler", "aws:lambda/function:Function"],
-      ["infra/my:mod:Web::web-app", "my:mod:Web"],
-      ["infra/pulumi:pulumi:Stack::app-dev", "pulumi:pulumi:Stack"],
-    ]);
-    expect(ir.meta?.pulumiMember).toEqual({ export: "stack-export.json", objects: 6, exported: true });
-  });
-
-  test("dependencies and parent are edges; a dependency outside the export is not", async () => {
-    const { ir } = await graphOf(member);
-    const edges = ir.edges.map((e) => `${e.from.slice(6)} -> ${e.to.slice(6)} via ${e.viaAttr}`).sort();
-    expect(edges).toEqual([
-      "aws:iam/role:Role::web -> pulumi:pulumi:Stack::app-dev via parent",
-      "aws:iam/rolePolicy:RolePolicy::webReadsAssets -> aws:iam/role:Role::web via dependencies",
-      "aws:iam/rolePolicy:RolePolicy::webReadsAssets -> aws:s3/bucket:Bucket::assets via dependencies",
-      "aws:iam/rolePolicy:RolePolicy::webReadsAssets -> pulumi:pulumi:Stack::app-dev via parent",
-      "aws:s3/bucket:Bucket::assets -> pulumi:pulumi:Stack::app-dev via parent",
-      "my:mod:Web$aws:lambda/function:Function::handler -> aws:iam/role:Role::web via dependencies",
-      "my:mod:Web$aws:lambda/function:Function::handler -> my:mod:Web::web-app via parent",
-      "my:mod:Web::web-app -> pulumi:pulumi:Stack::app-dev via parent",
-    ]);
-  });
-
-  test("inputs are not copied into the graph", async () => {
-    const { ir } = await graphOf(member);
-    expect(JSON.stringify(ir)).not.toContain("ciphertext");
-  });
-
-  test("a program with no export has no nodes, and the member says why", async () => {
-    const { ir, err, exit } = await graphOf(join(import.meta.dirname, "testdata", "pulumi-unexported"));
-    expect(exit, err.join("\n")).toBe(0);
-    expect(ir.nodes).toEqual([]);
-    const report = ir.meta?.pulumiMember as { exported: boolean; reason: string };
-    expect(report.exported).toBe(false);
-    expect(report.reason).toMatch(/pulumi stack export/);
-    expect(err.join("\n")).toMatch(/was not read/);
-  });
-});

package/src/workspace-member.ts

@@ -1,126 +0,0 @@
-/**
- * Reading a pulumi workspace member into the graph (#3179).
- *
- * `chant workspace graph` writes a reader project for a member of kind
- * `pulumi`, with `terraform.pulumiMember` in its config (see
- * `workspace-kinds.json`). The plugin's `buildRoots` hook calls
- * {@link readPulumiMember}, which reads the `pulumi stack export` JSON the
- * member has checked in, at {@link PULUMI_EXPORT_FILE} in its directory. chant
- * never runs the program and never calls `pulumi`: with no export there are no
- * nodes, and `meta.pulumiMember` says `exported: false` and why.
- *
- * Nodes are the export's resources, keyed `<label>/<urn tail>`, where the tail
- * is the URN after its stack and project (`aws:s3/bucket:Bucket::assets`).
- * Provider resources (`pulumi:providers:*`) are left out; the resources that
- * name them are not edged to them. Edges come from each resource's
- * `dependencies` and `parent`, kept only when the target is a node. Inputs and
- * outputs are not copied into the node, since an export can hold secrets.
- */
-import { existsSync, readFileSync } from "node:fs";
-import { basename, join } from "node:path";
-import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
-import type { EntityReference } from "@intentius/chant/graph-ir";
-
-/** The conventional place of the export, in the member's directory. */
-export const PULUMI_EXPORT_FILE = "stack-export.json";
-
-export interface PulumiMemberConfig {
-  /** The member's directory, absolute. */
-  dir: string;
-  /** Names the entities (`<label>/...`): the member's name. */
-  label?: string;
-}
-
-/** What the read found, carried on the graph's `meta.pulumiMember`. */
-export interface PulumiMemberReport {
-  /** The export read, relative to the member's directory. */
-  export?: string;
-  objects: number;
-  /** False when the member has no readable export. */
-  exported: boolean;
-  /** Why nothing was read; set with `exported: false`. */
-  reason?: string;
-}
-
-interface ExportedResource {
-  urn?: unknown;
-  type?: unknown;
-  parent?: unknown;
-  dependencies?: unknown;
-}
-
-const PROVIDER = /^pulumi:providers:/;
-
-/** `urn:pulumi:<stack>::<project>::<tail>`: the tail, or the whole URN when it has another shape. */
-function urnTail(urn: string): string {
-  const parts = urn.split("::");
-  return urn.startsWith("urn:pulumi:") && parts.length >= 4 ? parts.slice(2).join("::") : urn;
-}
-
-export function readPulumiMember(opts: { member: PulumiMemberConfig }): {
-  entities: Map<string, Declarable>;
-  warnings: string[];
-  report: PulumiMemberReport;
-} {
-  const { member } = opts;
-  const label = member.label ?? basename(member.dir);
-  const missing = (reason: string) => ({
-    entities: new Map<string, Declarable>(),
-    warnings: [`pulumi member "${label}" was not read: ${reason}`],
-    report: { objects: 0, exported: false, reason } as PulumiMemberReport,
-  });
-
-  const file = join(member.dir, PULUMI_EXPORT_FILE);
-  if (!existsSync(file)) {
-    return missing(`no ${PULUMI_EXPORT_FILE} in the member; run \`pulumi stack export --file ${PULUMI_EXPORT_FILE}\` and check it in, and chant will read it (chant does not run the program)`);
-  }
-  let resources: ExportedResource[];
-  try {
-    const doc = JSON.parse(readFileSync(file, "utf-8")) as { deployment?: { resources?: unknown } };
-    const list = doc?.deployment?.resources;
-    if (list !== undefined && !Array.isArray(list)) return missing(`${PULUMI_EXPORT_FILE} has a deployment.resources that is not a list`);
-    resources = (list ?? []) as ExportedResource[];
-  } catch (e) {
-    return missing(`${PULUMI_EXPORT_FILE} is not readable JSON: ${(e as Error).message}`);
-  }
-
-  const keyOf = new Map<string, string>();
-  for (const r of resources) {
-    if (typeof r?.urn !== "string" || typeof r.type !== "string" || PROVIDER.test(r.type)) continue;
-    keyOf.set(r.urn, `${label}/${urnTail(r.urn)}`);
-  }
-
-  const entities = new Map<string, Declarable>();
-  for (const r of resources) {
-    const key = typeof r?.urn === "string" ? keyOf.get(r.urn) : undefined;
-    if (!key) continue;
-    const references = new Map<string, EntityReference>();
-    const add = (urn: unknown, via: string) => {
-      const to = typeof urn === "string" ? keyOf.get(urn) : undefined;
-      if (to && to !== key) references.set(`${to}|${via}`, { to, viaAttr: via });
-    };
-    add(r.parent, "parent");
-    for (const d of Array.isArray(r.dependencies) ? r.dependencies : []) add(d, "dependencies");
-    entities.set(key, {
-      lexicon: "terraform",
-      entityType: r.type as string,
-      kind: "resource",
-      props: {},
-      references: [...references.values()],
-      [DECLARABLE_MARKER]: true,
-    } as unknown as Declarable);
-  }
-
-  return { entities, warnings: [], report: { export: PULUMI_EXPORT_FILE, objects: entities.size, exported: true } };
-}
-
-let lastReport: PulumiMemberReport | undefined;
-
-/** The report of the read in this process, left for `graphMeta` (see the aws member reader). */
-export function setLastMemberReport(report: PulumiMemberReport | undefined): void {
-  lastReport = report;
-}
-
-export function lastMemberReport(): PulumiMemberReport | undefined {
-  return lastReport;
-}