@intentius/chant-lexicon-terraform 0.57.0 → 0.58.0

package/src/op/activities/index.ts

@@ -8,30 +8,53 @@
  *   - terraformInit — `init` with the root's `backendConfig`.
  *   - terraformPlan — `plan -detailed-exitcode -out=<planFile>`, plus both
  *     `show` renders of the written plan.
- *   - terraformApply — `apply <planFile>`, a saved plan only.
+ *   - terraformApply: `apply <planFile>` on a stock root, a saved plan only;
+ *     `apply -auto-approve` with no plan file on a live root (#2103).
  *   - terraformShow — state, or a saved plan, as JSON and as text.
+ *   - choudoufuLivePlan: `live-plan -detailed-exitcode -json -estate=<estate>`,
+ *     plus a second `live-plan` for the human render (#2103).
+ *   - choudoufuLiveLs: `live-ls -estate=<estate> -json [-consistent]` (#2103).
+ *   - choudoufuLiveCheck: `live-check -json`, no cloud calls (#2103).
+ *   - choudoufuAdopt: the tag writes that claim an adoption ledger's matches (#2105).
  *
  * The module is dependency-light on purpose: it shells out to the configured
  * binary and reads the `terraform` config namespace, and never touches the
- * lexicon's HCL parse or serializer, so a Temporal worker loads it cheaply.
- * The pure command and environment builders are exported alongside the
- * activities because they are what the tests assert on.
+ * lexicon's HCL parse or serializer, so `loadActivities` imports it cheaply at
+ * run time. The pure command and environment builders are exported alongside
+ * the activities because they are what the tests assert on.
  */
 export {
   terraformInit,
   terraformPlan,
   terraformApply,
   terraformShow,
+  choudoufuLivePlan,
+  choudoufuLiveLs,
+  choudoufuLiveCheck,
+  choudoufuAdopt,
   terraformInitCommand,
   terraformPlanCommand,
   terraformApplyCommand,
   terraformShowCommand,
+  choudoufuLivePlanCommand,
+  choudoufuLiveLsCommand,
+  choudoufuLiveCheckCommand,
   terraformEnvironment,
   terraformBinary,
   countPlanChanges,
+  countLivePlanUnowned,
+  isOlderVersion,
+  parseChoudoufuVersion,
   quoteArg,
   DEFAULT_PLAN_FILE,
   DEFAULT_TERRAFORM_BINARY,
+  DEFAULT_LIVE_PLAN_DOCUMENT_FILE,
+  MIN_CHOUDOUFU_VERSION,
+  classifyApprovalRefusal,
+  CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL,
+  CHOUDOUFU_APPROVAL_EXIT_CODE,
+  CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL,
+  CHOUDOUFU_WRONG_ESTATE_REFUSAL,
 } from "./terraform";
 
 export type {
@@ -40,9 +63,22 @@ export type {
   TerraformPlanArgs,
   TerraformApplyArgs,
   TerraformShowArgs,
+  ChoudoufuLivePlanArgs,
+  ChoudoufuLiveLsArgs,
+  ChoudoufuLiveCheckArgs,
+  ChoudoufuAdoptArgs,
   TerraformInitResult,
   TerraformPlanResult,
   TerraformApplyResult,
+  TerraformApprovalRefusal,
   TerraformShowResult,
+  ChoudoufuLivePlanResult,
+  ChoudoufuLiveLsResult,
+  ChoudoufuLiveCheckResult,
+  ChoudoufuAdoptResult,
+  AdoptionRefusal,
   PlanChangeCounts,
+  LivePlanUnownedCounts,
 } from "./terraform";
+
+export { detectLiveEstate } from "./live-detect";

package/src/op/activities/live-detect.test.ts

@@ -0,0 +1,143 @@
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, test } from "vitest";
+import { detectLiveEstate, detectLivePolicyVerbs } from "./live-detect";
+
+const dirs: string[] = [];
+
+function tempDir(): string {
+  const dir = mkdtempSync(join(tmpdir(), "chant-tf-live-detect-"));
+  dirs.push(dir);
+  return dir;
+}
+
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
+describe("detectLiveEstate (#2103)", () => {
+  test("reads the estate from an estate.chdf.hcl sidecar", () => {
+    const dir = tempDir();
+    writeFileSync(join(dir, "estate.chdf.hcl"), 'estate = "prod-networking"\n');
+    writeFileSync(join(dir, "main.tf"), 'resource "null_resource" "x" {}\n');
+    expect(detectLiveEstate(dir)).toBe("prod-networking");
+  });
+
+  test("reads the estate from a live block nested in a terraform block", () => {
+    const dir = tempDir();
+    writeFileSync(
+      dir + "/main.tf",
+      [
+        "terraform {",
+        "  required_version = \">= 1.5.0\"",
+        "  live {",
+        '    estate = "fixture-estate"',
+        "  }",
+        "}",
+        "",
+        'resource "null_resource" "x" {}',
+        "",
+      ].join("\n"),
+    );
+    expect(detectLiveEstate(dir)).toBe("fixture-estate");
+  });
+
+  test("ignores an unrelated nested block with its own braces", () => {
+    const dir = tempDir();
+    writeFileSync(
+      join(dir, "main.tf"),
+      [
+        "terraform {",
+        "  required_providers {",
+        '    aws = { source = "hashicorp/aws" }',
+        "  }",
+        "  live {",
+        '    estate = "still-found"',
+        "    record_store \"local\" {",
+        '      path = ".tofu-records"',
+        "    }",
+        "  }",
+        "}",
+        "",
+      ].join("\n"),
+    );
+    expect(detectLiveEstate(dir)).toBe("still-found");
+  });
+
+  test("undefined when neither form is present", () => {
+    const dir = tempDir();
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, "main.tf"), 'resource "null_resource" "x" {}\n');
+    expect(detectLiveEstate(dir)).toBeUndefined();
+  });
+
+  test("undefined for a directory that does not exist", () => {
+    expect(detectLiveEstate(join(tmpdir(), "chant-tf-live-detect-does-not-exist"))).toBeUndefined();
+  });
+
+  test("the sidecar wins when both forms are present", () => {
+    const dir = tempDir();
+    writeFileSync(join(dir, "estate.chdf.hcl"), 'estate = "from-sidecar"\n');
+    writeFileSync(
+      join(dir, "main.tf"),
+      ["terraform {", "  live {", '    estate = "from-block"', "  }", "}", ""].join("\n"),
+    );
+    expect(detectLiveEstate(dir)).toBe("from-sidecar");
+  });
+});
+
+describe("detectLivePolicyVerbs (#2106)", () => {
+  test("reads undeclared_tagged and undeclared_untagged out of a nested policy block", () => {
+    const dir = tempDir();
+    writeFileSync(
+      join(dir, "main.tf"),
+      [
+        "terraform {",
+        "  live {",
+        '    estate = "fixture-estate"',
+        "    policy {",
+        '      undeclared_tagged   = "keep"',
+        '      undeclared_untagged = "delete"',
+        "      scope {",
+        '        services = ["ec2"]',
+        "      }",
+        "    }",
+        "  }",
+        "}",
+        "",
+      ].join("\n"),
+    );
+    expect(detectLivePolicyVerbs(dir)).toEqual({ undeclaredTagged: "keep", undeclaredUntagged: "delete" });
+  });
+
+  test("undefined fields when the policy block sets only one of the two", () => {
+    const dir = tempDir();
+    writeFileSync(
+      join(dir, "main.tf"),
+      ["terraform {", "  live {", '    estate = "fixture-estate"', "    policy {", '      undeclared_tagged = "untag"', "    }", "  }", "}", ""].join(
+        "\n",
+      ),
+    );
+    expect(detectLivePolicyVerbs(dir)).toEqual({ undeclaredTagged: "untag", undeclaredUntagged: undefined });
+  });
+
+  test("undefined when the live block declares no policy block", () => {
+    const dir = tempDir();
+    writeFileSync(
+      join(dir, "main.tf"),
+      ["terraform {", "  live {", '    estate = "fixture-estate"', "  }", "}", ""].join("\n"),
+    );
+    expect(detectLivePolicyVerbs(dir)).toBeUndefined();
+  });
+
+  test("undefined when the directory declares no live block at all", () => {
+    const dir = tempDir();
+    writeFileSync(join(dir, "main.tf"), 'resource "null_resource" "x" {}\n');
+    expect(detectLivePolicyVerbs(dir)).toBeUndefined();
+  });
+
+  test("undefined for a directory that does not exist", () => {
+    expect(detectLivePolicyVerbs(join(tmpdir(), "chant-tf-live-detect-does-not-exist"))).toBeUndefined();
+  });
+});

package/src/op/activities/live-detect.ts

@@ -0,0 +1,162 @@
+/**
+ * A fast, regex-based read of whether a root module directory declares a
+ * live estate: an `estate.chdf.hcl` sidecar, or a `live { ... }` block nested
+ * inside a `terraform { ... }` block of some `.tf` file (#2103).
+ *
+ * Deliberately separate from `../../hcl/parse.ts`'s AST-accurate detection
+ * (`blocksToEntities`'s `liveBlocksIn`), which the build and lint paths use.
+ * `op/activities/terraform.ts` is imported by core's activity registry at run
+ * time and is dependency-light on purpose, since it shells out to the
+ * configured binary and never touches the lexicon's HCL parse or serializer,
+ * so it never pulls in
+ * the ~1.8 MB `@cdktf/hcl2json` wasm parser just to decide whether an apply
+ * should run `apply -auto-approve` with no plan file. Plain text and a
+ * hand-rolled brace counter are enough for that narrower question, and the
+ * literal sidecar filename below is kept in sync with `LIVE_SIDECAR_FILENAME`
+ * in `../../hcl/parse.ts` by hand rather than by importing it, for the same
+ * reason.
+ */
+
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+
+/** Kept in sync with `LIVE_SIDECAR_FILENAME` in `../../hcl/parse.ts`. */
+const LIVE_SIDECAR_FILENAME = "estate.chdf.hcl";
+
+/**
+ * Find `keyword {` and return the matching `{ ... }` body's inner text, via
+ * brace counting rather than a regex (HCL bodies nest, and a lone regex
+ * cannot match balanced braces).
+ */
+function extractBalancedBlock(source: string, keyword: string): string | undefined {
+  const re = new RegExp(`\\b${keyword}\\s*\\{`);
+  const opening = re.exec(source);
+  if (!opening) return undefined;
+
+  let depth = 0;
+  let start = -1;
+  for (let i = opening.index; i < source.length; i++) {
+    const ch = source[i];
+    if (ch === "{") {
+      if (depth === 0) start = i + 1;
+      depth++;
+    } else if (ch === "}") {
+      depth--;
+      if (depth === 0) return source.slice(start, i);
+    }
+  }
+  return undefined; // unbalanced, malformed HCL, not this function's problem to diagnose
+}
+
+/** Pull a quoted `estate = "..."` attribute's value out of a block's inner text. */
+function extractEstateAttr(body: string): string | undefined {
+  const match = /estate\s*=\s*"([^"]*)"/.exec(body);
+  return match && match[1] !== "" ? match[1] : undefined;
+}
+
+/** Pull a quoted `<key> = "..."` attribute's value out of a block's inner text. */
+function extractQuotedAttr(body: string, key: string): string | undefined {
+  const match = new RegExp(`\\b${key}\\s*=\\s*"([^"]*)"`).exec(body);
+  return match && match[1] !== "" ? match[1] : undefined;
+}
+
+/**
+ * The declared estate name for the root module directory `dir`, or
+ * `undefined` when none is declared. Checks the `estate.chdf.hcl` sidecar
+ * first (cheaper: one file, no brace matching), then every `.tf` file in
+ * directory order for a `live { }` block nested in a `terraform { }` block.
+ * Returns the first estate name found; a directory with no `.tf` files and
+ * no sidecar (or one this function cannot read) yields `undefined` rather
+ * than throwing, since this is a best-effort check, not the authoritative parse.
+ */
+export function detectLiveEstate(dir: string): string | undefined {
+  const sidecarPath = join(dir, LIVE_SIDECAR_FILENAME);
+  if (existsSync(sidecarPath)) {
+    try {
+      const estate = extractEstateAttr(readFileSync(sidecarPath, "utf-8"));
+      if (estate) return estate;
+    } catch {
+      // fall through to the in-block form
+    }
+  }
+
+  let names: string[];
+  try {
+    names = readdirSync(dir)
+      .filter((f) => f.endsWith(".tf"))
+      .sort();
+  } catch {
+    return undefined;
+  }
+
+  for (const name of names) {
+    let source: string;
+    try {
+      source = readFileSync(join(dir, name), "utf-8");
+    } catch {
+      continue;
+    }
+    const terraformBlock = extractBalancedBlock(source, "terraform");
+    if (terraformBlock === undefined) continue;
+    const liveBlock = extractBalancedBlock(terraformBlock, "live");
+    if (liveBlock === undefined) continue;
+    const estate = extractEstateAttr(liveBlock);
+    if (estate) return estate;
+  }
+
+  return undefined;
+}
+
+/**
+ * The `undeclared_tagged`/`undeclared_untagged` verbs a live root's `policy {
+ * }` block assigns, or `undefined` when the directory declares no `policy`
+ * block at all (#2106). Same best-effort posture as {@link detectLiveEstate}:
+ * a plain read of the in-block form only (the `estate.chdf.hcl` sidecar's own
+ * `policy` block, if choudoufu ever admits one there, is not read here — a
+ * known, narrower gap than the estate check above, which does read the
+ * sidecar). `TerraformApplyOp` (`../../composites/terraform-apply-op.ts`)
+ * uses this to refuse a root whose `policy` sets
+ * `undeclared_untagged = "delete"` outright, at build time, before any
+ * activity runs; TF026 (`../../lint/post-synth/tf026.ts`) checks the same
+ * block's `undeclared_tagged` verb against a root's declared `delete: "never"`
+ * from the parsed HCL entities instead, since a post-synth check already has
+ * the block body in hand and has no need of this file-reading version.
+ */
+export interface LivePolicyVerbs {
+  /** The `undeclared_tagged` quadrant's verb, verbatim, or `undefined` when the attribute is absent (defaults to `"delete"`). */
+  undeclaredTagged?: string;
+  /** The `undeclared_untagged` quadrant's verb, verbatim, or `undefined` when the attribute is absent. */
+  undeclaredUntagged?: string;
+}
+
+export function detectLivePolicyVerbs(dir: string): LivePolicyVerbs | undefined {
+  let names: string[];
+  try {
+    names = readdirSync(dir)
+      .filter((f) => f.endsWith(".tf"))
+      .sort();
+  } catch {
+    return undefined;
+  }
+
+  for (const name of names) {
+    let source: string;
+    try {
+      source = readFileSync(join(dir, name), "utf-8");
+    } catch {
+      continue;
+    }
+    const terraformBlock = extractBalancedBlock(source, "terraform");
+    if (terraformBlock === undefined) continue;
+    const liveBlock = extractBalancedBlock(terraformBlock, "live");
+    if (liveBlock === undefined) continue;
+    const policyBlock = extractBalancedBlock(liveBlock, "policy");
+    if (policyBlock === undefined) continue;
+    return {
+      undeclaredTagged: extractQuotedAttr(policyBlock, "undeclared_tagged"),
+      undeclaredUntagged: extractQuotedAttr(policyBlock, "undeclared_untagged"),
+    };
+  }
+
+  return undefined;
+}

package/src/op/activities/registry.test.ts

@@ -14,10 +14,18 @@
 import { describe, test, expect } from "vitest";
 import { loadActivities, resolveActivity } from "@intentius/chant/op";
 
-describe("loadActivities([\"terraform\"]) (#2086)", () => {
-  test("resolves all four activity names", async () => {
+describe("loadActivities([\"terraform\"]) (#2086, #2103)", () => {
+  test("resolves all seven activity names", async () => {
     const activities = await loadActivities(["terraform"]);
-    for (const name of ["terraformInit", "terraformPlan", "terraformApply", "terraformShow"]) {
+    for (const name of [
+      "terraformInit",
+      "terraformPlan",
+      "terraformApply",
+      "terraformShow",
+      "choudoufuLivePlan",
+      "choudoufuLiveLs",
+      "choudoufuLiveCheck",
+    ]) {
       expect(typeof resolveActivity(activities, name)).toBe("function");
     }
   });

package/src/op/activities/terraform.test.ts

@@ -53,7 +53,11 @@ function execError(code: number, stderr: string, stdout = ""): Error & { code: n
   return Object.assign(new Error(`Command failed (exit ${code})`), { code, stdout, stderr });
 }
 
-vi.mock("node:child_process", () => {
+// Partial, via `importOriginal`: `@intentius/chant/op` reaches the base
+// activities now (chant #2114), and modules on that path promisify
+// `execFile` at load. A wholesale replacement of node:child_process would
+// make them fail to import rather than fail an assertion.
+vi.mock("node:child_process", async (importOriginal) => {
   const custom = Symbol.for("nodejs.util.promisify.custom");
   const exec = ((_cmd: string, _opts: unknown, cb?: (...a: unknown[]) => void) => {
     cb?.(new Error("unmocked exec path"));
@@ -78,7 +82,7 @@ vi.mock("node:child_process", () => {
     }
     return { stdout: "", stderr: "" };
   };
-  return { exec };
+  return { ...(await importOriginal<typeof import("node:child_process")>()), exec };
 });
 
 // ── A real project config to resolve roots against ──────────────────────────
@@ -376,7 +380,7 @@ describe("terraformApply — saved plans only (#2086)", () => {
     expect(result).toMatchObject({ planFile: "chant.tfplan", applied: true });
   });
 
-  test("no planFile: refused before the config is even read, with no bare apply run", async () => {
+  test("no planFile on a stock root: refused, with no bare apply run", async () => {
     const dir = project({ roots: { app: { dir: "./infra" } } });
     await expect(
       terraformApply({ root: "app", cwd: dir } as unknown as { root: string; cwd: string; planFile: string }),