@intentius/chant-lexicon-terraform 0.57.0 → 0.58.0

package/src/plugin.test.ts

@@ -9,6 +9,7 @@ import { terraformPlugin } from "./plugin";
 import { terraformConfigSchema } from "./config";
 import {
   DATA_TYPE,
+  LIVE_TYPE,
   PROVIDER_TYPE,
   RESOURCE_TYPE,
   TERRAFORM_TYPE,
@@ -57,6 +58,12 @@ describe("terraform plugin", () => {
     expect(terraformPlugin.postSynthChecks?.().length).toBeGreaterThan(0);
   });
 
+  it("registers the estate-wide reads a live root makes possible (#2104)", () => {
+    expect(terraformPlugin.ambientKinds?.()).toEqual(["Terraform::Resource"]);
+    expect(typeof terraformPlugin.observeAmbient).toBe("function");
+    expect(typeof terraformPlugin.teardownOwned).toBe("function");
+  });
+
   it("registers the LSP providers and docs", () => {
     expect(typeof terraformPlugin.completionProvider).toBe("function");
     expect(typeof terraformPlugin.hoverProvider).toBe("function");
@@ -227,6 +234,67 @@ describe("buildRoots", () => {
   });
 });
 
+describe("buildRoots: choudoufu live mode (#2103)", () => {
+  it("marks every entity live and carries the estate, under binary: choudoufu", async () => {
+    const { entities, warnings } = await buildRoots(fixtures, {
+      terraform: { binary: "choudoufu", roots: { estate: { dir: "./live" } } },
+    });
+
+    expect(warnings ?? []).toEqual([]);
+    expect([...entities.keys()].sort()).toEqual([
+      "estate/live",
+      "estate/null_resource.first",
+      "estate/null_resource.second",
+      "estate/provider.null",
+      "estate/terraform",
+    ]);
+
+    const live = entities.get("estate/live")!;
+    expect(live.entityType).toBe(LIVE_TYPE);
+    for (const key of entities.keys()) {
+      const props = propsOf(entities.get(key));
+      expect(props.mode).toBe("live");
+      expect(props.estate).toBe("fixture-estate");
+    }
+  });
+
+  it("reads the estate from the estate.chdf.hcl sidecar the same way", async () => {
+    const { entities, warnings } = await buildRoots(fixtures, {
+      terraform: { binary: "choudoufu", roots: { estate: { dir: "./live-sidecar" } } },
+    });
+
+    expect(warnings ?? []).toEqual([]);
+    const live = entities.get("estate/live")!;
+    expect(live.entityType).toBe(LIVE_TYPE);
+    expect(propsOf(live).file).toBe("estate.chdf.hcl");
+    expect(propsOf(entities.get("estate/terraform")).estate).toBe("fixture-estate");
+  });
+
+  it("stays state mode and warns when the estate is declared but the binary is not choudoufu", async () => {
+    const { entities, warnings } = await buildRoots(fixtures, {
+      terraform: { roots: { estate: { dir: "./live" } } },
+    });
+
+    for (const key of entities.keys()) {
+      const props = propsOf(entities.get(key));
+      expect(props.mode).toBe("state");
+      expect(props.estate).toBeUndefined();
+    }
+    expect(warnings).toHaveLength(1);
+    expect(warnings![0]).toContain("terraform.roots.estate");
+    expect(warnings![0]).toContain("inert");
+  });
+
+  it("stays state mode with no live declaration at all, regardless of binary", async () => {
+    const { entities, warnings } = await buildRoots(fixtures, {
+      terraform: { binary: "choudoufu", roots: { app: { dir: "./with-backend" } } },
+    });
+
+    expect(warnings ?? []).toEqual([]);
+    expect(propsOf(entities.get("app/terraform")).mode).toBe("state");
+  });
+});
+
 describe("auditEntities (#2085, parse-to-graph for chant audit)", () => {
   it("parses a joined `# file:` bundle into entities", async () => {
     const hook = terraformPlugin.auditEntities;

package/src/plugin.ts

@@ -5,12 +5,13 @@ import { createSkillsLoader } from "@intentius/chant/lexicon-plugin-helpers";
 import { terraformSerializer } from "./serializer";
 import { rules } from "./lint/rules";
 import { postSynthChecks } from "./lint/post-synth";
+import { withCallersChain } from "./lint/post-synth/scope";
 import { terraformAuditCatalog } from "./lint/audit-catalog";
 import { completions } from "./lsp/completions";
 import { hover } from "./lsp/hover";
 import { terraformConfigSchema, type TerraformConfig } from "./config";
 import { renderTerraformRoots } from "./hcl/roots";
-import { parseTerraformRootContent } from "./hcl/parse";
+import { parseTerraformRootContent, RESOURCE_TYPE } from "./hcl/parse";
 import { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership";
 
 const loadSkills = createSkillsLoader(import.meta.url, [
@@ -70,11 +71,19 @@ export const terraformPlugin: LexiconPlugin = {
   // ── Optional extensions ────────────────────────────────────
 
   /**
-   * Terraform's ownership channel is the state file, not a tag or a label
-   * (#2087). Every address `terraform show -json` returns is `owned`;
-   * everything else is `unknown`. Declaring the channel is what makes that a
-   * claim the conformance suite checks rather than a silent degradation.
-   * See `./describe-resources.ts` and `docs/pages/observation.mdx`.
+   * The ownership channel is per mode, and the channel declared here names
+   * the stock one, because a project's roots are stock unless it opts into
+   * choudoufu.
+   *
+   * On a stock root the channel is the state file, not a tag or a label
+   * (#2087): every address `terraform show -json` returns is `owned` and
+   * everything else is `unknown`. On a live root (#2104) it is choudoufu's
+   * two marker tags, `./live-ownership.ts`'s `TERRAFORM_LIVE_MARKER_KEYS`,
+   * and the verdicts come from `live-plan -json`'s own sections. Both
+   * readings resolve a real verdict on this path, which is what declaring
+   * `describeResources` here claims and what the conformance suite checks,
+   * for both modes. See `./describe-resources.ts` and
+   * `docs/pages/observation.mdx`.
    */
   ownershipChannel: {
     keys: TERRAFORM_STATE_OWNERSHIP_KEYS,
@@ -86,6 +95,26 @@ export const terraformPlugin: LexiconPlugin = {
     return describeResources(options);
   },
 
+  /**
+   * The kinds a live root can enumerate beyond its declaration (#1278,
+   * #2104). Empty on a project with no live root, because `live-ls` is the
+   * only estate-wide read this lexicon has and a stock root has none: a state
+   * file knows what it created and nothing else.
+   */
+  ambientKinds() {
+    return [RESOURCE_TYPE];
+  },
+
+  async observeAmbient(options) {
+    const { observeAmbient } = await import("./describe-resources");
+    return observeAmbient(options);
+  },
+
+  async teardownOwned(options) {
+    const { teardownOwned } = await import("./describe-resources");
+    return teardownOwned(options);
+  },
+
   /**
    * Each entry in `terraform.roots` is a root module directory that parses at
    * build time into one entity per HCL block. The render lives in
@@ -93,23 +122,49 @@ export const terraformPlugin: LexiconPlugin = {
    * project root, which is what relative `dir` paths resolve against.
    */
   async buildRoots(ctx): Promise<{ entities: Map<string, Declarable>; warnings: string[] }> {
-    const roots = (ctx.config as { terraform?: TerraformConfig }).terraform?.roots ?? {};
+    const namespace = (ctx.config as { terraform?: TerraformConfig }).terraform;
+    const roots = namespace?.roots ?? {};
     if (Object.keys(roots).length === 0) return { entities: new Map(), warnings: [] };
-    return renderTerraformRoots({ projectRoot: ctx.projectRoot, roots });
+    return renderTerraformRoots({
+      projectRoot: ctx.projectRoot,
+      roots,
+      binary: namespace?.binary,
+      callModuleType: namespace?.callModuleType,
+    });
   },
 
   lintRules() {
     return rules;
   },
 
+  /**
+   * The generated barrel of checks, each wrapped so a finding inside a
+   * descended child module names the call chain that reached it (#2112). See
+   * `./lint/post-synth/scope.ts`.
+   */
   postSynthChecks() {
-    return postSynthChecks;
+    return withCallersChain(postSynthChecks);
   },
 
   auditCatalog() {
     return terraformAuditCatalog;
   },
 
+  /**
+   * `recommended`/`all` (chant #2113), the tflint-ruleset-terraform shape:
+   * `recommended` is every `merge-worthy` TF rule (a correctness/security
+   * finding worth reporting by default), `all` adds the `report-only` ones
+   * (hygiene the family grows into as #2109/#2110/#2112 land). Derived from
+   * `terraformAuditCatalog` rather than a hand-kept id list, so a rule that
+   * lands in a later, parallel issue is picked up automatically the moment
+   * its catalog entry ships, with no second list to fall out of sync.
+   */
+  lintPresets() {
+    const ids = Object.keys(terraformAuditCatalog);
+    const recommended = ids.filter((id) => terraformAuditCatalog[id].tier === "merge-worthy");
+    return { recommended, all: ids };
+  },
+
   /**
    * Parse-to-graph for `chant audit` (#1567, #2085). `content` is the
    * `# file: <name>`-joined bundle discovery builds for one discovered root
@@ -119,6 +174,17 @@ export const terraformPlugin: LexiconPlugin = {
    * the root name to group and de-duplicate diagnostics within one parse, so
    * this is enough for the same graph-reading check that fires on `chant
    * build` to fire here too. Never throws: malformed HCL yields an empty map.
+   *
+   * Module descent (#2112) reaches this path through the same
+   * `blocksToEntities`, but finds nothing to descend into: this hook is
+   * handed one directory's joined text and no directory to read a local
+   * module's files from, and audit discovery has already classified every
+   * nested `.tf` directory as an audit input of its own (`classifyTerraform`,
+   * `packages/core/src/audit/discover.ts`). So a child module IS audited on
+   * this path, as its own root rather than as a child scope, which means the
+   * two rules that ask "is this block inside a child module?" (TF014, TF015)
+   * report on `chant build` and not in `chant audit`, and TF020 answers per
+   * directory either way. The rule pages say so.
    */
   async auditEntities(content: string): Promise<Map<string, Declarable>> {
     try {

package/src/skills/chant-terraform.md

@@ -65,7 +65,7 @@ export const { op } = TerraformApplyOp({
 });
 ```
 
-`gate: "never"` is what makes the Op runnable under the local executor (`chant run`); any other mode emits a Gate phase, and a gate is durable-runtime work the local executor refuses. The Gate phase always shows the saved plan first and reports its `destroys` count as a `Destroys` search attribute, because `GateStep` carries no condition to branch on at build time — the approver sees what's at stake before approving, rather than the Op deciding for them.
+`gate: "never"` drops the Gate phase, so `chant run` walks straight from Plan to Apply; any other mode emits a Gate phase, and a run that reaches an unapproved gate records a pending fact on the gate ledger, ends `gated` and exits 3 until someone runs `chant approve <op> <gate>`. The Gate phase always shows the saved plan first and reports its `destroys` count as a `Destroys` run outcome, because `GateStep` carries no condition to branch on at build time — the approver sees what's at stake before approving, rather than the Op deciding for them.
 
 Terraform has no automatic rollback, so `compensate: true` with no command throws at build time, naming the Op, rather than warning once an apply has already half-run: