@intentius/chant-lexicon-terraform 0.57.0

package/src/index.ts

@@ -0,0 +1,65 @@
+// Plugin
+export { terraformPlugin } from "./plugin";
+
+// Serializer
+export { terraformSerializer } from "./serializer";
+
+// The `terraform` config namespace. Importing this package is what brings the
+// `terraform` key into `ChantConfig` (#1344), so the augmentation must be
+// reachable from the entry point.
+export {
+  terraformConfigSchema,
+  terraformRootSchema,
+  type TerraformConfig,
+  type TerraformRootConfig,
+  type TerraformConfigNamespace,
+} from "./config";
+
+// HCL parse: one entity per block, shared by the build path and (from #2085)
+// the audit path.
+export {
+  blocksToEntities,
+  parseTerraformRootContent,
+  parseTerraformRootDir,
+  splitBundleContent,
+  terraformEntity,
+  DATA_TYPE,
+  LOCALS_TYPE,
+  MODULE_TYPE,
+  OUTPUT_TYPE,
+  PROVIDER_TYPE,
+  RESOURCE_TYPE,
+  TERRAFORM_TYPE,
+  VARIABLE_TYPE,
+  type BlockBody,
+  type TerraformEntity,
+  type TerraformFile,
+} from "./hcl/parse";
+
+export { renderTerraformRoots, type TerraformRootsResult } from "./hcl/roots";
+
+// Typed Op step builders (#2086). Same names as the activities they wrap, and
+// like k3s's they are opt-in from the lexicon root — the activities themselves
+// are reached by the registry through `./op/activities`, never from here.
+export { terraformInit, terraformPlan, terraformApply, terraformShow } from "./op/builders";
+
+// The Init/Plan/Gate/Apply composite (#2086).
+export { TerraformApplyOp } from "./composites/terraform-apply-op";
+export type {
+  TerraformApplyOpConfig,
+  TerraformApplyOpResources,
+  TerraformGateMode,
+} from "./composites/terraform-apply-op";
+
+// The Init/Plan/[Report] drift composite (#2087).
+export { TerraformWatchOp } from "./composites/terraform-watch-op";
+export type {
+  TerraformWatchOpConfig,
+  TerraformWatchOpResources,
+  TerraformFindingMode,
+} from "./composites/terraform-watch-op";
+
+// Live observation over `terraform show -json` (#2087). The plugin reaches
+// `describeResources` through a dynamic import; the ownership keys are here
+// because `ownershipChannel` declares them eagerly.
+export { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership";

package/src/lint/audit-catalog.ts

@@ -0,0 +1,30 @@
+/**
+ * The terraform lexicon's chant audit catalog: metadata for its post-synth
+ * checks, contributed through `terraformPlugin.auditCatalog()` (#687, #1346).
+ * Every post-synth check needs an entry or it contributes nothing to
+ * `chant audit`, silently, and `packages/core/src/audit/catalog.test.ts` fails.
+ *
+ * TF001 reads the chant model (`ctx.entities`), never emitted output, so
+ * `yamlBased` is false. Prior-art lineage lives in ./audit-lineage.ts.
+ */
+import type { RuleMeta } from "@intentius/chant/audit/catalog";
+import { applyLineage } from "@intentius/chant/audit/catalog";
+import { terraformAuditLineage } from "./audit-lineage";
+
+export const terraformAuditCatalog: Record<string, RuleMeta> = {
+  TF001: {
+    id: "TF001",
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "correctness",
+    title: "Root module declares no remote backend",
+    remediation:
+      'Add a `backend "<type>"` block (s3, gcs, azurerm, http) or a `cloud {}` block to the root ' +
+      "module's terraform block, then `terraform init -migrate-state`.",
+    yamlBased: false,
+  },
+};
+
+// Prior art credits, if any, live beside the rules in ./audit-lineage.ts (see
+// core audit/prior-art.ts).
+applyLineage(terraformAuditCatalog, terraformAuditLineage);

package/src/lint/audit-lineage.ts

@@ -0,0 +1,21 @@
+/**
+ * Prior art for the terraform lexicon's audit rules: the open-source tools
+ * whose checks cover the same condition, credited per rule. See
+ * packages/core/src/audit/prior-art.ts for the registry, the relation
+ * vocabulary, and why this is credit rather than authority. Kept by hand; the
+ * prior-art sweep (scripts/prior-art-sweep.ts) reports when a credited tool's
+ * index no longer lists a rule cited here.
+ *
+ * TF001 (no remote backend) has no entry here. Checkov's `CKV_TF_*` family
+ * (checkov.io) has no rule for a missing backend block, and
+ * tflint-ruleset-terraform's own rule index
+ * (github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/README.md)
+ * has none either: its closest neighbors are `terraform_required_providers`
+ * (unconstrained provider versions, TF002's territory, not TF001's) and
+ * `terraform_workspace_remote` (a `terraform.workspace` compatibility check
+ * against remote execution, a different condition than "no backend is
+ * configured at all"). Ship with no lineage rather than invent a credit.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+
+export const terraformAuditLineage: Record<string, Lineage[]> = {};

package/src/lint/audit.test.ts

@@ -0,0 +1,45 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import { auditFiles, type ChecksProvider, type EntitiesProvider } from "@intentius/chant/audit/core";
+import { discoverByDetection, type DetectPlugin } from "@intentius/chant/audit/discover";
+import { terraformPlugin } from "../plugin";
+
+/**
+ * End-to-end audit test (#2085 acceptance): `chant audit` (`auditFiles` on top
+ * of real filesystem discovery, `discoverByDetection`) against the #2083
+ * fixture root modules. Real terraform plugin methods are wired in directly
+ * as `checksProvider`/`entitiesProvider` (the same seam `packages/core/src/
+ * audit/core.test.ts` uses) rather than through `loadPlugin`'s package-name
+ * resolution, so this runs against source, not a built `dist/`.
+ */
+const fixtures = join(dirname(fileURLToPath(import.meta.url)), "..", "__fixtures__");
+
+const terraformDetectPlugin: DetectPlugin = { name: "terraform" };
+
+const checksProvider: ChecksProvider = async (lexicon) =>
+  lexicon === "terraform" ? (terraformPlugin.postSynthChecks?.() ?? []) : [];
+
+const entitiesProvider: EntitiesProvider = async (lexicon) =>
+  lexicon === "terraform" ? terraformPlugin.auditEntities?.bind(terraformPlugin) : undefined;
+
+describe("chant audit against a discovered terraform root module", () => {
+  test("reports TF001 once for the no-backend root", async () => {
+    const inputs = discoverByDetection(join(fixtures, "no-backend"), [terraformDetectPlugin]);
+    expect(inputs).toHaveLength(1);
+    expect(inputs[0]!.lexicon).toBe("terraform");
+
+    const findings = await auditFiles(inputs, { checksProvider, entitiesProvider });
+    const tf001 = findings.filter((f) => f.checkId === "TF001");
+    expect(tf001).toHaveLength(1);
+    expect(tf001[0]!.lexicon).toBe("terraform");
+  });
+
+  test("reports nothing for the with-backend root", async () => {
+    const inputs = discoverByDetection(join(fixtures, "with-backend"), [terraformDetectPlugin]);
+    expect(inputs).toHaveLength(1);
+
+    const findings = await auditFiles(inputs, { checksProvider, entitiesProvider });
+    expect(findings.filter((f) => f.checkId === "TF001")).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/index.ts

@@ -0,0 +1,7 @@
+// Code generated by chant generate. DO NOT EDIT.
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { tf001 } from "./tf001";
+
+export const postSynthChecks: PostSynthCheck[] = [
+  tf001,
+];

package/src/lint/post-synth/post-synth.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { tf001 } from "./tf001";
+import { TERRAFORM_TYPE, terraformEntity } from "../../hcl/parse";
+
+/**
+ * The local context builder the k3s checks use. `createPostSynthContext` from
+ * the test-utils package hands back an empty entity map, and every check here
+ * reads `ctx.entities`.
+ */
+function makeCtx(entities: Record<string, ReturnType<typeof terraformEntity>>): PostSynthContext {
+  return {
+    outputs: new Map(),
+    entities: new Map(Object.entries(entities)),
+  } as unknown as PostSynthContext;
+}
+
+/** A `terraform` block entity for root `name`, carrying `body` verbatim. */
+function terraformBlock(root: string, body: Record<string, unknown>): ReturnType<typeof terraformEntity> {
+  return terraformEntity(TERRAFORM_TYPE, "terraform", body, "main.tf", root);
+}
+
+describe("TF001: root module declares no remote backend", () => {
+  test("flags a root whose terraform block has no backend", () => {
+    const diags = tf001.check(
+      makeCtx({ "legacy/terraform": terraformBlock("legacy", { required_version: ">= 1.5.0" }) }),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF001");
+    expect(diags[0].entity).toBe("legacy/terraform");
+    expect(diags[0].lexicon).toBe("terraform");
+    expect(diags[0].message).toContain("legacy");
+  });
+
+  test("passes a root with a backend block", () => {
+    const diags = tf001.check(
+      makeCtx({
+        "app/terraform": terraformBlock("app", { backend: { local: [{ path: "terraform.tfstate" }] } }),
+      }),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("passes a root using Terraform Cloud's cloud block", () => {
+    const diags = tf001.check(
+      makeCtx({
+        "app/terraform": terraformBlock("app", {
+          cloud: [{ organization: "acme", workspaces: { name: "app" } }],
+        }),
+      }),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("fires once per root, not once per terraform block", () => {
+    const diags = tf001.check(
+      makeCtx({
+        "legacy/terraform": terraformBlock("legacy", {}),
+        "legacy/terraform~2": terraformBlock("legacy", { required_version: ">= 1.5.0" }),
+      }),
+    );
+    expect(diags).toHaveLength(1);
+  });
+
+  test("reports each backendless root separately", () => {
+    const diags = tf001.check(
+      makeCtx({
+        "legacy/terraform": terraformBlock("legacy", {}),
+        "other/terraform": terraformBlock("other", {}),
+        "app/terraform": terraformBlock("app", { backend: { s3: [{ bucket: "tfstate" }] } }),
+      }),
+    );
+    expect(diags.map((d) => d.entity).sort()).toEqual(["legacy/terraform", "other/terraform"]);
+  });
+
+  test("ignores a root with no terraform block at all", () => {
+    const diags = tf001.check(
+      makeCtx({
+        "app/null_resource.first": terraformEntity(
+          "Terraform::Resource",
+          "null_resource.first",
+          {},
+          "main.tf",
+          "app",
+        ),
+      }),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("treats an empty backend value as absent", () => {
+    const diags = tf001.check(makeCtx({ "app/terraform": terraformBlock("app", { backend: {} }) }));
+    expect(diags).toHaveLength(1);
+  });
+});

package/src/lint/post-synth/tf001.ts

@@ -0,0 +1,66 @@
+/**
+ * TF001: a root module keeps its state on local disk.
+ *
+ * A `terraform` block with no `backend "<type>"` and no `cloud {}` falls back
+ * to the local backend, which puts `terraform.tfstate` in the working
+ * directory. That file holds every attribute of every managed resource,
+ * secrets included, and it is not shared, not locked, and not versioned. The
+ * first apply from a second machine or a CI runner starts from an empty state
+ * and proposes to create the estate again.
+ *
+ * One diagnostic per root, fired from the root's `terraform` block. A root
+ * with no `terraform` block at all is not flagged: it declares no version
+ * constraints either, and the missing block is a different finding.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { TERRAFORM_TYPE, type BlockBody } from "../../hcl/parse";
+
+/** `backend`/`cloud` are blocks, so hcl2json encodes them as a value under the key. */
+function hasBlock(body: BlockBody, key: string): boolean {
+  const value = body[key];
+  if (value === undefined || value === null) return false;
+  if (Array.isArray(value)) return value.length > 0;
+  return typeof value === "object" ? Object.keys(value as object).length > 0 : true;
+}
+
+export const tf001: PostSynthCheck = {
+  id: "TF001",
+  description: "Root module declares no remote backend",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    /** Root name to the entity key of the first `terraform` block seen for it. */
+    const flagged = new Set<string>();
+
+    for (const [name, entity] of ctx.entities) {
+      if (entity.entityType !== TERRAFORM_TYPE) continue;
+      if (!isResourceDeclarable(entity)) continue;
+      const props = entity.props as { root?: unknown; body?: unknown };
+      const root = typeof props.root === "string" ? props.root : "";
+      if (flagged.has(root)) continue;
+
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      if (hasBlock(body, "backend") || hasBlock(body, "cloud")) continue;
+
+      flagged.add(root);
+      diagnostics.push({
+        checkId: "TF001",
+        severity: "warning",
+        message:
+          `Root module "${root}" declares no remote backend. State falls back to a local ` +
+          "terraform.tfstate, which is unshared, unlocked and holds every resource attribute in " +
+          'plaintext. Add a `backend "<type>"` or a `cloud {}` block to the terraform block.',
+        entity: name,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/index.ts

@@ -0,0 +1,7 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+import { planBeforeApplyRule } from "./plan-before-apply";
+
+export { planBeforeApplyRule } from "./plan-before-apply";
+
+/** All lint rules provided by this lexicon (imported by plugin.ts's lintRules()). */
+export const rules: LintRule[] = [planBeforeApplyRule];

package/src/lint/rules/plan-before-apply.test.ts

@@ -0,0 +1,111 @@
+import { describe, expect, test } from "vitest";
+import * as ts from "typescript";
+import type { LintContext } from "@intentius/chant/lint/rule";
+import { planBeforeApplyRule } from "./plan-before-apply";
+
+function createContext(code: string, fileName = "infra.op.ts"): LintContext {
+  const sourceFile = ts.createSourceFile(fileName, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath: fileName };
+}
+
+describe("TF101: plan-before-apply", () => {
+  test("flags a literal plan path", () => {
+    const diags = planBeforeApplyRule.check(
+      createContext(`
+        const plan = terraformPlan({ root: "app" });
+        const apply = terraformApply({ planFile: "/tmp/plan.out" });
+      `),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("TF101");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain("literal path");
+  });
+
+  test("flags a template literal plan path", () => {
+    const diags = planBeforeApplyRule.check(
+      createContext(`
+        const plan = terraformPlan({ root: "app" });
+        const dir = "/tmp";
+        const apply = terraformApply({ planFile: \`\${dir}/plan.out\` });
+      `),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("literal path");
+  });
+
+  test("flags a reference to a non-plan step", () => {
+    const diags = planBeforeApplyRule.check(
+      createContext(`
+        const notAPlan = someOtherStep({ root: "app" });
+        const apply = terraformApply({ planFile: stepOutput(notAPlan, "planFile") });
+      `),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("not bound to a `terraformPlan");
+  });
+
+  test("passes stepOutput(plan, \"planFile\")", () => {
+    const diags = planBeforeApplyRule.check(
+      createContext(`
+        const plan = terraformPlan({ root: "app" });
+        const apply = terraformApply({ planFile: stepOutput(plan, "planFile") });
+      `),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("passes plan.out.planFile", () => {
+    const diags = planBeforeApplyRule.check(
+      createContext(`
+        const plan = terraformPlan({ root: "app" });
+        const apply = terraformApply({ planFile: plan.out.planFile });
+      `),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag when the target cannot be resolved statically", () => {
+    const diags = planBeforeApplyRule.check(
+      createContext(`
+        const apply = terraformApply({ planFile: plan.out.planFile });
+      `),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("checks the options object when it follows a positional root argument (k3s-shaped builder)", () => {
+    const flagged = planBeforeApplyRule.check(
+      createContext(`
+        const plan = terraformPlan("app", { planFile: "plan.out" });
+        const apply = terraformApply("app", { planFile: "/tmp/plan.out" });
+      `),
+    );
+    expect(flagged).toHaveLength(1);
+    const passing = planBeforeApplyRule.check(
+      createContext(`
+        const plan = terraformPlan("app", { id: "plan" });
+        const apply = terraformApply("app", { planFile: plan.out.planFile });
+      `),
+    );
+    expect(passing).toHaveLength(0);
+  });
+
+  test("does not flag terraformApply calls with no planFile property", () => {
+    const diags = planBeforeApplyRule.check(
+      createContext(`
+        const apply = terraformApply({ root: "app" });
+      `),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag planFile-shaped keys outside terraformApply", () => {
+    const diags = planBeforeApplyRule.check(
+      createContext(`
+        const config = { planFile: "/tmp/plan.out" };
+      `),
+    );
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/rules/plan-before-apply.ts

@@ -0,0 +1,143 @@
+import * as ts from "typescript";
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+
+/**
+ * TF101: terraformApply's planFile must reference a preceding terraformPlan step.
+ *
+ * Applying a plan file chosen by a string means the applied plan can be
+ * stale, hand-edited, or simply the wrong one — the entire point of the
+ * plan/apply split (review exactly what will change, then apply exactly
+ * that) is defeated the moment the path is spelled out in source instead of
+ * carried forward from the `terraformPlan` step that produced it.
+ *
+ * The two builders this rule is written against (`terraformPlan`,
+ * `terraformApply`) don't exist yet (#2086 ships them in parallel), so this
+ * matches purely on callee identifier name — same posture as
+ * `lexicons/k3s/src/lint/rules/token-literal.ts`.
+ *
+ * Accepts exactly the two authoring forms that produce a genuine step-output
+ * reference (`packages/core/src/op/step-output-ref.ts`):
+ *   - `stepOutput(<ident>, "planFile")`
+ *   - `<ident>.out.planFile`
+ * where `<ident>` is bound (`const <ident> = terraformPlan(...)`) in the same
+ * file. Flags a string literal, a template literal, or one of the two
+ * accepted reference forms pointing at an identifier that resolves to
+ * something other than a `terraformPlan` call. When `<ident>` cannot be
+ * resolved at all (not declared anywhere in the file), this rule stays
+ * silent — the same deliberately shallow "bail rather than guess" posture
+ * `validateStepOutputRefs` takes, since the runtime brand on a real
+ * `StepOutputRef` is invisible to a source-level AST match.
+ */
+export const planBeforeApplyRule: LintRule = {
+  id: "TF101",
+  severity: "error",
+  category: "correctness",
+  description: "terraformApply's planFile must reference a preceding terraformPlan step",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    const source = context.sourceFile;
+
+    /** Identifier name bound to a `terraformPlan(...)` call, to whether it truly is one. */
+    const bindings = new Map<string, boolean>();
+
+    const calleeName = (expr: ts.Expression): string | undefined =>
+      ts.isIdentifier(expr) ? expr.text : ts.isPropertyAccessExpression(expr) ? expr.name.text : undefined;
+
+    const collectBindings = (node: ts.Node) => {
+      if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+        const init = node.initializer;
+        if (ts.isCallExpression(init) || ts.isNewExpression(init)) {
+          bindings.set(node.name.text, calleeName(init.expression) === "terraformPlan");
+        }
+      }
+      ts.forEachChild(node, collectBindings);
+    };
+    collectBindings(source);
+
+    const flag = (node: ts.Node, message: string) => {
+      const { line, character } = source.getLineAndCharacterOfPosition(node.getStart(source));
+      diagnostics.push({
+        ruleId: "TF101",
+        severity: "error",
+        message,
+        file: context.filePath,
+        line: line + 1,
+        column: character + 1,
+      });
+    };
+
+    /**
+     * `stepOutput(<ident>, "planFile")` or `<ident>.out.planFile`, returning
+     * the referenced identifier's name, or `undefined` if `initializer`
+     * isn't one of those two shapes.
+     */
+    const referencedIdent = (initializer: ts.Expression): string | undefined => {
+      if (ts.isCallExpression(initializer) && calleeName(initializer.expression) === "stepOutput") {
+        const arg = initializer.arguments[0];
+        return arg && ts.isIdentifier(arg) ? arg.text : undefined;
+      }
+      if (
+        ts.isPropertyAccessExpression(initializer) &&
+        initializer.name.text === "planFile" &&
+        ts.isPropertyAccessExpression(initializer.expression) &&
+        initializer.expression.name.text === "out" &&
+        ts.isIdentifier(initializer.expression.expression)
+      ) {
+        return initializer.expression.expression.text;
+      }
+      return undefined;
+    };
+
+    const checkPlanFile = (obj: ts.ObjectLiteralExpression) => {
+      for (const prop of obj.properties) {
+        if (!ts.isPropertyAssignment(prop)) continue;
+        const name = ts.isIdentifier(prop.name)
+          ? prop.name.text
+          : ts.isStringLiteral(prop.name)
+            ? prop.name.text
+            : undefined;
+        if (name !== "planFile") continue;
+
+        const value = prop.initializer;
+        if (ts.isStringLiteral(value) || ts.isNoSubstitutionTemplateLiteral(value) || ts.isTemplateExpression(value)) {
+          flag(
+            value,
+            "`planFile` is a literal path in source. Pass the preceding `terraformPlan` step's output " +
+              '(`stepOutput(plan, "planFile")` or `plan.out.planFile`), not a hardcoded path.',
+          );
+          continue;
+        }
+
+        const ident = referencedIdent(value);
+        if (ident === undefined) continue; // not one of the two accepted forms — out of this rule's reach
+        const isPlan = bindings.get(ident);
+        if (isPlan === false) {
+          flag(
+            value,
+            `\`planFile\` references "${ident}", which is not bound to a \`terraformPlan(...)\` call. ` +
+              "Apply only a plan this Op itself produced.",
+          );
+        }
+        // isPlan === true: paired correctly.
+        // isPlan === undefined: `ident` isn't declared anywhere in this file — cannot resolve
+        // statically, so stay silent rather than guess.
+      }
+    };
+
+    const visit = (node: ts.Node) => {
+      if (ts.isCallExpression(node) && calleeName(node.expression) === "terraformApply") {
+        // The options object may be the first argument (`terraformApply({ planFile })`)
+        // or follow a positional one (`terraformApply("app", { planFile })`, the
+        // k3s-shaped builder signature); inspect every object-literal argument.
+        for (const arg of node.arguments) {
+          if (ts.isObjectLiteralExpression(arg)) checkPlanFile(arg);
+        }
+      }
+      ts.forEachChild(node, visit);
+    };
+
+    visit(source);
+    return diagnostics;
+  },
+};