@intentius/chant-lexicon-terraform 0.61.0 → 0.62.0

package/dist/composites/terraform-adopt-op.d.ts

@@ -13,8 +13,18 @@
  * the two values that would claim it. Cloud-to-code here is "claim what the
  * configuration already describes" — a tag write, not a regeneration.
  *
- * Phases: Check, Ledger, Gate, Adopt.
+ * Phases: Init, Check, Ledger, Gate, Adopt.
  *
+ *   - **Init** runs `terraform init`, the same step `TerraformApplyOp` and
+ *     `TerraformWatchOp` open with. The Ledger step's `live-plan` needs the
+ *     provider schema to discover markers on the live resources it reads, and
+ *     a checkout that has never run `init` has no `.terraform` directory to
+ *     read one from — which is every fresh CI checkout, not a GitLab
+ *     peculiarity (#2302). Without this phase `live-plan` fails outright:
+ *     `Error: Provider unavailable for marker discovery`. This composite had
+ *     no Init phase because nothing had ever run `live-adopt` before
+ *     INTENTIUS/choudoufu#1026 did, so the gap survived every guard that only
+ *     read the generated YAML.
  *   - **Check** runs `live-check`, which makes no cloud calls and says whether
  *     this configuration can move under markers at all. It runs first because
  *     a root that `live-check` refuses will produce an adoption ledger that
@@ -103,6 +113,12 @@ export interface TerraformAdoptOpConfig {
     gateTimeout?: string;
     /** Override the gate description shown to the approver. */
     gateDescription?: string;
+    /**
+     * `-upgrade` on the Init step: re-resolve provider and module versions.
+     * Same field, same meaning, as `TerraformApplyOpConfig.upgrade` and
+     * `TerraformWatchOpConfig.upgrade`.
+     */
+    upgrade?: boolean;
     /**
      * Directory each step starts the `chant.config.*` search from, which is what
      * `terraform.roots` and the root's relative `dir` resolve against. Default:
@@ -124,7 +140,7 @@ export interface TerraformAdoptOpConfig {
     };
 }
 export interface TerraformAdoptOpResources {
-    /** Op resource. Generates the Check/Ledger/Gate/Adopt workflow. */
+    /** Op resource. Generates the Init/Check/Ledger/Gate/Adopt workflow. */
     op: InstanceType<typeof OpResource>;
 }
 export declare function TerraformAdoptOp(config: TerraformAdoptOpConfig): TerraformAdoptOpResources;

package/dist/composites/terraform-adopt-op.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terraform-adopt-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-adopt-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAEH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAO5E,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,wGAAwG;IACxG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CAiE1F"}
+{"version":3,"file":"terraform-adopt-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-adopt-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AAEH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAQ5E,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,wGAAwG;IACxG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,wEAAwE;IACxE,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CAkE1F"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "da8f1f7391554299a9dac6411b3d346aac233088d22d080a5c31feb56754ca19",
+    "manifest.json": "68a63fa7e36966979057c179df4393ea7af5ebaa3d4c4126b972fdb260a8c3d4",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "31b1b3176799fd365b2583fe3947edd187c2a863e3dc0094ed9e91ece2464c99",
@@ -37,5 +37,5 @@
     "rules/tf028.ts": "81ef95659c40ad1774c83e663473ed769143d894a4ba0517c3defa31f00ba723",
     "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "14b513f2e660229ea7f075738074c2cb08fe27e2e42a6ae1fd7e7cd708233ca1"
+  "composite": "bce1d6bc7353146056d897096ba518203b0b588cb4b4546b420e6d93169b77c4"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.61.0",
+  "version": "0.62.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.61.0",
+  "version": "0.62.0",
   "type": "module",
   "files": [
     "src/",
@@ -56,7 +56,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.61.0",
+    "@intentius/chant": "^0.62.0",
     "typescript": "^5.9.3"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/__fixtures__/ACCEPTANCE.md

@@ -1,6 +1,6 @@
 # What the gated acceptance suites have actually run against
 
-Four `describe` blocks across three files run this lexicon against a real
+Five `describe` blocks across three files run this lexicon against a real
 binary rather than a fixture, and every one of them skips rather than fails
 when its dependency is absent. A skip is silent by design, so without this
 file nothing in the tree says which of them has ever passed, against what, or
@@ -170,6 +170,47 @@ The fixture was deliberately left as an `aws_vpc`. A log group would make the
 block pass off `unowned[]` alone and would stop it proving the content-matcher
 path, which is the only thing it exists to prove.
 
+### 5. `TerraformAdoptOp reaches its gate on a checkout that has never run init`
+
+Same file, third block (#2302). One test: build `TerraformAdoptOp` and drive
+it through `runOpLocally`, exactly as the apply Op's own acceptance suite
+does, over a project this test creates fresh and never initializes by hand —
+no `terraformInit` call anywhere in the block. The Op's own Init phase is what
+has to download the provider, or the Ledger step fails the way it failed in
+INTENTIUS/choudoufu#1026. `TerraformAdoptOp` gates unconditionally, so a
+passing run ends `status: "gated"` right after the Ledger phase — reaching the
+gate is the pass, not a completed adoption.
+
+Gated on a `choudoufu` on PATH and `CHOUDOUFU_EMULATOR_ENDPOINT`. No `aws` CLI:
+this block creates no live resource of its own.
+
+```
+npx vitest run lexicons/terraform/src/composites/terraform-adopt-op.acceptance.test.ts
+```
+
+Last passed: 2026-09-09, choudoufu v0.15.0 with the pinned floci emulator up.
+Removing the Init phase this block exists to guard reproduces
+INTENTIUS/choudoufu#1026 verbatim:
+
+```
+choudoufu live-plan failed in <dir> (exit 1)
+Error: Provider unavailable for marker discovery
+
+Finding the live resources of this estate needs provider
+provider["registry.opentofu.org/hashicorp/aws"], which could not be used:
+cannot read the schema of provider registry.opentofu.org/hashicorp/aws:
+failed to instantiate provider "registry.opentofu.org/hashicorp/aws" to
+obtain schema: unavailable provider "registry.opentofu.org/hashicorp/aws".
+```
+
+With the Init phase back, the same run reaches its gate:
+
+```
+ ✓ TerraformAdoptOp reaches its gate on a checkout that has never run init >
+   Init downloads the provider the Ledger step needs, and the run reaches
+   its gate
+```
+
 ## Running everything that can run on a machine with no choudoufu
 
 ```
@@ -179,15 +220,15 @@ npx vitest run \
   lexicons/terraform/src/op/activities/choudoufu.acceptance.test.ts
 ```
 
-With `terraform` on PATH and the registry reachable, that is 1 passed and 5
+With `terraform` on PATH and the registry reachable, that is 1 passed and 6
 skipped, and each skip names its own reason in the block title. With
-choudoufu v0.15.0, the `aws` CLI and the emulator all present, it is 6 passed
-and 0 skipped: no block in this file skips any more. On 2026-09-08 that is
-exactly what it printed.
+choudoufu v0.15.0 and the emulator present (the `aws` CLI besides, for block
+4), it is 7 passed and 0 skipped: no block in this file skips any more. On
+2026-09-09 that is exactly what it printed.
 
 ```
  Test Files  3 passed (3)
-      Tests  6 passed (6)
+      Tests  7 passed (7)
 ```
 
 Bring the emulator up on a fixed port from choudoufu's own compose file rather

package/src/composites/terraform-adopt-op.acceptance.test.ts

@@ -69,6 +69,8 @@ import { cpSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterAll, describe, expect, it } from "vitest";
+import { loadActivities, loadProfiles, runOpLocally, type OpConfig } from "@intentius/chant/op";
+import { TerraformAdoptOp } from "./terraform-adopt-op";
 import { choudoufuAdopt, choudoufuLivePlan, terraformInit } from "../op/activities/terraform";
 
 function onPath(cmd: string): boolean {
@@ -177,3 +179,66 @@ describe.skipIf(skipReason !== "")(
     );
   },
 );
+
+/**
+ * #2302: `TerraformAdoptOp` built with no Init phase reached its Ledger step
+ * with an empty `.terraform` on every checkout that had never run `init` —
+ * every fresh CI checkout, not a GitLab peculiarity. This drives the built Op
+ * itself through `runOpLocally`, the way `terraform-apply-op.acceptance.test.ts`
+ * does, over a project this test creates fresh and never initializes by hand:
+ * no `terraformInit` call anywhere in this block, unlike the suite above. The
+ * Op's own Init phase is what has to do that work, or the Ledger step fails
+ * the same way it failed in INTENTIUS/choudoufu#1026.
+ *
+ * `TerraformAdoptOp` gates unconditionally (no `gate: "never"`, unlike
+ * `TerraformApplyOp`), so a passing run here ends with `status: "gated"`
+ * right after the Ledger phase — "reaching its gate" is the pass, not a
+ * completed adoption. That is proof enough: the Ledger step needs the
+ * provider schema, and a run that reaches the gate is a run whose Ledger step
+ * already read it.
+ *
+ * Needs only a `choudoufu` on PATH and the emulator, not the `aws` CLI: this
+ * block creates no live resource and never reads `ledger.adoptions`, so a
+ * narrower gate than the suite above is correct instead of borrowed.
+ */
+const gateSkipReason = !onPath("choudoufu")
+  ? "no choudoufu binary on PATH"
+  : !emulatorEndpoint
+    ? "CHOUDOUFU_EMULATOR_ENDPOINT is not set (bring up choudoufu's `just smoke` emulator stack and export it)"
+    : "";
+
+describe.skipIf(gateSkipReason !== "")(
+  `TerraformAdoptOp reaches its gate on a checkout that has never run init${gateSkipReason ? ` (skipped: ${gateSkipReason})` : ""}`,
+  () => {
+    it(
+      "Init downloads the provider the Ledger step needs, and the run reaches its gate",
+      { timeout: 300_000 },
+      async () => {
+        const dir = project();
+
+        process.env.AWS_ENDPOINT_URL ??= emulatorEndpoint;
+        process.env.AWS_ACCESS_KEY_ID ??= "choudoufu-emulator";
+        process.env.AWS_SECRET_ACCESS_KEY ??= "choudoufu-emulator";
+        process.env.AWS_DEFAULT_REGION ??= "us-east-1";
+
+        // No `terraformInit` call here. `dir/root` is a fresh checkout: no
+        // `.terraform`, only the fixture's own `main.tf` and
+        // `estate.chdf.hcl` — exactly what `git clone` leaves behind, since
+        // `.terraform` is what every `.gitignore` in this ecosystem excludes.
+        const { op } = TerraformAdoptOp({ name: "gate-check-adopt", root: "estate", cwd: dir });
+
+        const activities = await loadActivities(["terraform"]);
+        const result = await runOpLocally((op as unknown as { props: OpConfig }).props, activities, await loadProfiles());
+
+        expect(result.status).toBe("gated");
+        expect(result.records.map((r) => `${r.phase}:${r.status}`)).toEqual([
+          "Init:ok",
+          "Check:ok",
+          "Ledger:ok",
+          "Gate:skipped",
+          "Adopt:skipped",
+        ]);
+      },
+    );
+  },
+);

package/src/composites/terraform-adopt-op.test.ts

@@ -26,15 +26,37 @@ const isActivity = (s: StepDefinition): s is ActivityStep => s.kind === "activit
 const steps = (op: OpConfig): ActivityStep[] => op.phases.flatMap((p) => p.steps.filter(isActivity));
 const base = { name: "estate-adopt", root: "estate" };
 
-describe("TerraformAdoptOp phases (#2105)", () => {
-  test("Check, Ledger, Gate, Adopt, in that order", () => {
+describe("TerraformAdoptOp phases (#2105, #2302)", () => {
+  test("Init, Check, Ledger, Gate, Adopt, in that order", () => {
     const op = props(base);
-    expect(phaseNames(op)).toEqual(["Check", "Ledger", "Gate", "Adopt"]);
-    expect(steps(op).map((s) => s.fn)).toEqual(["choudoufuLiveCheck", "choudoufuLivePlan", "choudoufuAdopt"]);
+    expect(phaseNames(op)).toEqual(["Init", "Check", "Ledger", "Gate", "Adopt"]);
+    expect(steps(op).map((s) => s.fn)).toEqual([
+      "terraformInit",
+      "choudoufuLiveCheck",
+      "choudoufuLivePlan",
+      "choudoufuAdopt",
+    ]);
+  });
+
+  // #2302: the Ledger step's `live-plan` needs the provider schema to
+  // discover markers, which a checkout that has never run `init` does not
+  // have — every fresh CI checkout, not a GitLab peculiarity. Without this
+  // phase `live-plan` fails outright: "Error: Provider unavailable for
+  // marker discovery".
+  test("Init runs terraform init first, the same shape TerraformApplyOp and TerraformWatchOp use", () => {
+    const init = props(base).phases[0].steps[0] as ActivityStep;
+    expect(init.fn).toBe("terraformInit");
+    expect(init.args?.root).toBe("estate");
+    expect(init.args && "upgrade" in init.args).toBe(false);
+  });
+
+  test("upgrade rides the Init step only, the same option name as the other two Ops", () => {
+    const init = props({ ...base, upgrade: true }).phases[0].steps[0] as ActivityStep;
+    expect(init.args?.upgrade).toBe(true);
   });
 
-  test("Check runs live-check first, and reports whether the root was refused", () => {
-    const check = props(base).phases[0].steps[0] as ActivityStep;
+  test("Check runs live-check second, and reports whether the root was refused", () => {
+    const check = props(base).phases[1].steps[0] as ActivityStep;
     expect(check.fn).toBe("choudoufuLiveCheck");
     expect(check.outcomeAttribute).toEqual({ name: "Refused", from: "refused" });
     // No cloud calls, so this is the cheapest place to learn the root cannot
@@ -43,7 +65,7 @@ describe("TerraformAdoptOp phases (#2105)", () => {
   });
 
   test("Ledger is the -adoption-only live plan, and publishes both counts", () => {
-    const ledger = props(base).phases[1].steps[0] as ActivityStep;
+    const ledger = props(base).phases[2].steps[0] as ActivityStep;
     expect(ledger.fn).toBe("choudoufuLivePlan");
     expect(ledger.id).toBe("ledger");
     expect(ledger.args?.adoptionOnly).toBe(true);
@@ -64,14 +86,14 @@ describe("TerraformAdoptOp phases (#2105)", () => {
 
   test("an explicit estate rides the Ledger step only", () => {
     const op = props({ ...base, estate: "prod-networking" });
-    expect((op.phases[1].steps[0] as ActivityStep).args?.estate).toBe("prod-networking");
-    expect((op.phases[0].steps[0] as ActivityStep).args?.estate).toBeUndefined();
+    expect((op.phases[2].steps[0] as ActivityStep).args?.estate).toBe("prod-networking");
+    expect((op.phases[1].steps[0] as ActivityStep).args?.estate).toBeUndefined();
   });
 });
 
 describe("TerraformAdoptOp gates on the ledger (#2105)", () => {
   const gateOf = (op: OpConfig): GateStep => {
-    const step = op.phases[2].steps[0];
+    const step = op.phases[3].steps[0];
     expect(step.kind).toBe("gate");
     return step as GateStep;
   };
@@ -107,7 +129,7 @@ describe("TerraformAdoptOp gates on the ledger (#2105)", () => {
 });
 
 describe("TerraformAdoptOp adopts the ledger's matches and nothing else (#2105)", () => {
-  const adoptStep = (op: OpConfig): ActivityStep => op.phases[3].steps[0] as ActivityStep;
+  const adoptStep = (op: OpConfig): ActivityStep => op.phases[4].steps[0] as ActivityStep;
 
   test("the Adopt step takes the ledger's adoptable set by reference", () => {
     const adopt = adoptStep(props(base));

package/src/composites/terraform-adopt-op.ts

@@ -13,8 +13,18 @@
  * the two values that would claim it. Cloud-to-code here is "claim what the
  * configuration already describes" — a tag write, not a regeneration.
  *
- * Phases: Check, Ledger, Gate, Adopt.
+ * Phases: Init, Check, Ledger, Gate, Adopt.
  *
+ *   - **Init** runs `terraform init`, the same step `TerraformApplyOp` and
+ *     `TerraformWatchOp` open with. The Ledger step's `live-plan` needs the
+ *     provider schema to discover markers on the live resources it reads, and
+ *     a checkout that has never run `init` has no `.terraform` directory to
+ *     read one from — which is every fresh CI checkout, not a GitLab
+ *     peculiarity (#2302). Without this phase `live-plan` fails outright:
+ *     `Error: Provider unavailable for marker discovery`. This composite had
+ *     no Init phase because nothing had ever run `live-adopt` before
+ *     INTENTIUS/choudoufu#1026 did, so the gap survived every guard that only
+ *     read the generated YAML.
  *   - **Check** runs `live-check`, which makes no cloud calls and says whether
  *     this configuration can move under markers at all. It runs first because
  *     a root that `live-check` refuses will produce an adoption ledger that
@@ -83,6 +93,7 @@
 
 import { Op, phase, gate, activity, OpResource } from "@intentius/chant/op";
 import {
+  terraformInit as initStep,
   choudoufuLiveCheck as checkStep,
   choudoufuLivePlan as ledgerStep,
   choudoufuAdopt as adoptStep,
@@ -110,6 +121,12 @@ export interface TerraformAdoptOpConfig {
   gateTimeout?: string;
   /** Override the gate description shown to the approver. */
   gateDescription?: string;
+  /**
+   * `-upgrade` on the Init step: re-resolve provider and module versions.
+   * Same field, same meaning, as `TerraformApplyOpConfig.upgrade` and
+   * `TerraformWatchOpConfig.upgrade`.
+   */
+  upgrade?: boolean;
   /**
    * Directory each step starts the `chant.config.*` search from, which is what
    * `terraform.roots` and the root's relative `dir` resolve against. Default:
@@ -130,7 +147,7 @@ export interface TerraformAdoptOpConfig {
 }
 
 export interface TerraformAdoptOpResources {
-  /** Op resource. Generates the Check/Ledger/Gate/Adopt workflow. */
+  /** Op resource. Generates the Init/Check/Ledger/Gate/Adopt workflow. */
   op: InstanceType<typeof OpResource>;
 }
 
@@ -178,6 +195,7 @@ export function TerraformAdoptOp(config: TerraformAdoptOpConfig): TerraformAdopt
       TerraformMode: "live",
     },
     phases: [
+      phase("Init", [initStep(config.root, { ...where, ...(config.upgrade ? { upgrade: true } : {}) })]),
       phase("Check", [check]),
       phase("Ledger", [ledger]),
       phase("Gate", [