@intentius/chant-lexicon-terraform 0.75.1 → 0.77.0

package/src/behaviour/predict.test.ts

@@ -33,10 +33,12 @@ import {
   type PredictedBehaviour,
   type UnpredictedEntity,
 } from "@intentius/chant/behaviour";
+import { behaviourRequestFromIr } from "@intentius/chant/behaviour-graph";
 import type { Declarable } from "@intentius/chant/declarable";
+import { buildGraphIr } from "@intentius/chant/graph-ir";
 import type { TerraformReadDeps } from "../describe-resources";
 import { renderTerraformRoots } from "../hcl/roots";
-import { liveRootsOf, predictTerraformBehaviour, TERRAFORM } from "./predict";
+import { liveRootsOf, predictTerraformBehaviour, TERRAFORM, terraformPredictOptionsFrom } from "./predict";
 import type { TerraformBehaviourEntity } from "./request";
 
 const fixtures = join(dirname(fileURLToPath(import.meta.url)), "..", "__fixtures__");
@@ -49,6 +51,8 @@ const key = (address: string): string => `${ROOT}/${address}`;
 
 let entities: Map<string, TerraformBehaviourEntity>;
 let entityNames: string[];
+/** The build's own entities, as `chant graph` is handed them. */
+let built: Map<string, Declarable>;
 
 beforeAll(async () => {
   const rendered = await renderTerraformRoots({
@@ -56,6 +60,7 @@ beforeAll(async () => {
     roots: { [ROOT]: { dir: "./live-estate" } },
     binary: "choudoufu",
   });
+  built = rendered.entities;
   entities = new Map();
   for (const [name, entity] of rendered.entities) {
     const e = entity as Declarable & { props: Record<string, unknown>; references?: readonly never[] };
@@ -183,7 +188,7 @@ async function predict(
 ): Promise<{ result: BehaviourResult; calls: Call[] }> {
   const d = deps(overrides?.deps);
   const result = await predictTerraformBehaviour(
-    { ...common, entityNames, entities, ...(overrides?.owned ? { owned: true } : {}) },
+    { ...common, from: "live", entityNames, entities, ...(overrides?.owned ? { owned: true } : {}) },
     { liveLs: d.deps.liveLs, livePlan: d.deps.livePlan, predict: tariff },
   );
   return { result, calls: d.calls };
@@ -325,7 +330,7 @@ describe("the screen runs before the engine", () => {
     });
     const d = deps();
     const result = await predictTerraformBehaviour(
-      { ...common, entityNames, entities: tainted },
+      { ...common, from: "live", entityNames, entities: tainted },
       {
         liveLs: d.deps.liveLs,
         livePlan: d.deps.livePlan,
@@ -378,4 +383,167 @@ describe("the delta the epic asks for", () => {
     // not computed over a graph the other side does not have.
     expect(live.meta.edgeCoverage.verdict).toBe(declared.meta.edgeCoverage.verdict);
   });
+
+  it("tells the engine which estate each side is about (#2494)", async () => {
+    const asked: Array<PredictBehaviourOptions["from"]> = [];
+    const listening = async (options: PredictBehaviourOptions): Promise<BehaviourResult> => {
+      asked.push(options.from);
+      return tariff(options);
+    };
+    const d = deps();
+    for (const from of ["live", "declared"] as const) {
+      await predictTerraformBehaviour(
+        { ...common, from, entityNames, entities },
+        { liveLs: d.deps.liveLs, livePlan: d.deps.livePlan, predict: listening },
+      );
+    }
+    expect(asked).toEqual(["live", "declared"]);
+  });
+});
+
+describe("the contract's options, read as this producer's (#2495)", () => {
+  /** What `chant graph --traffic` hands a plugin: the graph reshaped, references left behind on the edges. */
+  const throughTheGraph = (from: "live" | "declared"): PredictBehaviourOptions =>
+    behaviourRequestFromIr(buildGraphIr(built, fixtures), {
+      ...common,
+      from,
+      edgeCoverage: { verdict: "unknown" },
+    });
+
+  /** Run the producer and keep the request the engine was sent. */
+  async function sent(options: Parameters<typeof predictTerraformBehaviour>[0]): Promise<PredictBehaviourOptions> {
+    let request: PredictBehaviourOptions | undefined;
+    const d = deps();
+    await predictTerraformBehaviour(options, {
+      liveLs: d.deps.liveLs,
+      livePlan: d.deps.livePlan,
+      predict: async (o) => {
+        request = o;
+        return tariff(o);
+      },
+    });
+    if (!request) throw new Error("the engine was never asked");
+    return request;
+  }
+
+  /** A reader that must not be reached: nothing on the declared side, or on a live side that kept its `mode`, reads the project again. */
+  const neverRedeclared = async (): Promise<never> => {
+    throw new Error("the declaration was read again");
+  };
+
+  it("the graph drops every reference, and the edges give each one back", async () => {
+    const graphed = throughTheGraph("declared");
+    const referencing = [...entities].filter(([, e]) => (e.references ?? []).length > 0);
+    expect(referencing.length).toBeGreaterThan(0);
+    for (const [name] of referencing) {
+      expect(Object.prototype.hasOwnProperty.call(graphed.entities.get(name), "references"), name).toBe(false);
+    }
+    const read = await terraformPredictOptionsFrom(graphed, neverRedeclared);
+    for (const [name, entity] of referencing) {
+      expect(read.entities.get(name)?.references, name).toEqual(entity.references);
+    }
+  });
+
+  it.each(["live", "declared"] as const)("sends the engine the %s request the build's own entities would have", async (from) => {
+    const direct = await sent({ ...common, from, entityNames, entities });
+    const graphed = await sent(await terraformPredictOptionsFrom(throughTheGraph(from), neverRedeclared));
+    expect(graphed.edges).toEqual(direct.edges);
+    expect(graphed.edgeCoverage).toEqual(direct.edgeCoverage);
+    expect(graphed.entityNames).toEqual(direct.entityNames);
+    expect(graphed.from).toBe(from);
+  });
+
+  it("keeps the references an entity still carries over the edges' copy", async () => {
+    const [name, entity] = [...entities].find(([, e]) => (e.references ?? []).length > 0)!;
+    const read = await terraformPredictOptionsFrom({
+      ...common,
+      from: "declared",
+      entityNames,
+      entities: entities as PredictBehaviourOptions["entities"],
+      edges: [{ from: name, to: "somewhere/else", kind: "ref" }],
+      edgeCoverage: { verdict: "unknown" },
+    }, neverRedeclared);
+    expect(read.entities.get(name)?.references).toEqual(entity.references);
+  });
+
+  it("does not pass the caller's edges or coverage claim on", async () => {
+    const read = (await terraformPredictOptionsFrom(throughTheGraph("declared"), neverRedeclared)) as unknown as Record<
+      string,
+      unknown
+    >;
+    expect(Object.prototype.hasOwnProperty.call(read, "edges")).toBe(false);
+    expect(Object.prototype.hasOwnProperty.call(read, "edgeCoverage")).toBe(false);
+  });
+
+  /**
+   * What `chant graph --live` hands over: observed nodes. An address, a root
+   * and the provider's type; no `mode`, no `body`, no edge. Plus one the
+   * account holds that nothing declares.
+   */
+  const ORPHAN = key("aws_sqs_queue.nobody_declared");
+  function throughTheLiveGraph(): PredictBehaviourOptions {
+    const observed = new Map<string, { entityType: string; props: Record<string, unknown> }>();
+    for (const [name, entity] of entities) {
+      if (entity.entityType !== "Terraform::Resource") continue;
+      const address = String(entity.props.address);
+      observed.set(name, {
+        entityType: entity.entityType,
+        props: { address, root: ROOT, estate: ESTATE, resourceType: address.slice(0, address.indexOf(".")) },
+      });
+    }
+    observed.set(ORPHAN, {
+      entityType: "Terraform::Resource",
+      props: { address: "aws_sqs_queue.nobody_declared", root: ROOT, estate: ESTATE, resourceType: "aws_sqs_queue" },
+    });
+    return {
+      ...common,
+      from: "live",
+      entityNames: [...observed.keys()],
+      entities: observed,
+      edges: [],
+      edgeCoverage: { verdict: "unknown" },
+    };
+  }
+
+  it("declares a live graph's root again, so the account is read and the engine is sent what the build would send", async () => {
+    const direct = await sent({ ...common, from: "live", entityNames, entities });
+    const graphed = await sent(await terraformPredictOptionsFrom(throughTheLiveGraph(), async () => entities));
+    expect(graphed.entityNames).toEqual(direct.entityNames);
+    expect(graphed.edges).toEqual(direct.edges);
+    expect(graphed.edgeCoverage).toEqual(direct.edgeCoverage);
+    for (const name of direct.entityNames) {
+      expect(graphed.entities.get(name)?.props, name).toEqual(direct.entities.get(name)?.props);
+    }
+  });
+
+  it("read as it arrived, the same live graph reads no account at all", async () => {
+    // The hole the test above closes, pinned so it cannot close by accident:
+    // no observed entity says `mode: "live"`, so no root is live.
+    const asArrived = throughTheLiveGraph();
+    expect(liveRootsOf(asArrived.entityNames, asArrived.entities)).toEqual([]);
+    const read = await terraformPredictOptionsFrom(asArrived, async () => entities);
+    expect(liveRootsOf(read.entityNames, read.entities)).toEqual([ROOT]);
+  });
+
+  it("sets an observed orphan aside for the live read to list", async () => {
+    const read = await terraformPredictOptionsFrom(throughTheLiveGraph(), async () => entities);
+    expect(read.entityNames).not.toContain(ORPHAN);
+    expect(read.entities.has(ORPHAN)).toBe(false);
+    expect([...read.entityNames].sort()).toEqual(entityNames);
+  });
+
+  it("leaves a root the config does not render as it arrived", async () => {
+    const asArrived = throughTheLiveGraph();
+    const read = await terraformPredictOptionsFrom(asArrived, async () => new Map());
+    expect(read.entityNames).toEqual(asArrived.entityNames);
+    expect(read.entities.get(ORPHAN)).toEqual(asArrived.entities.get(ORPHAN));
+  });
+
+  it("reads the declaration again only for a live graph", async () => {
+    const declaredSide = { ...throughTheLiveGraph(), from: "declared" as const };
+    await expect(terraformPredictOptionsFrom(declaredSide, neverRedeclared)).resolves.toBeDefined();
+    await expect(terraformPredictOptionsFrom(throughTheLiveGraph(), neverRedeclared)).rejects.toThrow(
+      "the declaration was read again",
+    );
+  });
 });

package/src/behaviour/predict.ts

@@ -60,8 +60,13 @@ import {
   type PredictBehaviourOptions,
   type UnpredictedEntity,
 } from "@intentius/chant/behaviour";
+import { createBehaviourPredict } from "@intentius/chant/behaviour-predict";
+import type { EntityReference } from "@intentius/chant/graph-ir";
 import { indexLivePlan, readLiveLs, type TerraformReadDeps } from "../describe-resources";
+import type { TerraformConfig } from "../config";
 import { RESOURCE_TYPE } from "../hcl/parse";
+import { choudoufuLiveLs, choudoufuLivePlanDocument } from "../op/activities/terraform";
+import { terraformBehaviourKinds } from "./kinds";
 import {
   terraformBehaviourRequest,
   type TerraformBehaviourEntity,
@@ -105,19 +110,175 @@ export interface TerraformPredictOptions
   /** Directory the activities start the `chant.config.*` search from. Default: the process cwd. */
   cwd?: string;
   /**
-   * Which estate to predict. `"live"`, the default, is this path's whole
-   * point: the account as it stands, drift included. `"declared"` runs the
-   * same producer over the declaration alone and reads no account, which is
-   * the other half of the delta the epic asks for (#2355) — a caller wanting
-   * that delta calls this twice and differences the two reports, and gets two
-   * reports assembled by one producer rather than two shapes that have each
-   * been through a different translation.
+   * Which estate to predict, as the contract's own `from` (#2494) and required
+   * for the same reason: a default is a guess about which estate somebody
+   * meant, and the report that comes back from a wrong guess is well-formed.
+   *
+   * `"live"` is this path's whole point: the account as it stands, drift
+   * included. `"declared"` runs the same producer over the declaration alone
+   * and reads no account, which is the other half of the delta the epic asks
+   * for (#2355) — a caller wanting that delta calls this twice and differences
+   * the two reports, and gets two reports assembled by one producer rather
+   * than two shapes that have each been through a different translation.
    *
    * `"declared"` on a project with no live root is the same request `"live"`
    * builds, because there is no account to read; the option exists so that a
    * caller can ask for the declaration of a root that *is* live.
    */
-  from?: "live" | "declared";
+  from: "live" | "declared";
+}
+
+/**
+ * What the plugin method runs with, where a caller injects nothing (#2495).
+ *
+ * The two reads are the activities `describeResources` already drives. The
+ * engine front is core's, handed this lexicon's coverage rows and no other's:
+ * a plugin method takes options alone and cannot see which other lexicons the
+ * project configured, and every name this producer sends is a terraform block
+ * or a name it passed through untouched. A passed-through name of another
+ * lexicon's type comes back `unknown-type`, which is true of what this path
+ * knows about it.
+ */
+const REAL_DEPS: TerraformBehaviourDeps = {
+  liveLs: choudoufuLiveLs,
+  livePlan: choudoufuLivePlanDocument,
+  predict: createBehaviourPredict({ kinds: [terraformBehaviourKinds] }),
+};
+
+/** Reads the project's declaration afresh. Injectable so a test parses nothing from disk. */
+export type TerraformDeclarationReader = (cwd?: string) => Promise<ReadonlyMap<string, TerraformBehaviourEntity>>;
+
+/**
+ * The build's own entities, read again from the project's config: what
+ * `buildRoots()` renders, with `mode`, `body` and `references` as the parse
+ * stamps them. The config is found the way `observeAmbient` and the
+ * activities find it, so `terraform.roots` means one thing to all of them.
+ */
+export const readTerraformDeclaration: TerraformDeclarationReader = async (cwd) => {
+  const { loadChantConfigUpward } = await import("@intentius/chant/config");
+  const { renderTerraformRoots } = await import("../hcl/roots");
+  const { dirname, resolve } = await import("node:path");
+
+  const start = resolve(cwd ?? process.cwd());
+  const { config, configPath } = await loadChantConfigUpward(start);
+  const namespace = (config as { terraform?: TerraformConfig }).terraform;
+  const entities = new Map<string, TerraformBehaviourEntity>();
+  if (!namespace?.roots || Object.keys(namespace.roots).length === 0) return entities;
+  const rendered = await renderTerraformRoots({
+    projectRoot: configPath ? dirname(configPath) : start,
+    roots: namespace.roots,
+    binary: namespace.binary,
+    callModuleType: namespace.callModuleType,
+  });
+  for (const [name, entity] of rendered.entities) {
+    const e = entity as unknown as TerraformBehaviourEntity;
+    entities.set(name, {
+      entityType: e.entityType,
+      props: e.props ?? {},
+      ...(Array.isArray(e.references) ? { references: e.references } : {}),
+    });
+  }
+  return entities;
+};
+
+const rootOf = (entity: TerraformBehaviourEntity | undefined): string | undefined =>
+  typeof entity?.props.root === "string" ? entity.props.root : undefined;
+
+/**
+ * Read the contract's options as this producer's (#2495): the plugin method's
+ * whole adaptation. Two things are missing from an entity by the time a graph
+ * has carried it here, and which one depends on the graph.
+ *
+ * ## A declared graph has lost its `references`
+ *
+ * `root` and `mode` need no work: they are on `props`, the graph projects
+ * `props` onto a node's `attrs` as they stand, and `behaviourRequestFromIr`
+ * hands `attrs` back as `props`. `references` are left off `attrs` on
+ * purpose, because an edge already says the same thing (`graph-ir.ts`'s
+ * `SKIP_KEYS`), and the contract's `edges` arrive in their place. An `IREdge`
+ * is an `EntityReference` plus the entity it leaves from, so grouping the
+ * edges by `from` gives every entity its references back, field for field.
+ * Without this a block whose body holds a `${…}` is counted as an unresolved
+ * kind on a graph that resolved it. An entity that still carries its own
+ * `references` keeps them: the edges are the copy.
+ *
+ * ## A live graph has lost the declaration
+ *
+ * `chant graph --live` hands over observed nodes: an address, a root, the
+ * provider's type, and no `mode`, no `body` and no edge. Read as they stand,
+ * no root is live, so the account is never read here; no block has a size,
+ * because `body.instance_type` went with the body; and containment is empty.
+ * The figures that come back are well-formed and differ from the declared
+ * side's for reasons that have nothing to do with the account, which is the
+ * delta this producer exists to keep honest.
+ *
+ * So under `from: "live"`, a root any of whose entities arrived with no
+ * `mode` is declared again from the project's own config, and the producer
+ * then reads the account itself, as it does for any other caller. The
+ * observed entities of that root are set aside, the undeclared ones
+ * included: an owned orphan is the live read's to list, under the key
+ * `observeAmbient` gave it, and one the account no longer holds is not in a
+ * prediction of the account.
+ *
+ * A root the config does not render is left as it arrived. That is a worse
+ * reading and the only one available.
+ *
+ * ## What stops here
+ *
+ * The caller's `edges` and `edgeCoverage`. Both are this producer's to
+ * compute, from whichever reads it ends up making (see
+ * {@link TerraformPredictOptions}).
+ */
+export async function terraformPredictOptionsFrom(
+  options: PredictBehaviourOptions,
+  redeclare: TerraformDeclarationReader = readTerraformDeclaration,
+): Promise<TerraformPredictOptions> {
+  const { entities: given, edges, edgeCoverage: _edgeCoverage, ...rest } = options;
+  const leaving = new Map<string, EntityReference[]>();
+  for (const edge of edges ?? []) {
+    if (edge.kind !== "ref") continue;
+    const reference: EntityReference = {
+      to: edge.to,
+      ...(edge.viaAttr !== undefined ? { viaAttr: edge.viaAttr } : {}),
+      ...(edge.toAttr !== undefined ? { toAttr: edge.toAttr } : {}),
+    };
+    (leaving.get(edge.from) ?? leaving.set(edge.from, []).get(edge.from)!).push(reference);
+  }
+  const entities = new Map<string, TerraformBehaviourEntity>();
+  for (const [name, entity] of given) {
+    const own = (entity as TerraformBehaviourEntity).references;
+    const references = Array.isArray(own) ? own : leaving.get(name);
+    entities.set(name, references === undefined ? entity : { ...entity, references });
+  }
+  if (options.from !== "live") return { ...rest, entities };
+
+  const observed = new Set<string>();
+  for (const name of options.entityNames) {
+    const entity = entities.get(name);
+    const root = rootOf(entity);
+    if (root !== undefined && entity?.props.mode === undefined) observed.add(root);
+  }
+  if (observed.size === 0) return { ...rest, entities };
+
+  const declared = new Map<string, Map<string, TerraformBehaviourEntity>>();
+  for (const [name, entity] of await redeclare()) {
+    const root = rootOf(entity);
+    if (root === undefined || !observed.has(root)) continue;
+    (declared.get(root) ?? declared.set(root, new Map()).get(root)!).set(name, entity);
+  }
+  const entityNames = options.entityNames.filter((name) => {
+    const root = rootOf(entities.get(name));
+    if (root === undefined || !declared.has(root)) return true;
+    entities.delete(name);
+    return false;
+  });
+  for (const again of declared.values()) {
+    for (const [name, entity] of again) {
+      entities.set(name, entity);
+      entityNames.push(name);
+    }
+  }
+  return { ...rest, entityNames, entities };
 }
 
 /** Which roots the request would read live: those whose entities the parse stamped `mode: "live"`. */
@@ -146,7 +307,7 @@ function readsAsCredentials(text: string): boolean {
  */
 export async function predictTerraformBehaviour(
   options: TerraformPredictOptions,
-  deps: TerraformBehaviourDeps,
+  deps: TerraformBehaviourDeps = REAL_DEPS,
 ): Promise<BehaviourResult> {
   const { cwd, from: _from, ...contract } = options;
   const where = cwd ? { cwd } : {};
@@ -191,6 +352,7 @@ export async function predictTerraformBehaviour(
     environment: contract.environment,
     buildOutput: contract.buildOutput,
     traffic: contract.traffic,
+    from: options.from,
     ...(contract.region !== undefined ? { region: contract.region } : {}),
     ...(contract.stack !== undefined ? { stack: contract.stack } : {}),
     ...(contract.owned !== undefined ? { owned: contract.owned } : {}),

package/src/behaviour/request.test.ts

@@ -65,11 +65,12 @@ beforeAll(async () => {
 const common = { environment: "prod", buildOutput: "/tmp/build", traffic: "100 rps, p50" };
 
 const declaredSide = (): TerraformBehaviourRequest =>
-  terraformBehaviourRequest({ ...common, entityNames, entities });
+  terraformBehaviourRequest({ ...common, from: "declared", entityNames, entities });
 
 const liveSide = (): TerraformBehaviourRequest =>
   terraformBehaviourRequest({
     ...common,
+    from: "live",
     entityNames,
     entities,
     live: [{ root: ROOT, listing: LISTING, plan: PLAN }],
@@ -79,6 +80,11 @@ const factsOf = (built: TerraformBehaviourRequest, address: string): LiveResourc
   (built.request.entities.get(key(address))!.props as { live: LiveResourceFacts }).live;
 
 describe("the declared side", () => {
+  it("says which estate the request is about, on both sides (#2494)", () => {
+    expect(declaredSide().request.from).toBe("declared");
+    expect(liveSide().request.from).toBe("live");
+  });
+
   it("builds every declared block, from the file and nothing else", () => {
     const built = declaredSide();
     expect(built.request.entityNames).toEqual(entityNames);
@@ -179,6 +185,7 @@ describe("the live side", () => {
   it("withholds what is not this estate's when --owned was asked for", () => {
     const built = terraformBehaviourRequest({
       ...common,
+      from: "live",
       entityNames,
       entities,
       owned: true,

package/src/behaviour/request.ts

@@ -129,7 +129,7 @@ export interface LiveResourceFacts {
 }
 
 export interface TerraformBehaviourRequestOptions
-  extends Pick<PredictBehaviourOptions, "environment" | "buildOutput" | "traffic" | "region" | "stack" | "owned"> {
+  extends Pick<PredictBehaviourOptions, "environment" | "buildOutput" | "traffic" | "from" | "region" | "stack" | "owned"> {
   entityNames: readonly string[];
   entities: ReadonlyMap<string, TerraformBehaviourEntity>;
   /**
@@ -613,6 +613,7 @@ export function terraformBehaviourRequest(options: TerraformBehaviourRequestOpti
     ...(options.stack !== undefined ? { stack: options.stack } : {}),
     ...(options.region !== undefined ? { region: options.region } : {}),
     ...(options.owned !== undefined ? { owned: options.owned } : {}),
+    from: options.from,
     traffic: options.traffic,
     edges: reconstructed.edges,
     edgeCoverage: edgeCoverageOf(reconstructed, [...unresolved]),

package/src/describe-resources.ts

@@ -173,7 +173,7 @@ import {
 import type { OwnershipMarker } from "@intentius/chant/ownership";
 import {
   choudoufuLiveLs,
-  choudoufuLivePlan,
+  choudoufuLivePlanDocument,
   terraformInit,
   terraformShow,
 } from "./op/activities/terraform";
@@ -1007,14 +1007,15 @@ async function liveRoots(options: LiveEstateOptions): Promise<Array<{ root: stri
 export interface TerraformReadDeps {
   init: typeof terraformInit;
   show: typeof terraformShow;
-  livePlan: typeof choudoufuLivePlan;
+  /** The document alone (chant #2498): this reader indexes it and never reads the human render. */
+  livePlan: typeof choudoufuLivePlanDocument;
   liveLs: typeof choudoufuLiveLs;
 }
 
 const REAL_DEPS: TerraformReadDeps = {
   init: terraformInit,
   show: terraformShow,
-  livePlan: choudoufuLivePlan,
+  livePlan: choudoufuLivePlanDocument,
   liveLs: choudoufuLiveLs,
 };
 

package/src/hcl/descend.ts

@@ -100,7 +100,7 @@ export interface DescendOptions {
   projectRoot: string;
   /** Resolved mode. `"none"` returns immediately with nothing. */
   callModuleType?: "local" | "none";
-  /** Injectable parser (tests); defaults to core's lazy-loaded `@cdktf/hcl2json`. */
+  /** Injectable parser (tests); defaults to core's lazy-loaded `@cdktn/hcl2json`. */
   hcl2json?: Hcl2Json;
   /** Mode facts stamped onto the child's entities, exactly as on the root's. */
   modeOptions?: TerraformRootModeOptions;

package/src/hcl/parse.ts

@@ -9,7 +9,7 @@
  * Both funnel through `blocksToEntities`, so an entity the audit path sees is
  * the entity the build path sees.
  *
- * Core owns the parser glue: `loadHcl2json()` lazy-loads `@cdktf/hcl2json`
+ * Core owns the parser glue: `loadHcl2json()` lazy-loads `@cdktn/hcl2json`
  * (a ~1.8 MB wasm blob) and raises a one-line install hint when it is absent.
  * `parseTerraformDir()` next to it is NOT reused: it returns carve's `TfGraph`,
  * a scoring-and-excision shape with no room for the per-block bodies a
@@ -27,7 +27,7 @@ import type { SuppressionDirective } from "@intentius/chant/lint/suppressions";
 import type { TerraformDeleteMode } from "../config";
 import { scanSuppressions, directivesFor, type FileScan } from "./suppressions";
 
-/** A parsed HCL block body, as `@cdktf/hcl2json` encodes it. */
+/** A parsed HCL block body, as `@cdktn/hcl2json` encodes it. */
 export type BlockBody = Record<string, unknown>;
 
 /**

package/src/hcl/roots.ts

@@ -56,7 +56,7 @@ export interface RenderTerraformRootsOptions {
    * `../` is parsed as a child scope of the root that calls it.
    */
   callModuleType?: CallModuleType;
-  /** Injectable parser (tests); defaults to core's lazy-loaded `@cdktf/hcl2json`. */
+  /** Injectable parser (tests); defaults to core's lazy-loaded `@cdktn/hcl2json`. */
   hcl2json?: Hcl2Json;
 }
 

package/src/hcl/suppressions.ts

@@ -3,7 +3,7 @@
  *
  * `hcl2json` drops comments entirely, and a probe of its output confirmed it
  * exposes no source ranges either, so a suppression comment has nothing to
- * attach to once a file goes through `@cdktf/hcl2json`. This module runs a
+ * attach to once a file goes through `@cdktn/hcl2json`. This module runs a
  * second, cheap pass over the SAME raw text `./parse.ts` hands the parser,
  * entirely with line-oriented regexes: a brace-depth counter to find each
  * top-level block's start line (`terraform`, `locals`, `provider "x"`,

package/src/hcl/value.ts

@@ -2,7 +2,7 @@
  * A value envelope over a parsed block body (chant #2113).
  *
  * Every TF post-synth check reads `BlockBody` (`./parse.ts`), raw
- * `@cdktf/hcl2json` output, and re-derives, by hand, whether an attribute is
+ * `@cdktn/hcl2json` output, and re-derives, by hand, whether an attribute is
  * a plain literal, a reference/expression, or absent. tflint's OPA ruleset
  * hands a policy `{value, unknown, sensitive, ephemeral, range}` per
  * attribute so a check reads that uniformly instead of re-deriving it

package/src/index.ts

@@ -99,10 +99,12 @@ export { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership";
 // path for a choudoufu root, reading `live-ls -json` and `live-plan -json`
 // through the same activities `describeResources` runs, and the same producer
 // over the declaration so the two sides of the delta are built alike. The
-// engine is injected: this lexicon dials none.
+// engine is injected, and defaults to core's front (#2495): this lexicon
+// dials none.
 export {
   predictTerraformBehaviour,
   terraformBehaviourRequest,
+  terraformPredictOptionsFrom,
   TERRAFORM_REFERENCE_CATALOG,
   type TerraformBehaviourDeps,
   type TerraformBehaviourEntity,

package/src/lint/post-synth/tf016.ts

@@ -8,7 +8,7 @@
  * argument that takes a list or a bool.
  *
  * This is the one rule in the family that reads the block's SOURCE rather than
- * its parsed body, and it has to. `@cdktf/hcl2json` renders both `x = var.y`
+ * its parsed body, and it has to. `@cdktn/hcl2json` renders both `x = var.y`
  * and `x = "${var.y}"` as the string `"${var.y}"`, so a check over the parse
  * cannot tell the deprecated form from the idiomatic one and would report every
  * reference in the root. The quotes only survive in the text, so the text is

package/src/op/activities/live-detect.ts

@@ -9,7 +9,7 @@
  * time and is dependency-light on purpose, since it shells out to the
  * configured binary and never touches the lexicon's HCL parse or serializer,
  * so it never pulls in
- * the ~1.8 MB `@cdktf/hcl2json` wasm parser just to decide whether an apply
+ * the ~1.8 MB `@cdktn/hcl2json` wasm parser just to decide whether an apply
  * should run `apply -auto-approve` with no plan file. Plain text and a
  * hand-rolled brace counter are enough for that narrower question, and the
  * literal sidecar filename below is kept in sync with `LIVE_SIDECAR_FILENAME`