@intentius/chant 0.124.48 → 0.124.50

package/src/workspace/import-fetch.ts

@@ -0,0 +1,151 @@
+/**
+ * The network half of `chant workspace init --from tfc|spacelift` (#3178).
+ *
+ * Reads the Terraform Cloud API or the Spacelift GraphQL API into the input
+ * documents `import-source.ts` maps. The transport is a parameter, so a test
+ * feeds fixture responses and nothing here is reached without a token. A
+ * token is read from `--token`, else `TFE_TOKEN` / `TF_TOKEN_app_terraform_io`
+ * for Terraform Cloud and `SPACELIFT_API_TOKEN` for Spacelift. Only reads:
+ * every request is a GET, or a GraphQL query with no mutation.
+ */
+
+import type { SpaceliftInput, TfcInput } from "./import-source";
+
+export type Fetcher = (url: string, init?: { method?: string; headers?: Record<string, string>; body?: string }) => Promise<{ ok: boolean; status: number; json(): Promise<unknown> }>;
+
+export class ImportFetchError extends Error {}
+
+const defaultFetch: Fetcher = (url, init) => fetch(url, init);
+
+// ── Terraform Cloud ──────────────────────────────────────────────────────────
+
+interface JsonApiResource {
+  id: string;
+  type?: string;
+  attributes?: Record<string, unknown>;
+  relationships?: Record<string, { data?: { id: string } | { id: string }[] | null }>;
+}
+
+export interface TfcFetchOptions {
+  organization: string;
+  token: string;
+  /** Default `https://app.terraform.io`; a Terraform Enterprise host works too. */
+  host?: string;
+  fetcher?: Fetcher;
+}
+
+export async function fetchTfc(options: TfcFetchOptions): Promise<TfcInput> {
+  const fetcher = options.fetcher ?? defaultFetch;
+  const base = (options.host ?? "https://app.terraform.io").replace(/\/$/, "");
+  const headers = { Authorization: `Bearer ${options.token}`, "Content-Type": "application/vnd.api+json" };
+
+  const list = async (path: string): Promise<JsonApiResource[]> => {
+    const out: JsonApiResource[] = [];
+    let url: string | undefined = `${base}/api/v2${path}${path.includes("?") ? "&" : "?"}page%5Bsize%5D=100`;
+    while (url) {
+      const res = await fetcher(url, { method: "GET", headers });
+      if (!res.ok) throw new ImportFetchError(`Terraform Cloud answered ${res.status} for ${url.replace(base, "")}`);
+      const body = (await res.json()) as { data?: JsonApiResource[]; links?: { next?: string | null } };
+      out.push(...(body.data ?? []));
+      url = body.links?.next ?? undefined;
+    }
+    return out;
+  };
+
+  const org = encodeURIComponent(options.organization);
+  const [projects, workspaces, policySets] = await Promise.all([list(`/organizations/${org}/projects`), list(`/organizations/${org}/workspaces`), list(`/organizations/${org}/policy-sets`)]);
+
+  const full: TfcInput["workspaces"] = [];
+  for (const w of workspaces) {
+    const a = w.attributes ?? {};
+    const [vars, triggers] = await Promise.all([list(`/workspaces/${w.id}/vars`), list(`/workspaces/${w.id}/run-triggers?filter%5Brun-trigger%5D%5Btype%5D=inbound`)]);
+    const project = w.relationships?.project?.data;
+    full.push({
+      id: w.id,
+      name: String(a.name ?? w.id),
+      ...(project && !Array.isArray(project) ? { project: project.id } : {}),
+      ...(a["working-directory"] ? { workingDirectory: String(a["working-directory"]) } : {}),
+      ...(a["terraform-version"] ? { terraformVersion: String(a["terraform-version"]) } : {}),
+      ...((a["vcs-repo"] as { identifier?: string } | null)?.identifier ? { vcsRepo: (a["vcs-repo"] as { identifier: string }).identifier } : {}),
+      tags: Array.isArray(a["tag-names"]) ? (a["tag-names"] as string[]) : [],
+      variables: vars.map((v) => ({ key: String(v.attributes?.key ?? ""), category: String(v.attributes?.category ?? ""), sensitive: v.attributes?.sensitive === true })),
+      runTriggers: triggers
+        .map((t) => (t.relationships?.sourceable?.data as { id: string } | undefined)?.id)
+        .filter((id): id is string => typeof id === "string"),
+    });
+  }
+
+  return {
+    organization: options.organization,
+    projects: projects.map((p) => ({ id: p.id, name: String(p.attributes?.name ?? p.id) })),
+    workspaces: full,
+    policySets: policySets.map((p) => ({
+      id: p.id,
+      name: String(p.attributes?.name ?? p.id),
+      kind: String(p.attributes?.kind ?? "sentinel"),
+      global: p.attributes?.global === true,
+      workspaces: ((p.relationships?.workspaces?.data as { id: string }[] | undefined) ?? []).map((x) => x.id),
+    })),
+  };
+}
+
+// ── Spacelift ────────────────────────────────────────────────────────────────
+
+export interface SpaceliftFetchOptions {
+  /** The account's endpoint, e.g. `https://acme.app.spacelift.io/graphql`. */
+  endpoint: string;
+  token: string;
+  fetcher?: Fetcher;
+}
+
+const SPACELIFT_QUERY = `query ChantImport {
+  stacks { id name space repository branch projectRoot vendor { __typename } labels
+    attachedPolicies: attachedPolicies { id }
+    dependsOn: dependencies { stackId references { outputName inputName } } }
+  policies { id name type }
+}`;
+
+export async function fetchSpacelift(options: SpaceliftFetchOptions): Promise<SpaceliftInput> {
+  const fetcher = options.fetcher ?? defaultFetch;
+  const res = await fetcher(options.endpoint, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${options.token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ query: SPACELIFT_QUERY }),
+  });
+  if (!res.ok) throw new ImportFetchError(`Spacelift answered ${res.status} for ${options.endpoint}`);
+  const body = (await res.json()) as {
+    errors?: { message: string }[];
+    data?: {
+      stacks?: {
+        id: string;
+        name: string;
+        space?: string;
+        repository?: string;
+        branch?: string;
+        projectRoot?: string;
+        vendor?: { __typename?: string } | null;
+        labels?: string[];
+        attachedPolicies?: { id: string }[];
+        dependsOn?: { stackId: string; references?: { outputName: string; inputName?: string }[] }[];
+      }[];
+      policies?: { id: string; name: string; type?: string }[];
+    };
+  };
+  if (body.errors?.length) throw new ImportFetchError(`Spacelift: ${body.errors.map((e) => e.message).join("; ")}`);
+  return {
+    account: new URL(options.endpoint).hostname.split(".")[0],
+    stacks: (body.data?.stacks ?? []).map((s) => ({
+      id: s.id,
+      name: s.name,
+      ...(s.space ? { space: s.space } : {}),
+      ...(s.repository ? { repository: s.repository } : {}),
+      ...(s.branch ? { branch: s.branch } : {}),
+      ...(s.projectRoot ? { projectRoot: s.projectRoot } : {}),
+      vendor: (s.vendor?.__typename ?? "TerraformStackVendor").replace(/StackVendor$|Vendor$/, "").toLowerCase() || "terraform",
+      labels: s.labels ?? [],
+      policies: (s.attachedPolicies ?? []).map((p) => p.id),
+      dependsOn: (s.dependsOn ?? []).map((d) => ({ stack: d.stackId, references: d.references ?? [] })),
+    })),
+    policies: body.data?.policies ?? [],
+  };
+}

package/src/workspace/import-init.ts

@@ -0,0 +1,147 @@
+/**
+ * `chant workspace init --from tfc|spacelift|backstage` (#3178): the command
+ * around `import-source.ts`. It reads the source, prints the proposal and what
+ * was left out, and writes only on confirmation, as `init` does (#2525 rule 1).
+ * Besides `chant.workspace.json` it writes `chant-import.<source>.json`: the
+ * environments and constraint records the declaration has no field for.
+ */
+
+import { existsSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { formatError, formatSuccess } from "../cli/format";
+import type { CommandContext } from "../cli/registry";
+import { fetchSpacelift, fetchTfc, ImportFetchError, type Fetcher } from "./import-fetch";
+import {
+  IMPORT_SOURCES,
+  proposeFromBackstage,
+  proposeFromSpacelift,
+  proposeFromTfc,
+  readInputFile,
+  type ImportProposal,
+  type ImportSource,
+  type SpaceliftInput,
+  type TfcInput,
+} from "./import-source";
+import { WorkspaceReadError } from "./declaration";
+
+export const IMPORT_USAGE =
+  "chant workspace init --from tfc --org <organization> [--input <export.json>] [--token <token>] [dir] [--name <name>] [--yes]\n" +
+  "       chant workspace init --from spacelift --endpoint <https://acme.app.spacelift.io/graphql> [--input <export.json>] [--token <token>] [dir] [--yes]\n" +
+  "       chant workspace init --from backstage [dir] [--name <name>] [--yes]";
+
+export const isImportSource = (v: string | undefined): v is ImportSource => (IMPORT_SOURCES as readonly string[]).includes(v ?? "");
+
+export interface ImportDeps {
+  /** For tests: the transport the API readers use. */
+  fetcher?: Fetcher;
+  env?: Record<string, string | undefined>;
+  /** For tests: answers the confirmation. */
+  confirm?: (question: string) => Promise<boolean>;
+  isTTY?: boolean;
+}
+
+/** Read the source into a proposal. Throws {@link ImportFetchError} or an Error naming what is missing. */
+export async function loadProposal(source: ImportSource, root: string, args: CommandContext["args"], deps: ImportDeps = {}): Promise<ImportProposal> {
+  const env = deps.env ?? process.env;
+  if (source === "backstage") return proposeFromBackstage(root, { name: args.selectName });
+  if (source === "tfc") {
+    let input: TfcInput;
+    if (args.input) input = readInputFile("tfc", resolve(args.input)) as TfcInput;
+    else {
+      const token = args.token ?? env.TFE_TOKEN ?? env.TF_TOKEN_app_terraform_io;
+      if (!token) throw new Error("--from tfc needs --input <export.json>, or a token in --token, TFE_TOKEN or TF_TOKEN_app_terraform_io");
+      if (!args.org) throw new Error("--from tfc needs --org <organization>");
+      input = await fetchTfc({ organization: args.org, token, fetcher: deps.fetcher });
+    }
+    return proposeFromTfc(input, { name: args.selectName });
+  }
+  let input: SpaceliftInput;
+  if (args.input) input = readInputFile("spacelift", resolve(args.input)) as SpaceliftInput;
+  else {
+    const token = args.token ?? env.SPACELIFT_API_TOKEN;
+    if (!token) throw new Error("--from spacelift needs --input <export.json>, or a token in --token or SPACELIFT_API_TOKEN");
+    if (!args.endpoint) throw new Error("--from spacelift needs --endpoint <https://<account>.app.spacelift.io/graphql>");
+    input = await fetchSpacelift({ endpoint: args.endpoint, token, fetcher: deps.fetcher });
+  }
+  return proposeFromSpacelift(input, { name: args.selectName });
+}
+
+export function formatImportProposal(p: ImportProposal): string[] {
+  const lines: string[] = [];
+  const links = p.declaration.members.reduce((n, m) => n + (m.links?.length ?? 0), 0);
+  lines.push(`${p.declaration.members.length} member(s), ${links} link(s), ${p.environments.length} environment(s), ${p.records.length} constraint record(s).`);
+  if (p.environments.length > 0) {
+    lines.push("", "Environments:");
+    for (const e of p.environments) lines.push(`  ${e.name}: ${e.members.join(", ")}`);
+  }
+  if (p.records.length > 0) {
+    lines.push("", "Constraint records:");
+    for (const r of p.records) lines.push(`  ${r.id}${r.policyKind ? ` (${r.policyKind})` : ""} applies to ${r.appliesTo.length === 0 ? "every member" : r.appliesTo.join(", ")}`);
+  }
+  lines.push("", "Left out:");
+  if (p.leftOut.length === 0) lines.push("  nothing");
+  for (const l of p.leftOut) lines.push(`  ${l.count} ${l.what}: ${l.why}`);
+  for (const n of p.notes) lines.push("", n);
+  return lines;
+}
+
+async function defaultConfirm(question: string): Promise<boolean> {
+  const { createInterface } = await import("node:readline");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((done) => {
+    rl.question(question, (a) => {
+      done(/^y(es)?$/i.test(a.trim()));
+      rl.close();
+    });
+    rl.on("close", () => done(false));
+  });
+}
+
+export async function runImportInit(source: ImportSource, root: string, args: CommandContext["args"], deps: ImportDeps = {}): Promise<number> {
+  let proposal: ImportProposal;
+  try {
+    proposal = await loadProposal(source, root, args, deps);
+  } catch (err) {
+    if (err instanceof WorkspaceReadError) {
+      console.error(formatError({ message: `the proposed declaration is not valid: ${err.describe()}`, hint: "Write chant.workspace.json by hand for now." }));
+      return 1;
+    }
+    console.error(formatError({ message: err instanceof Error ? err.message : String(err), hint: IMPORT_USAGE }));
+    return 1;
+  }
+
+  const target = join(root, "chant.workspace.json");
+  const sidecar = join(root, `chant-import.${source}.json`);
+  const text = `${JSON.stringify(proposal.declaration, null, 2)}\n`;
+  const sideText = `${JSON.stringify({ source, environments: proposal.environments, records: proposal.records, leftOut: proposal.leftOut }, null, 2)}\n`;
+  console.log(`Proposed ${target}:`);
+  console.log("");
+  console.log(text);
+  for (const line of formatImportProposal(proposal)) console.log(line);
+  console.log("");
+  console.log(`Confirming also writes ${sidecar}, holding the environments, constraint records and the left-out list.`);
+  console.log("");
+
+  let write = !!args.yes;
+  if (!write) {
+    if (!(deps.isTTY ?? process.stdin.isTTY)) {
+      console.log("Nothing written. Re-run with --yes to write it, or save the proposal above and edit it first.");
+      return 0;
+    }
+    write = await (deps.confirm ?? defaultConfirm)("Write chant.workspace.json? [y/N] ");
+  }
+  if (!write) {
+    console.log("Nothing written.");
+    return 0;
+  }
+  if (existsSync(sidecar)) {
+    console.error(formatError({ message: `${sidecar} already exists`, hint: "Move it aside and run again." }));
+    return 1;
+  }
+  writeFileSync(target, text, { flag: "wx" });
+  writeFileSync(sidecar, sideText, { flag: "wx" });
+  console.log(formatSuccess(`Wrote ${target} and ${sidecar}. chant workspace ls lists what it declares.`));
+  return 0;
+}
+
+export { ImportFetchError };

package/src/workspace/import-source.test.ts

@@ -0,0 +1,183 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { parseArgs } from "../cli/parse-args";
+import { fetchSpacelift, fetchTfc, type Fetcher } from "./import-fetch";
+import { runImportInit } from "./import-init";
+import { proposeFromBackstage, proposeFromSpacelift, proposeFromTfc, readInputFile, type SpaceliftInput, type TfcInput } from "./import-source";
+
+const FIX = join(__dirname, "__fixtures__", "import");
+const tfc = (): TfcInput => readInputFile("tfc", join(FIX, "tfc.json")) as TfcInput;
+const spacelift = (): SpaceliftInput => readInputFile("spacelift", join(FIX, "spacelift.json")) as SpaceliftInput;
+const noNetwork = vi.fn(() => {
+  throw new Error("a test reached the network");
+});
+
+describe("workspace init --from tfc (#3178)", () => {
+  test("workspaces become members, run triggers become links, tags become environments", () => {
+    const p = proposeFromTfc(tfc());
+    expect(p.declaration.members.map((m) => [m.name, m.kind, m.dir])).toEqual([
+      ["network-prod", "terraform", "infra/network"],
+      ["app-prod", "terraform", "infra/app"],
+    ]);
+    expect(p.declaration.members[0].outputs).toEqual(["applied"]);
+    expect(p.declaration.members[1].links).toEqual([{ member: "network-prod", output: "applied" }]);
+    expect(p.environments).toEqual([
+      { name: "dev", members: ["app-prod"] },
+      { name: "prod", members: ["network-prod", "app-prod"] },
+    ]);
+  });
+
+  test("policy sets become constraint records and the left-out list names what was not carried", () => {
+    const p = proposeFromTfc(tfc());
+    expect(p.records.map((r) => [r.title, r.kind, r.appliesTo])).toEqual([
+      ["no-public-s3", "constraint", ["app-prod"]],
+      ["tags-required", "constraint", []],
+    ]);
+    const out = Object.fromEntries(p.leftOut.map((l) => [l.what, l.count]));
+    expect(out.variables).toBe(2);
+    expect(out["run triggers"]).toBe(1);
+    expect(out["VCS connections"]).toBe(1);
+    expect(out["workspaces sharing a directory"]).toBe(1);
+    expect(p.notes.join(" ")).toContain("chant-lexicon-terraform");
+  });
+
+  test("the API reader builds the same input from fixture responses, with no network", async () => {
+    const calls: string[] = [];
+    const fetcher: Fetcher = async (url, init) => {
+      calls.push(`${init?.method} ${url}`);
+      const u = new URL(url);
+      const body = (data: unknown[]) => ({ ok: true, status: 200, json: async () => ({ data }) });
+      if (u.pathname.endsWith("/projects")) return body([{ id: "prj-1", attributes: { name: "platform" } }]);
+      if (u.pathname.endsWith("/policy-sets")) return body([{ id: "pol-1", attributes: { name: "p", global: true } }]);
+      if (u.pathname.endsWith("/organizations/acme/workspaces"))
+        return body([
+          { id: "ws-a", attributes: { name: "a", "working-directory": "a", "tag-names": ["env:x"] } },
+          { id: "ws-b", attributes: { name: "b" } },
+        ]);
+      if (u.pathname.endsWith("/workspaces/ws-b/run-triggers")) return body([{ id: "rt", relationships: { sourceable: { data: { id: "ws-a" } } } }]);
+      if (u.pathname.endsWith("/vars")) return body([{ id: "v", attributes: { key: "k", sensitive: true } }]);
+      return body([]);
+    };
+    const input = await fetchTfc({ organization: "acme", token: "t", fetcher });
+    expect(calls.every((c) => c.startsWith("GET "))).toBe(true);
+    const p = proposeFromTfc(input);
+    expect(p.declaration.members[1].links).toEqual([{ member: "a", output: "applied" }]);
+    expect(p.records[0].appliesTo).toEqual([]);
+  });
+
+  test("a bad status is an error that names the path", async () => {
+    const fetcher: Fetcher = async () => ({ ok: false, status: 401, json: async () => ({}) });
+    await expect(fetchTfc({ organization: "acme", token: "t", fetcher })).rejects.toThrow(/401/);
+  });
+});
+
+describe("workspace init --from spacelift (#3178)", () => {
+  test("dependent stacks become members with links on the named outputs", () => {
+    const p = proposeFromSpacelift(spacelift());
+    expect(p.declaration.members.map((m) => [m.name, m.kind])).toEqual([
+      ["vpc", "terraform"],
+      ["database", "terraform"],
+      ["ansible-config", "other"],
+    ]);
+    expect(p.declaration.members[0].outputs).toEqual(["subnet_ids"]);
+    expect(p.declaration.members[1].links).toEqual([{ member: "vpc", output: "subnet_ids" }]);
+    expect(p.declaration.members[2].links).toEqual([{ member: "database", output: "applied" }]);
+    expect(p.environments).toEqual([{ name: "prod", members: ["vpc", "database"] }]);
+    expect(p.records).toEqual([expect.objectContaining({ kind: "constraint", policyKind: "APPROVAL", appliesTo: ["database"] })]);
+    expect(p.leftOut.map((l) => l.what)).toEqual(expect.arrayContaining(["context attachments", "stack dependencies"]));
+  });
+
+  test("the GraphQL reader only sends a query, and maps the response", async () => {
+    let sent = "";
+    const fetcher: Fetcher = async (_url, init) => {
+      sent = init?.body ?? "";
+      return {
+        ok: true,
+        status: 200,
+        json: async () => ({ data: { stacks: [{ id: "a", name: "a", dependsOn: [] }, { id: "b", name: "b", dependsOn: [{ stackId: "a", references: [] }] }], policies: [] } }),
+      };
+    };
+    const input = await fetchSpacelift({ endpoint: "https://acme.app.spacelift.io/graphql", token: "t", fetcher });
+    expect(sent).not.toContain("mutation");
+    expect(input.account).toBe("acme");
+    expect(proposeFromSpacelift(input).declaration.members[1].links).toEqual([{ member: "a", output: "applied" }]);
+  });
+});
+
+describe("workspace init --from backstage (#3178)", () => {
+  const dirs: string[] = [];
+  afterEach(() => dirs.splice(0).forEach((d) => rmSync(d, { recursive: true, force: true })));
+  function catalog(files: Record<string, string>): string {
+    const root = mkdtempSync(join(tmpdir(), "chant-backstage-"));
+    dirs.push(root);
+    for (const [f, text] of Object.entries(files)) {
+      mkdirSync(dirname(join(root, f)), { recursive: true });
+      writeFileSync(join(root, f), text);
+    }
+    return root;
+  }
+
+  test("components become members, dependsOn and consumesApis become links, lifecycle becomes an environment", () => {
+    const root = catalog({
+      "api/catalog-info.yaml": "apiVersion: backstage.io/v1alpha1\nkind: Component\nmetadata:\n  name: api\nspec:\n  lifecycle: production\n  dependsOn: [resource:default/db]\n  consumesApis: [billing-api]\n---\napiVersion: backstage.io/v1alpha1\nkind: Group\nmetadata:\n  name: team\n",
+      "db/catalog-info.yaml": "apiVersion: backstage.io/v1alpha1\nkind: Resource\nmetadata:\n  name: db\nspec:\n  lifecycle: production\n",
+      "billing/catalog-info.yml": "apiVersion: backstage.io/v1alpha1\nkind: Component\nmetadata:\n  name: billing\nspec:\n  lifecycle: experimental\n  providesApis: [billing-api]\n",
+    });
+    const p = proposeFromBackstage(root, { name: "shop" });
+    expect(p.declaration.name).toBe("shop");
+    expect(p.declaration.members.map((m) => [m.name, m.kind, m.dir])).toEqual([
+      ["api", "other", "api"],
+      ["billing", "other", "billing"],
+      ["db", "other", "db"],
+    ]);
+    expect(p.declaration.members[0].links).toEqual([
+      { member: "db", output: "catalog" },
+      { member: "billing", output: "catalog" },
+    ]);
+    expect(p.environments.map((e) => e.name)).toEqual(["experimental", "production"]);
+    expect(p.leftOut.map((l) => l.what)).toContain("Group");
+  });
+});
+
+describe("the command writes nothing without confirmation (#3178)", () => {
+  const dirs: string[] = [];
+  afterEach(() => {
+    dirs.splice(0).forEach((d) => rmSync(d, { recursive: true, force: true }));
+    vi.restoreAllMocks();
+  });
+  const run = async (extra: string[], deps: Parameters<typeof runImportInit>[3] = {}) => {
+    const root = mkdtempSync(join(tmpdir(), "chant-import-"));
+    dirs.push(root);
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    const args = parseArgs(["workspace", "init", root, "--from", "tfc", "--input", join(FIX, "tfc.json"), ...extra]);
+    const code = await runImportInit("tfc", root, args, { fetcher: noNetwork as never, ...deps });
+    return { code, root };
+  };
+
+  test("no terminal and no --yes: nothing written", async () => {
+    const { code, root } = await run([], { isTTY: false });
+    expect(code).toBe(0);
+    expect(existsSync(join(root, "chant.workspace.json"))).toBe(false);
+  });
+
+  test("declining writes nothing; --yes writes the declaration and the sidecar", async () => {
+    const declined = await run([], { isTTY: true, confirm: async () => false });
+    expect(existsSync(join(declined.root, "chant.workspace.json"))).toBe(false);
+    const { code, root } = await run(["--yes"]);
+    expect(code).toBe(0);
+    expect(JSON.parse(readFileSync(join(root, "chant.workspace.json"), "utf-8")).members).toHaveLength(2);
+    const side = JSON.parse(readFileSync(join(root, "chant-import.tfc.json"), "utf-8"));
+    expect(side.records).toHaveLength(2);
+    expect(noNetwork).not.toHaveBeenCalled();
+  });
+
+  test("without --input or a token it says what is missing and reaches nothing", async () => {
+    const err = vi.spyOn(console, "error").mockImplementation(() => {});
+    const args = parseArgs(["workspace", "init", "--from", "tfc", "--org", "acme"]);
+    expect(await runImportInit("tfc", tmpdir(), args, { env: {}, fetcher: noNetwork as never })).toBe(1);
+    expect(err.mock.calls.join(" ")).toContain("TFE_TOKEN");
+    expect(noNetwork).not.toHaveBeenCalled();
+  });
+});