@intentius/chant 0.41.20 → 0.44.1

package/src/terraform/excise.ts

@@ -0,0 +1,139 @@
+/**
+ * Excision of a carved resource's own `resource "<type>" "<name>"` block from
+ * the surviving Terraform source (#998 — closes the "auto-excise" limitation).
+ *
+ * After `terraform state rm`, the block left behind would re-CREATE the
+ * resource on the next apply — the one edit the bridge previously left to
+ * hand-work. This removes the carve set's own blocks as part of the survivor
+ * rewrite, so the one bridge `.patch` (#1589) carries the whole handoff edit.
+ *
+ * Pure text transform. The scanner tracks brace depth outside of strings,
+ * comments, template interpolations, and heredocs — enough for real `.tf`
+ * files without pulling in the wasm parser for what is a subtractive edit.
+ */
+
+export interface ExciseTarget {
+  /** Terraform address, e.g. `aws_s3_bucket.assets`. */
+  address: string;
+  type: string;
+  name: string;
+}
+
+export interface ExciseResult {
+  content: string;
+  /** Addresses whose block was found and removed, in file order. */
+  excised: string[];
+}
+
+const HEADER = /^\s*resource\s+"([^"]+)"\s+"([^"]+)"\s*\{/;
+
+/**
+ * Remove the targets' own `resource` blocks from one `.tf` file's text. A
+ * comment line directly above a removed block stays (it may describe more
+ * than the block); the blank line the removal leaves behind is collapsed.
+ */
+export function exciseResourceBlocks(content: string, targets: ExciseTarget[]): ExciseResult {
+  if (targets.length === 0) return { content, excised: [] };
+  const wanted = new Map(targets.map((t) => [`${t.type}.${t.name}`, t.address]));
+  const lines = content.split("\n");
+  const excised: string[] = [];
+  const out: string[] = [];
+
+  let i = 0;
+  while (i < lines.length) {
+    const m = lines[i].match(HEADER);
+    const key = m ? `${m[1]}.${m[2]}` : undefined;
+    if (!m || !wanted.has(key!)) {
+      out.push(lines[i]);
+      i++;
+      continue;
+    }
+
+    const end = blockEnd(lines, i);
+    if (end === -1) {
+      // Unbalanced block — leave the file alone rather than corrupt it.
+      out.push(lines[i]);
+      i++;
+      continue;
+    }
+    excised.push(wanted.get(key!)!);
+    i = end + 1;
+    // Swallow the separator blank line so the removal leaves no doubled gap.
+    if (i < lines.length && lines[i].trim() === "") i++;
+  }
+
+  return { content: out.join("\n"), excised };
+}
+
+/** Index of the line closing the block opened on `start`, or -1 if unbalanced. */
+function blockEnd(lines: string[], start: number): number {
+  // Context stack: block/object braces, strings, `${` interpolations, block
+  // comments. The header's `{` pushes the first "brace"; the block closes when
+  // the stack empties.
+  const stack: Array<"brace" | "string" | "interp" | "comment"> = [];
+  let opened = false;
+  let heredoc: string | null = null;
+
+  for (let ln = start; ln < lines.length; ln++) {
+    const line = lines[ln];
+    if (heredoc !== null) {
+      if (line.trim() === heredoc) heredoc = null;
+      continue;
+    }
+
+    for (let c = 0; c < line.length; c++) {
+      const top = stack[stack.length - 1];
+      const ch = line[c];
+      const next = line[c + 1];
+
+      if (top === "comment") {
+        if (ch === "*" && next === "/") {
+          stack.pop();
+          c++;
+        }
+        continue;
+      }
+
+      if (top === "string") {
+        if (ch === "\\") {
+          c++;
+        } else if (ch === "$" && next === "{" && line[c - 1] !== "$") {
+          stack.push("interp");
+          c++;
+        } else if (ch === '"') {
+          stack.pop();
+        }
+        continue;
+      }
+
+      // Code position (top of file block, a nested brace, or inside `${...}`).
+      if (ch === "#" || (ch === "/" && next === "/")) break; // line comment
+      if (ch === "/" && next === "*") {
+        stack.push("comment");
+        c++;
+        continue;
+      }
+      if (ch === '"') {
+        stack.push("string");
+        continue;
+      }
+      if (ch === "<" && next === "<") {
+        const hd = line.slice(c).match(/^<<-?([A-Za-z_][A-Za-z0-9_-]*)/);
+        if (hd) {
+          heredoc = hd[1];
+          break;
+        }
+      }
+      if (ch === "{") {
+        stack.push("brace");
+        opened = true;
+        continue;
+      }
+      if (ch === "}") {
+        if (top === "brace" || top === "interp") stack.pop();
+        if (opened && stack.length === 0) return ln;
+      }
+    }
+  }
+  return -1;
+}

package/src/terraform/graduate.test.ts

@@ -1,7 +1,7 @@
 import { describe, test, expect } from "vitest";
-import { buildGraph } from "./graph";
+import { buildFixtureGraph } from "./__fixtures__/build-graph";
 import { boundaryReport } from "./carve";
-import { graduationPlan, DEFAULT_TAG_OWNERSHIP_KEYS } from "./graduate";
+import { graduationPlan, stampOwnershipIntoSource, DEFAULT_TAG_OWNERSHIP_KEYS } from "./graduate";
 import type { Hcl2JsonTree } from "./types";
 
 const bucketTree: Hcl2JsonTree = {
@@ -13,7 +13,7 @@ const bucketTree: Hcl2JsonTree = {
 
 describe("graduationPlan", () => {
   test("resolves the ownership marker + tags (chant-owned)", () => {
-    const report = boundaryReport(buildGraph(bucketTree), "aws_s3_bucket.assets")!;
+    const report = boundaryReport(buildFixtureGraph(bucketTree), "aws_s3_bucket.assets")!;
     const plan = graduationPlan(report, { stack: "assets", env: "prod" });
 
     expect(plan.marker).toEqual({ stack: "assets", env: "prod" });
@@ -25,14 +25,14 @@ describe("graduationPlan", () => {
   });
 
   test("stack defaults to the resource's local name", () => {
-    const report = boundaryReport(buildGraph(bucketTree), "aws_s3_bucket.assets")!;
+    const report = boundaryReport(buildFixtureGraph(bucketTree), "aws_s3_bucket.assets")!;
     const plan = graduationPlan(report);
     expect(plan.marker.stack).toBe("assets");
     expect(plan.ownershipTags).not.toHaveProperty(DEFAULT_TAG_OWNERSHIP_KEYS.env); // no env → omitted
   });
 
   test("runbook is reversible and BYOL (import rollback, no chant-runs-apply)", () => {
-    const report = boundaryReport(buildGraph(bucketTree), "aws_s3_bucket.assets")!;
+    const report = boundaryReport(buildFixtureGraph(bucketTree), "aws_s3_bucket.assets")!;
     const plan = graduationPlan(report, { env: "prod" });
     const runbook = plan.steps.join("\n");
     expect(runbook).toMatch(/terraform import aws_s3_bucket\.assets/);
@@ -42,8 +42,75 @@ describe("graduationPlan", () => {
 
   test("warns when outbound edges leave deferred inputs to wire", () => {
     // Carve the Lambda: it depends on the bucket (survivor) → outbound/deferred.
-    const report = boundaryReport(buildGraph(bucketTree), "aws_lambda_function.api")!;
+    const report = boundaryReport(buildFixtureGraph(bucketTree), "aws_lambda_function.api")!;
     const plan = graduationPlan(report, { env: "prod" });
     expect(plan.warnings.join(" ")).toMatch(/deferred deploy-time input/i);
   });
 });
+
+const TAGS = { "chant:managed-by": "chant", "chant:stack": "assets", "chant:env": "prod" };
+
+describe("stampOwnershipIntoSource", () => {
+  test("merges into an existing Tags prop, replacing stale chant keys", () => {
+    const src = [
+      'import { Bucket } from "@intentius/chant-lexicon-aws";',
+      "",
+      "export const assets = new Bucket({",
+      '  BucketName: "myapp-assets-prod",',
+      '  Tags: [{"Key":"Team","Value":"web"},{"Key":"chant:stack","Value":"old"}],',
+      "});",
+      "",
+    ].join("\n");
+
+    const res = stampOwnershipIntoSource(src, TAGS)!;
+    expect(res.changed).toBe(true);
+    const tagsLine = res.content.split("\n").find((l) => l.includes("Tags:"))!;
+    const tags = JSON.parse(tagsLine.trim().replace(/^Tags: /, "").replace(/,$/, "")) as Array<{ Key: string; Value: string }>;
+    expect(tags).toEqual([
+      { Key: "Team", Value: "web" },
+      { Key: "chant:managed-by", Value: "chant" },
+      { Key: "chant:stack", Value: "assets" },
+      { Key: "chant:env", Value: "prod" },
+    ]);
+  });
+
+  test("inserts a Tags prop when the constructor has none (unmapped comment untouched)", () => {
+    const src = [
+      "export const api = new LogGroup({",
+      '  LogGroupName: "/myapp/api",',
+      "});",
+      "",
+      "/* Unmapped Terraform attributes (reconcile to native props before building):",
+      '{ "skip_destroy": false }',
+      "*/",
+      "",
+    ].join("\n");
+
+    const res = stampOwnershipIntoSource(src, TAGS)!;
+    expect(res.changed).toBe(true);
+    const lines = res.content.split("\n");
+    expect(lines[2]).toBe(`  Tags: ${JSON.stringify(Object.entries(TAGS).map(([Key, Value]) => ({ Key, Value })))},`);
+    expect(lines[3]).toBe("});");
+    expect(res.content).toContain("skip_destroy"); // the comment survives
+  });
+
+  test("handles an empty props object", () => {
+    const src = "export const igw = new InternetGateway({});\n";
+    const res = stampOwnershipIntoSource(src, TAGS)!;
+    expect(res.changed).toBe(true);
+    expect(res.content).toContain("new InternetGateway({\n  Tags: [");
+    expect(res.content).toMatch(/\}\);\n$/);
+  });
+
+  test("is idempotent: a second stamp changes nothing", () => {
+    const src = 'export const assets = new Bucket({\n  BucketName: "b",\n});\n';
+    const first = stampOwnershipIntoSource(src, TAGS)!;
+    const second = stampOwnershipIntoSource(first.content, TAGS)!;
+    expect(second.changed).toBe(false);
+    expect(second.content).toBe(first.content);
+  });
+
+  test("returns null when there is no constructor to stamp", () => {
+    expect(stampOwnershipIntoSource("// nothing here\n", TAGS)).toBeNull();
+  });
+});

package/src/terraform/graduate.ts

@@ -76,3 +76,52 @@ export function graduationPlan(report: CarveReport, opts: GraduationOptions = {}
 
   return { target: report.target, marker, ownershipTags, steps, warnings };
 }
+
+/**
+ * Stamp the ownership tags into an emitted chant source file (`carve apply
+ * --write-source`). The emitted source is machine-generated (`adoptFromState`),
+ * so its shape is known: one prop per line, `Tags` as a single-line JSON array.
+ * Merges into an existing `Tags` prop (replacing stale chant keys) or inserts
+ * one into the constructor's props object. Returns null when the file has no
+ * recognizable constructor to stamp.
+ */
+export function stampOwnershipIntoSource(
+  content: string,
+  tags: Record<string, string>,
+): { content: string; changed: boolean } | null {
+  const entries = Object.entries(tags).map(([Key, Value]) => ({ Key, Value }));
+  const keys = new Set(Object.keys(tags));
+  const lines = content.split("\n");
+
+  // Merge into an existing Tags prop.
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^(\s*)Tags: (\[.*\]),$/);
+    if (!m) continue;
+    let existing: Array<{ Key: string; Value: unknown }>;
+    try {
+      existing = JSON.parse(m[2]) as Array<{ Key: string; Value: unknown }>;
+    } catch {
+      continue;
+    }
+    const merged = [...existing.filter((t) => !keys.has(t.Key)), ...entries];
+    const rendered = `${m[1]}Tags: ${JSON.stringify(merged)},`;
+    if (rendered === lines[i]) return { content, changed: false };
+    lines[i] = rendered;
+    return { content: lines.join("\n"), changed: true };
+  }
+
+  // No Tags prop yet: insert one into the constructor's props object.
+  const tagsLine = `  Tags: ${JSON.stringify(entries)},`;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (/^\}\);\s*$/.test(lines[i])) {
+      lines.splice(i, 0, tagsLine);
+      return { content: lines.join("\n"), changed: true };
+    }
+    const empty = lines[i].match(/^(export const .+ = new \w+\()\{\}(\);)\s*$/);
+    if (empty) {
+      lines[i] = `${empty[1]}{\n${tagsLine}\n}${empty[2]}`;
+      return { content: lines.join("\n"), changed: true };
+    }
+  }
+  return null;
+}

package/src/terraform/graph.test.ts

@@ -1,5 +1,6 @@
 import { describe, test, expect } from "vitest";
-import { buildGraph, inboundEdges, outboundEdges } from "./graph";
+import { inboundEdges, outboundEdges, refFromAccessor } from "./graph";
+import { buildFixtureGraph } from "./__fixtures__/build-graph";
 import type { Hcl2JsonTree } from "./types";
 
 /**
@@ -37,7 +38,7 @@ const workedExample: Hcl2JsonTree = {
 
 describe("buildGraph", () => {
   test("extracts resource nodes with addresses", () => {
-    const g = buildGraph(workedExample);
+    const g = buildFixtureGraph(workedExample);
     expect(g.nodes.map((n) => n.address)).toEqual([
       "aws_lambda_function.api",
       "aws_s3_bucket.assets",
@@ -47,16 +48,16 @@ describe("buildGraph", () => {
   });
 
   test("records directed edges with referenced attributes, deduped per target", () => {
-    const g = buildGraph(workedExample);
+    const g = buildFixtureGraph(workedExample);
     // versioning → bucket (.id), lambda → bucket (.bucket, .arn)
     expect(g.edges).toEqual([
-      { from: "aws_lambda_function.api", to: "aws_s3_bucket.assets", attrs: ["arn", "bucket"] },
-      { from: "aws_s3_bucket_versioning.assets", to: "aws_s3_bucket.assets", attrs: ["id"] },
+      { from: "aws_lambda_function.api", to: "aws_s3_bucket.assets", attrs: ["arn", "bucket"], via: ["environment"] },
+      { from: "aws_s3_bucket_versioning.assets", to: "aws_s3_bucket.assets", attrs: ["id"], via: ["bucket"] },
     ]);
   });
 
   test("inbound/outbound classification", () => {
-    const g = buildGraph(workedExample);
+    const g = buildFixtureGraph(workedExample);
     // Two survivors depend on the bucket; the bucket depends on nothing.
     expect(inboundEdges(g, "aws_s3_bucket.assets").map((e) => e.from)).toEqual([
       "aws_lambda_function.api",
@@ -78,7 +79,7 @@ describe("buildGraph", () => {
         aws_route53_record: { cdn: [{ name: "${module.cdn.domain}" }] },
       },
     };
-    const g = buildGraph(tree);
+    const g = buildFixtureGraph(tree);
     const cdn = g.nodes.find((n) => n.address === "module.cdn");
     expect(cdn).toMatchObject({ kind: "module", name: "cdn" });
     // module → bucket, and record → module
@@ -86,11 +87,13 @@ describe("buildGraph", () => {
       from: "module.cdn",
       to: "aws_s3_bucket.assets",
       attrs: ["arn"],
+      via: ["bucket_arn"],
     });
     expect(g.edges).toContainEqual({
       from: "aws_route53_record.cdn",
       to: "module.cdn",
       attrs: ["domain"],
+      via: ["name"],
     });
   });
 
@@ -104,7 +107,7 @@ describe("buildGraph", () => {
         },
       },
     };
-    const g = buildGraph(tree);
+    const g = buildFixtureGraph(tree);
     const byAddr = Object.fromEntries(g.nodes.map((n) => [n.address, n]));
     expect(byAddr["aws_instance.web"]).toMatchObject({ hasDynamic: true, instances: 1 });
     expect(byAddr["aws_instance.worker"]).toMatchObject({ hasDynamic: true, instances: 1 });
@@ -118,20 +121,80 @@ describe("buildGraph", () => {
         aws_instance: { web: [{ ami: "${data.aws_ami.ubuntu.id}" }] },
       },
     };
-    const g = buildGraph(tree);
+    const g = buildFixtureGraph(tree);
     expect(g.nodes.map((n) => n.address)).toEqual(["aws_instance.web"]); // data is not a node
     expect(g.edges).toEqual([]); // ref to data → no resource edge
     expect(g.nodes[0].hasDynamic).toBe(true);
   });
 
+  test("an expression whose AST found no references contributes no edge", () => {
+    // `${var.m["aws_s3_bucket.assets.arn"]}` — the AST reports only `var.m`;
+    // the quoted address inside the brackets is a map key, not a reference.
+    const tree: Hcl2JsonTree = {
+      resource: {
+        aws_s3_bucket: { assets: [{ bucket: "x" }] },
+        aws_lambda_function: { api: [{ handler: '${var.m["aws_s3_bucket.assets.arn"]}' }] },
+      },
+    };
+    const g = buildFixtureGraph(tree);
+    expect(g.edges).toEqual([]);
+  });
+
+  test("a dotted identity attr resolves through nested blocks (#998)", () => {
+    const tree: Hcl2JsonTree = {
+      resource: {
+        kubernetes_manifest: {
+          app_config: [{ manifest: { apiVersion: "v1", kind: "ConfigMap", metadata: { name: "app-config", namespace: "web" } } }],
+          templated: [{ manifest: { apiVersion: "v1", kind: "ConfigMap", metadata: { name: "${var.name}" } } }],
+        },
+        aws_s3_bucket: { assets: [{ bucket: "myapp-assets-prod" }] },
+      },
+    };
+    const g = buildFixtureGraph(tree);
+    const byAddr = Object.fromEntries(g.nodes.map((n) => [n.address, n]));
+    expect(byAddr["kubernetes_manifest.app_config"].identity).toBe("app-config");
+    expect(byAddr["kubernetes_manifest.templated"].identity).toBeUndefined(); // interpolated
+    expect(byAddr["aws_s3_bucket.assets"].identity).toBe("myapp-assets-prod"); // flat attr unaffected
+  });
+
   test("var / local references are not edges", () => {
     const tree: Hcl2JsonTree = {
       resource: {
         aws_s3_bucket: { assets: [{ bucket: "${var.name}", tags: { env: "${local.env}" } }] },
       },
     };
-    const g = buildGraph(tree);
+    const g = buildFixtureGraph(tree);
     expect(g.edges).toEqual([]);
     expect(g.nodes[0].hasDynamic).toBe(false); // var/local alone are not the dynamic markers
   });
 });
+
+describe("refFromAccessor", () => {
+  test("classifies resource, module, and data accessors", () => {
+    expect(refFromAccessor("aws_s3_bucket.assets.bucket")).toEqual({
+      address: "aws_s3_bucket.assets",
+      attr: "bucket",
+    });
+    expect(refFromAccessor("aws_s3_bucket.assets")).toEqual({ address: "aws_s3_bucket.assets", attr: undefined });
+    expect(refFromAccessor("module.cdn.domain")).toEqual({ address: "module.cdn", attr: "domain" });
+    expect(refFromAccessor("data.aws_ami.ubuntu.id")).toEqual({ address: "data.aws_ami.ubuntu", attr: "id" });
+  });
+
+  test("non-resource heads are not references", () => {
+    for (const accessor of ["var.name", "local.env", "each.value", "count.index", "self.arn", "path.module", "terraform.workspace"]) {
+      expect(refFromAccessor(accessor)).toBeNull();
+    }
+  });
+
+  test("quoted map keys and numeric indexes never become the attribute", () => {
+    // `var.m["aws_s3_bucket.assets.arn"]` → the AST renders `var.m."aws_s3_bucket.assets.arn"`
+    expect(refFromAccessor('var.m."aws_s3_bucket.assets.arn"')).toBeNull();
+    // `aws_instance.web[0].id` → `aws_instance.web.0.id`
+    expect(refFromAccessor("aws_instance.web.0.id")).toEqual({ address: "aws_instance.web", attr: "id" });
+    // `aws_s3_bucket.assets.tags["a.b"]` → the key must not shadow the attr
+    expect(refFromAccessor('aws_s3_bucket.assets.tags."a.b"')).toEqual({
+      address: "aws_s3_bucket.assets",
+      attr: "tags",
+    });
+  });
+});