@intentius/chant 0.41.20 → 0.44.1

package/src/terraform/score.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { buildGraph } from "./graph";
+import { buildFixtureGraph } from "./__fixtures__/build-graph";
 import { scoreEstate, bandFor } from "./score";
 import type { Hcl2JsonTree } from "./types";
 
@@ -28,7 +28,7 @@ describe("scoreEstate — #197 worked examples", () => {
         },
       },
     };
-    const results = scoreEstate(buildGraph(tree));
+    const results = scoreEstate(buildFixtureGraph(tree));
     const map = byAddress(results);
 
     // The folded sub-resource is not ranked on its own.
@@ -51,7 +51,7 @@ describe("scoreEstate — #197 worked examples", () => {
         },
       },
     };
-    const results = scoreEstate(buildGraph(tree));
+    const results = scoreEstate(buildFixtureGraph(tree));
     const cdn = byAddress(results)["module.cdn"];
     expect(cdn.score).toBe(61); // 100 - 12*2 - 15*(2-1)
     expect(cdn.band).toBe("carvable w/ edits");
@@ -70,7 +70,7 @@ describe("scoreEstate — #197 worked examples", () => {
         aws_subnet: consumers,
       },
     };
-    const vpc = byAddress(scoreEstate(buildGraph(tree)))["aws_vpc.main"];
+    const vpc = byAddress(scoreEstate(buildFixtureGraph(tree)))["aws_vpc.main"];
     expect(vpc.score).toBe(0);
     expect(vpc.band).toBe("leave in Terraform");
     expect(vpc.breakdown.inbound).toBe(40);
@@ -82,7 +82,7 @@ describe("scoreEstate — penalties", () => {
     const tree: Hcl2JsonTree = {
       resource: { random_pet: { name: [{ length: 2 }] } },
     };
-    const r = scoreEstate(buildGraph(tree))[0];
+    const r = scoreEstate(buildFixtureGraph(tree))[0];
     expect(r.score).toBe(0);
     expect(r.breakdown.tier).toBeNull();
     expect(r.mapsTo).toBeUndefined();
@@ -97,7 +97,7 @@ describe("scoreEstate — penalties", () => {
         },
       },
     };
-    const map = byAddress(scoreEstate(buildGraph(tree)));
+    const map = byAddress(scoreEstate(buildFixtureGraph(tree)));
     expect(map["aws_sqs_queue.plain"].score).toBe(100); // tier1, no edges, no dynamic
     expect(map["aws_sqs_queue.fanned"].score).toBe(90); // -10 dynamic
   });
@@ -110,7 +110,7 @@ describe("scoreEstate — penalties", () => {
         aws_sqs_queue: { dlq: [{ name: "d", redrive: "${aws_sns_topic.alerts.arn}" }] },
       },
     };
-    const map = byAddress(scoreEstate(buildGraph(tree)));
+    const map = byAddress(scoreEstate(buildFixtureGraph(tree)));
     expect(map["aws_sqs_queue.dlq"].score).toBe(96); // 100 - 4*1 outbound
     expect(map["aws_sns_topic.alerts"].score).toBe(88); // 100 - 12*1 inbound
   });
@@ -123,7 +123,7 @@ describe("scoreEstate — penalties", () => {
         aws_sns_topic: { t: [{ name: "t" }] },
       },
     };
-    const scores = scoreEstate(buildGraph(tree)).map((r) => r.score);
+    const scores = scoreEstate(buildFixtureGraph(tree)).map((r) => r.score);
     expect(scores).toEqual([...scores].sort((a, b) => b - a));
   });
 });

package/src/terraform/state.test.ts

@@ -3,7 +3,7 @@ import { mkdtempSync, writeFileSync, rmSync } from "fs";
 import { tmpdir } from "os";
 import { join } from "path";
 import { readStateInstanceCounts, applyStateCounts } from "./state";
-import { buildGraph } from "./graph";
+import { buildFixtureGraph } from "./__fixtures__/build-graph";
 import { scoreEstate } from "./score";
 import type { Hcl2JsonTree } from "./types";
 
@@ -44,7 +44,7 @@ describe("readStateInstanceCounts", () => {
 
 describe("applyStateCounts", () => {
   test("overlays counts; nodes absent from state keep 1", () => {
-    const graph = buildGraph({
+    const graph = buildFixtureGraph({
       resource: {
         aws_instance: { web: [{ count: 3, ami: "x" }] },
         aws_sqs_queue: { orphan: [{ name: "q" }] },
@@ -61,12 +61,12 @@ describe("applyStateCounts", () => {
       resource: { aws_sqs_queue: { fan: [{ count: 5, name: "q" }] } },
     };
     // Without state: instances=1, only the -10 dynamic penalty → 90.
-    const noState = scoreEstate(buildGraph(tree))[0];
+    const noState = scoreEstate(buildFixtureGraph(tree))[0];
     expect(noState.score).toBe(90);
     expect(noState.breakdown.instances).toBe(1);
 
     // With state: 5 instances → -10 dynamic -3*(5-1)=-12 → 78, drops out of "clean leaf".
-    const withCounts = buildGraph(tree);
+    const withCounts = buildFixtureGraph(tree);
     applyStateCounts(withCounts, new Map([["aws_sqs_queue.fan", 5]]));
     const stated = scoreEstate(withCounts)[0];
     expect(stated.breakdown.instances).toBe(5);

package/src/terraform/tier-map.ts

@@ -20,12 +20,52 @@ export interface TierInfo {
   mapsTo: string;
 }
 
+/**
+ * Kubernetes provider types with a native k8s-lexicon target. `kubernetes_manifest`
+ * IS the manifest (tier 1). The typed provider resources (`kubernetes_deployment`,
+ * ...) reshape their HCL schema back into a manifest, so they rank tier 2; the
+ * common `_v1` aliases share their base type's entry.
+ */
+const K8S_TIER_BASE: Record<string, TierInfo> = {
+  kubernetes_manifest: { tier: 1, mapsTo: "k8s:manifest" },
+  kubernetes_namespace: { tier: 2, mapsTo: "k8s:Namespace" },
+  kubernetes_config_map: { tier: 2, mapsTo: "k8s:ConfigMap" },
+  kubernetes_secret: { tier: 2, mapsTo: "k8s:Secret" },
+  kubernetes_service: { tier: 2, mapsTo: "k8s:Service" },
+  kubernetes_service_account: { tier: 2, mapsTo: "k8s:ServiceAccount" },
+  kubernetes_deployment: { tier: 2, mapsTo: "k8s:Deployment" },
+  kubernetes_stateful_set: { tier: 2, mapsTo: "k8s:StatefulSet" },
+  kubernetes_daemon_set: { tier: 2, mapsTo: "k8s:DaemonSet" },
+  kubernetes_job: { tier: 2, mapsTo: "k8s:Job" },
+  kubernetes_cron_job: { tier: 2, mapsTo: "k8s:CronJob" },
+  kubernetes_ingress: { tier: 2, mapsTo: "k8s:Ingress" },
+  kubernetes_network_policy: { tier: 2, mapsTo: "k8s:NetworkPolicy" },
+  kubernetes_persistent_volume_claim: { tier: 2, mapsTo: "k8s:PersistentVolumeClaim" },
+  kubernetes_role: { tier: 2, mapsTo: "k8s:Role" },
+  kubernetes_role_binding: { tier: 2, mapsTo: "k8s:RoleBinding" },
+  kubernetes_cluster_role: { tier: 2, mapsTo: "k8s:ClusterRole" },
+  kubernetes_cluster_role_binding: { tier: 2, mapsTo: "k8s:ClusterRoleBinding" },
+  kubernetes_resource_quota: { tier: 2, mapsTo: "k8s:ResourceQuota" },
+  kubernetes_limit_range: { tier: 2, mapsTo: "k8s:LimitRange" },
+  kubernetes_priority_class: { tier: 2, mapsTo: "k8s:PriorityClass" },
+  kubernetes_pod_disruption_budget: { tier: 2, mapsTo: "k8s:PodDisruptionBudget" },
+  kubernetes_horizontal_pod_autoscaler: { tier: 2, mapsTo: "k8s:HorizontalPodAutoscaler" },
+};
+
+const K8S_TIER: Record<string, TierInfo> = Object.fromEntries(
+  Object.entries(K8S_TIER_BASE).flatMap(([type, info]) =>
+    type === "kubernetes_manifest" ? [[type, info]] : [[type, info], [`${type}_v1`, info]],
+  ),
+);
+// The one provider type whose current alias is _v2, not _v1.
+K8S_TIER.kubernetes_horizontal_pod_autoscaler_v2 = K8S_TIER_BASE.kubernetes_horizontal_pod_autoscaler;
+
 /** TF resource type → native tier. Absent = unsupported (score 0). */
 export const TIER_MAP: Record<string, TierInfo> = {
   // AWS: derived from the carve-out table so advise and emit stay in lockstep.
   ...Object.fromEntries(AWS_CARVE_TYPES.map((t) => [t.tfType, { tier: t.tier, mapsTo: t.nativeType }])),
-  // Kubernetes — near-1:1 manifest. Ranked by advise; emit support is a separate target.
-  kubernetes_manifest: { tier: 1, mapsTo: "k8s:manifest" },
+  // Kubernetes — ranked by advise; emit support is a separate target.
+  ...K8S_TIER,
 };
 
 /**
@@ -44,16 +84,28 @@ export const FOLDS_INTO: Record<string, string> = {
   aws_s3_bucket_public_access_block: "aws_s3_bucket",
   aws_s3_bucket_server_side_encryption_configuration: "aws_s3_bucket",
   aws_s3_bucket_lifecycle_configuration: "aws_s3_bucket",
+  aws_s3_bucket_website_configuration: "aws_s3_bucket",
+  aws_s3_bucket_cors_configuration: "aws_s3_bucket",
+  aws_s3_bucket_logging: "aws_s3_bucket",
+  aws_s3_bucket_ownership_controls: "aws_s3_bucket",
+  aws_s3_bucket_notification: "aws_s3_bucket",
+  aws_s3_bucket_accelerate_configuration: "aws_s3_bucket",
+  aws_s3_bucket_request_payment_configuration: "aws_s3_bucket",
+  aws_s3_bucket_intelligent_tiering_configuration: "aws_s3_bucket",
+  aws_ecr_lifecycle_policy: "aws_ecr_repository",
+  aws_ecr_repository_policy: "aws_ecr_repository",
 };
 
 /**
- * The HCL attribute carrying a resource's physical name, per type — derived
- * from the AWS carve-out table. Used for the graph's identity and the
- * live-import hint. Absent → fall back to the TF logical name.
+ * The HCL attribute carrying a resource's physical name, per type — AWS entries
+ * derived from the carve-out table, non-AWS listed directly. A dotted entry is
+ * a path into nested blocks (`manifest.metadata.name`). Used for the graph's
+ * identity and the live-import hint. Absent → fall back to the TF logical name.
  */
-export const IDENTITY_ATTR: Record<string, string> = Object.fromEntries(
-  AWS_CARVE_TYPES.filter((t) => t.identityAttr).map((t) => [t.tfType, t.identityAttr!]),
-);
+export const IDENTITY_ATTR: Record<string, string> = {
+  ...Object.fromEntries(AWS_CARVE_TYPES.filter((t) => t.identityAttr).map((t) => [t.tfType, t.identityAttr!])),
+  kubernetes_manifest: "manifest.metadata.name",
+};
 
 export function resolveTier(tfType: string): TierInfo | null {
   return TIER_MAP[tfType] ?? null;

package/src/terraform/types.ts

@@ -48,6 +48,13 @@ export interface TfEdge {
   to: string;
   /** The attribute path(s) referenced, e.g. `["id", "arn"]`. */
   attrs: string[];
+  /**
+   * The referring block's own top-level attribute(s) the reference sits in,
+   * e.g. `["vpc_id"]` for a subnet reading its VPC (#998). This is what a
+   * deferred outbound input is named after when emit turns it into a build
+   * parameter. Empty when the reference came from a non-object block shape.
+   */
+  via: string[];
 }
 
 export interface TfGraph {

package/src/terraform/unified-diff.test.ts

@@ -0,0 +1,77 @@
+import { describe, test, expect } from "vitest";
+import { execFileSync } from "child_process";
+import { mkdtempSync, rmSync, writeFileSync, readFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { newFileDiff, unifiedDiff } from "./unified-diff";
+
+const OLD = `resource "aws_lambda_function" "api" {
+  function_name = "myapp-api"
+  environment {
+    variables = {
+      ASSETS_BUCKET = aws_s3_bucket.assets.bucket
+    }
+  }
+}
+`;
+const NEW = OLD.replace("aws_s3_bucket.assets.bucket", "data.aws_s3_bucket.assets.bucket");
+
+describe("unifiedDiff", () => {
+  test("identical inputs produce no diff", () => {
+    expect(unifiedDiff("main.tf", OLD, OLD)).toBe("");
+  });
+
+  test("a one-line rewrite yields one hunk with context and git headers", () => {
+    const patch = unifiedDiff("main.tf", OLD, NEW);
+    const lines = patch.split("\n");
+    expect(lines[0]).toBe("diff --git a/main.tf b/main.tf");
+    expect(lines[1]).toBe("--- a/main.tf");
+    expect(lines[2]).toBe("+++ b/main.tf");
+    expect(lines[3]).toBe("@@ -2,7 +2,7 @@");
+    expect(patch).toContain("-      ASSETS_BUCKET = aws_s3_bucket.assets.bucket");
+    expect(patch).toContain("+      ASSETS_BUCKET = data.aws_s3_bucket.assets.bucket");
+    // 3 context lines either side of the change.
+    expect(lines.filter((l) => l.startsWith(" "))).toHaveLength(6);
+  });
+
+  test("distant changes split into separate hunks; close ones join", () => {
+    const hunkHeaders = (patch: string) => patch.split("\n").filter((l) => l.startsWith("@@"));
+    const oldText = Array.from({ length: 20 }, (_, i) => `line ${i}`).join("\n") + "\n";
+    const twoFar = oldText.replace("line 2", "LINE 2").replace("line 17", "LINE 17");
+    expect(hunkHeaders(unifiedDiff("f.txt", oldText, twoFar))).toHaveLength(2);
+    const twoNear = oldText.replace("line 8", "LINE 8").replace("line 10", "LINE 10");
+    expect(hunkHeaders(unifiedDiff("f.txt", oldText, twoNear))).toHaveLength(1);
+  });
+
+  test("marks a missing trailing newline", () => {
+    const patch = unifiedDiff("f.txt", "a\nb\n", "a\nb2");
+    expect(patch).toContain("+b2\n\");
+  });
+
+  test("newFileDiff renders /dev/null → b/<path>", () => {
+    const patch = newFileDiff("ds.tf", 'data "aws_s3_bucket" "assets" {\n  bucket = "b"\n}\n');
+    expect(patch).toContain("new file mode 100644");
+    expect(patch).toContain("--- /dev/null");
+    expect(patch).toContain("+++ b/ds.tf");
+    expect(patch).toContain("@@ -0,0 +1,3 @@");
+  });
+
+  test("git apply accepts the combined patch and reproduces the new content", () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-udiff-"));
+    try {
+      writeFileSync(join(dir, "main.tf"), OLD);
+      const patch = unifiedDiff("main.tf", OLD, NEW) + newFileDiff("ds.tf", 'data "x" "y" {}\n');
+      writeFileSync(join(dir, "bridge.patch"), patch);
+      try {
+        execFileSync("git", ["apply", "bridge.patch"], { cwd: dir });
+      } catch (err) {
+        if ((err as NodeJS.ErrnoException).code === "ENOENT") return; // no git on this machine
+        throw err;
+      }
+      expect(readFileSync(join(dir, "main.tf"), "utf-8")).toBe(NEW);
+      expect(readFileSync(join(dir, "ds.tf"), "utf-8")).toBe('data "x" "y" {}\n');
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/src/terraform/unified-diff.ts

@@ -0,0 +1,146 @@
+/**
+ * Minimal unified-diff generator for the carve bridge patch (#998). Emits
+ * git-applyable hunks (`git apply`, or plain `patch -p1`) so the whole survivor
+ * edit — data sources plus rewired references — lands in one reviewable file.
+ * LCS-based; bridge inputs are hand-sized `.tf` files, so O(n·m) is fine.
+ */
+
+/** One file's diff, `a/<path>` → `b/<path>`, with git headers. Empty when unchanged. */
+export function unifiedDiff(path: string, oldText: string, newText: string, context = 3): string {
+  if (oldText === newText) return "";
+
+  const oldLines = splitLines(oldText);
+  const newLines = splitLines(newText);
+  const ops = diffOps(oldLines.lines, newLines.lines);
+  const hunks = buildHunks(ops, context);
+  if (hunks.length === 0) return "";
+
+  const L: string[] = [];
+  L.push(`diff --git a/${path} b/${path}`);
+  L.push(`--- a/${path}`);
+  L.push(`+++ b/${path}`);
+  for (const hunk of hunks) {
+    L.push(`@@ -${hunkRange(hunk.oldStart, hunk.oldCount)} +${hunkRange(hunk.newStart, hunk.newCount)} @@`);
+    for (const op of hunk.ops) {
+      L.push(`${op.kind === "add" ? "+" : op.kind === "del" ? "-" : " "}${op.line}`);
+      if (op.kind !== "add" && op.oldIndex === oldLines.lines.length - 1 && !oldLines.trailingNewline) {
+        L.push("\");
+      }
+      if (op.kind !== "del" && op.newIndex === newLines.lines.length - 1 && !newLines.trailingNewline) {
+        L.push("\");
+      }
+    }
+  }
+  return L.join("\n") + "\n";
+}
+
+/** A new-file diff (`/dev/null` → `b/<path>`), git-applyable. */
+export function newFileDiff(path: string, text: string): string {
+  const { lines, trailingNewline } = splitLines(text);
+  const L: string[] = [];
+  L.push(`diff --git a/${path} b/${path}`);
+  L.push("new file mode 100644");
+  L.push("--- /dev/null");
+  L.push(`+++ b/${path}`);
+  if (lines.length > 0) {
+    L.push(`@@ -0,0 +${hunkRange(1, lines.length)} @@`);
+    for (const line of lines) L.push(`+${line}`);
+    if (!trailingNewline) L.push("\");
+  }
+  return L.join("\n") + "\n";
+}
+
+function hunkRange(start: number, count: number): string {
+  return count === 1 ? String(start) : `${count === 0 ? start - 1 : start},${count}`;
+}
+
+function splitLines(text: string): { lines: string[]; trailingNewline: boolean } {
+  if (text === "") return { lines: [], trailingNewline: true };
+  const trailingNewline = text.endsWith("\n");
+  const lines = text.split("\n");
+  if (trailingNewline) lines.pop();
+  return { lines, trailingNewline };
+}
+
+interface DiffOp {
+  kind: "keep" | "del" | "add";
+  line: string;
+  /** Index in the old file (keep/del). */
+  oldIndex: number;
+  /** Index in the new file (keep/add). */
+  newIndex: number;
+}
+
+/** Line-level LCS diff as a flat op list. */
+function diffOps(a: string[], b: string[]): DiffOp[] {
+  const n = a.length;
+  const m = b.length;
+  // lcs[i][j] = LCS length of a[i..] and b[j..]
+  const lcs: number[][] = Array.from({ length: n + 1 }, () => new Array<number>(m + 1).fill(0));
+  for (let i = n - 1; i >= 0; i--) {
+    for (let j = m - 1; j >= 0; j--) {
+      lcs[i][j] = a[i] === b[j] ? lcs[i + 1][j + 1] + 1 : Math.max(lcs[i + 1][j], lcs[i][j + 1]);
+    }
+  }
+  const ops: DiffOp[] = [];
+  let i = 0;
+  let j = 0;
+  while (i < n && j < m) {
+    if (a[i] === b[j]) {
+      ops.push({ kind: "keep", line: a[i], oldIndex: i, newIndex: j });
+      i++;
+      j++;
+    } else if (lcs[i + 1][j] >= lcs[i][j + 1]) {
+      ops.push({ kind: "del", line: a[i], oldIndex: i, newIndex: j });
+      i++;
+    } else {
+      ops.push({ kind: "add", line: b[j], oldIndex: i, newIndex: j });
+      j++;
+    }
+  }
+  for (; i < n; i++) ops.push({ kind: "del", line: a[i], oldIndex: i, newIndex: j });
+  for (; j < m; j++) ops.push({ kind: "add", line: b[j], oldIndex: i, newIndex: j });
+  return ops;
+}
+
+interface Hunk {
+  oldStart: number;
+  oldCount: number;
+  newStart: number;
+  newCount: number;
+  ops: DiffOp[];
+}
+
+/** Group change ops into hunks with `context` lines of surrounding keeps. */
+function buildHunks(ops: DiffOp[], context: number): Hunk[] {
+  const changed = ops.map((op) => op.kind !== "keep");
+  const include = new Array<boolean>(ops.length).fill(false);
+  for (let k = 0; k < ops.length; k++) {
+    if (!changed[k]) continue;
+    for (let c = Math.max(0, k - context); c <= Math.min(ops.length - 1, k + context); c++) {
+      include[c] = true;
+    }
+  }
+
+  const hunks: Hunk[] = [];
+  let k = 0;
+  while (k < ops.length) {
+    if (!include[k]) {
+      k++;
+      continue;
+    }
+    const start = k;
+    while (k < ops.length && include[k]) k++;
+    const slice = ops.slice(start, k);
+    const oldOps = slice.filter((op) => op.kind !== "add");
+    const newOps = slice.filter((op) => op.kind !== "del");
+    hunks.push({
+      oldStart: (oldOps[0]?.oldIndex ?? slice[0].oldIndex) + 1,
+      oldCount: oldOps.length,
+      newStart: (newOps[0]?.newIndex ?? slice[0].newIndex) + 1,
+      newCount: newOps.length,
+      ops: slice,
+    });
+  }
+  return hunks;
+}