@intentius/chant 0.52.1 → 0.53.0

package/src/cli/commands/carve-emit-k8s.test.ts

@@ -0,0 +1,262 @@
+import { describe, test, expect, vi } from "vitest";
+import { mkdtempSync, writeFileSync, rmSync, readFileSync, existsSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { carveEmit, formatCarveEmit } from "./carve-emit";
+import { carveBridge } from "./carve-bridge";
+import { loadHcl2json } from "../../terraform/parse";
+import type { ImportResult, LiveImportOptions } from "./import";
+import type { LexiconPlugin } from "../../lexicon";
+
+/**
+ * `carve emit` over the kubernetes provider (#999), end to end: a Terraform
+ * estate that manages Kubernetes objects through `kubernetes_manifest`, carved
+ * into a buildable chant project for the k8s lexicon.
+ *
+ * The point of the fixture is the second resource. A `kubernetes_manifest` has
+ * no fixed entity type — the kind is inside the body — so a cert-manager
+ * Certificate and a core ConfigMap go through the identical path, which is what
+ * "one rule covers every CRD" has to mean in practice.
+ */
+let parserAvailable = false;
+try {
+  await loadHcl2json();
+  parserAvailable = true;
+} catch {
+  parserAvailable = false;
+}
+
+const ESTATE = `
+resource "kubernetes_namespace" "web" {
+  metadata {
+    name = "web"
+  }
+}
+
+resource "kubernetes_manifest" "app_config" {
+  manifest = {
+    apiVersion = "v1"
+    kind       = "ConfigMap"
+    metadata = {
+      name      = "app-config"
+      namespace = kubernetes_namespace.web.metadata[0].name
+    }
+    data = {
+      LOG_LEVEL = "info"
+    }
+  }
+}
+
+resource "kubernetes_manifest" "web_cert" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "web-tls"
+      namespace = "web"
+    }
+    spec = {
+      secretName = "web-tls"
+      dnsNames   = ["web.example.com"]
+    }
+  }
+}
+
+resource "kubernetes_config_map" "legacy" {
+  metadata {
+    name      = "legacy"
+    namespace = "web"
+  }
+  data = {
+    OLD = "true"
+  }
+}
+`;
+
+const TFSTATE = JSON.stringify({
+  version: 4,
+  resources: [
+    {
+      mode: "managed",
+      type: "kubernetes_manifest",
+      name: "app_config",
+      instances: [
+        {
+          attributes: {
+            manifest: {
+              apiVersion: "v1",
+              kind: "ConfigMap",
+              metadata: { name: "app-config", namespace: "web", labels: { "app.kubernetes.io/name": "web" } },
+              data: { LOG_LEVEL: "info" },
+            },
+            computed_fields: ["metadata.labels", "metadata.annotations"],
+            field_manager: null,
+          },
+        },
+      ],
+    },
+    {
+      mode: "managed",
+      type: "kubernetes_manifest",
+      name: "web_cert",
+      instances: [
+        {
+          attributes: {
+            manifest: {
+              apiVersion: "cert-manager.io/v1",
+              kind: "Certificate",
+              metadata: { name: "web-tls", namespace: "web" },
+              spec: { secretName: "web-tls", dnsNames: ["web.example.com"] },
+            },
+          },
+        },
+      ],
+    },
+    {
+      mode: "managed",
+      type: "kubernetes_config_map",
+      name: "legacy",
+      instances: [{ attributes: { id: "web/legacy", data: { OLD: "true" } } }],
+    },
+  ],
+});
+
+const fakeImport = () =>
+  vi.fn(
+    async (_plugins: LexiconPlugin[], _options: LiveImportOptions): Promise<ImportResult> => ({
+      success: true,
+      generatedFiles: ["infra/main.ts"],
+      warnings: [],
+    }),
+  );
+
+async function withEstate<T>(fn: (dir: string) => Promise<T>): Promise<T> {
+  const dir = mkdtempSync(join(tmpdir(), "chant-carve-k8s-"));
+  try {
+    writeFileSync(join(dir, "main.tf"), ESTATE);
+    writeFileSync(join(dir, "terraform.tfstate"), TFSTATE);
+    return await fn(dir);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+describe("carve emit — kubernetes_manifest (#999)", () => {
+  test("carves a ConfigMap manifest into a buildable k8s project", async () => {
+    if (!parserAvailable) return;
+    await withEstate(async (dir) => {
+      const out = join(dir, "carveout");
+      const liveImport = fakeImport();
+      const res = await carveEmit(
+        { from: dir, select: "kubernetes_manifest.app_config", statePath: join(dir, "terraform.tfstate"), output: out },
+        { plugins: [], liveImport },
+      );
+
+      expect(res.ok).toBe(true);
+      expect(res.source).toBe("tfstate");
+      expect(liveImport).not.toHaveBeenCalled();
+
+      const source = readFileSync(join(out, "src", "app_config.ts"), "utf-8");
+      expect(source).toContain('import { k8sManifest } from "@intentius/chant-lexicon-k8s";');
+      expect(source).toContain("export const app_config = k8sManifest({");
+      expect(source).toContain('apiVersion: "v1"');
+      expect(source).toContain('kind: "ConfigMap"');
+      expect(source).toContain('"app.kubernetes.io/name": "web"');
+      expect(source).toContain("-> v1 ConfigMap");
+
+      // The scaffold targets the provider's lexicon, so the emitted project
+      // builds with `npm install && npm run build` as it stands.
+      const pkg = JSON.parse(readFileSync(join(out, "package.json"), "utf-8"));
+      expect(pkg.scripts.build).toBe("chant build src --lexicon k8s");
+      expect(Object.keys(pkg.dependencies)).toEqual(["@intentius/chant", "@intentius/chant-lexicon-k8s"]);
+      expect(readFileSync(join(out, "chant.config.ts"), "utf-8")).toContain('lexicons: ["k8s"]');
+
+      // The namespace the manifest read is a survivor, so it is an outbound
+      // edge and becomes a declared build parameter.
+      expect(res.params?.map((p) => p.name)).toEqual(["manifest"]);
+      expect(source).toContain("Deferred deploy-time input: manifest read kubernetes_namespace.web");
+      // Nothing is substituted: state resolved `manifest` to the whole object.
+      expect(source).not.toContain("params.");
+
+      expect(res.manifestPath).toBe(join(out, "kubernetes_manifest-app_config.carve.json"));
+      expect(formatCarveEmit(res)).toContain("Adopted from Terraform state (offline).");
+    });
+  });
+
+  test("a CRD manifest carves through the same path as a core kind", async () => {
+    if (!parserAvailable) return;
+    await withEstate(async (dir) => {
+      const out = join(dir, "carveout");
+      const res = await carveEmit(
+        { from: dir, select: "kubernetes_manifest.web_cert", statePath: join(dir, "terraform.tfstate"), output: out },
+        { plugins: [], liveImport: fakeImport() },
+      );
+
+      expect(res.ok).toBe(true);
+      const source = readFileSync(join(out, "src", "web_cert.ts"), "utf-8");
+      expect(source).toContain("-> cert-manager.io/v1 Certificate");
+      expect(source).toContain('apiVersion: "cert-manager.io/v1"');
+      expect(source).toContain('kind: "Certificate"');
+      expect(source).toContain('secretName: "web-tls"');
+      expect(source).toContain('"web.example.com",');
+      // No CRD-specific mapping was needed, so nothing was left behind.
+      expect(source).not.toContain("TODO");
+    });
+  });
+
+  test("--env refuses: the kind is in the body, so a live export has nothing to filter on", async () => {
+    if (!parserAvailable) return;
+    await withEstate(async (dir) => {
+      const liveImport = fakeImport();
+      const res = await carveEmit(
+        { from: dir, select: "kubernetes_manifest.app_config", env: "prod" },
+        { plugins: [], liveImport },
+      );
+      expect(res.ok).toBe(false);
+      expect(res.error).toContain("no live adoption path");
+      expect(res.error).toContain("--state");
+      expect(liveImport).not.toHaveBeenCalled();
+    });
+  });
+
+  test("a typed kubernetes resource ranks but is refused identically on both paths", async () => {
+    if (!parserAvailable) return;
+    await withEstate(async (dir) => {
+      const liveImport = fakeImport();
+      const live = await carveEmit(
+        { from: dir, select: "kubernetes_config_map.legacy", env: "prod" },
+        { plugins: [], liveImport },
+      );
+      const state = await carveEmit(
+        { from: dir, select: "kubernetes_config_map.legacy", statePath: join(dir, "terraform.tfstate") },
+        { plugins: [], liveImport },
+      );
+      expect(live.ok).toBe(false);
+      expect(state.error).toBe(live.error);
+      expect(live.error).toContain("kubernetes_config_map cannot be emitted yet");
+      expect(live.error).toContain("kubernetes_manifest");
+      expect(liveImport).not.toHaveBeenCalled();
+    });
+  });
+
+  test("bridge still refuses the carved manifest, so emit writes no half-bridged estate", async () => {
+    if (!parserAvailable) return;
+    await withEstate(async (dir) => {
+      const out = join(dir, "carveout");
+      const emitted = await carveEmit(
+        { from: dir, select: "kubernetes_manifest.app_config", statePath: join(dir, "terraform.tfstate"), output: out },
+        { plugins: [], liveImport: fakeImport() },
+      );
+      expect(emitted.ok).toBe(true);
+
+      // Emit does not unlock bridge: `manifest.metadata.name` is a path into
+      // nested blocks and a data-source body is flat `attr = value`, so the
+      // survivors' references cannot be repointed yet.
+      const bridged = await carveBridge({ from: dir, select: "kubernetes_manifest.app_config", output: out });
+      expect(bridged.ok).toBe(false);
+      expect(bridged.error).toContain("cannot be bridged");
+      expect(bridged.error).toContain("manifest.metadata.name");
+      expect(existsSync(join(out, "kubernetes_manifest-app_config-runbook.md"))).toBe(false);
+    });
+  });
+});

package/src/cli/commands/carve-emit-provider.test.ts

@@ -0,0 +1,207 @@
+import { describe, test, expect, vi, afterEach } from "vitest";
+import { mkdtempSync, writeFileSync, rmSync, readFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { carveEmit, formatCarveEmit } from "./carve-emit";
+import { loadHcl2json } from "../../terraform/parse";
+import { registerCarveProvider, type CarveProvider } from "../../terraform/carve-provider";
+import type { ImportResult, LiveImportOptions } from "./import";
+import type { LexiconPlugin } from "../../lexicon";
+
+/**
+ * The carve provider seam (#2016), driven end to end by a provider core has
+ * never heard of. Nothing in `carve-emit.ts` or `adopt-state.ts` mentions
+ * `fake_`, `fakelex` or `fake:Widget` — if emit can carry this estate to
+ * emitted source, a scaffolded project and a live selector, then adding a real
+ * provider (#999 kubernetes, #2017 gcp) is a file under `terraform/providers/`.
+ */
+let parserAvailable = false;
+try {
+  await loadHcl2json();
+  parserAvailable = true;
+} catch {
+  parserAvailable = false;
+}
+
+const ESTATE = `
+resource "fake_widget" "hero" { widget_name = "hero-widget" }
+resource "fake_widget_setting" "hero" {
+  widget = fake_widget.hero.id
+  colour = "blue"
+}
+resource "fake_consumer" "reader" { widget = fake_widget.hero.id }
+resource "fake_gizmo" "spare" { size = 3 }
+`;
+
+const TFSTATE = JSON.stringify({
+  version: 4,
+  resources: [
+    {
+      mode: "managed",
+      type: "fake_widget",
+      name: "hero",
+      instances: [{ attributes: { id: "hero-widget", widget_name: "hero-widget" } }],
+    },
+    {
+      mode: "managed",
+      type: "fake_widget_setting",
+      name: "hero",
+      instances: [{ attributes: { id: "hero-widget", colour: "blue" } }],
+    },
+  ],
+});
+
+/** A provider with an emit path: adopt from state, and a live selector type. */
+const fakeProvider: CarveProvider = {
+  name: "test-fake-emit",
+  tfTypePrefixes: ["fake_"],
+  lexicon: "fakelex",
+  tiers: {
+    fake_widget: { tier: 1, mapsTo: "fake:Widget" },
+    fake_widget_setting: { tier: 2, mapsTo: "fake:WidgetSetting" },
+    fake_gizmo: { tier: 2, mapsTo: "fake:Gizmo" },
+  },
+  identityAttrs: { fake_widget: "widget_name" },
+  foldsInto: { fake_widget_setting: "fake_widget" },
+  emitTypes: ["fake_widget"],
+  adopt: (resource, params, folded) => ({
+    fileName: `${resource.name}.widget.ts`,
+    content: `// fake provider adopted ${resource.type}.${resource.name}\nexport const ${resource.name} = "${resource.attributes.widget_name}";\n`,
+    mapped: true,
+    nativeType: "fake:Widget",
+    parameterized: params.map((p) => p.name),
+    folded: folded.map((f) => ({ address: `${f.type}.${f.name}`, props: ["Colour"] })),
+  }),
+  liveSelectorType: (tfType) => (tfType === "fake_widget" ? "fake:Widget" : undefined),
+};
+
+/** Same provider, state-only: no live adoption path at all. */
+const stateOnlyProvider: CarveProvider = {
+  ...fakeProvider,
+  name: "test-fake-state-only",
+  liveSelectorType: undefined,
+};
+
+const fakeImport = () =>
+  vi.fn(
+    async (_plugins: LexiconPlugin[], _options: LiveImportOptions): Promise<ImportResult> => ({
+      success: true,
+      generatedFiles: ["infra/hero.ts"],
+      warnings: [],
+    }),
+  );
+
+let dispose: (() => void) | undefined;
+afterEach(() => {
+  dispose?.();
+  dispose = undefined;
+});
+
+async function withEstate<T>(fn: (dir: string) => Promise<T>): Promise<T> {
+  const dir = mkdtempSync(join(tmpdir(), "chant-carve-provider-"));
+  try {
+    writeFileSync(join(dir, "main.tf"), ESTATE);
+    writeFileSync(join(dir, "terraform.tfstate"), TFSTATE);
+    return await fn(dir);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+describe("carve emit through a registered provider (#2016)", () => {
+  test("without a provider the type is unknown to advise and refused by emit", async () => {
+    if (!parserAvailable) return;
+    await withEstate(async (dir) => {
+      const res = await carveEmit(
+        { from: dir, select: "fake_widget.hero", statePath: join(dir, "terraform.tfstate") },
+        { plugins: [], liveImport: fakeImport() },
+      );
+      expect(res.ok).toBe(false);
+      expect(res.error).toMatch(/no known native mapping/i);
+    });
+  });
+
+  test("--state emits through the provider and scaffolds for its lexicon", async () => {
+    if (!parserAvailable) return;
+    dispose = registerCarveProvider(fakeProvider);
+    await withEstate(async (dir) => {
+      const out = join(dir, "carveout");
+      const liveImport = fakeImport();
+      const res = await carveEmit(
+        { from: dir, select: "fake_widget.hero", statePath: join(dir, "terraform.tfstate"), output: out },
+        { plugins: [], liveImport },
+      );
+
+      expect(res.ok).toBe(true);
+      expect(res.source).toBe("tfstate");
+      expect(liveImport).not.toHaveBeenCalled();
+
+      // The provider named the file and wrote the content; core wrote it out.
+      expect(res.emittedFiles).toEqual([join(out, "src", "hero.widget.ts")]);
+      expect(readFileSync(res.emittedFiles![0], "utf-8")).toContain("fake provider adopted fake_widget.hero");
+
+      // The scaffold targets the provider's lexicon, not a hardcoded aws.
+      const pkg = JSON.parse(readFileSync(join(out, "package.json"), "utf-8"));
+      expect(pkg.scripts.build).toBe("chant build src --lexicon fakelex");
+      expect(Object.keys(pkg.dependencies)).toEqual(["@intentius/chant", "@intentius/chant-lexicon-fakelex"]);
+      expect(readFileSync(join(out, "chant.config.ts"), "utf-8")).toContain('lexicons: ["fakelex"]');
+
+      // The provider's foldsInto drove the carve set, so the setting folded in.
+      expect(res.folded).toEqual([{ address: "fake_widget_setting.hero", props: ["Colour"] }]);
+      expect(formatCarveEmit(res)).toContain("fake_widget_setting.hero (Colour)");
+      // And its identityAttrs gave the graph the physical name.
+      expect(res.report!.inbound.map((e) => e.survivor)).toEqual(["fake_consumer.reader"]);
+    });
+  });
+
+  test("--env uses the provider's live selector type and lexicon", async () => {
+    if (!parserAvailable) return;
+    dispose = registerCarveProvider(fakeProvider);
+    await withEstate(async (dir) => {
+      const liveImport = fakeImport();
+      const res = await carveEmit(
+        { from: dir, select: "fake_widget.hero", env: "prod" },
+        { plugins: [], liveImport },
+      );
+      expect(res.ok).toBe(true);
+      expect(res.selector).toEqual({ type: "fake:Widget" });
+      expect(liveImport.mock.calls[0][1]).toMatchObject({
+        environment: "prod",
+        selector: { type: "fake:Widget" },
+        lexicon: "fakelex",
+      });
+      expect(formatCarveEmit(res)).toContain("Adopted live as fake:Widget");
+    });
+  });
+
+  test("a ranked type the provider does not emit is refused identically on both paths", async () => {
+    if (!parserAvailable) return;
+    dispose = registerCarveProvider(fakeProvider);
+    await withEstate(async (dir) => {
+      const liveImport = fakeImport();
+      const live = await carveEmit({ from: dir, select: "fake_gizmo.spare", env: "prod" }, { plugins: [], liveImport });
+      const state = await carveEmit(
+        { from: dir, select: "fake_gizmo.spare", statePath: join(dir, "terraform.tfstate") },
+        { plugins: [], liveImport },
+      );
+      expect(live.ok).toBe(false);
+      expect(state.ok).toBe(false);
+      expect(live.error).toBe(state.error);
+      expect(live.error).toContain("fake_gizmo cannot be emitted yet");
+      expect(liveImport).not.toHaveBeenCalled();
+    });
+  });
+
+  test("a state-only provider refuses --env instead of importing the wrong thing", async () => {
+    if (!parserAvailable) return;
+    dispose = registerCarveProvider(stateOnlyProvider);
+    await withEstate(async (dir) => {
+      const liveImport = fakeImport();
+      const res = await carveEmit({ from: dir, select: "fake_widget.hero", env: "prod" }, { plugins: [], liveImport });
+      expect(res.ok).toBe(false);
+      expect(res.error).toContain("no live adoption path");
+      expect(res.error).toContain("--state");
+      expect(liveImport).not.toHaveBeenCalled();
+    });
+  });
+});

package/src/cli/commands/carve-emit.test.ts

@@ -1,9 +1,10 @@
 import { describe, test, expect, vi } from "vitest";
-import { mkdtempSync, writeFileSync, rmSync, readFileSync } from "fs";
+import { mkdtempSync, writeFileSync, rmSync, readFileSync, existsSync } from "fs";
 import { tmpdir } from "os";
 import { join } from "path";
 import { carveEmit, formatCarveEmit } from "./carve-emit";
 import { loadHcl2json } from "../../terraform/parse";
+import { listCarveManifests } from "../../terraform/manifest";
 import type { ImportResult, LiveImportOptions } from "./import";
 import type { LexiconPlugin } from "../../lexicon";
 
@@ -35,12 +36,30 @@ resource "aws_lambda_function" "api" {
 resource "random_pet" "suffix" {
   length = 2
 }
+resource "kubernetes_config_map" "demo" {
+  metadata { name = "demo-config" }
+}
 `;
 
+// A state file for the bucket, so the --state path reaches the same gate the
+// --env path does rather than stopping at "not found in state".
+const TFSTATE = JSON.stringify({
+  version: 4,
+  resources: [
+    {
+      mode: "managed",
+      type: "kubernetes_config_map",
+      name: "demo",
+      instances: [{ attributes: { id: "default/demo-config" } }],
+    },
+  ],
+});
+
 async function withEstate<T>(fn: (dir: string) => Promise<T>): Promise<T> {
   const dir = mkdtempSync(join(tmpdir(), "chant-carve-emit-"));
   try {
     writeFileSync(join(dir, "main.tf"), ESTATE);
+    writeFileSync(join(dir, "terraform.tfstate"), TFSTATE);
     return await fn(dir);
   } finally {
     rmSync(dir, { recursive: true, force: true });
@@ -142,6 +161,58 @@ describe("carveEmit — emit + boundary", () => {
     });
   });
 
+  test("a failed live import fails the emit and writes no carve manifest (#2015)", async () => {
+    if (!parserAvailable) return;
+    await withEstate(async (dir) => {
+      const out = join(dir, "carveout");
+      const li = vi.fn(
+        async (_p: LexiconPlugin[], _o: LiveImportOptions): Promise<ImportResult> => ({
+          success: false,
+          generatedFiles: [],
+          warnings: [],
+          error: "no stack in prod exports AWS::S3::Bucket",
+        }),
+      );
+      const res = await carveEmit(
+        { from: dir, select: "aws_s3_bucket.assets", env: "prod", output: out },
+        { plugins: noPlugins, liveImport: li },
+      );
+
+      expect(res.ok).toBe(false);
+      expect(res.error).toContain("no stack in prod exports AWS::S3::Bucket");
+      expect(res.manifestPath).toBeUndefined();
+      // Bridge/apply compose from the manifest; one written here would make
+      // bridge excise a `.tf` block for a resource that was never emitted.
+      expect(listCarveManifests(out)).toEqual([]);
+      expect(existsSync(out)).toBe(false);
+      // No false "Adopted live" line on the failure path.
+      expect(formatCarveEmit(res)).not.toContain("Adopted live");
+    });
+  });
+
+  test("a type emit cannot carve is refused identically on --state and --env (#2015)", async () => {
+    if (!parserAvailable) return;
+    await withEstate(async (dir) => {
+      const li = fakeImport();
+      const live = await carveEmit(
+        { from: dir, select: "kubernetes_config_map.demo", env: "prod" },
+        { plugins: noPlugins, liveImport: li },
+      );
+      const state = await carveEmit(
+        { from: dir, select: "kubernetes_config_map.demo", statePath: join(dir, "terraform.tfstate") },
+        { plugins: noPlugins, liveImport: li },
+      );
+
+      expect(live.ok).toBe(false);
+      expect(state.ok).toBe(false);
+      expect(live.error).toBe(state.error);
+      expect(live.error).toContain("kubernetes_config_map cannot be emitted yet");
+      // advise ranks it (tier 2), so it gets past resolveTier — the emit gate
+      // is what refuses it, before the AWS exporter is ever reached.
+      expect(li).not.toHaveBeenCalled();
+    });
+  });
+
   test("--live-name narrows the live selector to a CFN logical id", async () => {
     if (!parserAvailable) return;
     await withEstate(async (dir) => {