@intentius/chant 0.58.0 → 0.60.0

package/src/cli/commands/build.ts

@@ -18,6 +18,7 @@ import { runPostSynthChecks, type PostSynthDiagnostic } from "../../lint/post-sy
 import { loadActivityContracts } from "../../op/activity-contract-registry";
 import { isOpEntity } from "../../op/resource";
 import { serializeOpIR } from "../../op/op-ir";
+import { opUsesDeprecatedGateKey, DEPRECATED_GATE_KEY_WARNING } from "../../op/gate-name";
 import type { OpConfig } from "../../op/types";
 import { coreReceiptChecks } from "../../lint/receipt-checks";
 import { coreOutputChecks } from "../../lint/output-checks";
@@ -173,8 +174,8 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // Resolve opt-in ownership marking from project config. chant #1117 — walks
   // up from the infra dir to the project root (`loadChantConfigUpward`), not
   // just the infra dir's immediate parent: a project whose stacks live two or
-  // more levels below `chant.config.ts` (loomster's `src/<stack>` layout)
-  // otherwise never finds the root config at all, and every declared
+  // more levels below `chant.config.ts` (a `src/<stack>` layout) otherwise
+  // never finds the root config at all, and every declared
   // `buildParams`/`ownership`/`lint.policies` setting silently falls back to
   // its default.
   const loaded = await loadChantConfigUpward(infraPath);
@@ -232,10 +233,10 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // BEFORE calling build() — a resolution failure (an unknown name, a
   // missing required value, a type/enum mismatch) is reported as a chant
   // build error naming the parameter, never a thrown error from inside user
-  // source (which is what loomster's hand-rolled `tierFromEnv()`-style
-  // validators did before migrating to this mechanism). Also logs a one-line
-  // count on success, or every resolved value (`[param] name = value
-  // (source)`) under --verbose (#1424).
+  // source (which is what a hand-rolled `tierFromEnv()`-style validator in a
+  // project's own `params.ts` does before migrating to this mechanism). Also
+  // logs a one-line count on success, or every resolved value (`[param] name =
+  // value (source)`) under --verbose (#1424).
   const paramsResolution = resolveCliBuildParams(config.buildParams, {
     cli: options.params,
     paramsFile: options.paramsFile,
@@ -247,8 +248,8 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   }
 
   // chant #1117 — a project that declares buildParams but resolves NONE of
-  // them for this build is the exact shape that let loomster#162 live for two
-  // releases: the discovered config wasn't the one the project author
+  // them for this build is the exact shape that let a silent misresolution run
+  // for two releases: the discovered config wasn't the one the project author
   // expected (a stale --path, a workspace boundary that stopped the walk
   // short), or every declared parameter's `env:` var went unset, and either
   // way every `params.<name>` read silently falls back to `undefined` — with
@@ -639,6 +640,19 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // not a resource manifest, so an Ops-only project legitimately produces no
   // serializer output and must not be reported as a broken import.
   const declaredOps = [...result.entities.values()].filter(isOpEntity);
+
+  // The gate step's name key was renamed from `signalName` to `gate` in #2202.
+  // The old key is still read; a build that finds an Op still using it says so
+  // once, naming every Op involved, rather than once per gate step.
+  const opsOnOldGateKey = declaredOps
+    .map((entity) => (entity as unknown as { props?: OpConfig }).props)
+    .filter((config): config is OpConfig => Boolean(config?.name) && opUsesDeprecatedGateKey(config as OpConfig))
+    .map((config) => config.name);
+  if (opsOnOldGateKey.length > 0) {
+    warnings.push(
+      formatWarning({ message: `${DEPRECATED_GATE_KEY_WARNING} Ops: ${opsOnOldGateKey.join(", ")}.` }),
+    );
+  }
   if (
     result.sourceFileCount > 0 &&
     result.outputs.size === 0 &&

package/src/cli/commands/carve-bridge.test.ts

@@ -5,6 +5,7 @@ import { tmpdir } from "os";
 import { join } from "path";
 import { carveBridge, formatCarveBridge } from "./carve-bridge";
 import { loadHcl2json } from "../../terraform/parse";
+import { registerCarveProvider } from "../../terraform/carve-provider";
 import { readCarveManifest, writeCarveManifest, type CarveManifest } from "../../terraform/manifest";
 
 let parserAvailable = false;
@@ -195,36 +196,258 @@ describe("carveBridge", () => {
     }
   });
 
-  test("refuses a target whose identity attribute is a dotted path (#2015)", async () => {
+  test("refuses a dotted-identity type no provider declares a shape for (#2015, #2034)", async () => {
     if (!parserAvailable) return;
-    const dir = mkdtempSync(join(tmpdir(), "chant-bridge-k8s-"));
+    // A dotted identity attribute is a path into nested values, and a data body
+    // is flat `attr = value` — `spec.metadata.name = "x"` is not valid HCL. The
+    // guard now turns on the missing shape, not on the dot, so the message says
+    // what would lift it.
+    const unregister = registerCarveProvider({
+      name: "carve-bridge-test-nested",
+      tfTypePrefixes: ["nested_"],
+      lexicon: "aws",
+      tiers: { nested_widget: { tier: 1, mapsTo: "Test::Widget" } },
+      identityAttrs: { nested_widget: "spec.metadata.name" },
+    });
+    const dir = mkdtempSync(join(tmpdir(), "chant-bridge-nested-"));
     try {
-      // `kubernetes_manifest` identifies itself by `manifest.metadata.name`.
-      // Rendering that into a data body produced `manifest.metadata.name = "x"`,
-      // which is not valid HCL — and the provider has no manifest data source.
       writeFileSync(
         join(dir, "main.tf"),
-        `resource "kubernetes_manifest" "demo" {\n` +
-          `  manifest = {\n` +
-          `    apiVersion = "v1"\n` +
-          `    kind       = "ConfigMap"\n` +
-          `    metadata = { name = "demo-config" }\n` +
-          `  }\n` +
-          `}\n`,
+        `resource "nested_widget" "demo" {\n  spec {\n    metadata {\n      name = "demo"\n    }\n  }\n}\n`,
       );
       const out = join(dir, "carveout");
-      const res = await carveBridge({ from: dir, select: "kubernetes_manifest.demo", output: out });
+      const res = await carveBridge({ from: dir, select: "nested_widget.demo", output: out });
 
       expect(res.ok).toBe(false);
       expect(res.error).toContain("cannot be bridged");
-      expect(res.error).toContain("manifest.metadata.name");
+      expect(res.error).toContain("spec.metadata.name");
+      expect(res.error).toContain("no carve provider declares a data-source shape for it");
+      expect(res.error).toContain("dataSourceShapes");
       expect(res.plan).toBeUndefined();
       expect(existsSync(out)).toBe(false);
+    } finally {
+      unregister();
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+});
+
+/**
+ * `kubernetes_manifest` reads back through a different type (#2034). The
+ * kubernetes provider ships no `kubernetes_manifest` data source — verified
+ * against hashicorp/kubernetes v3.2.1 — so the bridge renders
+ * `data "kubernetes_resource"` from the manifest's own apiVersion, kind and
+ * metadata, and repoints survivors at that data source's attribute path.
+ */
+describe("carveBridge — kubernetes_manifest (#2034)", () => {
+  const MANIFEST_TF = `resource "kubernetes_manifest" "app_config" {
+  manifest = {
+    apiVersion = "v1"
+    kind       = "ConfigMap"
+    metadata = {
+      name      = "app-config"
+      namespace = "apps"
+    }
+    data = {
+      LOG_LEVEL = "info"
+    }
+  }
+}
+`;
+  // Three shapes of inbound reference: the issue's own example, one deeper into
+  // `object`, and one through `manifest` — the attribute the data source does
+  // NOT have, which is why the rewrite maps it rather than only swapping heads.
+  const SURVIVOR_TF = `resource "kubernetes_config_map" "mirror" {
+  metadata {
+    name      = kubernetes_manifest.app_config.object.metadata.name
+    namespace = "apps"
+  }
+  data = {
+    LOG_LEVEL = kubernetes_manifest.app_config.manifest.data.LOG_LEVEL
+    UPSTREAM  = kubernetes_manifest.app_config.object.data.LOG_LEVEL
+  }
+}
+`;
+  const OUTPUTS_TF = `output "app_config_name" {
+  value = kubernetes_manifest.app_config.object.metadata.name
+}
+`;
+
+  async function withManifestEstate<T>(fn: (dir: string) => Promise<T>): Promise<T> {
+    const dir = mkdtempSync(join(tmpdir(), "chant-bridge-manifest-"));
+    try {
+      writeFileSync(join(dir, "manifest.tf"), MANIFEST_TF);
+      writeFileSync(join(dir, "survivor.tf"), SURVIVOR_TF);
+      writeFileSync(join(dir, "outputs.tf"), OUTPUTS_TF);
+      return await fn(dir);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }
+
+  test("bridges to a data \"kubernetes_resource\" block built from the manifest body", async () => {
+    if (!parserAvailable) return;
+    await withManifestEstate(async (dir) => {
+      const out = join(dir, "carveout");
+      const res = await carveBridge({ from: dir, select: "kubernetes_manifest.app_config", output: out });
+      expect(res.ok).toBe(true);
+
+      // The data source is the provider's generic read, not the carved type.
+      expect(res.plan!.dataSources).toHaveLength(1);
+      expect(res.plan!.dataSources[0]).toMatchObject({
+        address: "kubernetes_manifest.app_config",
+        type: "kubernetes_resource",
+        name: "app_config",
+      });
+      expect(res.plan!.dataSources[0].hcl).toBe(
+        `data "kubernetes_resource" "app_config" {\n` +
+          `  api_version = "v1"\n` +
+          `  kind        = "ConfigMap"\n` +
+          `\n` +
+          `  metadata {\n` +
+          `    name      = "app-config"\n` +
+          `    namespace = "apps"\n` +
+          `  }\n` +
+          `}`,
+      );
+      expect(formatCarveBridge(res)).toContain(
+        "data.kubernetes_resource.app_config  (was kubernetes_manifest.app_config)",
+      );
+    });
+  });
+
+  test("the emitted data source parses as HCL and is terraform-fmt clean", async () => {
+    if (!parserAvailable) return;
+    await withManifestEstate(async (dir) => {
+      const out = join(dir, "carveout");
+      await carveBridge({ from: dir, select: "kubernetes_manifest.app_config", output: out });
+      const dsPath = join(out, "kubernetes_manifest-app_config-datasources.tf");
+      const hcl = readFileSync(dsPath, "utf-8");
+
+      // The repo's own parser: `metadata` has to come out as a block, since the
+      // provider declares it Block List (Min 1, Max 1), not an attribute.
+      const parsed = await (await loadHcl2json()).parse("datasources.tf", hcl);
+      const ds = (parsed.data as Record<string, Record<string, unknown[]>>).kubernetes_resource.app_config[0] as Record<
+        string,
+        unknown
+      >;
+      expect(ds.api_version).toBe("v1");
+      expect(ds.kind).toBe("ConfigMap");
+      expect(ds.metadata).toEqual([{ name: "app-config", namespace: "apps" }]);
+
+      // And Terraform's own formatter accepts it byte for byte.
+      try {
+        execFileSync("terraform", ["fmt", "-check", "-diff", dsPath], { stdio: "pipe" });
+      } catch (err) {
+        if ((err as NodeJS.ErrnoException).code === "ENOENT") return; // no terraform on this machine
+        throw err;
+      }
+    });
+  });
+
+  test("survivor references follow the data source's own attribute path", async () => {
+    if (!parserAvailable) return;
+    await withManifestEstate(async (dir) => {
+      const out = join(dir, "carveout");
+      const res = await carveBridge({ from: dir, select: "kubernetes_manifest.app_config", output: out });
+      expect(res.ok).toBe(true);
+
+      const survivor = readFileSync(join(out, "survivor.tf"), "utf-8");
+      // The issue's example, and a reference that goes deeper into `object`.
+      expect(survivor).toContain("name      = data.kubernetes_resource.app_config.object.metadata.name");
+      expect(survivor).toContain("UPSTREAM  = data.kubernetes_resource.app_config.object.data.LOG_LEVEL");
+      // `manifest` is an attribute of the resource that the data source does not
+      // have; left alone it would be an "Unsupported attribute" at validate.
+      expect(survivor).toContain("LOG_LEVEL = data.kubernetes_resource.app_config.object.data.LOG_LEVEL");
+      expect(survivor).not.toContain(".manifest.");
+      expect(survivor).not.toMatch(/(?<!data\.)\bkubernetes_manifest\.app_config\b/);
+
+      // An output reading the manifest is repointed the same way (#1638).
+      expect(res.plan!.outputRewrites).toEqual(["output.app_config_name"]);
+      expect(readFileSync(join(out, "outputs.tf"), "utf-8")).toContain(
+        "value = data.kubernetes_resource.app_config.object.metadata.name",
+      );
+
+      // The carved block leaves the survivor source, as for any other type.
+      expect(res.plan!.excised).toEqual(["kubernetes_manifest.app_config"]);
+      expect(readFileSync(join(out, "manifest.tf"), "utf-8").trim()).toBe("");
+    });
+  });
+
+  test("a namespace-less manifest omits the optional argument", async () => {
+    if (!parserAvailable) return;
+    const dir = mkdtempSync(join(tmpdir(), "chant-bridge-clusterwide-"));
+    try {
+      // A cluster-scoped kind has no namespace, and `metadata.namespace` is
+      // optional on the data source — so it is left out, not emitted empty.
+      writeFileSync(
+        join(dir, "main.tf"),
+        `resource "kubernetes_manifest" "reader" {\n` +
+          `  manifest = {\n` +
+          `    apiVersion = "rbac.authorization.k8s.io/v1"\n` +
+          `    kind       = "ClusterRole"\n` +
+          `    metadata = {\n` +
+          `      name = "reader"\n` +
+          `    }\n` +
+          `  }\n` +
+          `}\n`,
+      );
+      writeFileSync(
+        join(dir, "outputs.tf"),
+        `output "reader" {\n  value = kubernetes_manifest.reader.object.metadata.name\n}\n`,
+      );
+      const out = join(dir, "carveout");
+      const res = await carveBridge({ from: dir, select: "kubernetes_manifest.reader", output: out });
+      expect(res.ok).toBe(true);
+      const hcl = res.plan!.dataSources[0].hcl;
+      expect(hcl).toContain('api_version = "rbac.authorization.k8s.io/v1"');
+      expect(hcl).toContain('name = "reader"');
+      expect(hcl).not.toContain("namespace");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("an interpolated manifest name falls back to the TODO body, never a half-written block", async () => {
+    if (!parserAvailable) return;
+    const dir = mkdtempSync(join(tmpdir(), "chant-bridge-interp-"));
+    try {
+      writeFileSync(
+        join(dir, "main.tf"),
+        `variable "suffix" {\n  type = string\n}\n\n` +
+          `resource "kubernetes_manifest" "app_config" {\n` +
+          `  manifest = {\n` +
+          `    apiVersion = "v1"\n` +
+          `    kind       = "ConfigMap"\n` +
+          `    metadata = {\n` +
+          `      name = "app-\${var.suffix}"\n` +
+          `    }\n` +
+          `  }\n` +
+          `}\n`,
+      );
+      writeFileSync(
+        join(dir, "outputs.tf"),
+        `output "name" {\n  value = kubernetes_manifest.app_config.object.metadata.name\n}\n`,
+      );
+      const out = join(dir, "carveout");
+      const res = await carveBridge({ from: dir, select: "kubernetes_manifest.app_config", output: out });
+      expect(res.ok).toBe(true);
+      // `metadata.name` is required on the data source; guessing it would be
+      // worse than saying so.
+      expect(res.plan!.dataSources[0].hcl).toContain("# TODO: identify the resource");
+      expect(res.plan!.dataSources[0].hcl).not.toContain("api_version");
+      // The reference is still repointed, so the survivor plan is one edit away.
+      expect(readFileSync(join(out, "outputs.tf"), "utf-8")).toContain(
+        "value = data.kubernetes_resource.app_config.object.metadata.name",
+      );
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
   });
+});
 
+describe("carveBridge — formatting", () => {
   test("formatCarveBridge summarizes data sources, rewires, and safety", async () => {
     if (!parserAvailable) return;
     await withEstate(async (dir) => {

package/src/cli/commands/carve-bridge.ts

@@ -14,8 +14,8 @@ import { join, basename, relative, resolve } from "path";
 import { cdkNotSupported, isCloudAssembly } from "../../cdk/assembly";
 import { parseTerraformDir, Hcl2JsonNotInstalled } from "../../terraform/parse";
 import { boundaryReport, type CarveReport } from "../../terraform/carve";
-import { generateBridge, type BridgePlan, type CarvedIdentity } from "../../terraform/bridge";
-import { identityAttrOf, canBridge } from "../../terraform/tier-map";
+import { generateBridge, type BridgePlan, type CarvedDataSource } from "../../terraform/bridge";
+import { identityAttrOf, canBridge, dataSourceShapeOf } from "../../terraform/tier-map";
 import { resolveCarveManifest, writeCarveManifest, type CarveManifest } from "../../terraform/manifest";
 import { newFileDiff, unifiedDiff } from "../../terraform/unified-diff";
 
@@ -76,13 +76,13 @@ export async function carveBridge(opts: CarveBridgeOptions): Promise<CarveBridge
     if (!found) return { ok: false, error: `${select} not found in ${opts.from}` };
     report = found;
 
-    // Refuse a carve set whose data source cannot be written as valid HCL: a
-    // dotted identity attribute is a path into nested blocks, and a data body
-    // is flat `attr = value`. `kubernetes_manifest` is the standing case — the
-    // provider has no `kubernetes_manifest` data source either; its generic
-    // read is `kubernetes_resource`, a different shape. Emit adopting the type
-    // (#999) does not lift this: reading a manifest out of state and reading it
-    // back through a data source are separate problems (#2034).
+    // Refuse a carve set no provider says how to read back. A dotted identity
+    // attribute is a path into nested values and a data body is flat
+    // `attr = value`, so such a type bridges only once its provider declares a
+    // data-source shape — the data type, its arguments and where each comes
+    // from in the carved body (#2034). `kubernetes_manifest` declares one now:
+    // `data "kubernetes_resource"`, built from the manifest's apiVersion,
+    // kind and metadata.
     const carvedTypes = report.carveSet.map((m) => m.type).filter((t): t is string => t !== undefined);
     const unbridgeable = [...new Set(carvedTypes.filter((t) => !canBridge(t)))];
     if (unbridgeable.length) {
@@ -91,21 +91,25 @@ export async function carveBridge(opts: CarveBridgeOptions): Promise<CarveBridge
         error:
           `${select} cannot be bridged: ${unbridgeable
             .map((t) => `${t} identifies itself by \`${identityAttrOf(t)}\``)
-            .join(", ")}, a path into nested blocks that a Terraform data source body cannot express. ` +
-          `Bridging these types needs a data-source mapping — see chant issue #2034.`,
+            .join(", ")}, a path into nested values that a flat Terraform data source body cannot express, ` +
+          `and no carve provider declares a data-source shape for it. A provider contributes one through ` +
+          `\`dataSourceShapes\` (see \`kubernetes_manifest\` reading back as \`data "kubernetes_resource"\`, chant issue #2034).`,
       };
     }
 
-    // Physical identities for the carved resources, for the data sources.
-    const identities = new Map<string, CarvedIdentity>();
+    // How each carved resource is read back, and the literals to render the
+    // data-source body from. The shape comes from the provider, the values from
+    // the parsed block (`dataSourceValues`, a superset of the old identity).
+    const readBacks = new Map<string, CarvedDataSource>();
     for (const node of graph.nodes) {
-      if (node.type && node.identity) {
-        identities.set(node.address, { attr: identityAttrOf(node.type), value: node.identity });
-      }
+      if (!node.type) continue;
+      const shape = dataSourceShapeOf(node.type);
+      if (!shape) continue;
+      readBacks.set(node.address, { shape, values: node.dataSourceValues ?? {} });
     }
 
     const files = listTfFiles(opts.from).map((path) => ({ path, content: readFileSync(path, "utf-8") }));
-    plan = generateBridge(report, files, identities);
+    plan = generateBridge(report, files, readBacks);
   } catch (err) {
     if (err instanceof Hcl2JsonNotInstalled) return { ok: false, error: err.message };
     return { ok: false, error: `Failed to build the bridge: ${err instanceof Error ? err.message : String(err)}` };

package/src/cli/commands/carve-emit-k8s.test.ts

@@ -239,24 +239,31 @@ describe("carve emit — kubernetes_manifest (#999)", () => {
     });
   });
 
-  test("bridge still refuses the carved manifest, so emit writes no half-bridged estate", async () => {
+  test("emit then bridge compose on the same manifest (#2034)", async () => {
     if (!parserAvailable) return;
     await withEstate(async (dir) => {
       const out = join(dir, "carveout");
       const emitted = await carveEmit(
-        { from: dir, select: "kubernetes_manifest.app_config", statePath: join(dir, "terraform.tfstate"), output: out },
+        { from: dir, select: "kubernetes_manifest.web_cert", statePath: join(dir, "terraform.tfstate"), output: out },
         { plugins: [], liveImport: fakeImport() },
       );
       expect(emitted.ok).toBe(true);
 
-      // Emit does not unlock bridge: `manifest.metadata.name` is a path into
-      // nested blocks and a data-source body is flat `attr = value`, so the
-      // survivors' references cannot be repointed yet.
-      const bridged = await carveBridge({ from: dir, select: "kubernetes_manifest.app_config", output: out });
-      expect(bridged.ok).toBe(false);
-      expect(bridged.error).toContain("cannot be bridged");
-      expect(bridged.error).toContain("manifest.metadata.name");
-      expect(existsSync(join(out, "kubernetes_manifest-app_config-runbook.md"))).toBe(false);
+      // Bridge used to refuse here: `manifest.metadata.name` is a path into the
+      // body, and a data-source body is flat `attr = value`. It now reads the
+      // manifest back through the shape the kubernetes provider declares, so
+      // the target the emit manifest recorded bridges without --select.
+      const bridged = await carveBridge({ from: dir, output: out });
+      expect(bridged.ok).toBe(true);
+      expect(bridged.plan!.target).toBe("kubernetes_manifest.web_cert");
+      expect(existsSync(join(out, "kubernetes_manifest-web_cert-runbook.md"))).toBe(true);
+
+      // Nothing reads the Certificate, so there is no data source to write —
+      // but its own block still has to leave the survivor source, or the next
+      // apply re-creates what `terraform state rm` released.
+      expect(bridged.plan!.dataSources).toEqual([]);
+      expect(bridged.plan!.excised).toEqual(["kubernetes_manifest.web_cert"]);
+      expect(readFileSync(join(out, "main.tf"), "utf-8")).not.toContain('resource "kubernetes_manifest" "web_cert"');
     });
   });
 });