infraweaver 0.3.7 → 0.3.8

package/src/mcp/terraform/refactor/expressions.ts

@@ -0,0 +1,323 @@
+/**
+ * A Terraform expression read into its SHAPE, for the refactor proof's value
+ * comparison ([[substitution]]).
+ *
+ * Not an evaluator and not a full HCL grammar. It recognises the forms whose
+ * value can be followed without running anything — literals, quoted templates,
+ * tuples, objects, traversals (`var.x`, `aws_s3_bucket.b.arn`, `data.t.n.json`)
+ * and a top-level conditional — and keeps everything else (function calls,
+ * operators, `for` expressions) as `raw`: the code text, with the traversals
+ * and strings inside it lifted out so they can still be resolved. A raw
+ * expression is only ever compared as "the same code over the same values",
+ * which can say equal, never different.
+ *
+ * Pure.
+ */
+
+import { skipNonCode } from "#app/mcp/terraform/hcl";
+
+export type Step = { attr: string } | { index: Expr };
+
+export type Expr =
+  | { kind: "literal"; value: string | number | boolean | null }
+  /** a quoted string; `parts` alternate text and `${…}` interpolations. */
+  | { kind: "template"; parts: (string | Expr)[] }
+  | { kind: "tuple"; items: Expr[] }
+  | { kind: "object"; entries: { key: string; value: Expr }[] }
+  /** `root.step.step[index]…` — `root` is `var`, `local`, a resource type, … */
+  | { kind: "traversal"; root: string; steps: Step[]; text: string }
+  | { kind: "conditional"; cond: Expr; whenTrue: Expr; whenFalse: Expr }
+  /** anything else: code text interleaved with the expressions found inside it. */
+  | { kind: "raw"; parts: (string | Expr)[] }
+  /** text whose inside cannot be read safely — a heredoc, a template directive. */
+  | { kind: "opaque"; text: string };
+
+const IDENT = /[A-Za-z_][A-Za-z0-9_-]*/y;
+const NUMBER = /^-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?$/;
+
+/** the last index of a string, comment or heredoc starting at `i`, or -1.
+ *  Strings are read here rather than by [[skipNonCode]], which stops at the
+ *  first inner quote of `"${lookup(m, "k")}"`. */
+function skipSpan(s: string, i: number): number {
+  if (s[i] === '"') return stringEnd(s, i) - 1;
+  return skipNonCode(s, i)?.end ?? -1;
+}
+
+/** the index of the bracket closing the one at `open`, string/comment aware. */
+function closingBracket(s: string, open: number): number {
+  let depth = 0;
+  for (let i = open; i < s.length; i++) {
+    const end = skipSpan(s, i);
+    if (end !== -1) {
+      i = end;
+      continue;
+    }
+    const ch = s[i];
+    if (ch === "{" || ch === "[" || ch === "(") depth++;
+    else if (ch === "}" || ch === "]" || ch === ")") {
+      depth--;
+      if (depth === 0) return i;
+    }
+  }
+  return -1;
+}
+
+/** the end (exclusive) of the string literal opening at `open`, `${…}`-aware. */
+function stringEnd(s: string, open: number): number {
+  for (let i = open + 1; i < s.length; i++) {
+    const ch = s[i];
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (ch === '"') return i + 1;
+    if ((ch === "$" || ch === "%") && s[i + 1] === "{") {
+      const close = closingBracket(s, i + 1);
+      if (close === -1) return s.length;
+      i = close;
+    }
+  }
+  return s.length;
+}
+
+function parseTemplate(text: string): Expr {
+  const parts: (string | Expr)[] = [];
+  let buf = "";
+  for (let i = 1; i < text.length - 1; i++) {
+    const ch = text[i] as string;
+    if (ch === "\\") {
+      buf += text.slice(i, i + 2);
+      i++;
+      continue;
+    }
+    if ((ch === "$" || ch === "%") && text[i + 1] === "{") {
+      // `$${` / `%%{` are escapes for the literal text
+      if (text[i - 1] === ch && buf.endsWith(ch)) {
+        buf += "{";
+        i++;
+        continue;
+      }
+      if (ch === "%") return { kind: "opaque", text };
+      const close = closingBracket(text, i + 1);
+      if (close === -1) return { kind: "opaque", text };
+      if (buf) parts.push(buf);
+      buf = "";
+      // `${~ x ~}` strip markers do not change the interpolated value
+      parts.push(parseExpression(text.slice(i + 2, close).replace(/^~|~$/g, "")));
+      i = close;
+      continue;
+    }
+    buf += ch;
+  }
+  if (buf) parts.push(buf);
+  if (parts.every((p) => typeof p === "string")) {
+    return { kind: "literal", value: parts.join("") };
+  }
+  return { kind: "template", parts };
+}
+
+/** split `s` at depth-0 occurrences of any char in `seps`. */
+function splitTopLevel(s: string, seps: string): string[] {
+  const out: string[] = [];
+  let depth = 0;
+  let from = 0;
+  for (let i = 0; i < s.length; i++) {
+    const end = skipSpan(s, i);
+    if (end !== -1) {
+      // a line comment swallows its newline, which separates entries
+      const comment = s[i] === "#" || (s[i] === "/" && s[i + 1] === "/");
+      if (comment && depth === 0 && seps.includes("\n")) {
+        out.push(s.slice(from, i));
+        from = end + 1;
+      }
+      i = end;
+      continue;
+    }
+    const ch = s[i] as string;
+    if (ch === "{" || ch === "[" || ch === "(") depth++;
+    else if (ch === "}" || ch === "]" || ch === ")") depth--;
+    else if (depth === 0 && seps.includes(ch)) {
+      out.push(s.slice(from, i));
+      from = i + 1;
+    }
+  }
+  out.push(s.slice(from));
+  return out.map((p) => p.trim()).filter((p) => p !== "");
+}
+
+function parseObject(inner: string): Expr {
+  const entries: { key: string; value: Expr }[] = [];
+  for (const item of splitTopLevel(inner, "\n,")) {
+    const m =
+      /^("(?:[^"\\]|\\.)*"|[A-Za-z_][A-Za-z0-9_-]*|\([^)]*\))\s*(?:=|:)(?!=)\s*([\s\S]*)$/.exec(
+        item,
+      );
+    if (!m) return { kind: "raw", parts: [`{${inner}}`] };
+    const rawKey = m[1] as string;
+    const key = rawKey.startsWith('"') ? rawKey.slice(1, -1) : rawKey;
+    // a computed key `(var.x)` names a value, not a field: keep the object raw.
+    // So does a quoted key that is a template (`"${local.env}-owner"`): the same
+    // text resolves to a different key on each side of a module boundary, and
+    // comparing it as a literal called a changed key unchanged. `$${` is an
+    // escaped, literal `${`.
+    if (rawKey.startsWith("(") || /(?:^|[^$])\$\{|(?:^|[^%])%\{/.test(key)) {
+      return rawExpression(`{${inner}}`);
+    }
+    entries.push({ key, value: parseExpression(m[2] as string) });
+  }
+  return { kind: "object", entries };
+}
+
+/** read a traversal starting at `i`: `root(.attr|[index])*`. */
+function readTraversal(
+  s: string,
+  i: number,
+): { expr: Expr & { kind: "traversal" }; end: number } | null {
+  IDENT.lastIndex = i;
+  const head = IDENT.exec(s);
+  if (!head) return null;
+  let j = i + head[0].length;
+  const steps: Step[] = [];
+  for (;;) {
+    if (s[j] === "." && s[j + 1] === "*") return null; // splat: leave it to `raw`
+    if (s[j] === ".") {
+      IDENT.lastIndex = j + 1;
+      const attr = IDENT.exec(s);
+      const num = /^\d+/.exec(s.slice(j + 1));
+      if (attr) {
+        steps.push({ attr: attr[0] });
+        j += 1 + attr[0].length;
+        continue;
+      }
+      if (num) {
+        steps.push({ index: { kind: "literal", value: Number(num[0]) } });
+        j += 1 + num[0].length;
+        continue;
+      }
+      break;
+    }
+    if (s[j] === "[") {
+      const close = closingBracket(s, j);
+      if (close === -1) return null;
+      const inner = s.slice(j + 1, close).trim();
+      if (inner === "*") return null;
+      steps.push({ index: parseExpression(inner) });
+      j = close + 1;
+      continue;
+    }
+    break;
+  }
+  return { expr: { kind: "traversal", root: head[0], steps, text: s.slice(i, j) }, end: j };
+}
+
+const KEYWORDS = new Set(["for", "in", "if", "true", "false", "null"]);
+
+/** code text with the traversals and strings inside it lifted out. */
+function rawExpression(s: string): Expr {
+  const parts: (string | Expr)[] = [];
+  let buf = "";
+  const flush = () => {
+    if (buf) parts.push(buf);
+    buf = "";
+  };
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i] as string;
+    if (ch === '"') {
+      const end = stringEnd(s, i);
+      flush();
+      parts.push(parseTemplate(s.slice(i, end)));
+      i = end - 1;
+      continue;
+    }
+    const span = skipNonCode(s, i);
+    if (span) {
+      if (ch === "<") {
+        flush();
+        parts.push({ kind: "opaque", text: s.slice(i, span.end + 1) });
+      }
+      i = span.end;
+      continue;
+    }
+    const prev = s[i - 1] ?? "";
+    if (/[A-Za-z_]/.test(ch) && !/[A-Za-z0-9_.-]/.test(prev)) {
+      const t = readTraversal(s, i);
+      if (t) {
+        const next = s.slice(t.end).trimStart()[0];
+        // a function name, an object key or a keyword is code text, not a value
+        const isCode =
+          (t.expr.steps.length === 0 && (next === "(" || KEYWORDS.has(t.expr.root))) ||
+          (next === "=" && s[s.indexOf("=", t.end) + 1] !== "=");
+        if (!isCode) {
+          flush();
+          parts.push(t.expr);
+          i = t.end - 1;
+          continue;
+        }
+        buf += t.expr.text;
+        i = t.end - 1;
+        continue;
+      }
+    }
+    buf += ch;
+  }
+  flush();
+  return { kind: "raw", parts };
+}
+
+/** the depth-0 `?` and its matching `:` of a conditional, or null. */
+function conditionalSplit(s: string): { q: number; c: number } | null {
+  let depth = 0;
+  let q = -1;
+  let pending = 0;
+  for (let i = 0; i < s.length; i++) {
+    const end = skipSpan(s, i);
+    if (end !== -1) {
+      i = end;
+      continue;
+    }
+    const ch = s[i];
+    if (ch === "{" || ch === "[" || ch === "(") depth++;
+    else if (ch === "}" || ch === "]" || ch === ")") depth--;
+    else if (depth === 0 && ch === "?") {
+      if (q === -1) q = i;
+      else pending++;
+    } else if (depth === 0 && ch === ":" && q !== -1) {
+      if (pending === 0) return { q, c: i };
+      pending--;
+    }
+  }
+  return null;
+}
+
+/** read one expression's text into its shape. */
+export function parseExpression(text: string): Expr {
+  const s = text.trim();
+  if (s === "") return { kind: "raw", parts: [] };
+  const cond = conditionalSplit(s);
+  if (cond) {
+    return {
+      kind: "conditional",
+      cond: parseExpression(s.slice(0, cond.q)),
+      whenTrue: parseExpression(s.slice(cond.q + 1, cond.c)),
+      whenFalse: parseExpression(s.slice(cond.c + 1)),
+    };
+  }
+  if (s === "true" || s === "false") return { kind: "literal", value: s === "true" };
+  if (s === "null") return { kind: "literal", value: null };
+  if (NUMBER.test(s)) return { kind: "literal", value: Number(s) };
+  if (s.startsWith('"') && stringEnd(s, 0) === s.length) return parseTemplate(s);
+  if ((s[0] === "[" || s[0] === "{" || s[0] === "(") && closingBracket(s, 0) === s.length - 1) {
+    const inner = s.slice(1, -1);
+    if (s[0] === "(") return parseExpression(inner);
+    // `[for …]` / `{for …}` build a value by iteration: code, not a literal
+    if (/^\s*for\s/.test(inner)) return rawExpression(s);
+    return s[0] === "["
+      ? { kind: "tuple", items: splitTopLevel(inner, ",").map(parseExpression) }
+      : parseObject(inner);
+  }
+  if (/^[A-Za-z_]/.test(s)) {
+    const t = readTraversal(s, 0);
+    if (t && t.end === s.length && !KEYWORDS.has(t.expr.root)) return t.expr;
+  }
+  return rawExpression(s);
+}

package/src/mcp/terraform/refactor/references.ts

@@ -0,0 +1,101 @@
+/**
+ * References a refactor left pointing at an address it relocated.
+ *
+ * The equivalence proof compares the relocated resources themselves — the
+ * resource set, their arguments, their `moved {}` coverage — and not who points
+ * at them. A policy or output that read `aws_s3_bucket.data.arn` before the
+ * bucket moved into `module.data` must now read one of the module's outputs;
+ * left as it was, it names a resource that no longer exists. `terraform
+ * validate` reports that, but only after an `init` that installed every module:
+ * when init fails, validate's "Module not installed" is all it says, and that is
+ * dropped as noise. This check reads the tree and needs neither.
+ */
+import { posix } from "node:path";
+import { lineOf, skipNonCode } from "#app/mcp/terraform/hcl";
+import type { MovedBlock } from "#app/mcp/terraform/refactor/movedBlocks";
+import type { SourceFile } from "#app/mcp/terraform/tree";
+
+export interface StaleReference {
+  file: string;
+  line: number;
+  /** the relocated address the reference still names, without instance key. */
+  address: string;
+}
+
+/** `hcl` with comments and `moved {}` blocks blanked — newlines kept, so line
+ *  numbers hold. Strings and heredocs stay: an interpolation is a reference. */
+function referenceText(hcl: string): string {
+  const out = hcl.split("");
+  for (let i = 0; i < hcl.length; i++) {
+    const ch = hcl[i];
+    const comment = ch === "#" || (ch === "/" && (hcl[i + 1] === "/" || hcl[i + 1] === "*"));
+    const span = ch === '"' || ch === "<" || comment ? skipNonCode(hcl, i) : null;
+    if (!span) continue;
+    if (comment) for (let j = i; j <= span.end; j++) if (out[j] !== "\n") out[j] = " ";
+    i = span.end;
+  }
+  // a moved block names the old address by design
+  return out.join("").replace(/\bmoved\s*\{[^}]*\}/g, (block) => block.replace(/[^\n]/g, " "));
+}
+
+/** The root-level address a relocation moved away from: `aws_s3_bucket.data`
+ *  for a resource (instance key dropped), `module.app` for a renamed call.
+ *  null for an address inside a module — that module's own code refers to it
+ *  by its local name, which the relocation does not change. */
+function relocatedFrom(from: string): string | null {
+  const base = from.replace(/\[[^\]]*\]/g, "");
+  if (/^module\.[^.]+$/.test(base)) return base;
+  if (base.startsWith("module.") || base.startsWith("data.")) return null;
+  return /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(base) ? base : null;
+}
+
+/** Whether `address` is still declared in `files` (the relocation was not one). */
+function declared(files: readonly SourceFile[], address: string): boolean {
+  const [kind, name] = address.startsWith("module.")
+    ? ["module", address.slice("module.".length)]
+    : [`resource\\s+"${address.split(".")[0]}"`, address.split(".")[1]];
+  const re = new RegExp(`(?:^|\\n)\\s*${kind}\\s+"${name}"\\s*\\{`);
+  return files.some((f) => re.test(f.hcl));
+}
+
+/**
+ * Every place in a relocation's root that still names the address it moved
+ * away from. Each reference found is a defect the proof must refuse.
+ */
+export function staleReferences(
+  after: readonly SourceFile[],
+  relocations: readonly MovedBlock[],
+): StaleReference[] {
+  const out: StaleReference[] = [];
+  const seen = new Set<string>();
+  for (const move of relocations) {
+    const address = relocatedFrom(move.from);
+    if (!address) continue;
+    const dir = !move.root || move.root === "." ? "" : move.root;
+    const files = after.filter(
+      (f) => (posix.dirname(f.path) === "." ? "" : posix.dirname(f.path)) === dir,
+    );
+    if (declared(files, address)) continue;
+    const pattern = new RegExp(`(?<![\\w.-])${address.replace(/\./g, "\\.")}(?![\\w-])`, "g");
+    for (const file of files) {
+      const text = referenceText(file.hcl);
+      for (const m of text.matchAll(pattern)) {
+        const key = `${file.path}:${m.index}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        out.push({ file: file.path, line: lineOf(text, m.index), address });
+      }
+    }
+  }
+  return out.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+}
+
+/** The proof's reason for a set of stale references; null when there are none. */
+export function staleReferenceReason(stale: readonly StaleReference[]): string | null {
+  if (stale.length === 0) return null;
+  const sites = stale.map((s) => `${s.file}:${s.line} (${s.address})`).join(", ");
+  return (
+    `${stale.length} reference(s) still name a relocated address: ${sites}. ` +
+    "The resource now lives in a module — reach it through one of the module's outputs."
+  );
+}

package/src/mcp/terraform/refactor/resources.ts

@@ -19,10 +19,13 @@
  */
 
 import {
+  MODULE_HEADER,
   matchBraceBody,
+  RESOURCE_HEADER,
   stripTrailingComment,
   topLevelAssignments,
   topLevelEntries,
+  unquoteLabel,
 } from "#app/mcp/terraform/hcl";
 
 export interface ResourceRef {
@@ -47,6 +50,68 @@ export interface ResourceRef {
    * single instance. See [[Multiplicity]] — this is deliberately NOT folded into
    * `argNames`, because a correct extraction MOVES it onto the module call. */
   multiplicity: Multiplicity[];
+  /** the provider configuration that manages the resource, as the ROOT names it
+   *  (`aws`, `aws.replica`): the resource's own `provider` meta-argument, or the
+   *  default for its type, resolved through every module call's `providers`
+   *  map. Absent on a hand-built ref, which is not compared. See
+   *  [[moduleCallProviders]]. */
+  provider?: string;
+}
+
+// --- provider configuration (G16) -------------------------------------------
+
+/**
+ * Which provider configuration a resource is managed through is not an
+ * argument, and a refactor can change it without touching one. A resource
+ * pinned to `provider = aws.replica` (another region) moved into a module whose
+ * call passes no `providers` map is managed by the module's DEFAULT `aws` after
+ * the move: same arguments, same moves, same configuration — and a different
+ * region. Validate accepts it, and a plan without refresh shows a no-op.
+ *
+ * So, like multiplicity, the invariant is the EFFECTIVE value: the root's name
+ * for the configuration, resolved through each module call on the way down.
+ */
+function parseProvider(body: string): string | null {
+  const found = topLevelAssignments(body).find((a) => a.name === "provider");
+  return found ? stripTrailingComment(found.value).trim() : null;
+}
+
+/** `module "<name>" { … }` call name → its `providers` map (the module's name
+ *  for a configuration → the caller's), or null when the call passes none and
+ *  the module inherits the caller's default configurations. */
+export function moduleCallProviders(hcl: string): Map<string, Map<string, string> | null> {
+  const out = new Map<string, Map<string, string> | null>();
+  const re = new RegExp(MODULE_HEADER, "g");
+  let m: RegExpExecArray | null;
+  // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex-exec iteration
+  while ((m = re.exec(hcl)) !== null) {
+    const name = m[1] === undefined ? undefined : unquoteLabel(m[1]);
+    if (name === undefined) continue;
+    const braceStart = hcl.indexOf("{", m.index);
+    if (braceStart === -1) break;
+    const body = matchBraceBody(hcl, braceStart);
+    if (!body) break;
+    re.lastIndex = body.end + 1;
+    // the whole value: a `providers` map usually spans lines, and
+    // `topLevelAssignments` keeps only the first
+    const providers = topLevelEntries(body.text).find(
+      (e) => e.kind === "attr" && e.name === "providers",
+    );
+    if (!providers?.value) {
+      out.set(name, null);
+      continue;
+    }
+    const map = new Map<string, string>();
+    for (const e of providers.value
+      .replace(/(?:#|\/\/)[^\n]*/g, "")
+      .matchAll(
+        /([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)?)\s*=\s*([A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)?)/g,
+      )) {
+      if (e[1] && e[2]) map.set(e[1], e[2]);
+    }
+    out.set(name, map);
+  }
+  return out;
 }
 
 // --- instance multiplicity (G4) ----------------------------------------------
@@ -115,11 +180,11 @@ export function parseMultiplicity(body: string): Multiplicity | null {
  *  `for_each`, so this is half of the effective-multiplicity calculation. */
 export function moduleCallMultiplicity(hcl: string): Map<string, Multiplicity | null> {
   const out = new Map<string, Multiplicity | null>();
-  const re = /(?:^|\n)\s*module\s+"([^"]+)"\s*\{/g;
+  const re = new RegExp(MODULE_HEADER, "g");
   let m: RegExpExecArray | null;
   // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex-exec iteration
   while ((m = re.exec(hcl)) !== null) {
-    const name = m[1];
+    const name = m[1] === undefined ? undefined : unquoteLabel(m[1]);
     if (name === undefined) continue;
     const braceStart = hcl.indexOf("{", m.index);
     if (braceStart === -1) break;
@@ -389,20 +454,26 @@ function topLevelArgNames(body: string): string[] {
  * brace matching here is string/comment/heredoc-aware, which is the whole
  * difference between reading a `}` in a comment as a block end and not.
  */
-export function parseResourcesWithArgs(
-  hcl: string,
-): { type: string; name: string; argNames: string[]; multiplicity: Multiplicity | null }[] {
+export function parseResourcesWithArgs(hcl: string): {
+  type: string;
+  name: string;
+  argNames: string[];
+  multiplicity: Multiplicity | null;
+  provider: string | null;
+}[] {
   const out: {
     type: string;
     name: string;
     argNames: string[];
     multiplicity: Multiplicity | null;
+    provider: string | null;
   }[] = [];
-  const re = /(?:^|\n)\s*resource\s+"([^"]+)"\s+"([^"]+)"\s*\{/g;
+  const re = new RegExp(RESOURCE_HEADER, "g");
   let m: RegExpExecArray | null;
   // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex-exec iteration
   while ((m = re.exec(hcl)) !== null) {
-    const [, resourceType = "", name = ""] = m;
+    const resourceType = unquoteLabel(m[1] ?? "");
+    const name = unquoteLabel(m[2] ?? "");
     const braceStart = hcl.indexOf("{", m.index);
     if (braceStart === -1) break;
     const body = matchBraceBody(hcl, braceStart);
@@ -413,6 +484,7 @@ export function parseResourcesWithArgs(
       name,
       argNames: topLevelArgNames(body.text),
       multiplicity: parseMultiplicity(body.text),
+      provider: parseProvider(body.text),
     });
   }
   return out;