@intentius/chant 0.52.0 → 0.52.2

package/src/cli/handlers/misc.ts

@@ -5,6 +5,9 @@ import { loadChantConfig } from "../../config";
 import { resolve } from "path";
 import { auditCommand, printAuditResult, type AuditFormat, type AuditTier, type AuditFailOn } from "../commands/audit";
 import type { ReportTheme } from "../../audit/report-html";
+import { AGENT_RUNTIMES, AGENT_SCOPES, type AgentRuntime, type AgentScope } from "../../agents/types";
+import { registeredProjectRoots } from "../../agents/discover";
+import { homedir } from "os";
 import type { ResourceSelector } from "../../lexicon";
 import { formatError, formatSuccess, formatWarning, formatBold } from "../format";
 import type { CommandContext } from "../registry";
@@ -23,6 +26,44 @@ const AUDIT_FORMATS: AuditFormat[] = ["stylish", "json", "sarif", "markdown", "h
 const AUDIT_TIERS: AuditTier[] = ["merge-worthy", "all"];
 const AUDIT_FAIL_ON: AuditFailOn[] = ["merge-worthy", "warning", "none"];
 
+/**
+ * Parse `--scope system,user,project`. Returns `undefined` (meaning "all") when
+ * the flag is absent, or an Error the caller reports — an unrecognized scope is
+ * rejected rather than ignored, since silently scanning more than the user
+ * asked for is exactly the surprise this command exists to prevent.
+ */
+function parseScopes(raw: string | undefined): readonly AgentScope[] | undefined | Error {
+  if (!raw) return undefined;
+  const parts = raw.split(",").map((s) => s.trim()).filter(Boolean);
+  const bad = parts.filter((p) => !AGENT_SCOPES.includes(p as AgentScope));
+  if (bad.length > 0) return new Error(`Invalid --scope: ${bad.join(", ")}. Expected one or more of ${AGENT_SCOPES.join(", ")}.`);
+  return parts.length > 0 ? (parts as AgentScope[]) : undefined;
+}
+
+/** Parse `--runtime claude,codex,...`. Same contract as {@link parseScopes}. */
+function parseRuntimes(raw: string | undefined): readonly AgentRuntime[] | undefined | Error {
+  if (!raw) return undefined;
+  const parts = raw.split(",").map((s) => s.trim()).filter(Boolean);
+  const bad = parts.filter((p) => !AGENT_RUNTIMES.includes(p as AgentRuntime));
+  if (bad.length > 0) return new Error(`Invalid --runtime: ${bad.join(", ")}. Expected one or more of ${AGENT_RUNTIMES.join(", ")}.`);
+  return parts.length > 0 ? (parts as AgentRuntime[]) : undefined;
+}
+
+/**
+ * Project roots for an `--agents` run.
+ *
+ * Default: the path argument alone. With `--all-projects`, every project root
+ * the harness has registered, *unioned* with the path argument rather than
+ * replacing it — a flag that silently discarded an argument the user typed
+ * would be the wrong kind of surprise, and a cwd that isn't registered yet is
+ * still a project the user is plainly interested in.
+ */
+function resolveProjectRoots(args: { path: string; allProjects?: boolean }): string[] {
+  const named = resolve(args.path);
+  if (!args.allProjects) return [named];
+  return [...new Set([...registeredProjectRoots(homedir()), named])].sort();
+}
+
 export async function runAudit(ctx: CommandContext): Promise<number> {
   const { args } = ctx;
 
@@ -42,6 +83,37 @@ export async function runAudit(ctx: CommandContext): Promise<number> {
     return 1;
   }
 
+  // `--agents` switches the subject from a repo to this machine's agent
+  // configuration. Same formats, tiers, and fail-on policy — a different thing
+  // being audited, not a different report.
+  if (args.agents) {
+    const scopes = parseScopes(args.scope);
+    if (scopes instanceof Error) {
+      console.error(formatError({ message: scopes.message }));
+      return 1;
+    }
+    const runtimes = parseRuntimes(args.runtime);
+    if (runtimes instanceof Error) {
+      console.error(formatError({ message: runtimes.message }));
+      return 1;
+    }
+    const { auditAgentsCommand } = await import("../commands/audit-agents");
+    const result = auditAgentsCommand({
+      format,
+      tier,
+      failOn,
+      scopes,
+      runtimes,
+      projectRoots: resolveProjectRoots(args),
+      output: args.output,
+      toolVersion: CHANT_VERSION,
+    });
+    if (result.error) console.error(formatError({ message: result.error }));
+    else if (result.wroteTo) console.log(formatSuccess(`Report written to ${result.wroteTo}`));
+    else console.log(result.output);
+    return result.exitCode;
+  }
+
   // HTML report customization: --template <file> (full override) + --theme <file> (JSON knobs).
   let template: string | undefined;
   let theme: ReportTheme | undefined;
@@ -171,6 +243,45 @@ export async function runDescribe(ctx: CommandContext): Promise<number> {
 export async function runImport(ctx: CommandContext): Promise<number> {
   const { args } = ctx;
 
+  // `--agents` (#chant audit --agents' other half): the source is this
+  // machine's agent configuration rather than a template file, so there is
+  // nothing to detect — the flag names the subject, like `--kustomize` below
+  // names the lexicon.
+  if (args.agents) {
+    const scopes = parseScopes(args.scope);
+    if (scopes instanceof Error) {
+      console.error(formatError({ message: scopes.message }));
+      return 1;
+    }
+    const runtimes = parseRuntimes(args.runtime);
+    if (runtimes instanceof Error) {
+      console.error(formatError({ message: runtimes.message }));
+      return 1;
+    }
+    const { importAgentsCommand } = await import("../commands/import-agents");
+    const result = await importAgentsCommand({
+      lexicon: args.lexicon,
+      output: args.output,
+      force: args.force,
+      scopes,
+      runtimes,
+      projectRoots: resolveProjectRoots(args),
+    });
+    for (const warning of result.warnings) console.warn(formatWarning({ message: warning }));
+    if (!result.success) {
+      console.error(formatError({ message: result.error ?? "Import failed." }));
+      return 1;
+    }
+    console.log(
+      formatSuccess(
+        `Re-expressed ${result.summary.mapped} resource${result.summary.mapped === 1 ? "" : "s"} ` +
+          `from ${result.summary.discovered} agent config${result.summary.discovered === 1 ? "" : "s"}:`,
+      ),
+    );
+    for (const file of result.generatedFiles) console.log(`  ${file}`);
+    return 0;
+  }
+
   // `--kustomize <dir>` (#1548): render the overlay and import the output
   // through the k8s template parser — the flag NAMES the lexicon, so no JSON
   // detection. `kustomize build`, falling back to kubectl's vendored

package/src/cli/main.ts

@@ -48,6 +48,8 @@ import type { LexiconPlugin } from "../lexicon";
  */
 const BOOLEAN_FLAGS = new Set([
   "--help",
+  "--agents",
+  "--all-projects",
   "--force",
   "--fix",
   "--watch",
@@ -254,6 +256,14 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.env = args[++i];
     } else if (arg === "--tier") {
       result.tier = args[++i];
+    } else if (arg === "--agents") {
+      result.agents = true;
+    } else if (arg === "--scope") {
+      result.scope = args[++i];
+    } else if (arg === "--all-projects") {
+      result.allProjects = true;
+    } else if (arg === "--runtime") {
+      result.runtime = args[++i];
     } else if (arg === "--fail-on") {
       result.failOn = args[++i];
     } else if (arg === "--theme") {
@@ -438,10 +448,17 @@ Commands:
                         bundle tree, otherwise JSON path→content on stdout)
   vendor                Pull pinned, checksummed patterns into your repo
   import                Import external template into TypeScript
+                        (--agents re-expresses this machine's agent config as
+                         chant code instead of reading a template file)
   audit [path|url]      Audit a repo's CI YAML for security issues
                         (--format stylish|json|sarif|markdown|html, -o <file>,
                          --tier merge-worthy|all, --fail-on merge-worthy|warning|none,
                          --template <file> / --theme <file> for the html report)
+                        --agents audits this machine's agent configuration —
+                        instruction files, MCP servers, skills, plugins,
+                        permissions — instead of a repository
+                        (--scope system,user,project, --runtime claude,codex,...,
+                         --all-projects)
   migrate <file>        Translate a workflow between lexicons
                         (default: --from github --to gitlab)
   carve advise          Read-only Terraform peelability advisor: rank which

package/src/cli/registry.ts

@@ -158,6 +158,21 @@ export interface ParsedArgs {
   includeDependents?: boolean;
   /** `chant audit --tier merge-worthy|all` */
   tier?: string;
+  /**
+   * `chant audit --agents` / `chant import --agents` — switch the subject from
+   * a repo's pipeline YAML to the agent configuration installed on this
+   * machine (skills, MCP servers, instruction files, permissions).
+   */
+  agents?: boolean;
+  /** `--agents --scope system,user,project` — which scopes to scan (default all). */
+  scope?: string;
+  /** `--agents --runtime claude,codex,...` — which agent harnesses to scan (default all). */
+  runtime?: string;
+  /**
+   * `--agents --all-projects` — scan every project root the harness has
+   * registered in `~/.claude.json`, not just the path argument.
+   */
+  allProjects?: boolean;
   /** `chant audit --fail-on merge-worthy|warning|none` */
   failOn?: string;
   /** `chant audit --theme <file>` — JSON theme knobs for the HTML report */

package/src/discovery/fold-import.test.ts

@@ -2015,6 +2015,108 @@ describe("tryFoldFile — active lexicon package exports (#1063)", () => {
   });
 });
 
+describe("tryFoldFile — sandbox trust boundary, subpath import of an active lexicon package (chant #1995)", () => {
+  let testDir: string;
+  let seq = 0;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-fold-import-lexsubpath-test-${Date.now()}-${Math.random()}`);
+    await mkdir(testDir, { recursive: true });
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  /**
+   * Install a package into `<testDir>/node_modules/<name>` shaped like a real
+   * lexicon package: a barrel at "." AND a `./generated/index` subpath — the
+   * exact shape `examples/cc-azure-canonical/src/cc-cluster/cluster.ts`
+   * imports `AksCluster` through (`@intentius/chant-lexicon-azure/generated/index`).
+   * The subpath module exports a real resource CLASS with the same runtime
+   * shape `createResource` (chant-core's own factory) produces — plain,
+   * dependency-free JS using `Symbol.for("chant.declarable")` directly (same
+   * global-registry trick `../declarable.ts`'s own `DECLARABLE_MARKER` uses,
+   * and the same convention `installLexiconPackage`'s `LEXICON_SOURCE` above
+   * follows), rather than importing chant-core's runtime module: a real
+   * package's OWN `.js` file is loaded by a genuine `import()`, not run
+   * through this repo's TS loader, so a bare relative import of `runtime.ts`
+   * from inside it would need an extension Node's ESM resolver never gets —
+   * self-contained avoids that entirely and is just as faithful a stand-in.
+   */
+  async function installSubpathLexiconPackage(): Promise<{ lexicon: string; specifier: string }> {
+    const lexicon = `fold1995x${seq++}${Date.now().toString(36)}`;
+    const specifier = `@intentius/chant-lexicon-${lexicon}`;
+    const dir = join(testDir, "node_modules", specifier);
+    await mkdir(join(dir, "generated"), { recursive: true });
+    await writeFile(
+      join(dir, "package.json"),
+      JSON.stringify({
+        name: specifier,
+        version: "0.0.0",
+        type: "module",
+        exports: { ".": "./index.js", "./generated/index": "./generated/index.js" },
+      }),
+    );
+    await writeFile(join(dir, "index.js"), `export * from "./generated/index.js";`);
+    await writeFile(
+      join(dir, "generated", "index.js"),
+      `
+        const DECLARABLE_MARKER = Symbol.for("chant.declarable");
+        export function Widget(props) {
+          this[DECLARABLE_MARKER] = true;
+          this.lexicon = ${JSON.stringify(lexicon)};
+          this.entityType = "Test::Widget";
+          this.kind = "resource";
+          this.props = props ?? {};
+        }
+      `,
+    );
+    return { lexicon, specifier };
+  }
+
+  test("a subpath import of a declared-active lexicon package is trusted, and folds under --sandbox", async () => {
+    const { lexicon, specifier } = await installSubpathLexiconPackage();
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { Widget } from ${JSON.stringify(`${specifier}/generated/index`)};
+        export const widget = new Widget({ name: "test" });
+      `,
+    );
+
+    const sandboxed = await tryFoldFile(file, [], createFoldSession([], undefined, [lexicon], true));
+
+    expect(sandboxed.ok, !sandboxed.ok ? sandboxed.reason : "").toBe(true);
+    if (!sandboxed.ok) return;
+    const [, entity] = sandboxed.entities[0];
+    expect(isDeclarable(entity)).toBe(true);
+  });
+
+  test("a subpath import of a lexicon package NOT active for this build stays refused under --sandbox", async () => {
+    // chant #1995's own boundary — the fix must not widen trust beyond the
+    // build's declared-active set: an installed, importable package whose
+    // root the build never listed is still untrusted, subpath or not.
+    const { specifier } = await installSubpathLexiconPackage();
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { Widget } from ${JSON.stringify(`${specifier}/generated/index`)};
+        export const widget = new Widget({ name: "test" });
+      `,
+    );
+
+    const sandboxed = await tryFoldFile(file, [], createFoldSession([], undefined, ["aws"], true));
+
+    expect(sandboxed.ok).toBe(false);
+    if (sandboxed.ok) return;
+    expect(sandboxed.reason).toContain("--sandbox");
+    expect(sandboxed.reason).toContain(`constructor "Widget"`);
+  });
+});
+
 /**
  * chant #1169 — a `new Type(...)` used as a VALUE.
  *

package/src/discovery/fold-import.ts

@@ -1078,11 +1078,46 @@ function paramsModulePath(): string | null {
  *  - **Lexicons of THIS build only.** Not "any `@intentius/chant-lexicon-*`
  *    package on disk", and emphatically not "any bare specifier". A lexicon
  *    the build did not load is as out of scope as `node:fs`.
+ *
+ * chant #1995 — the "no subpaths" restriction above stays as documented for
+ * THIS function's caller ({@link resolveActiveLexiconExport}, #1063's
+ * data-export resolution): every lexicon's public data surface is reachable
+ * from the barrel, so a subpath buys that caller nothing and would cost the
+ * same cold-resolution risk. {@link isTrustedExecutableBinding} (#1093) asks a
+ * different question — not "does this specifier name a reachable data
+ * export" but "has the CLI already loaded this code" — and a project file
+ * reaching a lexicon's generated module by subpath instead of through the
+ * barrel is code the CLI already imported and executed either way, so that
+ * caller resolves a subpath's package root separately, via
+ * {@link bareSpecifierPackageRoot}, rather than widening this function.
  */
 function activeLexiconPackage(specifier: string, lexiconPackages: ReadonlySet<string>): string | undefined {
   return lexiconPackages.has(specifier) ? specifier : undefined;
 }
 
+/**
+ * chant #1995 — the package-ROOT portion of a bare subpath specifier
+ * (`@intentius/chant-lexicon-azure/generated/index` ->
+ * `@intentius/chant-lexicon-azure`), or `undefined` when `specifier` is a
+ * relative/absolute path, is already a bare root with no subpath, or is
+ * malformed (a lone `@scope` with nothing after it).
+ *
+ * Text only, no resolution — the same discipline {@link activeLexiconPackage}
+ * documents and for the identical reason: resolving an arbitrary bare
+ * specifier to find out what package it belongs to is the pathological cold
+ * `require.resolve` chant#1020 measured. A scoped package (`@scope/name`)
+ * reserves its first two `/`-separated segments for the root; an unscoped
+ * package (`name`) reserves one.
+ */
+function bareSpecifierPackageRoot(specifier: string): string | undefined {
+  if (specifier.startsWith(".") || isAbsolute(specifier)) return undefined;
+  const segments = specifier.split("/");
+  if (specifier.startsWith("@")) {
+    return segments.length > 2 ? `${segments[0]}/${segments[1]}` : undefined;
+  }
+  return segments.length > 1 ? segments[0] : undefined;
+}
+
 /**
  * chant #1063 — resolve one named import binding against an active lexicon
  * package's REAL exports, for {@link buildExternals}.
@@ -2706,10 +2741,19 @@ function isChantOwnedHelperBinding(binding: ImportBinding, ctx: ResolveCtx): boo
  * in the CLI's own process when the #1045 sandbox is active. Exactly two
  * arms, and neither of them trusts text the project controls:
  *
- *  1. **An ACTIVE lexicon package of this build** — matched against
- *     {@link FoldSession.lexiconPackages}, a closed set built from the
- *     lexicon names the BUILD resolved and `loadPlugins` already imported
- *     (../cli/plugins.ts), not from anything the file under fold says.
+ *  1. **An ACTIVE lexicon package of this build, root OR subpath** — the
+ *     exact specifier matched against {@link FoldSession.lexiconPackages}, a
+ *     closed set built from the lexicon names the BUILD resolved and
+ *     `loadPlugins` already imported (../cli/plugins.ts), not from anything
+ *     the file under fold says; OR (chant #1995) a subpath of one of those
+ *     same packages (`@intentius/chant-lexicon-azure/generated/index`), whose
+ *     package ROOT is extracted from the specifier TEXT
+ *     ({@link bareSpecifierPackageRoot}, no resolution) and checked against
+ *     the identical set. A subpath is trusted because the code it names
+ *     belongs to a package the CLI already imported and executed to load that
+ *     lexicon's serializers/lint rules — reaching one of that package's own
+ *     modules by subpath instead of through the barrel names code the process
+ *     already trusts, not code the project controls.
  *  2. **chant-core's own executing tree** — the specifier is RESOLVED and the
  *     resulting path checked against {@link chantCoreRoot}. A text match is
  *     not enough here: `@intentius/chant` and `@intentius/chant-lexicon-evil`
@@ -2738,6 +2782,12 @@ function isChantOwnedHelperBinding(binding: ImportBinding, ctx: ResolveCtx): boo
  */
 function isTrustedExecutableBinding(binding: ImportBinding, ctx: ResolveCtx): boolean {
   if (activeLexiconPackage(binding.specifier, ctx.lexiconPackages) !== undefined) return true;
+  // chant #1995 — arm 1's subpath case: same allowlist, matched against the
+  // specifier's package ROOT (text only, see bareSpecifierPackageRoot) rather
+  // than the specifier itself, so `<activeLexiconPkg>/generated/index` is
+  // trusted exactly like the bare package import already is.
+  const subpathRoot = bareSpecifierPackageRoot(binding.specifier);
+  if (subpathRoot !== undefined && activeLexiconPackage(subpathRoot, ctx.lexiconPackages) !== undefined) return true;
   // Only a chant-shaped or project-relative specifier is worth resolving; any
   // other bare specifier is untrusted by definition, and resolving it to find
   // that out would cost the pathological cold `require.resolve` (chant#1020).

package/src/lexicon.ts

@@ -5,6 +5,7 @@ import type { RuleSpec } from "./lint/declarative";
 import type { PostSynthCheck } from "./lint/post-synth";
 import type { TemplateParser, TemplateIR } from "./import/parser";
 import type { TypeScriptGenerator } from "./import/generator";
+import type { AgentConfigImporter } from "./agents/importer";
 import type { ArtifactIntegrity } from "./lexicon-integrity";
 import type { OkfFile } from "./okf";
 import type { CompletionContext, CompletionItem, HoverContext, HoverInfo, CodeActionContext, CodeAction } from "./lsp/types";
@@ -714,6 +715,17 @@ export interface LexiconPlugin {
   /** Return a generator for converting IR to TypeScript */
   templateGenerator?(): TypeScriptGenerator;
 
+  /**
+   * Re-express local agent configuration (skills, MCP servers, instruction
+   * files) discovered by `chant audit --agents` as this lexicon's resources.
+   *
+   * Implement this when the lexicon has types that model an agent's workload —
+   * fountain's `Agent`/`Environment` are the motivating case. Core does the
+   * harness-neutral discovery; the mapping onto concrete resource types is the
+   * lexicon's call, for the same reason `templateParser` is.
+   */
+  agentConfigImporter?(): AgentConfigImporter;
+
   /** Return skills provided by this lexicon */
   skills?(): SkillDefinition[];
 
@@ -1163,10 +1175,10 @@ export interface LexiconPlugin {
    * where the wrong delete gets proposed.
    *
    * Declared per read path, because the answer differs by path. aws stamps tags
-   * at synthesis and reads them on the deep observation and on live export,
-   * while its `describeResources` is sourced from `describe-stack-resources`,
-   * which returns no tags — so an `owned: true` thin read against aws can only
-   * answer `unknown`, and does.
+   * at synthesis and reads them per resource on the deep observation and on
+   * live export, while its `describeResources` is sourced from
+   * `describe-stack-resources`, which returns no per-resource tags — so that
+   * path resolves the verdict from the stack's own tags (#1998).
    *
    * Absent means no channel anywhere: every verdict must be `unknown`.
    */
@@ -1417,11 +1429,12 @@ export interface ResourceMetadata {
    *
    * Set only when the live model actually carries the channel and the
    * managed-by marker is present — an absent channel means an absent field,
-   * never a guess. In particular aws's thin read is sourced from
-   * `describe-stack-resources`, which returns no tags at all, so aws never
-   * populates this here; aws teardown is stack-level and reads the stack's own
-   * tags instead (later PR). A populated `marker` does not by itself imply an
-   * {@link ownership} verdict on paths that do not declare a marker channel.
+   * never a guess. The granularity is whatever the channel reads at: aws's thin
+   * read is sourced from `describe-stack-resources`, which returns no
+   * per-resource tags, so it reads the STACK's own tags and every member of a
+   * marked stack carries that stack's identity (#1998). A populated `marker`
+   * does not by itself imply an {@link ownership} verdict on paths that do not
+   * declare a marker channel.
    */
   marker?: OwnershipMarker;
   /**

package/src/lifecycle/assert-live.ts

@@ -15,9 +15,8 @@
  *
  * Marker verification is best-effort by the same logic {@link
  * ResourceMetadata.marker}'s own contract states: a lexicon with no marker
- * channel on this read path (aws's thin `describeResources`, `ownership:
- * "unknown"`) reports no marker at all, which is not the same claim as
- * "foreign". Enforcing a match whenever the channel exists — a present
+ * channel on this read path reports no marker at all, which is not the same
+ * claim as "foreign". Enforcing a match whenever the channel exists — a present
  * mismatch, or `ownership: "foreign"` with no marker to show — catches the
  * case the harness cares about (a same-named leftover from another env);
  * an absent channel is passed through unverified rather than making every

package/src/ownership.ts

@@ -133,10 +133,11 @@ export function readOwnership(
  * A read path that can resolve an ownership verdict from the marker (#1348).
  *
  * Per-path rather than per-lexicon because the answer genuinely differs by
- * path: aws stamps tags at synthesis and reads them on the deep observation and
- * on live export, but `describeResources` is sourced from
- * `describe-stack-resources`, which returns no tags at all — so an `owned: true`
- * thin read against aws can only answer `unknown`.
+ * path — in granularity as much as in availability. aws stamps tags at
+ * synthesis and reads them per resource on the deep observation and on live
+ * export; its `describeResources` is sourced from `describe-stack-resources`,
+ * which returns no per-resource tags, so it resolves the verdict from the
+ * STACK's own tags instead (#1998).
  */
 export type OwnershipReadPath = "describeResources" | "observeResourcesDeep" | "exportResources";
 

package/src/terraform/adopt-state.ts

@@ -19,13 +19,13 @@
  */
 
 import {
-  AWS_CARVE_TYPES,
   AWS_LEXICON_IMPORT,
   awsCarveType,
   applyAwsMapper,
   applyAwsFold,
   unmappedFoldAttrs,
 } from "./aws-resources";
+import { canCarveEmit, carveEmitTypes } from "./tier-map";
 import type { StateResource } from "./state";
 
 /** The core subpath the emitted source reads build parameters from. */
@@ -70,14 +70,17 @@ export interface AdoptedSource {
   folded: FoldedContribution[];
 }
 
-/** Is this Terraform type adoptable from state (has a native constructor)? */
+/**
+ * Is this Terraform type adoptable from state (has a native constructor)? The
+ * same table gates the live path, so both are the shared `canCarveEmit`.
+ */
 export function canAdoptFromState(tfType: string): boolean {
-  return awsCarveType(tfType) !== undefined;
+  return canCarveEmit(tfType);
 }
 
 /** Terraform types that can currently be adopted from state, for user-facing hints. */
 export function supportedStateAdoptionTypes(): string[] {
-  return AWS_CARVE_TYPES.map((t) => t.tfType).sort();
+  return carveEmitTypes();
 }
 
 /** Marker for a prop whose value is a `params.<name>` reference, not a literal. */

package/src/terraform/aws-resources.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect } from "vitest";
 import { AWS_CARVE_TYPES, AWS_FOLD_MAPPERS, awsCarveType, applyAwsMapper, applyAwsFold } from "./aws-resources";
-import { TIER_MAP, FOLDS_INTO, IDENTITY_ATTR } from "./tier-map";
+import { TIER_MAP, FOLDS_INTO, IDENTITY_ATTR, canBridge, canCarveEmit, carveEmitTypes } from "./tier-map";
 import { canAdoptFromState } from "./adopt-state";
 
 describe("AWS carve-out table", () => {
@@ -13,6 +13,29 @@ describe("AWS carve-out table", () => {
     for (const t of emitAws) expect(canAdoptFromState(t)).toBe(true);
   });
 
+  test("the emit gate is narrower than the tier map, which also ranks k8s (#2015)", () => {
+    // `carve advise` bands kubernetes types; emit has no path for them, so the
+    // gate both emit paths share must refuse them.
+    expect(TIER_MAP.kubernetes_config_map).toBeDefined();
+    expect(canCarveEmit("kubernetes_config_map")).toBe(false);
+    expect(canCarveEmit("kubernetes_manifest")).toBe(false);
+    expect(canCarveEmit("random_pet")).toBe(false);
+    expect(canCarveEmit("aws_s3_bucket")).toBe(true);
+    expect(carveEmitTypes()).toEqual(AWS_CARVE_TYPES.map((t) => t.tfType).sort());
+    // State adoption and live emit gate on the same table.
+    for (const t of carveEmitTypes()) expect(canAdoptFromState(t)).toBe(true);
+  });
+
+  test("canBridge rejects a dotted identity attribute (#2015)", () => {
+    // A data source body is flat `attr = value`; a dotted path is not HCL.
+    expect(IDENTITY_ATTR.kubernetes_manifest).toContain(".");
+    expect(canBridge("kubernetes_manifest")).toBe(false);
+    expect(canBridge("aws_s3_bucket")).toBe(true);
+    // No identity entry at all is fine — the bridge writes a TODO comment.
+    expect(canBridge("random_pet")).toBe(true);
+    for (const t of AWS_CARVE_TYPES) expect(canBridge(t.tfType)).toBe(true);
+  });
+
   test("covers the common carve targets across families", () => {
     const types = new Set(AWS_CARVE_TYPES.map((t) => t.tfType));
     for (const t of [

package/src/terraform/bridge.test.ts

@@ -51,6 +51,18 @@ describe("generateBridge — inbound (data-source rewrite)", () => {
     );
   });
 
+  test("never renders a dotted identity attribute into the data body (#2015)", () => {
+    const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
+    const dotted = new Map<string, CarvedIdentity>([
+      ["aws_s3_bucket.assets", { attr: "manifest.metadata.name", value: "demo-config" }],
+    ]);
+    const plan = generateBridge(report, [{ path: "api.tf", content: API_TF }], dotted);
+
+    // `manifest.metadata.name = "demo-config"` is not valid HCL.
+    expect(plan.dataSources[0].hcl).not.toContain("manifest.metadata.name =");
+    expect(plan.dataSources[0].hcl).toContain("# TODO: identify the resource");
+  });
+
   test("rewrites survivor references to the data source", () => {
     const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
     const plan = generateBridge(report, [{ path: "api.tf", content: API_TF }], identities);

package/src/terraform/bridge.ts

@@ -81,8 +81,11 @@ function referenceRegex(address: string): RegExp {
 }
 
 function dataSourceHcl(type: string, name: string, identity: CarvedIdentity): string {
+  // A dotted attr is a path into nested blocks; `a.b.c = v` is not valid HCL,
+  // so it falls back to the TODO. `carve bridge` refuses such a type outright.
+  const flat = identity.attr !== undefined && !identity.attr.includes(".");
   const body =
-    identity.attr && identity.value !== undefined
+    flat && identity.value !== undefined
       ? `  ${identity.attr} = ${JSON.stringify(identity.value)}`
       : `  # TODO: identify the resource (its name/id was interpolated in the source)`;
   return `data ${JSON.stringify(type)} ${JSON.stringify(name)} {\n${body}\n}`;

package/src/terraform/tier-map.ts

@@ -12,7 +12,7 @@
  *   null   — no known native mapping (unsupported provider/type) → score 0
  */
 
-import { AWS_CARVE_TYPES } from "./aws-resources";
+import { AWS_CARVE_TYPES, awsCarveType } from "./aws-resources";
 
 export interface TierInfo {
   tier: 1 | 2 | 3;
@@ -110,3 +110,30 @@ export const IDENTITY_ATTR: Record<string, string> = {
 export function resolveTier(tfType: string): TierInfo | null {
   return TIER_MAP[tfType] ?? null;
 }
+
+/**
+ * Can `chant carve emit` produce chant source for this type? Narrower than
+ * `resolveTier`: the tier map also ranks the kubernetes types, which advise
+ * bands but no emit path can adopt (#999, blocked on the provider seam #2016).
+ * Both emit paths — `--state` and `--env` — gate on this, so a type either
+ * command refuses is refused by the other with the same message.
+ */
+export function canCarveEmit(tfType: string): boolean {
+  return awsCarveType(tfType) !== undefined;
+}
+
+/** The types `canCarveEmit` accepts, sorted, for user-facing hints. */
+export function carveEmitTypes(): string[] {
+  return AWS_CARVE_TYPES.map((t) => t.tfType).sort();
+}
+
+/**
+ * Can `chant carve bridge` render a Terraform `data` source for this type? A
+ * dotted `IDENTITY_ATTR` is a path into nested blocks, and a data source body
+ * is flat `attr = value` — `manifest.metadata.name = "x"` is not valid HCL.
+ * An absent entry is fine: the bridge writes a TODO comment for the identity.
+ */
+export function canBridge(tfType: string): boolean {
+  const attr = IDENTITY_ATTR[tfType];
+  return attr === undefined || !attr.includes(".");
+}