@intentius/chant 0.52.1 → 0.53.0

package/src/identity.ts

@@ -0,0 +1,346 @@
+/**
+ * The identity contract (#1982) — which principal chant would act as in each
+ * substrate, reported before it acts.
+ *
+ * Every native observer already resolves this. `ObserverAdapter.bind()`
+ * (./observation.ts) reaches the provider on the applier's own transport, the
+ * k8s connector resolves a kubeconfig context and says which binding produced
+ * it, the aws read client resolves a region and an endpoint. All of it is
+ * discarded. The only way the answer has ever surfaced is as an `unobserved`
+ * entry with reason `no-credentials`, or — worse — as a successful read
+ * against the wrong account.
+ *
+ * A project spanning aws, k8s, gcp and github reaches four substrates with
+ * four credential sets, and nothing says which identity each one resolves to.
+ * `chant lifecycle whoami <env>` asks each configured lexicon that question
+ * and prints one row per lexicon.
+ *
+ * ## The tri-state
+ *
+ * The same discipline the observation contract draws between "absent" and
+ * "not observed" applies here, because the same mistake is available: an empty
+ * identity reads as "nobody", and "nobody" is not what "I could not find out"
+ * means.
+ *
+ *   - **REPORTED** — the lexicon asked the substrate and it answered. A
+ *     principal, a scope, and where the binding came from.
+ *   - **UNRESOLVED** — the lexicon tried and could not, carrying a total
+ *     {@link UnobservedReason}. `no-credentials` is "no identity is
+ *     configured"; `no-binding` and `read-failed` are "could not determine".
+ *     Those are different answers and the reason keeps them apart.
+ *   - **NOT REPORTED** — the lexicon implements no {@link
+ *     import("./lexicon").LexiconPlugin.describeIdentity}. It answers for
+ *     nothing, which is honest; it is never rendered as an empty identity.
+ *
+ * ## Read-only, and never a gate
+ *
+ * `whoami` mutates nothing and blocks nothing. It exits 0 whatever the rows
+ * say unless the caller asks for a non-zero exit on an unresolved row with
+ * `--strict`. A lexicon's implementation is held to the same rule: a self-query
+ * that reaches the substrate must be one the substrate treats as a read of the
+ * caller's own identity.
+ *
+ * ## No credential ever reaches the output
+ *
+ * An identity is a principal and a scope — an account id, a project, an org, a
+ * cluster context, a service-account name. It is never a token, a key, a
+ * password or a certificate. The rule is on the lexicon: report the fact, not
+ * the value, and where a substrate's only identity signal IS a secret, say so
+ * without it.
+ *
+ * {@link redactCredentialMaterial} is the backstop core applies to every field
+ * of every row regardless, not a license to be careless. It is deliberately
+ * structural rather than heuristic — it redacts what the process actually
+ * holds in a credential-shaped environment variable, plus the three literal
+ * shapes (PEM block, JWT, `Bearer …`) that no principal string can be — so an
+ * account id, an ARN and a `system:serviceaccount:…` subject survive it intact.
+ */
+
+import type { UnobservedReason } from "./observation";
+
+/** The identity one lexicon resolved, and the scope it resolves to. */
+export interface ResolvedIdentity {
+  /**
+   * The principal, as the substrate names it — an STS ARN, a
+   * `system:serviceaccount:<ns>:<name>` subject, a service-account email. Never
+   * a credential.
+   */
+  identity: string;
+  /**
+   * What that principal is scoped to here — an account id plus region, a
+   * cluster context, a project, an org. The half that answers "acting on
+   * WHAT", which is where a wrong-account read is actually visible.
+   */
+  scope: string;
+  /**
+   * Where the binding came from, in the project's own vocabulary:
+   * `k8s.profiles.prod.context`, `AWS_PROFILE`, `ADC`, `stacks[].region`. An
+   * identity with no provenance cannot be corrected by whoever reads it.
+   */
+  source: string;
+  /**
+   * The resolved address the self-query was issued against. Must be the address
+   * this lexicon's live read resolves for the same environment — a whoami that
+   * reports a binding the read does not use is worse than no whoami.
+   */
+  endpoint?: string;
+}
+
+/** Why one lexicon could not resolve an identity. Total, and reason-typed. */
+export interface UnresolvedIdentity {
+  /**
+   * Total verdict, from the same set an unobservable entity uses.
+   * `no-credentials` — nothing is configured to act as. `no-binding` — the
+   * environment resolves to no concrete target. `read-failed` — the substrate
+   * was reached and the self-query errored.
+   */
+  reason: UnobservedReason;
+  /** Human-readable detail: the call that failed, the missing binding key. */
+  detail?: string;
+}
+
+/**
+ * What `describeIdentity()` may return: the resolved identity, or a typed
+ * refusal. Discriminated by the `unresolved` key, the same shape
+ * {@link import("./observation").EntityObservation} uses.
+ */
+export type DescribeIdentityResult = ResolvedIdentity | { unresolved: UnresolvedIdentity };
+
+/** True when a lexicon answered with a typed refusal rather than an identity. */
+export function isUnresolvedIdentity(
+  value: DescribeIdentityResult,
+): value is { unresolved: UnresolvedIdentity } {
+  return typeof value === "object" && value !== null && "unresolved" in value;
+}
+
+/** The tri-state, as one row's verdict. */
+export type IdentityStatus = "reported" | "unresolved" | "not-reported";
+
+/** One lexicon's answer, normalized — the unit `whoami` renders and `--json` emits. */
+export interface IdentityRow {
+  lexicon: string;
+  status: IdentityStatus;
+  /** REPORTED only. */
+  identity?: string;
+  /** REPORTED only. */
+  scope?: string;
+  /** REPORTED only. */
+  source?: string;
+  /** REPORTED only, and only when the lexicon named one. */
+  endpoint?: string;
+  /** UNRESOLVED only. */
+  reason?: UnobservedReason;
+  /** UNRESOLVED only, when the lexicon supplied one. */
+  detail?: string;
+}
+
+/** What core hands a lexicon's `describeIdentity`. */
+export interface DescribeIdentityOptions {
+  environment: string;
+  /**
+   * The region the environment's stacks declare, when they declare exactly one
+   * (`stacks[].region`, #1261). Omitted when they declare none or disagree, in
+   * which case the lexicon resolves the region its own read path would.
+   */
+  region?: string;
+  /** Project root whose `chant.config.ts` carries the binding. Defaults to cwd. */
+  cwd?: string;
+}
+
+/** The subset of a plugin this module needs — narrower than importing the whole contract. */
+export interface IdentityPlugin {
+  name: string;
+  describeIdentity?(options: DescribeIdentityOptions): Promise<DescribeIdentityResult>;
+}
+
+/** The marker a redacted field carries. Fixed text so a consumer can match it. */
+export const REDACTED = "[redacted]";
+
+/**
+ * Environment variables whose VALUE is credential material. Matched on the
+ * name, so a lexicon that echoes one of these into an identity string has the
+ * value removed before it is printed or serialized.
+ */
+const CREDENTIAL_ENV_NAME =
+  /(SECRET|TOKEN|PASSWORD|PASSWD|CREDENTIAL|PRIVATE_KEY|APIKEY|API_KEY|ACCESS_KEY|SESSION_KEY|AUTH)/i;
+
+/** Shortest env value worth redacting. Below this a "secret" is a false positive. */
+const MIN_CREDENTIAL_LENGTH = 8;
+
+/**
+ * Literal credential shapes. Each is something a principal string cannot be,
+ * so matching one is proof rather than a guess.
+ */
+const CREDENTIAL_SHAPES: RegExp[] = [
+  // A PEM block of any key type.
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+  // A JWT: three base64url segments, the first starting with the `{"` header.
+  /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]*/g,
+  // An `Authorization`-style scheme plus its value.
+  /\b(?:Bearer|Basic)\s+[A-Za-z0-9\-._~+/]{16,}={0,2}/g,
+];
+
+/**
+ * Strip credential material from one reported field.
+ *
+ * Two rules, both structural. Any value this process holds in a
+ * credential-named environment variable is replaced wherever it appears, which
+ * covers the realistic accident — a lexicon echoing `$GITHUB_TOKEN` or
+ * `$AWS_SECRET_ACCESS_KEY` into a `source`. And the three literal shapes above
+ * are replaced on sight.
+ *
+ * Nothing is entropy-scored, so an ARN, an account id, a service-account email
+ * and a cluster context name pass through unchanged — which matters, because a
+ * mangled principal is a wrong answer, not a safe one.
+ */
+export function redactCredentialMaterial(
+  value: string,
+  env: Record<string, string | undefined> = process.env,
+): string {
+  let out = value;
+  for (const [name, secret] of Object.entries(env)) {
+    if (!secret || secret.length < MIN_CREDENTIAL_LENGTH) continue;
+    if (!CREDENTIAL_ENV_NAME.test(name)) continue;
+    if (!out.includes(secret)) continue;
+    out = out.split(secret).join(REDACTED);
+  }
+  for (const shape of CREDENTIAL_SHAPES) out = out.replace(shape, REDACTED);
+  return out;
+}
+
+/** Apply {@link redactCredentialMaterial} to every free-text field of a row. */
+export function redactIdentityRow(
+  row: IdentityRow,
+  env: Record<string, string | undefined> = process.env,
+): IdentityRow {
+  const clean = (v: string | undefined): string | undefined =>
+    v === undefined ? undefined : redactCredentialMaterial(v, env);
+  return {
+    ...row,
+    ...(row.identity !== undefined ? { identity: clean(row.identity) } : {}),
+    ...(row.scope !== undefined ? { scope: clean(row.scope) } : {}),
+    ...(row.source !== undefined ? { source: clean(row.source) } : {}),
+    ...(row.endpoint !== undefined ? { endpoint: clean(row.endpoint) } : {}),
+    ...(row.detail !== undefined ? { detail: clean(row.detail) } : {}),
+  };
+}
+
+/**
+ * Normalize one lexicon's answer into a row.
+ *
+ * Every degradation lands somewhere honest. No method at all is NOT REPORTED.
+ * A throw is UNRESOLVED with `read-failed` — the lexicon reached for the
+ * substrate and something broke, which is a different claim from having no
+ * credentials. An answer that carries no identity string is UNRESOLVED too: a
+ * lexicon cannot report an empty principal, because an empty principal renders
+ * as "acting as nobody", and nobody is a claim.
+ */
+export function identityRowFor(
+  lexicon: string,
+  result: DescribeIdentityResult | undefined,
+  env: Record<string, string | undefined> = process.env,
+): IdentityRow {
+  if (result === undefined) return { lexicon, status: "not-reported" };
+  if (isUnresolvedIdentity(result)) {
+    return redactIdentityRow(
+      {
+        lexicon,
+        status: "unresolved",
+        reason: result.unresolved.reason,
+        ...(result.unresolved.detail ? { detail: result.unresolved.detail } : {}),
+      },
+      env,
+    );
+  }
+  if (!result.identity || result.identity.trim() === "") {
+    return {
+      lexicon,
+      status: "unresolved",
+      reason: "read-failed",
+      detail: "the lexicon reported an identity with no principal in it",
+    };
+  }
+  return redactIdentityRow(
+    {
+      lexicon,
+      status: "reported",
+      identity: result.identity,
+      scope: result.scope,
+      source: result.source,
+      ...(result.endpoint ? { endpoint: result.endpoint } : {}),
+    },
+    env,
+  );
+}
+
+/**
+ * Ask every plugin who it would act as. One call per lexicon, concurrently,
+ * in the order the plugins were configured so the report is stable.
+ *
+ * A plugin that throws never fails the run: the throw becomes that lexicon's
+ * UNRESOLVED row. Reporting is the whole point, and a report that aborts on
+ * the first broken substrate is exactly the report nobody can use.
+ */
+export async function describeIdentities(
+  plugins: readonly IdentityPlugin[],
+  options: DescribeIdentityOptions,
+  env: Record<string, string | undefined> = process.env,
+): Promise<IdentityRow[]> {
+  return Promise.all(
+    plugins.map(async (plugin): Promise<IdentityRow> => {
+      if (!plugin.describeIdentity) return { lexicon: plugin.name, status: "not-reported" };
+      try {
+        return identityRowFor(plugin.name, await plugin.describeIdentity(options), env);
+      } catch (err) {
+        return identityRowFor(
+          plugin.name,
+          {
+            unresolved: {
+              reason: "read-failed",
+              detail: err instanceof Error ? err.message : String(err),
+            },
+          },
+          env,
+        );
+      }
+    }),
+  );
+}
+
+/**
+ * A row's verdict as one short cell, for the IDENTITY column. Deliberately
+ * without the `detail`, which is a sentence and belongs under the table rather
+ * than inside a column every other row has to be padded to.
+ */
+export function identityStatusText(row: IdentityRow): string {
+  switch (row.status) {
+    case "reported":
+      return row.identity ?? "";
+    case "unresolved":
+      return `could not determine — ${unresolvedReasonText(row.reason)}`;
+    case "not-reported":
+      return "not reported — this lexicon does not answer for an identity";
+  }
+}
+
+/**
+ * Why an identity did not resolve, in words. Deliberately distinct from
+ * `unobservedReasonText`: `no-credentials` here means "no identity is
+ * configured for this substrate", which is an answer, not a failure to look.
+ */
+export function unresolvedReasonText(reason: UnobservedReason | undefined): string {
+  switch (reason) {
+    case "no-credentials":
+      return "no identity is configured for this substrate";
+    case "no-binding":
+      return "this environment resolves to no target";
+    case "read-failed":
+      return "the substrate was reached and the self-query failed";
+    case "unsupported-kind":
+      return "the substrate exposes no self-query";
+    case "filtered":
+      return "withheld";
+    default:
+      return "no reason given";
+  }
+}

package/src/index.ts

@@ -53,6 +53,7 @@ export * from "./import/parser";
 export * from "./import/generator";
 export * from "./lexicon";
 export * from "./observation";
+export * from "./identity";
 export * from "./apply";
 export * from "./deep-observation";
 export * from "./owner-chain";

package/src/lexicon.ts

@@ -5,6 +5,7 @@ import type { RuleSpec } from "./lint/declarative";
 import type { PostSynthCheck } from "./lint/post-synth";
 import type { TemplateParser, TemplateIR } from "./import/parser";
 import type { TypeScriptGenerator } from "./import/generator";
+import type { AgentConfigImporter } from "./agents/importer";
 import type { ArtifactIntegrity } from "./lexicon-integrity";
 import type { OkfFile } from "./okf";
 import type { CompletionContext, CompletionItem, HoverContext, HoverInfo, CodeActionContext, CodeAction } from "./lsp/types";
@@ -17,6 +18,7 @@ import type { RuleMeta } from "./audit/catalog";
 import type { ReferenceCatalog } from "./graph-refs";
 import type { IREdge } from "./graph-ir";
 import type { DescribeResourcesResult, UnobservedReason } from "./observation";
+import type { DescribeIdentityOptions, DescribeIdentityResult } from "./identity";
 import type { DeepNormalizationHooks, DeepObservationResult } from "./deep-observation";
 import type { DisruptionQuery, DisruptionVerdict } from "./lifecycle/disruption";
 import type { OwnerChainVerdict } from "./owner-chain";
@@ -45,6 +47,18 @@ export type {
   UnobservedReason,
 } from "./observation";
 
+// The identity contract (#1982), re-exported from the same entry so a
+// lexicon's `describeIdentity` types itself without a second import path.
+// Runtime helpers live in `@intentius/chant/identity`.
+export type {
+  DescribeIdentityOptions,
+  DescribeIdentityResult,
+  ResolvedIdentity,
+  UnresolvedIdentity,
+  IdentityRow,
+  IdentityStatus,
+} from "./identity";
+
 // Disruption classification (#1665), re-exported from the same entry so a
 // lexicon's `classifyDisruption` types itself without a second import path.
 // Runtime helpers live in `@intentius/chant/lifecycle/disruption`.
@@ -714,6 +728,17 @@ export interface LexiconPlugin {
   /** Return a generator for converting IR to TypeScript */
   templateGenerator?(): TypeScriptGenerator;
 
+  /**
+   * Re-express local agent configuration (skills, MCP servers, instruction
+   * files) discovered by `chant audit --agents` as this lexicon's resources.
+   *
+   * Implement this when the lexicon has types that model an agent's workload —
+   * fountain's `Agent`/`Environment` are the motivating case. Core does the
+   * harness-neutral discovery; the mapping onto concrete resource types is the
+   * lexicon's call, for the same reason `templateParser` is.
+   */
+  agentConfigImporter?(): AgentConfigImporter;
+
   /** Return skills provided by this lexicon */
   skills?(): SkillDefinition[];
 
@@ -1071,6 +1096,46 @@ export interface LexiconPlugin {
    */
   describeStackStatus?(options: { environment: string; stack: string }): Promise<StackStatusObservation | null>;
 
+  /**
+   * Report the principal chant would act as in this substrate, and the scope
+   * that principal resolves to (#1982) — what `chant lifecycle whoami <env>`
+   * prints, one row per lexicon, before anything acts.
+   *
+   * Every implementation of {@link describeResources} already resolves this
+   * and throws it away: the bind reaches the provider on the applier's own
+   * transport, the k8s connector resolves a context and knows which binding
+   * produced it, the aws read client resolves a region and an endpoint. The
+   * answer has only ever surfaced as a `no-credentials` hole or, when the
+   * binding was wrong rather than missing, as a clean read of the wrong
+   * account.
+   *
+   * Implement it with the substrate's own cheap self-query —
+   * `sts:GetCallerIdentity`, `SelfSubjectReview`, the token introspection the
+   * forge already exposes. Two rules bind the implementation:
+   *
+   * - **Read-only.** `whoami` is pre-flight and never a gate. The self-query
+   *   must be one the substrate treats as a read of the caller's own identity;
+   *   it creates nothing and changes nothing.
+   * - **No credential in the answer.** An identity is a principal and a scope,
+   *   never a token, key or password. Where a substrate's only identity signal
+   *   IS a secret, report that fact in `source` without the value. Core
+   *   redacts credential material from every field as a backstop, which is not
+   *   a reason to put one there.
+   *
+   * `endpoint` must be the address this lexicon's live read resolves for the
+   * same environment. A whoami that names a binding the read does not use is
+   * worse than no whoami, so a test pins the two together.
+   *
+   * Returning `{ unresolved: { reason, detail } }` is a real answer and the
+   * required one when the identity cannot be resolved — `no-credentials` for
+   * "nothing is configured", `no-binding` for "this environment resolves to no
+   * target", `read-failed` for a self-query that errored. A throw degrades to
+   * `read-failed` for this lexicon alone and never fails the command. Omitting
+   * the method entirely reports `not reported`, which is honest; it is never
+   * rendered as an empty identity.
+   */
+  describeIdentity?(options: DescribeIdentityOptions): Promise<DescribeIdentityResult>;
+
   /**
    * Enumerate the resources this lexicon would delete for one marker identity
    * (#1222). Opt-in, and read-only here: this method names the would-delete

package/src/terraform/__fixtures__/gcp-estate/main.tf

@@ -0,0 +1,60 @@
+# A small google-provider estate for the carve-out advisor (#2017), mixed the
+# same way the AWS sample estate is: clean leaves, a hub with boundary work, a
+# tier-3 map, and one resource with no native mapping at all.
+
+# Clean leaf: a bucket nothing else reads.
+resource "google_storage_bucket" "assets" {
+  name     = "myapp-assets-prod"
+  location = "US"
+}
+
+# Clean leaf with one inbound edge: the subscription reads the topic.
+resource "google_pubsub_topic" "events" {
+  name = "myapp-events"
+}
+
+resource "google_pubsub_subscription" "worker" {
+  name  = "myapp-worker"
+  topic = google_pubsub_topic.events.name
+}
+
+# The hub: two subnets, a router and the cluster all reference the network, so
+# carving it costs four data-source patches to the surviving Terraform.
+resource "google_compute_network" "main" {
+  name                    = "myapp-vpc"
+  auto_create_subnetworks = false
+}
+
+resource "google_compute_subnetwork" "a" {
+  name          = "myapp-subnet-a"
+  ip_cidr_range = "10.0.1.0/24"
+  network       = google_compute_network.main.id
+}
+
+resource "google_compute_subnetwork" "b" {
+  name          = "myapp-subnet-b"
+  ip_cidr_range = "10.0.2.0/24"
+  network       = google_compute_network.main.id
+}
+
+resource "google_compute_router" "nat" {
+  name    = "myapp-router"
+  network = google_compute_network.main.id
+}
+
+# Tier 3: Config Connector inlines node pools the cluster also declares apart.
+resource "google_container_cluster" "primary" {
+  name       = "myapp-gke"
+  network    = google_compute_network.main.id
+  subnetwork = google_compute_subnetwork.a.id
+}
+
+# Identity lives in account_id here, not name.
+resource "google_service_account" "runner" {
+  account_id = "myapp-runner"
+}
+
+# Leave in Terraform: no native mapping, scored 0.
+resource "random_pet" "suffix" {
+  length = 2
+}

package/src/terraform/adopt-state.test.ts

@@ -159,3 +159,134 @@ describe("adoptFromState", () => {
     expect(adoptFromState({ type: "random_pet", name: "x", attributes: { id: "abc" } })).toBeNull();
   });
 });
+
+/**
+ * `kubernetes_manifest` adoption (#999). The Terraform type names no kind: the
+ * target is whatever the manifest body says it is, so these assertions are
+ * about reading the body, not about a per-type property mapping.
+ */
+describe("adoptFromState — kubernetes_manifest", () => {
+  const configMap: StateResource = {
+    type: "kubernetes_manifest",
+    name: "app_config",
+    attributes: {
+      manifest: {
+        apiVersion: "v1",
+        kind: "ConfigMap",
+        metadata: { name: "app-config", namespace: "web", labels: { "app.kubernetes.io/name": "web" } },
+        data: { LOG_LEVEL: "info" },
+      },
+      field_manager: null,
+      wait: null,
+      computed_fields: ["metadata.labels", "metadata.annotations"],
+    },
+  };
+
+  test("adopts the manifest body verbatim through the lexicon escape hatch", () => {
+    const out = adoptFromState(configMap)!;
+    expect(out.fileName).toBe("app_config.ts");
+    expect(out.mapped).toBe(true);
+    // The kind came out of the body, not out of the Terraform type.
+    expect(out.nativeType).toBe("v1 ConfigMap");
+
+    expect(out.content).toContain('import { k8sManifest } from "@intentius/chant-lexicon-k8s";');
+    expect(out.content).toContain("export const app_config = k8sManifest({");
+    expect(out.content).toContain('apiVersion: "v1"');
+    expect(out.content).toContain('kind: "ConfigMap"');
+    expect(out.content).toContain('namespace: "web"');
+    // A key that is not an identifier is quoted, so the emitted source parses.
+    expect(out.content).toContain('"app.kubernetes.io/name": "web"');
+    expect(out.content).toContain('LOG_LEVEL: "info"');
+    // Provider knobs are reported, never smuggled into the object.
+    expect(out.content).toContain("Provider-behaviour attributes not part of the object: computed_fields");
+    expect(out.content).not.toContain("computed_fields:");
+    expect(out.folded).toEqual([]);
+  });
+
+  test("a CRD body needs no per-type mapping — one rule covers every kind", () => {
+    const out = adoptFromState({
+      type: "kubernetes_manifest",
+      name: "cert",
+      attributes: {
+        manifest: {
+          apiVersion: "cert-manager.io/v1",
+          kind: "Certificate",
+          metadata: { name: "web-tls", namespace: "web" },
+          spec: {
+            secretName: "web-tls",
+            dnsNames: ["web.example.com"],
+            issuerRef: { name: "letsencrypt", kind: "ClusterIssuer" },
+          },
+        },
+      },
+    })!;
+    expect(out.nativeType).toBe("cert-manager.io/v1 Certificate");
+    expect(out.content).toContain('apiVersion: "cert-manager.io/v1"');
+    expect(out.content).toContain('kind: "Certificate"');
+    expect(out.content).toContain('secretName: "web-tls"');
+    expect(out.content).toContain('"web.example.com",');
+  });
+
+  test("falls back to the computed object, without the fields the API server owns", () => {
+    const out = adoptFromState({
+      type: "kubernetes_manifest",
+      name: "ns",
+      attributes: {
+        object: {
+          apiVersion: "v1",
+          kind: "Namespace",
+          metadata: {
+            name: "web",
+            uid: "8f1e",
+            resourceVersion: "4711",
+            creationTimestamp: "2026-01-01T00:00:00Z",
+            labels: {},
+          },
+          status: { phase: "Active" },
+        },
+      },
+    })!;
+    expect(out.content).toContain('name: "web"');
+    expect(out.content).not.toContain("resourceVersion");
+    expect(out.content).not.toContain("creationTimestamp");
+    expect(out.content).not.toContain("uid");
+    expect(out.content).not.toContain("status");
+  });
+
+  test("a deferred input is reported in the source, not substituted", () => {
+    // The survivor value sits inside the body, so the boundary report names the
+    // enclosing `manifest` attribute and state resolves it to an object —
+    // there is no scalar for a `params.<name>` reference to replace.
+    const params: DeferredParam[] = [
+      { name: "manifest", tfAttr: "manifest", survivor: "aws_eks_cluster.main", attrs: ["endpoint"] },
+    ];
+    const out = adoptFromState(configMap, params)!;
+    expect(out.parameterized).toEqual([]);
+    expect(out.content).toContain("Deferred deploy-time input: manifest read aws_eks_cluster.main.endpoint");
+    expect(out.content).toContain('declared as build param "manifest" in chant.config.ts');
+    expect(out.content).not.toContain("params.");
+  });
+
+  test("a name Terraform allows but TypeScript does not becomes an identifier", () => {
+    const out = adoptFromState({
+      type: "kubernetes_manifest",
+      name: "app-config",
+      attributes: { manifest: { apiVersion: "v1", kind: "ConfigMap", metadata: { name: "app-config" } } },
+    })!;
+    expect(out.fileName).toBe("app_config.ts");
+    expect(out.content).toContain("export const app_config = k8sManifest({");
+  });
+
+  test("a body without apiVersion/kind is refused rather than emitted headless", () => {
+    expect(
+      adoptFromState({ type: "kubernetes_manifest", name: "x", attributes: { manifest: { metadata: { name: "x" } } } }),
+    ).toBeNull();
+    expect(adoptFromState({ type: "kubernetes_manifest", name: "x", attributes: {} })).toBeNull();
+  });
+
+  test("a typed kubernetes resource is ranked but not adoptable", () => {
+    expect(canAdoptFromState("kubernetes_manifest")).toBe(true);
+    expect(canAdoptFromState("kubernetes_config_map")).toBe(false);
+    expect(adoptFromState({ type: "kubernetes_config_map", name: "c", attributes: {} })).toBeNull();
+  });
+});