@intentius/chant 0.52.2 → 0.53.1

package/dist/lifecycle/converge-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/converge-ledger.ts"],"names":[],"mappings":"AAmCA,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,MAAM,EAAE,KAAK,GAAG,UAAU,GAAG,gBAAgB,GAAG,cAAc,GAAG,OAAO,CAAC;IACzE,gEAAgE;IAChE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6JAA6J;IAC7J,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,6IAA6I;IAC7I,SAAS,EAAE,MAAM,CAAC;IAClB,oHAAoH;IACpH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,8CAA8C;IAC9C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,wDAAwD;IACxD,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,uNAAuN;QACvN,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,iHAAiH;IACjH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,uBAAuB,EAC9B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC,CAqBzD;AAED,6MAA6M;AAC7M,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAO1F"}
+{"version":3,"file":"converge-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/converge-ledger.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAcnD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAsB,GAAG,MAAM,CAKpF;AAcD,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,MAAM,EAAE,KAAK,GAAG,UAAU,GAAG,gBAAgB,GAAG,cAAc,GAAG,OAAO,CAAC;IACzE,gEAAgE;IAChE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6JAA6J;IAC7J,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACrD,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,4HAA4H;IAC5H,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kKAAkK;IAClK,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,kBAAkB,EAAE,GAAG,wBAAwB,EAAE,CAejG;AAED,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX;;;;;;;;;;OAUG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,6IAA6I;IAC7I,SAAS,EAAE,MAAM,CAAC;IAClB,oHAAoH;IACpH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,8CAA8C;IAC9C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACxC,wDAAwD;IACxD,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,uNAAuN;QACvN,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,iHAAiH;IACjH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,uBAAuB,EAC9B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,GAAG;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAqB1E;AAED,6MAA6M;AAC7M,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAO1F"}

package/dist/lifecycle/gate-ledger.d.ts

@@ -1,3 +1,34 @@
+/**
+ * The address of the approval surface for a gate, resolved from the CI
+ * environment (#2028).
+ *
+ * #1485's argument for gate-as-fact was that approval gets an address:
+ * "gate-as-PR gives approval a URL, a review surface, and CODEOWNERS as the
+ * authorization model." What shipped recorded the gate and not the address,
+ * so a pending-approval card had nothing to link to and gate-as-PR stayed a
+ * convention. This is the narrow, honest half of that: when a tick (or a
+ * `chant approve`) runs inside the PR/MR job that carries the change, the
+ * loop genuinely knows where approval happens, and says so. Anywhere else it
+ * returns `undefined` and the field is simply absent — never a guess, never a
+ * synthesized link.
+ *
+ * The env-var fallback chain is the same one `--actor` and `--run-id` already
+ * use (`../cli/handlers/components.ts`): GitHub Actions first, then GitLab CI.
+ *
+ * - GitHub Actions on a `pull_request` event: `GITHUB_SERVER_URL` +
+ *   `GITHUB_REPOSITORY` + the PR number, which `GITHUB_REF_NAME` carries as
+ *   `<n>/merge`. A push-event run has no PR, so it resolves to nothing.
+ * - GitLab CI on a merge-request pipeline: `CI_MERGE_REQUEST_PROJECT_URL` +
+ *   `CI_MERGE_REQUEST_IID`.
+ */
+export declare function resolveApprovalUrl(env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Whether `raw` is an address worth recording as one: an absolute `http`/
+ * `https` URL. A gate's address is a link a reader is expected to follow, so
+ * a relative path or a `file:`/`javascript:` scheme is refused at the CLI
+ * boundary rather than written into an immutable record.
+ */
+export declare function isApprovalUrl(raw: string): boolean;
 /** One immutable gate-resolution record. */
 export interface GateResolutionRecord {
     /** Schema version, so an incompatible future shape is detected before being misread. */
@@ -10,8 +41,19 @@ export interface GateResolutionRecord {
     resolvedBy: string;
     /** ISO-8601 timestamp, caller-supplied (library code never calls `Date.now()` internally). */
     timestamp: string;
-    /** Optional free-text context (e.g. a PR URL — "or a merged PR" is the issue's other resolution path; recording its link here keeps both paths visible from one ledger). */
+    /** Optional free-text context. Before #2028 this was also where a PR link went by convention; put the link in {@link GateResolutionRecord.url} instead and leave this for prose. */
     note?: string;
+    /**
+     * The address this resolution happened at (#2028) — the PR that carried the
+     * change, the review thread, whatever the approval surface was. Typed, so
+     * "resolved by this PR" is machine-readable instead of a reader sniffing
+     * `note` for something that looks like a link.
+     *
+     * `chant approve --url` sets it; absent when the resolver genuinely had no
+     * address (a human at a terminal, no PR). Always an absolute `http`/`https`
+     * URL — see {@link isApprovalUrl}.
+     */
+    url?: string;
 }
 export type GateResolutionInput = Omit<GateResolutionRecord, "version">;
 /** Append one immutable gate-resolution record. Does not push to the remote — call `pushLifecycle` (./git.ts) afterward, same two-step shape every other ledger write here uses. Retries on `RefCASConflictError` the same way `appendConvergeRecord` does (./converge-ledger.ts) — a concurrent writer to a different op's/env's file on the same orphan branch is the ordinary case, not an edge case. The baseline read must be `readPathSha` + `readBlobBySha` rather than `readBlobFromPath`, so the exact sha `existing` came from can be passed as `expectPriorPathSha` — see `writeBlobToPath` (./git.ts) for the race that closes. */

package/dist/lifecycle/gate-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-ledger.ts"],"names":[],"mappings":"AA4CA,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,yHAAyH;IACzH,UAAU,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,4KAA4K;IAC5K,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;AAMxE,+mBAA+mB;AAC/mB,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAqB3D;AAED,oPAAoP;AACpP,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BjE;AAED,uOAAuO;AACvO,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,oBAAoB,GAAG,SAAS,CASlC"}
+{"version":3,"file":"gate-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-ledger.ts"],"names":[],"mappings":"AA4CA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAY3F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,yHAAyH;IACzH,UAAU,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,oLAAoL;IACpL,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;AAMxE,+mBAA+mB;AAC/mB,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAqB3D;AAED,oPAAoP;AACpP,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BjE;AAED,uOAAuO;AACvO,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,oBAAoB,GAAG,SAAS,CASlC"}

package/dist/terraform/adopt-state.d.ts

@@ -4,81 +4,32 @@
  * a TF resource is created through the provider API, not CloudFormation, so it
  * is not in any CFN stack — but its resolved attributes ARE in the state file.
  *
- * chant AWS constructors take CloudFormation PascalCase properties (e.g.
- * `new Bucket({ BucketName })`), while Terraform state uses the provider's
- * snake_case attributes (`bucket`, `tags`). The mapping is driven by the single
- * AWS carve-out table (`aws-resources.ts`) — the same table the advisor's tier
- * map derives from, so every AWS type advise ranks can be emitted. Attributes
- * without a mapping are preserved in a reference comment, never dropped.
- *
- * Deferred outbound inputs (#998): an attribute whose value the Terraform
- * source read from a survivor (`vpc_id = aws_vpc.main.id`) is not a fact of
- * the carved resource — it is a deploy-time input. Those props are emitted as
- * `params.<name>` references instead of frozen literals, with the state's
- * resolved value as the declared default (see `carve-emit.ts`'s scaffold).
+ * The mapping itself belongs to the carve provider that owns the Terraform type
+ * (`carve-provider.ts`, #2016) — aws maps snake_case provider attributes to
+ * CloudFormation PascalCase props over the AWS carve-out table. This module is
+ * the dispatch: it resolves the provider and hands off. A new provider adds a
+ * file under `providers/`, never an edit here.
  */
+import { type AdoptedSource, type DeferredParam } from "./carve-provider.js";
 import type { StateResource } from "./state.js";
-/** The core subpath the emitted source reads build parameters from. */
-export declare const PARAMS_IMPORT = "@intentius/chant/params";
-/**
- * One deferred outbound input turned into a build parameter (#998). Derived
- * from the boundary report's outbound edges + the state's resolved attributes
- * in `carve-emit.ts`; consumed here (source substitution) and by the scaffold
- * (`chant.config.ts` `buildParams` declaration).
- */
-export interface DeferredParam {
-    /** Build-parameter name, source-referenceable (`params.<name>`). */
-    name: string;
-    /** The carved resource's own Terraform attribute the value enters through. */
-    tfAttr: string;
-    /** The survivor the Terraform source read, e.g. `aws_vpc.main`. */
-    survivor: string;
-    /** Survivor attribute(s) read, e.g. `["id"]`. */
-    attrs: string[];
-    /** The state-resolved value — the parameter's declared default. */
-    default?: string | number | boolean;
-}
-/** What one folded sub-resource contributed to the parent's emitted props (#1637). */
-export interface FoldedContribution {
-    /** The sub-resource's Terraform address, e.g. `aws_s3_bucket_versioning.assets`. */
-    address: string;
-    /** CFN properties it added to the parent, e.g. `["VersioningConfiguration"]`. */
-    props: string[];
-}
-export interface AdoptedSource {
-    fileName: string;
-    content: string;
-    /** True when at least one attribute was mapped to a native prop. */
-    mapped: boolean;
-    nativeType: string;
-    /** Deferred params actually substituted into the emitted props (#998). */
-    parameterized: string[];
-    /** Folded sub-resources and the props each one joined into the parent (#1637). */
-    folded: FoldedContribution[];
-}
+export { PARAMS_IMPORT } from "./emit-source.js";
+export type { AdoptedSource, DeferredParam, FoldedContribution } from "./carve-provider.js";
 /**
- * Is this Terraform type adoptable from state (has a native constructor)? The
- * same table gates the live path, so both are the shared `canCarveEmit`.
+ * Is this Terraform type adoptable from state (a provider emits it)? The same
+ * gate serves the live path, so both are the shared `canCarveEmit`.
  */
 export declare function canAdoptFromState(tfType: string): boolean;
 /** Terraform types that can currently be adopted from state, for user-facing hints. */
 export declare function supportedStateAdoptionTypes(): string[];
 /**
- * Render chant source for a state-adopted resource. Emits the native
- * constructor with mapped properties, plus a reference comment listing the
- * Terraform attributes that were not mapped so nothing is silently dropped.
- *
- * A mapped attribute named by a `DeferredParam` renders as a `params.<name>`
- * reference (a real chant build parameter) instead of the state literal —
- * the value came from a survivor, so it stays overridable per build.
+ * Render chant source for a state-adopted resource, through the provider that
+ * owns its Terraform type. `params` carries the deferred outbound inputs the
+ * boundary report found (#998) and `folded` the carve set's sub-resources read
+ * from the same state file (#1637); what a provider does with them is its own
+ * business, and both are reported back on the {@link AdoptedSource}.
  *
- * `folded` carries the carve set's sub-resources (`aws_s3_bucket_versioning`
- * and friends), read from the same state file. Their mappable attributes join
- * the parent's props (#1637) — a fold that only announced itself and left the
- * emitted resource without the versioning or public-access block the Terraform
- * declared was a silent loss of configuration. A sub-resource's setting wins
- * over the parent's own legacy in-state block: it is the one the config
- * actually declares.
+ * Null means no registered provider emits this type — the caller has already
+ * refused it at the emit gate, so this is the belt-and-braces path.
  */
 export declare function adoptFromState(resource: StateResource, params?: DeferredParam[], folded?: StateResource[]): AdoptedSource | null;
 //# sourceMappingURL=adopt-state.d.ts.map

package/dist/terraform/adopt-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adopt-state.d.ts","sourceRoot":"","sources":["../../src/terraform/adopt-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAUH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,uEAAuE;AACvE,eAAO,MAAM,aAAa,4BAA4B,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CACrC;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kFAAkF;IAClF,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,uFAAuF;AACvF,wBAAgB,2BAA2B,IAAI,MAAM,EAAE,CAEtD;AAUD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,aAAa,EACvB,MAAM,GAAE,aAAa,EAAO,EAC5B,MAAM,GAAE,aAAa,EAAO,GAC3B,aAAa,GAAG,IAAI,CAoEtB"}
+{"version":3,"file":"adopt-state.d.ts","sourceRoot":"","sources":["../../src/terraform/adopt-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAuB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEzF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,uFAAuF;AACvF,wBAAgB,2BAA2B,IAAI,MAAM,EAAE,CAEtD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,aAAa,EACvB,MAAM,GAAE,aAAa,EAAO,EAC5B,MAAM,GAAE,aAAa,EAAO,GAC3B,aAAa,GAAG,IAAI,CAGtB"}

package/dist/terraform/aws-resources.d.ts

@@ -37,7 +37,7 @@ export declare const AWS_LEXICON_IMPORT = "@intentius/chant-lexicon-aws";
 export declare const AWS_CARVE_TYPES: AwsCarveType[];
 export declare function awsCarveType(tfType: string): AwsCarveType | undefined;
 /**
- * How a folded sub-resource (see `FOLDS_INTO`) joins its parent's emitted
+ * How a folded sub-resource (see the provider's `foldsInto`) joins its parent's emitted
  * properties (#1637). Terraform splits configuration the CloudFormation shape
  * keeps inside the parent resource, so the fold is not just a carve-set
  * membership claim: the sub-resource's attributes have to land in the parent's

package/dist/terraform/carve-provider.d.ts

@@ -0,0 +1,142 @@
+/**
+ * The carve provider seam (#2016).
+ *
+ * `carve advise|emit|bridge` used to reach into the AWS carve table directly:
+ * the tier map derived from it, the emit gate was `awsCarveType(t) !== undefined`,
+ * the adopter called `applyAwsMapper`, and the emitted project's lexicon was a
+ * constant. A second provider — Kubernetes emit (#999), GCP (#2017) — had
+ * nowhere to land except a parallel path beside the AWS one.
+ *
+ * A provider owns one or more Terraform type prefixes and answers everything
+ * the carve commands ask about the types under them: how each ranks against a
+ * native spec, which HCL attribute carries the physical name, which
+ * sub-resources fold into a parent, which types emit can produce source for,
+ * and how to adopt one from `.tfstate`.
+ *
+ * ── Why the registry lives in core, not behind a `LexiconPlugin` capability ──
+ *
+ * `carve advise` runs against a Terraform directory that is not a chant project:
+ * there is no `chant.config.ts` naming lexicons, so there is nothing to load
+ * plugins from, and `carve emit --state` is deliberately offline (see the
+ * handler). Behind a plugin capability both would have to load plugins to learn
+ * that a type ranks tier 1. Providers are also Terraform-provider knowledge
+ * (`terraform-provider-aws` attribute names), which belongs beside the HCL
+ * parser rather than inside a lexicon.
+ *
+ * `registerCarveProvider` is exported, so a plugin that wants to contribute a
+ * provider at runtime still can — the seam does not foreclose it, it just does
+ * not require plugin loading for the paths that run without one.
+ */
+import type { StateResource } from "./state.js";
+export interface TierInfo {
+    tier: 1 | 2 | 3;
+    /** The native spec type a carve would target, for the report. */
+    mapsTo: string;
+}
+/**
+ * One deferred outbound input turned into a build parameter (#998). Derived
+ * from the boundary report's outbound edges + the state's resolved attributes
+ * in `carve-emit.ts`; consumed by a provider's `adopt` (source substitution)
+ * and by the scaffold (`chant.config.ts` `buildParams` declaration).
+ */
+export interface DeferredParam {
+    /** Build-parameter name, source-referenceable (`params.<name>`). */
+    name: string;
+    /** The carved resource's own Terraform attribute the value enters through. */
+    tfAttr: string;
+    /** The survivor the Terraform source read, e.g. `aws_vpc.main`. */
+    survivor: string;
+    /** Survivor attribute(s) read, e.g. `["id"]`. */
+    attrs: string[];
+    /** The state-resolved value — the parameter's declared default. */
+    default?: string | number | boolean;
+}
+/** What one folded sub-resource contributed to the parent's emitted props (#1637). */
+export interface FoldedContribution {
+    /** The sub-resource's Terraform address, e.g. `aws_s3_bucket_versioning.assets`. */
+    address: string;
+    /** Native properties it added to the parent, e.g. `["VersioningConfiguration"]`. */
+    props: string[];
+}
+export interface AdoptedSource {
+    fileName: string;
+    content: string;
+    /** True when at least one attribute was mapped to a native prop. */
+    mapped: boolean;
+    nativeType: string;
+    /** Deferred params actually substituted into the emitted props (#998). */
+    parameterized: string[];
+    /** Folded sub-resources and the props each one joined into the parent (#1637). */
+    folded: FoldedContribution[];
+}
+export interface CarveProvider {
+    /** Registry id, unique. Registering a second provider under it replaces the first. */
+    readonly name: string;
+    /**
+     * Terraform type prefixes this provider owns, e.g. `["aws_"]`. Resolution
+     * takes the longest match, so a narrower provider can claim a subset of a
+     * wider one's prefix.
+     */
+    readonly tfTypePrefixes: readonly string[];
+    /**
+     * The chant lexicon emitted source targets — the scaffolded project's
+     * dependency and `--lexicon` flag, and the lexicon the live import runs
+     * against.
+     */
+    readonly lexicon: string;
+    /** Terraform type → native tier, contributed to the advisor's tier map. */
+    readonly tiers: Readonly<Record<string, TierInfo>>;
+    /**
+     * Terraform type → the HCL attribute carrying the physical name. A dotted
+     * entry is a path into nested blocks (`manifest.metadata.name`); the bridge
+     * refuses those, since a data-source body is flat `attr = value`.
+     */
+    readonly identityAttrs?: Readonly<Record<string, string>>;
+    /**
+     * Sub-resource Terraform type → parent type, for types Terraform splits out
+     * of the resource the native spec keeps them in.
+     */
+    readonly foldsInto?: Readonly<Record<string, string>>;
+    /**
+     * Terraform types `carve emit` can produce chant source for — narrower than
+     * `tiers`, which advise also ranks types no emit path can adopt. Absent or
+     * empty means advise-only. Declaring types here obliges the provider to
+     * implement {@link adopt}: both emit paths gate on the same list (#2015), so
+     * a type the live path accepts must be adoptable from state too.
+     */
+    readonly emitTypes?: readonly string[];
+    /** Adopt a resource from Terraform state into chant source. */
+    adopt?(resource: StateResource, params: DeferredParam[], folded: StateResource[]): AdoptedSource | null;
+    /**
+     * The native selector type the live (cloud→code) import filters on, e.g.
+     * `AWS::S3::Bucket`. Undefined when this type has no live adoption path —
+     * `carve emit --env` refuses it rather than importing the wrong thing.
+     */
+    liveSelectorType?(tfType: string): string | undefined;
+}
+/**
+ * Register a carve provider. Returns a function that removes it again, so a
+ * test (or a plugin unloading) leaves the registry as it found it.
+ */
+export declare function registerCarveProvider(provider: CarveProvider): () => void;
+/** Every registered provider, in registration order. */
+export declare function carveProviders(): readonly CarveProvider[];
+/** The provider owning this Terraform type, by longest prefix match. */
+export declare function resolveCarveProvider(tfType: string): CarveProvider | undefined;
+/**
+ * The provider that can emit chant source for this Terraform type. Narrower
+ * than {@link resolveCarveProvider}: a provider owns every type under its
+ * prefix for advise, and only the ones on its `emitTypes` list for emit.
+ */
+export declare function resolveEmitProvider(tfType: string): CarveProvider | undefined;
+/** Every Terraform type any registered provider can emit, sorted, for user-facing hints. */
+export declare function carveEmitTypes(): string[];
+/** The lexicons emit can adopt into, sorted — what the CLI loads plugins for. */
+export declare function carveEmitLexicons(): string[];
+/** Terraform resource type → native tier, merged over every provider. Read-only: it is the cached index. */
+export declare function carveTierMap(): Readonly<Record<string, TierInfo>>;
+/** The HCL attribute carrying this type's physical name, if its provider declares one. */
+export declare function carveIdentityAttr(tfType: string): string | undefined;
+/** The parent Terraform type this sub-resource folds into, if any. */
+export declare function carveFoldParent(tfType: string): string | undefined;
+//# sourceMappingURL=carve-provider.d.ts.map

package/dist/terraform/carve-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"carve-provider.d.ts","sourceRoot":"","sources":["../../src/terraform/carve-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CACrC;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,kFAAkF;IAClF,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,+DAA+D;IAC/D,KAAK,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC;IACxG;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACvD;AAqBD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,IAAI,CAYzE;AAED,wDAAwD;AACxD,wBAAgB,cAAc,IAAI,SAAS,aAAa,EAAE,CAEzD;AAmCD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE7E;AAED,4FAA4F;AAC5F,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAEzC;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAE5C;AAED,4GAA4G;AAC5G,wBAAgB,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAEjE;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAElE"}

package/dist/terraform/carve.d.ts

@@ -10,6 +10,7 @@
  * (via live import) and generating the TF patches live in the command/bridge
  * layers; this module just classifies the boundary.
  */
+import { type ScoreOptions } from "./score.js";
 import type { TfGraph } from "./types.js";
 /** One resource in the carve set (the selected node plus its folded sub-resources). */
 export interface CarveMember {
@@ -47,8 +48,17 @@ export interface BoundaryEdge {
      * named after on emit. For an output edge it is `["value"]`.
      */
     via: string[];
-    bridge: "tf-data-source" | "tf-output-rewrite" | "deferred-input";
+    /**
+     * The patch that bridges the cut, in the surviving source's own vocabulary.
+     * Terraform: a `data` source, an `output` expression rewrite, or a deferred
+     * deploy-time input. CDK (#1056): `cdk-import` — the surviving app reimports
+     * the carved resource by ARN/name — or a `Outputs` rewrite. Open-ended: a
+     * reader must tolerate a value it does not know.
+     */
+    bridge: "tf-data-source" | "tf-output-rewrite" | "cdk-import" | "cfn-output-rewrite" | "deferred-input";
     required: "immediately" | "at-apply";
+    /** The two ends live in different CloudFormation templates (#1056). */
+    crossStack?: boolean;
 }
 export interface CarveReport {
     /** The selected resource address. */
@@ -64,20 +74,43 @@ export interface CarveReport {
 }
 /**
  * The carve set for a selected address: the node itself plus any sub-resources
- * that fold into it (same name, a `FOLDS_INTO` child type whose parent is the
+ * that fold into it (same name, a `foldParentOf` child type whose parent is the
  * selection). Those are carried along and inlined, not left behind.
  */
 export declare function resolveCarveSet(graph: TfGraph, target: string): CarveMember[];
+/**
+ * Which source the graph came from, and so which vocabulary its bridge patches
+ * are named in. Terraform is the default; `cdk` is the read-only cloud-assembly
+ * advisor (#1056), where the surviving app reimports rather than adding a
+ * `data` source.
+ */
+export type CarveDialect = "terraform" | "cdk";
+export interface BoundaryOptions {
+    dialect?: CarveDialect;
+    /** Scoring hooks, so `peelability` is the same number the ranking reported. */
+    score?: ScoreOptions;
+}
 /**
  * Classify the boundary of carving `target`: the inbound edges that need an
  * immediate data-source patch, and the outbound edges that become deferred
  * deploy-time inputs. Edges internal to the carve set (e.g. a folded
  * sub-resource pointing at its parent) are not boundary work.
  */
-export declare function boundaryReport(graph: TfGraph, target: string): CarveReport | null;
+export declare function boundaryReport(graph: TfGraph, target: string, opts?: BoundaryOptions): CarveReport | null;
 /**
  * The build-parameter name a deferred input's carrying attribute becomes on
  * emit (#998) — shared so bridge notes and emitted `buildParams` agree.
  */
 export declare function deferredParamName(tfAttr: string): string;
+/**
+ * Collapse duplicate edges (same survivor/carved pair), merging attrs.
+ *
+ * The map key below joins the two addresses with U+001F (unit separator).
+ * A Terraform address is built from HCL identifiers plus `.`, `[`, `]`, `"`
+ * and `-`; it cannot contain a C0 control character, so U+001F can never
+ * collide with an address component. Keep it that way — this key is never
+ * serialized, so a plain, non-printing separator is fine, but it must stay
+ * a character no address can produce.
+ */
+export declare function dedupeEdges(edges: BoundaryEdge[]): BoundaryEdge[];
 //# sourceMappingURL=carve.d.ts.map

package/dist/terraform/carve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"carve.d.ts","sourceRoot":"","sources":["../../src/terraform/carve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,UAAU,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,MAAM,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,gBAAgB,CAAC;IAClE,QAAQ,EAAE,aAAa,GAAG,UAAU,CAAC;CACtC;AAED,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iFAAiF;IACjF,UAAU,EAAE,IAAI,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CAgB7E;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAkDjF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD"}
+{"version":3,"file":"carve.d.ts","sourceRoot":"","sources":["../../src/terraform/carve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,UAAU,CAAC;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;;;;;;OAMG;IACH,MAAM,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,YAAY,GAAG,oBAAoB,GAAG,gBAAgB,CAAC;IACxG,QAAQ,EAAE,aAAa,GAAG,UAAU,CAAC;IACrC,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iFAAiF;IACjF,UAAU,EAAE,IAAI,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CAgB7E;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,KAAK,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAQD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,WAAW,GAAG,IAAI,CA0D7G;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,YAAY,EAAE,CAajE"}

package/dist/terraform/emit-source.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Source rendering shared by constructor-shaped carve providers (#2016).
+ *
+ * A provider that adopts into a typed chant constructor call — aws today, gcp
+ * next (#2017) — renders the same literal: an import, an exported `new Ctor({
+ * ...props })`, and a reference comment carrying whatever the mapping could not
+ * place. Only the lexicon import path and the property mapping differ, so the
+ * rendering lives here rather than being copied per provider.
+ *
+ * A provider whose native shape is not a constructor call (a Kubernetes
+ * manifest, #999) renders its own source and does not use this.
+ */
+/** The core subpath the emitted source reads build parameters from. */
+export declare const PARAMS_IMPORT = "@intentius/chant/params";
+/** Marker for a prop whose value is a `params.<name>` reference, not a literal. */
+export declare class ParamRef {
+    readonly name: string;
+    readonly type: "string" | "number" | "boolean";
+    constructor(name: string, type: "string" | "number" | "boolean");
+}
+/** Render a JS object literal with stable key order and given indent. */
+export declare function renderObject(obj: Record<string, unknown>, indent: number): string;
+/** A prop value: a `params.<name>` reference (cast keeps the project tsc-clean) or a literal. */
+export declare function renderValue(value: unknown): string;
+//# sourceMappingURL=emit-source.d.ts.map

package/dist/terraform/emit-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit-source.d.ts","sourceRoot":"","sources":["../../src/terraform/emit-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,uEAAuE;AACvE,eAAO,MAAM,aAAa,4BAA4B,CAAC;AAEvD,mFAAmF;AACnF,qBAAa,QAAQ;IAEjB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;gBADrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;CAEjD;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQjF;AAED,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAElD"}

package/dist/terraform/graduate.d.ts

@@ -25,8 +25,10 @@ export declare const DEFAULT_TAG_OWNERSHIP_KEYS: ChannelKeys;
 export interface GraduationPlan {
     target: string;
     marker: OwnershipMarker;
-    /** The ownership tags the emitted resource must carry to be chant-owned. */
+    /** The ownership entries the emitted resource must carry to be chant-owned. */
     ownershipTags: Record<string, string>;
+    /** What that channel is called on this target: `tags`, or `labels` for k8s. */
+    markerKind: string;
     /** The finalized, ordered apply runbook. */
     steps: string[];
     warnings: string[];
@@ -38,6 +40,14 @@ export interface GraduationOptions {
     env?: string;
     /** Override the tag channel (e.g. for a non-AWS lexicon). */
     channel?: ChannelKeys;
+    /**
+     * The lexicon the emitted source targets, from the carve provider that
+     * adopted the type. It decides how the build and the apply are spelled: a
+     * CloudFormation template and `aws cloudformation deploy` for aws, a manifest
+     * and `kubectl apply` for k8s (#999). Unknown falls back to the aws wording,
+     * which is what every carve was before there was a second provider.
+     */
+    lexicon?: string;
 }
 export declare function graduationPlan(report: CarveReport, opts?: GraduationOptions): GraduationPlan;
 /**

package/dist/terraform/graduate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graduate.d.ts","sourceRoot":"","sources":["../../src/terraform/graduate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAoB,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAIxC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,eAAe,CAAC;IACxB,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,4CAA4C;IAC5C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,OAAO,CAAC,EAAE,WAAW,CAAC;CACvB;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,GAAE,iBAAsB,GAAG,cAAc,CA2BhG;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAoC9C"}
+{"version":3,"file":"graduate.d.ts","sourceRoot":"","sources":["../../src/terraform/graduate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAA0C,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAC9G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAIxC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,eAAe,CAAC;IACxB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA6BD,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,GAAE,iBAAsB,GAAG,cAAc,CA4BhG;AAWD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAqC9C"}

package/dist/terraform/providers/aws.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The AWS carve provider (#2016) — the seam's implementation over the AWS
+ * carve-out table (`../aws-resources.ts`), which stays the single source of
+ * truth for which AWS Terraform types chant can carve and how.
+ *
+ * chant AWS constructors take CloudFormation PascalCase properties (e.g.
+ * `new Bucket({ BucketName })`), while Terraform state uses the provider's
+ * snake_case attributes (`bucket`, `tags`). Attributes without a mapping are
+ * preserved in a reference comment, never dropped.
+ *
+ * Deferred outbound inputs (#998): an attribute whose value the Terraform
+ * source read from a survivor (`vpc_id = aws_vpc.main.id`) is not a fact of
+ * the carved resource — it is a deploy-time input. Those props are emitted as
+ * `params.<name>` references instead of frozen literals, with the state's
+ * resolved value as the declared default (see `carve-emit.ts`'s scaffold).
+ */
+import type { CarveProvider } from "../carve-provider.js";
+export declare const awsCarveProvider: CarveProvider;
+//# sourceMappingURL=aws.d.ts.map

package/dist/terraform/providers/aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/terraform/providers/aws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAWH,OAAO,KAAK,EAAiB,aAAa,EAA+C,MAAM,mBAAmB,CAAC;AAgInH,eAAO,MAAM,gBAAgB,EAAE,aAc9B,CAAC"}

package/dist/terraform/providers/gcp.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The GCP carve provider (#2017) — advise-only.
+ *
+ * `mapsTo` names a Config Connector type as the gcp lexicon spells it
+ * (`GCP::Storage::Bucket`), not a Terraform type and not a raw CNRM kind. Every
+ * value here is checked against `lexicons/gcp/dist/meta.json` by
+ * `gcp.test.ts`, so an entry pointing at a type the lexicon does not define
+ * fails the suite rather than shipping a report that promises a resource chant
+ * cannot build.
+ *
+ * The google Terraform provider and Config Connector wrap the same GCP API, so
+ * resource granularity matches almost everywhere. That is why `foldsInto` is
+ * empty: unlike S3, where Terraform splits versioning, ACLs and encryption out
+ * of the bucket CloudFormation keeps together, GCP has no family where several
+ * `google_*` resources collapse into one CNRM resource.
+ *
+ * Tiers follow the reshaping the constructor demands, not the API's size:
+ *
+ *   1 — flat rename, `google_pubsub_topic` to `GCP::Pubsub::Topic`.
+ *   2 — a cross-resource reference becomes a `*Ref` object, or a Terraform
+ *       block list becomes a CNRM object. Most of the table.
+ *   3 — the native shape is a re-modelling. `google_container_cluster` inlines
+ *       node pools Terraform also declares separately, `google_sql_database_
+ *       instance` carries everything under `settings`, and the IAM membership
+ *       resources map onto one generic `GCP::Iam::PolicyMember` per binding.
+ *
+ * No `emitTypes` and no `adopt`, so `carve emit` refuses these types on both
+ * paths with the same message (#2015). Emit is a larger piece of work than the
+ * per-attribute rename the tier map implies: CNRM addresses a sibling through
+ * a `*Ref` object rather than the id or self-link Terraform state holds, and
+ * the resource's own name lives in `metadata.name` with `resourceID` as the
+ * override, so a faithful adopter has to resolve both per type. Declaring emit
+ * before that exists would put back the advise/emit cliff #2015 closed.
+ */
+import type { CarveProvider, TierInfo } from "../carve-provider.js";
+/** Terraform type → tier, the shape the registry merges into the tier map. */
+export declare const GCP_TIERS: Readonly<Record<string, TierInfo>>;
+/** Terraform type → the HCL attribute carrying its physical name. */
+export declare const GCP_IDENTITY_ATTRS: Readonly<Record<string, string>>;
+export declare const gcpCarveProvider: CarveProvider;
+//# sourceMappingURL=gcp.d.ts.map

package/dist/terraform/providers/gcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../../src/terraform/providers/gcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAiRjE,8EAA8E;AAC9E,eAAO,MAAM,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAExD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/D,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,aAQ9B,CAAC"}

package/dist/terraform/providers/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The carve providers core ships with (#2016). Adding a provider is a file
+ * here plus a line in this list — no edit to `adopt-state.ts` or
+ * `carve-emit.ts`, which resolve everything through the registry.
+ *
+ * This module holds no runtime dependency on `../carve-provider`, so the
+ * registry can import the list without an import cycle.
+ */
+import { awsCarveProvider } from "./aws.js";
+import { gcpCarveProvider } from "./gcp.js";
+import { kubernetesCarveProvider } from "./kubernetes.js";
+import type { CarveProvider } from "../carve-provider.js";
+export declare const BUILTIN_CARVE_PROVIDERS: readonly CarveProvider[];
+export { awsCarveProvider, gcpCarveProvider, kubernetesCarveProvider };
+//# sourceMappingURL=index.d.ts.map

package/dist/terraform/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/terraform/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,eAAO,MAAM,uBAAuB,EAAE,SAAS,aAAa,EAI3D,CAAC;AAEF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/terraform/providers/kubernetes.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The Kubernetes carve provider (#2016 seam, #999 emit).
+ *
+ * `kubernetes_manifest` IS the manifest (tier 1) and is the type emit adopts.
+ * The typed provider resources (`kubernetes_deployment`, ...) reshape their HCL
+ * schema back into a manifest, so they rank tier 2; the common `_v1` aliases
+ * share their base type's entry. They are advise-only: recovering a manifest
+ * from the provider's own schema is a per-type reshaping (`container` blocks to
+ * `containers`, `metadata` blocks unwrapped from their single-element state
+ * arrays), not something the generic path below can do honestly, so emit
+ * refuses them on both paths with the same message (#2015).
+ *
+ * ── Two things `kubernetes_manifest` does not share with an AWS type ──
+ *
+ * It has no fixed entity type. The target kind lives INSIDE the resource: the
+ * `manifest` attribute is the body, and its `apiVersion`/`kind` are what say
+ * whether this block is a ConfigMap or a cert-manager Certificate. So `mapsTo`
+ * can only name the family, and `adopt` reads the body to learn the rest —
+ * which is also why one rule here covers every CRD.
+ *
+ * It has no live adoption path. `carve emit --env` filters a live export by a
+ * native type, and there is no type to filter by until the body is read; state
+ * is where the body is. `liveSelectorType` therefore returns undefined and
+ * `--env` refuses with "adopts it from state only", rather than importing
+ * something else.
+ */
+import type { CarveProvider } from "../carve-provider.js";
+export declare const kubernetesCarveProvider: CarveProvider;
+//# sourceMappingURL=kubernetes.d.ts.map

package/dist/terraform/providers/kubernetes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes.d.ts","sourceRoot":"","sources":["../../../src/terraform/providers/kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAiB,aAAa,EAA2B,MAAM,mBAAmB,CAAC;AAuL/F,eAAO,MAAM,uBAAuB,EAAE,aAarC,CAAC"}