@intentius/chant 0.52.2 → 0.53.1

package/src/cli/commands/carve-emit-provider.test.ts

@@ -0,0 +1,207 @@
+import { describe, test, expect, vi, afterEach } from "vitest";
+import { mkdtempSync, writeFileSync, rmSync, readFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { carveEmit, formatCarveEmit } from "./carve-emit";
+import { loadHcl2json } from "../../terraform/parse";
+import { registerCarveProvider, type CarveProvider } from "../../terraform/carve-provider";
+import type { ImportResult, LiveImportOptions } from "./import";
+import type { LexiconPlugin } from "../../lexicon";
+
+/**
+ * The carve provider seam (#2016), driven end to end by a provider core has
+ * never heard of. Nothing in `carve-emit.ts` or `adopt-state.ts` mentions
+ * `fake_`, `fakelex` or `fake:Widget` — if emit can carry this estate to
+ * emitted source, a scaffolded project and a live selector, then adding a real
+ * provider (#999 kubernetes, #2017 gcp) is a file under `terraform/providers/`.
+ */
+let parserAvailable = false;
+try {
+  await loadHcl2json();
+  parserAvailable = true;
+} catch {
+  parserAvailable = false;
+}
+
+const ESTATE = `
+resource "fake_widget" "hero" { widget_name = "hero-widget" }
+resource "fake_widget_setting" "hero" {
+  widget = fake_widget.hero.id
+  colour = "blue"
+}
+resource "fake_consumer" "reader" { widget = fake_widget.hero.id }
+resource "fake_gizmo" "spare" { size = 3 }
+`;
+
+const TFSTATE = JSON.stringify({
+  version: 4,
+  resources: [
+    {
+      mode: "managed",
+      type: "fake_widget",
+      name: "hero",
+      instances: [{ attributes: { id: "hero-widget", widget_name: "hero-widget" } }],
+    },
+    {
+      mode: "managed",
+      type: "fake_widget_setting",
+      name: "hero",
+      instances: [{ attributes: { id: "hero-widget", colour: "blue" } }],
+    },
+  ],
+});
+
+/** A provider with an emit path: adopt from state, and a live selector type. */
+const fakeProvider: CarveProvider = {
+  name: "test-fake-emit",
+  tfTypePrefixes: ["fake_"],
+  lexicon: "fakelex",
+  tiers: {
+    fake_widget: { tier: 1, mapsTo: "fake:Widget" },
+    fake_widget_setting: { tier: 2, mapsTo: "fake:WidgetSetting" },
+    fake_gizmo: { tier: 2, mapsTo: "fake:Gizmo" },
+  },
+  identityAttrs: { fake_widget: "widget_name" },
+  foldsInto: { fake_widget_setting: "fake_widget" },
+  emitTypes: ["fake_widget"],
+  adopt: (resource, params, folded) => ({
+    fileName: `${resource.name}.widget.ts`,
+    content: `// fake provider adopted ${resource.type}.${resource.name}\nexport const ${resource.name} = "${resource.attributes.widget_name}";\n`,
+    mapped: true,
+    nativeType: "fake:Widget",
+    parameterized: params.map((p) => p.name),
+    folded: folded.map((f) => ({ address: `${f.type}.${f.name}`, props: ["Colour"] })),
+  }),
+  liveSelectorType: (tfType) => (tfType === "fake_widget" ? "fake:Widget" : undefined),
+};
+
+/** Same provider, state-only: no live adoption path at all. */
+const stateOnlyProvider: CarveProvider = {
+  ...fakeProvider,
+  name: "test-fake-state-only",
+  liveSelectorType: undefined,
+};
+
+const fakeImport = () =>
+  vi.fn(
+    async (_plugins: LexiconPlugin[], _options: LiveImportOptions): Promise<ImportResult> => ({
+      success: true,
+      generatedFiles: ["infra/hero.ts"],
+      warnings: [],
+    }),
+  );
+
+let dispose: (() => void) | undefined;
+afterEach(() => {
+  dispose?.();
+  dispose = undefined;
+});
+
+async function withEstate<T>(fn: (dir: string) => Promise<T>): Promise<T> {
+  const dir = mkdtempSync(join(tmpdir(), "chant-carve-provider-"));
+  try {
+    writeFileSync(join(dir, "main.tf"), ESTATE);
+    writeFileSync(join(dir, "terraform.tfstate"), TFSTATE);
+    return await fn(dir);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+describe("carve emit through a registered provider (#2016)", () => {
+  test("without a provider the type is unknown to advise and refused by emit", async () => {
+    if (!parserAvailable) return;
+    await withEstate(async (dir) => {
+      const res = await carveEmit(
+        { from: dir, select: "fake_widget.hero", statePath: join(dir, "terraform.tfstate") },
+        { plugins: [], liveImport: fakeImport() },
+      );
+      expect(res.ok).toBe(false);
+      expect(res.error).toMatch(/no known native mapping/i);
+    });
+  });
+
+  test("--state emits through the provider and scaffolds for its lexicon", async () => {
+    if (!parserAvailable) return;
+    dispose = registerCarveProvider(fakeProvider);
+    await withEstate(async (dir) => {
+      const out = join(dir, "carveout");
+      const liveImport = fakeImport();
+      const res = await carveEmit(
+        { from: dir, select: "fake_widget.hero", statePath: join(dir, "terraform.tfstate"), output: out },
+        { plugins: [], liveImport },
+      );
+
+      expect(res.ok).toBe(true);
+      expect(res.source).toBe("tfstate");
+      expect(liveImport).not.toHaveBeenCalled();
+
+      // The provider named the file and wrote the content; core wrote it out.
+      expect(res.emittedFiles).toEqual([join(out, "src", "hero.widget.ts")]);
+      expect(readFileSync(res.emittedFiles![0], "utf-8")).toContain("fake provider adopted fake_widget.hero");
+
+      // The scaffold targets the provider's lexicon, not a hardcoded aws.
+      const pkg = JSON.parse(readFileSync(join(out, "package.json"), "utf-8"));
+      expect(pkg.scripts.build).toBe("chant build src --lexicon fakelex");
+      expect(Object.keys(pkg.dependencies)).toEqual(["@intentius/chant", "@intentius/chant-lexicon-fakelex"]);
+      expect(readFileSync(join(out, "chant.config.ts"), "utf-8")).toContain('lexicons: ["fakelex"]');
+
+      // The provider's foldsInto drove the carve set, so the setting folded in.
+      expect(res.folded).toEqual([{ address: "fake_widget_setting.hero", props: ["Colour"] }]);
+      expect(formatCarveEmit(res)).toContain("fake_widget_setting.hero (Colour)");
+      // And its identityAttrs gave the graph the physical name.
+      expect(res.report!.inbound.map((e) => e.survivor)).toEqual(["fake_consumer.reader"]);
+    });
+  });
+
+  test("--env uses the provider's live selector type and lexicon", async () => {
+    if (!parserAvailable) return;
+    dispose = registerCarveProvider(fakeProvider);
+    await withEstate(async (dir) => {
+      const liveImport = fakeImport();
+      const res = await carveEmit(
+        { from: dir, select: "fake_widget.hero", env: "prod" },
+        { plugins: [], liveImport },
+      );
+      expect(res.ok).toBe(true);
+      expect(res.selector).toEqual({ type: "fake:Widget" });
+      expect(liveImport.mock.calls[0][1]).toMatchObject({
+        environment: "prod",
+        selector: { type: "fake:Widget" },
+        lexicon: "fakelex",
+      });
+      expect(formatCarveEmit(res)).toContain("Adopted live as fake:Widget");
+    });
+  });
+
+  test("a ranked type the provider does not emit is refused identically on both paths", async () => {
+    if (!parserAvailable) return;
+    dispose = registerCarveProvider(fakeProvider);
+    await withEstate(async (dir) => {
+      const liveImport = fakeImport();
+      const live = await carveEmit({ from: dir, select: "fake_gizmo.spare", env: "prod" }, { plugins: [], liveImport });
+      const state = await carveEmit(
+        { from: dir, select: "fake_gizmo.spare", statePath: join(dir, "terraform.tfstate") },
+        { plugins: [], liveImport },
+      );
+      expect(live.ok).toBe(false);
+      expect(state.ok).toBe(false);
+      expect(live.error).toBe(state.error);
+      expect(live.error).toContain("fake_gizmo cannot be emitted yet");
+      expect(liveImport).not.toHaveBeenCalled();
+    });
+  });
+
+  test("a state-only provider refuses --env instead of importing the wrong thing", async () => {
+    if (!parserAvailable) return;
+    dispose = registerCarveProvider(stateOnlyProvider);
+    await withEstate(async (dir) => {
+      const liveImport = fakeImport();
+      const res = await carveEmit({ from: dir, select: "fake_widget.hero", env: "prod" }, { plugins: [], liveImport });
+      expect(res.ok).toBe(false);
+      expect(res.error).toContain("no live adoption path");
+      expect(res.error).toContain("--state");
+      expect(liveImport).not.toHaveBeenCalled();
+    });
+  });
+});

package/src/cli/commands/carve-emit.ts

@@ -14,9 +14,11 @@
 
 import { existsSync, statSync, writeFileSync, mkdirSync } from "fs";
 import { basename, join, resolve } from "path";
+import { cdkNotSupported, isCloudAssembly } from "../../cdk/assembly";
 import { parseTerraformDir, Hcl2JsonNotInstalled } from "../../terraform/parse";
 import { boundaryReport, deferredParamName, type CarveReport } from "../../terraform/carve";
-import { canCarveEmit, carveEmitTypes, resolveTier } from "../../terraform/tier-map";
+import { carveEmitTypes, resolveTier } from "../../terraform/tier-map";
+import { resolveEmitProvider } from "../../terraform/carve-provider";
 import { readStateResource, type StateResource } from "../../terraform/state";
 import { writeCarveManifest, type CarveManifest } from "../../terraform/manifest";
 import { adoptFromState, type DeferredParam, type FoldedContribution } from "../../terraform/adopt-state";
@@ -24,14 +26,6 @@ import { getChantVersion } from "./init";
 import type { LexiconPlugin, ResourceSelector } from "../../lexicon";
 import type { ImportResult, LiveImportOptions } from "./import";
 
-/**
- * The lexicon emit targets. `canCarveEmit` admits only AWS carve-table types,
- * so both the scaffolded project and the live import are AWS. Widening this
- * needs the lexicon-agnostic emit seam (#999, #2016) — deriving it from
- * `tier.mapsTo` does not work: a `k8s:Namespace` mapping has no `::` to split.
- */
-const EMIT_LEXICON = "aws";
-
 export interface CarveEmitOptions {
   /** Terraform estate directory (`--from`). */
   from?: string;
@@ -92,6 +86,7 @@ export async function carveEmit(opts: CarveEmitOptions, deps: CarveEmitDeps): Pr
   if (!existsSync(opts.from) || !statSync(opts.from).isDirectory()) {
     return { ok: false, error: `Not a directory: ${opts.from}` };
   }
+  if (isCloudAssembly(opts.from)) return { ok: false, error: cdkNotSupported(opts.from, "emit") };
 
   let report: CarveReport | null;
   let tfType: string | undefined;
@@ -106,23 +101,23 @@ export async function carveEmit(opts: CarveEmitOptions, deps: CarveEmitDeps): Pr
 
   if (!report) return { ok: false, error: `${opts.select} not found in ${opts.from}` };
 
-  const tier = tfType ? resolveTier(tfType) : null;
-  if (!tier) {
+  if (!tfType || !resolveTier(tfType)) {
     return {
       ok: false,
       error: `${opts.select} (${tfType ?? "unknown type"}) has no known native mapping, so it cannot be emitted. Advisor bands it "leave in Terraform".`,
     };
   }
 
-  // `carve advise` ranks every type in the tier map; emit produces source only
-  // for the ones with a native constructor mapping. Both adoption paths refuse
-  // the rest here — before any file is written or any cloud call is made — so
+  // `carve advise` ranks every type a provider declares; emit produces source
+  // only for the ones that provider can adopt. Both adoption paths refuse the
+  // rest here — before any file is written or any cloud call is made — so
   // neither path can proceed on a type the other rejects.
-  if (!canCarveEmit(tfType!)) {
+  const provider = resolveEmitProvider(tfType);
+  if (!provider) {
     return {
       ok: false,
       error:
-        `${tfType} cannot be emitted yet (no native constructor mapping).\n` +
+        `${tfType} cannot be emitted yet (no carve provider adopts it).\n` +
         `Supported types: ${carveEmitTypes().join(", ")}. ` +
         `Coverage is expanding — see chant issue #1001.`,
     };
@@ -156,7 +151,7 @@ export async function carveEmit(opts: CarveEmitOptions, deps: CarveEmitDeps): Pr
     mkdirSync(srcDir, { recursive: true });
     const outPath = join(srcDir, adopted.fileName);
     writeFileSync(outPath, adopted.content);
-    const scaffolded = scaffoldProject(outDir, EMIT_LEXICON, params);
+    const scaffolded = scaffoldProject(outDir, provider.lexicon, params);
 
     const manifestPath = persistManifest(outDir, opts, report, tfType, "tfstate", [outPath], params);
     return {
@@ -172,19 +167,28 @@ export async function carveEmit(opts: CarveEmitOptions, deps: CarveEmitDeps): Pr
   }
 
   // ── Adoption path 2: live import (cloud→code) ──
-  // The live import filters a CloudFormation stack's template by logical ID, not
-  // the Terraform physical name — so select by native type, narrowing to a
-  // logical ID only when the caller passes --live-name (a stack with several of
-  // that type). `identity` (the TF physical name) is not a valid CFN selector.
+  // The provider names the selector type its live export filters on — for aws a
+  // CloudFormation type, filtered by logical ID rather than the Terraform
+  // physical name, so `--live-name` (not `identity`) is what narrows a stack
+  // holding several of that type.
+  const selectorType = provider.liveSelectorType?.(tfType);
+  if (!selectorType) {
+    return {
+      ok: false,
+      error:
+        `${tfType} has no live adoption path — the ${provider.name} carve provider adopts it from state only.\n` +
+        `Re-run with --state <tfstate>.`,
+    };
+  }
   const selector: ResourceSelector = opts.liveName
-    ? { type: tier.mapsTo, name: opts.liveName }
-    : { type: tier.mapsTo };
+    ? { type: selectorType, name: opts.liveName }
+    : { type: selectorType };
 
   const emit = await deps.liveImport(deps.plugins, {
     environment: opts.env!,
     selector,
     output: opts.output,
-    lexicon: EMIT_LEXICON,
+    lexicon: provider.lexicon,
   });
 
   // A failed import emitted no source. Reporting success here would write a

package/src/cli/commands/carve.ts

@@ -1,20 +1,29 @@
 /**
- * `chant carve advise` — the read-only Terraform peelability advisor (#214).
+ * `chant carve advise` — the read-only peelability advisor (#214, #1056).
  *
- * Points at a Terraform estate and reports which resources/modules are cheap to
- * carve into native chant later and which should stay in Terraform. It emits
+ * Points at foreign infrastructure and reports which pieces are cheap to carve
+ * into native chant later and which should stay where they are. It emits
  * nothing, patches nothing, and touches no live resource — pure analysis. The
- * emit/boundary/apply phases stay in #197, gated on demand.
+ * emit/boundary/apply phases (`carve emit|bridge|apply`, #197) read Terraform
+ * only, and refuse a cloud assembly by name.
+ *
+ * Two sources, one report. A Terraform estate is parsed from `.tf`; a CDK cloud
+ * assembly is read from `cdk.out` (#1056). Which one is in `--from` is decided
+ * by looking, not by a second flag: a directory holding `manifest.json` plus a
+ * synthesized `*.template.json` is an assembly. Both produce the same bands,
+ * the same score arithmetic, and the same JSON shape.
  */
 
 import { existsSync, statSync, writeFileSync } from "fs";
+import { adviseCloudAssembly, CDK_DIALECT } from "../../cdk/advise";
+import { isCloudAssembly } from "../../cdk/assembly";
 import { parseTerraformDir, Hcl2JsonNotInstalled } from "../../terraform/parse";
-import { scoreEstate, type Peelability, type PeelabilityBand } from "../../terraform/score";
-import { boundaryReport, type BoundaryEdge } from "../../terraform/carve";
+import { scoreEstate, type Peelability, type PeelabilityBand, type ScoreOptions } from "../../terraform/score";
+import { boundaryReport, type BoundaryEdge, type CarveDialect } from "../../terraform/carve";
 import type { TfGraph } from "../../terraform/types";
 
 export interface CarveAdviseOptions {
-  /** Terraform estate directory (from `--from`). */
+  /** Terraform estate directory or CDK cloud assembly (from `--from`). */
   from?: string;
   /** Opt-in `.tfstate` path (from `--state`): accurate fan-out instance counts. */
   statePath?: string;
@@ -22,10 +31,19 @@ export interface CarveAdviseOptions {
   reportFile?: string;
 }
 
+/**
+ * Which source the ranking came from. Terraform addresses and CDK construct
+ * paths are different namespaces, and the bridge patches have different names,
+ * so a report says which it is rather than leaving a reader to guess from the
+ * shape of an address.
+ */
+export type CarveSource = "terraform" | "cdk";
+
 export interface CarveAdviseResult {
   ok: boolean;
   error?: string;
   from?: string;
+  source?: CarveSource;
   results?: Peelability[];
   /**
    * The parsed dependency graph the scores came from. Kept so the JSON report
@@ -33,37 +51,69 @@ export interface CarveAdviseResult {
    * Not part of the JSON payload — `carveJson` derives from it.
    */
   graph?: TfGraph;
+  /** The hooks the scores were produced with, so the boundary pass agrees. */
+  scoreOptions?: ScoreOptions;
+  /** Anything about the read itself worth saying out loud. */
+  diagnostics?: string[];
 }
 
 const BAND_ORDER: PeelabilityBand[] = ["clean leaf", "carvable w/ edits", "leave in Terraform"];
 
 export async function carveAdvise(opts: CarveAdviseOptions): Promise<CarveAdviseResult> {
   if (!opts.from) {
-    return { ok: false, error: "chant carve advise requires --from <terraform-dir>" };
+    return { ok: false, error: "chant carve advise requires --from <terraform-dir | cdk.out>" };
   }
   if (!existsSync(opts.from) || !statSync(opts.from).isDirectory()) {
     return { ok: false, error: `Not a directory: ${opts.from}` };
   }
+
+  const result = isCloudAssembly(opts.from) ? adviseCdk(opts) : await adviseTerraform(opts);
+  if (result.ok && opts.reportFile) {
+    writeFileSync(opts.reportFile, JSON.stringify(carveJson(result), null, 2));
+  }
+  return result;
+}
+
+/** Rank a CDK cloud assembly. No parser to install, no state file to read. */
+function adviseCdk(opts: CarveAdviseOptions): CarveAdviseResult {
+  if (opts.statePath) {
+    return {
+      ok: false,
+      error:
+        `${opts.from} is a CDK cloud assembly, and --state is a Terraform option. ` +
+        "A synthesized template already carries its own instance counts.",
+    };
+  }
+  try {
+    const advice = adviseCloudAssembly(opts.from!);
+    return {
+      ok: true,
+      from: opts.from,
+      source: "cdk",
+      results: advice.results,
+      graph: advice.graph,
+      scoreOptions: advice.scoreOptions,
+      diagnostics: advice.diagnostics,
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      error: `Failed to read the CDK cloud assembly in ${opts.from}: ${err instanceof Error ? err.message : String(err)}`,
+    };
+  }
+}
+
+async function adviseTerraform(opts: CarveAdviseOptions): Promise<CarveAdviseResult> {
   if (opts.statePath && !existsSync(opts.statePath)) {
     return { ok: false, error: `State file not found: ${opts.statePath}` };
   }
-
-  let graph: TfGraph;
-  let results: Peelability[];
   try {
-    graph = await parseTerraformDir(opts.from, { statePath: opts.statePath });
-    results = scoreEstate(graph);
+    const graph = await parseTerraformDir(opts.from!, { statePath: opts.statePath });
+    return { ok: true, from: opts.from, source: "terraform", results: scoreEstate(graph), graph };
   } catch (err) {
     if (err instanceof Hcl2JsonNotInstalled) return { ok: false, error: err.message };
     return { ok: false, error: `Failed to parse Terraform in ${opts.from}: ${err instanceof Error ? err.message : String(err)}` };
   }
-
-  const result: CarveAdviseResult = { ok: true, from: opts.from, results, graph };
-  if (opts.reportFile) {
-    writeFileSync(opts.reportFile, JSON.stringify(carveJson(result), null, 2));
-  }
-
-  return result;
 }
 
 /**
@@ -81,6 +131,16 @@ export async function carveAdvise(opts: CarveAdviseOptions): Promise<CarveAdvise
  *    not).
  *  - A reader that does not know the version it is handed should refuse the
  *    report rather than half-read it.
+ *
+ * The CDK source (#1056) stays inside that promise and does not bump the
+ * version. Every field an existing reader keys on keeps its type and meaning:
+ * `address` is still an opaque string identifier (a construct path instead of a
+ * Terraform address), `kind` is still `"resource"` or `"module"` (an L3
+ * construct subtree is a Composite candidate, which is what `module` already
+ * means), `score`/`band`/`breakdown` are the same arithmetic. What is new is
+ * additive and ignorable: the top-level `source` discriminator, per-resource
+ * `notes` and `members`, and two more `bridge` values in a list that was
+ * already declared open-ended.
  */
 export const CARVE_REPORT_VERSION = 1;
 
@@ -113,10 +173,23 @@ export interface CarveJsonResource extends Peelability {
 export interface CarveJsonReport {
   version: number;
   from?: string;
+  /**
+   * Which source was read (#1056). `terraform` — addresses are Terraform
+   * addresses, bridges are `data` sources. `cdk` — addresses are construct
+   * paths and bridges are reimports. Absent on a chant that predates the CDK
+   * advisor, which a reader should take as `terraform`.
+   */
+  source: CarveSource;
   advisory: string;
   count: number;
   /** Band name -> how many resources landed in it. */
   bands: Record<string, number>;
+  /**
+   * Anything about the read the scores alone do not say — a missing `tree.json`,
+   * an assembly synthesized from unresolved context lookups. Present only when
+   * there is something to report.
+   */
+  diagnostics?: string[];
   resources: CarveJsonResource[];
 }
 
@@ -126,20 +199,29 @@ export function carveJson(result: CarveAdviseResult): CarveJsonReport {
   const counts = Object.fromEntries(
     BAND_ORDER.map((b) => [b, results.filter((r) => r.band === b).length]),
   );
+  const source = result.source ?? "terraform";
+  const dialect: CarveDialect = source === "cdk" ? CDK_DIALECT : "terraform";
   return {
     version: CARVE_REPORT_VERSION,
     from: result.from,
+    source,
     advisory: "read-only — emits nothing, patches nothing, touches no live resource",
     count: results.length,
     bands: counts,
-    resources: results.map((r) => withBoundary(r, result.graph)),
+    ...(result.diagnostics?.length ? { diagnostics: result.diagnostics } : {}),
+    resources: results.map((r) => withBoundary(r, result.graph, dialect, result.scoreOptions)),
   };
 }
 
 /** A scored resource plus its carve boundary, when the graph is at hand (#1636). */
-function withBoundary(r: Peelability, graph?: TfGraph): CarveJsonResource {
+function withBoundary(
+  r: Peelability,
+  graph: TfGraph | undefined,
+  dialect: CarveDialect,
+  score: ScoreOptions | undefined,
+): CarveJsonResource {
   if (!graph) return r;
-  const report = boundaryReport(graph, r.address);
+  const report = boundaryReport(graph, r.address, { dialect, score });
   if (!report) return r;
   return { ...r, boundary: { inbound: report.inbound, outbound: report.outbound } };
 }
@@ -147,52 +229,73 @@ function withBoundary(r: Peelability, graph?: TfGraph): CarveJsonResource {
 /** Human-readable banded, ranked summary. */
 export function formatCarveReport(result: CarveAdviseResult): string {
   const results = result.results ?? [];
+  const source = result.source ?? "terraform";
+  const cdk = source === "cdk";
+
   if (results.length === 0) {
-    return `No carvable resources found in ${result.from}\n(only data sources, providers, or unsupported types were present).`;
+    return cdk
+      ? `No carvable constructs found in ${result.from}\n(the assembly synthesized no infrastructure beyond CDK's own scaffolding).`
+      : `No carvable resources found in ${result.from}\n(only data sources, providers, or unsupported types were present).`;
   }
 
   const lines: string[] = [];
-  lines.push(`Terraform carve-out advisory for ${result.from}`);
-  lines.push(`  ${results.length} resource(s)/module(s) scored. Advises only — nothing is emitted or changed.`);
+  lines.push(`${cdk ? "CDK cloud-assembly" : "Terraform"} carve-out advisory for ${result.from}`);
+  lines.push(
+    `  ${results.length} ${cdk ? "construct(s)" : "resource(s)/module(s)"} scored. ` +
+      "Advises only — nothing is emitted or changed.",
+  );
+  for (const note of result.diagnostics ?? []) lines.push(`  ! ${note}`);
   lines.push("");
 
   for (const band of BAND_ORDER) {
     const inBand = results.filter((r) => r.band === band);
     if (inBand.length === 0) continue;
-    lines.push(`${bandLabel(band)}  (${inBand.length})`);
+    lines.push(`${bandLabel(band, cdk)}  (${inBand.length})`);
     for (const r of inBand) {
       const target = r.mapsTo ? ` -> ${r.mapsTo}` : "";
       lines.push(`  ${String(r.score).padStart(3)}  ${r.address}${target}`);
-      lines.push(`       ${reasons(r)}`);
+      lines.push(`       ${reasons(r, cdk)}`);
+      for (const note of r.notes ?? []) lines.push(`       ${note}`);
     }
     lines.push("");
   }
 
-  lines.push("Bands: 80-100 carve now | 50-79 carve with boundary edits | 0-49 leave in Terraform");
+  lines.push(
+    `Bands: 80-100 carve now | 50-79 carve with boundary edits | 0-49 leave in ${cdk ? "CDK" : "Terraform"}`,
+  );
   return lines.join("\n").trimEnd();
 }
 
-function bandLabel(band: PeelabilityBand): string {
+function bandLabel(band: PeelabilityBand, cdk: boolean): string {
   switch (band) {
     case "clean leaf":
       return "CLEAN LEAF — carve now";
     case "carvable w/ edits":
       return "CARVABLE — has boundary work";
     case "leave in Terraform":
-      return "LEAVE IN TERRAFORM";
+      // The band's name is part of the JSON contract and does not change per
+      // source; only the heading a person reads does.
+      return cdk ? "LEAVE IN CDK" : "LEAVE IN TERRAFORM";
   }
 }
 
 /** One-line explanation of what drove a score, from its breakdown. */
-function reasons(r: Peelability): string {
+function reasons(r: Peelability, cdk = false): string {
   const b = r.breakdown;
-  if (b.tier === null) return "no known native mapping (unsupported provider/type)";
+  if (b.tier === null) {
+    return cdk ? "no chant AWS lexicon target for this type" : "no known native mapping (unsupported provider/type)";
+  }
+  // A node that scored 0 with every penalty at 0 was disqualified outright, not
+  // scored down. Reciting the arithmetic would credit terms that never applied;
+  // the stated reason follows on the next line.
+  if (r.score === 0 && Object.values(b.penalties).every((p) => p === 0)) return "not carvable as it stands";
   const parts: string[] = [];
-  if (b.inbound) parts.push(`${b.inbound} inbound (data-source patch each)`);
-  if (b.outputs) parts.push(`${b.outputs} output block(s) reading it (one-line rewrite each)`);
+  if (b.inbound) parts.push(`${b.inbound} inbound (${cdk ? "a reimport each" : "data-source patch each"})`);
+  if (b.outputs) parts.push(`${b.outputs} ${cdk ? "stack output(s)" : "output block(s)"} reading it (one-line rewrite each)`);
   if (b.outbound) parts.push(`${b.outbound} outbound (deferred input each)`);
   if (b.tier > 1) parts.push(`tier ${b.tier} map`);
-  if (b.hasDynamic) parts.push("count/for_each/data present");
+  if (b.hasDynamic) parts.push(cdk ? "condition/parameter present" : "count/for_each/data present");
   if (b.instances > 1) parts.push(`${b.instances} instances`);
+  if (b.penalties.asset) parts.push("asset-backed");
   return parts.length ? parts.join(", ") : "clean 1:1 native map, no boundary edges";
 }

package/src/cli/handlers/carve-emit.ts

@@ -1,5 +1,6 @@
 import { carveEmit, formatCarveEmit } from "../commands/carve-emit";
 import { liveImportFromPlugins } from "../commands/import";
+import { carveEmitLexicons, resolveEmitProvider } from "../../terraform/carve-provider";
 import { loadPlugins } from "../plugins";
 import { formatError } from "../format";
 import type { CommandContext } from "../registry";
@@ -16,12 +17,16 @@ export async function runCarveEmit(ctx: CommandContext): Promise<number> {
   const { args } = ctx;
 
   // Load plugins only for the live path; the offline --state path needs none.
-  // aws is the only lexicon emit can adopt into (`canCarveEmit`), so it is the
-  // only one loaded here.
+  // Which lexicon comes from the carve provider seam (#2016), resolved off the
+  // selected address's type without parsing the estate — so a second provider
+  // needs no edit here. A type no provider emits falls back to every lexicon
+  // emit can adopt into, and carveEmit refuses the type properly afterwards.
   let plugins = ctx.plugins;
   if (!args.statePath && args.env) {
+    const tfType = args.selectAddress?.split(".")[0] ?? "";
+    const lexicon = resolveEmitProvider(tfType)?.lexicon;
     try {
-      plugins = await loadPlugins(["aws"]);
+      plugins = await loadPlugins(lexicon ? [lexicon] : carveEmitLexicons());
     } catch {
       // fall through with whatever ctx provided; carveEmit surfaces a clear error
     }