@intentius/chant 0.58.0 → 0.59.0

package/src/terraform/bridge.test.ts

@@ -1,7 +1,8 @@
 import { describe, test, expect } from "vitest";
 import { buildFixtureGraph } from "./__fixtures__/build-graph";
 import { boundaryReport } from "./carve";
-import { generateBridge, type CarvedIdentity } from "./bridge";
+import { generateBridge, type CarvedDataSource } from "./bridge";
+import { dataSourceShapeOf } from "./tier-map";
 import type { Hcl2JsonTree } from "./types";
 
 const workedExample: Hcl2JsonTree = {
@@ -35,8 +36,10 @@ const API_TF = `resource "aws_lambda_function" "api" {
 }
 `;
 
-const identities = new Map<string, CarvedIdentity>([
-  ["aws_s3_bucket.assets", { attr: "bucket", value: "myapp-assets-prod" }],
+// The read-back for the bucket: the shape its identity attribute implies, plus
+// the literal the graph resolved out of the block.
+const identities = new Map<string, CarvedDataSource>([
+  ["aws_s3_bucket.assets", { shape: dataSourceShapeOf("aws_s3_bucket"), values: { bucket: "myapp-assets-prod" } }],
 ]);
 
 describe("generateBridge — inbound (data-source rewrite)", () => {
@@ -51,18 +54,28 @@ describe("generateBridge — inbound (data-source rewrite)", () => {
     );
   });
 
-  test("never renders a dotted identity attribute into the data body (#2015)", () => {
+  test("a type with no shape gets a TODO body, never a dotted attr assignment (#2015)", () => {
     const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
-    const dotted = new Map<string, CarvedIdentity>([
-      ["aws_s3_bucket.assets", { attr: "manifest.metadata.name", value: "demo-config" }],
-    ]);
-    const plan = generateBridge(report, [{ path: "api.tf", content: API_TF }], dotted);
+    // A dotted identity attribute implies no shape at all — `canBridge` refuses
+    // such a type before the bridge runs — but an empty read-back still has to
+    // produce a block Terraform can parse, not `manifest.metadata.name = "x"`.
+    const noShape = new Map<string, CarvedDataSource>([["aws_s3_bucket.assets", {}]]);
+    const plan = generateBridge(report, [{ path: "api.tf", content: API_TF }], noShape);
 
-    // `manifest.metadata.name = "demo-config"` is not valid HCL.
     expect(plan.dataSources[0].hcl).not.toContain("manifest.metadata.name =");
     expect(plan.dataSources[0].hcl).toContain("# TODO: identify the resource");
   });
 
+  test("a shape whose required argument has no literal falls back to the TODO (#2034)", () => {
+    const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
+    const unresolved = new Map<string, CarvedDataSource>([
+      ["aws_s3_bucket.assets", { shape: dataSourceShapeOf("aws_s3_bucket"), values: {} }],
+    ]);
+    const plan = generateBridge(report, [{ path: "api.tf", content: API_TF }], unresolved);
+    // A `data "aws_s3_bucket" "assets" {}` with no `bucket` would not plan.
+    expect(plan.dataSources[0].hcl).toContain("# TODO: identify the resource");
+  });
+
   test("rewrites survivor references to the data source", () => {
     const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
     const plan = generateBridge(report, [{ path: "api.tf", content: API_TF }], identities);

package/src/terraform/bridge.ts

@@ -7,6 +7,9 @@
  *  - inbound edge  → the survivor loses its reference to the carved resource.
  *    Bridge: add a `data` source for the (now chant-managed) resource and
  *    rewrite the survivor's `type.name.attr` references to `data.type.name.attr`.
+ *    The provider's data-source shape (`data-source-shape.ts`, #2034) decides
+ *    both halves — the data type and body, and the attribute path survivors
+ *    read through, which need not be the resource's own.
  *    Required immediately, or `terraform plan` errors on the dangling ref.
  *    An `output` block reading the carved resource is such a survivor (#1638):
  *    same data source, same textual rewrite, applied to the output's value.
@@ -22,18 +25,32 @@
  */
 
 import { deferredParamName, type CarveReport } from "./carve";
+import { rewriteReadPath, type DataSourceShape, type ShapeField } from "./data-source-shape";
 import { exciseResourceBlocks, type ExciseTarget } from "./excise";
 
-export interface CarvedIdentity {
-  /** The HCL identity attribute, e.g. `bucket` or `name`. */
-  attr?: string;
-  /** Its literal value, e.g. `myapp-assets-prod`. */
-  value?: string;
+/** How one carved resource is read back, and the literals to render it with. */
+export interface CarvedDataSource {
+  /**
+   * The type's data-source shape (`dataSourceShapeOf`): the `data` type, its
+   * arguments and where each comes from, and the survivor path translation.
+   */
+  shape?: DataSourceShape;
+  /**
+   * Literals resolved from the carved block, keyed by the shape field's source
+   * path — `{ bucket: "myapp-assets-prod" }`, or for a manifest
+   * `{ "manifest.apiVersion": "v1", "manifest.metadata.name": "app-config" }`.
+   */
+  values?: Record<string, string>;
 }
 
 export interface DataSourceBlock {
   /** Carved resource address the data source stands in for. */
   address: string;
+  /**
+   * The `data` type. Usually the carved resource's own type; the shape can
+   * name another, as `kubernetes_manifest` reads back through
+   * `data "kubernetes_resource"` (#2034).
+   */
   type: string;
   name: string;
   hcl: string;
@@ -73,22 +90,64 @@ export interface BridgePlan {
   runbook: string;
 }
 
-/** `aws_s3_bucket.assets` → a regex matching that reference head, not already `data.`-prefixed. */
+/**
+ * `aws_s3_bucket.assets` → a regex matching that reference head plus the
+ * attribute path that follows it, not already `data.`-prefixed. The path is
+ * captured because the data source may expose it under a different attribute:
+ * a survivor reading `kubernetes_manifest.app_config.manifest.data.x` has to
+ * come out as `data.kubernetes_resource.app_config.object.data.x`.
+ */
 function referenceRegex(address: string): RegExp {
   const escaped = address.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   // (?<!data\.) — do not double-prefix an existing data source reference.
-  return new RegExp(`(?<!data\\.)\\b${escaped}\\b`, "g");
+  return new RegExp(`(?<!data\\.)\\b${escaped}\\b((?:\\.[A-Za-z_][A-Za-z0-9_-]*)*)`, "g");
 }
 
-function dataSourceHcl(type: string, name: string, identity: CarvedIdentity): string {
-  // A dotted attr is a path into nested blocks; `a.b.c = v` is not valid HCL,
-  // so it falls back to the TODO. `carve bridge` refuses such a type outright.
-  const flat = identity.attr !== undefined && !identity.attr.includes(".");
-  const body =
-    flat && identity.value !== undefined
-      ? `  ${identity.attr} = ${JSON.stringify(identity.value)}`
-      : `  # TODO: identify the resource (its name/id was interpolated in the source)`;
-  return `data ${JSON.stringify(type)} ${JSON.stringify(name)} {\n${body}\n}`;
+const IDENTIFY_TODO = "  # TODO: identify the resource (its name/id was interpolated in the source)";
+
+/** `terraform fmt` aligns the `=` of consecutive assignments; so do we. */
+function alignedAssignments(pairs: Array<[string, string]>, indent: string): string[] {
+  const width = Math.max(...pairs.map(([key]) => key.length));
+  return pairs.map(([key, value]) => `${indent}${key.padEnd(width)} = ${JSON.stringify(value)}`);
+}
+
+/** Resolved `[name, value]` pairs, or null when a required field has no literal. */
+function resolveFields(fields: readonly ShapeField[], values: Record<string, string>): Array<[string, string]> | null {
+  const pairs: Array<[string, string]> = [];
+  for (const field of fields) {
+    const value = values[field.from];
+    if (value === undefined) {
+      if (field.required) return null;
+      continue;
+    }
+    pairs.push([field.name, value]);
+  }
+  return pairs;
+}
+
+/**
+ * The `data` block standing in for the carved resource. A shape whose required
+ * arguments the carved block did not supply as literals renders the TODO body
+ * instead of a block `terraform validate` would reject.
+ */
+function dataSourceHcl(shape: DataSourceShape, name: string, values: Record<string, string>): string {
+  const body: string[] = [];
+  const args = resolveFields(shape.args ?? [], values);
+  if (args === null) return todoBlock(shape.type, name);
+  if (args.length) body.push(...alignedAssignments(args, "  "));
+  for (const block of shape.blocks ?? []) {
+    const fields = resolveFields(block.fields, values);
+    if (fields === null) return todoBlock(shape.type, name);
+    if (!fields.length) continue;
+    if (body.length) body.push("");
+    body.push(`  ${block.name} {`, ...alignedAssignments(fields, "    "), "  }");
+  }
+  if (!body.length) body.push(IDENTIFY_TODO);
+  return `data ${JSON.stringify(shape.type)} ${JSON.stringify(name)} {\n${body.join("\n")}\n}`;
+}
+
+function todoBlock(type: string, name: string): string {
+  return `data ${JSON.stringify(type)} ${JSON.stringify(name)} {\n${IDENTIFY_TODO}\n}`;
 }
 
 /**
@@ -96,26 +155,26 @@ function dataSourceHcl(type: string, name: string, identity: CarvedIdentity): st
  *
  * @param report    the boundary report (from `boundaryReport`)
  * @param files     every `.tf` file in the estate, as { path, content }
- * @param identities physical identity per carved address, for the data sources
+ * @param readBacks how each carved address is read back as a data source, and
+ *                  the literals to render it with (`dataSourceShapeOf` +
+ *                  the graph node's `dataSourceValues`)
  */
 export function generateBridge(
   report: CarveReport,
   files: Array<{ path: string; content: string }>,
-  identities: Map<string, CarvedIdentity>,
+  readBacks: Map<string, CarvedDataSource>,
 ): BridgePlan {
   // Carved resources that something still depends on need a data source.
-  const carvedWithInbound = new Map<string, { type: string; name: string }>();
+  const carvedWithInbound = new Map<string, { type: string; name: string; readBack: CarvedDataSource }>();
   for (const e of report.inbound) {
     const [type, ...rest] = e.carved.split(".");
-    carvedWithInbound.set(e.carved, { type, name: rest.join(".") });
+    carvedWithInbound.set(e.carved, { type, name: rest.join("."), readBack: readBacks.get(e.carved) ?? {} });
   }
 
-  const dataSources: DataSourceBlock[] = [...carvedWithInbound.entries()].map(([address, { type, name }]) => ({
-    address,
-    type,
-    name,
-    hcl: dataSourceHcl(type, name, identities.get(address) ?? {}),
-  }));
+  const dataSources: DataSourceBlock[] = [...carvedWithInbound.entries()].map(([address, { type, name, readBack }]) => {
+    const shape = readBack.shape ?? { type };
+    return { address, type: shape.type, name, hcl: dataSourceHcl(shape, name, readBack.values ?? {}) };
+  });
 
   // Excise the carve set's own blocks (#998): after `terraform state rm`, a
   // block left behind would re-create the resource on the next apply. Then
@@ -129,8 +188,10 @@ export function generateBridge(
   const rewrites: FileRewrite[] = files.map(({ path, content }) => {
     const excision = exciseResourceBlocks(content, exciseTargets);
     let rewritten = excision.content;
-    for (const address of carvedWithInbound.keys()) {
-      rewritten = rewritten.replace(referenceRegex(address), `data.${address}`);
+    for (const [address, { type, name, readBack }] of carvedWithInbound) {
+      const shape = readBack.shape;
+      const head = `data.${shape?.type ?? type}.${name}`;
+      rewritten = rewritten.replace(referenceRegex(address), (_match, path: string) => head + rewriteReadPath(shape, path));
     }
     return { path, original: content, rewritten, changed: rewritten !== content, excised: excision.excised };
   });

package/src/terraform/carve-provider.ts

@@ -28,6 +28,7 @@
  * not require plugin loading for the paths that run without one.
  */
 
+import { identityAttrShape, type DataSourceShape } from "./data-source-shape";
 import { BUILTIN_CARVE_PROVIDERS } from "./providers";
 import type { StateResource } from "./state";
 
@@ -95,10 +96,20 @@ export interface CarveProvider {
   readonly tiers: Readonly<Record<string, TierInfo>>;
   /**
    * Terraform type → the HCL attribute carrying the physical name. A dotted
-   * entry is a path into nested blocks (`manifest.metadata.name`); the bridge
-   * refuses those, since a data-source body is flat `attr = value`.
+   * entry is a path into nested values (`manifest.metadata.name`), which a
+   * flat `attr = value` body cannot express, so it implies no data-source
+   * shape on its own — see {@link dataSourceShapes}.
    */
   readonly identityAttrs?: Readonly<Record<string, string>>;
+  /**
+   * Terraform type → how `carve bridge` reads it back as a `data` source
+   * (#2034): the data-source type, where each argument comes from in the
+   * carved body, and how a survivor's attribute path translates. Needed when
+   * the data source is not the resource's own type, or when its body is more
+   * than one flat argument. A type with a plain identity attribute and no
+   * entry here gets that attribute's shape ({@link identityAttrShape}).
+   */
+  readonly dataSourceShapes?: Readonly<Record<string, DataSourceShape>>;
   /**
    * Sub-resource Terraform type → parent type, for types Terraform splits out
    * of the resource the native spec keeps them in.
@@ -169,6 +180,7 @@ interface RegistryIndex {
   prefixes: Array<{ prefix: string; provider: CarveProvider }>;
   tiers: Record<string, TierInfo>;
   identityAttrs: Record<string, string>;
+  dataSourceShapes: Record<string, DataSourceShape>;
   foldsInto: Record<string, string>;
   /** Terraform type → the provider that emits it. */
   emitters: Map<string, CarveProvider>;
@@ -182,6 +194,7 @@ function index(): RegistryIndex {
     prefixes: [],
     tiers: {},
     identityAttrs: {},
+    dataSourceShapes: {},
     foldsInto: {},
     emitters: new Map(),
   };
@@ -189,6 +202,7 @@ function index(): RegistryIndex {
     for (const prefix of provider.tfTypePrefixes) built.prefixes.push({ prefix, provider });
     Object.assign(built.tiers, provider.tiers);
     if (provider.identityAttrs) Object.assign(built.identityAttrs, provider.identityAttrs);
+    if (provider.dataSourceShapes) Object.assign(built.dataSourceShapes, provider.dataSourceShapes);
     if (provider.foldsInto) Object.assign(built.foldsInto, provider.foldsInto);
     for (const tfType of provider.emitTypes ?? []) built.emitters.set(tfType, provider);
   }
@@ -235,3 +249,25 @@ export function carveIdentityAttr(tfType: string): string | undefined {
 export function carveFoldParent(tfType: string): string | undefined {
   return index().foldsInto[tfType];
 }
+
+/**
+ * How `carve bridge` reads this type back as a `data` source (#2034), or
+ * undefined when it cannot be read back at all — which is what makes
+ * `canBridge` refuse it.
+ *
+ * Resolution order:
+ *  1. a shape the owning provider declared for the type;
+ *  2. otherwise the shape a plain identity attribute implies (same type, one
+ *     required argument) — the path every AWS and google type takes;
+ *  3. otherwise undefined, when the identity attribute is a dotted path into
+ *     nested values and no provider declared a shape for it;
+ *  4. and for a type with no identity attribute at all, the bare data-source
+ *     type: the bridge still emits a block, with a TODO for the body.
+ */
+export function carveDataSourceShape(tfType: string): DataSourceShape | undefined {
+  const declared = index().dataSourceShapes[tfType];
+  if (declared) return declared;
+  const attr = index().identityAttrs[tfType];
+  if (attr === undefined) return { type: tfType };
+  return identityAttrShape(tfType, attr);
+}

package/src/terraform/data-source-shape.ts

@@ -0,0 +1,95 @@
+/**
+ * How a carved Terraform type is read back as a `data` source (#2034).
+ *
+ * `carve bridge` replaces a carved resource with a data source the survivors
+ * read instead. Until now a carve provider said only which attribute carries
+ * the physical name (`identityAttrs`), and the bridge assumed the data source
+ * was the same type as the resource, with that one attribute in its body:
+ *
+ *     data "aws_s3_bucket" "assets" { bucket = "myapp-assets-prod" }
+ *
+ * That assumption holds for AWS and google, and breaks for Kubernetes twice
+ * over. `kubernetes_manifest` names itself by `manifest.metadata.name`, a path
+ * into a nested value that a flat `attr = value` body cannot express; and the
+ * kubernetes provider ships no `kubernetes_manifest` data source at all
+ * (verified against hashicorp/kubernetes v3.2.1: 27 data sources, none a
+ * manifest). Its generic read is `data "kubernetes_resource"`, with a
+ * different type, different arguments, a nested `metadata` block, and its own
+ * attribute path for survivors to read through.
+ *
+ * So a provider contributes a *shape*: the data-source type, where each
+ * argument comes from in the carved body, and how a survivor's attribute path
+ * translates. An identity attribute is one instance of that shape
+ * ({@link identityAttrShape}), so nothing that bridges today changes.
+ */
+
+/** One argument of the data-source body, and where its value comes from. */
+export interface ShapeField {
+  /** Argument name in the emitted data source, e.g. `api_version`. */
+  name: string;
+  /**
+   * Dotted path into the carved resource's HCL body the literal is read from,
+   * e.g. `manifest.apiVersion`. Nested blocks are walked by segment.
+   */
+  from: string;
+  /**
+   * A shape that cannot resolve a required field renders the TODO body rather
+   * than a data source missing an argument Terraform needs.
+   */
+  required?: boolean;
+}
+
+/** A nested block in the data-source body, e.g. `metadata { name = "x" }`. */
+export interface ShapeBlock {
+  name: string;
+  fields: readonly ShapeField[];
+}
+
+export interface DataSourceShape {
+  /** The `data` type standing in for the carved resource, e.g. `kubernetes_resource`. */
+  type: string;
+  /** Flat `name = value` arguments of the body. */
+  args?: readonly ShapeField[];
+  /** Nested `name { ... }` blocks of the body. */
+  blocks?: readonly ShapeBlock[];
+  /**
+   * The carved resource's top-level attribute → the data source's, for the
+   * survivor rewrite. `kubernetes_manifest` exposes both `manifest` (what the
+   * config declared) and `object` (the API server's read-back), and
+   * `kubernetes_resource` exposes only `object`, so both map to `object`. An
+   * attribute with no entry passes through unchanged, which is what every
+   * same-type identity-attribute shape wants.
+   */
+  readAttrs?: Readonly<Record<string, string>>;
+}
+
+/**
+ * The shape a plain identity attribute implies: the same type as the resource,
+ * one required argument, no path translation. Returns undefined for a dotted
+ * attribute, which is a path into nested values and needs a declared shape.
+ */
+export function identityAttrShape(tfType: string, attr: string): DataSourceShape | undefined {
+  if (attr.includes(".")) return undefined;
+  return { type: tfType, args: [{ name: attr, from: attr, required: true }] };
+}
+
+/** Every source path the shape reads, for the graph to resolve out of the carved block. */
+export function shapeSourcePaths(shape: DataSourceShape): string[] {
+  const paths = (shape.args ?? []).map((f) => f.from);
+  for (const block of shape.blocks ?? []) for (const f of block.fields) paths.push(f.from);
+  return [...new Set(paths)];
+}
+
+/**
+ * Translate a survivor's attribute path onto the data source. `path` is the
+ * text after the address, leading dot included (`.manifest.data.log_level`) or
+ * empty. Only the first segment is mapped: everything under it is the object's
+ * own structure, which the data source reproduces.
+ */
+export function rewriteReadPath(shape: DataSourceShape | undefined, path: string): string {
+  if (!path || !shape?.readAttrs) return path;
+  const [head, ...rest] = path.slice(1).split(".");
+  const mapped = shape.readAttrs[head];
+  if (mapped === undefined) return path;
+  return `.${[mapped, ...rest].join(".")}`;
+}

package/src/terraform/graph.ts

@@ -11,7 +11,8 @@
  * graph building stays unit-testable on hand-written fixtures.
  */
 
-import { identityAttrOf } from "./tier-map";
+import { shapeSourcePaths } from "./data-source-shape";
+import { dataSourceShapeOf, identityAttrOf } from "./tier-map";
 import type { Hcl2JsonTree, TfEdge, TfGraph, TfNode } from "./types";
 
 /**
@@ -142,16 +143,14 @@ function blockHasMeta(block: unknown, key: string): boolean {
 }
 
 /**
- * The resource's physical name, if its identity attribute is a plain literal
- * (not interpolated). A dotted identity attribute walks nested blocks —
+ * The literal string at a dotted path into a block, or undefined when the path
+ * misses or lands on an interpolation. A dotted path walks nested blocks —
  * hcl2json renders a nested block as a one-element array, so arrays step
  * through their first element (`manifest.metadata.name`).
  */
-function literalIdentity(block: unknown, type: string): string | undefined {
-  const attr = identityAttrOf(type);
-  if (!attr || !block || typeof block !== "object") return undefined;
+function literalAt(block: unknown, path: string): string | undefined {
   let value: unknown = block;
-  for (const segment of attr.split(".")) {
+  for (const segment of path.split(".")) {
     if (Array.isArray(value)) value = value[0];
     if (!value || typeof value !== "object") return undefined;
     value = (value as Record<string, unknown>)[segment];
@@ -160,6 +159,34 @@ function literalIdentity(block: unknown, type: string): string | undefined {
   return value;
 }
 
+/**
+ * The resource's physical name, if its identity attribute is a plain literal
+ * (not interpolated).
+ */
+function literalIdentity(block: unknown, type: string): string | undefined {
+  const attr = identityAttrOf(type);
+  if (!attr || !block || typeof block !== "object") return undefined;
+  return literalAt(block, attr);
+}
+
+/**
+ * The literals the type's data-source shape reads out of the carved block
+ * (#2034), keyed by the shape field's source path. `carve bridge` renders the
+ * data-source body from these; a required field missing here is what makes it
+ * write a TODO instead of a block Terraform would reject.
+ */
+function dataSourceValues(block: unknown, type: string): Record<string, string> | undefined {
+  if (!block || typeof block !== "object") return undefined;
+  const shape = dataSourceShapeOf(type);
+  if (!shape) return undefined;
+  const values: Record<string, string> = {};
+  for (const path of shapeSourcePaths(shape)) {
+    const value = literalAt(block, path);
+    if (value !== undefined) values[path] = value;
+  }
+  return Object.keys(values).length ? values : undefined;
+}
+
 /**
  * Build the dependency graph from a merged hcl2json tree.
  *
@@ -202,6 +229,7 @@ export function buildGraph(tree: Hcl2JsonTree, exprRefs: ExpressionRefs): TfGrap
         instances: 1,
         hasDynamic: dynamic || touchesData,
         identity: literalIdentity(block, type),
+        dataSourceValues: dataSourceValues(block, type),
       });
     }
   }

package/src/terraform/providers/kubernetes.ts

@@ -18,6 +18,11 @@
  * can only name the family, and `adopt` reads the body to learn the rest —
  * which is also why one rule here covers every CRD.
  *
+ * It has no `kubernetes_manifest` data source either, so it does not read back
+ * as its own type. `MANIFEST_READ_BACK` below is the shape `carve bridge` uses
+ * instead: `data "kubernetes_resource"`, built from the manifest's own
+ * apiVersion/kind/metadata (#2034).
+ *
  * It has no live adoption path. `carve emit --env` filters a live export by a
  * native type, and there is no type to filter by until the body is read; state
  * is where the body is. `liveSelectorType` therefore returns undefined and
@@ -26,6 +31,7 @@
  */
 
 import type { AdoptedSource, CarveProvider, DeferredParam, TierInfo } from "../carve-provider";
+import type { DataSourceShape } from "../data-source-shape";
 import type { StateResource } from "../state";
 
 /** The chant lexicon the emitted source imports from. */
@@ -208,14 +214,54 @@ function adoptManifestFromState(resource: StateResource, params: DeferredParam[]
   };
 }
 
+/**
+ * How `carve bridge` reads a carved `kubernetes_manifest` back (#2034).
+ *
+ * The provider ships no `kubernetes_manifest` data source — checked against
+ * hashicorp/kubernetes v3.2.1, whose 27 data sources include no manifest. The
+ * generic read is `data "kubernetes_resource"`, which asks for the GVK and the
+ * name rather than taking them from a body: `api_version`, `kind`, and a
+ * nested `metadata` block with `name` and an optional `namespace`. All three
+ * come out of the manifest the resource declared.
+ *
+ * Survivors read the object back through `object`, and only through `object`:
+ * the resource exposes both `manifest` (the declared body) and `object` (the
+ * API server's read-back), the data source exposes just the latter. So both
+ * map to `object`, and a reference to `.manifest.data.log_level` lands on
+ * `.object.data.log_level` rather than an attribute that does not exist.
+ *
+ * A namespace-less manifest (a ClusterRole, a CRD) simply omits `namespace`,
+ * which the data source allows. A manifest whose name is interpolated resolves
+ * no literal and falls back to the bridge's TODO body, as an AWS type with an
+ * interpolated bucket name does.
+ */
+const MANIFEST_READ_BACK: DataSourceShape = {
+  type: "kubernetes_resource",
+  args: [
+    { name: "api_version", from: "manifest.apiVersion", required: true },
+    { name: "kind", from: "manifest.kind", required: true },
+  ],
+  blocks: [
+    {
+      name: "metadata",
+      fields: [
+        { name: "name", from: "manifest.metadata.name", required: true },
+        { name: "namespace", from: "manifest.metadata.namespace" },
+      ],
+    },
+  ],
+  readAttrs: { manifest: "object", object: "object" },
+};
+
 export const kubernetesCarveProvider: CarveProvider = {
   name: "kubernetes",
   tfTypePrefixes: ["kubernetes_"],
   lexicon: "k8s",
   tiers: TIERS,
-  // A dotted path into nested blocks: the graph walks it for identity, and
-  // `carve bridge` refuses the type because a data-source body cannot express it.
+  // A dotted path into the manifest body: the graph walks it for identity. It
+  // cannot be a data-source argument on its own, so the read-back is a shape.
   identityAttrs: { kubernetes_manifest: "manifest.metadata.name" },
+  dataSourceShapes: { kubernetes_manifest: MANIFEST_READ_BACK },
   emitTypes: ["kubernetes_manifest"],
   adopt: (resource, params) => adoptManifestFromState(resource, params),
   // State only — the kind is in the body, so a live export has nothing to

package/src/terraform/tier-map.ts

@@ -18,14 +18,17 @@
  */
 
 import {
+  carveDataSourceShape,
   carveFoldParent,
   carveIdentityAttr,
   carveTierMap,
   resolveEmitProvider,
   type TierInfo,
 } from "./carve-provider";
+import type { DataSourceShape } from "./data-source-shape";
 
 export { carveEmitTypes, type TierInfo } from "./carve-provider";
+export type { DataSourceShape } from "./data-source-shape";
 
 /** TF resource type → native tier, over every registered provider. Absent = unsupported (score 0). */
 export function tierMap(): Readonly<Record<string, TierInfo>> {
@@ -66,12 +69,24 @@ export function canCarveEmit(tfType: string): boolean {
 }
 
 /**
- * Can `chant carve bridge` render a Terraform `data` source for this type? A
- * dotted identity attribute is a path into nested blocks, and a data source
- * body is flat `attr = value` — `manifest.metadata.name = "x"` is not valid
- * HCL. An absent entry is fine: the bridge writes a TODO comment instead.
+ * How `chant carve bridge` reads this type back as a `data` source: the
+ * data-source type, where each argument comes from in the carved body, and how
+ * a survivor's attribute path translates (#2034). Undefined when the type
+ * cannot be read back at all.
+ */
+export function dataSourceShapeOf(tfType: string): DataSourceShape | undefined {
+  return carveDataSourceShape(tfType);
+}
+
+/**
+ * Can `chant carve bridge` render a Terraform `data` source for this type?
+ * True whenever its provider contributes a shape — declared, or implied by a
+ * plain identity attribute. False for a dotted identity attribute with no
+ * declared shape: that is a path into nested values, and a flat `attr = value`
+ * body cannot express it (`manifest.metadata.name = "x"` is not valid HCL). A
+ * type with no identity attribute at all still bridges; the bridge writes a
+ * TODO comment for the body.
  */
 export function canBridge(tfType: string): boolean {
-  const attr = carveIdentityAttr(tfType);
-  return attr === undefined || !attr.includes(".");
+  return carveDataSourceShape(tfType) !== undefined;
 }

package/src/terraform/types.ts

@@ -34,6 +34,14 @@ export interface TfNode {
    * emit. Undefined when the identity attribute is absent or interpolated.
    */
   identity?: string;
+  /**
+   * The literals the type's data-source shape reads out of the block (#2034),
+   * keyed by the shape field's source path (`manifest.metadata.name`). This is
+   * what `carve bridge` renders the `data` body from — a superset of
+   * `identity`, since a shape can need more than one value (`api_version`,
+   * `kind` and `metadata.name` for a `kubernetes_manifest`).
+   */
+  dataSourceValues?: Record<string, string>;
 }
 
 /**