@intentius/chant 0.58.0 → 0.59.0

package/dist/terraform/data-source-shape.d.ts

@@ -0,0 +1,77 @@
+/**
+ * How a carved Terraform type is read back as a `data` source (#2034).
+ *
+ * `carve bridge` replaces a carved resource with a data source the survivors
+ * read instead. Until now a carve provider said only which attribute carries
+ * the physical name (`identityAttrs`), and the bridge assumed the data source
+ * was the same type as the resource, with that one attribute in its body:
+ *
+ *     data "aws_s3_bucket" "assets" { bucket = "myapp-assets-prod" }
+ *
+ * That assumption holds for AWS and google, and breaks for Kubernetes twice
+ * over. `kubernetes_manifest` names itself by `manifest.metadata.name`, a path
+ * into a nested value that a flat `attr = value` body cannot express; and the
+ * kubernetes provider ships no `kubernetes_manifest` data source at all
+ * (verified against hashicorp/kubernetes v3.2.1: 27 data sources, none a
+ * manifest). Its generic read is `data "kubernetes_resource"`, with a
+ * different type, different arguments, a nested `metadata` block, and its own
+ * attribute path for survivors to read through.
+ *
+ * So a provider contributes a *shape*: the data-source type, where each
+ * argument comes from in the carved body, and how a survivor's attribute path
+ * translates. An identity attribute is one instance of that shape
+ * ({@link identityAttrShape}), so nothing that bridges today changes.
+ */
+/** One argument of the data-source body, and where its value comes from. */
+export interface ShapeField {
+    /** Argument name in the emitted data source, e.g. `api_version`. */
+    name: string;
+    /**
+     * Dotted path into the carved resource's HCL body the literal is read from,
+     * e.g. `manifest.apiVersion`. Nested blocks are walked by segment.
+     */
+    from: string;
+    /**
+     * A shape that cannot resolve a required field renders the TODO body rather
+     * than a data source missing an argument Terraform needs.
+     */
+    required?: boolean;
+}
+/** A nested block in the data-source body, e.g. `metadata { name = "x" }`. */
+export interface ShapeBlock {
+    name: string;
+    fields: readonly ShapeField[];
+}
+export interface DataSourceShape {
+    /** The `data` type standing in for the carved resource, e.g. `kubernetes_resource`. */
+    type: string;
+    /** Flat `name = value` arguments of the body. */
+    args?: readonly ShapeField[];
+    /** Nested `name { ... }` blocks of the body. */
+    blocks?: readonly ShapeBlock[];
+    /**
+     * The carved resource's top-level attribute → the data source's, for the
+     * survivor rewrite. `kubernetes_manifest` exposes both `manifest` (what the
+     * config declared) and `object` (the API server's read-back), and
+     * `kubernetes_resource` exposes only `object`, so both map to `object`. An
+     * attribute with no entry passes through unchanged, which is what every
+     * same-type identity-attribute shape wants.
+     */
+    readAttrs?: Readonly<Record<string, string>>;
+}
+/**
+ * The shape a plain identity attribute implies: the same type as the resource,
+ * one required argument, no path translation. Returns undefined for a dotted
+ * attribute, which is a path into nested values and needs a declared shape.
+ */
+export declare function identityAttrShape(tfType: string, attr: string): DataSourceShape | undefined;
+/** Every source path the shape reads, for the graph to resolve out of the carved block. */
+export declare function shapeSourcePaths(shape: DataSourceShape): string[];
+/**
+ * Translate a survivor's attribute path onto the data source. `path` is the
+ * text after the address, leading dot included (`.manifest.data.log_level`) or
+ * empty. Only the first segment is mapped: everything under it is the object's
+ * own structure, which the data source reproduces.
+ */
+export declare function rewriteReadPath(shape: DataSourceShape | undefined, path: string): string;
+//# sourceMappingURL=data-source-shape.d.ts.map

package/dist/terraform/data-source-shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-source-shape.d.ts","sourceRoot":"","sources":["../../src/terraform/data-source-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,IAAI,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC7B,gDAAgD;IAChD,MAAM,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC9C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAG3F;AAED,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,EAAE,CAIjE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMxF"}

package/dist/terraform/graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/terraform/graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAU,MAAM,SAAS,CAAC;AAErE;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;AAKpE,UAAU,MAAM;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA4BD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe/D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,EAAE,CAe/D;AA4DD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAoFhF;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAEtE;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvE"}
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/terraform/graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAU,MAAM,SAAS,CAAC;AAErE;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;AAKpE,UAAU,MAAM;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA4BD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe/D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,EAAE,CAe/D;AAsFD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAqFhF;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAEtE;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvE"}

package/dist/terraform/providers/kubernetes.d.ts

@@ -18,6 +18,11 @@
  * can only name the family, and `adopt` reads the body to learn the rest —
  * which is also why one rule here covers every CRD.
  *
+ * It has no `kubernetes_manifest` data source either, so it does not read back
+ * as its own type. `MANIFEST_READ_BACK` below is the shape `carve bridge` uses
+ * instead: `data "kubernetes_resource"`, built from the manifest's own
+ * apiVersion/kind/metadata (#2034).
+ *
  * It has no live adoption path. `carve emit --env` filters a live export by a
  * native type, and there is no type to filter by until the body is read; state
  * is where the body is. `liveSelectorType` therefore returns undefined and

package/dist/terraform/providers/kubernetes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubernetes.d.ts","sourceRoot":"","sources":["../../../src/terraform/providers/kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAiB,aAAa,EAA2B,MAAM,mBAAmB,CAAC;AAuL/F,eAAO,MAAM,uBAAuB,EAAE,aAarC,CAAC"}
+{"version":3,"file":"kubernetes.d.ts","sourceRoot":"","sources":["../../../src/terraform/providers/kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAiB,aAAa,EAA2B,MAAM,mBAAmB,CAAC;AA+N/F,eAAO,MAAM,uBAAuB,EAAE,aAcrC,CAAC"}

package/dist/terraform/tier-map.d.ts

@@ -17,7 +17,9 @@
  * provider registered after module load has to be visible here.
  */
 import { type TierInfo } from "./carve-provider.js";
+import type { DataSourceShape } from "./data-source-shape.js";
 export { carveEmitTypes, type TierInfo } from "./carve-provider.js";
+export type { DataSourceShape } from "./data-source-shape.js";
 /** TF resource type → native tier, over every registered provider. Absent = unsupported (score 0). */
 export declare function tierMap(): Readonly<Record<string, TierInfo>>;
 export declare function resolveTier(tfType: string): TierInfo | null;
@@ -42,10 +44,20 @@ export declare function foldParentOf(tfType: string): string | undefined;
  */
 export declare function canCarveEmit(tfType: string): boolean;
 /**
- * Can `chant carve bridge` render a Terraform `data` source for this type? A
- * dotted identity attribute is a path into nested blocks, and a data source
- * body is flat `attr = value` — `manifest.metadata.name = "x"` is not valid
- * HCL. An absent entry is fine: the bridge writes a TODO comment instead.
+ * How `chant carve bridge` reads this type back as a `data` source: the
+ * data-source type, where each argument comes from in the carved body, and how
+ * a survivor's attribute path translates (#2034). Undefined when the type
+ * cannot be read back at all.
+ */
+export declare function dataSourceShapeOf(tfType: string): DataSourceShape | undefined;
+/**
+ * Can `chant carve bridge` render a Terraform `data` source for this type?
+ * True whenever its provider contributes a shape — declared, or implied by a
+ * plain identity attribute. False for a dotted identity attribute with no
+ * declared shape: that is a path into nested values, and a flat `attr = value`
+ * body cannot express it (`manifest.metadata.name = "x"` is not valid HCL). A
+ * type with no identity attribute at all still bridges; the bridge writes a
+ * TODO comment for the body.
  */
 export declare function canBridge(tfType: string): boolean;
 //# sourceMappingURL=tier-map.d.ts.map

package/dist/terraform/tier-map.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tier-map.d.ts","sourceRoot":"","sources":["../../src/terraform/tier-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAKL,KAAK,QAAQ,EACd,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjE,sGAAsG;AACtG,wBAAgB,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAE5D;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE/D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGjD"}
+{"version":3,"file":"tier-map.d.ts","sourceRoot":"","sources":["../../src/terraform/tier-map.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAML,KAAK,QAAQ,EACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,sGAAsG;AACtG,wBAAgB,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAE5D;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE/D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAE7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjD"}

package/dist/terraform/types.d.ts

@@ -33,6 +33,14 @@ export interface TfNode {
      * emit. Undefined when the identity attribute is absent or interpolated.
      */
     identity?: string;
+    /**
+     * The literals the type's data-source shape reads out of the block (#2034),
+     * keyed by the shape field's source path (`manifest.metadata.name`). This is
+     * what `carve bridge` renders the `data` body from — a superset of
+     * `identity`, since a shape can need more than one value (`api_version`,
+     * `kind` and `metadata.name` for a `kubernetes_manifest`).
+     */
+    dataSourceValues?: Record<string, string>;
 }
 /**
  * A directed dependency edge: `from` references `to`.

package/dist/terraform/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/terraform/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,MAAM;IACrB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC5B,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACjD,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/terraform/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,MAAM;IACrB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC5B,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACjD,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.58.0",
+  "version": "0.59.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/audit/core.ts

@@ -25,7 +25,7 @@ import type { Severity } from "../lint/rule";
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "../lint/post-synth";
 import { applyInlineSuppressions, type SuppressionMetaFinding } from "../lint/suppressions";
 import type { SerializerResult } from "../serializer";
-import type { LexiconPlugin } from "../lexicon";
+import type { AuditEntitiesInput, LexiconPlugin } from "../lexicon";
 import type { Declarable } from "../declarable";
 
 /**
@@ -61,6 +61,16 @@ export interface AuditInput {
    * — checks that read `output.files` (helm, docker) see the whole bundle.
    */
   files?: Record<string, string>;
+  /**
+   * Absolute directory this input's files were read from, set by discovery on
+   * a local walk for the inputs whose `path` names a directory (#2217). It
+   * reaches a lexicon's `auditEntities` as `AuditEntitiesInput.dir`, which is
+   * what lets terraform follow a root module's local `module` calls. Undefined
+   * for a remote tree fetch and for a single-file input.
+   */
+  dir?: string;
+  /** Absolute path of the audited root, when discovery walked one (#2217). The boundary `dir` may read within. */
+  baseDir?: string;
 }
 
 /** A finding produced by a post-synth check against an audited file. */
@@ -99,8 +109,16 @@ export type ChecksProvider = (lexicon: AuditLexicon) => Promise<PostSynthCheck[]
  * `ctx.entities` holds during a build, so entity-reading checks run unchanged.
  * May return a `Promise` for a lexicon whose parser is inherently async (e.g.
  * terraform's HCL parser); `auditLexicon`'s `entitiesFor` awaits it.
+ *
+ * The second argument carries the input's discovery facts (its path, and the
+ * directory it was read from on a local walk), so a lexicon whose unit of
+ * parsing is a directory can name its scope after that directory and read the
+ * directories it references (#2217).
  */
-export type EntitiesParser = (content: string) => Map<string, Declarable> | Promise<Map<string, Declarable>>;
+export type EntitiesParser = (
+  content: string,
+  input?: AuditEntitiesInput,
+) => Map<string, Declarable> | Promise<Map<string, Declarable>>;
 
 /**
  * Resolve the entities parser for a lexicon (its plugin's `auditEntities`,
@@ -322,7 +340,11 @@ async function auditLexicon(
   const entitiesFor = async (file: AuditInput): Promise<Map<string, Declarable>> => {
     if (!parseEntities) return new Map();
     try {
-      return await parseEntities(file.content);
+      return await parseEntities(file.content, {
+        path: file.path,
+        ...(file.dir !== undefined ? { dir: file.dir } : {}),
+        ...(file.baseDir !== undefined ? { baseDir: file.baseDir } : {}),
+      });
     } catch {
       // The audit contract is "runs against any repo" — unparseable content
       // contributes no entities, never a crash.

package/src/audit/discover.ts

@@ -23,9 +23,10 @@
  *     read `output.files`, so the whole chart is one AuditInput.
  *   - Terraform is also a directory BUNDLE, keyed by that directory's own
  *     `.tf` filenames, not recursively: a nested directory with its own
- *     `.tf` files (e.g. `modules/foo`) is a separate root module and gets its
- *     own AuditInput. `.tf` isn't YAML/JSON either, so `detectTemplate` can't
- *     see it.
+ *     `.tf` files (e.g. `modules/foo`) is its own AuditInput, UNLESS another
+ *     directory's `.tf` calls it as a local module, in which case it is a
+ *     child module of that root and is parsed as part of it (#2217). `.tf`
+ *     isn't YAML/JSON either, so `detectTemplate` can't see it.
  *   - k8s `detectTemplate` matches any `apiVersion`+`kind`, including GCP Config
  *     Connector (`cnrm.cloud.google.com`) resources and fountain
  *     (`fountain.dev/v1`) manifests, so gcp and fountain must be tried first.
@@ -34,7 +35,7 @@
  */
 
 import { readdirSync, readFileSync, statSync } from "fs";
-import { basename, join, relative } from "path";
+import { basename, join, relative, resolve } from "path";
 import { parseYAML } from "../yaml";
 import type { LexiconPlugin } from "../lexicon";
 import type { AuditInput, AuditLexicon } from "./core";
@@ -391,17 +392,103 @@ function classifyHelm(files: RepoFile[], plugin: DetectPlugin | undefined): { in
   return { inputs, prefixes };
 }
 
+/**
+ * A `source` attribute naming a local path, the only module source Terraform
+ * reads from the repository itself. A registry or git source ("hashicorp/aws",
+ * "git::https://...") never starts with `./` or `../`, and `source` inside
+ * `required_providers` is a registry address, so the prefix is what tells the
+ * two apart without an HCL parser here. `classifyTerraform` uses this to tell
+ * a root module from a directory that is somebody's child module; the lexicon
+ * plugin parses the calls properly once it has the root.
+ */
+const LOCAL_MODULE_SOURCE = /(?:^|[\s{,])source\s*=\s*"(\.{1,2}\/[^"]*)"/g;
+
+/**
+ * Resolve `rel` against the repo-relative directory `dir`. Returns undefined
+ * when the path climbs above the audited root, which is a directory this walk
+ * never read and so can never be one of its inputs.
+ */
+function resolveRepoDir(dir: string, rel: string): string | undefined {
+  const parts = dir === "" ? [] : dir.split("/");
+  for (const segment of rel.split("/")) {
+    if (segment === "" || segment === ".") continue;
+    if (segment === "..") {
+      if (parts.length === 0) return undefined;
+      parts.pop();
+      continue;
+    }
+    parts.push(segment);
+  }
+  return parts.join("/");
+}
+
+/**
+ * The directories that are somebody's local child module: a `.tf` file in
+ * another directory of this walk calls them with a relative `source`.
+ *
+ * They are dropped as audit inputs of their own, because the root that calls
+ * them parses them as child scopes (the terraform plugin's `auditEntities`
+ * descends from `AuditInput.dir`, #2217). Auditing them twice would report
+ * every finding in them twice, once per scope, and auditing them as roots is
+ * what made `chant audit` disagree with `chant build` about which rules apply
+ * to a child module at all.
+ *
+ * A directory a cycle reaches but no root does is kept: `a` calling `b`
+ * calling `a` is a configuration Terraform refuses, and dropping both would
+ * leave the files audited by nothing.
+ */
+function calledAsLocalModule(byDir: Map<string, Record<string, string>>): Set<string> {
+  const callees = new Map<string, Set<string>>();
+  const called = new Set<string>();
+  for (const [dir, bundle] of byDir) {
+    const targets = new Set<string>();
+    for (const source of Object.values(bundle)) {
+      for (const match of source.matchAll(LOCAL_MODULE_SOURCE)) {
+        const target = resolveRepoDir(dir, match[1]);
+        if (target === undefined || target === dir || !byDir.has(target)) continue;
+        targets.add(target);
+        called.add(target);
+      }
+    }
+    callees.set(dir, targets);
+  }
+
+  const queue = [...byDir.keys()].filter((dir) => !called.has(dir));
+  const reached = new Set<string>(queue);
+  while (queue.length > 0) {
+    for (const target of callees.get(queue.shift()!) ?? []) {
+      if (reached.has(target)) continue;
+      reached.add(target);
+      queue.push(target);
+    }
+  }
+  return new Set([...called].filter((dir) => reached.has(dir)));
+}
+
 /**
  * Collect Terraform root modules as directory bundles from an in-memory file
  * set, modeled on `classifyHelm`. Unlike a Helm chart (its whole subtree is
  * one bundle), a Terraform root module references only its own sibling
  * files, so grouping is by each `.tf` file's immediate directory, not
- * recursive: a nested directory with its own `.tf` files (`modules/foo`) is
- * a separate root module and gets its own AuditInput. Returns inputs plus
- * the exact `.tf` paths claimed, so the loose-file pass in `classifyFiles`
- * can skip them.
+ * recursive.
+ *
+ * A directory another one calls as a local module is not a root module and
+ * gets no input of its own (#2217): the root that calls it parses it as a
+ * child scope, which is what Terraform does and what `chant build` already
+ * did. That descent reads the child's directory from disk, so it only happens
+ * when `baseDir` says a local walk found these files; an in-memory file set
+ * with no directory behind it keeps every `.tf` directory as its own input,
+ * as before.
+ *
+ * Returns inputs plus the exact `.tf` paths claimed, so the loose-file pass in
+ * `classifyFiles` can skip them — a child module's files are claimed too, by
+ * the root that will parse them.
  */
-function classifyTerraform(files: RepoFile[], plugin: DetectPlugin | undefined): { inputs: AuditInput[]; claimed: Set<string> } {
+function classifyTerraform(
+  files: RepoFile[],
+  plugin: DetectPlugin | undefined,
+  baseDir?: string,
+): { inputs: AuditInput[]; claimed: Set<string> } {
   const inputs: AuditInput[] = [];
   const claimed = new Set<string>();
   if (!plugin) return { inputs, claimed };
@@ -416,20 +503,40 @@ function classifyTerraform(files: RepoFile[], plugin: DetectPlugin | undefined):
     byDir.set(dir, bundle);
     claimed.add(f.path);
   }
+  const childModules = baseDir === undefined ? new Set<string>() : calledAsLocalModule(byDir);
   for (const [dir, bundle] of byDir) {
+    if (childModules.has(dir)) continue;
     // `content` is the whole root module, every `.tf` in filename order with a
     // `# file:` line comment (legal HCL) marking each boundary, so a lexicon's
     // `auditEntities(content)` sees the module Terraform itself would load,
-    // not one arbitrary file of it. `files` keeps the per-file split.
+    // not one arbitrary file of it. `files` keeps the per-file split, and
+    // `dir` is where the local modules it calls are read from.
     const content = Object.keys(bundle)
       .sort()
       .map((name) => `# file: ${name}\n${bundle[name]}`)
       .join("\n");
-    inputs.push({ path: dir === "" ? "." : dir, content, lexicon: "terraform", files: bundle });
+    inputs.push({
+      path: dir === "" ? "." : dir,
+      content,
+      lexicon: "terraform",
+      files: bundle,
+      ...(baseDir === undefined ? {} : { dir: resolve(baseDir, dir), baseDir }),
+    });
   }
   return { inputs, claimed };
 }
 
+/** Where a set of classified files came from, when they came from a local walk (#2217). */
+export interface ClassifyOptions {
+  /**
+   * Absolute path of the directory that was walked. Travels onto the inputs
+   * whose `path` names a directory, so a lexicon's `auditEntities` can read
+   * the files that directory references (terraform's local module calls).
+   * Omit for an in-memory or fetched file set: there is no directory to read.
+   */
+  baseDir?: string;
+}
+
 /**
  * Classify an in-memory set of repo files into per-lexicon audit inputs. Pure
  * (no fs, no network) so the local walk and the remote tree-fetch share exactly
@@ -439,15 +546,16 @@ function classifyTerraform(files: RepoFile[], plugin: DetectPlugin | undefined):
  * (delegating to each plugin's `detectTemplate`). Lexicons whose plugin isn't
  * provided are skipped.
  */
-export function classifyFiles(files: RepoFile[], plugins: DetectPlugin[]): AuditInput[] {
+export function classifyFiles(files: RepoFile[], plugins: DetectPlugin[], opts: ClassifyOptions = {}): AuditInput[] {
   const byName = new Map(plugins.map((p) => [p.name, p]));
+  const baseDir = opts.baseDir === undefined ? undefined : resolve(opts.baseDir);
 
   // Helm claims whole chart directories first; chart-internal files are excluded
   // from the loose-file pass so templates aren't double-audited.
   const helm = classifyHelm(files, byName.get("helm"));
   const underChart = (p: string): boolean => helm.prefixes.some((pre) => (pre === "" ? true : p.startsWith(pre)));
 
-  const terraform = classifyTerraform(files, byName.get("terraform"));
+  const terraform = classifyTerraform(files, byName.get("terraform"), baseDir);
 
   const inputs: AuditInput[] = [...helm.inputs, ...terraform.inputs];
   for (const { path, content } of files) {
@@ -483,7 +591,7 @@ export function classifyFiles(files: RepoFile[], plugins: DetectPlugin[]): Audit
  * lexicon whose plugin isn't provided, so a caller can scope discovery.
  */
 export function discoverByDetection(root: string, plugins: DetectPlugin[]): AuditInput[] {
-  return classifyFiles(collectCandidates(root), plugins);
+  return classifyFiles(collectCandidates(root), plugins, { baseDir: root });
 }
 
 /** The walk half of `discoverByDetection`: candidate files read into memory, paths relative to the root. */

package/src/cli/commands/audit.test.ts

@@ -470,6 +470,8 @@ describe("auditCommand", () => {
     expect(valid).toBe(true);
   });
 
+  // The scope is the discovered root module's own directory (`infra`), which
+  // is what the terraform plugin names an audited scope after since #2217.
   describe("TF001's missing-resource shape renders in all three reporters (chant #2113)", () => {
     const dir = join(tmpdir(), `chant-audit-tf-missing-${process.pid}`);
 
@@ -484,7 +486,7 @@ describe("auditCommand", () => {
     test("stylish names the missing kind and scope instead of falling back to entity", async () => {
       setup();
       const result = await auditCommand({ path: dir, format: "stylish" });
-      expect(result.output).toContain("(missing backend in audit-root)");
+      expect(result.output).toContain("(missing backend in infra)");
       teardown();
     });
 
@@ -493,7 +495,7 @@ describe("auditCommand", () => {
       const result = await auditCommand({ path: dir, format: "json" });
       const doc = JSON.parse(result.output) as { findings: Array<{ checkId: string; missing?: { kind: string; scope: string } }> };
       const tf001 = doc.findings.find((f) => f.checkId === "TF001");
-      expect(tf001?.missing).toEqual({ kind: "backend", scope: "audit-root" });
+      expect(tf001?.missing).toEqual({ kind: "backend", scope: "infra" });
       teardown();
     });
 
@@ -504,7 +506,7 @@ describe("auditCommand", () => {
         runs: Array<{ results: Array<{ ruleId: string; properties?: { missing?: { kind: string; scope: string } } }> }>;
       };
       const tf001 = doc.runs[0].results.find((r) => r.ruleId === "TF001");
-      expect(tf001?.properties?.missing).toEqual({ kind: "backend", scope: "audit-root" });
+      expect(tf001?.properties?.missing).toEqual({ kind: "backend", scope: "infra" });
 
       const ajv = new Ajv({ strict: false, allErrors: true });
       const validate = ajv.compile(loadSarifSchema() as object);

package/src/cli/commands/audit.ts

@@ -408,7 +408,11 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
     // shape alone can't disambiguate them.
     candidates = collectCandidates(options.path);
   }
-  const inputs = classifyFiles(candidates, plugins);
+  // A local target hands its directory to the classifier, so an input whose
+  // path names a directory carries the directory itself (#2217): terraform's
+  // parse-to-graph follows a root module's local `module` calls from there. A
+  // URL target has no local tree, and never fetches `.tf` in the first place.
+  const inputs = classifyFiles(candidates, plugins, isUrl ? {} : { baseDir: options.path });
   const unclaimed = unclaimedFiles(candidates, inputs, plugins);
   const scanned = inputs.map((i) => i.path);
 

package/src/cli/commands/build.test.ts

@@ -1445,7 +1445,7 @@ export const pruneStaging = {
     name: "prune-staging",
     overview: "test",
     phases: [
-      { name: "Approve", steps: [{ kind: "gate", signalName: "approve-x" }] },
+      { name: "Approve", steps: [{ kind: "gate", gate: "approve-x" }] },
       { name: "Apply", steps: [
         { kind: "activity", fn: "nativeApply", args: { target: "kubectl", env: "staging", output: "dist", deleteMode: "gated" } },
       ] },
@@ -1502,6 +1502,44 @@ export const converge = {
       ),
     ).toBe(true);
   });
+
+  // #2202: a gate step spelling its name `signalName` still builds, and the
+  // build says so once, naming the Ops involved rather than each gate step.
+  test("warns once, naming the Ops, when a gate step still uses the deprecated `signalName` key", async () => {
+    const opFile = (name: string): string => `
+export const ${name.replace(/-/g, "")} = {
+  [Symbol.for("chant.declarable")]: true,
+  entityType: "Chant::Op",
+  lexicon: "chant",
+  kind: "resource",
+  props: {
+    name: "${name}",
+    overview: "test",
+    phases: [{ name: "Approve", steps: [{ kind: "gate", signalName: "approve-x" }] }],
+  },
+};
+      `;
+    await writeFile(join(testDir, "old-a.op.ts"), opFile("old-a"));
+    await writeFile(join(testDir, "old-b.op.ts"), opFile("old-b"));
+    await writeFile(
+      join(testDir, "new-c.op.ts"),
+      opFile("new-c").replace("signalName", "gate"),
+    );
+
+    const result = await buildCommand({
+      path: testDir,
+      format: "json",
+      serializers: [mockSerializer],
+      plugins: [],
+    });
+
+    const deprecation = result.warnings.filter((w) => w.includes("signalName"));
+    expect(deprecation).toHaveLength(1);
+    expect(deprecation[0]).toContain("old-a");
+    expect(deprecation[0]).toContain("old-b");
+    expect(deprecation[0]).not.toContain("new-c");
+    expect(deprecation[0]).toContain("0.60.0");
+  });
 });
 
 // ── #284 bug 1: -o extension drives format when --format is absent ────────

package/src/cli/commands/build.ts

@@ -18,6 +18,7 @@ import { runPostSynthChecks, type PostSynthDiagnostic } from "../../lint/post-sy
 import { loadActivityContracts } from "../../op/activity-contract-registry";
 import { isOpEntity } from "../../op/resource";
 import { serializeOpIR } from "../../op/op-ir";
+import { opUsesDeprecatedGateKey, DEPRECATED_GATE_KEY_WARNING } from "../../op/gate-name";
 import type { OpConfig } from "../../op/types";
 import { coreReceiptChecks } from "../../lint/receipt-checks";
 import { coreOutputChecks } from "../../lint/output-checks";
@@ -639,6 +640,19 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // not a resource manifest, so an Ops-only project legitimately produces no
   // serializer output and must not be reported as a broken import.
   const declaredOps = [...result.entities.values()].filter(isOpEntity);
+
+  // The gate step's name key was renamed from `signalName` to `gate` in #2202.
+  // The old key is still read; a build that finds an Op still using it says so
+  // once, naming every Op involved, rather than once per gate step.
+  const opsOnOldGateKey = declaredOps
+    .map((entity) => (entity as unknown as { props?: OpConfig }).props)
+    .filter((config): config is OpConfig => Boolean(config?.name) && opUsesDeprecatedGateKey(config as OpConfig))
+    .map((config) => config.name);
+  if (opsOnOldGateKey.length > 0) {
+    warnings.push(
+      formatWarning({ message: `${DEPRECATED_GATE_KEY_WARNING} Ops: ${opsOnOldGateKey.join(", ")}.` }),
+    );
+  }
   if (
     result.sourceFileCount > 0 &&
     result.outputs.size === 0 &&