@intentius/chant 0.58.0 → 0.60.0

package/src/terraform/providers/kubernetes.ts

@@ -18,6 +18,11 @@
  * can only name the family, and `adopt` reads the body to learn the rest —
  * which is also why one rule here covers every CRD.
  *
+ * It has no `kubernetes_manifest` data source either, so it does not read back
+ * as its own type. `MANIFEST_READ_BACK` below is the shape `carve bridge` uses
+ * instead: `data "kubernetes_resource"`, built from the manifest's own
+ * apiVersion/kind/metadata (#2034).
+ *
  * It has no live adoption path. `carve emit --env` filters a live export by a
  * native type, and there is no type to filter by until the body is read; state
  * is where the body is. `liveSelectorType` therefore returns undefined and
@@ -26,6 +31,7 @@
  */
 
 import type { AdoptedSource, CarveProvider, DeferredParam, TierInfo } from "../carve-provider";
+import type { DataSourceShape } from "../data-source-shape";
 import type { StateResource } from "../state";
 
 /** The chant lexicon the emitted source imports from. */
@@ -208,14 +214,54 @@ function adoptManifestFromState(resource: StateResource, params: DeferredParam[]
   };
 }
 
+/**
+ * How `carve bridge` reads a carved `kubernetes_manifest` back (#2034).
+ *
+ * The provider ships no `kubernetes_manifest` data source — checked against
+ * hashicorp/kubernetes v3.2.1, whose 27 data sources include no manifest. The
+ * generic read is `data "kubernetes_resource"`, which asks for the GVK and the
+ * name rather than taking them from a body: `api_version`, `kind`, and a
+ * nested `metadata` block with `name` and an optional `namespace`. All three
+ * come out of the manifest the resource declared.
+ *
+ * Survivors read the object back through `object`, and only through `object`:
+ * the resource exposes both `manifest` (the declared body) and `object` (the
+ * API server's read-back), the data source exposes just the latter. So both
+ * map to `object`, and a reference to `.manifest.data.log_level` lands on
+ * `.object.data.log_level` rather than an attribute that does not exist.
+ *
+ * A namespace-less manifest (a ClusterRole, a CRD) simply omits `namespace`,
+ * which the data source allows. A manifest whose name is interpolated resolves
+ * no literal and falls back to the bridge's TODO body, as an AWS type with an
+ * interpolated bucket name does.
+ */
+const MANIFEST_READ_BACK: DataSourceShape = {
+  type: "kubernetes_resource",
+  args: [
+    { name: "api_version", from: "manifest.apiVersion", required: true },
+    { name: "kind", from: "manifest.kind", required: true },
+  ],
+  blocks: [
+    {
+      name: "metadata",
+      fields: [
+        { name: "name", from: "manifest.metadata.name", required: true },
+        { name: "namespace", from: "manifest.metadata.namespace" },
+      ],
+    },
+  ],
+  readAttrs: { manifest: "object", object: "object" },
+};
+
 export const kubernetesCarveProvider: CarveProvider = {
   name: "kubernetes",
   tfTypePrefixes: ["kubernetes_"],
   lexicon: "k8s",
   tiers: TIERS,
-  // A dotted path into nested blocks: the graph walks it for identity, and
-  // `carve bridge` refuses the type because a data-source body cannot express it.
+  // A dotted path into the manifest body: the graph walks it for identity. It
+  // cannot be a data-source argument on its own, so the read-back is a shape.
   identityAttrs: { kubernetes_manifest: "manifest.metadata.name" },
+  dataSourceShapes: { kubernetes_manifest: MANIFEST_READ_BACK },
   emitTypes: ["kubernetes_manifest"],
   adopt: (resource, params) => adoptManifestFromState(resource, params),
   // State only — the kind is in the body, so a live export has nothing to

package/src/terraform/tier-map.ts

@@ -18,14 +18,17 @@
  */
 
 import {
+  carveDataSourceShape,
   carveFoldParent,
   carveIdentityAttr,
   carveTierMap,
   resolveEmitProvider,
   type TierInfo,
 } from "./carve-provider";
+import type { DataSourceShape } from "./data-source-shape";
 
 export { carveEmitTypes, type TierInfo } from "./carve-provider";
+export type { DataSourceShape } from "./data-source-shape";
 
 /** TF resource type → native tier, over every registered provider. Absent = unsupported (score 0). */
 export function tierMap(): Readonly<Record<string, TierInfo>> {
@@ -66,12 +69,24 @@ export function canCarveEmit(tfType: string): boolean {
 }
 
 /**
- * Can `chant carve bridge` render a Terraform `data` source for this type? A
- * dotted identity attribute is a path into nested blocks, and a data source
- * body is flat `attr = value` — `manifest.metadata.name = "x"` is not valid
- * HCL. An absent entry is fine: the bridge writes a TODO comment instead.
+ * How `chant carve bridge` reads this type back as a `data` source: the
+ * data-source type, where each argument comes from in the carved body, and how
+ * a survivor's attribute path translates (#2034). Undefined when the type
+ * cannot be read back at all.
+ */
+export function dataSourceShapeOf(tfType: string): DataSourceShape | undefined {
+  return carveDataSourceShape(tfType);
+}
+
+/**
+ * Can `chant carve bridge` render a Terraform `data` source for this type?
+ * True whenever its provider contributes a shape — declared, or implied by a
+ * plain identity attribute. False for a dotted identity attribute with no
+ * declared shape: that is a path into nested values, and a flat `attr = value`
+ * body cannot express it (`manifest.metadata.name = "x"` is not valid HCL). A
+ * type with no identity attribute at all still bridges; the bridge writes a
+ * TODO comment for the body.
  */
 export function canBridge(tfType: string): boolean {
-  const attr = carveIdentityAttr(tfType);
-  return attr === undefined || !attr.includes(".");
+  return carveDataSourceShape(tfType) !== undefined;
 }

package/src/terraform/types.ts

@@ -34,6 +34,14 @@ export interface TfNode {
    * emit. Undefined when the identity attribute is absent or interpolated.
    */
   identity?: string;
+  /**
+   * The literals the type's data-source shape reads out of the block (#2034),
+   * keyed by the shape field's source path (`manifest.metadata.name`). This is
+   * what `carve bridge` renders the `data` body from — a superset of
+   * `identity`, since a shape can need more than one value (`api_version`,
+   * `kind` and `metadata.name` for a `kubernetes_manifest`).
+   */
+  dataSourceValues?: Record<string, string>;
 }
 
 /**