infraweaver 0.3.7 → 0.3.8

package/src/mcp/terraform/idleFloor.ts

@@ -12,6 +12,7 @@ import {
   AZURE_PRICE_REGION,
 } from "#app/mcp/terraform/azurePrices";
 import type { TfResourceEntry } from "#app/mcp/terraform/cspm";
+import { tableCell } from "#app/utils/markdownTable";
 
 /**
  * Idle-floor detection — the resources that
@@ -464,7 +465,7 @@ export function renderCostMarkdown(report: IdleFloorReport, toolVersion: string)
       "| --- | --- | --- | --- |",
       ...provider.items.map(
         (i) =>
-          `| \`${i.address}\` | ${i.resourceType} | ${i.file}:${i.line} | ${money(i.currency, i.monthly_cost)} |`,
+          `| \`${i.address}\` | ${i.resourceType} | ${tableCell(`${i.file}:${i.line}`)} | ${money(i.currency, i.monthly_cost)} |`,
       ),
       "",
     );

package/src/mcp/terraform/initArtefacts.ts

@@ -0,0 +1,76 @@
+/**
+ * The `terraform init` output a tool leaves in the checkout, and undoing it.
+ *
+ * Validate inits every root in place. In a review that dirties the checkout the
+ * agent then works in; in a write mode it is worse — the push refuses a dirty
+ * tree, and an editor that deletes the files by hand spends turns on it, or
+ * commits a lock file the repository never had.
+ */
+import { rmSync } from "node:fs";
+import { join, posix } from "node:path";
+import { resetTerraformInitCache } from "#app/mcp/terraform/scanners";
+import { run } from "#app/mcp/terraform/subprocess";
+import { log } from "#app/utils/cli";
+
+const INIT_ARTEFACTS = new Set([".terraform", ".terraform.lock.hcl"]);
+
+export interface InitArtefacts {
+  /** init output git neither tracks nor ignores. */
+  untracked: Set<string>;
+  /** committed lock files with uncommitted changes. */
+  modifiedLocks: Set<string>;
+}
+
+/**
+ * The `terraform init` output in the checkout, as repo-relative paths; null
+ * outside a git checkout. A committed lock file counts once it is modified:
+ * init adds the runner's platform hash to one made on another platform (a
+ * lock file from a Mac lacks the linux hash).
+ */
+export function initArtefacts(cwd: string): InitArtefacts | null {
+  const r = run("git", ["status", "--porcelain=v1", "-z", "--untracked-files=normal"], cwd);
+  if (r.status !== 0) return null;
+  const entries = r.stdout.split("\0");
+  const isArtefact = (p: string) => INIT_ARTEFACTS.has(posix.basename(p.replace(/\/$/, "")));
+  return {
+    untracked: new Set(
+      entries
+        .filter((e) => e.startsWith("?? "))
+        .map((e) => e.slice(3))
+        .filter(isArtefact),
+    ),
+    modifiedLocks: new Set(
+      entries
+        .filter((e) => e[1] === "M" && e[2] === " ")
+        .map((e) => e.slice(3))
+        .filter((p) => posix.basename(p) === ".terraform.lock.hcl"),
+    ),
+  };
+}
+
+/**
+ * Undo what the gate scan's init did to the checkout: remove the artefacts it
+ * created and restore the committed lock files it changed. Validate inits every
+ * root in place, and a checkout that is dirty before the agent starts makes
+ * `checkout_pr` refuse — or, on a committing run, ships the change in the fix.
+ * What was there before the scan is left alone.
+ */
+export function removeNewInitArtefacts(
+  cwd: string,
+  before: InitArtefacts | null,
+  by: string,
+): void {
+  if (!before) return;
+  const top = run("git", ["rev-parse", "--show-toplevel"], cwd).stdout.trim();
+  const after = initArtefacts(cwd);
+  const created = [...(after?.untracked ?? [])].filter((p) => !before.untracked.has(p));
+  const changed = [...(after?.modifiedLocks ?? [])].filter((p) => !before.modifiedLocks.has(p));
+  if (!top || created.length + changed.length === 0) return;
+  for (const p of created) rmSync(join(top, p), { recursive: true, force: true });
+  if (changed.length > 0) run("git", ["checkout", "--", ...changed], top);
+  resetTerraformInitCache();
+  log.info(
+    `» ${by}: removed ${created.length} terraform init artefact(s) from the checkout` +
+      (changed.length ? `, restored ${changed.length} committed lock file(s)` : ""),
+  );
+}

package/src/mcp/terraform/localModules.ts

@@ -0,0 +1,112 @@
+/**
+ * The local `module` calls a Terraform root reaches, followed through every
+ * local module it calls in turn, each resolved against the disk.
+ *
+ * `terraform validate` cannot report a local source that points nowhere: init
+ * fails to install the module, and validate's "Module not installed" is
+ * indistinguishable from an init that failed for an environmental reason (no
+ * network, a private registry), so it is dropped as noise. A local source needs
+ * neither — whether `./modules/s3` exists is a fact about the tree — so it is
+ * read here instead, and a missing one is reported as the defect it is.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, posix, resolve } from "node:path";
+import { parseModuleBlocks } from "#app/mcp/modules";
+
+/**
+ * The `source` a module block in `fromDir` writes to call the module at
+ * `moduleDir`, both repo-relative POSIX paths. A local source is relative to the
+ * CALLER's directory, so `./modules/s3` is right only from the repo root; from
+ * `env/dev` the same module is `../../modules/s3`.
+ */
+export function localSourceFrom(fromDir: string, moduleDir: string): string {
+  const rel = posix.relative(fromDir || ".", moduleDir || ".") || ".";
+  return rel === "." || rel.startsWith("../") || rel === ".." ? rel : `./${rel}`;
+}
+
+const CONFIG_SUFFIXES = [".tf", ".tf.json", ".tofu"] as const;
+
+interface LocalModuleCall {
+  /** absolute path of the file declaring the call. */
+  file: string;
+  /** 1-based line of the `module` header; null in JSON configuration. */
+  line: number | null;
+  name: string;
+  source: string;
+  /** absolute directory the source resolves to. */
+  dir: string;
+  /** whether that directory holds any Terraform configuration. */
+  exists: boolean;
+}
+
+export interface LocalModuleClosure {
+  /** every local call reached from the root, missing ones included. */
+  calls: LocalModuleCall[];
+  /** the root and every existing local module directory it reaches. */
+  dirs: string[];
+}
+
+/** the configuration files directly in `dir` (not beneath it). */
+export function configFilesIn(dir: string): string[] {
+  try {
+    return readdirSync(dir)
+      .filter((f) => CONFIG_SUFFIXES.some((s) => f.endsWith(s)))
+      .map((f) => join(dir, f))
+      .filter((f) => statSync(f).isFile())
+      .sort();
+  } catch {
+    return [];
+  }
+}
+
+function callsIn(file: string): Omit<LocalModuleCall, "dir" | "exists">[] {
+  let text: string;
+  try {
+    text = readFileSync(file, "utf-8");
+  } catch {
+    return [];
+  }
+  if (file.endsWith(".json")) {
+    try {
+      const doc = JSON.parse(text) as { module?: Record<string, { source?: unknown }> };
+      return Object.entries(doc.module ?? {}).flatMap(([name, block]) =>
+        typeof block?.source === "string" && /^\.\.?[\\/]/.test(block.source)
+          ? [{ file, line: null, name, source: block.source }]
+          : [],
+      );
+    } catch {
+      return [];
+    }
+  }
+  return parseModuleBlocks(text)
+    .filter((b) => b.kind === "local")
+    .map((b) => {
+      const at = text.search(new RegExp(`module\\s+"${RegExp.escape(b.name)}"`));
+      return {
+        file,
+        line: at < 0 ? null : text.slice(0, at).split("\n").length,
+        name: b.name,
+        source: b.source,
+      };
+    });
+}
+
+export function localModuleClosure(rootDir: string): LocalModuleClosure {
+  const calls: LocalModuleCall[] = [];
+  const seen = new Set<string>([resolve(rootDir)]);
+  const queue = [resolve(rootDir)];
+  for (let dir = queue.shift(); dir !== undefined; dir = queue.shift()) {
+    for (const file of configFilesIn(dir)) {
+      for (const call of callsIn(file)) {
+        const target = resolve(dir, call.source);
+        const exists = existsSync(target) && configFilesIn(target).length > 0;
+        calls.push({ ...call, dir: target, exists });
+        if (exists && !seen.has(target)) {
+          seen.add(target);
+          queue.push(target);
+        }
+      }
+    }
+  }
+  return { calls, dirs: [...seen] };
+}

package/src/mcp/terraform/moduleDocs.ts

@@ -1,5 +1,6 @@
 import { PRODUCT_NAME } from "#app/brand";
 import type { ModuleInterface } from "#app/mcp/modules";
+import { tableCell } from "#app/utils/markdownTable";
 import packageJson from "#package.json" with { type: "json" };
 
 export type ModuleDocsVerdict =
@@ -41,11 +42,7 @@ const VERDICT_CLAIM: Record<ModuleDocsVerdict, string> = {
 };
 
 function escapeCell(text: string | null): string {
-  if (!text) return "";
-  return text
-    .replaceAll("|", "\\|")
-    .replaceAll(/\s*\n\s*/g, " ")
-    .trim();
+  return text ? tableCell(text) : "";
 }
 
 function moduleName(moduleDir: string): string {

package/src/mcp/terraform/moduleFindings.ts

@@ -0,0 +1,102 @@
+/**
+ * Findings inside a module the repository does not hold — a registry or git
+ * module that `terraform init` or checkov fetched — moved to the module call
+ * that instantiates it.
+ *
+ * Both scanners evaluate such a module with the caller's inputs, which is how an
+ * insecure input (`block_public_acls = false`) shows up at all. But they report
+ * the finding against the fetched copy: a path under `.terraform/modules`, under
+ * checkov's download directory, or one trivy synthesises from the module source.
+ * None of those is a file in the repository, so a review scoped to the roots a
+ * change reaches drops the finding, and a fix loop points the agent at code it
+ * must not edit. The call is where the finding is answered — through the
+ * module's inputs — and where a reviewer reads the change.
+ */
+import { isAbsolute, join, posix, relative, resolve } from "node:path";
+import { readTextCapped } from "#app/mcp/modules";
+import { buildConcern, type Concern } from "#app/mcp/terraform/types";
+
+/** Where a scanner was told to put the modules it fetched, outside the tree. */
+export interface FetchDir {
+  /** the directory the scanner's paths are relative to. */
+  cwd: string;
+  dir: string;
+}
+
+/**
+ * True when a scanner-reported path is a fetched module's copy, not repository
+ * code: under terraform's or checkov's module directory in the tree, or under
+ * the directory a scan had checkov download into. A path that merely leaves the
+ * scanned directory is not enough — a scan of one root reports the repository's
+ * own local modules as `../../modules/x`.
+ */
+export function isFetchedModulePath(file: string, fetchedInto?: FetchDir): boolean {
+  const segments = file.replace(/\\/g, "/").split("/");
+  if (segments.some((s) => s === ".terraform" || s === ".external_modules")) return true;
+  if (!fetchedInto) return false;
+  const rel = relative(fetchedInto.dir, resolve(fetchedInto.cwd, file));
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
+
+/** 1-based line of `module "<name>"` in `file`, or null when it is not there. */
+export function moduleCallLine(cwd: string, file: string, name: string): number | null {
+  const text = readTextCapped(join(cwd, file));
+  if (text === null) return null;
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const at = text.search(new RegExp(`^[ \\t]*module[ \\t]+"${escaped}"[ \\t]*\\{`, "m"));
+  return at < 0 ? null : text.slice(0, at).split("\n").length;
+}
+
+/** `module.<name>…` → `<name>`, the call in the root that instantiates it. */
+export function topModuleName(address: string): string | null {
+  return /^module\.([^.[]+)/.exec(address)?.[1] ?? null;
+}
+
+export interface ModuleFinding {
+  /** the concern as the scanner reported it, against the fetched copy. */
+  concern: Concern;
+  /** the call that instantiates the module, in the repository. */
+  call: { file: string; line: number | null };
+  /** the module resource the finding is about, e.g. `module.data.aws_s3_bucket.this`. */
+  address: string;
+}
+
+/**
+ * Re-locate each finding to its call, saying in the evidence which module
+ * resource it is about and where in the module. Findings that land on the same
+ * call under the same rule are one concern — a concern's identity is its rule
+ * and location — so they are merged, every resource named: one concern per
+ * resource would be collapsed by the dedupe anyway, and silently.
+ */
+export function relocateToCalls(findings: ModuleFinding[]): Concern[] {
+  const merged = new Map<string, { concern: Concern; addresses: string[]; where: string[] }>();
+  for (const { concern, call, address } of findings) {
+    const bareRule = concern.rule_id.slice(concern.source.length + 1);
+    const at = buildConcern({
+      source: concern.source,
+      rule: bareRule,
+      file: call.file,
+      line: call.line,
+      severity: concern.severity,
+      category: concern.category,
+      evidence: concern.evidence,
+      remediation_hint: concern.remediation_hint,
+      // the scanner's snippet is the module's code; the location is now the call
+      code_snippet: null,
+      ...(concern.language ? { language: concern.language } : {}),
+    });
+    const where = `${posix.basename(concern.location.file)}:${concern.location.line ?? "?"}`;
+    const prior = merged.get(at.id);
+    if (!prior) merged.set(at.id, { concern: at, addresses: [address], where: [where] });
+    else if (!prior.addresses.includes(address)) {
+      prior.addresses.push(address);
+      prior.where.push(where);
+    }
+  }
+  return [...merged.values()].map(({ concern, addresses, where }) => ({
+    ...concern,
+    evidence:
+      `${concern.evidence} — inside the module: ` +
+      addresses.map((a, i) => `${a} (${where[i]})`).join(", "),
+  }));
+}

package/src/mcp/terraform/moduleVersionConstraints.ts

@@ -46,7 +46,7 @@ export interface UnpinnedModule {
 
 /** the 1-based line of a `module "<name>"` header in a file. */
 function moduleLine(hcl: string, name: string): number {
-  const re = new RegExp(`module\\s+"${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}"\\s*\\{`);
+  const re = new RegExp(`module\\s+"${RegExp.escape(name)}"\\s*\\{`);
   const at = re.exec(hcl)?.index;
   return at === undefined ? 1 : hcl.slice(0, at).split("\n").length;
 }

package/src/mcp/terraform/planPairs.ts

@@ -33,6 +33,7 @@
  * network. The plan file is supplied by the caller.
  */
 
+import { isDeepStrictEqual } from "node:util";
 import type { PlanResourceChange } from "#app/mcp/terraform/plan";
 
 // --- ignore rules ------------------------------------------------------------
@@ -172,25 +173,6 @@ export function isUnknownPath(unknown: Set<string>, path: string): boolean {
   return false;
 }
 
-/** structural equality over JSON values (the only shapes a plan contains). */
-function deepEqual(a: unknown, b: unknown): boolean {
-  if (a === b) return true;
-  if (typeof a !== typeof b) return false;
-  if (Array.isArray(a) && Array.isArray(b)) {
-    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
-  }
-  if (typeof a === "object" && a !== null && typeof b === "object" && b !== null) {
-    if (Array.isArray(a) !== Array.isArray(b)) return false;
-    const ka = Object.keys(a);
-    const kb = Object.keys(b);
-    if (ka.length !== kb.length) return false;
-    return ka.every((k) =>
-      deepEqual((a as Record<string, unknown>)[k], (b as Record<string, unknown>)[k]),
-    );
-  }
-  return false;
-}
-
 // --- pair comparison ---------------------------------------------------------
 
 export interface PairComparison {
@@ -239,7 +221,7 @@ export function comparePair(
     }
     const a = before.get(path);
     const b = after.get(path);
-    if (deepEqual(a, b)) {
+    if (isDeepStrictEqual(a, b)) {
       equal++;
       continue;
     }

package/src/mcp/terraform/policyGate.ts

@@ -404,11 +404,6 @@ function blockKey(block: { keyword: string; labels: string[] }): string {
   return [block.keyword, ...block.labels].join(".");
 }
 
-/** A `resource` or `module` header whose first label is NOT quoted. Valid HCL,
- *  but `parseBlocks` reads quoted labels only, so such a block would be invisible
- *  — and an invisible violation is a pass. */
-const UNQUOTED_BLOCK = /(?:^|\n)[ \t]*(?:resource|module)[ \t]+[A-Za-z_][A-Za-z0-9_-]*[ \t{]/;
-
 /** Why the walk below never reads a module block's code, or null when it does.
  *  A local source is walked where it lives — unless its path leaves `cwd` or
  *  lands in a directory the walk skips; then it is as unseen as a registry
@@ -506,16 +501,6 @@ function evaluateRulesStatically(
   const types = new Set(rules.map((r) => r.resource_type));
   for (const { rel, text } of files) {
     const file = posix(rel);
-    if (blindSpotMatters && UNQUOTED_BLOCK.test(text)) {
-      blind(
-        file,
-        "a resource or module block with an unquoted label is not read by the static path",
-        {
-          file,
-        },
-      );
-    }
-
     for (const { block, unread } of modules.get(rel) ?? []) {
       if (!unread) continue; // its resources are walked where they live
       const changed = scope.kind === "all" || scope.isChanged(rel, blockKey(block), block.body);

package/src/mcp/terraform/refactor/attribution.ts

@@ -23,14 +23,15 @@
 
 import { posix } from "node:path";
 import { parseModuleBlocks } from "#app/mcp/modules";
-import type { FetchedModules } from "#app/mcp/terraform/refactor/workspace";
 import { type MovedBlock, parseMovedBlocks } from "#app/mcp/terraform/refactor/movedBlocks";
 import {
   type Multiplicity,
   moduleCallMultiplicity,
+  moduleCallProviders,
   parseResourcesWithArgs,
   type ResourceRef,
 } from "#app/mcp/terraform/refactor/resources";
+import type { FetchedModules } from "#app/mcp/terraform/refactor/workspace";
 import type { SourceFile } from "#app/mcp/terraform/tree";
 import { pushInto } from "#app/utils/collect";
 
@@ -52,6 +53,35 @@ interface ModuleCall {
   /** the CALL's own `count`/`for_each` — the outer half of the effective
    *  multiplicity chain. See [[Multiplicity]]. */
   multiplicity: Multiplicity | null;
+  /** the CALL's `providers` map, or null when it passes none — the module then
+   *  inherits the caller's default configurations. See [[parseProvider]]. */
+  providers: Map<string, string> | null;
+}
+
+/** a module's name for a provider configuration → the root's, or null when the
+ *  module cannot reach that configuration at all. */
+type ProviderScope = (local: string) => string | null;
+
+/** the scope inside a module called with `providers` (or without it). Without
+ *  the map a module inherits only the caller's DEFAULT configurations; an
+ *  aliased one must be passed explicitly. */
+function childScope(parent: ProviderScope, providers: Map<string, string> | null): ProviderScope {
+  if (providers === null) return (local) => (local.includes(".") ? null : parent(local));
+  return (local) => {
+    const passed = providers.get(local);
+    return passed === undefined ? null : parent(passed);
+  };
+}
+
+/** the configuration a resource is managed through, as the root names it. */
+function effectiveProvider(
+  r: { type: string; provider: string | null },
+  scope: ProviderScope,
+): string {
+  // a resource with no `provider` uses the default configuration of the
+  // provider its type names: `aws_s3_bucket` → `aws`
+  const local = r.provider ?? r.type.split("_")[0] ?? r.type;
+  return scope(local) ?? `${local} (not passed to this module)`;
 }
 
 /** one `.tf` file, parsed once — everything the attribution walk needs. */
@@ -73,6 +103,7 @@ function parseTree(
   for (const f of files) {
     const dir = posix.dirname(f.path);
     const callMultiplicity = moduleCallMultiplicity(f.hcl);
+    const callProviders = moduleCallProviders(f.hcl);
     const calls: ModuleCall[] = [];
     for (const block of parseModuleBlocks(f.hcl)) {
       const targetDir =
@@ -86,6 +117,7 @@ function parseTree(
         dir: targetDir,
         callName: block.name,
         multiplicity: callMultiplicity.get(block.name) ?? null,
+        providers: callProviders.get(block.name) ?? null,
       });
     }
     const parsed: ParsedFile = {
@@ -189,6 +221,7 @@ export function attributeAddresses(
     prefix: string,
     chain: Multiplicity[],
     path: string[],
+    scope: ProviderScope,
   ): void => {
     if (path.includes(dir)) {
       ambiguous.add(`${root}: module call cycle ${[...path, dir].join(" -> ")}`);
@@ -216,6 +249,7 @@ export function attributeAddresses(
           multiplicity: r.multiplicity
             ? [...chain, { ...r.multiplicity, at: "resource" as const }]
             : chain,
+          provider: effectiveProvider(r, scope),
         });
       }
       for (const mv of p.moved) {
@@ -232,12 +266,14 @@ export function attributeAddresses(
           `${prefix}module.${c.callName}.`,
           c.multiplicity ? [...chain, { ...c.multiplicity, at: "module" as const }] : chain,
           [...path, dir],
+          childScope(scope, c.providers),
         );
       }
     }
   };
 
-  for (const root of roots) visit(root, root, "", [], []);
+  // at a root every configuration is its own name
+  for (const root of roots) visit(root, root, "", [], [], (local) => local);
 
   const uninstantiated = [...byDir.keys()].filter((d) => !reached.has(d)).sort();
   return { resources, ambiguous: [...ambiguous].sort(), roots, moved, uninstantiated };
@@ -279,9 +315,7 @@ export function attributePair(
     const present = new Set(files.map((f) => f.path));
     return [...files, ...fetched.files.filter((f) => !present.has(f.path))];
   };
-  const opts = fetched
-    ? { moduleDirs, fetchedBySource: fetched.bySource }
-    : { moduleDirs };
+  const opts = fetched ? { moduleDirs, fetchedBySource: fetched.bySource } : { moduleDirs };
   return {
     before: attributeAddresses(withFetched(beforeFiles), opts),
     after: attributeAddresses(withFetched(afterFiles), opts),

package/src/mcp/terraform/refactor/equivalence.ts

@@ -97,6 +97,9 @@ export interface EquivalenceResult {
   multiplicity_preserved: boolean;
   /** per-resource multiplicity drift, human-readable on both sides. */
   multiplicity_diffs: { resource: string; before: string; after: string }[];
+  /** relocations that changed the provider configuration managing the resource
+   *  (G16) — another region or account, with every argument unchanged. */
+  provider_diffs: { resource: string; before: string; after: string }[];
   /** relocations where the repetition changed LEVEL — it sat on the resource and
    * now sits on a module call, or the reverse (G15). The instance key moves to a
    * different position in the address, so the same instances live at entirely
@@ -399,12 +402,19 @@ function uncoveredInstanceKeys(p: Pairing): string[] | null {
   const written = (k: string) => (kind === "count" ? k : `"${k}"`);
   const declared = new Set<string>();
   for (const blk of p.blocks) {
-    // read the key off whichever side carries it: the point of a relevelling is
-    // that only one of them does, and which one depends on the direction.
-    const keys = instanceKeysOf(blk.from).concat(instanceKeysOf(blk.to));
-    const unique = new Set(keys);
-    if (unique.size !== 1) return null;
-    for (const k of unique) declared.add(k);
+    // A relevelling repeats BOTH sides, at different levels: the instance is
+    // `aws_s3_bucket.data["logs"]` before and `module.data["logs"].…` after, so a
+    // block covers it only when each side names that same key. A key on one side
+    // alone (`aws_s3_bucket.data["logs"]` → `module.data.aws_s3_bucket.this`)
+    // points at an address the repetition no longer has, and Terraform plans it
+    // as a destroy and a create.
+    const from = instanceKeysOf(blk.from);
+    const to = instanceKeysOf(blk.to);
+    // more than one key per side is a chain this proof does not read; no key on
+    // either side names no single instance
+    if (from.length > 1 || to.length > 1) return null;
+    if (from.length === 0 && to.length === 0) return null;
+    if (from.length === 1 && to.length === 1 && from[0] === to[0]) declared.add(from[0] as string);
   }
   return expected.filter((k) => !declared.has(written(k)));
 }
@@ -492,6 +502,23 @@ export function computeEquivalence(
   }
   const multiplicityPreserved = multiplicityDiffs.length === 0;
 
+  // 2d. the provider configuration per pair (G16). A resource on
+  // `provider = aws.replica` moved into a module called without a `providers`
+  // map is managed by the module's default `aws` afterwards: every argument,
+  // move and planned value unchanged, and the resource in another region.
+  // Compared only where both sides were attributed (a hand-built ref has none).
+  const providerDiffs: EquivalenceResult["provider_diffs"] = [];
+  const seenProviderDiff = new Set<string>();
+  for (const p of corr.pairs) {
+    const before = p.before.provider;
+    const after = p.after.provider;
+    if (before === undefined || after === undefined || before === after) continue;
+    const id = `${p.before.key}|${before}|${after}`;
+    if (seenProviderDiff.has(id)) continue;
+    seenProviderDiff.add(id);
+    providerDiffs.push({ resource: p.before.address, before, after });
+  }
+
   // 2c. WHERE the repetition sits, not just how much of it there is (G15).
   //
   // Moving a `for_each` from the resource onto the module call that now wraps it
@@ -514,7 +541,9 @@ export function computeEquivalence(
     if (seenRelevel.has(id)) continue;
     seenRelevel.add(id);
     const missing = p.keyed ? uncoveredInstanceKeys(p) : null;
-    if (missing !== null && missing.length > 0) missingKeys.set(p.before.key, missing);
+    // per relocation, not per logical key: `aws_s3_bucket.data` at the root and
+    // inside a module share one key and are missing different instances
+    if (missing !== null && missing.length > 0) missingKeys.set(id, missing);
     relevelled.push({
       resource: p.before.key,
       from: p.before.address,
@@ -536,14 +565,16 @@ export function computeEquivalence(
         `instance key. Terraform would DESTROY and RECREATE every instance. Write one per-key ` +
         `\`moved {}\` block instead.`,
     );
-  for (const r of relevelledKeyedIncomplete)
+  for (const r of relevelledKeyedIncomplete) {
+    const missing = missingKeys.get(`${r.from}=>${r.to}`) ?? [];
     reasons.push(
       `${r.resource}: the repetition moved between levels (${r.from} → ${r.to}) and the collection ` +
         `is written out in the configuration, so the instance keys are known — and ` +
-        `${(missingKeys.get(r.resource) ?? []).length} of them have NO \`moved {}\` block: ` +
-        `${(missingKeys.get(r.resource) ?? []).map((k) => `"${k}"`).join(", ")}. Terraform would ` +
+        `${missing.length} of them have NO \`moved {}\` block: ` +
+        `${missing.map((k) => `"${k}"`).join(", ")}. Terraform would ` +
         `DESTROY and RECREATE those instances. Write one per-key block for each.`,
     );
+  }
   for (const r of relevelledKeyedUnread)
     reasons.push(
       `${r.resource}: the repetition moved between levels (${r.from} → ${r.to}) and the per-key ` +
@@ -556,6 +587,12 @@ export function computeEquivalence(
       `instance multiplicity CHANGED for ${d.resource}: ${d.before} → ${d.after} — this adds or ` +
         `destroys instances, whatever the argument names say`,
     );
+  for (const d of providerDiffs)
+    reasons.push(
+      `provider configuration CHANGED for ${d.resource}: ${d.before} → ${d.after} — the resource ` +
+        `would be managed through another configuration (region or account) with every argument ` +
+        `unchanged. Pass it to the module call: \`providers = { ${d.after.split(" ")[0]?.split(".")[0]} = ${d.before} }\`.`,
+    );
 
   // 3. moved-block exhaustiveness. A pair whose address changed is a relocation;
   // it is COVERED exactly when a declared block established the pairing, and
@@ -639,6 +676,7 @@ export function computeEquivalence(
     !resourceSetEquivalent ||
     !argNamesEquivalent ||
     !multiplicityPreserved ||
+    providerDiffs.length > 0 ||
     !movesExhaustive ||
     illegalMoves.length > 0 ||
     relevelledUnkeyed.length > 0 ||
@@ -671,6 +709,7 @@ export function computeEquivalence(
     arg_diffs: argDiffs,
     multiplicity_preserved: multiplicityPreserved,
     multiplicity_diffs: multiplicityDiffs,
+    provider_diffs: providerDiffs,
     relevelled_repetitions: relevelled,
     unsettled_only_keyed_relevel:
       verdict === "unverifiable" && relevelledKeyedUnread.length > 0 && !otherDoubt,