Function resolveScopedModuleRef

src/resolution/frameworks/terraform.ts:129–211

* Resolve `module.M: ` by locating the `module "M"` declaration in the * reference's own directory, reading its `source` attribute, and looking the * child symbol up inside that directory.

(
  ref: UnresolvedRef,
  moduleName: string,
  child: string,
  refDir: string,
  context: ResolutionContext
)

 * child symbol up inside that directory.
 */
function resolveScopedModuleRef(
  ref: UnresolvedRef,
  moduleName: string,
  child: string,
  refDir: string,
  context: ResolutionContext
): ResolvedRef | null {
  const decls = context
    .getNodesByQualifiedName(`module.${moduleName}`)
    .filter((n) => n.kind === 'module');
  if (decls.length === 0) return null;
  // Terraform scoping: the declaration lives in the reference's directory.
  const decl = decls.find((d) => dirOf(d.filePath) === refDir) ?? (decls.length === 1 ? decls[0]! : null);
  if (!decl) return null;

  const source = readModuleAttr(decl, 'source', context);
  if (!source) return null;

  // --- cloudposse/atmos remote-state: module.M.outputs.X where M is the
  // stack-config remote-state module reading another COMPONENT's state. The
  // component name is static in the monorepo case (`component = "vpc"` or
  // "eks/cluster"), so bridge to that component directory's own
  // `output "X"` — but only when every gate holds: the module source is the
  // remote-state module, the component is a string literal, and exactly ONE
  // directory in the repo matches the component name and declares that
  // output. Anything dynamic or ambiguous stays a visible boundary.
  if (child.startsWith('remote-output.')) {
    if (!/\/remote-state(\/|$)/.test(source)) return null;
    let component = readModuleAttr(decl, 'component', context);
    if (!component) {
      // The other half of real-world declarations indirect through a
      // variable with a literal default in the same directory
      // (`component = var.vpc_component_name` + `default = "vpc"`) — the
      // component's declared static wiring. One hop, same literal gate.
      const viaVar = readNodeSpanMatch(decl, /^\s*component\s*=\s*var\.([A-Za-z0-9_-]+)\s*$/, context);
      if (viaVar) {
        const declared = context
          .getNodesByQualifiedName(`var.${viaVar}`)
          .filter((n) => dirOf(n.filePath) === dirOf(decl.filePath));
        if (declared.length === 1) {
          component = readNodeSpanMatch(declared[0]!, /^\s*default\s*=\s*"([^"]+)"/, context);
        }
      }
    }
    if (!component) return null;
    const outName = child.slice('remote-output.'.length);
    const outs = context
      .getNodesByQualifiedName(`output.${outName}`)
      .filter((o) => {
        const d = dirOf(o.filePath);
        return d === component || d.endsWith('/' + component);
      });
    if (outs.length === 0) return null;
    const dirs = new Set(outs.map((o) => dirOf(o.filePath)));
    if (dirs.size > 1) return null; // two directories claim this component name — never guess
    return { original: ref, targetNodeId: outs[0]!.id, confidence: 0.9, resolvedBy: 'framework' };
  }