tfdsl 0.1.10 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 188ff59f9e8c63a9d7123ed9900db3079a74b17f16926b11cebf3863db5cbf41
-  data.tar.gz: 45d14091543dfe0e02512247dffbcf97550432715c357e2ab382c62482a9856d
+  metadata.gz: 53dc500c87b4a8775477610f94c90265c74a8b0fb065855c1f6914dca2dcbbaa
+  data.tar.gz: 5d5c9b8187223be0b79da605dde02e987ac0b7316c37aefdf046f86ec82170c0
 SHA512:
-  metadata.gz: 71f58ea39f028ddb1dfc1ddf06388e02975bb0583bd3da4db9571e6ea14b10d8f60ec66b7bc19824417e106a3d961c52414b98913c7b265ad272d9aab3357b49
-  data.tar.gz: 4dff89253f6ede3be10703f0a1a7ee41d43ffbeac17de45f69ee8c9b8fc7a187451ab5288ad37b6d2a8f5514a70ff87a9fd487cca46013e163263e631b194cb7
+  metadata.gz: a77d38c0cf2c1546a8bbf3fe37bc3a8c7383bb46fec86b7797cac517bba012738a5b180586fc4dd3d3c657f339d4b7c2296e55268145ec4ef44c38f1d4549642
+  data.tar.gz: efb9ed85d08976da942ea83b32851a0ff6f05b6d608bf848d8395d1d506daf2ff23d78b6cdfbb3bd878e6a2edbcde40f6314360543df1a5f2c9c0697765d34a1

data/.gitignore

@@ -6,3 +6,4 @@
 /pkg/
 /spec/reports/
 /tmp/
+/Gemfile.lock

data/.rubocop.yml

@@ -1,27 +1,30 @@
-Style/ConditionalAssignment:
+AllCops:
+  TargetRubyVersion: 2.7
+  NewCops: enable
+  SuggestExtensions: false
+
+Style/Documentation:
   Enabled: false
-Layout/IndentArray:
-  Enabled: false
-Style/ClassVars:
+
+Layout/LineLength:
+  Max: 120
+
+Metrics/BlockLength:
   Exclude:
-    - lib/**/block.rb
-Metrics/AbcSize:
-  Exclude: 
-    - lib/**/formatter.rb
-    - lib/**/data_formatter.rb
-    - lib/**/block.rb
+    - '*.gemspec'
+    - test/**/*
+
 Metrics/MethodLength:
-  Max: 35 
-Metrics/LineLength:
-  Max: 120
   Exclude:
     - test/**/*
-Layout/ElseAlignment:
-  Enabled: false
-Metrics/CyclomaticComplexity:
-  Max: 10
-Metrics/PerceivedComplexity: 
-  Max: 10
-Metrics/BlockLength:
+
+Style/ClassAndModuleChildren:
+  Exclude:
+    - test/**/*
+
+Metrics/AbcSize:
+  Max: 20
+
+Metrics:
   Exclude:
-    - '*.gemspec' 
+    - test/**/*

data/CLAUDE.md

@@ -0,0 +1,86 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What this is
+
+`tfdsl` is a small Ruby gem (no runtime dependencies) that renders a Chef-like Ruby DSL as Terraform
+HCL text. The output is meant to be byte-identical to what `terraform fmt` produces. The gem is
+published as `tfdsl` (the name `terraform_dsl` on rubygems.org belongs to someone else); the code lives
+under `lib/terraform_dsl/` in the `TerraformDSL` module, and `lib/tfdsl.rb` adds the legacy `TFDSL`
+alias. Releases go out with `bundle exec rake release` after bumping `lib/terraform_dsl/version.rb`.
+
+## Commands
+
+```bash
+bin/setup                      # bundle install
+bundle exec rake               # rubocop + full test suite (the default task, what CI runs)
+bundle exec rake test          # tests only
+bundle exec rubocop            # lint only (RuboCop 1.x, NewCops enabled, TargetRubyVersion 2.7)
+bundle exec rubocop -a         # autocorrect safe offenses
+
+# Single test file / single test
+bundle exec ruby -Ilib -Itest test/terraform_dsl/template_test.rb
+bundle exec ruby -Ilib -Itest test/terraform_dsl/block_test.rb -n test_assignment_syntax_and_multiple_arguments
+
+bin/console                    # IRB with the gem loaded
+```
+
+SimpleCov enforces 95% minimum line coverage; the suite fails below that.
+
+`test/terraform_dsl/terraform_test.rb` shells out to the real `terraform` binary (`fmt -check`,
+`init -backend=false`, `validate`) and is skipped when `terraform` is not on the PATH. CI installs
+Terraform, so locally install it too if you touch rendering. The validate fixture deliberately uses only
+the builtin `terraform_data` resource so no provider download is needed.
+
+`Gemfile.lock` is intentionally not committed. Dev dependencies live in the `Gemfile`, not the gemspec.
+
+## Architecture
+
+HCL rendering flows `Stack -> Block -> Formatter -> Template`; JSON rendering flows
+`Stack#to_h -> Block#to_h -> JsonSyntax`:
+
+- **`Block`** (`lib/terraform_dsl/block.rb`) is the whole DSL. `method_missing` turns a call with
+  arguments into an entry in the ordered `@__attrs__` hash and a call with a Ruby block into a child
+  `Block` in `@__blocks__` (its name is `__type__`, extra args are `__labels__`). Attribute order is
+  declaration order. So that almost any HCL attribute name works, the class body **undefines every
+  inherited Object method except `KEEP`**, plus a few private Kernel methods (`format`, `test`,
+  `select`, `open`, `system`). Consequences: anything you need to call on a Block instance from
+  library or test code (e.g. `instance_of?` for Minitest's `assert_instance_of`) must be in `KEEP`;
+  and Block is a plain `Object`, not `BasicObject`, precisely so that `puts`, `raise` and top-level
+  helper methods still work inside DSL blocks.
+- **Marker subclasses** (`Resource`, `Variable`, `Moved`, `Check`, `Action`, ...) each only set
+  `KEYWORD`. `Formatter.header` uses `block.class::KEYWORD` to decide top-level vs nested rendering:
+  top-level quotes `__type__` and labels after the keyword (`resource "aws_vpc" "main"`), nested
+  prints `__type__` bare and quotes only labels (`backend "local"`). Adding a Terraform top-level
+  block type = new 7-line subclass file + `require_relative` in `lib/terraform_dsl.rb` + an entry in
+  `Stack::BLOCKS`. Nested block kinds (`lifecycle`, `precondition`, `dynamic`, ...) need no code.
+- **`Stack`** defines one method per `BLOCKS` entry and joins the blocks' `to_tf` with blank lines.
+  `tfmodule` exists because `module` is a Ruby keyword; `data`/`datasource` are aliases.
+- **`Formatter`** (stateless module, depth passed as a parameter) renders a block's header,
+  attributes, children and closing brace with 2-space indentation.
+- **`Template`** maps Ruby values to HCL: String -> quoted/escaped (heredoc `<<-EOT` when it ends
+  with `\n`), **Symbol -> raw expression** (this is how references, functions and types are
+  written), Numeric/true/false bare, nil -> `null`, Array/Hash recursive. A Hash argument is a map
+  *attribute* (`tags = {}`); a Ruby block is a nested *block*. `Template.assignments` reproduces
+  `terraform fmt`'s `=` alignment: consecutive single-line values share a column, a multi-line
+  `{`/`[` value breaks the run and is itself unaligned. Blank lines inside heredocs must stay empty
+  (Terraform ignores them when computing `<<-` indentation; padding them changes the value).
+- **`JsonSyntax`** backs `Block#to_h`, `Stack#to_h` and `Stack#to_json` (Terraform JSON syntax, used by
+  consumers that write `.tf.json`). `JsonSyntax.value` wraps Symbols as `"${...}"`, except for attributes
+  listed in the block class's `STATIC_REFS` (`provider`, `depends_on`, `ignore_changes`, a variable's
+  `type`, `moved`/`import`/`removed` addresses), which JSON syntax requires as bare reference strings.
+  `terraform validate` rejects `${}` there, so extend `STATIC_REFS` when adding such an argument. `JsonSyntax.insert` nests a body under
+  `[keyword, type, *labels]` and turns a repeated path into an array, which is how repeated blocks
+  (`provider "aws"` twice, two `ingress` blocks) are expressed. `terraform_test.rb` validates a generated
+  `.tf.json` as well as the `.tf`.
+
+## Testing conventions
+
+- `test/terraform_dsl/stack_test.rb` holds one golden `EXPECTED` string covering every block kind,
+  exposed as `StackTest.stack` so `terraform_test.rb` can run `terraform fmt -check` on the same
+  output. Any change to rendering must keep that fixture passing `fmt -check`; update `EXPECTED` to
+  the canonical `terraform fmt` form, never the other way round.
+- Fixtures must be valid Terraform 0.12+ (e.g. `provisioner`, not `provider`, inside a resource).
+- `alias` is a Ruby keyword; in the DSL it is written `self.alias = 'west'` (the `=` suffix is stripped
+  by `method_missing`).

data/Gemfile

@@ -1,6 +1,10 @@
-source 'https://rubygems.org'
+# frozen_string_literal: true
 
-git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
+source 'https://rubygems.org'
 
-# Specify your gem's dependencies in tfdsl.gemspec
 gemspec
+
+gem 'minitest', '~> 5.0'
+gem 'rake', '~> 13.0'
+gem 'rubocop', '~> 1.50'
+gem 'simplecov', '~> 0.22'

data/README.md

@@ -1,13 +1,10 @@
-[![Gem Version](https://badge.fury.io/rb/tfdsl.svg)](http://badge.fury.io/rb/tfdsl)
-[![Build Status](https://travis-ci.org/tlopo-ruby/tfdsl.svg?branch=master)](https://travis-ci.org/tlopo-ruby/tfdsl)
-[![Code Climate](https://codeclimate.com/github/tlopo-ruby/tfdsl/badges/gpa.svg)](https://codeclimate.com/github/tlopo-ruby/tfdsl)
-[![Coverage Status](https://coveralls.io/repos/github/tlopo-ruby/tfdsl/badge.svg?branch=master)](https://coveralls.io/github/tlopo-ruby/tfdsl?branch=master)
+# tfdsl
 
-# TFDSL
+A Chef like Ruby DSL that renders Terraform (HCL) configuration.
 
-A Chef like DSL for Terraform.
-
-Terraform uses HCL for its configuration, which is better than json or yaml in my opinion, but still not quite as flexible as Chef DSL, so here it's a chef like DSL for terraform.
+HCL is a fine configuration language, but it is not a programming language. This gem lets
+you describe Terraform blocks in Ruby, with loops, helper methods and everything else Ruby
+gives you, and renders them as `terraform fmt` formatted HCL.
 
 ## Installation
 
@@ -23,68 +20,178 @@ And then execute:
 
 Or install it yourself as:
 
-    $ gem install terraform_dsl
+    $ gem install tfdsl
 
 ## Usage
 
-A quick usage example 
 ```ruby
-require 'tfdsl'
-  
-stack = TFDSL.stack do
+require 'terraform_dsl'
+
+stack = TerraformDSL.stack do
   resource 'aws_vpc', 'main' do
     cidr_block '10.0.0.0/16'
     instance_tenancy 'dedicated'
-    tags do
-      Name 'main'
+    tags Name: 'main'
+  end
+
+  resource 'aws_subnet', 'public' do
+    vpc_id :'aws_vpc.main.id'
+    cidr_block :'cidrsubnet(aws_vpc.main.cidr_block, 8, 1)'
+    lifecycle do
+      precondition do
+        condition :'aws_vpc.main.enable_dns_support'
+        error_message 'DNS support must be enabled'
+      end
     end
   end
 end
 
 puts stack
 ```
-The code above will produce the output below: 
+
+The code above produces:
+
 ```hcl
 resource "aws_vpc" "main" {
-  cidr_block = "10.0.0.0/16"
+  cidr_block       = "10.0.0.0/16"
   instance_tenancy = "dedicated"
-
   tags = {
     Name = "main"
   }
 }
+
+resource "aws_subnet" "public" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = cidrsubnet(aws_vpc.main.cidr_block, 8, 1)
+  lifecycle {
+    precondition {
+      condition     = aws_vpc.main.enable_dns_support
+      error_message = "DNS support must be enabled"
+    }
+  }
+}
+```
+
+### Rules
+
+Inside a block, every method call is either an **attribute** (when given arguments) or a
+**nested block** (when given a Ruby block). Nested blocks can carry labels, so
+`backend 'local' do ... end` renders `backend "local" { ... }`. Any nested block Terraform
+knows works this way: `lifecycle`, `precondition`, `postcondition`, `validation`, `dynamic`,
+`content`, `provisioner`, `connection`, `assert`, `required_providers`, and so on.
+
+Ruby values map to HCL values:
+
+| Ruby                   | HCL                                   |
+|------------------------|---------------------------------------|
+| `'text'`               | `"text"`, escaped as needed           |
+| `"multi\nline\n"`      | `<<-EOT` heredoc (string ends in `\n`)|
+| `:'aws_vpc.main.id'`   | raw expression `aws_vpc.main.id`      |
+| `:string`, `:'list(string)'` | type expression                 |
+| `1`, `1.5`, `true`     | `1`, `1.5`, `true`                    |
+| `nil`                  | `null`                                |
+| `[80, 443]`            | `[80, 443]` list                      |
+| `{ Name: 'main' }`     | `{ Name = "main" }` map attribute     |
+
+So a Hash argument gives a map **attribute** (`tags = { ... }`) while a Ruby block gives a
+nested **block** (`lifecycle { ... }`). Symbols are written verbatim, which is how you
+reference resources, variables, functions and types.
+
+### Top level blocks
+
+| DSL                                  | HCL                               |
+|--------------------------------------|-----------------------------------|
+| `terraform do ... end`               | `terraform { }`                   |
+| `provider 'aws' do ... end`          | `provider "aws" { }`              |
+| `variable 'name' do ... end`         | `variable "name" { }`             |
+| `locals do ... end`                  | `locals { }`                      |
+| `tfmodule 'vpc' do ... end`          | `module "vpc" { }`                |
+| `data 'aws_ami', 'web' do ... end`   | `data "aws_ami" "web" { }`        |
+| `resource 'aws_vpc', 'main' do ... end` | `resource "aws_vpc" "main" { }` |
+| `output 'id' do ... end`             | `output "id" { }`                 |
+| `moved do ... end`                   | `moved { }`                       |
+| `import do ... end`                  | `import { }`                      |
+| `removed do ... end`                 | `removed { }`                     |
+| `check 'health' do ... end`          | `check "health" { }`              |
+| `ephemeral 'random_password', 'db' do ... end` | `ephemeral "random_password" "db" { }` |
+| `action 'aws_lambda_invoke', 'x' do ... end`   | `action "aws_lambda_invoke" "x" { }`   |
+
+`module` is a Ruby keyword, hence `tfmodule`. `datasource` is kept as an alias of `data`.
+
+### Using Ruby inside blocks
+
+Blocks are evaluated with `instance_eval`, so local variables, constants and top level
+helper methods are all available inside them:
+
+```ruby
+def ami_for(region)
+  AMIS.fetch(region)
+end
+
+stack = TerraformDSL.stack do
+  REGIONS.each do |region|
+    resource 'aws_instance', "web_#{region}" do
+      ami ami_for(region)
+      instance_type 'm1.small'
+    end
+  end
+end
 ```
 
-## Ruby Reserved Words
+Nearly every name works as an attribute, including Ruby method names such as `hash`,
+`method`, `format` or `test`. The exceptions are `class`, `inspect`, `to_s` and a few other
+basics a Ruby object needs, plus private Kernel methods that you would expect to keep working
+inside a block, such as `puts`, `p`, `raise`, `require`, `lambda` or `loop`. Methods of a
+surrounding class are not reachable from inside a block because `self` is the block.
+
+Ruby keywords such as `alias` cannot be called bare, so use the assignment form:
+`self.alias = 'west'`.
 
-Since some terraform object names use Ruby reserved words, we had to do some slight modifications on how resources are named. 
-We use `datasource` for `data` and `tfmodule` for `module`
+`require 'tfdsl'` also works and defines `TFDSL` as an alias of `TerraformDSL`, for code written
+against tfdsl 0.1.x. Note that 0.2.0 changed the output format: values are typed, references are
+written as Symbols, and `to_json` renders bare strings for static references.
 
-Example:
+Each block class can also be used on its own:
 
-In ruby
 ```ruby
-datasource 'aws_ami', 'web' do
-...
-end
+TerraformDSL::Resource.new('aws_vpc', 'main') { cidr_block '10.0.0.0/16' }.to_tf
 ```
-In HCL
-```hcl
-data 'aws_ami' 'web' {
-...
-}
+
+### JSON output
+
+A stack also renders in
+[Terraform JSON syntax](https://developer.hashicorp.com/terraform/language/syntax/json),
+for writing a `.tf.json` file:
+
+```ruby
+stack.to_json   # pretty printed JSON string
+stack.to_h      # the same as a Hash
 ```
 
+Symbols become `"${...}"` template strings, except where JSON syntax wants a plain reference
+string: a variable's `type`, `provider`, `providers`, `depends_on`, `ignore_changes`,
+`replace_triggered_by`, and the addresses in `moved`, `import` and `removed` blocks. Repeated
+blocks, such as two `provider "aws"` blocks or two `ingress` blocks, become arrays.
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+After checking out the repo, run `bin/setup` to install dependencies. Then run `rake` to
+run RuboCop and the tests. You can also run `bin/console` for an interactive prompt.
+
+When the `terraform` binary is on the PATH the test suite also checks the generated
+configuration with `terraform fmt -check` and `terraform validate`.
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new
+version, update the version number in `version.rb`, and then run `bundle exec rake release`,
+which will create a git tag for the version, push git commits and tags, and push the `.gem`
+file to [rubygems.org](https://rubygems.org).
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/terraform_dsl. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
+Bug reports and pull requests are welcome on GitHub at
+https://github.com/tlopo-ruby/terraform-dsl. This project is intended to be a safe, welcoming
+space for collaboration, and contributors are expected to adhere to the
+[Contributor Covenant](http://contributor-covenant.org) code of conduct.
 
 ## License
 
@@ -92,4 +199,6 @@ The gem is available as open source under the terms of the [MIT License](https:/
 
 ## Code of Conduct
 
-Everyone interacting in the TerraformDsl project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/[USERNAME]/terraform_dsl/blob/master/CODE_OF_CONDUCT.md).
+Everyone interacting in the TerraformDSL project's codebases, issue trackers, chat rooms and
+mailing lists is expected to follow the
+[code of conduct](https://github.com/tlopo-ruby/terraform-dsl/blob/master/CODE_OF_CONDUCT.md).

data/Rakefile

@@ -1,7 +1,8 @@
+# frozen_string_literal: true
+
 require 'bundler/gem_tasks'
 require 'rake/testtask'
 require 'rubocop/rake_task'
-require 'coveralls/rake/task'
 
 Rake::TestTask.new(:test) do |t|
   t.libs << 'test'
@@ -9,8 +10,6 @@ Rake::TestTask.new(:test) do |t|
   t.test_files = FileList['test/**/*_test.rb']
 end
 
-task default: %i[rubocop test]
-task test_with_coveralls: [:default, 'coveralls:push']
-
 RuboCop::RakeTask.new
-Coveralls::RakeTask.new
+
+task default: %i[rubocop test]

data/bin/console

@@ -1,14 +1,8 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require 'bundler/setup'
-require 'tfdsl'
-
-# You can add fixtures and/or initialization code here to make experimenting
-# with your gem easier. You can also use a different console, if you like.
-
-# (If you use this, don't forget to add pry to your Gemfile!)
-# require "pry"
-# Pry.start
-
+require 'terraform_dsl'
 require 'irb'
+
 IRB.start(__FILE__)

data/lib/terraform_dsl/action.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  class Action < Block
+    KEYWORD = 'action'
+  end
+end

data/lib/terraform_dsl/block.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  # A terraform configuration block: https://developer.hashicorp.com/terraform/language/syntax/configuration
+  #
+  # Inside the DSL block every bare method call becomes either an attribute
+  # (when called with arguments) or a nested block (when called with a Ruby
+  # block). Subclasses set KEYWORD to the top-level block keyword.
+  class Block
+    KEYWORD = nil
+    # Arguments that take static references, which JSON syntax wants as plain
+    # strings rather than "${...}" expressions. Subclasses extend the list.
+    STATIC_REFS = %w[provider providers depends_on ignore_changes replace_triggered_by].freeze
+
+    # Ruby methods a Block keeps. Everything else Object provides is undefined
+    # so that it can be used as an attribute name (class, hash, method, ...).
+    KEEP = %i[instance_eval instance_exec class is_a? kind_of? instance_of? respond_to? object_id
+              __send__ __id__ equal? == != ! inspect to_s freeze frozen? nil?].freeze
+    (instance_methods - KEEP).each { |m| undef_method m }
+    # Private Kernel methods that are plausible attribute names.
+    %i[format test select open system].each { |m| undef_method m }
+
+    attr_accessor :__type__, :__labels__
+    attr_reader :__attrs__, :__blocks__
+
+    def initialize(type = nil, *labels, &block)
+      @__type__ = type
+      @__labels__ = labels
+      @__attrs__ = {}
+      @__blocks__ = []
+      instance_eval(&block) if block
+    end
+
+    def method_missing(name, *args, &block)
+      name = name.to_s.chomp('=')
+      return (@__blocks__ << Block.new(name, *args, &block)).last if block
+      return @__attrs__[name] if args.empty?
+
+      @__attrs__[name] = args.size == 1 ? args.first : args
+    end
+
+    def respond_to_missing?(_name, _include_private = false)
+      false
+    end
+
+    def to_tf
+      "#{Formatter.format(self)}\n"
+    end
+
+    # The block body in Terraform JSON syntax: attributes plus nested blocks
+    # keyed by type and labels.
+    def to_h
+      body = @__attrs__.to_h do |name, value|
+        [name, JsonSyntax.value(value, static: self.class::STATIC_REFS.include?(name))]
+      end
+      @__blocks__.each { |child| JsonSyntax.insert(body, [child.__type__, *child.__labels__], child.to_h) }
+      body
+    end
+
+    def to_s
+      to_tf
+    end
+  end
+end

data/lib/terraform_dsl/check.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  class Check < Block
+    KEYWORD = 'check'
+  end
+end

data/lib/terraform_dsl/data_source.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  class DataSource < Block
+    KEYWORD = 'data'
+  end
+end

data/lib/terraform_dsl/ephemeral.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  class Ephemeral < Block
+    KEYWORD = 'ephemeral'
+  end
+end

data/lib/terraform_dsl/formatter.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  # Renders a Block (and its nested blocks) as HCL text.
+  module Formatter
+    module_function
+
+    def format(block, depth = 0)
+      pad = INDENT * depth
+      lines = ["#{pad}#{header(block)} {"]
+      attrs = block.__attrs__.map { |name, value| [name, Template.value(value, depth + 1)] }
+      lines.concat Template.assignments(attrs, pad + INDENT)
+      block.__blocks__.each { |child| lines << format(child, depth + 1) }
+      lines << "#{pad}}"
+      lines.join("\n")
+    end
+
+    # Top level blocks:  resource "aws_vpc" "main"
+    # Nested blocks:     backend "local"
+    def header(block)
+      keyword = block.class::KEYWORD
+      name, *labels = keyword ? [keyword, block.__type__, *block.__labels__] : [block.__type__, *block.__labels__]
+      [name, *labels.compact.map { |label| Template.string(label.to_s) }].join(' ')
+    end
+  end
+end

data/lib/terraform_dsl/import.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  class Import < Block
+    KEYWORD = 'import'
+    STATIC_REFS = (Block::STATIC_REFS + %w[to]).freeze
+  end
+end

data/lib/terraform_dsl/json_syntax.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  # Helpers for rendering blocks in Terraform JSON syntax:
+  # https://developer.hashicorp.com/terraform/language/syntax/json
+  module JsonSyntax
+    module_function
+
+    # Symbols (raw HCL expressions) become "${...}" template strings, or bare
+    # strings for static references such as depends_on or a variable's type.
+    def value(obj, static: false)
+      case obj
+      when Hash then obj.to_h { |k, v| [k.to_s, value(v, static: static)] }
+      when Array then obj.map { |v| value(v, static: static) }
+      when Symbol then static ? obj.to_s : "${#{obj}}"
+      else obj
+      end
+    end
+
+    # Stores body under the nested keys. A repeated key turns into an array of
+    # bodies, which is how JSON syntax represents repeated blocks.
+    def insert(hash, keys, body)
+      key, *rest = keys.map(&:to_s)
+      return insert(hash[key] ||= {}, rest, body) unless rest.empty?
+
+      hash[key] = case (existing = hash[key])
+                  when nil then body
+                  when Array then existing + [body]
+                  else [existing, body]
+                  end
+    end
+  end
+end

data/lib/terraform_dsl/locals.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  class Locals < Block
+    KEYWORD = 'locals'
+  end
+end

data/lib/terraform_dsl/moved.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  class Moved < Block
+    KEYWORD = 'moved'
+    STATIC_REFS = (Block::STATIC_REFS + %w[from to]).freeze
+  end
+end

data/lib/terraform_dsl/output.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  class Output < Block
+    KEYWORD = 'output'
+  end
+end

data/lib/terraform_dsl/provider.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  class Provider < Block
+    KEYWORD = 'provider'
+  end
+end

data/lib/terraform_dsl/removed.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module TerraformDSL
+  class Removed < Block
+    KEYWORD = 'removed'
+    STATIC_REFS = (Block::STATIC_REFS + %w[from]).freeze
+  end
+end