@intentius/behold 0.9.0 → 0.10.0

package/example-argo-estate/app-a/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-k8s": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-k8s": "^0.44.7"
   }
 }

package/example-argo-estate/app-b/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-k8s": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-k8s": "^0.44.7"
   }
 }

package/example-argo-estate/control-plane/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o dist/control-plane.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-k8s": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-k8s": "^0.44.7"
   }
 }

package/example-argo-estate/package-lock.json

@@ -14,22 +14,22 @@
     "app-a": {
       "name": "behold-example-argo-app-a",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-k8s": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-k8s": "^0.44.7"
       }
     },
     "app-b": {
       "name": "behold-example-argo-app-b",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-k8s": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-k8s": "^0.44.7"
       }
     },
     "control-plane": {
       "name": "behold-example-argo-control-plane",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-k8s": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-k8s": "^0.44.7"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -464,9 +464,9 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.6.tgz",
-      "integrity": "sha512-VFqPKe2WsSAJoUvfyghVTlIcj+QRNn//JgSHToq6PDDuKPU7F34V/4f+EZpX4MF3gvwVkZc9d6FUwKio6t0uqg==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.7.tgz",
+      "integrity": "sha512-etCchkfbWFHJ+XnTYVVn9GT4/gZi/O8SVphDXHeuPOfK5VvRxo0unveIUEsuRoHGHgzN9Y+aj0Jk15xhIE7Gzg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
@@ -482,9 +482,9 @@
       }
     },
     "node_modules/@intentius/chant-k8s-client": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.6.tgz",
-      "integrity": "sha512-Do3zY0Bd2nIITDDrXYePwdOBdnNf59xn5J1aJA6gsg3dzXxR3dZ25YBAh+SQxKbRPuXIbu9rKd5lodaM8ZQDng==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.7.tgz",
+      "integrity": "sha512-G9VVki/qHZ+hbKrxDDnVVhfeZWoHgozLA7tjcY/lsa/fDIwI0xMJnAN/DJNcQLBpRscXm3y3Ki/PNQ9SxshmLA==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -492,19 +492,19 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-k8s": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.6.tgz",
-      "integrity": "sha512-JP2Lo4fFV7FPbSTHapKuDgpvrsm3dbNBT9pMW9NQB2MoE/ZkMGf3z3/wsPnygLdjbYq29abVYmw7DzPqBmA1tw==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.7.tgz",
+      "integrity": "sha512-h8QXOYoxjsAeA1w8koLQlZqOuSQcvWpEHKmwlf0AKPgwuVRiapwJI+UtuoBwL/AOrBKDh6Z5pW3zbo6vDltGvA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@types/js-yaml": "^4.0.9",
         "js-yaml": "^4.1.1"
       },
       "optionalDependencies": {
-        "@intentius/chant-k8s-client": "^0.44.6"
+        "@intentius/chant-k8s-client": "^0.44.7"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.6",
+        "@intentius/chant": "^0.44.7",
         "typescript": "^5.9.3",
         "zod": "^4.3.6"
       }
@@ -1071,9 +1071,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz",
+      "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==",
       "license": "MIT",
       "optional": true,
       "engines": {

package/example-carve/README.md

@@ -49,7 +49,7 @@ end of the walkthrough has somewhere to land.
 
 ## Bands
 
-Real output, from `chant carve advise` at chant 0.44.6. Reproduce it with:
+Real output, from `chant carve advise` at chant 0.44.7. Reproduce it with:
 
 ```sh
 npm install -D @cdktf/hcl2json          # once, anywhere on your PATH resolution
@@ -60,35 +60,45 @@ chant carve advise --from example-carve/legacy-tf \
 | score | address | band | why | role in the script |
 |---|---|---|---|---|
 | 100 | `aws_cloudwatch_log_group.worker` | clean leaf | clean 1:1 native map, no boundary edges | the free first move: named, not carved |
-| 88 | `aws_s3_bucket.assets` | clean leaf | 1 inbound | **the star** — the resource we carve on camera |
+| 84 | `aws_s3_bucket.assets` | clean leaf | 1 inbound, 1 output | **the star** — the resource we carve on camera |
 | 71 | `module.cdn` | carvable w/ edits | 1 outbound, tier 2, data present | one module, so module scoring appears |
 | 69 | `aws_iam_role.api` | carvable w/ edits | 1 inbound, 1 outbound, tier 2 | what an inbound edge costs |
 | 69 | `aws_vpc_endpoint.ssm` | carvable w/ edits | 4 outbound, tier 2 | outbound edges are cheap, but they add up |
-| 65 | `aws_lambda_function.api` | carvable w/ edits | 5 outbound, tier 2 | the honest yellow: next month, not today |
-| 46 | `aws_subnet.private_a` | leave in Terraform | 3 inbound, 2 outbound, data present | |
-| 46 | `aws_subnet.private_b` | leave in Terraform | 3 inbound, 2 outbound, data present | |
+| 61 | `aws_lambda_function.api` | carvable w/ edits | 1 output, 5 outbound, tier 2 | the honest yellow: next month, not today |
 | 43 | `aws_security_group.lambda` | leave in Terraform | 2 inbound, 2 outbound, tier 2, data present | |
-| 36 | `aws_vpc.main` | leave in Terraform | 5 inbound, 1 outbound | the grey anchor: this stays, and that's fine |
+| 42 | `aws_subnet.private_a` | leave in Terraform | 3 inbound, 1 output, 2 outbound, data present | |
+| 42 | `aws_subnet.private_b` | leave in Terraform | 3 inbound, 1 output, 2 outbound, data present | |
+| 32 | `aws_vpc.main` | leave in Terraform | 5 inbound, 1 output, 1 outbound | the grey anchor: this stays, and that's fine |
 | 0 | `aws_network_acl.private` | leave in Terraform | no known native mapping | |
 | 0 | `random_pet.suffix` | leave in Terraform | no known native mapping | the long tail, stated plainly |
 
 Bands: 80-100 carve now, 50-79 carve with boundary edits, 0-49 leave in Terraform.
 
-The scoring model is `100 - 12*inbound - 4*outbound - 15*(tier-1) - 10*dynamic
-- 3*(instances-1)`, clamped, with unmapped types pinned at 0. Every number
+The scoring model is `100 - 12*inbound - 4*outbound - 4*outputs - 15*(tier-1) -
+10*dynamic - 3*(instances-1)`, clamped, with unmapped types pinned at 0. The
+`outputs` term is chant#1638 (chant 0.44.7): an `output` block that reads a
+resource is a boundary edge too now, `bridge: "tf-output-rewrite"`, because
+carving that resource means rewriting the output the same way carving a
+resource with an inbound reference means adding a data source. Every number
 above is that arithmetic on the edges in `legacy-tf/`, which is why the estate
 is shaped the way it is:
 
-- The bucket has exactly one inbound edge, `aws_lambda_function.api`'s
-  `ASSETS_BUCKET` environment variable. One edge, one patch, 88.
+- The bucket has one inbound edge — `aws_lambda_function.api`'s
+  `ASSETS_BUCKET` environment variable — and, since `outputs.tf`'s
+  `assets_bucket` reads it too, one output edge. Two edges, two rewrites, 84.
+  `assets_bucket` is deliberate: a downstream consumer of this state reads the
+  bucket name today, so the carve has a second thing to bridge, not just the
+  lambda's env var.
 - `aws_s3_bucket_versioning.assets` and `aws_s3_bucket_public_access_block.assets`
   share the bucket's name, so they fold into its carve set. They are not ranked
   separately and their edges to the bucket are not counted against it.
-- Five resources point at the VPC. Carving it would mean patching all five at
-  once, and 36 says so.
+- Five resources point at the VPC, and its existing `vpc_id` output reads it
+  too. Carving it would mean patching all five survivors and rewriting the
+  output, and 32 says so.
 - The subnets and the security group each read a data source, which costs 10.
-  That is what pushes them under the line rather than sitting awkwardly in the
-  middle band next to the star.
+  The subnets also feed `private_subnet_ids`, an existing output, which costs
+  4 more apiece and drops them under the security group's 43 — the one place
+  the outputs term reorders the table, not just re-scores it.
 
 No resource uses `count` or `for_each`, so the instance-count penalty is zero
 and `--state` produces byte-identical scores to a `.tf`-only parse. The bands do
@@ -109,14 +119,20 @@ chant carve advise --from example-carve/legacy-tf \
 
 from the repository root, so the `from` field stays a relative path.
 
-`app/` pins chant ^0.44.6 and that floor is load-bearing, not housekeeping: the
-advisor only publishes a top-level `version: 1` and per-resource `boundary` edge
-lists from 0.44.6 (chant#1636). Run the same command on 0.44.4 and every score
-is identical but no resource carries a `boundary` field at all, so the Pick step
-falls back to naming inbound/outbound COUNTS instead of highlighting the one
-`aws_lambda_function.api` edge the carve severs. The committed report above is
-byte-identical to what 0.44.6 regenerates, which is why the demo's fallback path
-and its fresh-run path show the same picture.
+`app/` pins chant ^0.44.7 and that floor is load-bearing, not housekeeping, in
+two layers. The advisor only publishes a top-level `version: 1` and
+per-resource `boundary` edge lists from 0.44.6 (chant#1636) — run the same
+command on 0.44.4 and every score is identical but no resource carries a
+`boundary` field at all, so the Pick step falls back to naming inbound/outbound
+COUNTS instead of naming the edges the carve severs. 0.44.7 adds a second
+layer on top: `output` blocks read as boundary edges (chant#1638), so the
+bucket scores 84 instead of 88 and the report's `patchOnCarve` list names
+`output.assets_bucket` alongside `aws_lambda_function.api`; and `carve emit`'s
+fold is applied, not just reported (chant#1637), so the emitted bucket actually
+carries `VersioningConfiguration` and `PublicAccessBlockConfiguration` instead
+of leaving them in an "unmapped attributes" comment. The committed report above
+is byte-identical to what 0.44.7 regenerates, which is why the demo's fallback
+path and its fresh-run path show the same picture.
 
 ## The six beats
 
@@ -124,20 +140,21 @@ These are the six steps on the panel's Carve tab. behold runs beats 4 and 5
 itself, into `app/carveout/` in the copy; beat 6 is copy buttons, on purpose.
 
 1. **The green star.** The estate view, banded. Two resources are green; the
-   100 is a log group nobody will miss, so the eye lands on the 88 next to it.
-2. **The arithmetic.** Open `aws_s3_bucket.assets`: 100 minus 12 for one
-   inbound edge. The score is not a vibe, it is a subtraction, and the inspect
-   pane shows the terms.
-3. **The cut edge.** Highlight the one dependency the carve severs:
-   `aws_lambda_function.api` reads the bucket name. One line of Terraform.
+   100 is a log group nobody will miss, so the eye lands on the 84 next to it.
+2. **The arithmetic.** Open `aws_s3_bucket.assets`: 100 minus 12 for the
+   inbound edge, minus 4 more for the output block that reads it. The score is
+   not a vibe, it is a subtraction, and the inspect pane shows the terms.
+3. **The cut edge.** Highlight the two dependencies the carve severs:
+   `aws_lambda_function.api` reads the bucket name, and the `assets_bucket`
+   output reads it too. Two one-line rewrites, not one.
 4. **Emit.** `carve emit --from legacy-tf --state legacy-tf/terraform.tfstate
    --select aws_s3_bucket.assets` adopts the bucket from state into typed chant
-   source, folds both sub-resources into the carve set, and writes a boundary
-   report. Nothing is applied, nothing is destroyed, and `chant lint` on the
-   result exits clean.
+   source, folds both sub-resources into the carve set AS native props
+   (chant#1637's fold, applied), and writes a boundary report. Nothing is
+   applied, nothing is destroyed, and `chant lint` on the result exits clean.
 5. **The bridge.** One `data "aws_s3_bucket" "assets"` block in the surviving
-   Terraform, and `aws_lambda_function.api` reads from that instead. The
-   surviving plan is whole again.
+   Terraform; `aws_lambda_function.api` and the `assets_bucket` output both
+   read from that instead. The surviving plan is whole again.
 6. **The handoff.** Two commands: `terraform state rm aws_s3_bucket.assets`,
    then chant takes the observe position. `terraform plan` shows no destroy.
 
@@ -153,14 +170,21 @@ no AWS account and no network. The only dependency beyond this directory is
 `@cdktf/hcl2json`, which chant lazy-loads and names in its error if absent. This
 tier guarantees the first thirty seconds of the video.
 
-**`--live` is the full video.** Boot a scratch Floci, arm
-`legacy-tf/floci-override.tf.disabled` (see its header), and `terraform apply`
-the estate into it, so the state is one terraform really wrote. Then the observe
-beats become footage rather than caption: after Emit, `chant lifecycle diff
---live` reads the bucket out of Floci, clean, while Terraform still owns it; the
-handoff runs a real `terraform plan` showing no destroy; and behold's overlay
-flips the bucket green afterwards. The line it exists for is "Terraform forgot
-it, chant adopted it, and it never blinked."
+**`--live` is the full video.** `behold demo carve --live` boots a scratch
+Floci (`behold-carve-floci`, its own port, deleted on exit), arms
+`legacy-tf/floci-override.tf.disabled` (see its header) into the demo copy, and
+`terraform apply -target`s the starred resources into it — so the tfstate the
+advisor reads is one terraform really wrote. At Handoff the stepper gains a
+read-only **terraform plan** button: before `state rm` it shows a no-op, after
+it the carved bucket is simply gone from Terraform's world — `0 to destroy`.
+The line the tier exists for is "Terraform forgot it, chant adopted it, and it
+never blinked."
+
+One beat stays caption rather than footage for now: `chant lifecycle diff
+--live` reading the bucket clean while Terraform still owns it. chant's AWS
+observe is CFN-stack-scoped by logical id, so a Terraform-owned resource reads
+confirmed-missing regardless of its existence — chant#1647 tracks the
+physical-identity read path that unlocks it.
 
 The live tier needs `docker` and `terraform` on PATH, boots its own throwaway
 Floci and deletes it after, and never touches an existing `floci*` container.
@@ -169,22 +193,32 @@ walkthrough actually carves, are covered (chant's `just carve-emit-e2e` is the
 prior art). The VPC, lambda and CloudFront blocks are scenery for the advisor's
 grey band, so expect `-target` rather than one apply of the whole estate.
 
-## Known rough edge in emit
+## Why build still fails
 
 `carve emit --state --select aws_s3_bucket.assets` reports "Folded in:
-`aws_s3_bucket_public_access_block.assets`, `aws_s3_bucket_versioning.assets`"
-and then emits a `Bucket` carrying neither. Only `bucket` and `tags` are in the
-AWS carve-out table's field map for `aws_s3_bucket`; versioning, public-access
-block and the state's server-side encryption block come out in the "unmapped
-Terraform attributes" comment instead. `chant lint` on the emitted project
-passes with warnings, but `chant build` fails on two AWS policy rules
-(`PublicAccessBlockConfiguration` missing, no TLS-deny bucket policy) even
-though the Terraform declared the first of those.
-
-Verified against chant 0.44.6. The walkthrough's Emit beat shows `lint`, not
-`build`, until the fold is applied as well as reported — the step's "why lint
-and not build?" note says the same thing on screen, so nobody reads a lint pass
-as a build pass. That is chant#1637.
+`aws_s3_bucket_public_access_block.assets`, `aws_s3_bucket_versioning.assets`",
+and as of chant 0.44.7 (chant#1637, chant PR #1640) the emitted `Bucket`
+actually carries both: `VersioningConfiguration` and
+`PublicAccessBlockConfiguration` come out as native props, not an "unmapped
+Terraform attributes" comment. That used to be the rough edge here — a fold
+that was reported but not applied, so `chant build` failed two AWS policy
+rules on source the advisor called clean. It is fixed now.
+
+`chant lint` on the emitted project passes with warnings. `chant build` still
+fails, but on one rule: WAW042, no bucket policy denying non-TLS requests.
+That is not a carve-tooling gap — grep `legacy-tf/` for
+`aws_s3_bucket_policy` and there isn't one. The Terraform never declared a
+TLS-deny policy for this bucket, in any form; chant's post-synth checks
+noticed the moment the resource had a native representation to check. Nothing
+here would show up scanning the `.tf` by eye, because there is nothing to
+find — only an absence.
+
+Verified against chant 0.44.7. The walkthrough's Emit beat still shows `lint`,
+not `build` — the step's "why lint and not build?" note says why on screen —
+but the reason changed: `build` doesn't fail because the fold is incomplete
+anymore, it fails because the estate really does have a policy gap. "chant
+found a policy gap Terraform never noticed" is the honest line to close the
+video on.
 
 ## Values
 

package/example-carve/app/package-lock.json

@@ -6,8 +6,8 @@
     "": {
       "name": "behold-example-carve-app",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-aws": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-aws": "^0.44.7"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -442,9 +442,9 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.6.tgz",
-      "integrity": "sha512-VFqPKe2WsSAJoUvfyghVTlIcj+QRNn//JgSHToq6PDDuKPU7F34V/4f+EZpX4MF3gvwVkZc9d6FUwKio6t0uqg==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.7.tgz",
+      "integrity": "sha512-etCchkfbWFHJ+XnTYVVn9GT4/gZi/O8SVphDXHeuPOfK5VvRxo0unveIUEsuRoHGHgzN9Y+aj0Jk15xhIE7Gzg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
@@ -460,16 +460,16 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-aws": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.44.6.tgz",
-      "integrity": "sha512-2qGwWFCRLkT9MD5YFnhnZOGDCqPZg9la4MM8szlX8QxFFoQjAulJ8e+vjeCGbWoB8nbSIQ9kJOX8Yn46Pm37iQ==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.44.7.tgz",
+      "integrity": "sha512-tlwcUv0zN5rTupRdJHdcYSsKbodiVjYaBAwG/omK4hYPtys3dZMjLVOt8bszBeTKp+h8boIEjhwpgQKpDAGmcQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "fflate": "^0.8.2",
         "js-yaml": "^4.1.0"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.6",
+        "@intentius/chant": "^0.44.7",
         "typescript": "^5.9.3"
       }
     },

package/example-carve/app/package.json

@@ -7,7 +7,7 @@
     "build": "./node_modules/.bin/chant build src --lexicon aws -o template.json"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-aws": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-aws": "^0.44.7"
   }
 }