@intentius/behold 0.9.0 → 0.9.1

package/README.md

@@ -317,10 +317,11 @@ stepper on the panel's **Carve** tab:
 6. **Done** — the card is marked chant-owned at the observe position;
    `terraform import` reverses all of it.
 
-The Emit step reports `chant lint`, not `chant build`: chant#1637 means `build`
-fails on the emitted bucket even though the advisor scored it 88, and the panel
-links the reason. `example-carve/README.md` has the estate's full story, the
-band table, and the offline/`--live` split.
+The Emit step reports `chant lint`, not `chant build`: `build` fails on the
+emitted bucket (scored 84 by the advisor) on one rule — WAW042, a TLS-deny
+bucket policy the source Terraform never declared — and the panel links the
+reason. `example-carve/README.md` has the estate's full story, the band table,
+and the offline/`--live` split.
 
 behold writes only into the demo copy it made — `app/carveout/`, and nothing
 else. Your Terraform is never edited; see AGENTS.md, "Invariant".

package/dist/cli.js

@@ -4052,6 +4052,7 @@ function scoreArithmetic(r) {
   const terms = [];
   if (p.inbound) terms.push(`- 12x${b.inbound ?? 0} inbound`);
   if (p.outbound) terms.push(`- 4x${b.outbound ?? 0} outbound`);
+  if (p.outputs) terms.push(`- 4x${b.outputs ?? 0} output`);
   if (p.tier) terms.push(`- 15x${(b.tier ?? 1) - 1} tier${b.tier}`);
   if (p.dynamic) terms.push(`- 10 dynamic`);
   if (p.instances) terms.push(`- 3x${(b.instances ?? 1) - 1} instances`);
@@ -4066,6 +4067,7 @@ function boundaryWorkOf(r) {
   const parts = [];
   if (b.inbound) parts.push(`${b.inbound} inbound (a data-source patch each)`);
   if (b.outbound) parts.push(`${b.outbound} outbound (a deferred input each)`);
+  if (b.outputs) parts.push(`${b.outputs} output block(s) reading it (a one-line rewrite each)`);
   if ((b.tier ?? 1) > 1) parts.push(`tier ${b.tier} map`);
   if (b.hasDynamic) parts.push("count/for_each/data present");
   if ((b.instances ?? 1) > 1) parts.push(`${b.instances} instances`);
@@ -4106,6 +4108,7 @@ function carveReportToIr(report) {
         tier: b.tier === null || b.tier === void 0 ? "none" : b.tier,
         inbound: b.inbound ?? 0,
         outbound: b.outbound ?? 0,
+        outputs: b.outputs ?? 0,
         instances: b.instances ?? 1,
         dynamic: b.hasDynamic ?? false,
         // The predicted diff, when the report carries the edge lists: who needs
@@ -4596,7 +4599,7 @@ var refuse2 = (code, error, remedy) => ({
   ok: false,
   refusal: { error, code, remedy }
 });
-var BUILD_CAVEAT = 'The gate shown is `chant lint`, not `chant build`. `carve emit` folds the bucket\'s versioning and public-access-block sub-resources into the carve set but does not yet carry them as native props, so `chant build` fails two AWS policy rules on source the advisor scored 88 (chant#1637). example-carve/README.md, "Known rough edge in emit", has the full statement.';
+var BUILD_CAVEAT = "The gate shown is `chant lint`, not `chant build`. chant#1637's fold is applied now: the bucket's versioning and public-access-block sub-resources come out as native props, not just folded-in mentions. `chant build` still fails, but on one rule only \u2014 WAW042, a TLS-deny bucket policy the source Terraform never declared. That's real drift the estate inherited, not a gap in the carve. example-carve/README.md, \"Why build still fails\", has the full statement.";
 function insideDemo(root, p) {
   const rel = relative(resolve2(root), resolve2(p));
   return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
@@ -5324,6 +5327,7 @@ import { spawn as spawn3 } from "node:child_process";
 import { existsSync as existsSync9, readFileSync as readFileSync10 } from "node:fs";
 import { join as join11 } from "node:path";
 import { platform } from "node:os";
+var DOCKER_DOWN_DETAIL = "docker is down";
 function probe(cmd, args) {
   return new Promise((resolve8) => {
     let out = "";
@@ -5340,12 +5344,12 @@ function probe(cmd, args) {
     proc.on("close", (code) => resolve8({ code: code ?? 1, out }));
   });
 }
-async function dockerAvailable() {
-  const { code } = await probe("docker", ["info", "--format", "{{.ServerVersion}}"]);
+async function dockerAvailable(run3) {
+  const { code } = await run3("docker", ["info", "--format", "{{.ServerVersion}}"]);
   return code === 0;
 }
-async function dockerRunning(nameFilter) {
-  const { code, out } = await probe("docker", ["ps", "--filter", `name=${nameFilter}`, "--format", "{{.Names}}"]);
+async function dockerRunning(run3, nameFilter) {
+  const { code, out } = await run3("docker", ["ps", "--filter", `name=${nameFilter}`, "--format", "{{.Names}}"]);
   if (code !== 0) return [];
   return out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
 }
@@ -5362,10 +5366,11 @@ function projectLexicons(projectDir) {
     return [];
   }
 }
-async function detectSubstrates(projectDir, preview = false, boundContext) {
+async function detectSubstrates(projectDir, preview = false, boundContext, probes = {}) {
+  const run3 = probes.probe ?? probe;
   const subs = [];
   const lexicons = projectLexicons(projectDir);
-  const docker = await dockerAvailable();
+  const docker = await dockerAvailable(run3);
   subs.push({
     name: "docker",
     label: "Docker",
@@ -5373,9 +5378,10 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
     detail: docker ? "daemon running" : "daemon not running",
     bringUp: docker || platform() !== "darwin" ? void 0 : { label: "open -a Docker", cmd: "open", args: ["-a", "Docker"] }
   });
-  const dep = (up, upDetail, offDetail) => !docker ? { status: "blocked", detail: "waiting on Docker" } : { status: up ? "up" : offDetail === "on-demand (pipeline run)" ? "on-demand" : "down", detail: up ? upDetail : offDetail };
+  const DOCKER_BLOCKED = { status: "blocked", detail: DOCKER_DOWN_DETAIL };
+  const dep = (up, upDetail, offDetail) => !docker ? DOCKER_BLOCKED : { status: up ? "up" : offDetail === "on-demand (pipeline run)" ? "on-demand" : "down", detail: up ? upDetail : offDetail };
   if (lexicons.includes("aws")) {
-    const floci = docker ? await dockerRunning("^floci$|^chant-floci$") : [];
+    const floci = docker ? await dockerRunning(run3, "^floci$|^chant-floci$") : [];
     const d = dep(floci.length > 0, "container up on :4566", "not running");
     subs.push({
       name: "floci",
@@ -5390,7 +5396,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
   ];
   for (const [lexicon, name, label, pattern, port] of emulators) {
     if (!lexicons.includes(lexicon)) continue;
-    const running = docker ? await dockerRunning(pattern) : [];
+    const running = docker ? await dockerRunning(run3, pattern) : [];
     subs.push({
       name,
       label,
@@ -5405,7 +5411,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
   ];
   for (const [name, label, marker, script] of forges) {
     if (!existsSync9(join11(projectDir, marker))) continue;
-    const c = docker ? await dockerRunning(name) : [];
+    const c = docker ? await dockerRunning(run3, name) : [];
     const d = dep(c.length > 0, "container up", "on-demand (pipeline run)");
     subs.push({
       name,
@@ -5415,15 +5421,19 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
     });
   }
   if (lexicons.includes("k8s")) {
-    const k3d = await probe("k3d", ["cluster", "list", "--no-headers"]);
-    const clusters = k3d.code === 0 ? k3d.out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean) : [];
-    subs.push({
-      name: "k3d",
-      label: "k3d",
-      status: k3d.code === 127 ? "unknown" : clusters.length ? "up" : "down",
-      detail: k3d.code === 127 ? "k3d not installed" : clusters.length ? `${clusters.length} cluster(s)` : "no clusters",
-      bringUp: docker && k3d.code !== 127 && !clusters.length ? scriptBringUp(projectDir, "scripts/local/local-up.sh", "local-up") : void 0
-    });
+    if (!docker) {
+      subs.push({ name: "k3d", label: "k3d", ...DOCKER_BLOCKED });
+    } else {
+      const k3d = await run3("k3d", ["cluster", "list", "--no-headers"]);
+      const clusters = k3d.code === 0 ? k3d.out.split(/\r?\n/).map((s) => s.trim()).filter(Boolean) : [];
+      subs.push({
+        name: "k3d",
+        label: "k3d",
+        status: k3d.code === 127 ? "unknown" : clusters.length ? "up" : "down",
+        detail: k3d.code === 127 ? "k3d not installed" : clusters.length ? `${clusters.length} cluster(s)` : "no clusters",
+        bringUp: k3d.code !== 127 && !clusters.length ? scriptBringUp(projectDir, "scripts/local/local-up.sh", "local-up") : void 0
+      });
+    }
   }
   if (lexicons.includes("fly")) {
     const endpoint = process.env.FLY_FLAPS_BASE_URL;
@@ -5435,7 +5445,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
     });
   }
   if (existsSync9(join11(projectDir, ".github", "workflows"))) {
-    const gh = await probe("gh", ["auth", "status"]);
+    const gh = await run3("gh", ["auth", "status"]);
     const ready = gh.code === 0;
     subs.push({
       name: "github",
@@ -5458,7 +5468,7 @@ async function detectSubstrates(projectDir, preview = false, boundContext) {
     });
   }
   if (lexicons.includes("helm")) {
-    const helm = await probe("helm", ["version", "--short"]);
+    const helm = await run3("helm", ["version", "--short"]);
     const ambient = helm.code === 0 && !boundContext ? await ambientContext() : void 0;
     const ctx = boundContext ?? ambient ?? "";
     subs.push({

package/example-argo-estate/app-a/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-k8s": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-k8s": "^0.44.7"
   }
 }

package/example-argo-estate/app-b/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-k8s": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-k8s": "^0.44.7"
   }
 }

package/example-argo-estate/control-plane/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o dist/control-plane.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-k8s": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-k8s": "^0.44.7"
   }
 }

package/example-argo-estate/package-lock.json

@@ -14,22 +14,22 @@
     "app-a": {
       "name": "behold-example-argo-app-a",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-k8s": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-k8s": "^0.44.7"
       }
     },
     "app-b": {
       "name": "behold-example-argo-app-b",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-k8s": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-k8s": "^0.44.7"
       }
     },
     "control-plane": {
       "name": "behold-example-argo-control-plane",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-k8s": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-k8s": "^0.44.7"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -464,9 +464,9 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.6.tgz",
-      "integrity": "sha512-VFqPKe2WsSAJoUvfyghVTlIcj+QRNn//JgSHToq6PDDuKPU7F34V/4f+EZpX4MF3gvwVkZc9d6FUwKio6t0uqg==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.7.tgz",
+      "integrity": "sha512-etCchkfbWFHJ+XnTYVVn9GT4/gZi/O8SVphDXHeuPOfK5VvRxo0unveIUEsuRoHGHgzN9Y+aj0Jk15xhIE7Gzg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
@@ -482,9 +482,9 @@
       }
     },
     "node_modules/@intentius/chant-k8s-client": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.6.tgz",
-      "integrity": "sha512-Do3zY0Bd2nIITDDrXYePwdOBdnNf59xn5J1aJA6gsg3dzXxR3dZ25YBAh+SQxKbRPuXIbu9rKd5lodaM8ZQDng==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.7.tgz",
+      "integrity": "sha512-G9VVki/qHZ+hbKrxDDnVVhfeZWoHgozLA7tjcY/lsa/fDIwI0xMJnAN/DJNcQLBpRscXm3y3Ki/PNQ9SxshmLA==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -492,19 +492,19 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-k8s": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.6.tgz",
-      "integrity": "sha512-JP2Lo4fFV7FPbSTHapKuDgpvrsm3dbNBT9pMW9NQB2MoE/ZkMGf3z3/wsPnygLdjbYq29abVYmw7DzPqBmA1tw==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.7.tgz",
+      "integrity": "sha512-h8QXOYoxjsAeA1w8koLQlZqOuSQcvWpEHKmwlf0AKPgwuVRiapwJI+UtuoBwL/AOrBKDh6Z5pW3zbo6vDltGvA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@types/js-yaml": "^4.0.9",
         "js-yaml": "^4.1.1"
       },
       "optionalDependencies": {
-        "@intentius/chant-k8s-client": "^0.44.6"
+        "@intentius/chant-k8s-client": "^0.44.7"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.6",
+        "@intentius/chant": "^0.44.7",
         "typescript": "^5.9.3",
         "zod": "^4.3.6"
       }
@@ -1071,9 +1071,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz",
+      "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==",
       "license": "MIT",
       "optional": true,
       "engines": {

package/example-carve/README.md

@@ -49,7 +49,7 @@ end of the walkthrough has somewhere to land.
 
 ## Bands
 
-Real output, from `chant carve advise` at chant 0.44.6. Reproduce it with:
+Real output, from `chant carve advise` at chant 0.44.7. Reproduce it with:
 
 ```sh
 npm install -D @cdktf/hcl2json          # once, anywhere on your PATH resolution
@@ -60,35 +60,45 @@ chant carve advise --from example-carve/legacy-tf \
 | score | address | band | why | role in the script |
 |---|---|---|---|---|
 | 100 | `aws_cloudwatch_log_group.worker` | clean leaf | clean 1:1 native map, no boundary edges | the free first move: named, not carved |
-| 88 | `aws_s3_bucket.assets` | clean leaf | 1 inbound | **the star** — the resource we carve on camera |
+| 84 | `aws_s3_bucket.assets` | clean leaf | 1 inbound, 1 output | **the star** — the resource we carve on camera |
 | 71 | `module.cdn` | carvable w/ edits | 1 outbound, tier 2, data present | one module, so module scoring appears |
 | 69 | `aws_iam_role.api` | carvable w/ edits | 1 inbound, 1 outbound, tier 2 | what an inbound edge costs |
 | 69 | `aws_vpc_endpoint.ssm` | carvable w/ edits | 4 outbound, tier 2 | outbound edges are cheap, but they add up |
-| 65 | `aws_lambda_function.api` | carvable w/ edits | 5 outbound, tier 2 | the honest yellow: next month, not today |
-| 46 | `aws_subnet.private_a` | leave in Terraform | 3 inbound, 2 outbound, data present | |
-| 46 | `aws_subnet.private_b` | leave in Terraform | 3 inbound, 2 outbound, data present | |
+| 61 | `aws_lambda_function.api` | carvable w/ edits | 1 output, 5 outbound, tier 2 | the honest yellow: next month, not today |
 | 43 | `aws_security_group.lambda` | leave in Terraform | 2 inbound, 2 outbound, tier 2, data present | |
-| 36 | `aws_vpc.main` | leave in Terraform | 5 inbound, 1 outbound | the grey anchor: this stays, and that's fine |
+| 42 | `aws_subnet.private_a` | leave in Terraform | 3 inbound, 1 output, 2 outbound, data present | |
+| 42 | `aws_subnet.private_b` | leave in Terraform | 3 inbound, 1 output, 2 outbound, data present | |
+| 32 | `aws_vpc.main` | leave in Terraform | 5 inbound, 1 output, 1 outbound | the grey anchor: this stays, and that's fine |
 | 0 | `aws_network_acl.private` | leave in Terraform | no known native mapping | |
 | 0 | `random_pet.suffix` | leave in Terraform | no known native mapping | the long tail, stated plainly |
 
 Bands: 80-100 carve now, 50-79 carve with boundary edits, 0-49 leave in Terraform.
 
-The scoring model is `100 - 12*inbound - 4*outbound - 15*(tier-1) - 10*dynamic
-- 3*(instances-1)`, clamped, with unmapped types pinned at 0. Every number
+The scoring model is `100 - 12*inbound - 4*outbound - 4*outputs - 15*(tier-1) -
+10*dynamic - 3*(instances-1)`, clamped, with unmapped types pinned at 0. The
+`outputs` term is chant#1638 (chant 0.44.7): an `output` block that reads a
+resource is a boundary edge too now, `bridge: "tf-output-rewrite"`, because
+carving that resource means rewriting the output the same way carving a
+resource with an inbound reference means adding a data source. Every number
 above is that arithmetic on the edges in `legacy-tf/`, which is why the estate
 is shaped the way it is:
 
-- The bucket has exactly one inbound edge, `aws_lambda_function.api`'s
-  `ASSETS_BUCKET` environment variable. One edge, one patch, 88.
+- The bucket has one inbound edge — `aws_lambda_function.api`'s
+  `ASSETS_BUCKET` environment variable — and, since `outputs.tf`'s
+  `assets_bucket` reads it too, one output edge. Two edges, two rewrites, 84.
+  `assets_bucket` is deliberate: a downstream consumer of this state reads the
+  bucket name today, so the carve has a second thing to bridge, not just the
+  lambda's env var.
 - `aws_s3_bucket_versioning.assets` and `aws_s3_bucket_public_access_block.assets`
   share the bucket's name, so they fold into its carve set. They are not ranked
   separately and their edges to the bucket are not counted against it.
-- Five resources point at the VPC. Carving it would mean patching all five at
-  once, and 36 says so.
+- Five resources point at the VPC, and its existing `vpc_id` output reads it
+  too. Carving it would mean patching all five survivors and rewriting the
+  output, and 32 says so.
 - The subnets and the security group each read a data source, which costs 10.
-  That is what pushes them under the line rather than sitting awkwardly in the
-  middle band next to the star.
+  The subnets also feed `private_subnet_ids`, an existing output, which costs
+  4 more apiece and drops them under the security group's 43 — the one place
+  the outputs term reorders the table, not just re-scores it.
 
 No resource uses `count` or `for_each`, so the instance-count penalty is zero
 and `--state` produces byte-identical scores to a `.tf`-only parse. The bands do
@@ -109,14 +119,20 @@ chant carve advise --from example-carve/legacy-tf \
 
 from the repository root, so the `from` field stays a relative path.
 
-`app/` pins chant ^0.44.6 and that floor is load-bearing, not housekeeping: the
-advisor only publishes a top-level `version: 1` and per-resource `boundary` edge
-lists from 0.44.6 (chant#1636). Run the same command on 0.44.4 and every score
-is identical but no resource carries a `boundary` field at all, so the Pick step
-falls back to naming inbound/outbound COUNTS instead of highlighting the one
-`aws_lambda_function.api` edge the carve severs. The committed report above is
-byte-identical to what 0.44.6 regenerates, which is why the demo's fallback path
-and its fresh-run path show the same picture.
+`app/` pins chant ^0.44.7 and that floor is load-bearing, not housekeeping, in
+two layers. The advisor only publishes a top-level `version: 1` and
+per-resource `boundary` edge lists from 0.44.6 (chant#1636) — run the same
+command on 0.44.4 and every score is identical but no resource carries a
+`boundary` field at all, so the Pick step falls back to naming inbound/outbound
+COUNTS instead of naming the edges the carve severs. 0.44.7 adds a second
+layer on top: `output` blocks read as boundary edges (chant#1638), so the
+bucket scores 84 instead of 88 and the report's `patchOnCarve` list names
+`output.assets_bucket` alongside `aws_lambda_function.api`; and `carve emit`'s
+fold is applied, not just reported (chant#1637), so the emitted bucket actually
+carries `VersioningConfiguration` and `PublicAccessBlockConfiguration` instead
+of leaving them in an "unmapped attributes" comment. The committed report above
+is byte-identical to what 0.44.7 regenerates, which is why the demo's fallback
+path and its fresh-run path show the same picture.
 
 ## The six beats
 
@@ -124,20 +140,21 @@ These are the six steps on the panel's Carve tab. behold runs beats 4 and 5
 itself, into `app/carveout/` in the copy; beat 6 is copy buttons, on purpose.
 
 1. **The green star.** The estate view, banded. Two resources are green; the
-   100 is a log group nobody will miss, so the eye lands on the 88 next to it.
-2. **The arithmetic.** Open `aws_s3_bucket.assets`: 100 minus 12 for one
-   inbound edge. The score is not a vibe, it is a subtraction, and the inspect
-   pane shows the terms.
-3. **The cut edge.** Highlight the one dependency the carve severs:
-   `aws_lambda_function.api` reads the bucket name. One line of Terraform.
+   100 is a log group nobody will miss, so the eye lands on the 84 next to it.
+2. **The arithmetic.** Open `aws_s3_bucket.assets`: 100 minus 12 for the
+   inbound edge, minus 4 more for the output block that reads it. The score is
+   not a vibe, it is a subtraction, and the inspect pane shows the terms.
+3. **The cut edge.** Highlight the two dependencies the carve severs:
+   `aws_lambda_function.api` reads the bucket name, and the `assets_bucket`
+   output reads it too. Two one-line rewrites, not one.
 4. **Emit.** `carve emit --from legacy-tf --state legacy-tf/terraform.tfstate
    --select aws_s3_bucket.assets` adopts the bucket from state into typed chant
-   source, folds both sub-resources into the carve set, and writes a boundary
-   report. Nothing is applied, nothing is destroyed, and `chant lint` on the
-   result exits clean.
+   source, folds both sub-resources into the carve set AS native props
+   (chant#1637's fold, applied), and writes a boundary report. Nothing is
+   applied, nothing is destroyed, and `chant lint` on the result exits clean.
 5. **The bridge.** One `data "aws_s3_bucket" "assets"` block in the surviving
-   Terraform, and `aws_lambda_function.api` reads from that instead. The
-   surviving plan is whole again.
+   Terraform; `aws_lambda_function.api` and the `assets_bucket` output both
+   read from that instead. The surviving plan is whole again.
 6. **The handoff.** Two commands: `terraform state rm aws_s3_bucket.assets`,
    then chant takes the observe position. `terraform plan` shows no destroy.
 
@@ -169,22 +186,32 @@ walkthrough actually carves, are covered (chant's `just carve-emit-e2e` is the
 prior art). The VPC, lambda and CloudFront blocks are scenery for the advisor's
 grey band, so expect `-target` rather than one apply of the whole estate.
 
-## Known rough edge in emit
+## Why build still fails
 
 `carve emit --state --select aws_s3_bucket.assets` reports "Folded in:
-`aws_s3_bucket_public_access_block.assets`, `aws_s3_bucket_versioning.assets`"
-and then emits a `Bucket` carrying neither. Only `bucket` and `tags` are in the
-AWS carve-out table's field map for `aws_s3_bucket`; versioning, public-access
-block and the state's server-side encryption block come out in the "unmapped
-Terraform attributes" comment instead. `chant lint` on the emitted project
-passes with warnings, but `chant build` fails on two AWS policy rules
-(`PublicAccessBlockConfiguration` missing, no TLS-deny bucket policy) even
-though the Terraform declared the first of those.
-
-Verified against chant 0.44.6. The walkthrough's Emit beat shows `lint`, not
-`build`, until the fold is applied as well as reported — the step's "why lint
-and not build?" note says the same thing on screen, so nobody reads a lint pass
-as a build pass. That is chant#1637.
+`aws_s3_bucket_public_access_block.assets`, `aws_s3_bucket_versioning.assets`",
+and as of chant 0.44.7 (chant#1637, chant PR #1640) the emitted `Bucket`
+actually carries both: `VersioningConfiguration` and
+`PublicAccessBlockConfiguration` come out as native props, not an "unmapped
+Terraform attributes" comment. That used to be the rough edge here — a fold
+that was reported but not applied, so `chant build` failed two AWS policy
+rules on source the advisor called clean. It is fixed now.
+
+`chant lint` on the emitted project passes with warnings. `chant build` still
+fails, but on one rule: WAW042, no bucket policy denying non-TLS requests.
+That is not a carve-tooling gap — grep `legacy-tf/` for
+`aws_s3_bucket_policy` and there isn't one. The Terraform never declared a
+TLS-deny policy for this bucket, in any form; chant's post-synth checks
+noticed the moment the resource had a native representation to check. Nothing
+here would show up scanning the `.tf` by eye, because there is nothing to
+find — only an absence.
+
+Verified against chant 0.44.7. The walkthrough's Emit beat still shows `lint`,
+not `build` — the step's "why lint and not build?" note says why on screen —
+but the reason changed: `build` doesn't fail because the fold is incomplete
+anymore, it fails because the estate really does have a policy gap. "chant
+found a policy gap Terraform never noticed" is the honest line to close the
+video on.
 
 ## Values
 

package/example-carve/app/package-lock.json

@@ -6,8 +6,8 @@
     "": {
       "name": "behold-example-carve-app",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-aws": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-aws": "^0.44.7"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -442,9 +442,9 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.6.tgz",
-      "integrity": "sha512-VFqPKe2WsSAJoUvfyghVTlIcj+QRNn//JgSHToq6PDDuKPU7F34V/4f+EZpX4MF3gvwVkZc9d6FUwKio6t0uqg==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.7.tgz",
+      "integrity": "sha512-etCchkfbWFHJ+XnTYVVn9GT4/gZi/O8SVphDXHeuPOfK5VvRxo0unveIUEsuRoHGHgzN9Y+aj0Jk15xhIE7Gzg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
@@ -460,16 +460,16 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-aws": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.44.6.tgz",
-      "integrity": "sha512-2qGwWFCRLkT9MD5YFnhnZOGDCqPZg9la4MM8szlX8QxFFoQjAulJ8e+vjeCGbWoB8nbSIQ9kJOX8Yn46Pm37iQ==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-aws/-/chant-lexicon-aws-0.44.7.tgz",
+      "integrity": "sha512-tlwcUv0zN5rTupRdJHdcYSsKbodiVjYaBAwG/omK4hYPtys3dZMjLVOt8bszBeTKp+h8boIEjhwpgQKpDAGmcQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "fflate": "^0.8.2",
         "js-yaml": "^4.1.0"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.6",
+        "@intentius/chant": "^0.44.7",
         "typescript": "^5.9.3"
       }
     },

package/example-carve/app/package.json

@@ -7,7 +7,7 @@
     "build": "./node_modules/.bin/chant build src --lexicon aws -o template.json"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-aws": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-aws": "^0.44.7"
   }
 }