@intentius/behold 0.9.0 → 0.9.1

package/example-carve/carve-report.json

@@ -18,12 +18,14 @@
       "breakdown": {
         "inbound": 0,
         "outbound": 0,
+        "outputs": 0,
         "tier": 1,
         "hasDynamic": false,
         "instances": 1,
         "penalties": {
           "inbound": 0,
           "outbound": 0,
+          "outputs": 0,
           "tier": 0,
           "dynamic": 0,
           "instances": 0
@@ -37,18 +39,20 @@
     {
       "address": "aws_s3_bucket.assets",
       "kind": "resource",
-      "score": 88,
+      "score": 84,
       "band": "clean leaf",
       "mapsTo": "AWS::S3::Bucket",
       "breakdown": {
         "inbound": 1,
         "outbound": 0,
+        "outputs": 1,
         "tier": 1,
         "hasDynamic": false,
         "instances": 1,
         "penalties": {
           "inbound": -12,
           "outbound": 0,
+          "outputs": -4,
           "tier": 0,
           "dynamic": 0,
           "instances": 0
@@ -68,6 +72,19 @@
             ],
             "bridge": "tf-data-source",
             "required": "immediately"
+          },
+          {
+            "direction": "inbound",
+            "survivor": "output.assets_bucket",
+            "carved": "aws_s3_bucket.assets",
+            "attrs": [
+              "bucket"
+            ],
+            "via": [
+              "value"
+            ],
+            "bridge": "tf-output-rewrite",
+            "required": "immediately"
           }
         ],
         "outbound": []
@@ -81,12 +98,14 @@
       "breakdown": {
         "inbound": 0,
         "outbound": 1,
+        "outputs": 0,
         "tier": 2,
         "hasDynamic": true,
         "instances": 1,
         "penalties": {
           "inbound": 0,
           "outbound": -4,
+          "outputs": 0,
           "tier": -15,
           "dynamic": -10,
           "instances": 0
@@ -120,12 +139,14 @@
       "breakdown": {
         "inbound": 1,
         "outbound": 1,
+        "outputs": 0,
         "tier": 2,
         "hasDynamic": false,
         "instances": 1,
         "penalties": {
           "inbound": -12,
           "outbound": -4,
+          "outputs": 0,
           "tier": -15,
           "dynamic": 0,
           "instances": 0
@@ -173,12 +194,14 @@
       "breakdown": {
         "inbound": 0,
         "outbound": 4,
+        "outputs": 0,
         "tier": 2,
         "hasDynamic": false,
         "instances": 1,
         "penalties": {
           "inbound": 0,
           "outbound": -16,
+          "outputs": 0,
           "tier": -15,
           "dynamic": 0,
           "instances": 0
@@ -245,25 +268,41 @@
     {
       "address": "aws_lambda_function.api",
       "kind": "resource",
-      "score": 65,
+      "score": 61,
       "band": "carvable w/ edits",
       "mapsTo": "AWS::Lambda::Function",
       "breakdown": {
         "inbound": 0,
         "outbound": 5,
+        "outputs": 1,
         "tier": 2,
         "hasDynamic": false,
         "instances": 1,
         "penalties": {
           "inbound": 0,
           "outbound": -20,
+          "outputs": -4,
           "tier": -15,
           "dynamic": 0,
           "instances": 0
         }
       },
       "boundary": {
-        "inbound": [],
+        "inbound": [
+          {
+            "direction": "inbound",
+            "survivor": "output.api_function_name",
+            "carved": "aws_lambda_function.api",
+            "attrs": [
+              "function_name"
+            ],
+            "via": [
+              "value"
+            ],
+            "bridge": "tf-output-rewrite",
+            "required": "immediately"
+          }
+        ],
         "outbound": [
           {
             "direction": "outbound",
@@ -334,21 +373,23 @@
       }
     },
     {
-      "address": "aws_subnet.private_a",
+      "address": "aws_security_group.lambda",
       "kind": "resource",
-      "score": 46,
+      "score": 43,
       "band": "leave in Terraform",
-      "mapsTo": "AWS::EC2::Subnet",
+      "mapsTo": "AWS::EC2::SecurityGroup",
       "breakdown": {
-        "inbound": 3,
+        "inbound": 2,
         "outbound": 2,
-        "tier": 1,
+        "outputs": 0,
+        "tier": 2,
         "hasDynamic": true,
         "instances": 1,
         "penalties": {
-          "inbound": -36,
+          "inbound": -24,
           "outbound": -8,
-          "tier": 0,
+          "outputs": 0,
+          "tier": -15,
           "dynamic": -10,
           "instances": 0
         }
@@ -358,7 +399,7 @@
           {
             "direction": "inbound",
             "survivor": "aws_lambda_function.api",
-            "carved": "aws_subnet.private_a",
+            "carved": "aws_security_group.lambda",
             "attrs": [
               "id"
             ],
@@ -368,28 +409,15 @@
             "bridge": "tf-data-source",
             "required": "immediately"
           },
-          {
-            "direction": "inbound",
-            "survivor": "aws_network_acl.private",
-            "carved": "aws_subnet.private_a",
-            "attrs": [
-              "id"
-            ],
-            "via": [
-              "subnet_ids"
-            ],
-            "bridge": "tf-data-source",
-            "required": "immediately"
-          },
           {
             "direction": "inbound",
             "survivor": "aws_vpc_endpoint.ssm",
-            "carved": "aws_subnet.private_a",
+            "carved": "aws_security_group.lambda",
             "attrs": [
               "id"
             ],
             "via": [
-              "subnet_ids"
+              "security_group_ids"
             ],
             "bridge": "tf-data-source",
             "required": "immediately"
@@ -399,7 +427,7 @@
           {
             "direction": "outbound",
             "survivor": "aws_vpc.main",
-            "carved": "aws_subnet.private_a",
+            "carved": "aws_security_group.lambda",
             "attrs": [
               "id"
             ],
@@ -412,12 +440,12 @@
           {
             "direction": "outbound",
             "survivor": "random_pet.suffix",
-            "carved": "aws_subnet.private_a",
+            "carved": "aws_security_group.lambda",
             "attrs": [
               "id"
             ],
             "via": [
-              "tags"
+              "name"
             ],
             "bridge": "deferred-input",
             "required": "at-apply"
@@ -426,20 +454,22 @@
       }
     },
     {
-      "address": "aws_subnet.private_b",
+      "address": "aws_subnet.private_a",
       "kind": "resource",
-      "score": 46,
+      "score": 42,
       "band": "leave in Terraform",
       "mapsTo": "AWS::EC2::Subnet",
       "breakdown": {
         "inbound": 3,
         "outbound": 2,
+        "outputs": 1,
         "tier": 1,
         "hasDynamic": true,
         "instances": 1,
         "penalties": {
           "inbound": -36,
           "outbound": -8,
+          "outputs": -4,
           "tier": 0,
           "dynamic": -10,
           "instances": 0
@@ -450,7 +480,7 @@
           {
             "direction": "inbound",
             "survivor": "aws_lambda_function.api",
-            "carved": "aws_subnet.private_b",
+            "carved": "aws_subnet.private_a",
             "attrs": [
               "id"
             ],
@@ -463,7 +493,7 @@
           {
             "direction": "inbound",
             "survivor": "aws_network_acl.private",
-            "carved": "aws_subnet.private_b",
+            "carved": "aws_subnet.private_a",
             "attrs": [
               "id"
             ],
@@ -476,7 +506,7 @@
           {
             "direction": "inbound",
             "survivor": "aws_vpc_endpoint.ssm",
-            "carved": "aws_subnet.private_b",
+            "carved": "aws_subnet.private_a",
             "attrs": [
               "id"
             ],
@@ -485,13 +515,26 @@
             ],
             "bridge": "tf-data-source",
             "required": "immediately"
+          },
+          {
+            "direction": "inbound",
+            "survivor": "output.private_subnet_ids",
+            "carved": "aws_subnet.private_a",
+            "attrs": [
+              "id"
+            ],
+            "via": [
+              "value"
+            ],
+            "bridge": "tf-output-rewrite",
+            "required": "immediately"
           }
         ],
         "outbound": [
           {
             "direction": "outbound",
             "survivor": "aws_vpc.main",
-            "carved": "aws_subnet.private_b",
+            "carved": "aws_subnet.private_a",
             "attrs": [
               "id"
             ],
@@ -504,7 +547,7 @@
           {
             "direction": "outbound",
             "survivor": "random_pet.suffix",
-            "carved": "aws_subnet.private_b",
+            "carved": "aws_subnet.private_a",
             "attrs": [
               "id"
             ],
@@ -518,21 +561,23 @@
       }
     },
     {
-      "address": "aws_security_group.lambda",
+      "address": "aws_subnet.private_b",
       "kind": "resource",
-      "score": 43,
+      "score": 42,
       "band": "leave in Terraform",
-      "mapsTo": "AWS::EC2::SecurityGroup",
+      "mapsTo": "AWS::EC2::Subnet",
       "breakdown": {
-        "inbound": 2,
+        "inbound": 3,
         "outbound": 2,
-        "tier": 2,
+        "outputs": 1,
+        "tier": 1,
         "hasDynamic": true,
         "instances": 1,
         "penalties": {
-          "inbound": -24,
+          "inbound": -36,
           "outbound": -8,
-          "tier": -15,
+          "outputs": -4,
+          "tier": 0,
           "dynamic": -10,
           "instances": 0
         }
@@ -542,7 +587,7 @@
           {
             "direction": "inbound",
             "survivor": "aws_lambda_function.api",
-            "carved": "aws_security_group.lambda",
+            "carved": "aws_subnet.private_b",
             "attrs": [
               "id"
             ],
@@ -552,25 +597,51 @@
             "bridge": "tf-data-source",
             "required": "immediately"
           },
+          {
+            "direction": "inbound",
+            "survivor": "aws_network_acl.private",
+            "carved": "aws_subnet.private_b",
+            "attrs": [
+              "id"
+            ],
+            "via": [
+              "subnet_ids"
+            ],
+            "bridge": "tf-data-source",
+            "required": "immediately"
+          },
           {
             "direction": "inbound",
             "survivor": "aws_vpc_endpoint.ssm",
-            "carved": "aws_security_group.lambda",
+            "carved": "aws_subnet.private_b",
             "attrs": [
               "id"
             ],
             "via": [
-              "security_group_ids"
+              "subnet_ids"
             ],
             "bridge": "tf-data-source",
             "required": "immediately"
+          },
+          {
+            "direction": "inbound",
+            "survivor": "output.private_subnet_ids",
+            "carved": "aws_subnet.private_b",
+            "attrs": [
+              "id"
+            ],
+            "via": [
+              "value"
+            ],
+            "bridge": "tf-output-rewrite",
+            "required": "immediately"
           }
         ],
         "outbound": [
           {
             "direction": "outbound",
             "survivor": "aws_vpc.main",
-            "carved": "aws_security_group.lambda",
+            "carved": "aws_subnet.private_b",
             "attrs": [
               "id"
             ],
@@ -583,12 +654,12 @@
           {
             "direction": "outbound",
             "survivor": "random_pet.suffix",
-            "carved": "aws_security_group.lambda",
+            "carved": "aws_subnet.private_b",
             "attrs": [
               "id"
             ],
             "via": [
-              "name"
+              "tags"
             ],
             "bridge": "deferred-input",
             "required": "at-apply"
@@ -599,18 +670,20 @@
     {
       "address": "aws_vpc.main",
       "kind": "resource",
-      "score": 36,
+      "score": 32,
       "band": "leave in Terraform",
       "mapsTo": "AWS::EC2::VPC",
       "breakdown": {
         "inbound": 5,
         "outbound": 1,
+        "outputs": 1,
         "tier": 1,
         "hasDynamic": false,
         "instances": 1,
         "penalties": {
           "inbound": -60,
           "outbound": -4,
+          "outputs": -4,
           "tier": 0,
           "dynamic": 0,
           "instances": 0
@@ -682,6 +755,19 @@
             ],
             "bridge": "tf-data-source",
             "required": "immediately"
+          },
+          {
+            "direction": "inbound",
+            "survivor": "output.vpc_id",
+            "carved": "aws_vpc.main",
+            "attrs": [
+              "id"
+            ],
+            "via": [
+              "value"
+            ],
+            "bridge": "tf-output-rewrite",
+            "required": "immediately"
           }
         ],
         "outbound": [
@@ -709,12 +795,14 @@
       "breakdown": {
         "inbound": 0,
         "outbound": 3,
+        "outputs": 0,
         "tier": null,
         "hasDynamic": false,
         "instances": 1,
         "penalties": {
           "inbound": 0,
           "outbound": 0,
+          "outputs": 0,
           "tier": 0,
           "dynamic": 0,
           "instances": 0
@@ -773,12 +861,14 @@
       "breakdown": {
         "inbound": 6,
         "outbound": 0,
+        "outputs": 0,
         "tier": null,
         "hasDynamic": false,
         "instances": 1,
         "penalties": {
           "inbound": 0,
           "outbound": 0,
+          "outputs": 0,
           "tier": 0,
           "dynamic": 0,
           "instances": 0

package/example-carve/legacy-tf/outputs.tf

@@ -1,7 +1,12 @@
-# Outputs are invisible to `chant carve advise` — it builds its graph from
-# `resource` and `module` blocks only. Nothing here references the bucket, so
-# the walkthrough's one-patch story stays true; if it did, the patch would be
-# yours to write, not the bridge's.
+# Outputs are boundary edges now (chant#1638): `chant carve advise` reads
+# `output` blocks and scores each one a survivor reads across the cut, at -4,
+# `bridge: "tf-output-rewrite"`. `assets_bucket` is deliberate — a downstream
+# consumer of this state reads the bucket name today, so the carve has to
+# rewrite that output the same way it rewrites `cdn.tf`'s data source.
+
+output "assets_bucket" {
+  value = aws_s3_bucket.assets.bucket
+}
 
 output "api_function_name" {
   value = aws_lambda_function.api.function_name

package/example-flux-estate/app-a/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-k8s": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-k8s": "^0.44.7"
   }
 }

package/example-flux-estate/app-b/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-k8s": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-k8s": "^0.44.7"
   }
 }

package/example-flux-estate/control-plane/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o dist/control-plane.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.6",
-    "@intentius/chant-lexicon-k8s": "^0.44.6"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-k8s": "^0.44.7"
   }
 }

package/example-flux-estate/package-lock.json

@@ -14,22 +14,22 @@
     "app-a": {
       "name": "behold-example-flux-app-a",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-k8s": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-k8s": "^0.44.7"
       }
     },
     "app-b": {
       "name": "behold-example-flux-app-b",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-k8s": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-k8s": "^0.44.7"
       }
     },
     "control-plane": {
       "name": "behold-example-flux-control-plane",
       "dependencies": {
-        "@intentius/chant": "^0.44.6",
-        "@intentius/chant-lexicon-k8s": "^0.44.6"
+        "@intentius/chant": "^0.44.7",
+        "@intentius/chant-lexicon-k8s": "^0.44.7"
       }
     },
     "node_modules/@dagrejs/dagre": {
@@ -464,9 +464,9 @@
       }
     },
     "node_modules/@intentius/chant": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.6.tgz",
-      "integrity": "sha512-VFqPKe2WsSAJoUvfyghVTlIcj+QRNn//JgSHToq6PDDuKPU7F34V/4f+EZpX4MF3gvwVkZc9d6FUwKio6t0uqg==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant/-/chant-0.44.7.tgz",
+      "integrity": "sha512-etCchkfbWFHJ+XnTYVVn9GT4/gZi/O8SVphDXHeuPOfK5VvRxo0unveIUEsuRoHGHgzN9Y+aj0Jk15xhIE7Gzg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@dagrejs/dagre": "^3.0.0",
@@ -482,9 +482,9 @@
       }
     },
     "node_modules/@intentius/chant-k8s-client": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.6.tgz",
-      "integrity": "sha512-Do3zY0Bd2nIITDDrXYePwdOBdnNf59xn5J1aJA6gsg3dzXxR3dZ25YBAh+SQxKbRPuXIbu9rKd5lodaM8ZQDng==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-k8s-client/-/chant-k8s-client-0.44.7.tgz",
+      "integrity": "sha512-G9VVki/qHZ+hbKrxDDnVVhfeZWoHgozLA7tjcY/lsa/fDIwI0xMJnAN/DJNcQLBpRscXm3y3Ki/PNQ9SxshmLA==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -492,19 +492,19 @@
       }
     },
     "node_modules/@intentius/chant-lexicon-k8s": {
-      "version": "0.44.6",
-      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.6.tgz",
-      "integrity": "sha512-JP2Lo4fFV7FPbSTHapKuDgpvrsm3dbNBT9pMW9NQB2MoE/ZkMGf3z3/wsPnygLdjbYq29abVYmw7DzPqBmA1tw==",
+      "version": "0.44.7",
+      "resolved": "https://registry.npmjs.org/@intentius/chant-lexicon-k8s/-/chant-lexicon-k8s-0.44.7.tgz",
+      "integrity": "sha512-h8QXOYoxjsAeA1w8koLQlZqOuSQcvWpEHKmwlf0AKPgwuVRiapwJI+UtuoBwL/AOrBKDh6Z5pW3zbo6vDltGvA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@types/js-yaml": "^4.0.9",
         "js-yaml": "^4.1.1"
       },
       "optionalDependencies": {
-        "@intentius/chant-k8s-client": "^0.44.6"
+        "@intentius/chant-k8s-client": "^0.44.7"
       },
       "peerDependencies": {
-        "@intentius/chant": "^0.44.6",
+        "@intentius/chant": "^0.44.7",
         "typescript": "^5.9.3",
         "zod": "^4.3.6"
       }
@@ -1071,9 +1071,9 @@
       }
     },
     "node_modules/ip-address": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
-      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz",
+      "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==",
       "license": "MIT",
       "optional": true,
       "engines": {