@intentius/chant 0.124.13 → 0.124.15

package/dist/terraform/excise.js

@@ -0,0 +1,123 @@
+/**
+ * Excision of a carved resource's own `resource "<type>" "<name>"` block from
+ * the surviving Terraform source (#998 — closes the "auto-excise" limitation).
+ *
+ * After `terraform state rm`, the block left behind would re-CREATE the
+ * resource on the next apply — the one edit the bridge previously left to
+ * hand-work. This removes the carve set's own blocks as part of the survivor
+ * rewrite, so the one bridge `.patch` (#1589) carries the whole handoff edit.
+ *
+ * Pure text transform. The scanner tracks brace depth outside of strings,
+ * comments, template interpolations, and heredocs — enough for real `.tf`
+ * files without pulling in the wasm parser for what is a subtractive edit.
+ */
+const HEADER = /^\s*resource\s+"([^"]+)"\s+"([^"]+)"\s*\{/;
+/**
+ * Remove the targets' own `resource` blocks from one `.tf` file's text. A
+ * comment line directly above a removed block stays (it may describe more
+ * than the block); the blank line the removal leaves behind is collapsed.
+ */
+export function exciseResourceBlocks(content, targets) {
+    if (targets.length === 0)
+        return { content, excised: [] };
+    const wanted = new Map(targets.map((t) => [`${t.type}.${t.name}`, t.address]));
+    const lines = content.split("\n");
+    const excised = [];
+    const out = [];
+    let i = 0;
+    while (i < lines.length) {
+        const m = lines[i].match(HEADER);
+        const key = m ? `${m[1]}.${m[2]}` : undefined;
+        if (!m || !wanted.has(key)) {
+            out.push(lines[i]);
+            i++;
+            continue;
+        }
+        const end = blockEnd(lines, i);
+        if (end === -1) {
+            // Unbalanced block — leave the file alone rather than corrupt it.
+            out.push(lines[i]);
+            i++;
+            continue;
+        }
+        excised.push(wanted.get(key));
+        i = end + 1;
+        // Swallow the separator blank line so the removal leaves no doubled gap.
+        if (i < lines.length && lines[i].trim() === "")
+            i++;
+    }
+    return { content: out.join("\n"), excised };
+}
+/** Index of the line closing the block opened on `start`, or -1 if unbalanced. */
+function blockEnd(lines, start) {
+    // Context stack: block/object braces, strings, `${` interpolations, block
+    // comments. The header's `{` pushes the first "brace"; the block closes when
+    // the stack empties.
+    const stack = [];
+    let opened = false;
+    let heredoc = null;
+    for (let ln = start; ln < lines.length; ln++) {
+        const line = lines[ln];
+        if (heredoc !== null) {
+            if (line.trim() === heredoc)
+                heredoc = null;
+            continue;
+        }
+        for (let c = 0; c < line.length; c++) {
+            const top = stack[stack.length - 1];
+            const ch = line[c];
+            const next = line[c + 1];
+            if (top === "comment") {
+                if (ch === "*" && next === "/") {
+                    stack.pop();
+                    c++;
+                }
+                continue;
+            }
+            if (top === "string") {
+                if (ch === "\\") {
+                    c++;
+                }
+                else if (ch === "$" && next === "{" && line[c - 1] !== "$") {
+                    stack.push("interp");
+                    c++;
+                }
+                else if (ch === '"') {
+                    stack.pop();
+                }
+                continue;
+            }
+            // Code position (top of file block, a nested brace, or inside `${...}`).
+            if (ch === "#" || (ch === "/" && next === "/"))
+                break; // line comment
+            if (ch === "/" && next === "*") {
+                stack.push("comment");
+                c++;
+                continue;
+            }
+            if (ch === '"') {
+                stack.push("string");
+                continue;
+            }
+            if (ch === "<" && next === "<") {
+                const hd = line.slice(c).match(/^<<-?([A-Za-z_][A-Za-z0-9_-]*)/);
+                if (hd) {
+                    heredoc = hd[1];
+                    break;
+                }
+            }
+            if (ch === "{") {
+                stack.push("brace");
+                opened = true;
+                continue;
+            }
+            if (ch === "}") {
+                if (top === "brace" || top === "interp")
+                    stack.pop();
+                if (opened && stack.length === 0)
+                    return ln;
+            }
+        }
+    }
+    return -1;
+}

package/dist/terraform/graduate.js

@@ -0,0 +1,128 @@
+/**
+ * Apply graduation for the strangler-fig carve (#197) — the last step.
+ *
+ * After a resource is emitted (`carve emit`) and the survivors are bridged
+ * (`carve bridge`), it sits at the observe position: chant has the source, but
+ * the live resource is an orphan carrying no chant ownership. Graduation is the
+ * dial-turn to apply: mark the resource chant-owned so `chant carve` / status
+ * recognize it, and finalize the ordered apply runbook.
+ *
+ * This is BYOL-honest: it does NOT call the cloud. It resolves the ownership
+ * marker (reusing core's `ownershipEntries`) and produces the graduation
+ * artifacts + runbook. The apply itself is whatever lifecycle you brought —
+ * the native CLI, a CI pipeline, an ApplyOp — and it stamps the marker the
+ * emitted source now carries.
+ */
+import { ownershipEntries, LABEL_OWNERSHIP_KEYS } from "../ownership.js";
+/**
+ * Default tag channel, mirroring the AWS lexicon's `AWS_TAG_OWNERSHIP_KEYS`
+ * (`lexicons/aws/src/ownership.ts`). Core cannot import a lexicon, so the
+ * convention is duplicated here; the values match so the graduation plan shows
+ * the tags the AWS apply path will actually stamp.
+ */
+export const DEFAULT_TAG_OWNERSHIP_KEYS = {
+    managedBy: "chant:managed-by",
+    stack: "chant:stack",
+    env: "chant:env",
+};
+/**
+ * How the marker, the build output and the BYOL apply are spelled, per emitted
+ * lexicon. A Kubernetes object carries the marker as labels — the same
+ * `LABEL_OWNERSHIP_KEYS` the k8s serializer merges in — so a runbook promising
+ * `chant:managed-by` tags would name a channel nothing stamps.
+ */
+function applyVocabulary(lexicon, target, stack) {
+    if (lexicon === "k8s") {
+        return {
+            channel: LABEL_OWNERSHIP_KEYS,
+            markerKind: "labels",
+            build: `chant build <emitted-src> --lexicon k8s > ${target}.yaml`,
+            apply: `kubectl apply -f ${target}.yaml`,
+        };
+    }
+    return {
+        channel: DEFAULT_TAG_OWNERSHIP_KEYS,
+        markerKind: "tags",
+        build: `chant build <emitted-src> -o ${target}.template.json`,
+        apply: `aws cloudformation deploy --template-file ${target}.template.json --stack-name ${stack} ...`,
+    };
+}
+export function graduationPlan(report, opts = {}) {
+    const stack = opts.stack ?? (report.target.split(".").slice(1).join(".") || report.target);
+    const marker = { stack, env: opts.env };
+    const vocabulary = applyVocabulary(opts.lexicon, report.target, stack);
+    const ownershipTags = ownershipEntries(opts.channel ?? vocabulary.channel, marker);
+    const warnings = [];
+    if (report.outbound.length) {
+        warnings.push(`${report.outbound.length} deferred deploy-time input(s) must be wired before apply (see the boundary report).`);
+    }
+    const tagList = Object.entries(ownershipTags)
+        .map(([k, v]) => `${k}=${v}`)
+        .join(", ");
+    const steps = [
+        `1. Confirm the emitted source builds spec-true:  ${vocabulary.build}`,
+        `2. Add the ownership marker so chant owns the resource — ${vocabulary.markerKind}: ${tagList}`,
+        `3. Apply with your lifecycle (BYOL), e.g.:`,
+        `     ${vocabulary.apply}`,
+        `   or graduate to an ApplyOp for a durable, gated apply.`,
+        `4. Verify chant now owns it:  chant lifecycle diff --live <env>   (expect: unchanged, owned)`,
+        `Rollback before this point:  terraform import ${report.target} <physical-id>`,
+    ];
+    return { target: report.target, marker, ownershipTags, markerKind: vocabulary.markerKind, steps, warnings };
+}
+/**
+ * A constructor-shaped emitted file: `export const x = new Ctor(`. Tag-based
+ * ownership is a property of that shape — a carved `kubernetes_manifest` is a
+ * `k8sManifest({ ... })` call whose props are the manifest, where a top-level
+ * `Tags` array would be an invented field on the object, not a marker (#999).
+ * Such a file is refused rather than stamped.
+ */
+const CONSTRUCTOR_SHAPE = /^export const \w+ = new \w+\(/m;
+/**
+ * Stamp the ownership tags into an emitted chant source file (`carve apply
+ * --write-source`). The emitted source is machine-generated (`adoptFromState`),
+ * so its shape is known: one prop per line, `Tags` as a single-line JSON array.
+ * Merges into an existing `Tags` prop (replacing stale chant keys) or inserts
+ * one into the constructor's props object. Returns null when the file has no
+ * recognizable constructor to stamp.
+ */
+export function stampOwnershipIntoSource(content, tags) {
+    if (!CONSTRUCTOR_SHAPE.test(content))
+        return null;
+    const entries = Object.entries(tags).map(([Key, Value]) => ({ Key, Value }));
+    const keys = new Set(Object.keys(tags));
+    const lines = content.split("\n");
+    // Merge into an existing Tags prop.
+    for (let i = 0; i < lines.length; i++) {
+        const m = lines[i].match(/^(\s*)Tags: (\[.*\]),$/);
+        if (!m)
+            continue;
+        let existing;
+        try {
+            existing = JSON.parse(m[2]);
+        }
+        catch {
+            continue;
+        }
+        const merged = [...existing.filter((t) => !keys.has(t.Key)), ...entries];
+        const rendered = `${m[1]}Tags: ${JSON.stringify(merged)},`;
+        if (rendered === lines[i])
+            return { content, changed: false };
+        lines[i] = rendered;
+        return { content: lines.join("\n"), changed: true };
+    }
+    // No Tags prop yet: insert one into the constructor's props object.
+    const tagsLine = `  Tags: ${JSON.stringify(entries)},`;
+    for (let i = lines.length - 1; i >= 0; i--) {
+        if (/^\}\);\s*$/.test(lines[i])) {
+            lines.splice(i, 0, tagsLine);
+            return { content: lines.join("\n"), changed: true };
+        }
+        const empty = lines[i].match(/^(export const .+ = new \w+\()\{\}(\);)\s*$/);
+        if (empty) {
+            lines[i] = `${empty[1]}{\n${tagsLine}\n}${empty[2]}`;
+            return { content: lines.join("\n"), changed: true };
+        }
+    }
+    return null;
+}

package/dist/terraform/graph.js

@@ -0,0 +1,435 @@
+/**
+ * Pure Terraform dependency-graph builder for the carve-out advisor (#214 T1).
+ *
+ * Input is the JSON tree `@cdktn/hcl2json` produces (`Hcl2JsonTree`) plus the
+ * traversal accessors its expression AST found per interpolated string
+ * (`ExpressionRefs`, resolved in `parse.ts` — #998). Tokenizing `${...}`
+ * expression bodies is the AST's job — a quoted address inside an expression
+ * (`var.m["aws_s3_bucket.assets.arn"]`) or an escaped `$${...}` literal is not
+ * a reference, which the regex scan this replaced could not tell. This module
+ * only classifies the accessors the AST produced: no wasm, no filesystem, so
+ * graph building stays unit-testable on hand-written fixtures.
+ */
+import { shapeSourcePaths } from "./data-source-shape.js";
+import { dataSourceShapeOf, identityAttrOf } from "./tier-map.js";
+/** Non-resource reference heads that must never be read as a resource type. */
+const NON_RESOURCE_HEADS = new Set(["var", "local", "each", "count", "self", "path", "terraform"]);
+/**
+ * Split a traversal accessor into segments. Dots inside a quoted map key
+ * (`var.m."a.b"` — how the AST renders `var.m["a.b"]`) do not split.
+ */
+function accessorSegments(accessor) {
+    const segments = [];
+    let i = 0;
+    while (i < accessor.length) {
+        if (accessor[i] === '"') {
+            const close = accessor.indexOf('"', i + 1);
+            const end = close === -1 ? accessor.length : close + 1;
+            segments.push(accessor.slice(i, end));
+            i = end;
+        }
+        else {
+            let j = i;
+            while (j < accessor.length && accessor[j] !== ".")
+                j++;
+            segments.push(accessor.slice(i, j));
+            i = j;
+        }
+        if (accessor[i] === ".")
+            i++;
+    }
+    return segments;
+}
+const NAME = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+/**
+ * Classify one AST traversal accessor into a resource/module/data reference.
+ * `var.*`/`local.*`/`each.*`-headed accessors are not references; quoted map
+ * keys and numeric indexes never become the attribute.
+ */
+export function refFromAccessor(accessor) {
+    const parts = accessorSegments(accessor);
+    const isName = (s) => s !== undefined && NAME.test(s);
+    const attrAfter = (idx) => parts.slice(idx).find((p) => isName(p));
+    if (parts[0] === "module") {
+        return isName(parts[1]) ? { address: `module.${parts[1]}`, attr: attrAfter(2) } : null;
+    }
+    if (parts[0] === "data") {
+        return isName(parts[1]) && isName(parts[2])
+            ? { address: `data.${parts[1]}.${parts[2]}`, attr: attrAfter(3) }
+            : null;
+    }
+    if (NON_RESOURCE_HEADS.has(parts[0]) || !isName(parts[0]) || !isName(parts[1]))
+        return null;
+    return { address: `${parts[0]}.${parts[1]}`, attr: attrAfter(2) };
+}
+/**
+ * The referrer key a `local.<name>` accessor names, or null for anything else.
+ *
+ * `refFromAccessor` is right to refuse `local.*`: a local is a substitution,
+ * has no address in the plan graph, and nothing carves one. But the resource a
+ * local ultimately names is a dependency all the same, so the accessor is
+ * carried this far to be resolved through the locals table (#2324) rather than
+ * dropped at the resource-head guard.
+ */
+function localKeyFromAccessor(accessor) {
+    const parts = accessorSegments(accessor);
+    const name = parts[1];
+    return parts[0] === "local" && name !== undefined && NAME.test(name) ? `local.${name}` : null;
+}
+/**
+ * Every string value carrying an interpolation across the tree's resource,
+ * module, output, `locals` and `data` blocks — exactly the expressions
+ * `parse.ts` must resolve through the AST before `buildGraph` can classify
+ * them.
+ *
+ * `locals` and `data` are here because a reference can reach a resource
+ * through them (#2324): a survivor reading `local.assets_id`, or a `data`
+ * source keyed off the carved resource, is a dependency the plan breaks on
+ * just as hard as a direct one. Skipping their bodies meant the AST never saw
+ * those expressions at all.
+ */
+export function collectExpressions(tree) {
+    const exprs = new Set();
+    const visit = (v) => {
+        if (typeof v === "string") {
+            if (v.includes("${"))
+                exprs.add(v);
+        }
+        else if (Array.isArray(v)) {
+            v.forEach(visit);
+        }
+        else if (v && typeof v === "object") {
+            for (const inner of Object.values(v))
+                visit(inner);
+        }
+    };
+    for (const named of Object.values(tree.resource ?? {}))
+        for (const blocks of Object.values(named))
+            visit(blocks);
+    for (const blocks of Object.values(tree.module ?? {}))
+        visit(blocks);
+    for (const blocks of Object.values(tree.output ?? {}))
+        visit(blocks);
+    visit(tree.locals);
+    for (const named of Object.values(tree.data ?? {}))
+        for (const blocks of Object.values(named))
+            visit(blocks);
+    return [...exprs].sort();
+}
+/** Collect every reference reachable in a block's value tree, via the AST-resolved accessors. */
+function refsInValue(value, exprRefs) {
+    const refs = [];
+    const visit = (v) => {
+        if (typeof v === "string") {
+            if (!v.includes("${"))
+                return;
+            for (const accessor of exprRefs.get(v) ?? []) {
+                const ref = refFromAccessor(accessor);
+                if (ref) {
+                    refs.push(ref);
+                    continue;
+                }
+                const localKey = localKeyFromAccessor(accessor);
+                if (localKey)
+                    refs.push({ address: localKey });
+            }
+        }
+        else if (Array.isArray(v)) {
+            v.forEach(visit);
+        }
+        else if (v && typeof v === "object") {
+            for (const inner of Object.values(v))
+                visit(inner);
+        }
+    };
+    visit(value);
+    return refs;
+}
+/**
+ * References in a whole block, each tagged with the top-level attribute it
+ * came in through — `via` is what a deferred outbound input gets named after
+ * when emit turns it into a build parameter (#998).
+ */
+function refsInBlock(block, exprRefs) {
+    if (!block || typeof block !== "object" || Array.isArray(block))
+        return refsInValue(block, exprRefs);
+    const refs = [];
+    for (const [key, value] of Object.entries(block)) {
+        for (const ref of refsInValue(value, exprRefs))
+            refs.push({ ...ref, via: key });
+    }
+    return refs;
+}
+/**
+ * Non-node referrers: `local.<name>` and `data.<type>.<name>` → the references
+ * in the body each one stands for (#2324).
+ *
+ * Neither is a graph node — a local is a substitution, and a data source is
+ * not carvable infrastructure — but both sit on a path between a survivor and
+ * a resource, which is the shape an `output` block already has here. A
+ * `locals` block arrives from hcl2json as an array of its assignments, one
+ * element per `locals` block in the estate.
+ */
+function referrerTable(tree, exprRefs) {
+    const table = new Map();
+    const add = (key, refs) => {
+        const existing = table.get(key);
+        if (existing)
+            existing.push(...refs);
+        else
+            table.set(key, refs);
+    };
+    const localsBlocks = Array.isArray(tree.locals) ? tree.locals : tree.locals ? [tree.locals] : [];
+    for (const block of localsBlocks) {
+        if (!block || typeof block !== "object")
+            continue;
+        for (const [name, value] of Object.entries(block)) {
+            add(`local.${name}`, refsInValue(value, exprRefs));
+        }
+    }
+    for (const [type, named] of Object.entries(tree.data ?? {})) {
+        for (const [name, blocks] of Object.entries(named)) {
+            add(`data.${type}.${name}`, refsInBlock(Array.isArray(blocks) ? blocks[0] : blocks, exprRefs));
+        }
+    }
+    return table;
+}
+/** Identity of a reference for de-duplication: the address plus the attribute read off it. */
+function refKey(ref) {
+    return `${ref.address}\u0000${ref.attr ?? ""}`;
+}
+/**
+ * Resolve every referrer entry to the node references it ultimately names.
+ *
+ * One substitution pass is not enough: a local can read another local, and a
+ * `data` source can read a local that reads another data source. So this
+ * iterates to a fixpoint — each round replaces a referrer key appearing in an
+ * entry with that key's own resolved references, and the loop stops when a
+ * round adds nothing new.
+ *
+ * Growth is monotone and bounded by (referrers x distinct references), so a
+ * self-referential local (`a = local.a`, skipped outright) or a cycle
+ * (`a = local.b`, `b = local.a`) converges instead of recursing. Terraform
+ * rejects both, but the advisor only reads an estate and must not hang on one
+ * it disagrees with.
+ */
+function resolveReferrers(table) {
+    // Seed each entry with the references that already name something outside
+    // the table; the loop then folds in what the referrer keys resolve to.
+    const resolved = new Map();
+    for (const [key, refs] of table) {
+        resolved.set(key, new Map(refs.filter((r) => !table.has(r.address)).map((r) => [refKey(r), r])));
+    }
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const [key, refs] of table) {
+            const into = resolved.get(key);
+            for (const ref of refs) {
+                if (ref.address === key)
+                    continue; // `a = local.a` — nothing to fold in but itself
+                const from = resolved.get(ref.address);
+                if (!from)
+                    continue;
+                for (const [id, inner] of from) {
+                    if (into.has(id))
+                        continue;
+                    into.set(id, inner);
+                    changed = true;
+                }
+            }
+        }
+    }
+    return new Map([...resolved].map(([key, refs]) => [key, [...refs.values()]]));
+}
+/**
+ * A block's references as the graph should see them: one that reaches a
+ * `local` or `data` referrer additionally yields the node reference it
+ * resolves to.
+ *
+ * The original reference is kept — a `data.*` address is what marks the
+ * referring node dynamic, and an address that is not a node is dropped at edge
+ * time anyway. The resolved reference keeps the referring block's own `via`
+ * attribute, since that is what a deferred input is named after, and takes the
+ * carried resource attribute from the referrer's body.
+ */
+function throughReferrers(refs, resolved) {
+    const out = [];
+    for (const ref of refs) {
+        out.push(ref);
+        for (const inner of resolved.get(ref.address) ?? [])
+            out.push({ ...inner, via: ref.via });
+    }
+    return out;
+}
+/** A block carries `count`/`for_each` → dynamic, single instance until state resolves it. */
+function blockHasMeta(block, key) {
+    return !!block && typeof block === "object" && key in block;
+}
+/**
+ * The literal string at a dotted path into a block, or undefined when the path
+ * misses or lands on an interpolation. A dotted path walks nested blocks —
+ * hcl2json renders a nested block as a one-element array, so arrays step
+ * through their first element (`manifest.metadata.name`).
+ */
+function literalAt(block, path) {
+    let value = block;
+    for (const segment of path.split(".")) {
+        if (Array.isArray(value))
+            value = value[0];
+        if (!value || typeof value !== "object")
+            return undefined;
+        value = value[segment];
+    }
+    if (typeof value !== "string" || value.includes("${"))
+        return undefined;
+    return value;
+}
+/**
+ * The resource's physical name, if its identity attribute is a plain literal
+ * (not interpolated).
+ */
+function literalIdentity(block, type) {
+    const attr = identityAttrOf(type);
+    if (!attr || !block || typeof block !== "object")
+        return undefined;
+    return literalAt(block, attr);
+}
+/**
+ * The literals the type's data-source shape reads out of the carved block
+ * (#2034), keyed by the shape field's source path. `carve bridge` renders the
+ * data-source body from these; a required field missing here is what makes it
+ * write a TODO instead of a block Terraform would reject.
+ */
+function dataSourceValues(block, type) {
+    if (!block || typeof block !== "object")
+        return undefined;
+    const shape = dataSourceShapeOf(type);
+    if (!shape)
+        return undefined;
+    const values = {};
+    for (const path of shapeSourcePaths(shape)) {
+        const value = literalAt(block, path);
+        if (value !== undefined)
+            values[path] = value;
+    }
+    return Object.keys(values).length ? values : undefined;
+}
+/**
+ * Build the dependency graph from a merged hcl2json tree.
+ *
+ * `resource` and `module` blocks become nodes. `data` sources are NOT nodes
+ * (they are not carvable infrastructure), but a reference *to* a data source
+ * marks the referring node dynamic. An edge is recorded only when its target
+ * resolves to a known resource/module node — references to `var`/`local`/data
+ * are dropped.
+ *
+ * `output` blocks are not nodes either — nothing carves an output — but they
+ * do reference, and a reference to a carved resource breaks the surviving plan
+ * exactly like a resource's does. So an output contributes an edge tagged
+ * `fromKind: "output"` from the pseudo-address `output.<name>` (#1638),
+ * which the scorer weights lower and `carve bridge` patches.
+ *
+ * `locals` and `data` blocks are non-node referrers of a third kind (#2324):
+ * they carry a reference between two nodes rather than terminating it. A
+ * survivor reading `local.assets_id`, or reading a `data` source keyed off the
+ * carved resource, depends on that resource, so the reference is resolved
+ * through the referrer to the resource it ultimately names and the edge is
+ * recorded against the surviving node — the thing a reader can actually carve
+ * or leave behind. The referrer's own body is where `carve bridge` then lands
+ * the rewrite.
+ */
+export function buildGraph(tree, exprRefs) {
+    const nodes = [];
+    const dataAddresses = new Set();
+    const referrers = resolveReferrers(referrerTable(tree, exprRefs));
+    // First pass: register data-source addresses so refs to them can be spotted.
+    for (const [type, named] of Object.entries(tree.data ?? {})) {
+        for (const name of Object.keys(named))
+            dataAddresses.add(`data.${type}.${name}`);
+    }
+    // Resource nodes.
+    const rawRefsByNode = new Map();
+    for (const [type, named] of Object.entries(tree.resource ?? {})) {
+        for (const [name, blocks] of Object.entries(named)) {
+            const address = `${type}.${name}`;
+            const block = Array.isArray(blocks) ? blocks[0] : blocks;
+            const dynamic = blockHasMeta(block, "count") || blockHasMeta(block, "for_each");
+            const refs = throughReferrers(refsInBlock(block, exprRefs), referrers);
+            const touchesData = refs.some((r) => dataAddresses.has(r.address));
+            rawRefsByNode.set(address, refs);
+            nodes.push({
+                address,
+                kind: "resource",
+                type,
+                name,
+                instances: 1,
+                hasDynamic: dynamic || touchesData,
+                identity: literalIdentity(block, type),
+                dataSourceValues: dataSourceValues(block, type),
+            });
+        }
+    }
+    // Module nodes.
+    for (const [name, blocks] of Object.entries(tree.module ?? {})) {
+        const address = `module.${name}`;
+        const block = Array.isArray(blocks) ? blocks[0] : blocks;
+        const dynamic = blockHasMeta(block, "count") || blockHasMeta(block, "for_each");
+        const refs = throughReferrers(refsInBlock(block, exprRefs), referrers);
+        const touchesData = refs.some((r) => dataAddresses.has(r.address));
+        rawRefsByNode.set(address, refs);
+        nodes.push({
+            address,
+            kind: "module",
+            name,
+            instances: 1,
+            hasDynamic: dynamic || touchesData,
+        });
+    }
+    // Output blocks: referrers without being nodes (#1638). Their pseudo-address
+    // never joins `known`, so nothing can depend on an output in turn.
+    const outputRefs = new Map();
+    for (const [name, blocks] of Object.entries(tree.output ?? {})) {
+        const block = Array.isArray(blocks) ? blocks[0] : blocks;
+        outputRefs.set(`output.${name}`, throughReferrers(refsInBlock(block, exprRefs), referrers));
+    }
+    // Edges: keep only references that resolve to a known node.
+    const known = new Set(nodes.map((n) => n.address));
+    const edges = [];
+    const collect = (source, fromKind) => {
+        for (const [from, refs] of source) {
+            const byTarget = new Map();
+            for (const ref of refs) {
+                if (ref.address === from || !known.has(ref.address))
+                    continue;
+                if (!byTarget.has(ref.address))
+                    byTarget.set(ref.address, { attrs: new Set(), via: new Set() });
+                const target = byTarget.get(ref.address);
+                if (ref.attr)
+                    target.attrs.add(ref.attr);
+                if (ref.via)
+                    target.via.add(ref.via);
+            }
+            for (const [to, { attrs, via }] of byTarget) {
+                edges.push({ from, to, attrs: [...attrs].sort(), via: [...via].sort(), ...(fromKind ? { fromKind } : {}) });
+            }
+        }
+    };
+    collect(rawRefsByNode);
+    collect(outputRefs, "output");
+    // Code-point ordering (not localeCompare) so output is locale-independent and
+    // punctuation sorts predictably (`.` < `_`).
+    const cmp = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+    return {
+        nodes: nodes.sort((a, b) => cmp(a.address, b.address)),
+        edges: edges.sort((a, b) => cmp(a.from, b.from) || cmp(a.to, b.to)),
+    };
+}
+/** Edges where something in the surviving Terraform depends on `address`. */
+export function inboundEdges(graph, address) {
+    return graph.edges.filter((e) => e.to === address);
+}
+/** Edges where `address` depends on other nodes (each → a deferred deploy-time input). */
+export function outboundEdges(graph, address) {
+    return graph.edges.filter((e) => e.from === address);
+}