@intentius/chant 0.18.36 → 0.19.0

package/src/cli/handlers/carve-apply.ts

@@ -0,0 +1,34 @@
+import { carveApply, formatCarveApply } from "../commands/carve-apply";
+import { formatError } from "../format";
+import type { CommandContext } from "../registry";
+
+/**
+ * `chant carve apply --from <tf-dir> --select <address> --env <env> [--stack <name>] [--write]`
+ *
+ * Resolves the ownership marker + graduation runbook. BYOL-honest: no cloud
+ * calls. `--write` saves the graduation doc. No lexicon plugins needed.
+ */
+export async function runCarveApply(ctx: CommandContext): Promise<number> {
+  const { args } = ctx;
+
+  const result = await carveApply({
+    from: args.migrateFrom, // `--from <terraform-dir>`
+    select: args.selectAddress, // `--select <tf-address>`
+    env: args.env,
+    stack: args.carveStack,
+    statePath: args.statePath,
+    output: args.output,
+    write: args.write,
+  });
+
+  if (!result.ok) {
+    console.error(formatError({
+      message: result.error ?? "carve apply failed",
+      hint: "chant carve apply --from ./tf --select aws_s3_bucket.assets --env prod",
+    }));
+    return 1;
+  }
+
+  console.log(formatCarveApply(result));
+  return 0;
+}

package/src/cli/handlers/carve-bridge.ts

@@ -0,0 +1,33 @@
+import { carveBridge, formatCarveBridge } from "../commands/carve-bridge";
+import { formatError } from "../format";
+import type { CommandContext } from "../registry";
+
+/**
+ * `chant carve bridge --from <tf-dir> --select <address> [--output <dir>] [--apply-rewrites]`
+ *
+ * Read-only by default: writes proposed survivor patches + a runbook to an
+ * output dir. `--apply-rewrites` edits the surviving `.tf` in place. Loads no
+ * lexicon plugins — pure Terraform-side analysis.
+ */
+export async function runCarveBridge(ctx: CommandContext): Promise<number> {
+  const { args } = ctx;
+
+  const result = await carveBridge({
+    from: args.migrateFrom, // `--from <terraform-dir>`
+    select: args.selectAddress, // `--select <tf-address>`
+    statePath: args.statePath,
+    output: args.output,
+    applyRewrites: args.applyRewrites,
+  });
+
+  if (!result.ok) {
+    console.error(formatError({
+      message: result.error ?? "carve bridge failed",
+      hint: "chant carve bridge --from ./tf --select aws_s3_bucket.assets",
+    }));
+    return 1;
+  }
+
+  console.log(formatCarveBridge(result));
+  return 0;
+}

package/src/cli/handlers/carve-emit.ts

@@ -0,0 +1,51 @@
+import { carveEmit, formatCarveEmit } from "../commands/carve-emit";
+import { liveImportFromPlugins } from "../commands/import";
+import { loadPlugins } from "../plugins";
+import { formatError } from "../format";
+import type { CommandContext } from "../registry";
+
+/**
+ * `chant carve emit --from <tf-dir> --select <address> (--state <tfstate> | --env <env>)`
+ *
+ * Adopts the selected Terraform resource into typed chant source. `--state`
+ * adopts offline from the tfstate (no plugins); `--env` adopts via the live
+ * cloud import path, for which the target lexicon is loaded lazily here — so a
+ * state-only carve never pays the plugin-load cost.
+ */
+export async function runCarveEmit(ctx: CommandContext): Promise<number> {
+  const { args } = ctx;
+
+  // Load plugins only for the live path; the offline --state path needs none.
+  let plugins = ctx.plugins;
+  if (!args.statePath && args.env) {
+    try {
+      plugins = await loadPlugins(["aws"]);
+    } catch {
+      // fall through with whatever ctx provided; carveEmit surfaces a clear error
+    }
+  }
+
+  const result = await carveEmit(
+    {
+      from: args.migrateFrom, // `--from <terraform-dir>`
+      select: args.selectAddress, // `--select <tf-address>`
+      env: args.env,
+      liveName: args.liveName, // `--live-name <cfn-logical-id>`
+      statePath: args.statePath,
+      output: args.output,
+      reportFile: args.reportFile,
+    },
+    { plugins, liveImport: liveImportFromPlugins },
+  );
+
+  if (!result.ok) {
+    console.error(formatError({
+      message: result.error ?? "carve emit failed",
+      hint: "chant carve emit --from ./tf --select aws_s3_bucket.assets --env prod",
+    }));
+    return 1;
+  }
+
+  console.log(formatCarveEmit(result));
+  return 0;
+}

package/src/cli/handlers/carve.ts

@@ -0,0 +1,44 @@
+import { carveAdvise, carveJson, formatCarveReport } from "../commands/carve";
+import { formatError } from "../format";
+import type { CommandContext } from "../registry";
+
+/**
+ * `chant carve advise --from <terraform-dir> [--json] [--report <path>]`
+ *
+ * Read-only. Reuses `--from` (shared with migrate/import) for the estate dir.
+ * Loads no chant project and no lexicon plugins — pure analysis of a foreign
+ * Terraform tree.
+ */
+export async function runCarveAdvise(ctx: CommandContext): Promise<number> {
+  const { args } = ctx;
+
+  const result = await carveAdvise({
+    from: args.migrateFrom, // `--from <terraform-dir>`
+    statePath: args.statePath, // `--state <tfstate>`
+    reportFile: args.reportFile, // `--report <path>`
+  });
+
+  if (!result.ok) {
+    console.error(formatError({
+      message: result.error ?? "carve advise failed",
+      hint: "chant carve advise --from ./path/to/terraform",
+    }));
+    return 1;
+  }
+
+  if (args.json) {
+    console.log(JSON.stringify(carveJson(result), null, 2));
+  } else {
+    console.log(formatCarveReport(result));
+  }
+  return 0;
+}
+
+/** Fallback for `chant carve` with no/unknown subcommand. */
+export async function runCarveUnknown(_ctx: CommandContext): Promise<number> {
+  console.error(formatError({
+    message: "Unknown carve subcommand",
+    hint: "chant carve advise --from <terraform-dir>   (read-only peelability report)",
+  }));
+  return 1;
+}

package/src/cli/main.ts

@@ -16,6 +16,10 @@ import { runInit, runInitLexicon } from "./handlers/init";
 import { runList, runDescribe, runImport, runAudit, runUpdate, runDoctor } from "./handlers/misc";
 import { runVendor } from "./handlers/vendor";
 import { runMigrate } from "./handlers/migrate";
+import { runCarveAdvise, runCarveUnknown } from "./handlers/carve";
+import { runCarveEmit } from "./handlers/carve-emit";
+import { runCarveBridge } from "./handlers/carve-bridge";
+import { runCarveApply } from "./handlers/carve-apply";
 import { runLifecycleSnapshot, runLifecycleShow, runLifecycleDiff, runLifecycleRollback, runLifecyclePlan, runLifecycleAffected, runLifecycleLog, runLifecycleUnknown } from "./handlers/lifecycle";
 import { runComponentsStatus, runComponentsReleaseRecord, runComponentsUnknown } from "./handlers/components";
 import { runGraph } from "./handlers/graph";
@@ -116,6 +120,18 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.owned = true;
     } else if (arg === "--verbatim") {
       result.verbatim = true;
+    } else if (arg === "--state") {
+      result.statePath = args[++i];
+    } else if (arg === "--select") {
+      result.selectAddress = args[++i];
+    } else if (arg === "--live-name") {
+      result.liveName = args[++i];
+    } else if (arg === "--apply-rewrites") {
+      result.applyRewrites = true;
+    } else if (arg === "--stack") {
+      result.carveStack = args[++i];
+    } else if (arg === "--write") {
+      result.write = true;
     } else if (arg === "--to") {
       result.migrateTo = args[++i];
     } else if (arg === "--emit") {
@@ -245,6 +261,23 @@ Commands:
                          --template <file> / --theme <file> for the html report)
   migrate <file>        Translate a workflow between lexicons
                         (default: --from github --to gitlab)
+  carve advise          Read-only Terraform peelability advisor: rank which
+                        --from <tf-dir>   resources are cheap to carve into native chant
+                        (--json, --report <path>). Emits nothing, changes nothing.
+                        Needs @cdktf/hcl2json (npm install -D @cdktf/hcl2json).
+  carve emit            Adopt a selected TF resource into chant source + report
+                        --from <tf-dir>   its boundary. --state <tfstate> adopts offline
+                        --select <addr>   (recommended for TF-managed resources); --env
+                        --state|--env     <env> adopts via live cloud import (--live-name
+                                          <logical-id> narrows a multi-resource stack).
+  carve bridge          Generate the surviving-TF patch (data sources + rewired
+                        --from <tf-dir>   refs) + deferred inputs + reversible runbook.
+                        --select <addr>   Writes proposals for review; --apply-rewrites
+                                          edits the .tf in place.
+  carve apply           Apply graduation: ownership marker + finalized apply
+                        --from <tf-dir>   runbook (dial-turn observe→apply). BYOL —
+                        --select <addr>   no cloud call; --write saves the doc.
+                        --env <env>
 
 Ops:
   run <name>            Start an Op workflow (spawns worker + submits to Temporal)
@@ -428,6 +461,20 @@ const registry: CommandDef[] = [
   { name: "import", handler: runImport },
   { name: "audit", handler: runAudit },
   { name: "migrate", handler: runMigrate },
+  // Read-only Terraform peelability advisor (#214). Compound so "advise" lands
+  // in args.path; the estate dir comes from --from. No plugins, no project.
+  { name: "carve advise", handler: runCarveAdvise },
+  // Emit step (#197): adopt a selected TF resource into chant source. The
+  // --state path is offline (no plugins); the --env live path loads the target
+  // lexicon lazily in the handler, so this command does not require plugins.
+  { name: "carve emit", handler: runCarveEmit },
+  // Boundary bridging (#197): patch the surviving TF (data sources + rewired
+  // refs) + runbook. No plugins; Terraform-side only. Read-only unless
+  // --apply-rewrites.
+  { name: "carve bridge", handler: runCarveBridge },
+  // Apply graduation (#197): ownership marker + finalized apply runbook.
+  // BYOL-honest — no cloud call; --write saves the graduation doc.
+  { name: "carve apply", handler: runCarveApply },
   { name: "init", handler: runInit },
   { name: "init lexicon", handler: runInitLexicon },
 { name: "update", handler: runUpdate },
@@ -477,6 +524,7 @@ const registry: CommandDef[] = [
   { name: "serve mcp", requiresPlugins: true, handler: runServeMcp },
 
   // Fallback for unknown subcommands (must come after compound entries)
+  { name: "carve", handler: runCarveUnknown },
   { name: "emulator", requiresPlugins: true, handler: runEmulator },
   { name: "lifecycle", handler: runLifecycleUnknown },
   { name: "dev", handler: runDevUnknown },

package/src/cli/registry.ts

@@ -31,6 +31,18 @@ export interface ParsedArgs {
   live: boolean;
   /** `chant migrate --from <name>` (default "github") */
   migrateFrom?: string;
+  /** `chant carve advise --state <path>` — opt-in .tfstate for accurate instance counts */
+  statePath?: string;
+  /** `chant carve emit --select <tf-address>` — the Terraform resource to carve */
+  selectAddress?: string;
+  /** `chant carve emit --live-name <logicalId>` — CFN logical ID for live adoption */
+  liveName?: string;
+  /** `chant carve bridge --apply-rewrites` — write rewritten survivor .tf in place */
+  applyRewrites?: boolean;
+  /** `chant carve apply --stack <name>` — ownership-marker stack for graduation */
+  carveStack?: string;
+  /** `chant carve apply --write` — save the graduation doc */
+  write?: boolean;
   /** `chant migrate --to <name>` (default "gitlab") */
   migrateTo?: string;
   /** `chant migrate --emit yaml|ts` */

package/src/terraform/__fixtures__/advise.test.ts

@@ -0,0 +1,51 @@
+import { describe, test, expect } from "vitest";
+import { join } from "path";
+import { carveAdvise, formatCarveReport } from "../../cli/commands/carve";
+import { loadHcl2json } from "../parse";
+
+/**
+ * End-to-end demo test (#214 T5): run the advisor against the runnable sample
+ * estate the docs point at, and pin the headline scores so the doc examples
+ * stay honest. Skips cleanly when the optional wasm parser is absent.
+ */
+let parserAvailable = false;
+try {
+  await loadHcl2json();
+  parserAvailable = true;
+} catch {
+  parserAvailable = false;
+}
+
+const ESTATE = join(__dirname, "sample-estate");
+
+describe("carve advise against the sample estate", () => {
+  test("bands the estate the way the docs describe", async () => {
+    if (!parserAvailable) return;
+    const r = await carveAdvise({ from: ESTATE });
+    expect(r.ok).toBe(true);
+    const byAddr = Object.fromEntries((r.results ?? []).map((x) => [x.address, x]));
+
+    // Clean leaves
+    expect(byAddr["aws_s3_bucket.assets"].band).toBe("clean leaf");
+    expect(byAddr["aws_s3_bucket.assets"].score).toBe(88); // 1 inbound (Lambda); versioning folded
+    expect(byAddr["aws_cloudwatch_log_group.api"].score).toBe(100); // clean, no edges
+
+    // Folded sub-resource is not ranked on its own
+    expect(byAddr["aws_s3_bucket_versioning.assets"]).toBeUndefined();
+
+    // A subnet is a clean leaf (one outbound edge to the VPC).
+    expect(byAddr["aws_subnet.a"].score).toBe(96);
+
+    // The VPC three subnets hang off of is carvable, but with boundary work.
+    expect(byAddr["aws_vpc.main"].band).toBe("carvable w/ edits");
+    expect(byAddr["aws_vpc.main"].score).toBe(64); // 100 - 12*3 inbound
+
+    // Unsupported provider scores 0 → leave in Terraform
+    expect(byAddr["random_pet.suffix"].score).toBe(0);
+    expect(byAddr["random_pet.suffix"].band).toBe("leave in Terraform");
+
+    // The report never proposes a mutation.
+    const text = formatCarveReport(r);
+    expect(text).not.toMatch(/state rm|apply|destroy/i);
+  });
+});

package/src/terraform/__fixtures__/carve-arc.test.ts

@@ -0,0 +1,77 @@
+import { describe, test, expect, vi } from "vitest";
+import { mkdtempSync, writeFileSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { carveEmit } from "../../cli/commands/carve-emit";
+import { carveBridge } from "../../cli/commands/carve-bridge";
+import { carveApply } from "../../cli/commands/carve-apply";
+import { loadHcl2json } from "../parse";
+import type { ImportResult, LiveImportOptions } from "../../cli/commands/import";
+import type { LexiconPlugin } from "../../lexicon";
+
+/**
+ * End-to-end: one resource through the whole strangler-fig arc — emit → bridge
+ * → apply — on a single estate, asserting the steps compose. Live import is
+ * faked (no cloud). Skips when the wasm parser is absent.
+ */
+let parserAvailable = false;
+try {
+  await loadHcl2json();
+  parserAvailable = true;
+} catch {
+  parserAvailable = false;
+}
+
+const ESTATE = `
+resource "aws_s3_bucket" "assets" { bucket = "myapp-assets-prod" }
+resource "aws_s3_bucket_versioning" "assets" {
+  bucket = aws_s3_bucket.assets.id
+  versioning_configuration { status = "Enabled" }
+}
+resource "aws_lambda_function" "api" {
+  function_name = "myapp-api"
+  environment { variables = { B = aws_s3_bucket.assets.bucket, A = aws_s3_bucket.assets.arn } }
+}
+`;
+
+const fakeImport = vi.fn(
+  async (_p: LexiconPlugin[], _o: LiveImportOptions): Promise<ImportResult> => ({
+    success: true,
+    generatedFiles: ["infra/assets.ts"],
+    warnings: [],
+    lexicon: "aws",
+  }),
+);
+
+describe("carve arc: emit → bridge → apply", () => {
+  test("carries aws_s3_bucket.assets from Terraform to chant-owned", async () => {
+    if (!parserAvailable) return;
+    const dir = mkdtempSync(join(tmpdir(), "chant-arc-"));
+    try {
+      writeFileSync(join(dir, "main.tf"), ESTATE);
+      const sel = "aws_s3_bucket.assets";
+
+      // 1. emit: adopt + boundary (Lambda inbound; versioning folded).
+      const emit = await carveEmit({ from: dir, select: sel, env: "prod" }, { plugins: [], liveImport: fakeImport });
+      expect(emit.ok).toBe(true);
+      expect(emit.selector).toEqual({ type: "AWS::S3::Bucket" }); // live selector is by native type
+      expect(emit.report!.inbound.map((e) => e.survivor)).toEqual(["aws_lambda_function.api"]);
+
+      // 2. bridge: data source + rewired survivor (dry-run).
+      const out = join(dir, "carveout");
+      const bridge = await carveBridge({ from: dir, select: sel, output: out });
+      expect(bridge.ok).toBe(true);
+      expect(bridge.plan!.dataSources[0].type).toBe("aws_s3_bucket");
+      const rewired = bridge.plan!.rewrites.find((r) => r.changed)!;
+      expect(rewired.rewritten).toContain("data.aws_s3_bucket.assets.bucket");
+
+      // 3. apply: ownership marker + graduation plan.
+      const apply = await carveApply({ from: dir, select: sel, env: "prod", stack: "assets" });
+      expect(apply.ok).toBe(true);
+      expect(apply.plan!.ownershipTags["chant:managed-by"]).toBe("chant");
+      expect(apply.plan!.steps.join("\n")).toMatch(/terraform import aws_s3_bucket\.assets/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/src/terraform/__fixtures__/sample-estate/main.tf

@@ -0,0 +1,58 @@
+# A small, deliberately mixed Terraform estate for the carve-out advisor demo.
+# Some resources are clean leaves, some carry boundary edges, some should stay.
+
+# Clean leaf: a bucket a Lambda reads from. Its versioning sub-resource folds in.
+resource "aws_s3_bucket" "assets" {
+  bucket = "myapp-assets-prod"
+  tags   = { Team = "web", Env = "prod" }
+}
+
+resource "aws_s3_bucket_versioning" "assets" {
+  bucket = aws_s3_bucket.assets.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+# Clean leaf: a log group nothing depends on.
+resource "aws_cloudwatch_log_group" "api" {
+  name              = "/myapp/api"
+  retention_in_days = 30
+}
+
+# Stays in Terraform: the Lambda reads the bucket (tier-2 map + outbound edge).
+resource "aws_lambda_function" "api" {
+  function_name = "myapp-api"
+  environment {
+    variables = {
+      ASSETS_BUCKET = aws_s3_bucket.assets.bucket
+      ASSETS_ARN    = aws_s3_bucket.assets.arn
+    }
+  }
+}
+
+# Carvable w/ edits: three subnets depend on the VPC, so carving it means three
+# data-source patches to the surviving Terraform — real but bounded boundary work.
+resource "aws_vpc" "main" {
+  cidr_block = "10.0.0.0/16"
+}
+
+resource "aws_subnet" "a" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = "10.0.1.0/24"
+}
+
+resource "aws_subnet" "b" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = "10.0.2.0/24"
+}
+
+resource "aws_subnet" "c" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = "10.0.3.0/24"
+}
+
+# Leave in Terraform: an unsupported provider with no native mapping, scored 0.
+resource "random_pet" "suffix" {
+  length = 2
+}

package/src/terraform/adopt-state.test.ts

@@ -0,0 +1,64 @@
+import { describe, test, expect } from "vitest";
+import { adoptFromState, canAdoptFromState, supportedStateAdoptionTypes } from "./adopt-state";
+import type { StateResource } from "./state";
+
+describe("adoptFromState", () => {
+  test("maps a real S3 bucket state resource to native chant source", () => {
+    const resource: StateResource = {
+      type: "aws_s3_bucket",
+      name: "assets",
+      attributes: {
+        id: "myapp-assets-prod",
+        bucket: "myapp-assets-prod",
+        arn: "arn:aws:s3:::myapp-assets-prod",
+        tags: { Team: "web", Env: "prod" },
+        force_destroy: false,
+      },
+    };
+    const out = adoptFromState(resource)!;
+    expect(out.fileName).toBe("assets.ts");
+    expect(out.mapped).toBe(true);
+    expect(out.nativeType).toBe("AWS::S3::Bucket");
+
+    // Correct constructor + CloudFormation PascalCase props from real TF attrs.
+    expect(out.content).toContain('import { Bucket } from "@intentius/chant-lexicon-aws";');
+    expect(out.content).toContain("export const assets = new Bucket({");
+    expect(out.content).toContain('BucketName: "myapp-assets-prod"');
+    expect(out.content).toContain('{"Key":"Team","Value":"web"}');
+    expect(out.content).toContain('{"Key":"Env","Value":"prod"}');
+
+    // Unmapped attributes are preserved for reconciliation, not dropped.
+    expect(out.content).toContain("Unmapped Terraform attributes");
+    expect(out.content).toContain("force_destroy");
+    // Mapped keys are not repeated in the unmapped block.
+    expect(out.content).not.toContain('"bucket":');
+  });
+
+  test("maps a log group with retention", () => {
+    const out = adoptFromState({
+      type: "aws_cloudwatch_log_group",
+      name: "api",
+      attributes: { id: "/myapp/api", name: "/myapp/api", retention_in_days: 30, arn: "arn:...:log-group:/myapp/api" },
+    })!;
+    expect(out.content).toContain("new LogGroup({");
+    expect(out.content).toContain('LogGroupName: "/myapp/api"');
+    expect(out.content).toContain("RetentionInDays: 30");
+  });
+
+  test("canAdoptFromState gates on a known native constructor", () => {
+    expect(canAdoptFromState("aws_s3_bucket")).toBe(true);
+    expect(canAdoptFromState("random_pet")).toBe(false);
+  });
+
+  test("supportedStateAdoptionTypes lists the mappable types, sorted", () => {
+    const types = supportedStateAdoptionTypes();
+    expect(types).toContain("aws_s3_bucket");
+    expect(types).toContain("aws_sqs_queue");
+    expect(types).toEqual([...types].sort());
+    expect(types).not.toContain("aws_instance"); // not yet mapped
+  });
+
+  test("returns null for a type with no native constructor", () => {
+    expect(adoptFromState({ type: "random_pet", name: "x", attributes: { id: "abc" } })).toBeNull();
+  });
+});

package/src/terraform/adopt-state.ts

@@ -0,0 +1,79 @@
+/**
+ * Adopt a Terraform-managed resource into chant source from its `.tfstate`
+ * (#1009). This is the correct adoption source for carving OUT of Terraform:
+ * a TF resource is created through the provider API, not CloudFormation, so it
+ * is not in any CFN stack — but its resolved attributes ARE in the state file.
+ *
+ * chant AWS constructors take CloudFormation PascalCase properties (e.g.
+ * `new Bucket({ BucketName })`), while Terraform state uses the provider's
+ * snake_case attributes (`bucket`, `tags`). The mapping is driven by the single
+ * AWS carve-out table (`aws-resources.ts`) — the same table the advisor's tier
+ * map derives from, so every AWS type advise ranks can be emitted. Attributes
+ * without a mapping are preserved in a reference comment, never dropped.
+ */
+
+import { AWS_CARVE_TYPES, AWS_LEXICON_IMPORT, awsCarveType, applyAwsMapper } from "./aws-resources";
+import type { StateResource } from "./state";
+
+export interface AdoptedSource {
+  fileName: string;
+  content: string;
+  /** True when at least one attribute was mapped to a native prop. */
+  mapped: boolean;
+  nativeType: string;
+}
+
+/** Is this Terraform type adoptable from state (has a native constructor)? */
+export function canAdoptFromState(tfType: string): boolean {
+  return awsCarveType(tfType) !== undefined;
+}
+
+/** Terraform types that can currently be adopted from state, for user-facing hints. */
+export function supportedStateAdoptionTypes(): string[] {
+  return AWS_CARVE_TYPES.map((t) => t.tfType).sort();
+}
+
+/**
+ * Render chant source for a state-adopted resource. Emits the native
+ * constructor with mapped properties, plus a reference comment listing the
+ * Terraform attributes that were not mapped so nothing is silently dropped.
+ */
+export function adoptFromState(resource: StateResource): AdoptedSource | null {
+  const entry = awsCarveType(resource.type);
+  if (!entry) return null;
+
+  const { props, mappedKeys } = applyAwsMapper(entry, resource.attributes);
+  const unmapped: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(resource.attributes)) {
+    if (!mappedKeys.includes(k)) unmapped[k] = v;
+  }
+
+  const L: string[] = [];
+  L.push(`// Adopted from Terraform state: ${resource.type}.${resource.name} -> ${entry.nativeType}`);
+  L.push(`// Properties mapped from Terraform attributes (CloudFormation PascalCase).`);
+  L.push(`import { ${entry.ctor} } from "${AWS_LEXICON_IMPORT}";`);
+  L.push("");
+  L.push(`export const ${resource.name} = new ${entry.ctor}(${renderObject(props, 2)});`);
+  if (Object.keys(unmapped).length) {
+    L.push("");
+    L.push("/* Unmapped Terraform attributes (reconcile to native props before building):");
+    L.push(JSON.stringify(unmapped, null, 2));
+    L.push("*/");
+  }
+
+  return {
+    fileName: `${resource.name}.ts`,
+    content: L.join("\n") + "\n",
+    mapped: Object.keys(props).length > 0,
+    nativeType: entry.nativeType,
+  };
+}
+
+/** Render a JS object literal with stable key order and given indent. */
+function renderObject(obj: Record<string, unknown>, indent: number): string {
+  const keys = Object.keys(obj);
+  if (keys.length === 0) return "{}";
+  const pad = " ".repeat(indent);
+  const body = keys.map((k) => `${pad}${k}: ${JSON.stringify(obj[k])},`).join("\n");
+  return `{\n${body}\n}`;
+}