@intentius/chant 0.41.19 → 0.42.1

package/src/terraform/graduate.test.ts

@@ -1,7 +1,7 @@
 import { describe, test, expect } from "vitest";
-import { buildGraph } from "./graph";
+import { buildFixtureGraph } from "./__fixtures__/build-graph";
 import { boundaryReport } from "./carve";
-import { graduationPlan, DEFAULT_TAG_OWNERSHIP_KEYS } from "./graduate";
+import { graduationPlan, stampOwnershipIntoSource, DEFAULT_TAG_OWNERSHIP_KEYS } from "./graduate";
 import type { Hcl2JsonTree } from "./types";
 
 const bucketTree: Hcl2JsonTree = {
@@ -13,7 +13,7 @@ const bucketTree: Hcl2JsonTree = {
 
 describe("graduationPlan", () => {
   test("resolves the ownership marker + tags (chant-owned)", () => {
-    const report = boundaryReport(buildGraph(bucketTree), "aws_s3_bucket.assets")!;
+    const report = boundaryReport(buildFixtureGraph(bucketTree), "aws_s3_bucket.assets")!;
     const plan = graduationPlan(report, { stack: "assets", env: "prod" });
 
     expect(plan.marker).toEqual({ stack: "assets", env: "prod" });
@@ -25,14 +25,14 @@ describe("graduationPlan", () => {
   });
 
   test("stack defaults to the resource's local name", () => {
-    const report = boundaryReport(buildGraph(bucketTree), "aws_s3_bucket.assets")!;
+    const report = boundaryReport(buildFixtureGraph(bucketTree), "aws_s3_bucket.assets")!;
     const plan = graduationPlan(report);
     expect(plan.marker.stack).toBe("assets");
     expect(plan.ownershipTags).not.toHaveProperty(DEFAULT_TAG_OWNERSHIP_KEYS.env); // no env → omitted
   });
 
   test("runbook is reversible and BYOL (import rollback, no chant-runs-apply)", () => {
-    const report = boundaryReport(buildGraph(bucketTree), "aws_s3_bucket.assets")!;
+    const report = boundaryReport(buildFixtureGraph(bucketTree), "aws_s3_bucket.assets")!;
     const plan = graduationPlan(report, { env: "prod" });
     const runbook = plan.steps.join("\n");
     expect(runbook).toMatch(/terraform import aws_s3_bucket\.assets/);
@@ -42,8 +42,75 @@ describe("graduationPlan", () => {
 
   test("warns when outbound edges leave deferred inputs to wire", () => {
     // Carve the Lambda: it depends on the bucket (survivor) → outbound/deferred.
-    const report = boundaryReport(buildGraph(bucketTree), "aws_lambda_function.api")!;
+    const report = boundaryReport(buildFixtureGraph(bucketTree), "aws_lambda_function.api")!;
     const plan = graduationPlan(report, { env: "prod" });
     expect(plan.warnings.join(" ")).toMatch(/deferred deploy-time input/i);
   });
 });
+
+const TAGS = { "chant:managed-by": "chant", "chant:stack": "assets", "chant:env": "prod" };
+
+describe("stampOwnershipIntoSource", () => {
+  test("merges into an existing Tags prop, replacing stale chant keys", () => {
+    const src = [
+      'import { Bucket } from "@intentius/chant-lexicon-aws";',
+      "",
+      "export const assets = new Bucket({",
+      '  BucketName: "myapp-assets-prod",',
+      '  Tags: [{"Key":"Team","Value":"web"},{"Key":"chant:stack","Value":"old"}],',
+      "});",
+      "",
+    ].join("\n");
+
+    const res = stampOwnershipIntoSource(src, TAGS)!;
+    expect(res.changed).toBe(true);
+    const tagsLine = res.content.split("\n").find((l) => l.includes("Tags:"))!;
+    const tags = JSON.parse(tagsLine.trim().replace(/^Tags: /, "").replace(/,$/, "")) as Array<{ Key: string; Value: string }>;
+    expect(tags).toEqual([
+      { Key: "Team", Value: "web" },
+      { Key: "chant:managed-by", Value: "chant" },
+      { Key: "chant:stack", Value: "assets" },
+      { Key: "chant:env", Value: "prod" },
+    ]);
+  });
+
+  test("inserts a Tags prop when the constructor has none (unmapped comment untouched)", () => {
+    const src = [
+      "export const api = new LogGroup({",
+      '  LogGroupName: "/myapp/api",',
+      "});",
+      "",
+      "/* Unmapped Terraform attributes (reconcile to native props before building):",
+      '{ "skip_destroy": false }',
+      "*/",
+      "",
+    ].join("\n");
+
+    const res = stampOwnershipIntoSource(src, TAGS)!;
+    expect(res.changed).toBe(true);
+    const lines = res.content.split("\n");
+    expect(lines[2]).toBe(`  Tags: ${JSON.stringify(Object.entries(TAGS).map(([Key, Value]) => ({ Key, Value })))},`);
+    expect(lines[3]).toBe("});");
+    expect(res.content).toContain("skip_destroy"); // the comment survives
+  });
+
+  test("handles an empty props object", () => {
+    const src = "export const igw = new InternetGateway({});\n";
+    const res = stampOwnershipIntoSource(src, TAGS)!;
+    expect(res.changed).toBe(true);
+    expect(res.content).toContain("new InternetGateway({\n  Tags: [");
+    expect(res.content).toMatch(/\}\);\n$/);
+  });
+
+  test("is idempotent: a second stamp changes nothing", () => {
+    const src = 'export const assets = new Bucket({\n  BucketName: "b",\n});\n';
+    const first = stampOwnershipIntoSource(src, TAGS)!;
+    const second = stampOwnershipIntoSource(first.content, TAGS)!;
+    expect(second.changed).toBe(false);
+    expect(second.content).toBe(first.content);
+  });
+
+  test("returns null when there is no constructor to stamp", () => {
+    expect(stampOwnershipIntoSource("// nothing here\n", TAGS)).toBeNull();
+  });
+});

package/src/terraform/graduate.ts

@@ -76,3 +76,52 @@ export function graduationPlan(report: CarveReport, opts: GraduationOptions = {}
 
   return { target: report.target, marker, ownershipTags, steps, warnings };
 }
+
+/**
+ * Stamp the ownership tags into an emitted chant source file (`carve apply
+ * --write-source`). The emitted source is machine-generated (`adoptFromState`),
+ * so its shape is known: one prop per line, `Tags` as a single-line JSON array.
+ * Merges into an existing `Tags` prop (replacing stale chant keys) or inserts
+ * one into the constructor's props object. Returns null when the file has no
+ * recognizable constructor to stamp.
+ */
+export function stampOwnershipIntoSource(
+  content: string,
+  tags: Record<string, string>,
+): { content: string; changed: boolean } | null {
+  const entries = Object.entries(tags).map(([Key, Value]) => ({ Key, Value }));
+  const keys = new Set(Object.keys(tags));
+  const lines = content.split("\n");
+
+  // Merge into an existing Tags prop.
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^(\s*)Tags: (\[.*\]),$/);
+    if (!m) continue;
+    let existing: Array<{ Key: string; Value: unknown }>;
+    try {
+      existing = JSON.parse(m[2]) as Array<{ Key: string; Value: unknown }>;
+    } catch {
+      continue;
+    }
+    const merged = [...existing.filter((t) => !keys.has(t.Key)), ...entries];
+    const rendered = `${m[1]}Tags: ${JSON.stringify(merged)},`;
+    if (rendered === lines[i]) return { content, changed: false };
+    lines[i] = rendered;
+    return { content: lines.join("\n"), changed: true };
+  }
+
+  // No Tags prop yet: insert one into the constructor's props object.
+  const tagsLine = `  Tags: ${JSON.stringify(entries)},`;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (/^\}\);\s*$/.test(lines[i])) {
+      lines.splice(i, 0, tagsLine);
+      return { content: lines.join("\n"), changed: true };
+    }
+    const empty = lines[i].match(/^(export const .+ = new \w+\()\{\}(\);)\s*$/);
+    if (empty) {
+      lines[i] = `${empty[1]}{\n${tagsLine}\n}${empty[2]}`;
+      return { content: lines.join("\n"), changed: true };
+    }
+  }
+  return null;
+}

package/src/terraform/graph.test.ts

@@ -1,5 +1,6 @@
 import { describe, test, expect } from "vitest";
-import { buildGraph, inboundEdges, outboundEdges } from "./graph";
+import { inboundEdges, outboundEdges, refFromAccessor } from "./graph";
+import { buildFixtureGraph } from "./__fixtures__/build-graph";
 import type { Hcl2JsonTree } from "./types";
 
 /**
@@ -37,7 +38,7 @@ const workedExample: Hcl2JsonTree = {
 
 describe("buildGraph", () => {
   test("extracts resource nodes with addresses", () => {
-    const g = buildGraph(workedExample);
+    const g = buildFixtureGraph(workedExample);
     expect(g.nodes.map((n) => n.address)).toEqual([
       "aws_lambda_function.api",
       "aws_s3_bucket.assets",
@@ -47,16 +48,16 @@ describe("buildGraph", () => {
   });
 
   test("records directed edges with referenced attributes, deduped per target", () => {
-    const g = buildGraph(workedExample);
+    const g = buildFixtureGraph(workedExample);
     // versioning → bucket (.id), lambda → bucket (.bucket, .arn)
     expect(g.edges).toEqual([
-      { from: "aws_lambda_function.api", to: "aws_s3_bucket.assets", attrs: ["arn", "bucket"] },
-      { from: "aws_s3_bucket_versioning.assets", to: "aws_s3_bucket.assets", attrs: ["id"] },
+      { from: "aws_lambda_function.api", to: "aws_s3_bucket.assets", attrs: ["arn", "bucket"], via: ["environment"] },
+      { from: "aws_s3_bucket_versioning.assets", to: "aws_s3_bucket.assets", attrs: ["id"], via: ["bucket"] },
     ]);
   });
 
   test("inbound/outbound classification", () => {
-    const g = buildGraph(workedExample);
+    const g = buildFixtureGraph(workedExample);
     // Two survivors depend on the bucket; the bucket depends on nothing.
     expect(inboundEdges(g, "aws_s3_bucket.assets").map((e) => e.from)).toEqual([
       "aws_lambda_function.api",
@@ -78,7 +79,7 @@ describe("buildGraph", () => {
         aws_route53_record: { cdn: [{ name: "${module.cdn.domain}" }] },
       },
     };
-    const g = buildGraph(tree);
+    const g = buildFixtureGraph(tree);
     const cdn = g.nodes.find((n) => n.address === "module.cdn");
     expect(cdn).toMatchObject({ kind: "module", name: "cdn" });
     // module → bucket, and record → module
@@ -86,11 +87,13 @@ describe("buildGraph", () => {
       from: "module.cdn",
       to: "aws_s3_bucket.assets",
       attrs: ["arn"],
+      via: ["bucket_arn"],
     });
     expect(g.edges).toContainEqual({
       from: "aws_route53_record.cdn",
       to: "module.cdn",
       attrs: ["domain"],
+      via: ["name"],
     });
   });
 
@@ -104,7 +107,7 @@ describe("buildGraph", () => {
         },
       },
     };
-    const g = buildGraph(tree);
+    const g = buildFixtureGraph(tree);
     const byAddr = Object.fromEntries(g.nodes.map((n) => [n.address, n]));
     expect(byAddr["aws_instance.web"]).toMatchObject({ hasDynamic: true, instances: 1 });
     expect(byAddr["aws_instance.worker"]).toMatchObject({ hasDynamic: true, instances: 1 });
@@ -118,20 +121,63 @@ describe("buildGraph", () => {
         aws_instance: { web: [{ ami: "${data.aws_ami.ubuntu.id}" }] },
       },
     };
-    const g = buildGraph(tree);
+    const g = buildFixtureGraph(tree);
     expect(g.nodes.map((n) => n.address)).toEqual(["aws_instance.web"]); // data is not a node
     expect(g.edges).toEqual([]); // ref to data → no resource edge
     expect(g.nodes[0].hasDynamic).toBe(true);
   });
 
+  test("an expression whose AST found no references contributes no edge", () => {
+    // `${var.m["aws_s3_bucket.assets.arn"]}` — the AST reports only `var.m`;
+    // the quoted address inside the brackets is a map key, not a reference.
+    const tree: Hcl2JsonTree = {
+      resource: {
+        aws_s3_bucket: { assets: [{ bucket: "x" }] },
+        aws_lambda_function: { api: [{ handler: '${var.m["aws_s3_bucket.assets.arn"]}' }] },
+      },
+    };
+    const g = buildFixtureGraph(tree);
+    expect(g.edges).toEqual([]);
+  });
+
   test("var / local references are not edges", () => {
     const tree: Hcl2JsonTree = {
       resource: {
         aws_s3_bucket: { assets: [{ bucket: "${var.name}", tags: { env: "${local.env}" } }] },
       },
     };
-    const g = buildGraph(tree);
+    const g = buildFixtureGraph(tree);
     expect(g.edges).toEqual([]);
     expect(g.nodes[0].hasDynamic).toBe(false); // var/local alone are not the dynamic markers
   });
 });
+
+describe("refFromAccessor", () => {
+  test("classifies resource, module, and data accessors", () => {
+    expect(refFromAccessor("aws_s3_bucket.assets.bucket")).toEqual({
+      address: "aws_s3_bucket.assets",
+      attr: "bucket",
+    });
+    expect(refFromAccessor("aws_s3_bucket.assets")).toEqual({ address: "aws_s3_bucket.assets", attr: undefined });
+    expect(refFromAccessor("module.cdn.domain")).toEqual({ address: "module.cdn", attr: "domain" });
+    expect(refFromAccessor("data.aws_ami.ubuntu.id")).toEqual({ address: "data.aws_ami.ubuntu", attr: "id" });
+  });
+
+  test("non-resource heads are not references", () => {
+    for (const accessor of ["var.name", "local.env", "each.value", "count.index", "self.arn", "path.module", "terraform.workspace"]) {
+      expect(refFromAccessor(accessor)).toBeNull();
+    }
+  });
+
+  test("quoted map keys and numeric indexes never become the attribute", () => {
+    // `var.m["aws_s3_bucket.assets.arn"]` → the AST renders `var.m."aws_s3_bucket.assets.arn"`
+    expect(refFromAccessor('var.m."aws_s3_bucket.assets.arn"')).toBeNull();
+    // `aws_instance.web[0].id` → `aws_instance.web.0.id`
+    expect(refFromAccessor("aws_instance.web.0.id")).toEqual({ address: "aws_instance.web", attr: "id" });
+    // `aws_s3_bucket.assets.tags["a.b"]` → the key must not shadow the attr
+    expect(refFromAccessor('aws_s3_bucket.assets.tags."a.b"')).toEqual({
+      address: "aws_s3_bucket.assets",
+      attr: "tags",
+    });
+  });
+});

package/src/terraform/graph.ts

@@ -1,65 +1,116 @@
 /**
  * Pure Terraform dependency-graph builder for the carve-out advisor (#214 T1).
  *
- * Input is the JSON tree `@cdktf/hcl2json` produces (`Hcl2JsonTree`). No wasm,
- * no filesystem — so the graph and its edge classification are unit-testable
- * on hand-written fixtures. `parse.ts` is the thin glue that loads the wasm
- * parser and feeds this.
+ * Input is the JSON tree `@cdktf/hcl2json` produces (`Hcl2JsonTree`) plus the
+ * traversal accessors its expression AST found per interpolated string
+ * (`ExpressionRefs`, resolved in `parse.ts` — #998). Tokenizing `${...}`
+ * expression bodies is the AST's job — a quoted address inside an expression
+ * (`var.m["aws_s3_bucket.assets.arn"]`) or an escaped `$${...}` literal is not
+ * a reference, which the regex scan this replaced could not tell. This module
+ * only classifies the accessors the AST produced: no wasm, no filesystem, so
+ * graph building stays unit-testable on hand-written fixtures.
  */
 
 import { IDENTITY_ATTR } from "./tier-map";
 import type { Hcl2JsonTree, TfEdge, TfGraph, TfNode } from "./types";
 
 /**
- * hcl2json leaves interpolations as `${...}` strings. Match each expression
- * body; reference heads are extracted from it in `refsFromExpression`.
+ * Traversal accessors per interpolated string, as the hcl2json expression AST
+ * reports them (`getReferencesInExpression`): `"${aws_s3_bucket.assets.arn}"`
+ * maps to `["aws_s3_bucket.assets.arn"]`. Keys are the raw hcl2json string
+ * values; a missing key means the expression yielded no references.
  */
-const INTERPOLATION = /\$\{([^}]+)\}/g;
+export type ExpressionRefs = ReadonlyMap<string, readonly string[]>;
 
-/** `module.<name>` reference head. */
-const MODULE_REF = /\bmodule\.([A-Za-z0-9_-]+)(?:\.([A-Za-z0-9_]+))?/g;
-
-/** `data.<type>.<name>` reference head. */
-const DATA_REF = /\bdata\.([a-z][a-z0-9_]*)\.([A-Za-z0-9_-]+)(?:\.([A-Za-z0-9_]+))?/g;
-
-/**
- * `<type>.<name>` resource reference head. Deliberately broad — it also
- * matches `var.x`, `local.y`, `each.value`, function-ish tokens. Only heads
- * whose address is a known node survive into an edge (see `buildGraph`).
- */
-const RESOURCE_REF = /\b([a-z][a-z0-9_]*)\.([A-Za-z0-9_-]+)(?:\.([A-Za-z0-9_]+))?/g;
-
-/** Non-resource reference prefixes that must never be read as a resource type. */
-const NON_RESOURCE_HEADS = new Set(["var", "local", "module", "data", "each", "count", "self", "path", "terraform"]);
+/** Non-resource reference heads that must never be read as a resource type. */
+const NON_RESOURCE_HEADS = new Set(["var", "local", "each", "count", "self", "path", "terraform"]);
 
 interface RawRef {
   address: string;
   attr?: string;
+  /** The referring block's top-level attribute the reference sits in (#998). */
+  via?: string;
 }
 
-/** Pull every resource/module/data reference out of one interpolation body. */
-function refsFromExpression(expr: string): RawRef[] {
-  const refs: RawRef[] = [];
-
-  for (const m of expr.matchAll(MODULE_REF)) {
-    refs.push({ address: `module.${m[1]}`, attr: m[2] });
+/**
+ * Split a traversal accessor into segments. Dots inside a quoted map key
+ * (`var.m."a.b"` — how the AST renders `var.m["a.b"]`) do not split.
+ */
+function accessorSegments(accessor: string): string[] {
+  const segments: string[] = [];
+  let i = 0;
+  while (i < accessor.length) {
+    if (accessor[i] === '"') {
+      const close = accessor.indexOf('"', i + 1);
+      const end = close === -1 ? accessor.length : close + 1;
+      segments.push(accessor.slice(i, end));
+      i = end;
+    } else {
+      let j = i;
+      while (j < accessor.length && accessor[j] !== ".") j++;
+      segments.push(accessor.slice(i, j));
+      i = j;
+    }
+    if (accessor[i] === ".") i++;
   }
-  for (const m of expr.matchAll(DATA_REF)) {
-    refs.push({ address: `data.${m[1]}.${m[2]}`, attr: m[3] });
+  return segments;
+}
+
+const NAME = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+
+/**
+ * Classify one AST traversal accessor into a resource/module/data reference.
+ * `var.*`/`local.*`/`each.*`-headed accessors are not references; quoted map
+ * keys and numeric indexes never become the attribute.
+ */
+export function refFromAccessor(accessor: string): RawRef | null {
+  const parts = accessorSegments(accessor);
+  const isName = (s: string | undefined): s is string => s !== undefined && NAME.test(s);
+  const attrAfter = (idx: number): string | undefined => parts.slice(idx).find((p) => isName(p));
+
+  if (parts[0] === "module") {
+    return isName(parts[1]) ? { address: `module.${parts[1]}`, attr: attrAfter(2) } : null;
   }
-  for (const m of expr.matchAll(RESOURCE_REF)) {
-    if (NON_RESOURCE_HEADS.has(m[1])) continue;
-    refs.push({ address: `${m[1]}.${m[2]}`, attr: m[3] });
+  if (parts[0] === "data") {
+    return isName(parts[1]) && isName(parts[2])
+      ? { address: `data.${parts[1]}.${parts[2]}`, attr: attrAfter(3) }
+      : null;
   }
-  return refs;
+  if (NON_RESOURCE_HEADS.has(parts[0]) || !isName(parts[0]) || !isName(parts[1])) return null;
+  return { address: `${parts[0]}.${parts[1]}`, attr: attrAfter(2) };
+}
+
+/**
+ * Every string value carrying an interpolation across the tree's resource and
+ * module blocks — exactly the expressions `parse.ts` must resolve through the
+ * AST before `buildGraph` can classify them.
+ */
+export function collectExpressions(tree: Hcl2JsonTree): string[] {
+  const exprs = new Set<string>();
+  const visit = (v: unknown): void => {
+    if (typeof v === "string") {
+      if (v.includes("${")) exprs.add(v);
+    } else if (Array.isArray(v)) {
+      v.forEach(visit);
+    } else if (v && typeof v === "object") {
+      for (const inner of Object.values(v as Record<string, unknown>)) visit(inner);
+    }
+  };
+  for (const named of Object.values(tree.resource ?? {})) for (const blocks of Object.values(named)) visit(blocks);
+  for (const blocks of Object.values(tree.module ?? {})) visit(blocks);
+  return [...exprs].sort();
 }
 
-/** Collect every `${...}` reference reachable in a block's value tree. */
-function refsInValue(value: unknown): RawRef[] {
+/** Collect every reference reachable in a block's value tree, via the AST-resolved accessors. */
+function refsInValue(value: unknown, exprRefs: ExpressionRefs): RawRef[] {
   const refs: RawRef[] = [];
   const visit = (v: unknown): void => {
     if (typeof v === "string") {
-      for (const m of v.matchAll(INTERPOLATION)) refs.push(...refsFromExpression(m[1]));
+      if (!v.includes("${")) return;
+      for (const accessor of exprRefs.get(v) ?? []) {
+        const ref = refFromAccessor(accessor);
+        if (ref) refs.push(ref);
+      }
     } else if (Array.isArray(v)) {
       v.forEach(visit);
     } else if (v && typeof v === "object") {
@@ -70,6 +121,20 @@ function refsInValue(value: unknown): RawRef[] {
   return refs;
 }
 
+/**
+ * References in a whole block, each tagged with the top-level attribute it
+ * came in through — `via` is what a deferred outbound input gets named after
+ * when emit turns it into a build parameter (#998).
+ */
+function refsInBlock(block: unknown, exprRefs: ExpressionRefs): RawRef[] {
+  if (!block || typeof block !== "object" || Array.isArray(block)) return refsInValue(block, exprRefs);
+  const refs: RawRef[] = [];
+  for (const [key, value] of Object.entries(block as Record<string, unknown>)) {
+    for (const ref of refsInValue(value, exprRefs)) refs.push({ ...ref, via: key });
+  }
+  return refs;
+}
+
 /** A block carries `count`/`for_each` → dynamic, single instance until state resolves it. */
 function blockHasMeta(block: unknown, key: string): boolean {
   return !!block && typeof block === "object" && key in (block as Record<string, unknown>);
@@ -93,7 +158,7 @@ function literalIdentity(block: unknown, type: string): string | undefined {
  * resolves to a known resource/module node — references to `var`/`local`/data
  * are dropped.
  */
-export function buildGraph(tree: Hcl2JsonTree): TfGraph {
+export function buildGraph(tree: Hcl2JsonTree, exprRefs: ExpressionRefs): TfGraph {
   const nodes: TfNode[] = [];
   const dataAddresses = new Set<string>();
 
@@ -109,7 +174,7 @@ export function buildGraph(tree: Hcl2JsonTree): TfGraph {
       const address = `${type}.${name}`;
       const block = Array.isArray(blocks) ? blocks[0] : blocks;
       const dynamic = blockHasMeta(block, "count") || blockHasMeta(block, "for_each");
-      const refs = refsInValue(block);
+      const refs = refsInBlock(block, exprRefs);
       const touchesData = refs.some((r) => dataAddresses.has(r.address));
       rawRefsByNode.set(address, refs);
       nodes.push({
@@ -129,7 +194,7 @@ export function buildGraph(tree: Hcl2JsonTree): TfGraph {
     const address = `module.${name}`;
     const block = Array.isArray(blocks) ? blocks[0] : blocks;
     const dynamic = blockHasMeta(block, "count") || blockHasMeta(block, "for_each");
-    const refs = refsInValue(block);
+    const refs = refsInBlock(block, exprRefs);
     const touchesData = refs.some((r) => dataAddresses.has(r.address));
     rawRefsByNode.set(address, refs);
     nodes.push({
@@ -145,14 +210,16 @@ export function buildGraph(tree: Hcl2JsonTree): TfGraph {
   const known = new Set(nodes.map((n) => n.address));
   const edges: TfEdge[] = [];
   for (const [from, refs] of rawRefsByNode) {
-    const byTarget = new Map<string, Set<string>>();
+    const byTarget = new Map<string, { attrs: Set<string>; via: Set<string> }>();
     for (const ref of refs) {
       if (ref.address === from || !known.has(ref.address)) continue;
-      if (!byTarget.has(ref.address)) byTarget.set(ref.address, new Set());
-      if (ref.attr) byTarget.get(ref.address)!.add(ref.attr);
+      if (!byTarget.has(ref.address)) byTarget.set(ref.address, { attrs: new Set(), via: new Set() });
+      const target = byTarget.get(ref.address)!;
+      if (ref.attr) target.attrs.add(ref.attr);
+      if (ref.via) target.via.add(ref.via);
     }
-    for (const [to, attrs] of byTarget) {
-      edges.push({ from, to, attrs: [...attrs].sort() });
+    for (const [to, { attrs, via }] of byTarget) {
+      edges.push({ from, to, attrs: [...attrs].sort(), via: [...via].sort() });
     }
   }
 

package/src/terraform/manifest.test.ts

@@ -0,0 +1,105 @@
+import { describe, test, expect } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import {
+  carveManifestPath,
+  listCarveManifests,
+  readCarveManifest,
+  resolveCarveManifest,
+  updateCarveManifest,
+  writeCarveManifest,
+  type CarveManifest,
+} from "./manifest";
+import type { CarveReport } from "./carve";
+
+function report(target: string): CarveReport {
+  return {
+    target,
+    carveSet: [{ address: target, type: target.split(".")[0] }],
+    peelability: 90,
+    inbound: [],
+    outbound: [],
+    reversible: true,
+    diagnostics: [],
+  };
+}
+
+function manifest(target: string): CarveManifest {
+  return { version: 1, target, from: "/estate", boundary: report(target) };
+}
+
+function withDir<T>(fn: (dir: string) => T): T {
+  const dir = mkdtempSync(join(tmpdir(), "chant-manifest-"));
+  try {
+    return fn(dir);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+describe("carve manifest", () => {
+  test("round-trips through the output dir, named by target slug", () => {
+    withDir((dir) => {
+      const path = writeCarveManifest(dir, manifest("aws_s3_bucket.assets"));
+      expect(path).toBe(join(dir, "aws_s3_bucket-assets.carve.json"));
+      expect(path).toBe(carveManifestPath(dir, "aws_s3_bucket.assets"));
+      const read = readCarveManifest(path)!;
+      expect(read.target).toBe("aws_s3_bucket.assets");
+      expect(read.boundary.peelability).toBe(90);
+    });
+  });
+
+  test("rejects missing, malformed, and wrong-version files", () => {
+    withDir((dir) => {
+      expect(readCarveManifest(join(dir, "nope.carve.json"))).toBeNull();
+      writeFileSync(join(dir, "bad.carve.json"), "not json");
+      expect(readCarveManifest(join(dir, "bad.carve.json"))).toBeNull();
+      writeFileSync(join(dir, "v9.carve.json"), JSON.stringify({ version: 9, target: "x" }));
+      expect(readCarveManifest(join(dir, "v9.carve.json"))).toBeNull();
+    });
+  });
+
+  test("resolve: no select + exactly one manifest composes; none or several is a clear error", () => {
+    withDir((dir) => {
+      expect(resolveCarveManifest(dir).error).toContain("--select");
+
+      writeCarveManifest(dir, manifest("aws_s3_bucket.assets"));
+      const one = resolveCarveManifest(dir);
+      expect(one.manifest!.target).toBe("aws_s3_bucket.assets");
+      expect(one.error).toBeUndefined();
+
+      writeCarveManifest(dir, manifest("aws_sqs_queue.jobs"));
+      const many = resolveCarveManifest(dir);
+      expect(many.error).toContain("aws_s3_bucket.assets");
+      expect(many.error).toContain("aws_sqs_queue.jobs");
+      expect(listCarveManifests(dir)).toHaveLength(2);
+
+      // An explicit select still resolves its own manifest among several.
+      const picked = resolveCarveManifest(dir, "aws_sqs_queue.jobs");
+      expect(picked.manifest!.target).toBe("aws_sqs_queue.jobs");
+    });
+  });
+
+  test("resolve with a select whose manifest is absent runs standalone (no error)", () => {
+    withDir((dir) => {
+      const res = resolveCarveManifest(dir, "aws_s3_bucket.assets");
+      expect(res.manifest).toBeUndefined();
+      expect(res.error).toBeUndefined();
+    });
+  });
+
+  test("update patches an existing manifest and no-ops on a missing one", () => {
+    withDir((dir) => {
+      expect(updateCarveManifest(dir, "aws_s3_bucket.assets", { bridge: { written: [], appliedInPlace: false, at: "t" } })).toBeUndefined();
+
+      writeCarveManifest(dir, manifest("aws_s3_bucket.assets"));
+      const path = updateCarveManifest(dir, "aws_s3_bucket.assets", {
+        apply: { marker: { stack: "assets", env: "prod" }, ownershipTags: { "chant:managed-by": "chant" }, at: "t" },
+      })!;
+      const read = readCarveManifest(path)!;
+      expect(read.apply!.marker).toEqual({ stack: "assets", env: "prod" });
+      expect(read.boundary.target).toBe("aws_s3_bucket.assets"); // untouched sections survive
+    });
+  });
+});