@intentius/chant 0.41.20 → 0.44.1

package/src/terraform/aws-resources.ts

@@ -120,7 +120,7 @@ export const AWS_CARVE_TYPES: AwsCarveType[] = [
     fields: { name: "AutoScalingGroupName", min_size: "MinSize", max_size: "MaxSize", desired_capacity: "DesiredCapacity", vpc_zone_identifier: "VPCZoneIdentifier", health_check_type: "HealthCheckType" } },
   { tfType: "aws_ecs_cluster", tier: 1, nativeType: "AWS::ECS::Cluster", ctor: "EcsCluster", identityAttr: "name",
     fields: { name: "ClusterName" }, tags: true },
-  { tfType: "aws_ecs_task_definition", tier: 3, nativeType: "AWS::ECS::TaskDefinition", ctor: "TaskDefinition",
+  { tfType: "aws_ecs_task_definition", tier: 3, nativeType: "AWS::ECS::TaskDefinition", ctor: "TaskDefinition", identityAttr: "family",
     fields: { family: "Family", cpu: "Cpu", memory: "Memory", network_mode: "NetworkMode", execution_role_arn: "ExecutionRoleArn", task_role_arn: "TaskRoleArn" }, tags: true },
   { tfType: "aws_ebs_volume", tier: 1, nativeType: "AWS::EC2::Volume", ctor: "EC2Volume",
     fields: { availability_zone: "AvailabilityZone", size: "Size", type: "VolumeType", encrypted: "Encrypted", iops: "Iops" }, tags: true },
@@ -140,13 +140,13 @@ export const AWS_CARVE_TYPES: AwsCarveType[] = [
     fields: { identifier: "DBInstanceIdentifier", engine: "Engine", engine_version: "EngineVersion", instance_class: "DBInstanceClass", allocated_storage: "AllocatedStorage", db_name: "DBName", multi_az: "MultiAZ", storage_encrypted: "StorageEncrypted" }, tags: true },
   { tfType: "aws_db_subnet_group", tier: 1, nativeType: "AWS::RDS::DBSubnetGroup", ctor: "RDSDBSubnetGroup", identityAttr: "name",
     fields: { name: "DBSubnetGroupName", description: "DBSubnetGroupDescription", subnet_ids: "SubnetIds" }, tags: true },
-  { tfType: "aws_elasticache_cluster", tier: 2, nativeType: "AWS::ElastiCache::CacheCluster", ctor: "CacheCluster",
-    fields: { engine: "Engine", node_type: "CacheNodeType", num_cache_nodes: "NumCacheNodes", engine_version: "EngineVersion" }, tags: true },
+  { tfType: "aws_elasticache_cluster", tier: 2, nativeType: "AWS::ElastiCache::CacheCluster", ctor: "CacheCluster", identityAttr: "cluster_id",
+    fields: { cluster_id: "ClusterName", engine: "Engine", node_type: "CacheNodeType", num_cache_nodes: "NumCacheNodes", engine_version: "EngineVersion" }, tags: true },
   { tfType: "aws_elasticache_replication_group", tier: 2, nativeType: "AWS::ElastiCache::ReplicationGroup", ctor: "ReplicationGroup", identityAttr: "replication_group_id",
     fields: { replication_group_id: "ReplicationGroupId", description: "ReplicationGroupDescription", node_type: "CacheNodeType", engine: "Engine" }, tags: true },
 
   // ── DNS, CDN & API ──
-  { tfType: "aws_route53_record", tier: 2, nativeType: "AWS::Route53::RecordSet", ctor: "RecordSet",
+  { tfType: "aws_route53_record", tier: 2, nativeType: "AWS::Route53::RecordSet", ctor: "RecordSet", identityAttr: "name",
     fields: { name: "Name", type: "Type", ttl: "TTL", zone_id: "HostedZoneId", records: "ResourceRecords" } },
   { tfType: "aws_api_gateway_rest_api", tier: 2, nativeType: "AWS::ApiGateway::RestApi", ctor: "RestApi", identityAttr: "name",
     fields: { name: "Name", description: "Description" }, tags: true },
@@ -168,6 +168,97 @@ export const AWS_CARVE_TYPES: AwsCarveType[] = [
     fields: { protocol: "Protocol", endpoint: "Endpoint", topic_arn: "TopicArn" } },
   { tfType: "aws_sfn_state_machine", tier: 3, nativeType: "AWS::StepFunctions::StateMachine", ctor: "StateMachine", identityAttr: "name",
     fields: { name: "StateMachineName", role_arn: "RoleArn", type: "StateMachineType" }, tags: true },
+  { tfType: "aws_sqs_queue_policy", tier: 2, nativeType: "AWS::SQS::QueuePolicy", ctor: "QueuePolicy",
+    fields: { policy: json("PolicyDocument"), queue_url: { prop: "Queues", transform: (v) => (v === undefined ? v : [v]) } } },
+  { tfType: "aws_sns_topic_policy", tier: 2, nativeType: "AWS::SNS::TopicPolicy", ctor: "TopicPolicy",
+    fields: { policy: json("PolicyDocument"), arn: { prop: "Topics", transform: (v) => (v === undefined ? v : [v]) } } },
+
+  // ── Streaming ──
+  { tfType: "aws_kinesis_stream", tier: 1, nativeType: "AWS::Kinesis::Stream", ctor: "KinesisStream", identityAttr: "name",
+    fields: { name: "Name", shard_count: "ShardCount", retention_period: "RetentionPeriodHours" }, tags: true },
+  { tfType: "aws_kinesis_firehose_delivery_stream", tier: 3, nativeType: "AWS::KinesisFirehose::DeliveryStream", ctor: "DeliveryStream", identityAttr: "name",
+    fields: { name: "DeliveryStreamName" }, tags: true },
+
+  // ── EKS ──
+  { tfType: "aws_eks_cluster", tier: 2, nativeType: "AWS::EKS::Cluster", ctor: "EKSCluster", identityAttr: "name",
+    fields: { name: "Name", role_arn: "RoleArn", version: "Version" }, tags: true },
+  { tfType: "aws_eks_node_group", tier: 2, nativeType: "AWS::EKS::Nodegroup", ctor: "Nodegroup", identityAttr: "node_group_name",
+    fields: { cluster_name: "ClusterName", node_group_name: "NodegroupName", node_role_arn: "NodeRole", subnet_ids: "Subnets",
+      instance_types: "InstanceTypes", ami_type: "AmiType", capacity_type: "CapacityType", disk_size: "DiskSize" } },
+
+  // ── Lambda periphery ──
+  { tfType: "aws_lambda_permission", tier: 1, nativeType: "AWS::Lambda::Permission", ctor: "Permission",
+    fields: { action: "Action", function_name: "FunctionName", principal: "Principal", source_arn: "SourceArn", source_account: "SourceAccount" } },
+  { tfType: "aws_lambda_event_source_mapping", tier: 2, nativeType: "AWS::Lambda::EventSourceMapping", ctor: "EventSourceMapping",
+    fields: { event_source_arn: "EventSourceArn", function_name: "FunctionName", batch_size: "BatchSize", enabled: "Enabled",
+      starting_position: "StartingPosition", maximum_batching_window_in_seconds: "MaximumBatchingWindowInSeconds" } },
+  { tfType: "aws_lambda_alias", tier: 1, nativeType: "AWS::Lambda::Alias", ctor: "LambdaAlias", identityAttr: "name",
+    fields: { name: "Name", function_name: "FunctionName", function_version: "FunctionVersion", description: "Description" } },
+  { tfType: "aws_lambda_layer_version", tier: 2, nativeType: "AWS::Lambda::LayerVersion", ctor: "LayerVersion", identityAttr: "layer_name",
+    fields: { layer_name: "LayerName", description: "Description", compatible_runtimes: "CompatibleRuntimes",
+      compatible_architectures: "CompatibleArchitectures", license_info: "LicenseInfo" } },
+
+  // ── Networking (endpoints, routes, peering, flow logs) ──
+  { tfType: "aws_vpc_endpoint", tier: 2, nativeType: "AWS::EC2::VPCEndpoint", ctor: "VPCEndpoint",
+    fields: { vpc_id: "VpcId", service_name: "ServiceName", vpc_endpoint_type: "VpcEndpointType", route_table_ids: "RouteTableIds",
+      subnet_ids: "SubnetIds", security_group_ids: "SecurityGroupIds", private_dns_enabled: "PrivateDnsEnabled", policy: json("PolicyDocument") }, tags: true },
+  { tfType: "aws_route_table_association", tier: 2, nativeType: "AWS::EC2::SubnetRouteTableAssociation", ctor: "SubnetRouteTableAssociation",
+    fields: { subnet_id: "SubnetId", route_table_id: "RouteTableId" } },
+  { tfType: "aws_route", tier: 2, nativeType: "AWS::EC2::Route", ctor: "EC2Route",
+    fields: { route_table_id: "RouteTableId", destination_cidr_block: "DestinationCidrBlock", destination_ipv6_cidr_block: "DestinationIpv6CidrBlock",
+      gateway_id: "GatewayId", nat_gateway_id: "NatGatewayId", transit_gateway_id: "TransitGatewayId",
+      vpc_peering_connection_id: "VpcPeeringConnectionId", network_interface_id: "NetworkInterfaceId" } },
+  { tfType: "aws_egress_only_internet_gateway", tier: 1, nativeType: "AWS::EC2::EgressOnlyInternetGateway", ctor: "EgressOnlyInternetGateway",
+    fields: { vpc_id: "VpcId" } },
+  { tfType: "aws_vpc_peering_connection", tier: 2, nativeType: "AWS::EC2::VPCPeeringConnection", ctor: "VPCPeeringConnection",
+    fields: { vpc_id: "VpcId", peer_vpc_id: "PeerVpcId", peer_owner_id: "PeerOwnerId", peer_region: "PeerRegion" }, tags: true },
+  { tfType: "aws_flow_log", tier: 2, nativeType: "AWS::EC2::FlowLog", ctor: "FlowLog",
+    fields: { traffic_type: "TrafficType", log_destination: "LogDestination", log_destination_type: "LogDestinationType",
+      iam_role_arn: "DeliverLogsPermissionArn", log_group_name: "LogGroupName", max_aggregation_interval: "MaxAggregationInterval" }, tags: true },
+  { tfType: "aws_key_pair", tier: 1, nativeType: "AWS::EC2::KeyPair", ctor: "KeyPair", identityAttr: "key_name",
+    fields: { key_name: "KeyName", public_key: "PublicKeyMaterial" }, tags: true },
+
+  // ── Audit & observability ──
+  { tfType: "aws_cloudtrail", tier: 2, nativeType: "AWS::CloudTrail::Trail", ctor: "Trail", identityAttr: "name",
+    fields: { name: "TrailName", s3_bucket_name: "S3BucketName", s3_key_prefix: "S3KeyPrefix",
+      include_global_service_events: "IncludeGlobalServiceEvents", is_multi_region_trail: "IsMultiRegionTrail",
+      enable_logging: "IsLogging", enable_log_file_validation: "EnableLogFileValidation", kms_key_id: "KMSKeyId",
+      sns_topic_name: "SnsTopicName", cloud_watch_logs_group_arn: "CloudWatchLogsLogGroupArn", cloud_watch_logs_role_arn: "CloudWatchLogsRoleArn" }, tags: true },
+  { tfType: "aws_cloudwatch_dashboard", tier: 1, nativeType: "AWS::CloudWatch::Dashboard", ctor: "CwDashboard", identityAttr: "dashboard_name",
+    fields: { dashboard_name: "DashboardName", dashboard_body: "DashboardBody" } },
+
+  // ── Databases & cache (groups, clusters) ──
+  { tfType: "aws_elasticache_subnet_group", tier: 1, nativeType: "AWS::ElastiCache::SubnetGroup", ctor: "EcSubnetGroup", identityAttr: "name",
+    fields: { name: "CacheSubnetGroupName", description: "Description", subnet_ids: "SubnetIds" }, tags: true },
+  { tfType: "aws_db_parameter_group", tier: 2, nativeType: "AWS::RDS::DBParameterGroup", ctor: "RDSDBParameterGroup", identityAttr: "name",
+    fields: { name: "DBParameterGroupName", family: "Family", description: "Description" }, tags: true },
+  { tfType: "aws_rds_cluster", tier: 2, nativeType: "AWS::RDS::DBCluster", ctor: "DbCluster", identityAttr: "cluster_identifier",
+    fields: { cluster_identifier: "DBClusterIdentifier", engine: "Engine", engine_version: "EngineVersion", database_name: "DatabaseName",
+      master_username: "MasterUsername", backup_retention_period: "BackupRetentionPeriod", preferred_backup_window: "PreferredBackupWindow",
+      storage_encrypted: "StorageEncrypted", kms_key_id: "KmsKeyId", port: "Port" }, tags: true },
+
+  // ── Load balancing & API stages ──
+  { tfType: "aws_lb_listener_rule", tier: 3, nativeType: "AWS::ElasticLoadBalancingV2::ListenerRule", ctor: "ListenerRule",
+    fields: { listener_arn: "ListenerArn", priority: "Priority" } },
+  { tfType: "aws_api_gateway_stage", tier: 2, nativeType: "AWS::ApiGateway::Stage", ctor: "ApigwStage", identityAttr: "stage_name",
+    fields: { rest_api_id: "RestApiId", stage_name: "StageName", deployment_id: "DeploymentId", description: "Description" }, tags: true },
+  { tfType: "aws_api_gateway_deployment", tier: 2, nativeType: "AWS::ApiGateway::Deployment", ctor: "ApigwDeployment",
+    fields: { rest_api_id: "RestApiId", description: "Description" } },
+  { tfType: "aws_apigatewayv2_stage", tier: 2, nativeType: "AWS::ApiGatewayV2::Stage", ctor: "Apigwv2Stage", identityAttr: "name",
+    fields: { api_id: "ApiId", name: "StageName", auto_deploy: "AutoDeploy", description: "Description" } },
+
+  // ── Identity & scaling ──
+  { tfType: "aws_cognito_user_pool", tier: 3, nativeType: "AWS::Cognito::UserPool", ctor: "UserPool", identityAttr: "name",
+    fields: { name: "UserPoolName", mfa_configuration: "MfaConfiguration", deletion_protection: "DeletionProtection" } },
+  { tfType: "aws_appautoscaling_target", tier: 2, nativeType: "AWS::ApplicationAutoScaling::ScalableTarget", ctor: "ScalableTarget",
+    fields: { max_capacity: "MaxCapacity", min_capacity: "MinCapacity", resource_id: "ResourceId",
+      scalable_dimension: "ScalableDimension", service_namespace: "ServiceNamespace", role_arn: "RoleARN" } },
+
+  // ── EFS periphery ──
+  { tfType: "aws_efs_mount_target", tier: 1, nativeType: "AWS::EFS::MountTarget", ctor: "EFSMountTarget",
+    fields: { file_system_id: "FileSystemId", subnet_id: "SubnetId", ip_address: "IpAddress", security_groups: "SecurityGroups" } },
+  { tfType: "aws_efs_access_point", tier: 2, nativeType: "AWS::EFS::AccessPoint", ctor: "EFSAccessPoint",
+    fields: { file_system_id: "FileSystemId" } },
 ];
 
 const BY_TYPE = new Map(AWS_CARVE_TYPES.map((t) => [t.tfType, t]));

package/src/terraform/bridge.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { buildGraph } from "./graph";
+import { buildFixtureGraph } from "./__fixtures__/build-graph";
 import { boundaryReport } from "./carve";
 import { generateBridge, type CarvedIdentity } from "./bridge";
 import type { Hcl2JsonTree } from "./types";
@@ -41,7 +41,7 @@ const identities = new Map<string, CarvedIdentity>([
 
 describe("generateBridge — inbound (data-source rewrite)", () => {
   test("adds a data source for the carved bucket", () => {
-    const report = boundaryReport(buildGraph(workedExample), "aws_s3_bucket.assets")!;
+    const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
     const plan = generateBridge(report, [{ path: "api.tf", content: API_TF }], identities);
 
     expect(plan.dataSources).toHaveLength(1);
@@ -52,7 +52,7 @@ describe("generateBridge — inbound (data-source rewrite)", () => {
   });
 
   test("rewrites survivor references to the data source", () => {
-    const report = boundaryReport(buildGraph(workedExample), "aws_s3_bucket.assets")!;
+    const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
     const plan = generateBridge(report, [{ path: "api.tf", content: API_TF }], identities);
 
     const rewrite = plan.rewrites.find((r) => r.path === "api.tf")!;
@@ -64,7 +64,7 @@ describe("generateBridge — inbound (data-source rewrite)", () => {
   });
 
   test("does not double-prefix an already-rewritten reference (idempotent)", () => {
-    const report = boundaryReport(buildGraph(workedExample), "aws_s3_bucket.assets")!;
+    const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
     const already = API_TF.replace(/aws_s3_bucket\.assets/g, "data.aws_s3_bucket.assets");
     const plan = generateBridge(report, [{ path: "api.tf", content: already }], identities);
     const rewrite = plan.rewrites.find((r) => r.path === "api.tf")!;
@@ -72,19 +72,39 @@ describe("generateBridge — inbound (data-source rewrite)", () => {
     expect(rewrite.rewritten).not.toContain("data.data.aws_s3_bucket");
   });
 
-  test("does not touch the carved resource's own declaration (quoted labels)", () => {
-    const report = boundaryReport(buildGraph(workedExample), "aws_s3_bucket.assets")!;
-    const decl = `resource "aws_s3_bucket" "assets" {\n  bucket = "myapp-assets-prod"\n}\n`;
+  test("excises the carved resource's own declaration (#998 — the data source replaces it)", () => {
+    const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
+    const decl = `resource "aws_s3_bucket" "assets" {\n  bucket = "myapp-assets-prod"\n}\n\nresource "aws_sns_topic" "alerts" {\n  name = "a"\n}\n`;
     const plan = generateBridge(report, [{ path: "bucket.tf", content: decl }], identities);
     const rewrite = plan.rewrites.find((r) => r.path === "bucket.tf")!;
-    // `resource "aws_s3_bucket" "assets"` uses quoted labels, not the dotted
-    // token, so it is left alone.
-    expect(rewrite.rewritten).toContain('resource "aws_s3_bucket" "assets"');
-    expect(rewrite.changed).toBe(false);
+    // After `terraform state rm`, a block left behind would re-create the
+    // resource on the next apply — so the bridge removes it.
+    expect(rewrite.changed).toBe(true);
+    expect(rewrite.excised).toEqual(["aws_s3_bucket.assets"]);
+    expect(rewrite.rewritten).not.toContain('resource "aws_s3_bucket" "assets"');
+    expect(rewrite.rewritten).toContain('resource "aws_sns_topic" "alerts"');
+    expect(plan.excised).toEqual(["aws_s3_bucket.assets"]);
+    expect(plan.runbook).toContain("removes the carved block(s): aws_s3_bucket.assets");
+  });
+
+  test("a folded sub-resource's block is excised along with its parent", () => {
+    const withVersioning: Hcl2JsonTree = {
+      resource: {
+        ...workedExample.resource,
+        aws_s3_bucket_versioning: {
+          assets: [{ bucket: "${aws_s3_bucket.assets.id}", versioning_configuration: { status: "Enabled" } }],
+        },
+      },
+    };
+    const report = boundaryReport(buildFixtureGraph(withVersioning), "aws_s3_bucket.assets")!;
+    const decl = `resource "aws_s3_bucket" "assets" {\n  bucket = "b"\n}\n\nresource "aws_s3_bucket_versioning" "assets" {\n  bucket = aws_s3_bucket.assets.id\n}\n`;
+    const plan = generateBridge(report, [{ path: "bucket.tf", content: decl }], identities);
+    expect(plan.excised).toEqual(["aws_s3_bucket.assets", "aws_s3_bucket_versioning.assets"]);
+    expect(plan.rewrites[0].rewritten.trim()).toBe("");
   });
 
   test("unknown identity emits a TODO data source instead of a wrong value", () => {
-    const report = boundaryReport(buildGraph(workedExample), "aws_s3_bucket.assets")!;
+    const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
     const plan = generateBridge(report, [{ path: "api.tf", content: API_TF }], new Map());
     expect(plan.dataSources[0].hcl).toContain("# TODO");
   });
@@ -98,17 +118,21 @@ describe("generateBridge — outbound (deferred inputs)", () => {
         aws_sqs_queue: { dlq: [{ name: "d", redrive: "${aws_sns_topic.alerts.arn}" }] },
       },
     };
-    const report = boundaryReport(buildGraph(tree), "aws_sqs_queue.dlq")!;
+    const report = boundaryReport(buildFixtureGraph(tree), "aws_sqs_queue.dlq")!;
     const plan = generateBridge(report, [], new Map());
     expect(plan.dataSources).toEqual([]); // no inbound → no survivor patch
     expect(plan.deferredInputs).toHaveLength(1);
     expect(plan.deferredInputs[0]).toMatchObject({ survivor: "aws_sns_topic.alerts", carved: "aws_sqs_queue.dlq" });
+    // The deferred input names the build param emit declares for it (#998).
+    expect(plan.deferredInputs[0].params).toEqual(["redrive"]);
+    expect(plan.deferredInputs[0].note).toContain("build param `redrive`");
+    expect(plan.deferredInputs[0].note).toContain("--param");
   });
 });
 
 describe("generateBridge — runbook", () => {
   test("is reversible and observe-first, with the state-rm and import steps", () => {
-    const report = boundaryReport(buildGraph(workedExample), "aws_s3_bucket.assets")!;
+    const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
     const plan = generateBridge(report, [{ path: "api.tf", content: API_TF }], identities);
     expect(plan.runbook).toContain("terraform state rm aws_s3_bucket.assets");
     expect(plan.runbook).toContain("does NOT destroy");

package/src/terraform/bridge.ts

@@ -19,7 +19,8 @@
  * is reversible via `terraform import`.
  */
 
-import type { CarveReport } from "./carve";
+import { deferredParamName, type CarveReport } from "./carve";
+import { exciseResourceBlocks, type ExciseTarget } from "./excise";
 
 export interface CarvedIdentity {
   /** The HCL identity attribute, e.g. `bucket` or `name`. */
@@ -41,12 +42,16 @@ export interface FileRewrite {
   original: string;
   rewritten: string;
   changed: boolean;
+  /** Carved addresses whose own `resource` block was removed from this file (#998). */
+  excised: string[];
 }
 
 export interface DeferredInput {
   survivor: string;
   carved: string;
   attrs: string[];
+  /** Build-parameter name(s) the input becomes in the emitted project (#998). */
+  params: string[];
   note: string;
 }
 
@@ -55,6 +60,8 @@ export interface BridgePlan {
   dataSources: DataSourceBlock[];
   rewrites: FileRewrite[];
   deferredInputs: DeferredInput[];
+  /** Every carved address whose own block the rewrites remove, across files. */
+  excised: string[];
   runbook: string;
 }
 
@@ -99,33 +106,56 @@ export function generateBridge(
     hcl: dataSourceHcl(type, name, identities.get(address) ?? {}),
   }));
 
-  // Rewrite every survivor reference to the carved resources into a data ref.
+  // Excise the carve set's own blocks (#998): after `terraform state rm`, a
+  // block left behind would re-create the resource on the next apply. Then
+  // rewrite every remaining survivor reference into a data ref.
+  const exciseTargets: ExciseTarget[] = report.carveSet
+    .filter((m) => !m.address.startsWith("module."))
+    .map((m) => {
+      const [type, ...rest] = m.address.split(".");
+      return { address: m.address, type, name: rest.join(".") };
+    });
   const rewrites: FileRewrite[] = files.map(({ path, content }) => {
-    let rewritten = content;
+    const excision = exciseResourceBlocks(content, exciseTargets);
+    let rewritten = excision.content;
     for (const address of carvedWithInbound.keys()) {
       rewritten = rewritten.replace(referenceRegex(address), `data.${address}`);
     }
-    return { path, original: content, rewritten, changed: rewritten !== content };
+    return { path, original: content, rewritten, changed: rewritten !== content, excised: excision.excised };
   });
+  const excised = rewrites.flatMap((r) => r.excised);
 
-  const deferredInputs: DeferredInput[] = report.outbound.map((e) => ({
-    survivor: e.survivor,
-    carved: e.carved,
-    attrs: e.attrs,
-    note: `${e.carved} reads ${e.survivor}.${e.attrs.join(", ")} — supply this as a deploy-time input to the carved component at apply.`,
-  }));
+  const deferredInputs: DeferredInput[] = report.outbound.map((e) => {
+    const params = (e.via ?? []).map(deferredParamName);
+    const wiring = params.length
+      ? `emit declares it as build param ${params.map((p) => `\`${p}\``).join(", ")} — override with --param at build`
+      : "supply this as a deploy-time input to the carved component at apply";
+    return {
+      survivor: e.survivor,
+      carved: e.carved,
+      attrs: e.attrs,
+      params,
+      note: `${e.carved} reads ${e.survivor}.${e.attrs.join(", ")} — ${wiring}.`,
+    };
+  });
 
   return {
     target: report.target,
     dataSources,
     rewrites,
     deferredInputs,
-    runbook: buildRunbook(report, dataSources, deferredInputs),
+    excised,
+    runbook: buildRunbook(report, dataSources, deferredInputs, excised),
   };
 }
 
 /** The reversible, observe-first handoff runbook (#197). */
-function buildRunbook(report: CarveReport, dataSources: DataSourceBlock[], deferred: DeferredInput[]): string {
+function buildRunbook(
+  report: CarveReport,
+  dataSources: DataSourceBlock[],
+  deferred: DeferredInput[],
+  excised: string[],
+): string {
   const carvedAddrs = report.carveSet.map((m) => m.address);
   const L: string[] = [];
   L.push(`# Carve-out: ${report.target} → chant   [observe-first, reversible]`);
@@ -140,10 +170,14 @@ function buildRunbook(report: CarveReport, dataSources: DataSourceBlock[], defer
   L.push("");
   L.push("## 3. Confirm no destroy, then patch the survivors");
   L.push("    terraform plan   # expect 0 to destroy; refs to the carved resource now error");
+  if (excised.length) {
+    L.push(`    # the generated bridge patch removes the carved block(s): ${excised.join(", ")}`);
+    L.push("    #   (without this, the next apply would re-create what state rm released)");
+  }
   if (dataSources.length) {
-    L.push("    # apply the generated bridge patch — it adds these data sources and rewires references:");
+    L.push("    # it also adds these data sources and rewires references:");
     for (const ds of dataSources) L.push(`    #   data.${ds.type}.${ds.name}  (for ${ds.address})`);
-  } else {
+  } else if (!excised.length) {
     L.push("    # no inbound edges — no survivor patch needed.");
   }
   L.push("    terraform plan   # expect: in-place updates to the survivors only");

package/src/terraform/carve.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { buildGraph } from "./graph";
+import { buildFixtureGraph } from "./__fixtures__/build-graph";
 import { resolveCarveSet, boundaryReport } from "./carve";
 import type { Hcl2JsonTree } from "./types";
 
@@ -27,7 +27,7 @@ const workedExample: Hcl2JsonTree = {
 
 describe("resolveCarveSet", () => {
   test("selected node plus its folded sub-resources", () => {
-    const set = resolveCarveSet(buildGraph(workedExample), "aws_s3_bucket.assets");
+    const set = resolveCarveSet(buildFixtureGraph(workedExample), "aws_s3_bucket.assets");
     expect(set.map((m) => m.address).sort()).toEqual([
       "aws_s3_bucket.assets",
       "aws_s3_bucket_versioning.assets",
@@ -37,13 +37,13 @@ describe("resolveCarveSet", () => {
   });
 
   test("empty for an unknown address", () => {
-    expect(resolveCarveSet(buildGraph(workedExample), "aws_s3_bucket.nope")).toEqual([]);
+    expect(resolveCarveSet(buildFixtureGraph(workedExample), "aws_s3_bucket.nope")).toEqual([]);
   });
 });
 
 describe("boundaryReport", () => {
   test("classifies the Lambda inbound edge; folds the versioning internal edge away", () => {
-    const report = boundaryReport(buildGraph(workedExample), "aws_s3_bucket.assets")!;
+    const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
     expect(report.target).toBe("aws_s3_bucket.assets");
     expect(report.peelability).toBe(88);
     expect(report.reversible).toBe(true);
@@ -56,6 +56,7 @@ describe("boundaryReport", () => {
         survivor: "aws_lambda_function.api",
         carved: "aws_s3_bucket.assets",
         attrs: ["arn", "bucket"],
+        via: ["environment"],
         bridge: "tf-data-source",
         required: "immediately",
       },
@@ -71,7 +72,7 @@ describe("boundaryReport", () => {
       },
     };
     // Carve the queue: it depends on the topic (a survivor) → outbound/deferred.
-    const report = boundaryReport(buildGraph(tree), "aws_sqs_queue.dlq")!;
+    const report = boundaryReport(buildFixtureGraph(tree), "aws_sqs_queue.dlq")!;
     expect(report.inbound).toEqual([]);
     expect(report.outbound).toEqual([
       {
@@ -79,6 +80,7 @@ describe("boundaryReport", () => {
         survivor: "aws_sns_topic.alerts",
         carved: "aws_sqs_queue.dlq",
         attrs: ["arn"],
+        via: ["redrive"],
         bridge: "deferred-input",
         required: "at-apply",
       },
@@ -87,11 +89,11 @@ describe("boundaryReport", () => {
 
   test("unsupported type is flagged in diagnostics", () => {
     const tree: Hcl2JsonTree = { resource: { random_pet: { n: [{ length: 2 }] } } };
-    const report = boundaryReport(buildGraph(tree), "random_pet.n")!;
+    const report = boundaryReport(buildFixtureGraph(tree), "random_pet.n")!;
     expect(report.diagnostics.join(" ")).toMatch(/no known native mapping/i);
   });
 
   test("null for an unknown target", () => {
-    expect(boundaryReport(buildGraph(workedExample), "aws_s3_bucket.nope")).toBeNull();
+    expect(boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.nope")).toBeNull();
   });
 });

package/src/terraform/excise.test.ts

@@ -0,0 +1,92 @@
+import { describe, test, expect } from "vitest";
+import { exciseResourceBlocks, type ExciseTarget } from "./excise";
+
+const bucket: ExciseTarget = { address: "aws_s3_bucket.assets", type: "aws_s3_bucket", name: "assets" };
+const versioning: ExciseTarget = {
+  address: "aws_s3_bucket_versioning.assets",
+  type: "aws_s3_bucket_versioning",
+  name: "assets",
+};
+
+describe("exciseResourceBlocks", () => {
+  test("removes the target block, leaves the rest byte-for-byte", () => {
+    const tf = `# the bucket
+resource "aws_s3_bucket" "assets" {
+  bucket = "myapp-assets-prod"
+  tags   = { Team = "web" }
+}
+
+resource "aws_lambda_function" "api" {
+  function_name = "myapp-api"
+}
+`;
+    const r = exciseResourceBlocks(tf, [bucket]);
+    expect(r.excised).toEqual(["aws_s3_bucket.assets"]);
+    expect(r.content).toBe(`# the bucket
+resource "aws_lambda_function" "api" {
+  function_name = "myapp-api"
+}
+`);
+  });
+
+  test("removes several targets (a folded sub-resource travels with its parent)", () => {
+    const tf = `resource "aws_s3_bucket" "assets" {
+  bucket = "b"
+}
+
+resource "aws_s3_bucket_versioning" "assets" {
+  bucket = aws_s3_bucket.assets.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_sns_topic" "alerts" {
+  name = "a"
+}
+`;
+    const r = exciseResourceBlocks(tf, [bucket, versioning]);
+    expect(r.excised).toEqual(["aws_s3_bucket.assets", "aws_s3_bucket_versioning.assets"]);
+    expect(r.content).toBe(`resource "aws_sns_topic" "alerts" {\n  name = "a"\n}\n`);
+  });
+
+  test("a same-name block of a different type stays", () => {
+    const tf = `resource "aws_s3_bucket" "assets" { bucket = "b" }
+resource "aws_s3_bucket_versioning" "assets" { bucket = "b" }
+`;
+    const r = exciseResourceBlocks(tf, [bucket]);
+    expect(r.excised).toEqual(["aws_s3_bucket.assets"]);
+    expect(r.content).toContain('resource "aws_s3_bucket_versioning" "assets"');
+  });
+
+  test("braces inside strings, interpolations, comments, and heredocs do not fool the scanner", () => {
+    const tf = `resource "aws_s3_bucket" "assets" {
+  bucket = "b"
+  # a } in a comment
+  policy = jsonencode({ Statement = [{ Effect = "Allow" }] })
+  note   = "literal } and \${var.m["k}"]} too"
+  user_data = <<EOF
+    if true; then echo "}"; fi
+EOF
+}
+resource "aws_sns_topic" "alerts" { name = "a" }
+`;
+    const r = exciseResourceBlocks(tf, [bucket]);
+    expect(r.excised).toEqual(["aws_s3_bucket.assets"]);
+    expect(r.content).toBe(`resource "aws_sns_topic" "alerts" { name = "a" }\n`);
+  });
+
+  test("no target present → the file comes back unchanged", () => {
+    const tf = `resource "aws_sns_topic" "alerts" { name = "a" }\n`;
+    const r = exciseResourceBlocks(tf, [bucket]);
+    expect(r.excised).toEqual([]);
+    expect(r.content).toBe(tf);
+  });
+
+  test("an unbalanced block is left alone rather than corrupted", () => {
+    const tf = `resource "aws_s3_bucket" "assets" {\n  bucket = "b"\n`;
+    const r = exciseResourceBlocks(tf, [bucket]);
+    expect(r.excised).toEqual([]);
+    expect(r.content).toBe(tf);
+  });
+});