@intentius/chant 0.44.5 → 0.44.7

package/src/cli/commands/carve-emit.ts

@@ -17,9 +17,15 @@ import { basename, join, resolve } from "path";
 import { parseTerraformDir, Hcl2JsonNotInstalled } from "../../terraform/parse";
 import { boundaryReport, deferredParamName, type CarveReport } from "../../terraform/carve";
 import { resolveTier } from "../../terraform/tier-map";
-import { readStateResource } from "../../terraform/state";
+import { readStateResource, type StateResource } from "../../terraform/state";
 import { writeCarveManifest, type CarveManifest } from "../../terraform/manifest";
-import { adoptFromState, canAdoptFromState, supportedStateAdoptionTypes, type DeferredParam } from "../../terraform/adopt-state";
+import {
+  adoptFromState,
+  canAdoptFromState,
+  supportedStateAdoptionTypes,
+  type DeferredParam,
+  type FoldedContribution,
+} from "../../terraform/adopt-state";
 import { getChantVersion } from "./init";
 import type { LexiconPlugin, ResourceSelector } from "../../lexicon";
 import type { ImportResult, LiveImportOptions } from "./import";
@@ -67,6 +73,8 @@ export interface CarveEmitResult {
   scaffolded?: string[];
   /** Deferred outbound inputs declared as build parameters in the emitted project (#998). */
   params?: DeferredParam[];
+  /** Folded sub-resources and the props each joined into the emitted parent (#1637). */
+  folded?: FoldedContribution[];
   /** The persisted carve state manifest bridge/apply compose with. */
   manifestPath?: string;
 }
@@ -125,7 +133,13 @@ export async function carveEmit(opts: CarveEmitOptions, deps: CarveEmitDeps): Pr
     // value the carved block read enters the emitted project as a declared
     // param, defaulted to the value the state resolved.
     const params = deferredParams(report, stateResource.attributes);
-    const adopted = adoptFromState(stateResource, params);
+    // The carve set's folded sub-resources come out of the same state file:
+    // their mappable attributes belong in the parent's emitted props (#1637).
+    const folded = report.carveSet
+      .filter((m) => m.foldedInto)
+      .map((m) => readStateResource(opts.statePath!, m.address))
+      .filter((r): r is StateResource => r !== null);
+    const adopted = adoptFromState(stateResource, params, folded);
     if (!adopted) return { ok: false, error: `Could not adopt ${opts.select} from state.` };
 
     // The output dir is a buildable chant project: source in src/, plus the
@@ -139,7 +153,16 @@ export async function carveEmit(opts: CarveEmitOptions, deps: CarveEmitDeps): Pr
     const scaffolded = scaffoldProject(outDir, lexicon, params);
 
     const manifestPath = persistManifest(outDir, opts, report, tfType, "tfstate", [outPath], params);
-    return { ok: true, report, source: "tfstate", emittedFiles: [outPath], scaffolded, manifestPath, params };
+    return {
+      ok: true,
+      report,
+      source: "tfstate",
+      emittedFiles: [outPath],
+      scaffolded,
+      manifestPath,
+      params,
+      folded: adopted.folded,
+    };
   }
 
   // ── Adoption path 2: live import (cloud→code) ──
@@ -335,7 +358,16 @@ export function formatCarveEmit(result: CarveEmitResult): string {
     lines.push(`  State manifest: ${result.manifestPath} — carve bridge/apply pick the target up from here.`);
   }
   if (r.carveSet.length > 1) {
-    const folded = r.carveSet.filter((m) => m.foldedInto).map((m) => m.address);
+    // Say what each fold actually contributed — announcing the fold without the
+    // properties was the bug behind #1637.
+    const contributed = new Map((result.folded ?? []).map((f) => [f.address, f.props]));
+    const folded = r.carveSet
+      .filter((m) => m.foldedInto)
+      .map((m) => {
+        const props = contributed.get(m.address);
+        if (props === undefined) return m.address;
+        return props.length ? `${m.address} (${props.join(", ")})` : `${m.address} (nothing mappable)`;
+      });
     lines.push(`  Folded in: ${folded.join(", ")}`);
   }
   lines.push("");

package/src/cli/commands/carve.test.ts

@@ -2,7 +2,7 @@ import { describe, test, expect } from "vitest";
 import { mkdtempSync, writeFileSync, rmSync, readFileSync } from "fs";
 import { tmpdir } from "os";
 import { join } from "path";
-import { carveAdvise, carveJson, formatCarveReport } from "./carve";
+import { carveAdvise, carveJson, formatCarveReport, CARVE_REPORT_VERSION } from "./carve";
 import { loadHcl2json } from "../../terraform/parse";
 
 let parserAvailable = false;
@@ -78,12 +78,65 @@ describe("carveAdvise", () => {
 
       // report file is valid JSON with the advisory banner + band counts
       const payload = JSON.parse(readFileSync(reportFile, "utf-8"));
+      expect(payload.version).toBe(CARVE_REPORT_VERSION);
       expect(payload.advisory).toContain("read-only");
       expect(payload.bands["clean leaf"]).toBeGreaterThanOrEqual(1);
       expect(payload.count).toBe(r.results!.length);
+
+      // The written report carries the edge lists, not just the counts (#1636).
+      const written = payload.resources.find((x: { address: string }) => x.address === "aws_s3_bucket.assets");
+      expect(written.boundary.inbound).toEqual([
+        {
+          direction: "inbound",
+          survivor: "aws_lambda_function.api",
+          carved: "aws_s3_bucket.assets",
+          attrs: ["bucket"],
+          via: ["environment"],
+          bridge: "tf-data-source",
+          required: "immediately",
+        },
+      ]);
+      expect(written.boundary.outbound).toEqual([]);
     });
   });
 
+  test("an output block in its own file counts against the score it reads (#1638)", async () => {
+    if (!parserAvailable) return;
+    const dir = mkdtempSync(join(tmpdir(), "chant-carve-outputs-"));
+    try {
+      writeFileSync(join(dir, "main.tf"), ESTATE);
+      // Outputs almost always live in their own file — the merge across files
+      // has to carry them, or the graph never sees the estate's outputs.tf.
+      writeFileSync(
+        join(dir, "outputs.tf"),
+        `output "assets_bucket" {\n  value = aws_s3_bucket.assets.bucket\n}\n`,
+      );
+      const r = await carveAdvise({ from: dir });
+      expect(r.ok).toBe(true);
+
+      // Outputs are not carve candidates.
+      expect((r.results ?? []).map((x) => x.address)).not.toContain("output.assets_bucket");
+
+      const bucket = r.results!.find((x) => x.address === "aws_s3_bucket.assets")!;
+      expect(bucket.breakdown).toMatchObject({ inbound: 1, outputs: 1 });
+      expect(bucket.score).toBe(84); // 88 with the Lambda alone, minus 4 for the output
+      expect(formatCarveReport(r)).toContain("1 output block(s) reading it (one-line rewrite each)");
+
+      const written = carveJson(r).resources.find((x) => x.address === "aws_s3_bucket.assets")!;
+      expect(written.boundary!.inbound).toContainEqual({
+        direction: "inbound",
+        survivor: "output.assets_bucket",
+        carved: "aws_s3_bucket.assets",
+        attrs: ["bucket"],
+        via: ["value"],
+        bridge: "tf-output-rewrite",
+        required: "immediately",
+      });
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   test("formatCarveReport groups by band and never suggests a mutation", async () => {
     if (!parserAvailable) return;
     await withEstate(async (dir) => {
@@ -96,9 +149,35 @@ describe("carveAdvise", () => {
     });
   });
 
-  test("carveJson carries the read-only advisory banner", () => {
-    const payload = carveJson({ ok: true, from: "x", results: [] }) as { advisory: string; count: number };
+  test("carveJson carries the read-only advisory banner and the schema version", () => {
+    const payload = carveJson({ ok: true, from: "x", results: [] });
     expect(payload.advisory).toContain("read-only");
     expect(payload.count).toBe(0);
+    expect(payload.version).toBe(1);
+  });
+
+  test("carveJson omits boundary entirely with no graph — 'none' and 'not reported' differ", () => {
+    const payload = carveJson({
+      ok: true,
+      from: "x",
+      results: [
+        {
+          address: "aws_vpc.main",
+          kind: "resource",
+          score: 100,
+          band: "clean leaf",
+          breakdown: {
+            inbound: 0,
+            outbound: 0,
+            outputs: 0,
+            tier: 1,
+            hasDynamic: false,
+            instances: 1,
+            penalties: { inbound: 0, outbound: 0, outputs: 0, tier: 0, dynamic: 0, instances: 0 },
+          },
+        },
+      ],
+    });
+    expect(payload.resources[0]).not.toHaveProperty("boundary");
   });
 });

package/src/cli/commands/carve.ts

@@ -10,6 +10,8 @@
 import { existsSync, statSync, writeFileSync } from "fs";
 import { parseTerraformDir, Hcl2JsonNotInstalled } from "../../terraform/parse";
 import { scoreEstate, type Peelability, type PeelabilityBand } from "../../terraform/score";
+import { boundaryReport, type BoundaryEdge } from "../../terraform/carve";
+import type { TfGraph } from "../../terraform/types";
 
 export interface CarveAdviseOptions {
   /** Terraform estate directory (from `--from`). */
@@ -25,6 +27,12 @@ export interface CarveAdviseResult {
   error?: string;
   from?: string;
   results?: Peelability[];
+  /**
+   * The parsed dependency graph the scores came from. Kept so the JSON report
+   * can carry the boundary edge lists (#1636) rather than only their counts.
+   * Not part of the JSON payload — `carveJson` derives from it.
+   */
+  graph?: TfGraph;
 }
 
 const BAND_ORDER: PeelabilityBand[] = ["clean leaf", "carvable w/ edits", "leave in Terraform"];
@@ -40,36 +48,102 @@ export async function carveAdvise(opts: CarveAdviseOptions): Promise<CarveAdvise
     return { ok: false, error: `State file not found: ${opts.statePath}` };
   }
 
+  let graph: TfGraph;
   let results: Peelability[];
   try {
-    results = scoreEstate(await parseTerraformDir(opts.from, { statePath: opts.statePath }));
+    graph = await parseTerraformDir(opts.from, { statePath: opts.statePath });
+    results = scoreEstate(graph);
   } catch (err) {
     if (err instanceof Hcl2JsonNotInstalled) return { ok: false, error: err.message };
     return { ok: false, error: `Failed to parse Terraform in ${opts.from}: ${err instanceof Error ? err.message : String(err)}` };
   }
 
+  const result: CarveAdviseResult = { ok: true, from: opts.from, results, graph };
   if (opts.reportFile) {
-    writeFileSync(opts.reportFile, JSON.stringify(carveJson({ ok: true, from: opts.from, results }), null, 2));
+    writeFileSync(opts.reportFile, JSON.stringify(carveJson(result), null, 2));
   }
 
-  return { ok: true, from: opts.from, results };
+  return result;
 }
 
-/** The `--json` / `--report` payload. */
-export function carveJson(result: CarveAdviseResult): unknown {
+/**
+ * The schema version of the `--json` / `--report` payload (#1636).
+ *
+ * The report is a cross-tool contract — behold renders it as a graph — so it
+ * says which shape it is. The promise attached to this number:
+ *
+ *  - **Additive within a version.** New top-level fields, new per-resource
+ *    fields, new kinds of entry in an existing list, and new values in an
+ *    open-ended enum (a `bridge` kind, say) may appear in any release. A
+ *    reader must ignore keys and values it does not know.
+ *  - **A removal, a rename, or a changed meaning bumps it.** So does narrowing
+ *    a field's type (an optional becoming required is additive; the reverse is
+ *    not).
+ *  - A reader that does not know the version it is handed should refuse the
+ *    report rather than half-read it.
+ */
+export const CARVE_REPORT_VERSION = 1;
+
+/** One ranked resource in the JSON report: its score, plus the boundary its carve would cut. */
+export interface CarveJsonResource extends Peelability {
+  /**
+   * Every dependency edge carving this resource would cut (#1636), in chant's
+   * own `BoundaryEdge` shape — the same classification the emit/bridge path
+   * runs on. `inbound` edges need a Terraform `data`-source patch the moment
+   * the carve lands; `outbound` edges become deploy-time inputs, deferred
+   * until apply.
+   *
+   * The lists are the *carve set's* boundary, so a folded sub-resource never
+   * appears as an endpoint: it carves with its parent, and the parent's edges
+   * stand in for it. Edges internal to the carve set are not boundary work and
+   * are not listed.
+   *
+   * An inbound edge's survivor can be an `output.<name>` pseudo-address
+   * (#1638), carrying `bridge: "tf-output-rewrite"` and `via: ["value"]`. It
+   * is counted in `breakdown.outputs`, not `breakdown.inbound`.
+   *
+   * Present (possibly with two empty lists) whenever the graph was available;
+   * absent means this chant did not compute it — "none" and "not reported" are
+   * different claims. `breakdown.inbound`/`outbound` keep the counts.
+   */
+  boundary?: { inbound: BoundaryEdge[]; outbound: BoundaryEdge[] };
+}
+
+/** The `chant carve advise --json` / `--report` payload. Versioned; see {@link CARVE_REPORT_VERSION}. */
+export interface CarveJsonReport {
+  version: number;
+  from?: string;
+  advisory: string;
+  count: number;
+  /** Band name -> how many resources landed in it. */
+  bands: Record<string, number>;
+  resources: CarveJsonResource[];
+}
+
+/** Build the `--json` / `--report` payload. */
+export function carveJson(result: CarveAdviseResult): CarveJsonReport {
   const results = result.results ?? [];
   const counts = Object.fromEntries(
     BAND_ORDER.map((b) => [b, results.filter((r) => r.band === b).length]),
   );
   return {
+    version: CARVE_REPORT_VERSION,
     from: result.from,
     advisory: "read-only — emits nothing, patches nothing, touches no live resource",
     count: results.length,
     bands: counts,
-    resources: results,
+    resources: results.map((r) => withBoundary(r, result.graph)),
   };
 }
 
+/** A scored resource plus its carve boundary, when the graph is at hand (#1636). */
+function withBoundary(r: Peelability, graph?: TfGraph): CarveJsonResource {
+  if (!graph) return r;
+  const report = boundaryReport(graph, r.address);
+  if (!report) return r;
+  return { ...r, boundary: { inbound: report.inbound, outbound: report.outbound } };
+}
+
 /** Human-readable banded, ranked summary. */
 export function formatCarveReport(result: CarveAdviseResult): string {
   const results = result.results ?? [];
@@ -115,6 +189,7 @@ function reasons(r: Peelability): string {
   if (b.tier === null) return "no known native mapping (unsupported provider/type)";
   const parts: string[] = [];
   if (b.inbound) parts.push(`${b.inbound} inbound (data-source patch each)`);
+  if (b.outputs) parts.push(`${b.outputs} output block(s) reading it (one-line rewrite each)`);
   if (b.outbound) parts.push(`${b.outbound} outbound (deferred input each)`);
   if (b.tier > 1) parts.push(`tier ${b.tier} map`);
   if (b.hasDynamic) parts.push("count/for_each/data present");

package/src/terraform/__fixtures__/advise.test.ts

@@ -1,6 +1,12 @@
 import { describe, test, expect } from "vitest";
 import { join } from "path";
-import { carveAdvise, formatCarveReport } from "../../cli/commands/carve";
+import {
+  carveAdvise,
+  carveJson,
+  formatCarveReport,
+  CARVE_REPORT_VERSION,
+  type CarveJsonResource,
+} from "../../cli/commands/carve";
 import { loadHcl2json } from "../parse";
 
 /**
@@ -49,3 +55,110 @@ describe("carve advise against the sample estate", () => {
     expect(text).not.toMatch(/state rm|apply|destroy/i);
   });
 });
+
+/**
+ * The JSON payload as a cross-tool contract (#1636): a schema version, and the
+ * boundary edge LISTS beside the counts. behold's carve lens renders these —
+ * the counts alone can't be paired back into edges (this estate has 4 inbound
+ * and 4 outbound, which admits several matchings), so the lists are the thing
+ * that makes a predicted diff drawable.
+ */
+describe("carve advise --json against the sample estate", () => {
+  test("is a versioned report whose resources carry their boundary edges", async () => {
+    if (!parserAvailable) return;
+    const report = carveJson(await carveAdvise({ from: ESTATE }));
+
+    expect(report.version).toBe(CARVE_REPORT_VERSION);
+    expect(report.count).toBe(8);
+    expect(report.resources).toHaveLength(8);
+
+    const byAddr = Object.fromEntries(report.resources.map((x) => [x.address, x]));
+
+    // The VPC's three subnets: each one a data-source patch to surviving TF.
+    expect(byAddr["aws_vpc.main"].boundary!.inbound).toEqual([
+      { direction: "inbound", survivor: "aws_subnet.a", carved: "aws_vpc.main", attrs: ["id"], via: ["vpc_id"], bridge: "tf-data-source", required: "immediately" },
+      { direction: "inbound", survivor: "aws_subnet.b", carved: "aws_vpc.main", attrs: ["id"], via: ["vpc_id"], bridge: "tf-data-source", required: "immediately" },
+      { direction: "inbound", survivor: "aws_subnet.c", carved: "aws_vpc.main", attrs: ["id"], via: ["vpc_id"], bridge: "tf-data-source", required: "immediately" },
+    ]);
+    expect(byAddr["aws_vpc.main"].boundary!.outbound).toEqual([]);
+
+    // The same cut, seen from the other end: the subnet's carve defers a value.
+    expect(byAddr["aws_subnet.a"].boundary!.outbound).toEqual([
+      { direction: "outbound", survivor: "aws_vpc.main", carved: "aws_subnet.a", attrs: ["id"], via: ["vpc_id"], bridge: "deferred-input", required: "at-apply" },
+    ]);
+
+    // A clean leaf nothing touches reports two empty lists, not a missing key:
+    // "none" is a claim the advisor is willing to make.
+    expect(byAddr["aws_cloudwatch_log_group.api"].boundary).toEqual({ inbound: [], outbound: [] });
+
+    // The Lambda reads two of the bucket's attributes — one edge, both attrs.
+    expect(byAddr["aws_lambda_function.api"].boundary!.outbound).toEqual([
+      { direction: "outbound", survivor: "aws_s3_bucket.assets", carved: "aws_lambda_function.api", attrs: ["arn", "bucket"], via: ["environment"], bridge: "deferred-input", required: "at-apply" },
+    ]);
+  });
+
+  test("every edge endpoint is a real Terraform address in the estate", async () => {
+    if (!parserAvailable) return;
+    const report = carveJson(await carveAdvise({ from: ESTATE }));
+    const ranked = new Set(report.resources.map((r) => r.address));
+
+    for (const edge of allEdges(report.resources)) {
+      // The carved side is always ranked — it is the resource reporting it.
+      expect(ranked.has(edge.carved)).toBe(true);
+      // The survivor side is a real address too. Every survivor in this estate
+      // is itself carvable, so it is ranked; in general a survivor may be an
+      // unranked address (a folded sub-resource's parent is never one, but an
+      // unsupported type is), which is why this checks the estate's own set.
+      expect(ranked.has(edge.survivor)).toBe(true);
+      expect(edge.survivor).not.toBe(edge.carved);
+    }
+  });
+
+  test("a folded sub-resource is never an edge endpoint — it carves with its parent", async () => {
+    if (!parserAvailable) return;
+    const report = carveJson(await carveAdvise({ from: ESTATE }));
+    const endpoints = allEdges(report.resources).flatMap((e) => [e.survivor, e.carved]);
+
+    // `aws_s3_bucket_versioning.assets` references its bucket, but that edge is
+    // internal to the bucket's carve set: not boundary work, and not an endpoint.
+    expect(endpoints).not.toContain("aws_s3_bucket_versioning.assets");
+    expect(report.resources.map((r) => r.address)).not.toContain("aws_s3_bucket_versioning.assets");
+  });
+
+  test("the counts and the edge lists tell the same story", async () => {
+    if (!parserAvailable) return;
+    const report = carveJson(await carveAdvise({ from: ESTATE }));
+
+    // `breakdown.inbound`/`outbound`/`outputs` are what the score was computed
+    // from and stay for backward compatibility. They must agree with the lists,
+    // or the arithmetic a reader prints beside the drawn edges is a lie. The
+    // inbound list holds both resource and output survivors (#1638), so it is
+    // the two counts together.
+    for (const r of report.resources) {
+      expect([r.address, r.boundary!.inbound.length]).toEqual([r.address, r.breakdown.inbound + r.breakdown.outputs]);
+      expect([r.address, r.boundary!.outbound.length]).toEqual([r.address, r.breakdown.outbound]);
+    }
+
+    const inbound = report.resources.reduce((s, r) => s + r.breakdown.inbound, 0);
+    const outbound = report.resources.reduce((s, r) => s + r.breakdown.outbound, 0);
+    expect([inbound, outbound]).toEqual([4, 4]);
+
+    // Each cut is reported from both ends — inbound from the depended-on side,
+    // outbound from the depending side — so the two totals are the same set of
+    // edges seen twice. Keyed in dependency direction, that is 4 distinct cuts.
+    const cuts = new Set(
+      allEdges(report.resources).map((e) =>
+        e.direction === "inbound" ? `${e.survivor} -> ${e.carved}` : `${e.carved} -> ${e.survivor}`,
+      ),
+    );
+    expect([...cuts].sort()).toEqual([
+      "aws_lambda_function.api -> aws_s3_bucket.assets",
+      "aws_subnet.a -> aws_vpc.main",
+      "aws_subnet.b -> aws_vpc.main",
+      "aws_subnet.c -> aws_vpc.main",
+    ]);
+  });
+});
+
+const allEdges = (resources: CarveJsonResource[]) =>
+  resources.flatMap((r) => [...(r.boundary?.inbound ?? []), ...(r.boundary?.outbound ?? [])]);

package/src/terraform/adopt-state.test.ts

@@ -78,6 +78,70 @@ describe("adoptFromState", () => {
     expect(out.content).toContain('FunctionName: "myapp-api"');
   });
 
+  test("folded sub-resources join the parent's emitted properties (#1637)", () => {
+    const bucket: StateResource = {
+      type: "aws_s3_bucket",
+      name: "assets",
+      attributes: {
+        id: "myapp-assets-prod",
+        bucket: "myapp-assets-prod",
+        versioning: [{ enabled: true, mfa_delete: false }],
+        server_side_encryption_configuration: [
+          { rule: [{ apply_server_side_encryption_by_default: [{ sse_algorithm: "AES256" }], bucket_key_enabled: false }] },
+        ],
+      },
+    };
+    const out = adoptFromState(bucket, [], [
+      {
+        type: "aws_s3_bucket_versioning",
+        name: "assets",
+        attributes: { bucket: "myapp-assets-prod", versioning_configuration: [{ status: "Enabled" }], mfa: null },
+      },
+      {
+        type: "aws_s3_bucket_public_access_block",
+        name: "assets",
+        attributes: {
+          bucket: "myapp-assets-prod",
+          block_public_acls: true,
+          block_public_policy: true,
+          ignore_public_acls: true,
+          restrict_public_buckets: true,
+        },
+      },
+    ])!;
+
+    expect(out.content).toContain('VersioningConfiguration: {"Status":"Enabled"}');
+    expect(out.content).toContain(
+      'PublicAccessBlockConfiguration: {"BlockPublicAcls":true,"BlockPublicPolicy":true,"IgnorePublicAcls":true,"RestrictPublicBuckets":true}',
+    );
+    // The bucket's own in-state SSE block lands as BucketEncryption.
+    expect(out.content).toContain('BucketEncryption: {"ServerSideEncryptionConfiguration"');
+    // The source says what each fold contributed.
+    expect(out.content).toContain("// Folded in aws_s3_bucket_versioning.assets -> VersioningConfiguration");
+    expect(out.content).toContain(
+      "// Folded in aws_s3_bucket_public_access_block.assets -> PublicAccessBlockConfiguration",
+    );
+    expect(out.folded).toEqual([
+      { address: "aws_s3_bucket_versioning.assets", props: ["VersioningConfiguration"] },
+      { address: "aws_s3_bucket_public_access_block.assets", props: ["PublicAccessBlockConfiguration"] },
+    ]);
+    // Only the genuinely unmappable leftover is in the comment.
+    expect(out.content).toContain('"aws_s3_bucket_versioning.assets"');
+    expect(out.content).toContain('"mfa": null');
+  });
+
+  test("a folded sub-resource with no mapping yet is reported, not dropped", () => {
+    const out = adoptFromState(
+      { type: "aws_s3_bucket", name: "assets", attributes: { bucket: "b" } },
+      [],
+      [{ type: "aws_s3_bucket_policy", name: "assets", attributes: { bucket: "b", policy: '{"Statement":[]}' } }],
+    )!;
+    expect(out.folded).toEqual([{ address: "aws_s3_bucket_policy.assets", props: [] }]);
+    expect(out.content).toContain("// Folded in aws_s3_bucket_policy.assets -> nothing mappable");
+    expect(out.content).toContain('"aws_s3_bucket_policy.assets"');
+    expect(out.content).toContain('"policy"');
+  });
+
   test("canAdoptFromState gates on a known native constructor", () => {
     expect(canAdoptFromState("aws_s3_bucket")).toBe(true);
     expect(canAdoptFromState("random_pet")).toBe(false);

package/src/terraform/adopt-state.ts

@@ -18,7 +18,14 @@
  * resolved value as the declared default (see `carve-emit.ts`'s scaffold).
  */
 
-import { AWS_CARVE_TYPES, AWS_LEXICON_IMPORT, awsCarveType, applyAwsMapper } from "./aws-resources";
+import {
+  AWS_CARVE_TYPES,
+  AWS_LEXICON_IMPORT,
+  awsCarveType,
+  applyAwsMapper,
+  applyAwsFold,
+  unmappedFoldAttrs,
+} from "./aws-resources";
 import type { StateResource } from "./state";
 
 /** The core subpath the emitted source reads build parameters from. */
@@ -43,6 +50,14 @@ export interface DeferredParam {
   default?: string | number | boolean;
 }
 
+/** What one folded sub-resource contributed to the parent's emitted props (#1637). */
+export interface FoldedContribution {
+  /** The sub-resource's Terraform address, e.g. `aws_s3_bucket_versioning.assets`. */
+  address: string;
+  /** CFN properties it added to the parent, e.g. `["VersioningConfiguration"]`. */
+  props: string[];
+}
+
 export interface AdoptedSource {
   fileName: string;
   content: string;
@@ -51,6 +66,8 @@ export interface AdoptedSource {
   nativeType: string;
   /** Deferred params actually substituted into the emitted props (#998). */
   parameterized: string[];
+  /** Folded sub-resources and the props each one joined into the parent (#1637). */
+  folded: FoldedContribution[];
 }
 
 /** Is this Terraform type adoptable from state (has a native constructor)? */
@@ -79,13 +96,38 @@ class ParamRef {
  * A mapped attribute named by a `DeferredParam` renders as a `params.<name>`
  * reference (a real chant build parameter) instead of the state literal —
  * the value came from a survivor, so it stays overridable per build.
+ *
+ * `folded` carries the carve set's sub-resources (`aws_s3_bucket_versioning`
+ * and friends), read from the same state file. Their mappable attributes join
+ * the parent's props (#1637) — a fold that only announced itself and left the
+ * emitted resource without the versioning or public-access block the Terraform
+ * declared was a silent loss of configuration. A sub-resource's setting wins
+ * over the parent's own legacy in-state block: it is the one the config
+ * actually declares.
  */
-export function adoptFromState(resource: StateResource, params: DeferredParam[] = []): AdoptedSource | null {
+export function adoptFromState(
+  resource: StateResource,
+  params: DeferredParam[] = [],
+  folded: StateResource[] = [],
+): AdoptedSource | null {
   const entry = awsCarveType(resource.type);
   if (!entry) return null;
 
   const { props, mappedKeys } = applyAwsMapper(entry, resource.attributes);
 
+  const contributions: FoldedContribution[] = [];
+  const foldedUnmapped: Record<string, Record<string, unknown>> = {};
+  for (const sub of folded) {
+    const address = `${sub.type}.${sub.name}`;
+    const fold = applyAwsFold(sub.type, sub.attributes);
+    // No fold mapping for this sub-resource type: it still carves with the
+    // parent, so report its attributes rather than dropping them on the floor.
+    const rest = fold ? fold.unmapped : unmappedFoldAttrs(sub.attributes);
+    if (fold) Object.assign(props, fold.props);
+    if (Object.keys(rest).length) foldedUnmapped[address] = rest;
+    contributions.push({ address, props: Object.keys(fold?.props ?? {}) });
+  }
+
   // Substitute deferred inputs: only plain (untransformed) field mappings can
   // carry a parameter reference — a transform ran against the literal at emit
   // time and cannot re-run at build. Everything else keeps the state literal.
@@ -102,10 +144,17 @@ export function adoptFromState(resource: StateResource, params: DeferredParam[]
   for (const [k, v] of Object.entries(resource.attributes)) {
     if (!mappedKeys.includes(k)) unmapped[k] = v;
   }
+  // A folded sub-resource's leftovers are keyed by its address, so the comment
+  // says which block a stray attribute came from.
+  for (const [address, attrs] of Object.entries(foldedUnmapped)) unmapped[address] = attrs;
 
   const L: string[] = [];
   L.push(`// Adopted from Terraform state: ${resource.type}.${resource.name} -> ${entry.nativeType}`);
   L.push(`// Properties mapped from Terraform attributes (CloudFormation PascalCase).`);
+  for (const c of contributions) {
+    const into = c.props.length ? c.props.join(", ") : "nothing mappable — see the reference comment below";
+    L.push(`// Folded in ${c.address} -> ${into}`);
+  }
   L.push(`import { ${entry.ctor} } from "${AWS_LEXICON_IMPORT}";`);
   if (parameterized.length) {
     L.push(`// Deferred deploy-time input(s) — declared in chant.config.ts's buildParams.`);
@@ -126,6 +175,7 @@ export function adoptFromState(resource: StateResource, params: DeferredParam[]
     mapped: Object.keys(props).length > 0,
     nativeType: entry.nativeType,
     parameterized,
+    folded: contributions,
   };
 }