@intentius/chant 0.44.5 → 0.44.7

package/src/terraform/aws-resources.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { AWS_CARVE_TYPES, awsCarveType, applyAwsMapper } from "./aws-resources";
+import { AWS_CARVE_TYPES, AWS_FOLD_MAPPERS, awsCarveType, applyAwsMapper, applyAwsFold } from "./aws-resources";
 import { TIER_MAP, FOLDS_INTO, IDENTITY_ATTR } from "./tier-map";
 import { canAdoptFromState } from "./adopt-state";
 
@@ -100,6 +100,107 @@ describe("applyAwsMapper", () => {
   });
 });
 
+describe("folded sub-resource mappers (#1637)", () => {
+  test("every fold mapper is for a type that actually folds", () => {
+    for (const tfType of Object.keys(AWS_FOLD_MAPPERS)) {
+      expect(FOLDS_INTO[tfType]).toBeDefined();
+    }
+  });
+
+  test("versioning becomes the parent's VersioningConfiguration", () => {
+    const fold = applyAwsFold("aws_s3_bucket_versioning", {
+      id: "my-bucket",
+      bucket: "my-bucket",
+      versioning_configuration: [{ status: "Enabled", mfa_delete: "" }],
+      expected_bucket_owner: "",
+    })!;
+    expect(fold.props).toEqual({ VersioningConfiguration: { Status: "Enabled" } });
+    // The parent link is not content; the leftover attribute still reports.
+    expect(fold.unmapped).toEqual({ expected_bucket_owner: "" });
+  });
+
+  test("a status CloudFormation cannot spell maps nothing and consumes nothing", () => {
+    const fold = applyAwsFold("aws_s3_bucket_versioning", {
+      bucket: "b",
+      versioning_configuration: [{ status: "Disabled" }],
+    })!;
+    expect(fold.props).toEqual({});
+    expect(fold.unmapped).toEqual({ versioning_configuration: [{ status: "Disabled" }] });
+  });
+
+  test("the public access block becomes the parent's PublicAccessBlockConfiguration", () => {
+    const fold = applyAwsFold("aws_s3_bucket_public_access_block", {
+      id: "my-bucket",
+      bucket: "my-bucket",
+      block_public_acls: true,
+      block_public_policy: true,
+      ignore_public_acls: true,
+      restrict_public_buckets: false,
+    })!;
+    expect(fold.props).toEqual({
+      PublicAccessBlockConfiguration: {
+        BlockPublicAcls: true,
+        BlockPublicPolicy: true,
+        IgnorePublicAcls: true,
+        RestrictPublicBuckets: false,
+      },
+    });
+    expect(fold.unmapped).toEqual({});
+  });
+
+  test("the SSE sub-resource becomes BucketEncryption, KMS key included", () => {
+    const fold = applyAwsFold("aws_s3_bucket_server_side_encryption_configuration", {
+      bucket: "my-bucket",
+      rule: [
+        {
+          apply_server_side_encryption_by_default: [{ sse_algorithm: "aws:kms", kms_master_key_id: "arn:aws:kms:k" }],
+          bucket_key_enabled: true,
+        },
+      ],
+    })!;
+    expect(fold.props).toEqual({
+      BucketEncryption: {
+        ServerSideEncryptionConfiguration: [
+          { ServerSideEncryptionByDefault: { SSEAlgorithm: "aws:kms", KMSMasterKeyID: "arn:aws:kms:k" }, BucketKeyEnabled: true },
+        ],
+      },
+    });
+  });
+
+  test("a sub-resource type with no mapping yet returns null (the caller reports it)", () => {
+    expect(applyAwsFold("aws_s3_bucket_policy", { policy: "{}" })).toBeNull();
+  });
+
+  test("the bucket's own in-state versioning and SSE blocks map too", () => {
+    const { props, mappedKeys } = applyAwsMapper(awsCarveType("aws_s3_bucket")!, {
+      bucket: "my-bucket",
+      versioning: [{ enabled: true, mfa_delete: false }],
+      server_side_encryption_configuration: [
+        { rule: [{ apply_server_side_encryption_by_default: [{ sse_algorithm: "AES256", kms_master_key_id: "" }], bucket_key_enabled: false }] },
+      ],
+    });
+    expect(props.VersioningConfiguration).toEqual({ Status: "Enabled" });
+    expect(props.BucketEncryption).toEqual({
+      ServerSideEncryptionConfiguration: [
+        { ServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" }, BucketKeyEnabled: false },
+      ],
+    });
+    expect(mappedKeys).toContain("versioning");
+  });
+
+  test("an unversioned bucket's empty blocks map nothing and stay reported", () => {
+    const { props, mappedKeys } = applyAwsMapper(awsCarveType("aws_s3_bucket")!, {
+      bucket: "my-bucket",
+      versioning: [{ enabled: false, mfa_delete: false }],
+      server_side_encryption_configuration: [],
+    });
+    expect(props).not.toHaveProperty("VersioningConfiguration");
+    expect(props).not.toHaveProperty("BucketEncryption");
+    expect(mappedKeys).not.toContain("versioning");
+    expect(mappedKeys).not.toContain("server_side_encryption_configuration");
+  });
+});
+
 describe("tier + identity coverage maps (#998)", () => {
   test("kubernetes provider types rank, with _v1 aliases sharing the entry", () => {
     expect(TIER_MAP.kubernetes_manifest).toEqual({ tier: 1, mapsTo: "k8s:manifest" });

package/src/terraform/aws-resources.ts

@@ -46,10 +46,64 @@ const asJson = (v: unknown): unknown => {
 };
 const json = (prop: string): FieldSpec => ({ prop, transform: asJson });
 
+/**
+ * Terraform state renders a nested block as a one-element list. Take that
+ * entry (or the object itself, if the provider wrote it unwrapped).
+ */
+function firstBlock(value: unknown): Record<string, unknown> | undefined {
+  const candidate = Array.isArray(value) ? value[0] : value;
+  return candidate && typeof candidate === "object" ? (candidate as Record<string, unknown>) : undefined;
+}
+
+/**
+ * A list of TF server-side-encryption `rule` blocks → the CFN `BucketEncryption`
+ * property. Shared by the bucket's own (deprecated, still state-resident)
+ * `server_side_encryption_configuration` block and by the modern
+ * `aws_s3_bucket_server_side_encryption_configuration` sub-resource, whose
+ * `rule` list has the same shape.
+ */
+function sseRulesToCfn(rules: unknown): unknown {
+  if (!Array.isArray(rules)) return undefined;
+  const cfnRules: Array<Record<string, unknown>> = [];
+  for (const raw of rules) {
+    if (!raw || typeof raw !== "object") continue;
+    const rule = raw as Record<string, unknown>;
+    const out: Record<string, unknown> = {};
+    const byDefault = firstBlock(rule.apply_server_side_encryption_by_default);
+    const algorithm = byDefault?.sse_algorithm;
+    if (typeof algorithm === "string" && algorithm) {
+      const sse: Record<string, unknown> = { SSEAlgorithm: algorithm };
+      const kmsKey = byDefault?.kms_master_key_id;
+      if (typeof kmsKey === "string" && kmsKey) sse.KMSMasterKeyID = kmsKey;
+      out.ServerSideEncryptionByDefault = sse;
+    }
+    if (typeof rule.bucket_key_enabled === "boolean") out.BucketKeyEnabled = rule.bucket_key_enabled;
+    if (Object.keys(out).length) cfnRules.push(out);
+  }
+  return cfnRules.length ? { ServerSideEncryptionConfiguration: cfnRules } : undefined;
+}
+
+/**
+ * The bucket's own deprecated `versioning` block, as state still carries it.
+ * Only an enabled bucket says anything CloudFormation needs: a bucket that
+ * never had versioning has no `VersioningConfiguration` at all, so `enabled =
+ * false` maps to nothing and the block stays in the unmapped comment.
+ */
+function legacyVersioningToCfn(value: unknown): unknown {
+  const block = firstBlock(value);
+  return block?.enabled === true ? { Status: "Enabled" } : undefined;
+}
+
 export const AWS_CARVE_TYPES: AwsCarveType[] = [
   // ── Storage & data ──
   { tfType: "aws_s3_bucket", tier: 1, nativeType: "AWS::S3::Bucket", ctor: "Bucket", identityAttr: "bucket",
-    fields: { bucket: "BucketName" }, tags: true },
+    fields: {
+      bucket: "BucketName",
+      // The provider still resolves these two into the bucket's own state, even
+      // when the config declares them through sub-resources (#1637).
+      server_side_encryption_configuration: { prop: "BucketEncryption", transform: (v) => sseRulesToCfn(firstBlock(v)?.rule) },
+      versioning: { prop: "VersioningConfiguration", transform: legacyVersioningToCfn },
+    }, tags: true },
   { tfType: "aws_dynamodb_table", tier: 2, nativeType: "AWS::DynamoDB::Table", ctor: "Table", identityAttr: "name",
     fields: { name: "TableName", billing_mode: "BillingMode" }, tags: true },
   { tfType: "aws_efs_file_system", tier: 1, nativeType: "AWS::EFS::FileSystem", ctor: "EFSFileSystem",
@@ -267,6 +321,91 @@ export function awsCarveType(tfType: string): AwsCarveType | undefined {
   return BY_TYPE.get(tfType);
 }
 
+/**
+ * How a folded sub-resource (see `FOLDS_INTO`) joins its parent's emitted
+ * properties (#1637). Terraform splits configuration the CloudFormation shape
+ * keeps inside the parent resource, so the fold is not just a carve-set
+ * membership claim: the sub-resource's attributes have to land in the parent's
+ * props, or the emitted resource silently loses what the Terraform declared.
+ */
+export interface AwsFoldMapper {
+  /** Sub-resource attributes this mapper reads. Anything else stays unmapped. */
+  consumes: string[];
+  /** The parent CFN properties this sub-resource contributes. */
+  map: (attrs: Record<string, unknown>) => Record<string, unknown>;
+}
+
+/** Identity and parent-link attributes: never content, never reported unmapped. */
+const FOLD_LINK_ATTRS = new Set(["id", "arn", "bucket"]);
+
+export const AWS_FOLD_MAPPERS: Record<string, AwsFoldMapper> = {
+  aws_s3_bucket_versioning: {
+    consumes: ["versioning_configuration"],
+    map: (attrs) => {
+      const status = firstBlock(attrs.versioning_configuration)?.status;
+      // CFN takes Enabled/Suspended only; TF's third state ("Disabled", write-once
+      // buckets) has no CloudFormation spelling and stays in the comment.
+      return status === "Enabled" || status === "Suspended" ? { VersioningConfiguration: { Status: status } } : {};
+    },
+  },
+  aws_s3_bucket_public_access_block: {
+    consumes: ["block_public_acls", "block_public_policy", "ignore_public_acls", "restrict_public_buckets"],
+    map: (attrs) => {
+      const config: Record<string, unknown> = {};
+      const flags: Array<[string, string]> = [
+        ["block_public_acls", "BlockPublicAcls"],
+        ["block_public_policy", "BlockPublicPolicy"],
+        ["ignore_public_acls", "IgnorePublicAcls"],
+        ["restrict_public_buckets", "RestrictPublicBuckets"],
+      ];
+      for (const [tfAttr, prop] of flags) {
+        if (typeof attrs[tfAttr] === "boolean") config[prop] = attrs[tfAttr];
+      }
+      return Object.keys(config).length ? { PublicAccessBlockConfiguration: config } : {};
+    },
+  },
+  aws_s3_bucket_server_side_encryption_configuration: {
+    consumes: ["rule"],
+    map: (attrs) => {
+      const encryption = sseRulesToCfn(attrs.rule);
+      return encryption ? { BucketEncryption: encryption } : {};
+    },
+  },
+};
+
+/**
+ * Apply a folded sub-resource's state attributes to its parent's properties.
+ *
+ * Returns the props it contributes plus the attributes that stay genuinely
+ * unmappable (which the emitted source preserves in its reference comment). A
+ * mapper that produced nothing consumes nothing — the caller reports the whole
+ * sub-resource rather than claiming a fold that did not happen. `null` means
+ * this sub-resource type has no fold mapping at all.
+ */
+export function applyAwsFold(
+  tfType: string,
+  attrs: Record<string, unknown>,
+): { props: Record<string, unknown>; unmapped: Record<string, unknown> } | null {
+  const mapper = AWS_FOLD_MAPPERS[tfType];
+  if (!mapper) return null;
+  const props = mapper.map(attrs);
+  const consumed = new Set(Object.keys(props).length ? mapper.consumes : []);
+  return { props, unmapped: unmappedFoldAttrs(attrs, consumed) };
+}
+
+/** A folded sub-resource's attributes minus what was consumed and its parent link. */
+export function unmappedFoldAttrs(
+  attrs: Record<string, unknown>,
+  consumed: ReadonlySet<string> = new Set(),
+): Record<string, unknown> {
+  const rest: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(attrs)) {
+    if (consumed.has(key) || FOLD_LINK_ATTRS.has(key)) continue;
+    rest[key] = value;
+  }
+  return rest;
+}
+
 /** TF `tags` map → CloudFormation `Tags` list of {Key, Value}. */
 function tagsToCfn(tags: unknown): Array<{ Key: string; Value: unknown }> | undefined {
   if (!tags || typeof tags !== "object" || Array.isArray(tags)) return undefined;
@@ -291,8 +430,11 @@ export function applyAwsMapper(
     if (typeof spec === "string") {
       props[spec] = value;
     } else {
+      // A transform that declines (undefined) has mapped nothing — the attribute
+      // stays in the unmapped report rather than being claimed and dropped.
       const t = spec.transform(value);
-      if (t !== undefined) props[spec.prop] = t;
+      if (t === undefined) continue;
+      props[spec.prop] = t;
     }
     mappedKeys.push(tfAttr);
   }

package/src/terraform/bridge.test.ts

@@ -110,6 +110,36 @@ describe("generateBridge — inbound (data-source rewrite)", () => {
   });
 });
 
+describe("generateBridge — output blocks (#1638)", () => {
+  const withOutput: Hcl2JsonTree = {
+    resource: { aws_s3_bucket: { assets: [{ bucket: "myapp-assets-prod" }] } },
+    output: { assets_bucket: [{ value: "${aws_s3_bucket.assets.bucket}" }] },
+  };
+  const OUTPUTS_TF = `output "assets_bucket" {\n  value = aws_s3_bucket.assets.bucket\n}\n`;
+
+  test("an output-only dependency still gets a data source and a rewrite", () => {
+    const report = boundaryReport(buildFixtureGraph(withOutput), "aws_s3_bucket.assets")!;
+    const plan = generateBridge(report, [{ path: "outputs.tf", content: OUTPUTS_TF }], identities);
+
+    // Before #1638 the graph could not see the output, so this was an unpatched
+    // dependency: no data source, no rewrite, a broken plan at handoff.
+    expect(plan.dataSources.map((d) => d.address)).toEqual(["aws_s3_bucket.assets"]);
+    expect(plan.outputRewrites).toEqual(["output.assets_bucket"]);
+
+    const rewrite = plan.rewrites.find((r) => r.path === "outputs.tf")!;
+    expect(rewrite.changed).toBe(true);
+    expect(rewrite.rewritten).toContain("value = data.aws_s3_bucket.assets.bucket");
+    expect(plan.runbook).toContain("repoints these output block(s) at the data source: output.assets_bucket");
+  });
+
+  test("no outputs → nothing listed", () => {
+    const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
+    const plan = generateBridge(report, [{ path: "api.tf", content: API_TF }], identities);
+    expect(plan.outputRewrites).toEqual([]);
+    expect(plan.runbook).not.toContain("repoints these output block(s) at the data source");
+  });
+});
+
 describe("generateBridge — outbound (deferred inputs)", () => {
   test("records outbound edges as deferred deploy-time inputs", () => {
     const tree: Hcl2JsonTree = {

package/src/terraform/bridge.ts

@@ -8,6 +8,8 @@
  *    Bridge: add a `data` source for the (now chant-managed) resource and
  *    rewrite the survivor's `type.name.attr` references to `data.type.name.attr`.
  *    Required immediately, or `terraform plan` errors on the dangling ref.
+ *    An `output` block reading the carved resource is such a survivor (#1638):
+ *    same data source, same textual rewrite, applied to the output's value.
  *
  *  - outbound edge → the carved resource read a value from a survivor. That
  *    value must enter chant from outside synthesis, as a deploy-time input.
@@ -62,6 +64,12 @@ export interface BridgePlan {
   deferredInputs: DeferredInput[];
   /** Every carved address whose own block the rewrites remove, across files. */
   excised: string[];
+  /**
+   * `output` blocks whose value the rewrites repoint at a data source (#1638),
+   * as `output.<name>`. They are inbound edges like any other — listed
+   * separately only because the patch is a one-line expression edit.
+   */
+  outputRewrites: string[];
   runbook: string;
 }
 
@@ -139,13 +147,19 @@ export function generateBridge(
     };
   });
 
+  const outputRewrites = report.inbound
+    .filter((e) => e.bridge === "tf-output-rewrite")
+    .map((e) => e.survivor)
+    .sort();
+
   return {
     target: report.target,
     dataSources,
     rewrites,
     deferredInputs,
     excised,
-    runbook: buildRunbook(report, dataSources, deferredInputs, excised),
+    outputRewrites,
+    runbook: buildRunbook(report, dataSources, deferredInputs, excised, outputRewrites),
   };
 }
 
@@ -155,6 +169,7 @@ function buildRunbook(
   dataSources: DataSourceBlock[],
   deferred: DeferredInput[],
   excised: string[],
+  outputRewrites: string[],
 ): string {
   const carvedAddrs = report.carveSet.map((m) => m.address);
   const L: string[] = [];
@@ -180,6 +195,9 @@ function buildRunbook(
   } else if (!excised.length) {
     L.push("    # no inbound edges — no survivor patch needed.");
   }
+  if (outputRewrites.length) {
+    L.push(`    # and repoints these output block(s) at the data source: ${outputRewrites.join(", ")}`);
+  }
   L.push("    terraform plan   # expect: in-place updates to the survivors only");
   L.push("    terraform apply");
   L.push("");

package/src/terraform/carve.test.ts

@@ -87,6 +87,40 @@ describe("boundaryReport", () => {
     ]);
   });
 
+  test("an output block is an inbound edge with its own bridge kind (#1638)", () => {
+    const tree: Hcl2JsonTree = {
+      resource: { aws_s3_bucket: { assets: [{ bucket: "b" }] } },
+      output: { assets_bucket: [{ value: "${aws_s3_bucket.assets.bucket}" }] },
+    };
+    const report = boundaryReport(buildFixtureGraph(tree), "aws_s3_bucket.assets")!;
+    expect(report.inbound).toEqual([
+      {
+        direction: "inbound",
+        survivor: "output.assets_bucket",
+        carved: "aws_s3_bucket.assets",
+        attrs: ["bucket"],
+        via: ["value"],
+        bridge: "tf-output-rewrite",
+        required: "immediately",
+      },
+    ]);
+    expect(report.peelability).toBe(96); // the cheaper output weight, not 88
+  });
+
+  test("an output on a folded sub-resource is still the parent's boundary work", () => {
+    const tree: Hcl2JsonTree = {
+      resource: {
+        aws_s3_bucket: { assets: [{ bucket: "b" }] },
+        aws_s3_bucket_versioning: { assets: [{ bucket: "${aws_s3_bucket.assets.id}" }] },
+      },
+      output: { versioning_id: [{ value: "${aws_s3_bucket_versioning.assets.id}" }] },
+    };
+    const report = boundaryReport(buildFixtureGraph(tree), "aws_s3_bucket.assets")!;
+    expect(report.inbound.map((e) => [e.survivor, e.carved, e.bridge])).toEqual([
+      ["output.versioning_id", "aws_s3_bucket_versioning.assets", "tf-output-rewrite"],
+    ]);
+  });
+
   test("unsupported type is flagged in diagnostics", () => {
     const tree: Hcl2JsonTree = { resource: { random_pet: { n: [{ length: 2 }] } } };
     const report = boundaryReport(buildFixtureGraph(tree), "random_pet.n")!;

package/src/terraform/graph.test.ts

@@ -157,6 +157,51 @@ describe("buildGraph", () => {
     expect(byAddr["aws_s3_bucket.assets"].identity).toBe("myapp-assets-prod"); // flat attr unaffected
   });
 
+  test("an output block referencing a resource is an inbound edge, tagged as an output (#1638)", () => {
+    const tree: Hcl2JsonTree = {
+      resource: { aws_s3_bucket: { assets: [{ bucket: "x" }] } },
+      output: {
+        assets_bucket: [{ value: "${aws_s3_bucket.assets.bucket}" }],
+        assets_pair: [{ value: ["${aws_s3_bucket.assets.arn}", "${aws_s3_bucket.assets.id}"], description: "both" }],
+      },
+    };
+    const g = buildFixtureGraph(tree);
+
+    // An output is a referrer, never a node — nothing carves an output.
+    expect(g.nodes.map((n) => n.address)).toEqual(["aws_s3_bucket.assets"]);
+    expect(inboundEdges(g, "aws_s3_bucket.assets")).toEqual([
+      {
+        from: "output.assets_bucket",
+        to: "aws_s3_bucket.assets",
+        attrs: ["bucket"],
+        via: ["value"],
+        fromKind: "output",
+      },
+      {
+        from: "output.assets_pair",
+        to: "aws_s3_bucket.assets",
+        attrs: ["arn", "id"],
+        via: ["value"],
+        fromKind: "output",
+      },
+    ]);
+    // Nothing can depend on an output in turn.
+    expect(outboundEdges(g, "output.assets_bucket").map((e) => e.to)).toEqual(["aws_s3_bucket.assets"]);
+    expect(inboundEdges(g, "output.assets_bucket")).toEqual([]);
+  });
+
+  test("an output referencing a var or a data source contributes no edge", () => {
+    const tree: Hcl2JsonTree = {
+      data: { aws_ami: { ubuntu: [{ owners: ["1"] }] } },
+      resource: { aws_s3_bucket: { assets: [{ bucket: "x" }] } },
+      output: {
+        name: [{ value: "${var.name}" }],
+        ami: [{ value: "${data.aws_ami.ubuntu.id}" }],
+      },
+    };
+    expect(buildFixtureGraph(tree).edges).toEqual([]);
+  });
+
   test("var / local references are not edges", () => {
     const tree: Hcl2JsonTree = {
       resource: {

package/src/terraform/graph.ts

@@ -81,9 +81,9 @@ export function refFromAccessor(accessor: string): RawRef | null {
 }
 
 /**
- * Every string value carrying an interpolation across the tree's resource and
- * module blocks — exactly the expressions `parse.ts` must resolve through the
- * AST before `buildGraph` can classify them.
+ * Every string value carrying an interpolation across the tree's resource,
+ * module and output blocks — exactly the expressions `parse.ts` must resolve
+ * through the AST before `buildGraph` can classify them.
  */
 export function collectExpressions(tree: Hcl2JsonTree): string[] {
   const exprs = new Set<string>();
@@ -98,6 +98,7 @@ export function collectExpressions(tree: Hcl2JsonTree): string[] {
   };
   for (const named of Object.values(tree.resource ?? {})) for (const blocks of Object.values(named)) visit(blocks);
   for (const blocks of Object.values(tree.module ?? {})) visit(blocks);
+  for (const blocks of Object.values(tree.output ?? {})) visit(blocks);
   return [...exprs].sort();
 }
 
@@ -167,6 +168,12 @@ function literalIdentity(block: unknown, type: string): string | undefined {
  * marks the referring node dynamic. An edge is recorded only when its target
  * resolves to a known resource/module node — references to `var`/`local`/data
  * are dropped.
+ *
+ * `output` blocks are not nodes either — nothing carves an output — but they
+ * do reference, and a reference to a carved resource breaks the surviving plan
+ * exactly like a resource's does. So an output contributes an edge tagged
+ * `fromKind: "output"` from the pseudo-address `output.<name>` (#1638),
+ * which the scorer weights lower and `carve bridge` patches.
  */
 export function buildGraph(tree: Hcl2JsonTree, exprRefs: ExpressionRefs): TfGraph {
   const nodes: TfNode[] = [];
@@ -216,22 +223,34 @@ export function buildGraph(tree: Hcl2JsonTree, exprRefs: ExpressionRefs): TfGrap
     });
   }
 
+  // Output blocks: referrers without being nodes (#1638). Their pseudo-address
+  // never joins `known`, so nothing can depend on an output in turn.
+  const outputRefs = new Map<string, RawRef[]>();
+  for (const [name, blocks] of Object.entries(tree.output ?? {})) {
+    const block = Array.isArray(blocks) ? blocks[0] : blocks;
+    outputRefs.set(`output.${name}`, refsInBlock(block, exprRefs));
+  }
+
   // Edges: keep only references that resolve to a known node.
   const known = new Set(nodes.map((n) => n.address));
   const edges: TfEdge[] = [];
-  for (const [from, refs] of rawRefsByNode) {
-    const byTarget = new Map<string, { attrs: Set<string>; via: Set<string> }>();
-    for (const ref of refs) {
-      if (ref.address === from || !known.has(ref.address)) continue;
-      if (!byTarget.has(ref.address)) byTarget.set(ref.address, { attrs: new Set(), via: new Set() });
-      const target = byTarget.get(ref.address)!;
-      if (ref.attr) target.attrs.add(ref.attr);
-      if (ref.via) target.via.add(ref.via);
-    }
-    for (const [to, { attrs, via }] of byTarget) {
-      edges.push({ from, to, attrs: [...attrs].sort(), via: [...via].sort() });
+  const collect = (source: Map<string, RawRef[]>, fromKind?: "output"): void => {
+    for (const [from, refs] of source) {
+      const byTarget = new Map<string, { attrs: Set<string>; via: Set<string> }>();
+      for (const ref of refs) {
+        if (ref.address === from || !known.has(ref.address)) continue;
+        if (!byTarget.has(ref.address)) byTarget.set(ref.address, { attrs: new Set(), via: new Set() });
+        const target = byTarget.get(ref.address)!;
+        if (ref.attr) target.attrs.add(ref.attr);
+        if (ref.via) target.via.add(ref.via);
+      }
+      for (const [to, { attrs, via }] of byTarget) {
+        edges.push({ from, to, attrs: [...attrs].sort(), via: [...via].sort(), ...(fromKind ? { fromKind } : {}) });
+      }
     }
-  }
+  };
+  collect(rawRefsByNode);
+  collect(outputRefs, "output");
 
   // Code-point ordering (not localeCompare) so output is locale-independent and
   // punctuation sorts predictably (`.` < `_`).
@@ -242,7 +261,7 @@ export function buildGraph(tree: Hcl2JsonTree, exprRefs: ExpressionRefs): TfGrap
   };
 }
 
-/** Edges where other nodes depend on `address` (each → a surviving-TF data-source patch). */
+/** Edges where something in the surviving Terraform depends on `address`. */
 export function inboundEdges(graph: TfGraph, address: string): TfEdge[] {
   return graph.edges.filter((e) => e.to === address);
 }

package/src/terraform/parse.ts

@@ -68,7 +68,7 @@ async function resolveExpressionRefs(hcl2json: Hcl2Json, tree: Hcl2JsonTree): Pr
   return refs;
 }
 
-/** Deep-merge hcl2json trees across files (resource/module/data namespaces). */
+/** Deep-merge hcl2json trees across files (resource/module/data/output namespaces). */
 function mergeTrees(into: Hcl2JsonTree, next: Hcl2JsonTree): void {
   for (const section of ["resource", "data"] as const) {
     const src = next[section];
@@ -79,6 +79,9 @@ function mergeTrees(into: Hcl2JsonTree, next: Hcl2JsonTree): void {
     }
   }
   if (next.module) into.module = { ...(into.module ?? {}), ...next.module };
+  // Outputs usually live in their own file (#1638) — merge them, or the graph
+  // never sees the estate's outputs.tf at all.
+  if (next.output) into.output = { ...(into.output ?? {}), ...next.output };
 }
 
 /** List every `.tf` file directly under `dir` (non-recursive; matches Terraform's own module scoping). */

package/src/terraform/score.test.ts

@@ -115,6 +115,31 @@ describe("scoreEstate — penalties", () => {
     expect(map["aws_sns_topic.alerts"].score).toBe(88); // 100 - 12*1 inbound
   });
 
+  test("an output block reading a resource costs 4, not 12 (#1638)", () => {
+    const tree: Hcl2JsonTree = {
+      resource: { aws_s3_bucket: { assets: [{ bucket: "b" }] } },
+      output: { assets_bucket: [{ value: "${aws_s3_bucket.assets.bucket}" }] },
+    };
+    const bucket = byAddress(scoreEstate(buildFixtureGraph(tree)))["aws_s3_bucket.assets"];
+    expect(bucket.score).toBe(96); // 100 - 4*1 output
+    expect(bucket.breakdown.outputs).toBe(1);
+    expect(bucket.breakdown.inbound).toBe(0); // not counted as a data-source patch
+    expect(bucket.breakdown.penalties.outputs).toBe(-4);
+  });
+
+  test("an output and a resource reference are counted apart", () => {
+    const tree: Hcl2JsonTree = {
+      resource: {
+        aws_s3_bucket: { assets: [{ bucket: "b" }] },
+        aws_lambda_function: { api: [{ environment: { variables: { B: "${aws_s3_bucket.assets.bucket}" } } }] },
+      },
+      output: { assets_arn: [{ value: "${aws_s3_bucket.assets.arn}" }] },
+    };
+    const bucket = byAddress(scoreEstate(buildFixtureGraph(tree)))["aws_s3_bucket.assets"];
+    expect(bucket.breakdown).toMatchObject({ inbound: 1, outputs: 1 });
+    expect(bucket.score).toBe(84); // 100 - 12 - 4
+  });
+
   test("results are ranked most-peelable first", () => {
     const tree: Hcl2JsonTree = {
       resource: {