@intentius/chant 0.44.6 → 0.44.8

package/src/cli/commands/carve.test.ts

@@ -100,6 +100,43 @@ describe("carveAdvise", () => {
     });
   });
 
+  test("an output block in its own file counts against the score it reads (#1638)", async () => {
+    if (!parserAvailable) return;
+    const dir = mkdtempSync(join(tmpdir(), "chant-carve-outputs-"));
+    try {
+      writeFileSync(join(dir, "main.tf"), ESTATE);
+      // Outputs almost always live in their own file — the merge across files
+      // has to carry them, or the graph never sees the estate's outputs.tf.
+      writeFileSync(
+        join(dir, "outputs.tf"),
+        `output "assets_bucket" {\n  value = aws_s3_bucket.assets.bucket\n}\n`,
+      );
+      const r = await carveAdvise({ from: dir });
+      expect(r.ok).toBe(true);
+
+      // Outputs are not carve candidates.
+      expect((r.results ?? []).map((x) => x.address)).not.toContain("output.assets_bucket");
+
+      const bucket = r.results!.find((x) => x.address === "aws_s3_bucket.assets")!;
+      expect(bucket.breakdown).toMatchObject({ inbound: 1, outputs: 1 });
+      expect(bucket.score).toBe(84); // 88 with the Lambda alone, minus 4 for the output
+      expect(formatCarveReport(r)).toContain("1 output block(s) reading it (one-line rewrite each)");
+
+      const written = carveJson(r).resources.find((x) => x.address === "aws_s3_bucket.assets")!;
+      expect(written.boundary!.inbound).toContainEqual({
+        direction: "inbound",
+        survivor: "output.assets_bucket",
+        carved: "aws_s3_bucket.assets",
+        attrs: ["bucket"],
+        via: ["value"],
+        bridge: "tf-output-rewrite",
+        required: "immediately",
+      });
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   test("formatCarveReport groups by band and never suggests a mutation", async () => {
     if (!parserAvailable) return;
     await withEstate(async (dir) => {
@@ -132,10 +169,11 @@ describe("carveAdvise", () => {
           breakdown: {
             inbound: 0,
             outbound: 0,
+            outputs: 0,
             tier: 1,
             hasDynamic: false,
             instances: 1,
-            penalties: { inbound: 0, outbound: 0, tier: 0, dynamic: 0, instances: 0 },
+            penalties: { inbound: 0, outbound: 0, outputs: 0, tier: 0, dynamic: 0, instances: 0 },
           },
         },
       ],

package/src/cli/commands/carve.ts

@@ -73,8 +73,9 @@ export async function carveAdvise(opts: CarveAdviseOptions): Promise<CarveAdvise
  * says which shape it is. The promise attached to this number:
  *
  *  - **Additive within a version.** New top-level fields, new per-resource
- *    fields, and new entries in an existing list may appear in any release. A
- *    reader must ignore keys it does not know.
+ *    fields, new kinds of entry in an existing list, and new values in an
+ *    open-ended enum (a `bridge` kind, say) may appear in any release. A
+ *    reader must ignore keys and values it does not know.
  *  - **A removal, a rename, or a changed meaning bumps it.** So does narrowing
  *    a field's type (an optional becoming required is additive; the reverse is
  *    not).
@@ -97,6 +98,10 @@ export interface CarveJsonResource extends Peelability {
    * stand in for it. Edges internal to the carve set are not boundary work and
    * are not listed.
    *
+   * An inbound edge's survivor can be an `output.<name>` pseudo-address
+   * (#1638), carrying `bridge: "tf-output-rewrite"` and `via: ["value"]`. It
+   * is counted in `breakdown.outputs`, not `breakdown.inbound`.
+   *
    * Present (possibly with two empty lists) whenever the graph was available;
    * absent means this chant did not compute it — "none" and "not reported" are
    * different claims. `breakdown.inbound`/`outbound` keep the counts.
@@ -184,6 +189,7 @@ function reasons(r: Peelability): string {
   if (b.tier === null) return "no known native mapping (unsupported provider/type)";
   const parts: string[] = [];
   if (b.inbound) parts.push(`${b.inbound} inbound (data-source patch each)`);
+  if (b.outputs) parts.push(`${b.outputs} output block(s) reading it (one-line rewrite each)`);
   if (b.outbound) parts.push(`${b.outbound} outbound (deferred input each)`);
   if (b.tier > 1) parts.push(`tier ${b.tier} map`);
   if (b.hasDynamic) parts.push("count/for_each/data present");

package/src/cli/handlers/lifecycle.test.ts

@@ -677,6 +677,33 @@ describe("runLifecyclePlan", () => {
     expect(stdoutBuf.join("\n")).toContain("bucket");
   });
 
+  // #1620 — the resolved read address rides plan entries the same way it rides
+  // the live diff. Regression: the plan path dropped the observation's queried
+  // map, so only unobserved rows ever carried an address while the docs
+  // promised it per-entry.
+  test("--json carries the observation's queried address on observed entries", async () => {
+    buildMock.mockResolvedValue(makeBuildResult({ k8s: ["web"] }));
+    const plugins: LexiconPlugin[] = [
+      createMockPlugin({
+        name: "k8s",
+        describeResources: async () => ({
+          observation: "v1" as const,
+          resources: { web: meta({ type: "K8s::Apps::Deployment" }) },
+          queried: { web: "/apis/apps/v1/namespaces/default/deployments/web" },
+        }),
+      }),
+    ];
+    const exit = await runLifecyclePlan({
+      args: makeArgs({ path: "plan", extraPositional: "prod", json: true }),
+      plugins,
+      serializers: plugins.map((p) => p.serializer),
+    });
+    expect(exit).toBe(0);
+    const plan = JSON.parse(stdoutBuf.join("\n"));
+    const web = plan.entries.find((e: { name: string }) => e.name === "web");
+    expect(web.queried).toBe("/apis/apps/v1/namespaces/default/deployments/web");
+  });
+
   // #1166 — plan is always a live read (no `--live` flag of its own), so a
   // declared environment endpoint applies here exactly as it does for
   // `chant graph --live` / `chant lifecycle diff --live`.

package/src/cli/handlers/lifecycle.ts

@@ -1178,6 +1178,9 @@ export async function runLifecyclePlan(ctx: CommandContext): Promise<number> {
         observedNow: observed.resources,
         observedThen,
         unobserved: observed.unobserved,
+        // The resolved read address rides every entry, not just unobserved
+        // ones — the diff path already passes it (#1620); plan lost it.
+        queried: observed.queried,
       });
       merged.entries.push(...cs.entries);
       checked++;

package/src/terraform/__fixtures__/advise.test.ts

@@ -129,11 +129,13 @@ describe("carve advise --json against the sample estate", () => {
     if (!parserAvailable) return;
     const report = carveJson(await carveAdvise({ from: ESTATE }));
 
-    // `breakdown.inbound`/`outbound` are what the score was computed from and
-    // stay for backward compatibility. They must agree with the lists, or the
-    // arithmetic a reader prints beside the drawn edges is a lie.
+    // `breakdown.inbound`/`outbound`/`outputs` are what the score was computed
+    // from and stay for backward compatibility. They must agree with the lists,
+    // or the arithmetic a reader prints beside the drawn edges is a lie. The
+    // inbound list holds both resource and output survivors (#1638), so it is
+    // the two counts together.
     for (const r of report.resources) {
-      expect([r.address, r.boundary!.inbound.length]).toEqual([r.address, r.breakdown.inbound]);
+      expect([r.address, r.boundary!.inbound.length]).toEqual([r.address, r.breakdown.inbound + r.breakdown.outputs]);
       expect([r.address, r.boundary!.outbound.length]).toEqual([r.address, r.breakdown.outbound]);
     }
 

package/src/terraform/adopt-state.test.ts

@@ -78,6 +78,70 @@ describe("adoptFromState", () => {
     expect(out.content).toContain('FunctionName: "myapp-api"');
   });
 
+  test("folded sub-resources join the parent's emitted properties (#1637)", () => {
+    const bucket: StateResource = {
+      type: "aws_s3_bucket",
+      name: "assets",
+      attributes: {
+        id: "myapp-assets-prod",
+        bucket: "myapp-assets-prod",
+        versioning: [{ enabled: true, mfa_delete: false }],
+        server_side_encryption_configuration: [
+          { rule: [{ apply_server_side_encryption_by_default: [{ sse_algorithm: "AES256" }], bucket_key_enabled: false }] },
+        ],
+      },
+    };
+    const out = adoptFromState(bucket, [], [
+      {
+        type: "aws_s3_bucket_versioning",
+        name: "assets",
+        attributes: { bucket: "myapp-assets-prod", versioning_configuration: [{ status: "Enabled" }], mfa: null },
+      },
+      {
+        type: "aws_s3_bucket_public_access_block",
+        name: "assets",
+        attributes: {
+          bucket: "myapp-assets-prod",
+          block_public_acls: true,
+          block_public_policy: true,
+          ignore_public_acls: true,
+          restrict_public_buckets: true,
+        },
+      },
+    ])!;
+
+    expect(out.content).toContain('VersioningConfiguration: {"Status":"Enabled"}');
+    expect(out.content).toContain(
+      'PublicAccessBlockConfiguration: {"BlockPublicAcls":true,"BlockPublicPolicy":true,"IgnorePublicAcls":true,"RestrictPublicBuckets":true}',
+    );
+    // The bucket's own in-state SSE block lands as BucketEncryption.
+    expect(out.content).toContain('BucketEncryption: {"ServerSideEncryptionConfiguration"');
+    // The source says what each fold contributed.
+    expect(out.content).toContain("// Folded in aws_s3_bucket_versioning.assets -> VersioningConfiguration");
+    expect(out.content).toContain(
+      "// Folded in aws_s3_bucket_public_access_block.assets -> PublicAccessBlockConfiguration",
+    );
+    expect(out.folded).toEqual([
+      { address: "aws_s3_bucket_versioning.assets", props: ["VersioningConfiguration"] },
+      { address: "aws_s3_bucket_public_access_block.assets", props: ["PublicAccessBlockConfiguration"] },
+    ]);
+    // Only the genuinely unmappable leftover is in the comment.
+    expect(out.content).toContain('"aws_s3_bucket_versioning.assets"');
+    expect(out.content).toContain('"mfa": null');
+  });
+
+  test("a folded sub-resource with no mapping yet is reported, not dropped", () => {
+    const out = adoptFromState(
+      { type: "aws_s3_bucket", name: "assets", attributes: { bucket: "b" } },
+      [],
+      [{ type: "aws_s3_bucket_policy", name: "assets", attributes: { bucket: "b", policy: '{"Statement":[]}' } }],
+    )!;
+    expect(out.folded).toEqual([{ address: "aws_s3_bucket_policy.assets", props: [] }]);
+    expect(out.content).toContain("// Folded in aws_s3_bucket_policy.assets -> nothing mappable");
+    expect(out.content).toContain('"aws_s3_bucket_policy.assets"');
+    expect(out.content).toContain('"policy"');
+  });
+
   test("canAdoptFromState gates on a known native constructor", () => {
     expect(canAdoptFromState("aws_s3_bucket")).toBe(true);
     expect(canAdoptFromState("random_pet")).toBe(false);

package/src/terraform/adopt-state.ts

@@ -18,7 +18,14 @@
  * resolved value as the declared default (see `carve-emit.ts`'s scaffold).
  */
 
-import { AWS_CARVE_TYPES, AWS_LEXICON_IMPORT, awsCarveType, applyAwsMapper } from "./aws-resources";
+import {
+  AWS_CARVE_TYPES,
+  AWS_LEXICON_IMPORT,
+  awsCarveType,
+  applyAwsMapper,
+  applyAwsFold,
+  unmappedFoldAttrs,
+} from "./aws-resources";
 import type { StateResource } from "./state";
 
 /** The core subpath the emitted source reads build parameters from. */
@@ -43,6 +50,14 @@ export interface DeferredParam {
   default?: string | number | boolean;
 }
 
+/** What one folded sub-resource contributed to the parent's emitted props (#1637). */
+export interface FoldedContribution {
+  /** The sub-resource's Terraform address, e.g. `aws_s3_bucket_versioning.assets`. */
+  address: string;
+  /** CFN properties it added to the parent, e.g. `["VersioningConfiguration"]`. */
+  props: string[];
+}
+
 export interface AdoptedSource {
   fileName: string;
   content: string;
@@ -51,6 +66,8 @@ export interface AdoptedSource {
   nativeType: string;
   /** Deferred params actually substituted into the emitted props (#998). */
   parameterized: string[];
+  /** Folded sub-resources and the props each one joined into the parent (#1637). */
+  folded: FoldedContribution[];
 }
 
 /** Is this Terraform type adoptable from state (has a native constructor)? */
@@ -79,13 +96,38 @@ class ParamRef {
  * A mapped attribute named by a `DeferredParam` renders as a `params.<name>`
  * reference (a real chant build parameter) instead of the state literal —
  * the value came from a survivor, so it stays overridable per build.
+ *
+ * `folded` carries the carve set's sub-resources (`aws_s3_bucket_versioning`
+ * and friends), read from the same state file. Their mappable attributes join
+ * the parent's props (#1637) — a fold that only announced itself and left the
+ * emitted resource without the versioning or public-access block the Terraform
+ * declared was a silent loss of configuration. A sub-resource's setting wins
+ * over the parent's own legacy in-state block: it is the one the config
+ * actually declares.
  */
-export function adoptFromState(resource: StateResource, params: DeferredParam[] = []): AdoptedSource | null {
+export function adoptFromState(
+  resource: StateResource,
+  params: DeferredParam[] = [],
+  folded: StateResource[] = [],
+): AdoptedSource | null {
   const entry = awsCarveType(resource.type);
   if (!entry) return null;
 
   const { props, mappedKeys } = applyAwsMapper(entry, resource.attributes);
 
+  const contributions: FoldedContribution[] = [];
+  const foldedUnmapped: Record<string, Record<string, unknown>> = {};
+  for (const sub of folded) {
+    const address = `${sub.type}.${sub.name}`;
+    const fold = applyAwsFold(sub.type, sub.attributes);
+    // No fold mapping for this sub-resource type: it still carves with the
+    // parent, so report its attributes rather than dropping them on the floor.
+    const rest = fold ? fold.unmapped : unmappedFoldAttrs(sub.attributes);
+    if (fold) Object.assign(props, fold.props);
+    if (Object.keys(rest).length) foldedUnmapped[address] = rest;
+    contributions.push({ address, props: Object.keys(fold?.props ?? {}) });
+  }
+
   // Substitute deferred inputs: only plain (untransformed) field mappings can
   // carry a parameter reference — a transform ran against the literal at emit
   // time and cannot re-run at build. Everything else keeps the state literal.
@@ -102,10 +144,17 @@ export function adoptFromState(resource: StateResource, params: DeferredParam[]
   for (const [k, v] of Object.entries(resource.attributes)) {
     if (!mappedKeys.includes(k)) unmapped[k] = v;
   }
+  // A folded sub-resource's leftovers are keyed by its address, so the comment
+  // says which block a stray attribute came from.
+  for (const [address, attrs] of Object.entries(foldedUnmapped)) unmapped[address] = attrs;
 
   const L: string[] = [];
   L.push(`// Adopted from Terraform state: ${resource.type}.${resource.name} -> ${entry.nativeType}`);
   L.push(`// Properties mapped from Terraform attributes (CloudFormation PascalCase).`);
+  for (const c of contributions) {
+    const into = c.props.length ? c.props.join(", ") : "nothing mappable — see the reference comment below";
+    L.push(`// Folded in ${c.address} -> ${into}`);
+  }
   L.push(`import { ${entry.ctor} } from "${AWS_LEXICON_IMPORT}";`);
   if (parameterized.length) {
     L.push(`// Deferred deploy-time input(s) — declared in chant.config.ts's buildParams.`);
@@ -126,6 +175,7 @@ export function adoptFromState(resource: StateResource, params: DeferredParam[]
     mapped: Object.keys(props).length > 0,
     nativeType: entry.nativeType,
     parameterized,
+    folded: contributions,
   };
 }
 

package/src/terraform/aws-resources.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { AWS_CARVE_TYPES, awsCarveType, applyAwsMapper } from "./aws-resources";
+import { AWS_CARVE_TYPES, AWS_FOLD_MAPPERS, awsCarveType, applyAwsMapper, applyAwsFold } from "./aws-resources";
 import { TIER_MAP, FOLDS_INTO, IDENTITY_ATTR } from "./tier-map";
 import { canAdoptFromState } from "./adopt-state";
 
@@ -100,6 +100,107 @@ describe("applyAwsMapper", () => {
   });
 });
 
+describe("folded sub-resource mappers (#1637)", () => {
+  test("every fold mapper is for a type that actually folds", () => {
+    for (const tfType of Object.keys(AWS_FOLD_MAPPERS)) {
+      expect(FOLDS_INTO[tfType]).toBeDefined();
+    }
+  });
+
+  test("versioning becomes the parent's VersioningConfiguration", () => {
+    const fold = applyAwsFold("aws_s3_bucket_versioning", {
+      id: "my-bucket",
+      bucket: "my-bucket",
+      versioning_configuration: [{ status: "Enabled", mfa_delete: "" }],
+      expected_bucket_owner: "",
+    })!;
+    expect(fold.props).toEqual({ VersioningConfiguration: { Status: "Enabled" } });
+    // The parent link is not content; the leftover attribute still reports.
+    expect(fold.unmapped).toEqual({ expected_bucket_owner: "" });
+  });
+
+  test("a status CloudFormation cannot spell maps nothing and consumes nothing", () => {
+    const fold = applyAwsFold("aws_s3_bucket_versioning", {
+      bucket: "b",
+      versioning_configuration: [{ status: "Disabled" }],
+    })!;
+    expect(fold.props).toEqual({});
+    expect(fold.unmapped).toEqual({ versioning_configuration: [{ status: "Disabled" }] });
+  });
+
+  test("the public access block becomes the parent's PublicAccessBlockConfiguration", () => {
+    const fold = applyAwsFold("aws_s3_bucket_public_access_block", {
+      id: "my-bucket",
+      bucket: "my-bucket",
+      block_public_acls: true,
+      block_public_policy: true,
+      ignore_public_acls: true,
+      restrict_public_buckets: false,
+    })!;
+    expect(fold.props).toEqual({
+      PublicAccessBlockConfiguration: {
+        BlockPublicAcls: true,
+        BlockPublicPolicy: true,
+        IgnorePublicAcls: true,
+        RestrictPublicBuckets: false,
+      },
+    });
+    expect(fold.unmapped).toEqual({});
+  });
+
+  test("the SSE sub-resource becomes BucketEncryption, KMS key included", () => {
+    const fold = applyAwsFold("aws_s3_bucket_server_side_encryption_configuration", {
+      bucket: "my-bucket",
+      rule: [
+        {
+          apply_server_side_encryption_by_default: [{ sse_algorithm: "aws:kms", kms_master_key_id: "arn:aws:kms:k" }],
+          bucket_key_enabled: true,
+        },
+      ],
+    })!;
+    expect(fold.props).toEqual({
+      BucketEncryption: {
+        ServerSideEncryptionConfiguration: [
+          { ServerSideEncryptionByDefault: { SSEAlgorithm: "aws:kms", KMSMasterKeyID: "arn:aws:kms:k" }, BucketKeyEnabled: true },
+        ],
+      },
+    });
+  });
+
+  test("a sub-resource type with no mapping yet returns null (the caller reports it)", () => {
+    expect(applyAwsFold("aws_s3_bucket_policy", { policy: "{}" })).toBeNull();
+  });
+
+  test("the bucket's own in-state versioning and SSE blocks map too", () => {
+    const { props, mappedKeys } = applyAwsMapper(awsCarveType("aws_s3_bucket")!, {
+      bucket: "my-bucket",
+      versioning: [{ enabled: true, mfa_delete: false }],
+      server_side_encryption_configuration: [
+        { rule: [{ apply_server_side_encryption_by_default: [{ sse_algorithm: "AES256", kms_master_key_id: "" }], bucket_key_enabled: false }] },
+      ],
+    });
+    expect(props.VersioningConfiguration).toEqual({ Status: "Enabled" });
+    expect(props.BucketEncryption).toEqual({
+      ServerSideEncryptionConfiguration: [
+        { ServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" }, BucketKeyEnabled: false },
+      ],
+    });
+    expect(mappedKeys).toContain("versioning");
+  });
+
+  test("an unversioned bucket's empty blocks map nothing and stay reported", () => {
+    const { props, mappedKeys } = applyAwsMapper(awsCarveType("aws_s3_bucket")!, {
+      bucket: "my-bucket",
+      versioning: [{ enabled: false, mfa_delete: false }],
+      server_side_encryption_configuration: [],
+    });
+    expect(props).not.toHaveProperty("VersioningConfiguration");
+    expect(props).not.toHaveProperty("BucketEncryption");
+    expect(mappedKeys).not.toContain("versioning");
+    expect(mappedKeys).not.toContain("server_side_encryption_configuration");
+  });
+});
+
 describe("tier + identity coverage maps (#998)", () => {
   test("kubernetes provider types rank, with _v1 aliases sharing the entry", () => {
     expect(TIER_MAP.kubernetes_manifest).toEqual({ tier: 1, mapsTo: "k8s:manifest" });

package/src/terraform/aws-resources.ts

@@ -46,10 +46,64 @@ const asJson = (v: unknown): unknown => {
 };
 const json = (prop: string): FieldSpec => ({ prop, transform: asJson });
 
+/**
+ * Terraform state renders a nested block as a one-element list. Take that
+ * entry (or the object itself, if the provider wrote it unwrapped).
+ */
+function firstBlock(value: unknown): Record<string, unknown> | undefined {
+  const candidate = Array.isArray(value) ? value[0] : value;
+  return candidate && typeof candidate === "object" ? (candidate as Record<string, unknown>) : undefined;
+}
+
+/**
+ * A list of TF server-side-encryption `rule` blocks → the CFN `BucketEncryption`
+ * property. Shared by the bucket's own (deprecated, still state-resident)
+ * `server_side_encryption_configuration` block and by the modern
+ * `aws_s3_bucket_server_side_encryption_configuration` sub-resource, whose
+ * `rule` list has the same shape.
+ */
+function sseRulesToCfn(rules: unknown): unknown {
+  if (!Array.isArray(rules)) return undefined;
+  const cfnRules: Array<Record<string, unknown>> = [];
+  for (const raw of rules) {
+    if (!raw || typeof raw !== "object") continue;
+    const rule = raw as Record<string, unknown>;
+    const out: Record<string, unknown> = {};
+    const byDefault = firstBlock(rule.apply_server_side_encryption_by_default);
+    const algorithm = byDefault?.sse_algorithm;
+    if (typeof algorithm === "string" && algorithm) {
+      const sse: Record<string, unknown> = { SSEAlgorithm: algorithm };
+      const kmsKey = byDefault?.kms_master_key_id;
+      if (typeof kmsKey === "string" && kmsKey) sse.KMSMasterKeyID = kmsKey;
+      out.ServerSideEncryptionByDefault = sse;
+    }
+    if (typeof rule.bucket_key_enabled === "boolean") out.BucketKeyEnabled = rule.bucket_key_enabled;
+    if (Object.keys(out).length) cfnRules.push(out);
+  }
+  return cfnRules.length ? { ServerSideEncryptionConfiguration: cfnRules } : undefined;
+}
+
+/**
+ * The bucket's own deprecated `versioning` block, as state still carries it.
+ * Only an enabled bucket says anything CloudFormation needs: a bucket that
+ * never had versioning has no `VersioningConfiguration` at all, so `enabled =
+ * false` maps to nothing and the block stays in the unmapped comment.
+ */
+function legacyVersioningToCfn(value: unknown): unknown {
+  const block = firstBlock(value);
+  return block?.enabled === true ? { Status: "Enabled" } : undefined;
+}
+
 export const AWS_CARVE_TYPES: AwsCarveType[] = [
   // ── Storage & data ──
   { tfType: "aws_s3_bucket", tier: 1, nativeType: "AWS::S3::Bucket", ctor: "Bucket", identityAttr: "bucket",
-    fields: { bucket: "BucketName" }, tags: true },
+    fields: {
+      bucket: "BucketName",
+      // The provider still resolves these two into the bucket's own state, even
+      // when the config declares them through sub-resources (#1637).
+      server_side_encryption_configuration: { prop: "BucketEncryption", transform: (v) => sseRulesToCfn(firstBlock(v)?.rule) },
+      versioning: { prop: "VersioningConfiguration", transform: legacyVersioningToCfn },
+    }, tags: true },
   { tfType: "aws_dynamodb_table", tier: 2, nativeType: "AWS::DynamoDB::Table", ctor: "Table", identityAttr: "name",
     fields: { name: "TableName", billing_mode: "BillingMode" }, tags: true },
   { tfType: "aws_efs_file_system", tier: 1, nativeType: "AWS::EFS::FileSystem", ctor: "EFSFileSystem",
@@ -267,6 +321,91 @@ export function awsCarveType(tfType: string): AwsCarveType | undefined {
   return BY_TYPE.get(tfType);
 }
 
+/**
+ * How a folded sub-resource (see `FOLDS_INTO`) joins its parent's emitted
+ * properties (#1637). Terraform splits configuration the CloudFormation shape
+ * keeps inside the parent resource, so the fold is not just a carve-set
+ * membership claim: the sub-resource's attributes have to land in the parent's
+ * props, or the emitted resource silently loses what the Terraform declared.
+ */
+export interface AwsFoldMapper {
+  /** Sub-resource attributes this mapper reads. Anything else stays unmapped. */
+  consumes: string[];
+  /** The parent CFN properties this sub-resource contributes. */
+  map: (attrs: Record<string, unknown>) => Record<string, unknown>;
+}
+
+/** Identity and parent-link attributes: never content, never reported unmapped. */
+const FOLD_LINK_ATTRS = new Set(["id", "arn", "bucket"]);
+
+export const AWS_FOLD_MAPPERS: Record<string, AwsFoldMapper> = {
+  aws_s3_bucket_versioning: {
+    consumes: ["versioning_configuration"],
+    map: (attrs) => {
+      const status = firstBlock(attrs.versioning_configuration)?.status;
+      // CFN takes Enabled/Suspended only; TF's third state ("Disabled", write-once
+      // buckets) has no CloudFormation spelling and stays in the comment.
+      return status === "Enabled" || status === "Suspended" ? { VersioningConfiguration: { Status: status } } : {};
+    },
+  },
+  aws_s3_bucket_public_access_block: {
+    consumes: ["block_public_acls", "block_public_policy", "ignore_public_acls", "restrict_public_buckets"],
+    map: (attrs) => {
+      const config: Record<string, unknown> = {};
+      const flags: Array<[string, string]> = [
+        ["block_public_acls", "BlockPublicAcls"],
+        ["block_public_policy", "BlockPublicPolicy"],
+        ["ignore_public_acls", "IgnorePublicAcls"],
+        ["restrict_public_buckets", "RestrictPublicBuckets"],
+      ];
+      for (const [tfAttr, prop] of flags) {
+        if (typeof attrs[tfAttr] === "boolean") config[prop] = attrs[tfAttr];
+      }
+      return Object.keys(config).length ? { PublicAccessBlockConfiguration: config } : {};
+    },
+  },
+  aws_s3_bucket_server_side_encryption_configuration: {
+    consumes: ["rule"],
+    map: (attrs) => {
+      const encryption = sseRulesToCfn(attrs.rule);
+      return encryption ? { BucketEncryption: encryption } : {};
+    },
+  },
+};
+
+/**
+ * Apply a folded sub-resource's state attributes to its parent's properties.
+ *
+ * Returns the props it contributes plus the attributes that stay genuinely
+ * unmappable (which the emitted source preserves in its reference comment). A
+ * mapper that produced nothing consumes nothing — the caller reports the whole
+ * sub-resource rather than claiming a fold that did not happen. `null` means
+ * this sub-resource type has no fold mapping at all.
+ */
+export function applyAwsFold(
+  tfType: string,
+  attrs: Record<string, unknown>,
+): { props: Record<string, unknown>; unmapped: Record<string, unknown> } | null {
+  const mapper = AWS_FOLD_MAPPERS[tfType];
+  if (!mapper) return null;
+  const props = mapper.map(attrs);
+  const consumed = new Set(Object.keys(props).length ? mapper.consumes : []);
+  return { props, unmapped: unmappedFoldAttrs(attrs, consumed) };
+}
+
+/** A folded sub-resource's attributes minus what was consumed and its parent link. */
+export function unmappedFoldAttrs(
+  attrs: Record<string, unknown>,
+  consumed: ReadonlySet<string> = new Set(),
+): Record<string, unknown> {
+  const rest: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(attrs)) {
+    if (consumed.has(key) || FOLD_LINK_ATTRS.has(key)) continue;
+    rest[key] = value;
+  }
+  return rest;
+}
+
 /** TF `tags` map → CloudFormation `Tags` list of {Key, Value}. */
 function tagsToCfn(tags: unknown): Array<{ Key: string; Value: unknown }> | undefined {
   if (!tags || typeof tags !== "object" || Array.isArray(tags)) return undefined;
@@ -291,8 +430,11 @@ export function applyAwsMapper(
     if (typeof spec === "string") {
       props[spec] = value;
     } else {
+      // A transform that declines (undefined) has mapped nothing — the attribute
+      // stays in the unmapped report rather than being claimed and dropped.
       const t = spec.transform(value);
-      if (t !== undefined) props[spec.prop] = t;
+      if (t === undefined) continue;
+      props[spec.prop] = t;
     }
     mappedKeys.push(tfAttr);
   }

package/src/terraform/bridge.test.ts

@@ -110,6 +110,36 @@ describe("generateBridge — inbound (data-source rewrite)", () => {
   });
 });
 
+describe("generateBridge — output blocks (#1638)", () => {
+  const withOutput: Hcl2JsonTree = {
+    resource: { aws_s3_bucket: { assets: [{ bucket: "myapp-assets-prod" }] } },
+    output: { assets_bucket: [{ value: "${aws_s3_bucket.assets.bucket}" }] },
+  };
+  const OUTPUTS_TF = `output "assets_bucket" {\n  value = aws_s3_bucket.assets.bucket\n}\n`;
+
+  test("an output-only dependency still gets a data source and a rewrite", () => {
+    const report = boundaryReport(buildFixtureGraph(withOutput), "aws_s3_bucket.assets")!;
+    const plan = generateBridge(report, [{ path: "outputs.tf", content: OUTPUTS_TF }], identities);
+
+    // Before #1638 the graph could not see the output, so this was an unpatched
+    // dependency: no data source, no rewrite, a broken plan at handoff.
+    expect(plan.dataSources.map((d) => d.address)).toEqual(["aws_s3_bucket.assets"]);
+    expect(plan.outputRewrites).toEqual(["output.assets_bucket"]);
+
+    const rewrite = plan.rewrites.find((r) => r.path === "outputs.tf")!;
+    expect(rewrite.changed).toBe(true);
+    expect(rewrite.rewritten).toContain("value = data.aws_s3_bucket.assets.bucket");
+    expect(plan.runbook).toContain("repoints these output block(s) at the data source: output.assets_bucket");
+  });
+
+  test("no outputs → nothing listed", () => {
+    const report = boundaryReport(buildFixtureGraph(workedExample), "aws_s3_bucket.assets")!;
+    const plan = generateBridge(report, [{ path: "api.tf", content: API_TF }], identities);
+    expect(plan.outputRewrites).toEqual([]);
+    expect(plan.runbook).not.toContain("repoints these output block(s) at the data source");
+  });
+});
+
 describe("generateBridge — outbound (deferred inputs)", () => {
   test("records outbound edges as deferred deploy-time inputs", () => {
     const tree: Hcl2JsonTree = {