@intentius/chant 0.44.6 → 0.44.8

package/src/terraform/bridge.ts

@@ -8,6 +8,8 @@
  *    Bridge: add a `data` source for the (now chant-managed) resource and
  *    rewrite the survivor's `type.name.attr` references to `data.type.name.attr`.
  *    Required immediately, or `terraform plan` errors on the dangling ref.
+ *    An `output` block reading the carved resource is such a survivor (#1638):
+ *    same data source, same textual rewrite, applied to the output's value.
  *
  *  - outbound edge → the carved resource read a value from a survivor. That
  *    value must enter chant from outside synthesis, as a deploy-time input.
@@ -62,6 +64,12 @@ export interface BridgePlan {
   deferredInputs: DeferredInput[];
   /** Every carved address whose own block the rewrites remove, across files. */
   excised: string[];
+  /**
+   * `output` blocks whose value the rewrites repoint at a data source (#1638),
+   * as `output.<name>`. They are inbound edges like any other — listed
+   * separately only because the patch is a one-line expression edit.
+   */
+  outputRewrites: string[];
   runbook: string;
 }
 
@@ -139,13 +147,19 @@ export function generateBridge(
     };
   });
 
+  const outputRewrites = report.inbound
+    .filter((e) => e.bridge === "tf-output-rewrite")
+    .map((e) => e.survivor)
+    .sort();
+
   return {
     target: report.target,
     dataSources,
     rewrites,
     deferredInputs,
     excised,
-    runbook: buildRunbook(report, dataSources, deferredInputs, excised),
+    outputRewrites,
+    runbook: buildRunbook(report, dataSources, deferredInputs, excised, outputRewrites),
   };
 }
 
@@ -155,6 +169,7 @@ function buildRunbook(
   dataSources: DataSourceBlock[],
   deferred: DeferredInput[],
   excised: string[],
+  outputRewrites: string[],
 ): string {
   const carvedAddrs = report.carveSet.map((m) => m.address);
   const L: string[] = [];
@@ -180,6 +195,9 @@ function buildRunbook(
   } else if (!excised.length) {
     L.push("    # no inbound edges — no survivor patch needed.");
   }
+  if (outputRewrites.length) {
+    L.push(`    # and repoints these output block(s) at the data source: ${outputRewrites.join(", ")}`);
+  }
   L.push("    terraform plan   # expect: in-place updates to the survivors only");
   L.push("    terraform apply");
   L.push("");

package/src/terraform/carve.test.ts

@@ -87,6 +87,40 @@ describe("boundaryReport", () => {
     ]);
   });
 
+  test("an output block is an inbound edge with its own bridge kind (#1638)", () => {
+    const tree: Hcl2JsonTree = {
+      resource: { aws_s3_bucket: { assets: [{ bucket: "b" }] } },
+      output: { assets_bucket: [{ value: "${aws_s3_bucket.assets.bucket}" }] },
+    };
+    const report = boundaryReport(buildFixtureGraph(tree), "aws_s3_bucket.assets")!;
+    expect(report.inbound).toEqual([
+      {
+        direction: "inbound",
+        survivor: "output.assets_bucket",
+        carved: "aws_s3_bucket.assets",
+        attrs: ["bucket"],
+        via: ["value"],
+        bridge: "tf-output-rewrite",
+        required: "immediately",
+      },
+    ]);
+    expect(report.peelability).toBe(96); // the cheaper output weight, not 88
+  });
+
+  test("an output on a folded sub-resource is still the parent's boundary work", () => {
+    const tree: Hcl2JsonTree = {
+      resource: {
+        aws_s3_bucket: { assets: [{ bucket: "b" }] },
+        aws_s3_bucket_versioning: { assets: [{ bucket: "${aws_s3_bucket.assets.id}" }] },
+      },
+      output: { versioning_id: [{ value: "${aws_s3_bucket_versioning.assets.id}" }] },
+    };
+    const report = boundaryReport(buildFixtureGraph(tree), "aws_s3_bucket.assets")!;
+    expect(report.inbound.map((e) => [e.survivor, e.carved, e.bridge])).toEqual([
+      ["output.versioning_id", "aws_s3_bucket_versioning.assets", "tf-output-rewrite"],
+    ]);
+  });
+
   test("unsupported type is flagged in diagnostics", () => {
     const tree: Hcl2JsonTree = { resource: { random_pet: { n: [{ length: 2 }] } } };
     const report = boundaryReport(buildFixtureGraph(tree), "random_pet.n")!;

package/src/terraform/graph.test.ts

@@ -157,6 +157,51 @@ describe("buildGraph", () => {
     expect(byAddr["aws_s3_bucket.assets"].identity).toBe("myapp-assets-prod"); // flat attr unaffected
   });
 
+  test("an output block referencing a resource is an inbound edge, tagged as an output (#1638)", () => {
+    const tree: Hcl2JsonTree = {
+      resource: { aws_s3_bucket: { assets: [{ bucket: "x" }] } },
+      output: {
+        assets_bucket: [{ value: "${aws_s3_bucket.assets.bucket}" }],
+        assets_pair: [{ value: ["${aws_s3_bucket.assets.arn}", "${aws_s3_bucket.assets.id}"], description: "both" }],
+      },
+    };
+    const g = buildFixtureGraph(tree);
+
+    // An output is a referrer, never a node — nothing carves an output.
+    expect(g.nodes.map((n) => n.address)).toEqual(["aws_s3_bucket.assets"]);
+    expect(inboundEdges(g, "aws_s3_bucket.assets")).toEqual([
+      {
+        from: "output.assets_bucket",
+        to: "aws_s3_bucket.assets",
+        attrs: ["bucket"],
+        via: ["value"],
+        fromKind: "output",
+      },
+      {
+        from: "output.assets_pair",
+        to: "aws_s3_bucket.assets",
+        attrs: ["arn", "id"],
+        via: ["value"],
+        fromKind: "output",
+      },
+    ]);
+    // Nothing can depend on an output in turn.
+    expect(outboundEdges(g, "output.assets_bucket").map((e) => e.to)).toEqual(["aws_s3_bucket.assets"]);
+    expect(inboundEdges(g, "output.assets_bucket")).toEqual([]);
+  });
+
+  test("an output referencing a var or a data source contributes no edge", () => {
+    const tree: Hcl2JsonTree = {
+      data: { aws_ami: { ubuntu: [{ owners: ["1"] }] } },
+      resource: { aws_s3_bucket: { assets: [{ bucket: "x" }] } },
+      output: {
+        name: [{ value: "${var.name}" }],
+        ami: [{ value: "${data.aws_ami.ubuntu.id}" }],
+      },
+    };
+    expect(buildFixtureGraph(tree).edges).toEqual([]);
+  });
+
   test("var / local references are not edges", () => {
     const tree: Hcl2JsonTree = {
       resource: {

package/src/terraform/graph.ts

@@ -81,9 +81,9 @@ export function refFromAccessor(accessor: string): RawRef | null {
 }
 
 /**
- * Every string value carrying an interpolation across the tree's resource and
- * module blocks — exactly the expressions `parse.ts` must resolve through the
- * AST before `buildGraph` can classify them.
+ * Every string value carrying an interpolation across the tree's resource,
+ * module and output blocks — exactly the expressions `parse.ts` must resolve
+ * through the AST before `buildGraph` can classify them.
  */
 export function collectExpressions(tree: Hcl2JsonTree): string[] {
   const exprs = new Set<string>();
@@ -98,6 +98,7 @@ export function collectExpressions(tree: Hcl2JsonTree): string[] {
   };
   for (const named of Object.values(tree.resource ?? {})) for (const blocks of Object.values(named)) visit(blocks);
   for (const blocks of Object.values(tree.module ?? {})) visit(blocks);
+  for (const blocks of Object.values(tree.output ?? {})) visit(blocks);
   return [...exprs].sort();
 }
 
@@ -167,6 +168,12 @@ function literalIdentity(block: unknown, type: string): string | undefined {
  * marks the referring node dynamic. An edge is recorded only when its target
  * resolves to a known resource/module node — references to `var`/`local`/data
  * are dropped.
+ *
+ * `output` blocks are not nodes either — nothing carves an output — but they
+ * do reference, and a reference to a carved resource breaks the surviving plan
+ * exactly like a resource's does. So an output contributes an edge tagged
+ * `fromKind: "output"` from the pseudo-address `output.<name>` (#1638),
+ * which the scorer weights lower and `carve bridge` patches.
  */
 export function buildGraph(tree: Hcl2JsonTree, exprRefs: ExpressionRefs): TfGraph {
   const nodes: TfNode[] = [];
@@ -216,22 +223,34 @@ export function buildGraph(tree: Hcl2JsonTree, exprRefs: ExpressionRefs): TfGrap
     });
   }
 
+  // Output blocks: referrers without being nodes (#1638). Their pseudo-address
+  // never joins `known`, so nothing can depend on an output in turn.
+  const outputRefs = new Map<string, RawRef[]>();
+  for (const [name, blocks] of Object.entries(tree.output ?? {})) {
+    const block = Array.isArray(blocks) ? blocks[0] : blocks;
+    outputRefs.set(`output.${name}`, refsInBlock(block, exprRefs));
+  }
+
   // Edges: keep only references that resolve to a known node.
   const known = new Set(nodes.map((n) => n.address));
   const edges: TfEdge[] = [];
-  for (const [from, refs] of rawRefsByNode) {
-    const byTarget = new Map<string, { attrs: Set<string>; via: Set<string> }>();
-    for (const ref of refs) {
-      if (ref.address === from || !known.has(ref.address)) continue;
-      if (!byTarget.has(ref.address)) byTarget.set(ref.address, { attrs: new Set(), via: new Set() });
-      const target = byTarget.get(ref.address)!;
-      if (ref.attr) target.attrs.add(ref.attr);
-      if (ref.via) target.via.add(ref.via);
-    }
-    for (const [to, { attrs, via }] of byTarget) {
-      edges.push({ from, to, attrs: [...attrs].sort(), via: [...via].sort() });
+  const collect = (source: Map<string, RawRef[]>, fromKind?: "output"): void => {
+    for (const [from, refs] of source) {
+      const byTarget = new Map<string, { attrs: Set<string>; via: Set<string> }>();
+      for (const ref of refs) {
+        if (ref.address === from || !known.has(ref.address)) continue;
+        if (!byTarget.has(ref.address)) byTarget.set(ref.address, { attrs: new Set(), via: new Set() });
+        const target = byTarget.get(ref.address)!;
+        if (ref.attr) target.attrs.add(ref.attr);
+        if (ref.via) target.via.add(ref.via);
+      }
+      for (const [to, { attrs, via }] of byTarget) {
+        edges.push({ from, to, attrs: [...attrs].sort(), via: [...via].sort(), ...(fromKind ? { fromKind } : {}) });
+      }
     }
-  }
+  };
+  collect(rawRefsByNode);
+  collect(outputRefs, "output");
 
   // Code-point ordering (not localeCompare) so output is locale-independent and
   // punctuation sorts predictably (`.` < `_`).
@@ -242,7 +261,7 @@ export function buildGraph(tree: Hcl2JsonTree, exprRefs: ExpressionRefs): TfGrap
   };
 }
 
-/** Edges where other nodes depend on `address` (each → a surviving-TF data-source patch). */
+/** Edges where something in the surviving Terraform depends on `address`. */
 export function inboundEdges(graph: TfGraph, address: string): TfEdge[] {
   return graph.edges.filter((e) => e.to === address);
 }

package/src/terraform/parse.ts

@@ -68,7 +68,7 @@ async function resolveExpressionRefs(hcl2json: Hcl2Json, tree: Hcl2JsonTree): Pr
   return refs;
 }
 
-/** Deep-merge hcl2json trees across files (resource/module/data namespaces). */
+/** Deep-merge hcl2json trees across files (resource/module/data/output namespaces). */
 function mergeTrees(into: Hcl2JsonTree, next: Hcl2JsonTree): void {
   for (const section of ["resource", "data"] as const) {
     const src = next[section];
@@ -79,6 +79,9 @@ function mergeTrees(into: Hcl2JsonTree, next: Hcl2JsonTree): void {
     }
   }
   if (next.module) into.module = { ...(into.module ?? {}), ...next.module };
+  // Outputs usually live in their own file (#1638) — merge them, or the graph
+  // never sees the estate's outputs.tf at all.
+  if (next.output) into.output = { ...(into.output ?? {}), ...next.output };
 }
 
 /** List every `.tf` file directly under `dir` (non-recursive; matches Terraform's own module scoping). */

package/src/terraform/score.test.ts

@@ -115,6 +115,31 @@ describe("scoreEstate — penalties", () => {
     expect(map["aws_sns_topic.alerts"].score).toBe(88); // 100 - 12*1 inbound
   });
 
+  test("an output block reading a resource costs 4, not 12 (#1638)", () => {
+    const tree: Hcl2JsonTree = {
+      resource: { aws_s3_bucket: { assets: [{ bucket: "b" }] } },
+      output: { assets_bucket: [{ value: "${aws_s3_bucket.assets.bucket}" }] },
+    };
+    const bucket = byAddress(scoreEstate(buildFixtureGraph(tree)))["aws_s3_bucket.assets"];
+    expect(bucket.score).toBe(96); // 100 - 4*1 output
+    expect(bucket.breakdown.outputs).toBe(1);
+    expect(bucket.breakdown.inbound).toBe(0); // not counted as a data-source patch
+    expect(bucket.breakdown.penalties.outputs).toBe(-4);
+  });
+
+  test("an output and a resource reference are counted apart", () => {
+    const tree: Hcl2JsonTree = {
+      resource: {
+        aws_s3_bucket: { assets: [{ bucket: "b" }] },
+        aws_lambda_function: { api: [{ environment: { variables: { B: "${aws_s3_bucket.assets.bucket}" } } }] },
+      },
+      output: { assets_arn: [{ value: "${aws_s3_bucket.assets.arn}" }] },
+    };
+    const bucket = byAddress(scoreEstate(buildFixtureGraph(tree)))["aws_s3_bucket.assets"];
+    expect(bucket.breakdown).toMatchObject({ inbound: 1, outputs: 1 });
+    expect(bucket.score).toBe(84); // 100 - 12 - 4
+  });
+
   test("results are ranked most-peelable first", () => {
     const tree: Hcl2JsonTree = {
       resource: {

package/src/terraform/score.ts

@@ -6,11 +6,18 @@
  *   score = 100
  *     - 12 * inbound          # survivors that depend on this → each a TF data-source patch
  *     -  4 * outbound         # this depends on survivors → a deferred deploy-time input
+ *     -  4 * outputs          # an output block reads this → a one-line rewrite (#1638)
  *     - 15 * (tier - 1)       # native-spec map: tier1=0, tier2=-15, tier3=-30
  *     - 10 * has_dynamic      # count / for_each / data present
  *     -  3 * (instances - 1)  # state-expanded instance count
  *   clamp 0..100   (unsupported provider/type → 0)
  *
+ * An `output` block referencing the target is a real inbound dependency — the
+ * surviving plan errors on the dangling reference — so it cannot score as
+ * free. It is not a data-source patch either: bridging it rewrites one
+ * expression in a block that manages no infrastructure, the same order of work
+ * as recording an outbound deferred input. Hence 4, not 12.
+ *
  * Sub-resources that inline into a parent (see `FOLDS_INTO`) are folded into the
  * parent's carve set: they are removed from the ranking and their edge to the
  * parent is not counted as inbound — inlining them is free, not boundary work.
@@ -23,8 +30,11 @@ import type { TfGraph, TfNode } from "./types";
 export type PeelabilityBand = "clean leaf" | "carvable w/ edits" | "leave in Terraform";
 
 export interface PeelabilityBreakdown {
+  /** Inbound edges from resource/module blocks — a data-source patch each. */
   inbound: number;
   outbound: number;
+  /** Inbound edges from `output` blocks — a one-line rewrite each (#1638). */
+  outputs: number;
   tier: 1 | 2 | 3 | null;
   hasDynamic: boolean;
   instances: number;
@@ -32,6 +42,7 @@ export interface PeelabilityBreakdown {
   penalties: {
     inbound: number;
     outbound: number;
+    outputs: number;
     tier: number;
     dynamic: number;
     instances: number;
@@ -82,8 +93,11 @@ function computeFolds(graph: TfGraph): { folded: Set<string>; childrenOf: Map<st
 }
 
 function scoreNode(node: TfNode, graph: TfGraph, foldedChildren: Set<string>): Peelability {
-  // Inbound excludes edges from this node's own folded sub-resources.
-  const inbound = inboundEdges(graph, node.address).filter((e) => !foldedChildren.has(e.from)).length;
+  // Inbound excludes edges from this node's own folded sub-resources, and
+  // counts output blocks separately — they cost less to bridge (#1638).
+  const inboundAll = inboundEdges(graph, node.address).filter((e) => !foldedChildren.has(e.from));
+  const inbound = inboundAll.filter((e) => e.fromKind !== "output").length;
+  const outputs = inboundAll.length - inbound;
   const outbound = outboundEdges(graph, node.address).length;
 
   const tierInfo = node.kind === "module" ? { tier: MODULE_TIER, mapsTo: undefined } : resolveTier(node.type!);
@@ -99,10 +113,11 @@ function scoreNode(node: TfNode, graph: TfGraph, foldedChildren: Set<string>): P
       breakdown: {
         inbound,
         outbound,
+        outputs,
         tier: null,
         hasDynamic: node.hasDynamic,
         instances: node.instances,
-        penalties: { inbound: 0, outbound: 0, tier: 0, dynamic: 0, instances: 0 },
+        penalties: { inbound: 0, outbound: 0, outputs: 0, tier: 0, dynamic: 0, instances: 0 },
       },
     };
   }
@@ -110,12 +125,19 @@ function scoreNode(node: TfNode, graph: TfGraph, foldedChildren: Set<string>): P
   const penalties = {
     inbound: -12 * inbound,
     outbound: -4 * outbound,
+    outputs: -4 * outputs,
     tier: -15 * (tier - 1),
     dynamic: node.hasDynamic ? -10 : 0,
     instances: -3 * Math.max(0, node.instances - 1),
   };
   const score = clamp(
-    100 + penalties.inbound + penalties.outbound + penalties.tier + penalties.dynamic + penalties.instances,
+    100 +
+      penalties.inbound +
+      penalties.outbound +
+      penalties.outputs +
+      penalties.tier +
+      penalties.dynamic +
+      penalties.instances,
   );
 
   return {
@@ -127,6 +149,7 @@ function scoreNode(node: TfNode, graph: TfGraph, foldedChildren: Set<string>): P
     breakdown: {
       inbound,
       outbound,
+      outputs,
       tier,
       hasDynamic: node.hasDynamic,
       instances: node.instances,

package/src/terraform/types.ts

@@ -46,6 +46,15 @@ export interface TfNode {
 export interface TfEdge {
   from: string;
   to: string;
+  /**
+   * The kind of block the reference came from, when it is not one of the
+   * graph's own nodes. `"output"` marks a root-module `output` block (#1638):
+   * a real dependency — `terraform plan` errors on the dangling reference the
+   * moment the carve lands — but a cheaper one to bridge than a resource's,
+   * since the patch is a single expression edit in a block that manages
+   * nothing. Absent means the reference came from a resource or module node.
+   */
+  fromKind?: "output";
   /** The attribute path(s) referenced, e.g. `["id", "arn"]`. */
   attrs: string[];
   /**
@@ -72,5 +81,7 @@ export interface Hcl2JsonTree {
   resource?: Record<string, Record<string, unknown[]>>;
   module?: Record<string, unknown[]>;
   data?: Record<string, Record<string, unknown[]>>;
+  /** Root-module `output` blocks. Not nodes — they reference, they are not carvable (#1638). */
+  output?: Record<string, unknown[]>;
   [k: string]: unknown;
 }