fix: compute manual building block outputs from the API

Manual building block definitions have their outputs derived from the
inputs on the backend (one output per input, assignment type NONE, with
SINGLE_SELECT/MULTI_SELECT/LIST translated). Configuring outputs that
mirror the inputs caused "Provider produced inconsistent result after
apply" whenever the backend added or changed an output the config did not
predict, especially when toggling draft false->true together with input
changes (#131, #176).

version_spec.outputs is now Optional+Computed without a static default:
omit it for manual building blocks and it is reconciled from the API. The
plan leaves outputs (and the content hash) unknown when the inputs or the
configured PLATFORM_TENANT_ID outputs change, and reuses the reconciled
state value otherwise. ValidateConfig rejects manual outputs with any
assignment_type other than PLATFORM_TENANT_ID, which the backend still
honors to mark the tenant-id output. The mock client mirrors the backend's
manual output generation so unit tests cover the behavior.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: grubmeshi

CHANGELOG.md

@@ -1,6 +1,10 @@
 # v0.21.1
 
+BREAKING CHANGES:
+- `meshstack_building_block_definition`: For manual building blocks, `version_spec.outputs` is now computed from the API and must be omitted from configuration — the backend derives one output per input. Configuring an output with any `assignment_type` other than `PLATFORM_TENANT_ID` is now rejected. Remove `outputs` blocks from manual building block definitions; you may still declare an output with `assignment_type = "PLATFORM_TENANT_ID"` to mark which output carries the tenant id.
+
 FIXES:
+- `meshstack_building_block_definition`: Fixed "Provider produced inconsistent result after apply" for manual building blocks whose outputs the backend auto-generates from inputs (e.g. `SINGLE_SELECT`/`STATIC` inputs), including when toggling `version_spec.draft` from `false` to `true` together with input changes ([#131](https://github.com/meshcloud/terraform-provider-meshstack/issues/131), [#176](https://github.com/meshcloud/terraform-provider-meshstack/issues/176)). Outputs are now reconciled from the API response.
 - When no `runner_ref` is provided, the new shared building block runner UUID `98520496-627d-43e6-82da-ce499179ff3f` is used which is suitable for all implementation types.
   Existing `building_block_definition` resources will see a plan change addressing this migration to a single shared runner. 
   Using the old shared runner UUIDs is deprecated but handled gracefully by the API.

docs/resources/building_block_definition.md

@@ -215,14 +215,8 @@ resource "meshstack_building_block_definition" "example_03_manual" {
       manual = {}
     }
 
-    # Output keys must match with inputs, as the backend copies over inputs to outputs
-    outputs = {
-      approval_required = {
-        display_name    = "Approval Required"
-        type            = "BOOLEAN"
-        assignment_type = "NONE"
-      }
-    }
+    # Outputs are omitted for manual building blocks: the backend derives them from the inputs
+    # (one output per input), so version_spec.outputs is computed and must not be set here.
   }
 }
 ```
@@ -395,7 +389,7 @@ Optional:
 - `dependency_refs` (Attributes Set) Set of refs to building block definitions this definition depends on. Prefer reusable refs from `meshstack_building_block_definition.<name>.ref` or `one(data.meshstack_building_block_definitions.<name>.building_block_definitions).ref`. (see [below for nested schema](#nestedatt--version_spec--dependency_refs))
 - `inputs` (Attributes Map) Map of input definitions for the building block. Keys are input names, values are input configuration objects. Inputs define parameters that building blocks can receive. (see [below for nested schema](#nestedatt--version_spec--inputs))
 - `only_apply_once_per_tenant` (Boolean) Whether this building block can only be applied once per tenant.
-- `outputs` (Attributes Map) Map of output definitions for the building block. Keys are output names, values are output configuration objects. Outputs define values that building blocks produce and can be consumed by other building blocks. (see [below for nested schema](#nestedatt--version_spec--outputs))
+- `outputs` (Attributes Map) Map of output definitions for the building block. Keys are output names, values are output configuration objects. Outputs define values that building blocks produce and can be consumed by other building blocks. If implementation type is `manual`, outputs are computed from the API response, so omit this attribute entirely unless you want to specify a static `assignment_type = "PLATFORM_TENANT_ID"` as part of a landing zone. (see [below for nested schema](#nestedatt--version_spec--outputs))
 - `permissions` (Set of String) Set of API permissions required by this building block. Will provide building block runs with an ephemeral API token with the specified workspace permissions. See [Workspace Permissions](https://docs.meshcloud.io/api/authentication/api-permissions/) for available values and [documentation on ephemeral API keys](https://docs.dev.meshcloud.io/concepts/building-block/#ephemeral-api-keys).
 - `runner_ref` (Attributes) Reference to the runner to run the implementation. If omitted, the pre-defined shared runner is used suitable for the given `implementation` choice (see [below for nested schema](#nestedatt--version_spec--runner_ref))
 

examples/resources/meshstack_building_block_definition/resource_03_manual.tf

@@ -24,13 +24,7 @@ resource "meshstack_building_block_definition" "example_03_manual" {
       manual = {}
     }
 
-    # Output keys must match with inputs, as the backend copies over inputs to outputs
-    outputs = {
-      approval_required = {
-        display_name    = "Approval Required"
-        type            = "BOOLEAN"
-        assignment_type = "NONE"
-      }
-    }
+    # Outputs are omitted for manual building blocks: the backend derives them from the inputs
+    # (one output per input), so version_spec.outputs is computed and must not be set here.
   }
 }

examples/resources/meshstack_building_block_v2/test-support_01_workspace.tf

@@ -50,33 +50,7 @@ resource "meshstack_building_block_definition" "example" {
       manual = {}
     }
 
-    # Output keys must match with inputs, as the backend copies over inputs to outputs for manual implementations.
-    outputs = {
-      name = {
-        display_name    = "Name"
-        type            = "STRING"
-        assignment_type = "NONE"
-      }
-      size = {
-        display_name    = "Size"
-        type            = "INTEGER"
-        assignment_type = "NONE"
-      }
-      environment = {
-        display_name    = "Environment"
-        type            = "STRING"
-        assignment_type = "NONE"
-      }
-      region = {
-        display_name    = "Region"
-        type            = "STRING"
-        assignment_type = "NONE"
-      }
-      enable_monitoring = {
-        display_name    = "Enable Monitoring"
-        type            = "BOOLEAN"
-        assignment_type = "NONE"
-      }
-    }
+    # Outputs are omitted for manual building blocks: the backend derives them from the inputs, so
+    # version_spec.outputs is computed and must not be set here.
   }
 }

examples/resources/meshstack_building_block_v2/test-support_02_tenant.tf

@@ -40,23 +40,7 @@ resource "meshstack_building_block_definition" "bb_v2_tenant_bbd" {
       manual = {}
     }
 
-    # Output keys must match with inputs, as the backend copies over inputs to outputs for manual implementations.
-    outputs = {
-      name = {
-        display_name    = "Name"
-        type            = "STRING"
-        assignment_type = "NONE"
-      }
-      size = {
-        display_name    = "Size"
-        type            = "INTEGER"
-        assignment_type = "NONE"
-      }
-      environment = {
-        display_name    = "Environment"
-        type            = "STRING"
-        assignment_type = "NONE"
-      }
-    }
+    # Outputs are omitted for manual building blocks: the backend derives them from the inputs, so
+    # version_spec.outputs is computed and must not be set here.
   }
 }

internal/clientmock/mock_buildingblock_definition_version.go

@@ -28,6 +28,7 @@ func (m meshBuildingBlockDefinitionVersionClient) Create(_ context.Context, owne
 	versionUuid := uuid.NewString()
 	// Compute hashes for all secrets in the spec
 	backendSecretBehavior(true, &versionSpec, nil)
+	applyManualOutputBehavior(&versionSpec)
 
 	// Set version number if not already set
 	if versionSpec.VersionNumber == nil {
@@ -51,6 +52,7 @@ func (m meshBuildingBlockDefinitionVersionClient) Update(_ context.Context, uuid
 	if existing, ok := m.Store.Get(uuid); ok {
 		// Compute hashes for all secrets in the spec
 		backendSecretBehavior(false, &versionSpec, &existing.Spec)
+		applyManualOutputBehavior(&versionSpec)
 		if existing.Metadata.OwnedByWorkspace != ownedByWorkspace {
 			return nil, fmt.Errorf("mismatching workspace ownership: %s (existing) != %s (expected)", existing.Metadata.OwnedByWorkspace, ownedByWorkspace)
 		}
@@ -60,6 +62,49 @@ func (m meshBuildingBlockDefinitionVersionClient) Update(_ context.Context, uuid
 	return nil, fmt.Errorf("building block definition version not found: %s", uuid)
 }
 
+// applyManualOutputBehavior mirrors the real backend's ManualBuildingBlockCreationModule: for manual
+// building blocks the outputs are derived from the inputs (one output per input, assignment type NONE,
+// with SINGLE_SELECT/MULTI_SELECT/LIST input types translated to output-compatible types). Any output the
+// caller marked PLATFORM_TENANT_ID keeps that assignment for the matching input; all other supplied
+// outputs are ignored, matching the backend.
+func applyManualOutputBehavior(versionSpec *client.MeshBuildingBlockDefinitionVersionSpec) {
+	if versionSpec.Implementation.Manual == nil {
+		return
+	}
+	platformTenantIdKeys := map[string]bool{}
+	for key, output := range versionSpec.Outputs {
+		if output.AssignmentType == client.MeshBuildingBlockDefinitionOutputAssignmentTypePlatformTenantID.Unwrap() {
+			platformTenantIdKeys[key] = true
+		}
+	}
+	outputs := make(map[string]client.MeshBuildingBlockDefinitionOutput, len(versionSpec.Inputs))
+	for key, input := range versionSpec.Inputs {
+		assignmentType := client.MeshBuildingBlockDefinitionOutputAssignmentTypeNone.Unwrap()
+		if platformTenantIdKeys[key] {
+			assignmentType = client.MeshBuildingBlockDefinitionOutputAssignmentTypePlatformTenantID.Unwrap()
+		}
+		outputs[key] = client.MeshBuildingBlockDefinitionOutput{
+			DisplayName:    input.DisplayName,
+			Type:           translateManualInputTypeToOutput(input.Type),
+			AssignmentType: assignmentType,
+		}
+	}
+	versionSpec.Outputs = outputs
+}
+
+// translateManualInputTypeToOutput mirrors backend ManualIOTypeTranslation: SINGLE_SELECT, MULTI_SELECT
+// and LIST cannot be output types and are translated; all other types are kept as-is.
+func translateManualInputTypeToOutput(inputType client.MeshBuildingBlockIOType) client.MeshBuildingBlockIOType {
+	switch inputType {
+	case client.MeshBuildingBlockIOTypeSingleSelect.Unwrap():
+		return client.MeshBuildingBlockIOTypeString.Unwrap()
+	case client.MeshBuildingBlockIOTypeMultiSelect.Unwrap(), client.MeshBuildingBlockIOTypeList.Unwrap():
+		return client.MeshBuildingBlockIOTypeCode.Unwrap()
+	default:
+		return inputType
+	}
+}
+
 func (m meshBuildingBlockDefinitionVersionClient) getNextVersionNumber() int {
 	maxNum := 0
 	for _, v := range m.Store.Values() {

internal/provider/building_block_definition_resource.go

@@ -3,6 +3,7 @@ package provider
 import (
 	"context"
 	"fmt"
+	"maps"
 	"slices"
 
 	"github.com/hashicorp/terraform-plugin-framework/diag"
@@ -16,10 +17,11 @@ import (
 )
 
 var (
-	_ resource.Resource                = &buildingBlockDefinitionResource{}
-	_ resource.ResourceWithConfigure   = &buildingBlockDefinitionResource{}
-	_ resource.ResourceWithImportState = &buildingBlockDefinitionResource{}
-	_ resource.ResourceWithModifyPlan  = &buildingBlockDefinitionResource{}
+	_ resource.Resource                   = &buildingBlockDefinitionResource{}
+	_ resource.ResourceWithConfigure      = &buildingBlockDefinitionResource{}
+	_ resource.ResourceWithImportState    = &buildingBlockDefinitionResource{}
+	_ resource.ResourceWithModifyPlan     = &buildingBlockDefinitionResource{}
+	_ resource.ResourceWithValidateConfig = &buildingBlockDefinitionResource{}
 )
 
 func NewBuildingBlockDefinitionResource() resource.Resource {
@@ -86,6 +88,14 @@ func (r *buildingBlockDefinitionResource) Create(ctx context.Context, req resour
 	// Updating the empty created version with provided configuration to complete creation
 	versionUuid := createdEmptyVersion.Metadata.Uuid
 	createVersionSpecDto := plan.VersionSpec.ToClientDto(bbdUuid)
+	if createVersionSpecDto.Implementation.Manual != nil {
+		// Manual outputs are computed (left unknown in the plan), so source the configured
+		// PLATFORM_TENANT_ID hints straight from config to send them to the backend.
+		createVersionSpecDto.Outputs = manualConfiguredOutputs(ctx, req.Config, &resp.Diagnostics)
+		if resp.Diagnostics.HasError() {
+			return
+		}
+	}
 	createdVersionDto, err := r.buildingBlockDefinitionVersionClient.Update(ctx, versionUuid, createdDto.Metadata.OwnedByWorkspace, createVersionSpecDto)
 	if err != nil {
 		resp.Diagnostics.AddError("Error updating initial version", fmt.Sprintf(
@@ -144,6 +154,89 @@ func (r *buildingBlockDefinitionResource) Read(ctx context.Context, req resource
 		buildingBlockDefinitionConverterOptions().Append(buildingBlockDefinitionVersionConverterOptions(ctx, nil, nil, req.State)...)...)...)
 }
 
+func (r *buildingBlockDefinitionResource) ValidateConfig(ctx context.Context, req resource.ValidateConfigRequest, resp *resource.ValidateConfigResponse) {
+	manualPath := path.Root("version_spec").AtName("implementation").AtName("manual")
+	outputsPath := path.Root("version_spec").AtName("outputs")
+
+	var manual types.Object
+	resp.Diagnostics.Append(req.Config.GetAttribute(ctx, manualPath, &manual)...)
+	var outputs types.Map
+	resp.Diagnostics.Append(req.Config.GetAttribute(ctx, outputsPath, &outputs)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	// Manual building blocks derive their outputs from the inputs on the backend (one output per input,
+	// assignment type NONE). The backend only honors outputs the user marks with assignment type
+	// PLATFORM_TENANT_ID; everything else it regenerates. So configuring any non-PLATFORM_TENANT_ID output
+	// for a manual building block is rejected here - omit it and let it be computed (see issues #131, #176).
+	if manual.IsNull() || manual.IsUnknown() || outputs.IsNull() || outputs.IsUnknown() {
+		return
+	}
+	for key, assignmentType := range outputAssignmentTypes(outputs) {
+		if assignmentType != "" && assignmentType != client.MeshBuildingBlockDefinitionOutputAssignmentTypePlatformTenantID.String() {
+			resp.Diagnostics.AddAttributeError(
+				outputsPath.AtMapKey(key),
+				"manual building block outputs may only assign PLATFORM_TENANT_ID",
+				fmt.Sprintf("Manual building block definitions derive their outputs from the inputs automatically. "+
+					"Output %q has assignment_type %q; remove it so it can be computed from the API response. "+
+					"Only outputs with assignment_type %s may be configured (to mark which output carries the tenant id).",
+					key, assignmentType, client.MeshBuildingBlockDefinitionOutputAssignmentTypePlatformTenantID),
+			)
+		}
+	}
+}
+
+// outputAssignmentTypes returns the assignment_type of each output in the given map (keyed by output name),
+// skipping null/unknown maps and elements. Unknown assignment types yield an empty string.
+func outputAssignmentTypes(outputs types.Map) map[string]string {
+	result := map[string]string{}
+	if outputs.IsNull() || outputs.IsUnknown() {
+		return result
+	}
+	for key, elem := range outputs.Elements() {
+		obj, ok := elem.(types.Object)
+		if !ok || obj.IsNull() || obj.IsUnknown() {
+			continue
+		}
+		assignmentType, ok := obj.Attributes()["assignment_type"].(types.String)
+		if !ok || assignmentType.IsNull() || assignmentType.IsUnknown() {
+			continue
+		}
+		result[key] = assignmentType.ValueString()
+	}
+	return result
+}
+
+// platformTenantIdOutputKeysEqual reports whether the set of output keys assigned PLATFORM_TENANT_ID is
+// the same in both maps. Used to detect whether a manual building block's configured tenant-id output
+// changed, which (besides an inputs change) is the only way its reconciled outputs can change.
+func platformTenantIdOutputKeysEqual(a, b types.Map) bool {
+	tenantIdKeys := func(m types.Map) map[string]struct{} {
+		keys := map[string]struct{}{}
+		for key, assignmentType := range outputAssignmentTypes(m) {
+			if assignmentType == client.MeshBuildingBlockDefinitionOutputAssignmentTypePlatformTenantID.String() {
+				keys[key] = struct{}{}
+			}
+		}
+		return keys
+	}
+	return maps.Equal(tenantIdKeys(a), tenantIdKeys(b))
+}
+
+// manualConfiguredOutputs reads the user-configured version_spec.outputs (the PLATFORM_TENANT_ID hints)
+// from config so they can be sent to the backend even though the planned outputs value is left unknown
+// for manual building blocks. Returns an empty map when outputs are omitted.
+func manualConfiguredOutputs(ctx context.Context, config generic.AttributeGetter, diags *diag.Diagnostics) map[string]client.MeshBuildingBlockDefinitionOutput {
+	outputs := generic.GetAttribute[map[string]client.MeshBuildingBlockDefinitionOutput](
+		ctx, config, path.Root("version_spec").AtName("outputs"), diags, generic.WithSetUnknownValueToZero())
+	if outputs == nil {
+		// The backend rejects a null outputs property, so send an empty map when none are configured.
+		outputs = map[string]client.MeshBuildingBlockDefinitionOutput{}
+	}
+	return outputs
+}
+
 func (r *buildingBlockDefinitionResource) ModifyPlan(ctx context.Context, req resource.ModifyPlanRequest, resp *resource.ModifyPlanResponse) {
 	if req.Plan.Raw.IsNull() {
 		// do nothing in case of delete
@@ -188,9 +281,44 @@ func (r *buildingBlockDefinitionResource) ModifyPlan(ctx context.Context, req re
 		return
 	}
 
+	// Manual building blocks have backend-derived outputs: the backend mirrors every input into an output
+	// (assignment type NONE), preserving only outputs the user marked PLATFORM_TENANT_ID (see issues #131
+	// and #176, and ValidateConfig). We cannot fully predict the reconciled outputs at plan time, so
+	// whenever the inputs or the configured PLATFORM_TENANT_ID outputs change we leave outputs - and the
+	// content hash that includes them - unknown and let the apply reconcile them from the API response.
+	// Otherwise we reuse the reconciled value from state, which also avoids a perpetual diff between the
+	// (partial) configured outputs and the (full) stored outputs. Non-manual implementations configure
+	// outputs explicitly and the backend does not derive them, so they are left untouched here.
+	outputsPath := path.Root("version_spec").AtName("outputs")
+	inputsPath := path.Root("version_spec").AtName("inputs")
+	manualPath := path.Root("version_spec").AtName("implementation").AtName("manual")
+	versionSpecOutputsUncertain := false
+	var manual types.Object
+	resp.Diagnostics.Append(req.Plan.GetAttribute(ctx, manualPath, &manual)...)
+	if !manual.IsNull() && !manual.IsUnknown() {
+		var planInputs, stateInputs, configOutputs, stateOutputs types.Map
+		resp.Diagnostics.Append(req.Plan.GetAttribute(ctx, inputsPath, &planInputs)...)
+		resp.Diagnostics.Append(req.State.GetAttribute(ctx, inputsPath, &stateInputs)...)
+		resp.Diagnostics.Append(req.Config.GetAttribute(ctx, outputsPath, &configOutputs)...)
+		resp.Diagnostics.Append(req.State.GetAttribute(ctx, outputsPath, &stateOutputs)...)
+		if resp.Diagnostics.HasError() {
+			return
+		}
+		versionSpecOutputsUncertain = !planInputs.Equal(stateInputs) ||
+			!platformTenantIdOutputKeysEqual(configOutputs, stateOutputs)
+		if versionSpecOutputsUncertain {
+			resp.Diagnostics.Append(resp.Plan.SetAttribute(ctx, outputsPath, types.MapUnknown(stateOutputs.ElementType(ctx)))...)
+		} else {
+			resp.Diagnostics.Append(resp.Plan.SetAttribute(ctx, outputsPath, stateOutputs)...)
+		}
+		if resp.Diagnostics.HasError() {
+			return
+		}
+	}
+
 	// Determine this very carefully and leave it unknown if the underlying version_spec has unknown values somewhere deep down
 	versionSpecContentHash := func() (result generic.NullIsUnknown[string]) {
-		if versionSpecSecretsChanged {
+		if versionSpecSecretsChanged || versionSpecOutputsUncertain {
 			return
 		}
 		versionSpecPath := path.Root("version_spec")
@@ -301,6 +429,14 @@ func (r *buildingBlockDefinitionResource) Update(ctx context.Context, req resour
 	// Handle version_spec update logic
 
 	versionSpecDto := plan.VersionSpec.ToClientDto(bbdUuid)
+	if versionSpecDto.Implementation.Manual != nil {
+		// Manual outputs are computed (left unknown in the plan), so source the configured
+		// PLATFORM_TENANT_ID hints straight from config to send them to the backend.
+		versionSpecDto.Outputs = manualConfiguredOutputs(ctx, req.Config, &resp.Diagnostics)
+		if resp.Diagnostics.HasError() {
+			return
+		}
+	}
 
 	var updatedVersionDto *client.MeshBuildingBlockDefinitionVersion
 	switch {