Dependency Graph

Kyku builds a directed acyclic graph (DAG) from your config automatically. The graph determines create and destroy order, enabling safe parallel execution.

How Edges Are Created

The GraphBuilder scans every property of every resource for BaseResource references:

Reference Type	Edge Created?	Example
Object reference	✅ Yes	vm.network = myVpc → Vm → Vpc
Array of objects	✅ Yes (per element)	vm.securityGroups = [sg1, sg2]
String reference	❌ No	vm.network = "vpc-main"
Tags / labels	❌ No	vm.tags = { env: "prod" }
Output values	✅ Yes	lbTargets: [{ vm: server.outputs.instanceId }]

Always use object references for properties that represent cloud dependencies. String references bypass the dependency graph and may cause ordering issues.

Ignored Properties

The following properties never create edges:

• type, id, name, provider, tags, outputs

Create Order

Root nodes (level 0) are created first. Each level waits for all lower levels to complete:

Level 0:  Vpc
Level 1:  SecurityGroup (depends on Vpc)
Level 2:  Vm (depends on Vpc, SecurityGroup)
Level 3:  LoadBalancer (depends on Vpc, Vm)

Resources at the same level with no mutual dependencies are created in parallel.

Destroy Order

Destroy order is the reverse of create order — leaves first:

Level 3:  LoadBalancer
Level 2:  Vm
Level 1:  SecurityGroup
Level 0:  Vpc

Viewing the Graph

ASCII Tree

kyku graph

Output:

Vpc (vpc-main) [level 0]
└── depends on:
└── depended on by: SecurityGroup (sg-web), Vm (vm-web)
SecurityGroup (sg-web) [level 1]
└── depends on: Vpc (vpc-main)
└── depended on by: Vm (vm-web)
Vm (vm-web) [level 2]
└── depends on: Vpc (vpc-main), SecurityGroup (sg-web)

Graphviz DOT

kyku graph --dot > graph.dot
dot -Tsvg graph.dot > graph.svg

The DOT output assigns distinct shapes and colors per resource type for visual inspection.

Verify Your Config

kyku graph -c ./my-config.ts

Check that:

• Every depends on ID appears as a node in the graph
• No orphan resources (unless truly standalone like SshKey)
• Create order is correct (roots appear first)
• Destroy order matches the reverse of levels
• No cycles (cycles are detected and throw a CycleError)