[vaishakdinesh]

Two resources replaced an expression with a literal, because each read only the first token of the expression. The result looked well-formed in both cases, so neither was caught by validation.

Device profile precedence

A custom profile whose precedence came from an expression had that expression replaced by a literal. Every affected profile then shared one precedence, so their relative order collapsed and the wrong WARP profile could match for a user or device.

The value was read as string(tokens[0].Bytes) and handed to gjson.Parse. For index(local.order, "x") that is the bare word index, which gjson reports as Number 0, producing 900 + 0.

The leading token also decides which wrong answer appears. local is not valid JSON, so gjson reports it absent, the 100.0 default survives, and local.base_precedence silently became 1000 rather than 900:

v4	before	after
index(local.order, "a")	900	900 + (index(local.order, "a"))
index(local.order, "b")	900 ← collides	900 + (index(local.order, "b"))
local.base_precedence	1000	900 + (local.base_precedence)
var.use_high ? 5 : 20	900	900 + (var.use_high ? 5 : 20)
10	910	910 unchanged

Non-literals are preserved and offset at apply time rather than replaced. That keeps both properties the literal path had: the expression still distinguishes the profiles, and the result still lands in the band that keeps migrated precedences away from profiles the account already has. The band also guarantees a positive value, which matters because index() is zero-based and the API rejects a precedence of 0.

The parentheses are load-bearing. A conditional binds more loosely than addition, so var.use_high ? 5 : 20 would otherwise re-associate to (900 + var.use_high) ? 5 : 20.

An existing integration fixture had enshrined the bug: a for_each profile with precedence = each.value.precedence expected 1000 — one precedence for every instance, a guaranteed collision locked in by a passing test.

Spectrum origin_port_range

Same defect, and it fails more quietly. v4's origin_port_range block becomes a single v5 origin_port string, and each bound was read the same way:

v4 bounds	before	after
1000, 2000	"1000-2000"	unchanged
var.port_start, var.port_end	"var-var"	"${var.port_start}-${var.port_end}"
1000, local.lo + 5	"1000-local"	"1000-${local.lo + 5}"
var.port_start, 2000	"var-2000"	"${var.port_start}-2000"

The result is a syntactically valid string, so terraform validate accepts "var-var" — I confirmed this. The configuration only breaks when the API rejects the port range at apply. Ranges with two literal bounds still take the existing cty path and are byte-for-byte unchanged.

Literal runs are emitted as one token each, matching how HCL parses the equivalent hand-written string. Emitting "1000", "-", "2000" as three tokens renders identically but broke two pre-existing tests, because the semantic comparator compares token counts.

origin_port_range had no test coverage at all — no unit case, no fixture — which is why this survived. Added the four permutations as unit tests. Deliberately not added to the integration fixture: that resource has no _e2e.tf variant, so its single input file doubles as the e2e configuration, and new cases there would create real Spectrum applications.

Shared

Both fixes go through two new helpers, since reading the first token of an expression is the underlying mistake in each:

• tfhcl.LiteralNumber — reports whether an expression is a bare numeric literal, so only a value that can safely be folded is folded
• tfhcl.TrimLeadingSpace — prepares expression tokens for re-embedding, copying the first token rather than mutating tokens shared with the source attribute

Verification

Against provider v5.28.1: every case above validates, the Spectrum output is terraform fmt clean, and two profiles ordered by index() now receive distinct precedences.

Revert-proof — emulating the old first-token read fails the three new precedence tests and the two new Spectrum expression tests.

Green: build, go vet, go test ./internal/..., go test -race ./integration/..., make lint-testdata, gofmt on all touched files.

Note: gofmt -l internal/ flags ~55 files untouched by this branch, all a trailing blank line at EOF. Pre-existing, left alone.