@intentius/chant-lexicon-aws 0.15.3 → 0.16.0

package/src/live-attrs.test.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect } from "vitest";
+import { resolveTemplateAttrs } from "./live-attrs";
+import { reconstructEdges } from "@intentius/chant/graph-refs";
+import type { IRNode } from "@intentius/chant/graph-ir";
+import { awsReferenceCatalog } from "./reference-catalog";
+import type { ExportedTemplate } from "@intentius/chant/lexicon";
+
+const tmpl = (resources: Array<{ logicalId: string; type: string; properties: Record<string, unknown> }>): ExportedTemplate =>
+  ({ resources, parameters: [], outputs: {} }) as unknown as ExportedTemplate;
+
+describe("resolveTemplateAttrs", () => {
+  it("resolves {Ref} and {Fn::GetAtt} intrinsics to bare logical ids", () => {
+    const attrs = resolveTemplateAttrs(
+      tmpl([
+        { logicalId: "Subnet", type: "AWS::EC2::Subnet", properties: { VpcId: { Ref: "Vpc" }, CidrBlock: "10.0.1.0/24" } },
+        { logicalId: "Listener", type: "AWS::ElasticLoadBalancingV2::Listener", properties: { LoadBalancerArn: { "Fn::GetAtt": ["Alb", "Arn"] } } },
+      ]),
+    );
+    expect(attrs.Subnet).toEqual({ VpcId: "Vpc", CidrBlock: "10.0.1.0/24" });
+    expect(attrs.Listener).toEqual({ LoadBalancerArn: "Alb" });
+  });
+
+  it("resolves intrinsics nested in arrays and objects", () => {
+    const attrs = resolveTemplateAttrs(
+      tmpl([
+        { logicalId: "Inst", type: "AWS::EC2::Instance", properties: { SecurityGroupIds: [{ Ref: "SgA" }, { Ref: "SgB" }], Nested: { SubnetId: { Ref: "Sn" } } } },
+      ]),
+    );
+    expect(attrs.Inst.SecurityGroupIds).toEqual(["SgA", "SgB"]);
+    expect(attrs.Inst.Nested).toEqual({ SubnetId: "Sn" });
+  });
+});
+
+describe("live edges from a CloudFormation template (#784)", () => {
+  it("reconstructs containment + edges from resolved template attrs", () => {
+    const template = tmpl([
+      { logicalId: "Vpc", type: "AWS::EC2::VPC", properties: { CidrBlock: "10.0.0.0/16" } },
+      { logicalId: "Subnet", type: "AWS::EC2::Subnet", properties: { VpcId: { Ref: "Vpc" } } },
+      { logicalId: "Sg", type: "AWS::EC2::SecurityGroup", properties: { VpcId: { Ref: "Vpc" } } },
+      { logicalId: "Inst", type: "AWS::EC2::Instance", properties: { SubnetId: { Ref: "Subnet" }, SecurityGroupIds: [{ Ref: "Sg" }] } },
+    ]);
+    const attrsById = resolveTemplateAttrs(template);
+    const nodes: IRNode[] = template.resources.map((r) => ({ id: r.logicalId, kind: r.type, lexicon: "aws", attrs: attrsById[r.logicalId] }));
+
+    const { edges, containment, dangling } = reconstructEdges(nodes, awsReferenceCatalog);
+    // containment: subnet and sg are inside the VPC; the instance is inside the subnet
+    expect(containment).toContainEqual({ child: "Subnet", parent: "Vpc", label: "in VPC" });
+    expect(containment).toContainEqual({ child: "Sg", parent: "Vpc", label: "in VPC" });
+    expect(containment).toContainEqual({ child: "Inst", parent: "Subnet", label: "in subnet" });
+    // edge: the instance references the security group
+    expect(edges).toContainEqual({ from: "Inst", to: "Sg", kind: "ref", viaAttr: "sg" });
+    expect(dangling).toEqual([]);
+  });
+});

package/src/live-attrs.ts

@@ -0,0 +1,40 @@
+import type { ExportedTemplate } from "@intentius/chant/lexicon";
+
+/**
+ * Resolve a live CloudFormation template's per-resource properties into flat
+ * attributes for `chant graph --live` edge reconstruction (#784).
+ *
+ * `describeResources()` returns thin metadata (stack outputs), so the reference
+ * resolver (#778) had nothing to match on. `exportResources()` returns the
+ * deployed template, where resources reference each other by **logical id** via
+ * `{Ref: LogicalId}` / `{Fn::GetAtt: [LogicalId, …]}`. Logical id == the IR node
+ * id (both keyed by the CloudFormation logical name), so resolving those
+ * intrinsics to the bare logical-id string turns each reference into a value the
+ * resolver matches directly (it indexes every node by its own id).
+ */
+function resolveIntrinsics(v: unknown): unknown {
+  if (Array.isArray(v)) return v.map(resolveIntrinsics);
+  if (v && typeof v === "object") {
+    const o = v as Record<string, unknown>;
+    const keys = Object.keys(o);
+    if (keys.length === 1 && typeof o.Ref === "string") return o.Ref;
+    if (keys.length === 1 && o["Fn::GetAtt"] !== undefined) {
+      const g = o["Fn::GetAtt"];
+      if (Array.isArray(g) && typeof g[0] === "string") return g[0]; // ["LogicalId", "Attr"]
+      if (typeof g === "string") return g.split(".")[0]; // "LogicalId.Attr"
+    }
+    const out: Record<string, unknown> = {};
+    for (const [k, val] of Object.entries(o)) out[k] = resolveIntrinsics(val);
+    return out;
+  }
+  return v;
+}
+
+/** logical id → resolved properties (references become bare logical-id strings). */
+export function resolveTemplateAttrs(template: ExportedTemplate): Record<string, Record<string, unknown>> {
+  const out: Record<string, Record<string, unknown>> = {};
+  for (const r of template.resources) {
+    out[r.logicalId] = resolveIntrinsics(r.properties) as Record<string, unknown>;
+  }
+  return out;
+}

package/src/op/activities/aws-apply.ts

@@ -54,7 +54,14 @@ export function capabilityParams(capabilities: string[]): Record<string, string>
   return out;
 }
 
-/** First `<tag>…</tag>` text in a CFN XML response. */
+/**
+ * First `<tag>…</tag>` text in a CFN XML response.
+ *
+ * Assumes flat scalar fields — the CloudFormation Query API returns simple
+ * `<StackStatus>…</StackStatus>` style leaves, so `[^<]*` is sufficient. It does
+ * NOT handle nested tags or XML entities in the value; if a field ever carries
+ * either, replace this with a real XML parser.
+ */
 export function xmlField(xml: string, tag: string): string | undefined {
   return xml.match(new RegExp(`<${tag}>([^<]*)</${tag}>`))?.[1];
 }

package/src/op/activities/floci.ts

@@ -1,14 +1,11 @@
-import { exec } from "node:child_process";
-import { promisify } from "node:util";
-import { safeHeartbeat, sleep } from "@intentius/chant/op";
-
-const execAsync = promisify(exec);
+import { emulatorLifecycle } from "@intentius/chant/op";
 
 const DEFAULT_NAME = "chant-floci";
 const DEFAULT_PORT = 4566;
 const DEFAULT_IMAGE = "floci/floci:latest";
 const DEFAULT_REGION = "us-east-1";
 const DEFAULT_READY_SERVICE = "cloudformation";
+const DOCKER_SOCK = ["-v", "/var/run/docker.sock:/var/run/docker.sock"] as const;
 
 export interface FlociUpArgs {
   /** Container name. Default: `chant-floci`. */
@@ -34,30 +31,9 @@ export interface FlociDownArgs {
   name?: string;
 }
 
-/** `docker ps -q -f name=<name>` — non-empty stdout means the container is running. */
-export function flociExistsCommand(name: string): string {
-  return `docker ps -q -f name=${name}`;
-}
-
-/** Build the `docker run` command that boots Floci. */
-export function flociRunCommand(args: FlociUpArgs): string {
-  const name = args.name ?? DEFAULT_NAME;
-  const port = args.port ?? DEFAULT_PORT;
-  const image = args.image ?? DEFAULT_IMAGE;
-  const parts = ["docker", "run", "-d", "--rm", "--name", name, "-p", `${port}:4566`];
-  if (args.dockerSocket) parts.push("-v", "/var/run/docker.sock:/var/run/docker.sock");
-  parts.push(image);
-  return parts.join(" ");
-}
-
-/** Build the `docker rm -f` command. */
-export function flociRmCommand(name: string): string {
-  return `docker rm -f ${name}`;
-}
-
-/** The Floci health endpoint URL for a host port. */
-export function flociHealthUrl(port: number): string {
-  return `http://localhost:${port}/_localstack/health`;
+/** True once the health body reports the required service (e.g. `"cloudformation"`). */
+export function isFlociReady(healthBody: string, service: string): boolean {
+  return healthBody.includes(`"${service}"`);
 }
 
 /** The AWS env vars that point the `aws` CLI / SDK at a local Floci endpoint. */
@@ -70,9 +46,32 @@ export function flociEnv(port: number, region: string): Record<string, string> {
   };
 }
 
-/** True once the health body reports the required service (e.g. `"cloudformation"`). */
-export function isFlociReady(healthBody: string, service: string): boolean {
-  return healthBody.includes(`"${service}"`);
+// AWS runs the LocalStack-compatible floci/floci image, so readiness is gated on
+// a service (`cloudformation`) appearing in `/_localstack/health` — unlike the
+// bespoke az/gcp fakes. Shared lifecycle: emulatorLifecycle (#746).
+const flociFor = (readyService: string) =>
+  emulatorLifecycle({
+    name: DEFAULT_NAME,
+    image: DEFAULT_IMAGE,
+    containerPort: DEFAULT_PORT,
+    healthPath: "/_localstack/health",
+    ready: (body) => isFlociReady(body, readyService),
+  });
+
+const builders = flociFor(DEFAULT_READY_SERVICE);
+
+export const flociExistsCommand = builders.existsCommand;
+export const flociRmCommand = builders.rmCommand;
+export const flociHealthUrl = builders.healthUrl;
+
+/** Build the `docker run` command that boots Floci. */
+export function flociRunCommand(args: FlociUpArgs = {}): string {
+  return builders.runCommand({
+    name: args.name,
+    port: args.port,
+    image: args.image,
+    extraArgs: args.dockerSocket ? [...DOCKER_SOCK] : [],
+  });
 }
 
 /**
@@ -81,69 +80,28 @@ export function isFlociReady(healthBody: string, service: string): boolean {
  * Idempotent: reuses a running container of the same name. Waits for the health
  * endpoint to report `readyService`, then sets `AWS_ENDPOINT_URL` + test creds in
  * the process environment so a following `nativeApply`/`cfn-deploy` targets the
- * emulator. Env injection assumes the in-process **local executor**; under a
+ * emulator. Env injection assumes the in-process local executor; under a
  * distributed Temporal worker, pass the endpoint explicitly instead.
- *
- * Uses longInfra profile — 20m timeout, heartbeat every poll (the image may pull).
  */
-export async function flociUp(args: FlociUpArgs, signal?: AbortSignal): Promise<{ endpoint: string }> {
-  const name = args.name ?? DEFAULT_NAME;
-  const port = args.port ?? DEFAULT_PORT;
+export async function flociUp(args: FlociUpArgs = {}, signal?: AbortSignal): Promise<{ endpoint: string }> {
   const region = args.region ?? DEFAULT_REGION;
   const service = args.readyService ?? DEFAULT_READY_SERVICE;
-  const timeoutMs = args.timeoutMs ?? 60_000;
-  const intervalMs = args.intervalMs ?? 2_000;
-
-  let running = false;
-  try {
-    const { stdout } = await execAsync(flociExistsCommand(name), { signal });
-    running = Boolean(stdout.trim());
-  } catch {
-    // `docker ps` failed — assume not running and try to start it.
-  }
-
-  if (running) {
-    console.log(`Floci container "${name}" already running — reusing`);
-  } else {
-    await execAsync(flociRunCommand({ ...args, name, port }), { signal });
-  }
-
-  const url = flociHealthUrl(port);
-  const deadline = Date.now() + timeoutMs;
-  let ready = false;
-  while (Date.now() < deadline) {
-    if (signal?.aborted) throw new Error("flociUp aborted");
-    safeHeartbeat({ step: "flociUp", container: name });
-    try {
-      const res = await fetch(url, { signal });
-      if (res.ok && isFlociReady(await res.text(), service)) {
-        ready = true;
-        break;
-      }
-    } catch {
-      // Not up yet (connection refused / non-2xx) — retry.
-    }
-    await sleep(intervalMs, signal);
-  }
-  if (!ready) {
-    throw new Error(`Floci "${name}" did not become ready within ${timeoutMs}ms`);
-  }
-
-  const env = flociEnv(port, region);
-  Object.assign(process.env, env);
-  console.log(`Floci ready on ${env.AWS_ENDPOINT_URL} (service: ${service})`);
-  return { endpoint: env.AWS_ENDPOINT_URL };
+  const { endpoint } = await flociFor(service).up(
+    {
+      name: args.name,
+      port: args.port,
+      image: args.image,
+      timeoutMs: args.timeoutMs,
+      intervalMs: args.intervalMs,
+      extraArgs: args.dockerSocket ? [...DOCKER_SOCK] : [],
+    },
+    signal,
+  );
+  Object.assign(process.env, flociEnv(args.port ?? DEFAULT_PORT, region));
+  return { endpoint };
 }
 
-/**
- * Stop and remove the local Floci emulator container. A no-op success when the
- * container is already gone. Uses fastIdempotent profile — 5m timeout.
- */
-export async function flociDown(args: FlociDownArgs, signal?: AbortSignal): Promise<void> {
-  const name = args.name ?? DEFAULT_NAME;
-  try {
-    await execAsync(flociRmCommand(name), { signal });
-  } catch {
-    // Already removed (`--rm` on exit, or never started) — treat as success.
-  }
+/** Stop and remove the local Floci emulator container (no-op if already gone). */
+export async function flociDown(args: FlociDownArgs = {}, signal?: AbortSignal): Promise<void> {
+  return builders.down(args, signal);
 }

package/src/plugin.ts

@@ -14,6 +14,8 @@ import { readFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { awsSerializer } from "./serializer";
+import { awsReferenceCatalog } from "./reference-catalog";
+import { resolveTemplateAttrs } from "./live-attrs";
 import { CFParser } from "./import/parser";
 import { CFGenerator } from "./import/generator";
 import { parseStackTemplate } from "./import/live-export";
@@ -31,6 +33,8 @@ export const awsPlugin: LexiconPlugin = {
   serializer: awsSerializer,
   // Audit rule metadata for this lexicon's WAW* checks (#687).
   auditCatalog: () => awsAuditCatalog,
+  // Live edge reconstruction for `chant graph --live` (#778).
+  referenceCatalog: awsReferenceCatalog,
 
   lintRules(): LintRule[] {
     const rulesDir = join(dirname(fileURLToPath(import.meta.url)), "lint", "rules");
@@ -580,6 +584,15 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
     return parseStackTemplate(parsed.TemplateBody, options.selector, options.owned);
   },
 
+  // Live attribute enrichment for `chant graph --live` edge reconstruction (#784).
+  // describe-stack-resources is too thin; the deployed template (exportResources)
+  // carries the references. Resolve its `{Ref}`/`{Fn::GetAtt}` intrinsics to bare
+  // logical ids so the reference resolver matches them.
+  async enrichLiveAttrs(options: { environment: string; owned?: boolean }): Promise<Record<string, Record<string, unknown>>> {
+    const template = await this.exportResources!({ environment: options.environment, owned: options.owned });
+    return resolveTemplateAttrs(template);
+  },
+
   mcpTools() {
     return [
       {

package/src/reference-catalog.test.ts

@@ -0,0 +1,74 @@
+import { describe, it, expect } from "vitest";
+import { reconstructEdges, containmentGroups } from "@intentius/chant/graph-refs";
+import type { IRNode } from "@intentius/chant/graph-ir";
+import { awsReferenceCatalog } from "./reference-catalog";
+
+const n = (id: string, kind: string, attrs: Record<string, unknown>): IRNode => ({ id, kind, lexicon: "aws", attrs });
+
+// A canonical 3-tier VPC (managed subgraph): internet → ALB (public subnets) →
+// ECS service (private subnets) → RDS, with SG attachments. Attributes are the
+// per-resource describe/export shape the catalog targets.
+const nodes: IRNode[] = [
+  n("vpc", "AWS::EC2::VPC", { VpcId: "vpc-1" }),
+  n("pubA", "AWS::EC2::Subnet", { SubnetId: "subnet-pa", VpcId: "vpc-1" }),
+  n("pubB", "AWS::EC2::Subnet", { SubnetId: "subnet-pb", VpcId: "vpc-1" }),
+  n("privA", "AWS::EC2::Subnet", { SubnetId: "subnet-qa", VpcId: "vpc-1" }),
+  n("privB", "AWS::EC2::Subnet", { SubnetId: "subnet-qb", VpcId: "vpc-1" }),
+  n("albSg", "AWS::EC2::SecurityGroup", { GroupId: "sg-alb", VpcId: "vpc-1" }),
+  n("appSg", "AWS::EC2::SecurityGroup", { GroupId: "sg-app", VpcId: "vpc-1", IpPermissions: [{ UserIdGroupPairs: [{ GroupId: "sg-alb" }] }] }),
+  n("alb", "AWS::ElasticLoadBalancingV2::LoadBalancer", { LoadBalancerArn: "arn-alb", AvailabilityZones: [{ SubnetId: "subnet-pa" }, { SubnetId: "subnet-pb" }], SecurityGroups: ["sg-alb"] }),
+  n("tg", "AWS::ElasticLoadBalancingV2::TargetGroup", { TargetGroupArn: "arn-tg", VpcId: "vpc-1" }),
+  n("listener", "AWS::ElasticLoadBalancingV2::Listener", { LoadBalancerArn: "arn-alb", DefaultActions: [{ TargetGroupArn: "arn-tg" }] }),
+  n("cluster", "AWS::ECS::Cluster", { ClusterArn: "arn-cl" }),
+  n("taskdef", "AWS::ECS::TaskDefinition", { TaskDefinitionArn: "arn-td" }),
+  n("svc", "AWS::ECS::Service", { ServiceArn: "arn-svc", ClusterArn: "arn-cl", TaskDefinition: "arn-td", LoadBalancers: [{ TargetGroupArn: "arn-tg" }], NetworkConfiguration: { AwsvpcConfiguration: { Subnets: ["subnet-qa", "subnet-qb"], SecurityGroups: ["sg-app"] } } }),
+  n("rds", "AWS::RDS::DBInstance", { DBInstanceArn: "arn-rds", DBSubnetGroup: { Subnets: [{ SubnetIdentifier: "subnet-qa" }, { SubnetIdentifier: "subnet-qb" }] }, VpcSecurityGroups: [{ VpcSecurityGroupId: "sg-app" }] }),
+];
+
+describe("awsReferenceCatalog — golden 3-tier VPC", () => {
+  const { edges, containment, dangling } = reconstructEdges(nodes, awsReferenceCatalog);
+  const hasEdge = (from: string, to: string, via?: string) =>
+    edges.some((e) => e.from === from && e.to === to && (via === undefined || e.viaAttr === via));
+  const hasCont = (child: string, parent: string) =>
+    containment.some((c) => c.child === child && c.parent === parent);
+
+  it("reconstructs the topology edges", () => {
+    expect(hasEdge("svc", "cluster", "in cluster")).toBe(true);
+    expect(hasEdge("svc", "taskdef", "runs")).toBe(true);
+    expect(hasEdge("svc", "tg", "registered in")).toBe(true);
+    expect(hasEdge("svc", "appSg", "sg")).toBe(true);
+    expect(hasEdge("listener", "alb", "on")).toBe(true);
+    expect(hasEdge("listener", "tg", "forwards to")).toBe(true);
+    expect(hasEdge("alb", "albSg", "sg")).toBe(true);
+    expect(hasEdge("appSg", "albSg", "allows")).toBe(true);
+    expect(hasEdge("rds", "appSg", "sg")).toBe(true);
+  });
+
+  it("reconstructs network containment (→ #779 boundaries), not as edges", () => {
+    for (const s of ["pubA", "pubB", "privA", "privB", "albSg", "appSg", "tg"]) expect(hasCont(s, "vpc")).toBe(true);
+    expect(hasCont("alb", "pubA")).toBe(true);
+    expect(hasCont("alb", "pubB")).toBe(true);
+    expect(hasCont("svc", "privA")).toBe(true);
+    expect(hasCont("rds", "privB")).toBe(true);
+    // containment is never an edge
+    expect(edges.some((e) => e.to === "vpc")).toBe(false);
+  });
+
+  it("has no dangling references — every target is in the observed set", () => {
+    expect(dangling).toEqual([]);
+  });
+
+  it("reference edges point holder → referenced", () => {
+    // e.g. the service references the cluster, not the reverse
+    expect(hasEdge("cluster", "svc")).toBe(false);
+  });
+
+  it("containment groups nest VPC → subnets → resources (#779)", () => {
+    const groups = containmentGroups(containment);
+    // the VPC contains its subnets, SGs, and target group
+    expect(groups.vpc).toEqual(expect.arrayContaining(["pubA", "pubB", "privA", "privB", "albSg", "appSg", "tg"]));
+    // public subnets contain the ALB; private subnets contain the service + RDS
+    expect(groups.pubA).toContain("alb");
+    expect(groups.privA).toEqual(expect.arrayContaining(["svc", "rds"]));
+  });
+});

package/src/reference-catalog.ts

@@ -0,0 +1,82 @@
+import type { ReferenceCatalog } from "@intentius/chant/lexicon";
+
+/**
+ * AWS reference catalog (#778, epic #776 v1) — how observed AWS resources
+ * reference each other, so `chant graph --live` can reconstruct the topology.
+ *
+ * Keyed to the per-resource describe/export attribute shape (`VpcId`,
+ * `SecurityGroups[].GroupId`, `TargetGroupArn`, …), not the thin
+ * `describe-stack-resources` metadata. Enough to draw the canonical 3-tier VPC
+ * (internet → ALB → ECS service → RDS, with SG attachments). `containment`
+ * relations (subnet ∈ VPC) feed #779's boundary boxes; `reference` relations are
+ * edges.
+ */
+export const awsReferenceCatalog: ReferenceCatalog = {
+  identities: [
+    { kind: "AWS::EC2::VPC", ids: ["VpcId"] },
+    { kind: "AWS::EC2::Subnet", ids: ["SubnetId"] },
+    { kind: "AWS::EC2::SecurityGroup", ids: ["GroupId"] },
+    { kind: "AWS::EC2::Instance", ids: ["InstanceId"] },
+    { kind: "AWS::EC2::InternetGateway", ids: ["InternetGatewayId"] },
+    { kind: "AWS::EC2::NatGateway", ids: ["NatGatewayId"] },
+    { kind: "AWS::EC2::RouteTable", ids: ["RouteTableId"] },
+    { kind: "AWS::ElasticLoadBalancingV2::LoadBalancer", ids: ["LoadBalancerArn", "DNSName"] },
+    { kind: "AWS::ElasticLoadBalancingV2::TargetGroup", ids: ["TargetGroupArn"] },
+    { kind: "AWS::ECS::Cluster", ids: ["ClusterArn", "ClusterName"] },
+    { kind: "AWS::ECS::Service", ids: ["ServiceArn"] },
+    { kind: "AWS::ECS::TaskDefinition", ids: ["TaskDefinitionArn"] },
+    { kind: "AWS::RDS::DBInstance", ids: ["DBInstanceArn", "Endpoint.Address"] },
+  ],
+  refs: [
+    // ── containment (→ boundary boxes, #779) ──
+    { from: "AWS::EC2::Subnet", path: "VpcId", targetKind: "AWS::EC2::VPC", relation: "containment", label: "in VPC" },
+    { from: "AWS::EC2::SecurityGroup", path: "VpcId", targetKind: "AWS::EC2::VPC", relation: "containment", label: "in VPC" },
+    { from: "AWS::EC2::RouteTable", path: "VpcId", targetKind: "AWS::EC2::VPC", relation: "containment", label: "in VPC" },
+    { from: "AWS::EC2::Instance", path: "SubnetId", targetKind: "AWS::EC2::Subnet", relation: "containment", label: "in subnet" },
+    { from: "AWS::EC2::NatGateway", path: "SubnetId", targetKind: "AWS::EC2::Subnet", relation: "containment", label: "in subnet" },
+    { from: "AWS::ElasticLoadBalancingV2::LoadBalancer", path: "AvailabilityZones[].SubnetId", targetKind: "AWS::EC2::Subnet", relation: "containment", label: "in subnet" },
+    { from: "AWS::ElasticLoadBalancingV2::TargetGroup", path: "VpcId", targetKind: "AWS::EC2::VPC", relation: "containment", label: "in VPC" },
+    { from: "AWS::ECS::Service", path: "NetworkConfiguration.AwsvpcConfiguration.Subnets[]", targetKind: "AWS::EC2::Subnet", relation: "containment", label: "in subnet" },
+    { from: "AWS::RDS::DBInstance", path: "DBSubnetGroup.Subnets[].SubnetIdentifier", targetKind: "AWS::EC2::Subnet", relation: "containment", label: "in subnet" },
+
+    // ── references (→ edges) ──
+    { from: "AWS::EC2::Instance", path: "SecurityGroups[].GroupId", targetKind: "AWS::EC2::SecurityGroup", relation: "reference", label: "sg" },
+    { from: "AWS::EC2::SecurityGroup", path: "IpPermissions[].UserIdGroupPairs[].GroupId", targetKind: "AWS::EC2::SecurityGroup", relation: "reference", label: "allows" },
+    { from: "AWS::EC2::Route", path: "GatewayId", targetKind: "AWS::EC2::InternetGateway", relation: "reference", label: "via" },
+    { from: "AWS::EC2::Route", path: "NatGatewayId", targetKind: "AWS::EC2::NatGateway", relation: "reference", label: "via" },
+    { from: "AWS::ElasticLoadBalancingV2::LoadBalancer", path: "SecurityGroups[]", targetKind: "AWS::EC2::SecurityGroup", relation: "reference", label: "sg" },
+    { from: "AWS::ElasticLoadBalancingV2::Listener", path: "LoadBalancerArn", targetKind: "AWS::ElasticLoadBalancingV2::LoadBalancer", relation: "reference", label: "on" },
+    { from: "AWS::ElasticLoadBalancingV2::Listener", path: "DefaultActions[].TargetGroupArn", targetKind: "AWS::ElasticLoadBalancingV2::TargetGroup", relation: "reference", label: "forwards to" },
+    { from: "AWS::ECS::Service", path: "ClusterArn", targetKind: "AWS::ECS::Cluster", relation: "reference", label: "in cluster" },
+    { from: "AWS::ECS::Service", path: "TaskDefinition", targetKind: "AWS::ECS::TaskDefinition", relation: "reference", label: "runs" },
+    { from: "AWS::ECS::Service", path: "LoadBalancers[].TargetGroupArn", targetKind: "AWS::ElasticLoadBalancingV2::TargetGroup", relation: "reference", label: "registered in" },
+    { from: "AWS::ECS::Service", path: "NetworkConfiguration.AwsvpcConfiguration.SecurityGroups[]", targetKind: "AWS::EC2::SecurityGroup", relation: "reference", label: "sg" },
+    { from: "AWS::RDS::DBInstance", path: "VpcSecurityGroups[].VpcSecurityGroupId", targetKind: "AWS::EC2::SecurityGroup", relation: "reference", label: "sg" },
+
+    // ── CloudFormation *template* property paths (#784) ──
+    // `enrichLiveAttrs` resolves the deployed template's `{Ref}`/`{Fn::GetAtt}`
+    // intrinsics to bare logical ids (= node ids), so these match by node id; the
+    // property names are the CFN template shape (SecurityGroupIds, Cluster, …),
+    // which differs from the describe/SDK shape above. No targetKind needed —
+    // logical ids are unique.
+    { from: "AWS::EC2::Subnet", path: "VpcId", relation: "containment", label: "in VPC" },
+    { from: "AWS::EC2::SecurityGroup", path: "VpcId", relation: "containment", label: "in VPC" },
+    { from: "AWS::EC2::RouteTable", path: "VpcId", relation: "containment", label: "in VPC" },
+    { from: "AWS::EC2::Instance", path: "SubnetId", relation: "containment", label: "in subnet" },
+    { from: "AWS::EC2::Instance", path: "SecurityGroupIds[]", relation: "reference", label: "sg" },
+    { from: "AWS::EC2::NatGateway", path: "SubnetId", relation: "containment", label: "in subnet" },
+    { from: "AWS::EC2::Route", path: "RouteTableId", relation: "reference", label: "in" },
+    { from: "AWS::EC2::Route", path: "GatewayId", relation: "reference", label: "via" },
+    { from: "AWS::EC2::Route", path: "NatGatewayId", relation: "reference", label: "via" },
+    { from: "AWS::ElasticLoadBalancingV2::LoadBalancer", path: "Subnets[]", relation: "containment", label: "in subnet" },
+    { from: "AWS::ElasticLoadBalancingV2::LoadBalancer", path: "SecurityGroups[]", relation: "reference", label: "sg" },
+    { from: "AWS::ElasticLoadBalancingV2::TargetGroup", path: "VpcId", relation: "containment", label: "in VPC" },
+    { from: "AWS::ElasticLoadBalancingV2::Listener", path: "LoadBalancerArn", relation: "reference", label: "on" },
+    { from: "AWS::ElasticLoadBalancingV2::Listener", path: "DefaultActions[].TargetGroupArn", relation: "reference", label: "forwards to" },
+    { from: "AWS::ECS::Service", path: "Cluster", relation: "reference", label: "in cluster" },
+    { from: "AWS::ECS::Service", path: "TaskDefinition", relation: "reference", label: "runs" },
+    { from: "AWS::ECS::Service", path: "LoadBalancers[].TargetGroupArn", relation: "reference", label: "registered in" },
+    { from: "AWS::RDS::DBInstance", path: "DBSubnetGroupName", relation: "reference", label: "subnets" },
+    { from: "AWS::RDS::DBInstance", path: "VPCSecurityGroups[]", relation: "reference", label: "sg" },
+  ],
+};