@intentius/chant-lexicon-aws 0.46.0 → 0.50.0

package/src/deep-observe.ts

@@ -56,10 +56,19 @@ import {
   AwsReadError,
   describeStackResources,
   getResource,
+  listResources,
   type AwsReadClientOptions,
   type AwsReadHttp,
+  type StackResource,
 } from "./api/read-client";
+import { declaredIdentifier } from "./identity-observe";
 import { AWS_TAG_OWNERSHIP_KEYS } from "./ownership";
+import {
+  AWS_DEEP_BLIND_SPOTS,
+  EC2_TOPOLOGY_GENERATED_NAMES,
+  EC2_TOPOLOGY_SERVICE_DEFAULTS,
+  EC2_TOPOLOGY_SOURCES,
+} from "./deep-topology";
 import { applyAwsEndpointArgv } from "./components/cloud-executor";
 import { toIngressRules } from "./dependencies";
 import { createRequire } from "node:module";
@@ -106,6 +115,9 @@ export const DEEP_SOURCES: Record<string, DeepSource> = {
     id: "GroupId",
     toModel: securityGroupToModel,
   },
+  // The EC2 topology types the folds fold over (#1269), sources and
+  // translations alongside their type in ./deep-topology.ts.
+  ...EC2_TOPOLOGY_SOURCES,
 };
 
 /**
@@ -114,6 +126,74 @@ export const DEEP_SOURCES: Record<string, DeepSource> = {
  */
 export const DEEP_READABLE_TYPES: ReadonlySet<string> = new Set(Object.keys(DEEP_SOURCES));
 
+/**
+ * A child type this reader enumerates under one declared parent (#1015's
+ * out-of-band case) — the console-added SNS subscription or inline role
+ * policy that no property diff can see, because it is not a property of
+ * anything declared: it is a whole resource CloudFormation never made.
+ *
+ * Cloud Control's `ListResources` takes the parent as a `ResourceModel`
+ * scope, which is what `model` builds from the physical id the stack read
+ * already resolved. Every listed child is then sorted into declared (it is
+ * some stack resource's physical id, or some declared entity's spelled
+ * identity) or out-of-band; the out-of-band ones ride into the observation
+ * as live resources nobody declared, which the deep diff reports as
+ * undeclared entities.
+ */
+export interface DeepChildSource {
+  /** The child's CloudFormation type — what `ListResources` is asked for. */
+  childType: string;
+  /** The `ResourceModel` scoping the listing to one parent. */
+  model: (parentPhysicalId: string) => Record<string, unknown>;
+  /**
+   * Legacy declared forms of the same live child. `AWS::IAM::Policy` attached
+   * to a role creates the same inline policy `AWS::IAM::RolePolicy` lists, but
+   * under its own physical id — the policy name, which is the second part of
+   * the RolePolicy identifier. Without this leg every legacy inline policy
+   * reads as out-of-band on a stack that declared it.
+   */
+  declaredVia?: Array<{
+    type: string;
+    /** The part of the child identifier that carries that type's physical id. */
+    part: (identifier: string) => string | undefined;
+  }>;
+}
+
+/**
+ * Parent type → the child types worth listing under it. Scoped like
+ * {@link DEEP_SOURCES}: the high-signal cases first — the issue's own
+ * examples — and widened per type, not by wildcard. A child type Cloud
+ * Control cannot list parent-scoped does not belong here.
+ */
+export const DEEP_CHILD_SOURCES: Record<string, readonly DeepChildSource[]> = {
+  "AWS::IAM::Role": [
+    {
+      childType: "AWS::IAM::RolePolicy",
+      model: (roleName) => ({ RoleName: roleName }),
+      // A RolePolicy identifier is `PolicyName|RoleName` — the schema's own
+      // primaryIdentifier order, which is what the manifest records and what
+      // `declaredIdentifier` joins by. The legacy type's physical id is the
+      // policy name, the first part.
+      declaredVia: [{ type: "AWS::IAM::Policy", part: (id) => id.split("|")[0] }],
+    },
+  ],
+  "AWS::SNS::Topic": [
+    {
+      childType: "AWS::SNS::Subscription",
+      model: (topicArn) => ({ TopicArn: topicArn }),
+    },
+  ],
+};
+
+/**
+ * The name an out-of-band child reports under. There is no chant entity name
+ * to use — nobody declared it — so the name has to carry the finding on its
+ * own: what kind of thing, and which one.
+ */
+export function outOfBandChildName(childType: string, identifier: string): string {
+  return `${childType}:${identifier}`;
+}
+
 /**
  * `describe-security-groups` -> the `AWS::EC2::SecurityGroup` resource model.
  *
@@ -205,6 +285,7 @@ export const AWS_SERVICE_DEFAULTS: Record<string, Record<string, unknown>> = {
     "SecurityGroupEgress[].CidrIp": "0.0.0.0/0",
     "SecurityGroupEgress[].IpProtocol": "-1",
   },
+  ...EC2_TOPOLOGY_SERVICE_DEFAULTS,
 };
 
 /**
@@ -218,6 +299,7 @@ export const AWS_SERVICE_DEFAULTS: Record<string, Record<string, unknown>> = {
  */
 export const AWS_GENERATED_NAMES: Record<string, ReadonlySet<string>> = {
   "AWS::EC2::SecurityGroup": new Set(["GroupName"]),
+  ...EC2_TOPOLOGY_GENERATED_NAMES,
 };
 
 /** Stable JSON with sorted keys — the fallback ordering key for a set-like array. */
@@ -303,6 +385,18 @@ export const awsDeepNormalizationHooks: DeepNormalizationHooks = {
     if (schemaReadOnlyPatterns(node.entityType).has(node.pattern)) return true;
     if (AWS_READ_ONLY_NAMES.has(lastSegment(node.pattern))) return true;
 
+    // A declared property this type's source cannot see (#1269). With nothing
+    // live to stand against it would report `value -> <absent>` on every clean
+    // apply — a blind spot rendered as drift. Counterpart-gated the other way
+    // round: a live tree that does carry the field is still compared.
+    if (
+      node.side === "declared" &&
+      node.counterpart === "absent" &&
+      AWS_DEEP_BLIND_SPOTS[node.entityType]?.has(node.pattern)
+    ) {
+      return true;
+    }
+
     // Provider defaults, on the live side only, and only where source is silent
     // about the property. `"unknown"` (a one-sided normalization) never prunes:
     // the reader must not decide this before the declared tree is in hand.
@@ -606,9 +700,119 @@ export async function observeResourcesDeepAws(
     };
   });
 
+  // The out-of-band pass (#1015): under each declared parent whose type names
+  // child sources, list what actually exists and keep what nothing declared.
+  // A parent `--owned` withheld keeps its children out too — reporting a
+  // foreign resource's children while withholding the resource itself would
+  // be the filter half-applied. A parent with no deep reader of its own
+  // (`unsupported-kind`) still gets its children enumerated: listing under it
+  // needs only the physical id the stack already resolved.
+  const parents: Array<{ resource: StackResource; sources: readonly DeepChildSource[] }> = [];
+  for (const entityName of options.entityNames) {
+    const resource = byLogicalId.get(entityName);
+    const sources = resource ? DEEP_CHILD_SOURCES[resource.type] : undefined;
+    if (!resource?.physicalId || !sources) continue;
+    if (unobserved[entityName]?.reason === "filtered") continue;
+    parents.push({ resource, sources });
+  }
+  const children = await enumerateOutOfBandChildren({
+    parents,
+    allStackResources: stackResources,
+    entities: options.entities,
+    client,
+    normalize: (childType, properties) =>
+      normalizeDeepProperties(properties, {
+        entityType: childType,
+        side: "live",
+        hooks: awsDeepNormalizationHooks,
+      }),
+    concurrently: boundedConcurrently,
+  });
+  for (const [name, child] of Object.entries(children)) {
+    if (!resources[name]) resources[name] = child;
+  }
+
   return deepObservation(resources, unobserved);
 }
 
+/**
+ * List every child-sourced type under its declared parents and return the
+ * resources nothing declared, named by {@link outOfBandChildName}.
+ *
+ * "Declared" is answered three ways, in order of how directly the stack says
+ * it: the child identifier is some stack resource's physical id (the normal
+ * case — a declared `AWS::SNS::Subscription` deploys under its ARN); a
+ * `declaredVia` legacy form's physical id is the identifier's relevant part;
+ * or a declared entity's props spell the identifier (`declaredIdentifier`,
+ * the carve case — declared in source, not yet in any stack).
+ *
+ * A listing that fails is silence about that parent's children, never a
+ * finding and never a hole: there is no declared entity to hang a hole on,
+ * and fabricating one would put an undeclared name in the unobserved report.
+ * `UnsupportedOperation` — an emulator without parent-scoped listing — lands
+ * here too, which is what keeps the Floci lanes quiet.
+ */
+async function enumerateOutOfBandChildren(args: {
+  parents: Array<{ resource: StackResource; sources: readonly DeepChildSource[] }>;
+  allStackResources: StackResource[];
+  entities?: Map<string, { entityType: string; props: Record<string, unknown> }>;
+  client: AwsReadClientOptions;
+  normalize: (childType: string, properties: Record<string, unknown>) => Record<string, unknown>;
+  concurrently: <T>(items: T[], fn: (item: T) => Promise<void>) => Promise<unknown>;
+}): Promise<Record<string, DeepResourceObservation>> {
+  const out: Record<string, DeepResourceObservation> = {};
+  if (args.parents.length === 0) return out;
+
+  // Physical ids by type, over the WHOLE stack — a stack resource that is not
+  // a declared chant entity (a nested stack's row, a resource another tool
+  // added to the same stack) is still stack-managed, not out-of-band.
+  const addTo = (map: Map<string, Set<string>>, key: string, value: string) => {
+    const set = map.get(key) ?? new Set<string>();
+    set.add(value);
+    map.set(key, set);
+  };
+  const stackIdsByType = new Map<string, Set<string>>();
+  for (const r of args.allStackResources) {
+    if (r.physicalId) addTo(stackIdsByType, r.type, r.physicalId);
+  }
+  const declaredIdsByType = new Map<string, Set<string>>();
+  for (const entity of args.entities?.values() ?? []) {
+    const id = declaredIdentifier(entity.entityType, entity.props ?? {});
+    if (id) addTo(declaredIdsByType, entity.entityType, id);
+  }
+
+  const isDeclared = (source: DeepChildSource, identifier: string): boolean => {
+    if (stackIdsByType.get(source.childType)?.has(identifier)) return true;
+    if (declaredIdsByType.get(source.childType)?.has(identifier)) return true;
+    for (const via of source.declaredVia ?? []) {
+      const part = via.part(identifier);
+      if (part && stackIdsByType.get(via.type)?.has(part)) return true;
+    }
+    return false;
+  };
+
+  const listings = args.parents.flatMap(({ resource, sources }) =>
+    sources.map((source) => ({ physicalId: resource.physicalId as string, source })),
+  );
+  await args.concurrently(listings, async ({ physicalId, source }) => {
+    let listed;
+    try {
+      listed = await listResources(source.childType, args.client, source.model(physicalId));
+    } catch {
+      return;
+    }
+    for (const child of listed) {
+      if (!child.identifier || isDeclared(source, child.identifier)) continue;
+      out[outOfBandChildName(source.childType, child.identifier)] = {
+        type: source.childType,
+        physicalId: child.identifier,
+        properties: args.normalize(source.childType, child.properties),
+      };
+    }
+  });
+  return out;
+}
+
 /**
  * Read every `ec2`-sourced type in bulk, keyed by physical id.
  *

package/src/deep-topology.test.ts

@@ -0,0 +1,392 @@
+/**
+ * Deep-read coverage for the EC2 topology types (#1269).
+ *
+ * The folds' inputs — VPC, subnet, route table, internet gateway, and the
+ * joins between them — were exactly the types the deep reader could not read,
+ * so a snapshot-backed query could answer identity questions and not a single
+ * fold question. These tests drive each added type through the real reader
+ * against faked describes, and close with the fold-level proof: a question
+ * that was previously unanswerable (is this VPC the provider's default?)
+ * answered from the deep read alone.
+ *
+ * Same seams as deep-observe.test.ts: Cloud Control and CloudFormation are
+ * faked at the injected `http` transport, the EC2 describes at the runtime's
+ * `spawn`.
+ */
+import { describe, test, expect, vi, beforeEach } from "vitest";
+
+const spawnMock = vi.fn();
+vi.mock("@intentius/chant/runtime-adapter", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@intentius/chant/runtime-adapter")>();
+  return { ...actual, getRuntime: () => ({ ...actual.getRuntime(), spawn: spawnMock }) };
+});
+
+const { observeResourcesDeepAws, DEEP_READABLE_TYPES, awsDeepNormalizationHooks } = await import("./deep-observe");
+const { vpcToModel, subnetToModel, routeTableToModel, internetGatewayToModel } = await import("./deep-topology");
+const { stampProviderDefaults } = await import("./defaults");
+const { normalizeDeepObservation } = await import("@intentius/chant/deep-observation");
+const { diffDeepObservation } = await import("@intentius/chant/lifecycle/deep-observe");
+
+const ok = (text: string) => ({ status: 200, text });
+
+/** A Cloud Control `GetResource` body — the model arrives as a JSON string. */
+const cloudControl = (identifier: string, properties: Record<string, unknown>) =>
+  ok(JSON.stringify({ ResourceDescription: { Identifier: identifier, Properties: JSON.stringify(properties) } }));
+
+const stackResources = (rows: Array<[string, string, string]>) =>
+  ok(
+    `<DescribeStackResourcesResponse><DescribeStackResourcesResult><StackResources>${rows
+      .map(
+        ([logicalId, type, physicalId]) =>
+          `<member><LogicalResourceId>${logicalId}</LogicalResourceId><ResourceType>${type}</ResourceType>` +
+          `<PhysicalResourceId>${physicalId}</PhysicalResourceId><ResourceStatus>CREATE_COMPLETE</ResourceStatus>` +
+          `<Timestamp>2026-01-01T00:00:00Z</Timestamp></member>`,
+      )
+      .join("")}</StackResources></DescribeStackResourcesResult></DescribeStackResourcesResponse>`,
+  );
+
+type FakeResponse = { status: number; text: string };
+
+/** Route on the Cloud Control identifier; `undefined` is the CloudFormation call. */
+function httpFake(route: (identifier: string | undefined) => FakeResponse) {
+  return async (_url: string, init: { headers: Record<string, string>; body: string }) => {
+    const target = init.headers["x-amz-target"];
+    const identifier = target ? (JSON.parse(init.body) as { Identifier?: string }).Identifier : undefined;
+    return route(identifier);
+  };
+}
+
+/** Route each EC2 bulk describe on its subcommand (`argv[2]`). */
+function ec2Describes(byCommand: Record<string, Record<string, unknown[]>>) {
+  spawnMock.mockImplementation((argv: string[]) => {
+    const body = byCommand[argv[2]];
+    if (!body) return Promise.resolve({ stdout: "", stderr: `no fake for ${argv[2]}`, exitCode: 255 });
+    return Promise.resolve({ stdout: JSON.stringify(body), stderr: "", exitCode: 0 });
+  });
+}
+
+const entities = (
+  record: Record<string, { entityType: string; props: Record<string, unknown> }>,
+): Map<string, { entityType: string; props: Record<string, unknown> }> => new Map(Object.entries(record));
+
+const vpcRow = {
+  VpcId: "vpc-01",
+  State: "available",
+  OwnerId: "111122223333",
+  CidrBlock: "10.0.0.0/16",
+  DhcpOptionsId: "dopt-01",
+  InstanceTenancy: "default",
+  IsDefault: false,
+  CidrBlockAssociationSet: [{ AssociationId: "vpc-cidr-assoc-01", CidrBlock: "10.0.0.0/16" }],
+  Tags: [{ Key: "env", Value: "prod" }],
+};
+
+// Braces matter: `mockReset()` returns the mock, and a function returned from
+// a vitest hook is called as a cleanup hook — the mock invoked with no argv.
+beforeEach(() => {
+  spawnMock.mockReset();
+});
+
+describe("the topology translations", () => {
+  test("a VPC row maps onto the resource model, keeping the provider's default marker", () => {
+    expect(vpcToModel(vpcRow)).toEqual({
+      VpcId: "vpc-01",
+      CidrBlock: "10.0.0.0/16",
+      InstanceTenancy: "default",
+      IsDefault: false,
+      Tags: [{ Key: "env", Value: "prod" }],
+    });
+  });
+
+  test("a subnet row keeps both fold inputs: the VPC hop and MapPublicIpOnLaunch", () => {
+    expect(
+      subnetToModel({
+        SubnetId: "subnet-01",
+        VpcId: "vpc-01",
+        State: "available",
+        OwnerId: "111122223333",
+        CidrBlock: "10.0.1.0/24",
+        AvailabilityZone: "us-east-1a",
+        AvailabilityZoneId: "use1-az1",
+        AvailableIpAddressCount: 250,
+        MapPublicIpOnLaunch: true,
+        AssignIpv6AddressOnCreation: false,
+        DefaultForAz: false,
+        Ipv6Native: false,
+        PrivateDnsNameOptionsOnLaunch: { HostnameType: "ip-name" },
+      }),
+    ).toEqual({
+      SubnetId: "subnet-01",
+      VpcId: "vpc-01",
+      CidrBlock: "10.0.1.0/24",
+      AvailabilityZone: "us-east-1a",
+      AvailabilityZoneId: "use1-az1",
+      MapPublicIpOnLaunch: true,
+      AssignIpv6AddressOnCreation: false,
+      Ipv6Native: false,
+      DefaultForAz: false,
+    });
+  });
+
+  test("a route table's routes and associations are its own declared resources, not carried twice", () => {
+    expect(
+      routeTableToModel({
+        RouteTableId: "rtb-01",
+        VpcId: "vpc-01",
+        Routes: [{ DestinationCidrBlock: "0.0.0.0/0", GatewayId: "igw-01" }],
+        Associations: [{ Main: false, SubnetId: "subnet-01" }],
+        PropagatingVgws: [],
+      }),
+    ).toEqual({ RouteTableId: "rtb-01", VpcId: "vpc-01" });
+  });
+
+  test("an internet gateway is tags and nothing else; an empty tag set is absence, not a value", () => {
+    expect(internetGatewayToModel({ InternetGatewayId: "igw-01", Attachments: [], Tags: [] })).toEqual({
+      InternetGatewayId: "igw-01",
+    });
+  });
+});
+
+describe("deep-reading an EC2 topology stack", () => {
+  const topologyStack = stackResources([
+    ["Net", "AWS::EC2::VPC", "vpc-01"],
+    ["PublicSubnet", "AWS::EC2::Subnet", "subnet-01"],
+    ["PublicRoutes", "AWS::EC2::RouteTable", "rtb-01"],
+    ["Igw", "AWS::EC2::InternetGateway", "igw-01"],
+  ]);
+
+  test("every topology type from #1269 is readable", () => {
+    for (const type of [
+      "AWS::EC2::VPC",
+      "AWS::EC2::Subnet",
+      "AWS::EC2::RouteTable",
+      "AWS::EC2::Route",
+      "AWS::EC2::SubnetRouteTableAssociation",
+      "AWS::EC2::InternetGateway",
+      "AWS::EC2::VPCGatewayAttachment",
+      "AWS::EC2::Instance",
+      "AWS::EC2::LaunchTemplate",
+    ]) {
+      expect(DEEP_READABLE_TYPES.has(type)).toBe(true);
+    }
+  });
+
+  test("one bulk describe per type, and every tree is recorded", async () => {
+    ec2Describes({
+      "describe-vpcs": { Vpcs: [vpcRow] },
+      "describe-subnets": {
+        Subnets: [{ SubnetId: "subnet-01", VpcId: "vpc-01", CidrBlock: "10.0.1.0/24", MapPublicIpOnLaunch: true }],
+      },
+      "describe-route-tables": { RouteTables: [{ RouteTableId: "rtb-01", VpcId: "vpc-01", Routes: [] }] },
+      "describe-internet-gateways": { InternetGateways: [{ InternetGatewayId: "igw-01", Attachments: [] }] },
+    });
+    const result = normalizeDeepObservation(
+      await observeResourcesDeepAws({
+        environment: "prod",
+        entityNames: ["Net", "PublicSubnet", "PublicRoutes", "Igw"],
+        http: httpFake(() => topologyStack),
+      }),
+    );
+
+    expect(Object.keys(result.resources).sort()).toEqual(["Igw", "Net", "PublicRoutes", "PublicSubnet"]);
+    expect(result.unobserved).toEqual({});
+
+    // The containment hop and the public-IP fact the folds read.
+    expect(result.resources.PublicSubnet.properties).toMatchObject({
+      VpcId: "vpc-01",
+      MapPublicIpOnLaunch: true,
+    });
+    // Server-minted ids are pruned by the schema's own readOnlyProperties.
+    expect(result.resources.Net.properties.VpcId).toBeUndefined();
+    expect(result.resources.PublicSubnet.properties.SubnetId).toBeUndefined();
+    // The provider's default marker survives into the snapshot for the fold.
+    expect(result.resources.Net.properties.IsDefault).toBe(false);
+
+    // Four types, four describes — never one call per resource.
+    expect(spawnMock).toHaveBeenCalledTimes(4);
+    const commands = spawnMock.mock.calls.map((c) => (c[0] as string[])[2]).sort();
+    expect(commands).toEqual([
+      "describe-internet-gateways",
+      "describe-route-tables",
+      "describe-subnets",
+      "describe-vpcs",
+    ]);
+  });
+
+  test("the routing-chain joins read through Cloud Control by their physical id", async () => {
+    const http = httpFake((identifier) => {
+      if (identifier === undefined) {
+        return stackResources([
+          ["DefaultRoute", "AWS::EC2::Route", "rtb-01|0.0.0.0/0"],
+          ["SubnetRoutes", "AWS::EC2::SubnetRouteTableAssociation", "rtbassoc-01"],
+          ["IgwAttachment", "AWS::EC2::VPCGatewayAttachment", "IGW|vpc-01"],
+        ]);
+      }
+      if (identifier === "rtb-01|0.0.0.0/0") {
+        return cloudControl(identifier, {
+          RouteTableId: "rtb-01",
+          DestinationCidrBlock: "0.0.0.0/0",
+          GatewayId: "igw-01",
+        });
+      }
+      if (identifier === "rtbassoc-01") {
+        return cloudControl(identifier, { Id: "rtbassoc-01", RouteTableId: "rtb-01", SubnetId: "subnet-01" });
+      }
+      return cloudControl(identifier, { InternetGatewayId: "igw-01", VpcId: "vpc-01" });
+    });
+    const result = normalizeDeepObservation(
+      await observeResourcesDeepAws({
+        environment: "prod",
+        entityNames: ["DefaultRoute", "SubnetRoutes", "IgwAttachment"],
+        http,
+      }),
+    );
+
+    // The `0.0.0.0/0` -> igw edge `internetFacing` walks.
+    expect(result.resources.DefaultRoute.properties).toEqual({
+      RouteTableId: "rtb-01",
+      DestinationCidrBlock: "0.0.0.0/0",
+      GatewayId: "igw-01",
+    });
+    // Subnet -> route table, with the association's own minted id pruned.
+    expect(result.resources.SubnetRoutes.properties).toEqual({
+      RouteTableId: "rtb-01",
+      SubnetId: "subnet-01",
+    });
+    // Igw -> VPC.
+    expect(result.resources.IgwAttachment.properties).toEqual({
+      InternetGatewayId: "igw-01",
+      VpcId: "vpc-01",
+    });
+    expect(spawnMock).not.toHaveBeenCalled();
+  });
+
+  test("a type without a source is still a stated hole, not a silent one", async () => {
+    const result = normalizeDeepObservation(
+      await observeResourcesDeepAws({
+        environment: "prod",
+        entityNames: ["Ip"],
+        http: httpFake(() => stackResources([["Ip", "AWS::EC2::EIP", "203.0.113.7"]])),
+      }),
+    );
+    expect(result.resources).toEqual({});
+    expect(result.unobserved.Ip.reason).toBe("unsupported-kind");
+  });
+});
+
+describe("the fold answers (#1269)", () => {
+  const vpcStack = stackResources([
+    ["Net", "AWS::EC2::VPC", "vpc-01"],
+    ["Legacy", "AWS::EC2::VPC", "vpc-02"],
+  ]);
+
+  test("IsDefault on a VPC — previously unanswerable — answers from the deep read", async () => {
+    ec2Describes({
+      "describe-vpcs": {
+        Vpcs: [vpcRow, { ...vpcRow, VpcId: "vpc-02", CidrBlock: "172.31.0.0/16", IsDefault: true, Tags: [] }],
+      },
+    });
+    const observed = normalizeDeepObservation(
+      await observeResourcesDeepAws({
+        environment: "prod",
+        entityNames: ["Net", "Legacy"],
+        http: httpFake(() => vpcStack),
+      }),
+    );
+
+    // The classification fold reads the provider's own marker off the
+    // recorded properties — nothing to re-fetch, no heuristics.
+    const stamped = stampProviderDefaults(
+      Object.fromEntries(
+        Object.entries(observed.resources).map(([name, r]) => [
+          name,
+          { type: r.type, status: "CREATE_COMPLETE", attributes: r.properties },
+        ]),
+      ),
+    );
+    expect(stamped.Legacy.attributes?.providerDefault).toBe(true);
+    expect(stamped.Net.attributes?.providerDefault).toBeUndefined();
+  });
+
+  test("the marker feeds the fold without surfacing as drift on a declared VPC", async () => {
+    ec2Describes({ "describe-vpcs": { Vpcs: [vpcRow] } });
+    const observed = normalizeDeepObservation(
+      await observeResourcesDeepAws({
+        environment: "prod",
+        entityNames: ["Net"],
+        http: httpFake(() => stackResources([["Net", "AWS::EC2::VPC", "vpc-01"]])),
+      }),
+    );
+    const declared = entities({
+      Net: {
+        entityType: "AWS::EC2::VPC",
+        props: { CidrBlock: "10.0.0.0/16", Tags: [{ Key: "env", Value: "prod" }] },
+      },
+    });
+
+    // In the snapshot for a query to read…
+    expect(observed.resources.Net.properties.IsDefault).toBe(false);
+    // …and subtracted in the diff, where source never declared it.
+    const diff = diffDeepObservation(declared, observed, awsDeepNormalizationHooks);
+    expect(diff.drifted).toEqual([]);
+    expect(diff.unchanged).toEqual(["Net"]);
+  });
+
+  test("declared DNS attributes are a source blind spot, not absence drift; a visible change still reports", async () => {
+    ec2Describes({ "describe-vpcs": { Vpcs: [{ ...vpcRow, CidrBlock: "10.9.0.0/16", Tags: [] }] } });
+    const observed = normalizeDeepObservation(
+      await observeResourcesDeepAws({
+        environment: "prod",
+        entityNames: ["Net"],
+        http: httpFake(() => stackResources([["Net", "AWS::EC2::VPC", "vpc-01"]])),
+      }),
+    );
+    const declared = entities({
+      Net: {
+        entityType: "AWS::EC2::VPC",
+        props: { CidrBlock: "10.0.0.0/16", EnableDnsSupport: true, EnableDnsHostnames: true },
+      },
+    });
+
+    const diff = diffDeepObservation(declared, observed, awsDeepNormalizationHooks);
+    expect(diff.drifted).toEqual([
+      {
+        name: "Net",
+        type: "AWS::EC2::VPC",
+        changes: [
+          { path: "CidrBlock", kind: "changed", declared: "10.0.0.0/16", live: "10.9.0.0/16" },
+        ],
+      },
+    ]);
+  });
+
+  test("an out-of-band MapPublicIpOnLaunch flip reports; the service default does not", async () => {
+    const subnetRow = (mapPublic: boolean) => ({
+      Subnets: [{ SubnetId: "subnet-01", VpcId: "vpc-01", CidrBlock: "10.0.1.0/24", MapPublicIpOnLaunch: mapPublic }],
+    });
+    const declared = entities({
+      PublicSubnet: { entityType: "AWS::EC2::Subnet", props: { VpcId: "vpc-01", CidrBlock: "10.0.1.0/24" } },
+    });
+    const observe = async () =>
+      normalizeDeepObservation(
+        await observeResourcesDeepAws({
+          environment: "prod",
+          entityNames: ["PublicSubnet"],
+          http: httpFake(() => stackResources([["PublicSubnet", "AWS::EC2::Subnet", "subnet-01"]])),
+        }),
+      );
+
+    ec2Describes({ "describe-subnets": subnetRow(false) });
+    expect(diffDeepObservation(declared, await observe(), awsDeepNormalizationHooks).drifted).toEqual([]);
+
+    ec2Describes({ "describe-subnets": subnetRow(true) });
+    const diff = diffDeepObservation(declared, await observe(), awsDeepNormalizationHooks);
+    expect(diff.drifted).toEqual([
+      {
+        name: "PublicSubnet",
+        type: "AWS::EC2::Subnet",
+        changes: [{ path: "MapPublicIpOnLaunch", kind: "undeclared", live: true }],
+      },
+    ]);
+  });
+});