@intentius/chant-lexicon-terraform 0.124.31 → 0.124.32

package/dist/behaviour/predict.js

@@ -0,0 +1,297 @@
+/**
+ * The live path for choudoufu roots (#2360): a prediction of the account as
+ * it stands, drift included.
+ *
+ * `describeResources` (`../describe-resources.ts`) answers "does this declared
+ * block exist" for a live root by running `choudoufu live-plan -json` through
+ * the applier's own activity. This does the same two reads — `live-ls -json`
+ * for what the account holds, `live-plan -json` for how that binds to the
+ * declaration — through the same injected activities, builds the engine's
+ * request from them (`./request.ts`), and hands it to whichever lexicon fronts
+ * the engine. The terraform lexicon has no engine of its own and dials none:
+ * `deps.predict` is core's `predictBehaviour` in production, and a fixture
+ * in a test.
+ *
+ * ## Four moves, in this order
+ *
+ *  1. **Read.** One `live-ls` and one `live-plan` per live root — none at all
+ *     under `from: "declared"` — no ambient
+ *     credentials and no new shell-out: the activities are the ones
+ *     `describeResources` already runs. A root whose read fails reports every
+ *     resource it declares `read-failed`, naming the root, and is not sent — a
+ *     failed read must never render as an estate with nothing in it.
+ *  2. **Build.** `terraformBehaviourRequest`, pure, over the parsed documents.
+ *  3. **Screen.** `screenBehaviourRequest`, before any engine is asked. Live
+ *     props are exactly where a resolved connection string or a secret written
+ *     into a tag can appear, and the screen's key-name, value-shape,
+ *     URL-userinfo and walk-depth rules all apply to them. A refusal here is
+ *     the result.
+ *  4. **Ask, and account for the rest.** The engine-fronting lexicon answers
+ *     for what was sent. What was not sent — a resource the plan could not
+ *     read, one withheld by `owned`, every resource of a root whose read
+ *     failed — is merged into the report as `unpredicted` with its reason, so
+ *     every declared name still lands in one map or the other.
+ *
+ * A root that is not live is built from its declaration by the same producer,
+ * so a project mixing stock and live roots gets one request with both, and
+ * `sources` says which is which. With no live root at all this is the
+ * declared path, containment included.
+ *
+ * ## Both halves of the delta come out of here
+ *
+ * `from: "declared"` reads no account and builds every root from its file,
+ * including a root that is live. That is the other side of the delta the epic
+ * wants, and it is deliberately the same function rather than a second one:
+ * two reports that differ because one producer was handed different input are
+ * a statement about the estate, and two reports that differ because two
+ * producers disagree about how to assemble a graph are a statement about
+ * chant. `edgeCoverage.containmentEdges` is the field that made the
+ * difference concrete (#2360's third review comment) — it is built by the same
+ * catalog over the same reconstruction on both sides here, so a "one zone
+ * lost" verdict that differs between the two differs because the account
+ * differs.
+ */
+import { behaviourReport, isBehaviourRefusalReport, screenBehaviourRequest, } from "@intentius/chant/behaviour";
+import { createBehaviourPredict } from "@intentius/chant/behaviour-predict";
+import { indexLivePlan, readLiveLs } from "../describe-resources.js";
+import { RESOURCE_TYPE } from "../hcl/parse.js";
+import { choudoufuLiveLs, choudoufuLivePlanDocument } from "../op/activities/terraform.js";
+import { terraformBehaviourKinds } from "./kinds.js";
+import { terraformBehaviourRequest, } from "./request.js";
+/** The name this path screens and refuses under. */
+export const TERRAFORM = "terraform";
+/**
+ * What the plugin method runs with, where a caller injects nothing (#2495).
+ *
+ * The two reads are the activities `describeResources` already drives. The
+ * engine front is core's, handed this lexicon's coverage rows and no other's:
+ * a plugin method takes options alone and cannot see which other lexicons the
+ * project configured, and every name this producer sends is a terraform block
+ * or a name it passed through untouched. A passed-through name of another
+ * lexicon's type comes back `unknown-type`, which is true of what this path
+ * knows about it.
+ */
+const REAL_DEPS = {
+    liveLs: choudoufuLiveLs,
+    livePlan: choudoufuLivePlanDocument,
+    predict: createBehaviourPredict({ kinds: [terraformBehaviourKinds] }),
+};
+/**
+ * The build's own entities, read again from the project's config: what
+ * `buildRoots()` renders, with `mode`, `body` and `references` as the parse
+ * stamps them. The config is found the way `observeAmbient` and the
+ * activities find it, so `terraform.roots` means one thing to all of them.
+ */
+export const readTerraformDeclaration = async (cwd) => {
+    const { loadChantConfigUpward } = await import("@intentius/chant/config");
+    const { renderTerraformRoots } = await import("../hcl/roots.js");
+    const { dirname, resolve } = await import("node:path");
+    const start = resolve(cwd ?? process.cwd());
+    const { config, configPath } = await loadChantConfigUpward(start);
+    const namespace = config.terraform;
+    const entities = new Map();
+    if (!namespace?.roots || Object.keys(namespace.roots).length === 0)
+        return entities;
+    const rendered = await renderTerraformRoots({
+        projectRoot: configPath ? dirname(configPath) : start,
+        roots: namespace.roots,
+        binary: namespace.binary,
+        callModuleType: namespace.callModuleType,
+        moduleRoot: namespace.moduleRoot,
+    });
+    for (const [name, entity] of rendered.entities) {
+        const e = entity;
+        entities.set(name, {
+            entityType: e.entityType,
+            props: e.props ?? {},
+            ...(Array.isArray(e.references) ? { references: e.references } : {}),
+        });
+    }
+    return entities;
+};
+const rootOf = (entity) => typeof entity?.props.root === "string" ? entity.props.root : undefined;
+/**
+ * Read the contract's options as this producer's (#2495): the plugin method's
+ * whole adaptation. Two things are missing from an entity by the time a graph
+ * has carried it here, and which one depends on the graph.
+ *
+ * ## A declared graph has lost its `references`
+ *
+ * `root` and `mode` need no work: they are on `props`, the graph projects
+ * `props` onto a node's `attrs` as they stand, and `behaviourRequestFromIr`
+ * hands `attrs` back as `props`. `references` are left off `attrs` on
+ * purpose, because an edge already says the same thing (`graph-ir.ts`'s
+ * `SKIP_KEYS`), and the contract's `edges` arrive in their place. An `IREdge`
+ * is an `EntityReference` plus the entity it leaves from, so grouping the
+ * edges by `from` gives every entity its references back, field for field.
+ * Without this a block whose body holds a `${…}` is counted as an unresolved
+ * kind on a graph that resolved it. An entity that still carries its own
+ * `references` keeps them: the edges are the copy.
+ *
+ * ## A live graph has lost the declaration
+ *
+ * `chant graph --live` hands over observed nodes: an address, a root, the
+ * provider's type, and no `mode`, no `body` and no edge. Read as they stand,
+ * no root is live, so the account is never read here; no block has a size,
+ * because `body.instance_type` went with the body; and containment is empty.
+ * The figures that come back are well-formed and differ from the declared
+ * side's for reasons that have nothing to do with the account, which is the
+ * delta this producer exists to keep honest.
+ *
+ * So under `from: "live"`, a root any of whose entities arrived with no
+ * `mode` is declared again from the project's own config, and the producer
+ * then reads the account itself, as it does for any other caller. The
+ * observed entities of that root are set aside, the undeclared ones
+ * included: an owned orphan is the live read's to list, under the key
+ * `observeAmbient` gave it, and one the account no longer holds is not in a
+ * prediction of the account.
+ *
+ * A root the config does not render is left as it arrived. That is a worse
+ * reading and the only one available.
+ *
+ * ## What stops here
+ *
+ * The caller's `edges` and `edgeCoverage`. Both are this producer's to
+ * compute, from whichever reads it ends up making (see
+ * {@link TerraformPredictOptions}).
+ */
+export async function terraformPredictOptionsFrom(options, redeclare = readTerraformDeclaration) {
+    const { entities: given, edges, edgeCoverage: _edgeCoverage, ...rest } = options;
+    const leaving = new Map();
+    for (const edge of edges ?? []) {
+        if (edge.kind !== "ref")
+            continue;
+        const reference = {
+            to: edge.to,
+            ...(edge.viaAttr !== undefined ? { viaAttr: edge.viaAttr } : {}),
+            ...(edge.toAttr !== undefined ? { toAttr: edge.toAttr } : {}),
+        };
+        (leaving.get(edge.from) ?? leaving.set(edge.from, []).get(edge.from)).push(reference);
+    }
+    const entities = new Map();
+    for (const [name, entity] of given) {
+        const own = entity.references;
+        const references = Array.isArray(own) ? own : leaving.get(name);
+        entities.set(name, references === undefined ? entity : { ...entity, references });
+    }
+    if (options.from !== "live")
+        return { ...rest, entities };
+    const observed = new Set();
+    for (const name of options.entityNames) {
+        const entity = entities.get(name);
+        const root = rootOf(entity);
+        if (root !== undefined && entity?.props.mode === undefined)
+            observed.add(root);
+    }
+    if (observed.size === 0)
+        return { ...rest, entities };
+    const declared = new Map();
+    for (const [name, entity] of await redeclare()) {
+        const root = rootOf(entity);
+        if (root === undefined || !observed.has(root))
+            continue;
+        (declared.get(root) ?? declared.set(root, new Map()).get(root)).set(name, entity);
+    }
+    const entityNames = options.entityNames.filter((name) => {
+        const root = rootOf(entities.get(name));
+        if (root === undefined || !declared.has(root))
+            return true;
+        entities.delete(name);
+        return false;
+    });
+    for (const again of declared.values()) {
+        for (const [name, entity] of again) {
+            entities.set(name, entity);
+            entityNames.push(name);
+        }
+    }
+    return { ...rest, entityNames, entities };
+}
+/** Which roots the request would read live: those whose entities the parse stamped `mode: "live"`. */
+export function liveRootsOf(entityNames, entities) {
+    const roots = new Set();
+    for (const name of entityNames) {
+        const props = entities.get(name)?.props;
+        const root = typeof props?.root === "string" ? props.root : undefined;
+        if (root && props?.mode === "live")
+            roots.add(root);
+    }
+    return [...roots].sort();
+}
+function readsAsCredentials(text) {
+    return /\b(no valid credential|credentials?|not authorized|unauthorized|accessdenied|access denied|expiredtoken|invalidclienttokenid|signature)\b/i.test(text);
+}
+/**
+ * Predict from the account for every live root, and from the declaration for
+ * every other, through the engine `deps.predict` fronts.
+ */
+export async function predictTerraformBehaviour(options, deps = REAL_DEPS) {
+    const { cwd, from: _from, ...contract } = options;
+    const where = cwd ? { cwd } : {};
+    const reads = [];
+    const failed = new Map();
+    const roots = options.from === "declared" ? [] : liveRootsOf(options.entityNames, options.entities);
+    for (const root of roots) {
+        try {
+            const listed = await deps.liveLs({ root, consistent: true, ...where });
+            const planned = await deps.livePlan({ root, ...where });
+            reads.push({ root, listing: readLiveLs(listed.json), plan: indexLivePlan(planned.json) });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            failed.set(root, message);
+        }
+    }
+    // A root whose read failed contributes no node and every one of its
+    // resources as `read-failed`, naming the root: the tri-state's rule for a
+    // broken read, applied to a prediction.
+    const unpredicted = {};
+    const entityNames = options.entityNames.filter((name) => {
+        const entity = options.entities.get(name);
+        const root = typeof entity?.props.root === "string" ? entity.props.root : undefined;
+        if (!root || !failed.has(root))
+            return true;
+        if (entity?.entityType === RESOURCE_TYPE) {
+            const message = failed.get(root);
+            unpredicted[name] = {
+                type: RESOURCE_TYPE,
+                reason: "read-failed",
+                detail: `terraform.roots.${root}: the live read failed, so the account was not predicted for this root` +
+                    `${readsAsCredentials(message) ? " (the failure names credentials)" : ""}: ${message.split("\n")[0]}`,
+            };
+            return false;
+        }
+        return true;
+    });
+    const built = terraformBehaviourRequest({
+        environment: contract.environment,
+        buildOutput: contract.buildOutput,
+        traffic: contract.traffic,
+        from: options.from,
+        ...(contract.region !== undefined ? { region: contract.region } : {}),
+        ...(contract.stack !== undefined ? { stack: contract.stack } : {}),
+        ...(contract.owned !== undefined ? { owned: contract.owned } : {}),
+        entityNames,
+        entities: options.entities,
+        live: reads,
+    });
+    Object.assign(unpredicted, built.unpredicted);
+    const unsafe = screenBehaviourRequest(TERRAFORM, built.request);
+    if (unsafe)
+        return unsafe;
+    const result = await deps.predict(built.request);
+    if (isBehaviourRefusalReport(result))
+        return result;
+    const extra = Object.keys(unpredicted);
+    if (extra.length === 0)
+        return result;
+    return behaviourReport({
+        entityNames: [...built.request.entityNames, ...extra],
+        traffic: result.meta.at.traffic,
+        edgeCoverage: result.meta.edgeCoverage,
+    }, {
+        engine: result.meta.engine,
+        version: result.meta.version,
+        ...(result.meta.total ? { total: result.meta.total } : {}),
+    }, result.entities, { ...result.unpredicted, ...unpredicted });
+}

package/dist/behaviour/reference-catalog.js

@@ -0,0 +1,178 @@
+/**
+ * How the aws provider's resources reference each other, as a `ReferenceCatalog`
+ * over terraform's own argument names (#2360).
+ *
+ * `packages/core/src/graph-refs.ts`'s `reconstructEdges` turns a bag of nodes
+ * into a graph by reading identifier values out of each node's attributes and
+ * matching them against every other node's identity. The aws lexicon's
+ * catalog does that over the SDK's shape (`VpcId`, `SecurityGroups[].GroupId`);
+ * this one does it over a terraform block's shape (`vpc_id`,
+ * `vpc_security_group_ids[]`), because that is the shape a block's body has
+ * after `../hcl/parse.ts` and the shape `./request.ts` hands the resolver on
+ * both the declared and the live side.
+ *
+ * ## Keyed by provider type, not by chant entity type
+ *
+ * Every terraform `resource` block is `Terraform::Resource` to chant. A rule
+ * keyed on that would apply to a VPC and an instance alike, so the nodes
+ * `./request.ts` builds for the resolver carry the **provider type** as their
+ * `kind` — `aws_subnet` — and the rules here are keyed the same way. That is
+ * also why this catalog is not declared on the plugin as `referenceCatalog`:
+ * `chant graph --live` builds its nodes with `kind: "Terraform::Resource"`
+ * and attributes that carry no arguments at all, so declaring it there would
+ * be a catalog that matched nothing and looked like coverage.
+ *
+ * ## Two relations, and why the split matters to an engine
+ *
+ * A `containment` rule (subnet ∈ VPC, instance ∈ subnet) becomes a boundary
+ * pair and a traversable containment edge; a `reference` rule becomes an
+ * ordinary edge. `PredictBehaviourOptions.edges` carries the second and
+ * `edgeCoverage.containmentEdges` the first, and the contract keeps them
+ * apart for a reason that is the whole of #2360's first review comment: a
+ * "one zone lost" verdict is computed over zone membership, and membership is
+ * not a reference. Both sides of the declared-versus-live delta run these
+ * same rules, so neither side is structurally short of containment the other
+ * has.
+ *
+ * ## Multi-kind arguments carry no `targetKind`
+ *
+ * `reconstructEdges` records a value under a rule with a `targetKind` as
+ * dangling when the value resolves to a node of another kind. An argument
+ * that legitimately points at more than one kind — a target-group attachment's
+ * `target_id` is an instance or a function — would therefore report every
+ * match of the other kind as a reference leaving the estate. Those rules name
+ * no `targetKind` and take whatever the identifier resolves to, the same
+ * choice the aws catalog makes for its CloudFormation template paths.
+ *
+ * ## What "no rule" means
+ *
+ * A kind with no rule here produces no edges and, on its own, no complaint —
+ * the quiet gap `edgeCoverage.unresolvedKinds` exists to name. But "no rule"
+ * has two causes that should not read alike: nobody has written one, or the
+ * kind holds no identifier-bearing argument to write one about. A VPC
+ * references nothing; an SQS queue names its dead-letter queue inside a JSON
+ * document this catalog does not read. {@link REFERENCES_NOTHING} is the list
+ * of kinds in the first position, checked rather than assumed, so that an
+ * estate with a VPC in it is not `partial` forever and an estate with a queue
+ * in it is not `complete` by omission.
+ */
+/**
+ * Provider types this catalog has looked at and found to hold no argument
+ * that identifies another resource. A node of one of these kinds is not an
+ * unresolved kind: nothing was looked for because there is nothing to find.
+ *
+ * Deliberately short. A kind is added here when every identifier-bearing
+ * argument it has is also a rule below, or when it has none — not when its
+ * references happen to be inconvenient to read.
+ */
+export const REFERENCES_NOTHING = new Set([
+    "aws_vpc",
+    "aws_s3_bucket",
+    "aws_ecs_cluster",
+    "aws_ecr_repository",
+    "aws_route53_zone",
+]);
+/** The catalog. Rules are grouped by the relation they produce. */
+export const TERRAFORM_REFERENCE_CATALOG = {
+    // Every node is indexed by its own id and physical id (`reconstructEdges`
+    // does that itself), and a block's body never carries a second identifier
+    // for the block, so there are no identity rules to declare.
+    identities: [],
+    refs: [
+        // ── containment (→ boundary pairs, and containment edges) ──
+        { from: "aws_subnet", path: "vpc_id", targetKind: "aws_vpc", relation: "containment", label: "in VPC" },
+        { from: "aws_security_group", path: "vpc_id", targetKind: "aws_vpc", relation: "containment", label: "in VPC" },
+        { from: "aws_route_table", path: "vpc_id", targetKind: "aws_vpc", relation: "containment", label: "in VPC" },
+        { from: "aws_internet_gateway", path: "vpc_id", targetKind: "aws_vpc", relation: "containment", label: "in VPC" },
+        { from: "aws_lb_target_group", path: "vpc_id", targetKind: "aws_vpc", relation: "containment", label: "in VPC" },
+        { from: "aws_vpc_endpoint", path: "vpc_id", targetKind: "aws_vpc", relation: "containment", label: "in VPC" },
+        // An instance's subnet is the hop a topology fold takes first, so it is
+        // traversable as an ordinary edge too — the same `viaAttr` opt-in the aws
+        // catalog gives `AWS::EC2::Instance.SubnetId`.
+        { from: "aws_instance", path: "subnet_id", targetKind: "aws_subnet", relation: "containment", label: "in subnet", viaAttr: "subnet_id" },
+        { from: "aws_nat_gateway", path: "subnet_id", targetKind: "aws_subnet", relation: "containment", label: "in subnet" },
+        { from: "aws_network_interface", path: "subnet_id", targetKind: "aws_subnet", relation: "containment", label: "in subnet" },
+        { from: "aws_lb", path: "subnets[]", targetKind: "aws_subnet", relation: "containment", label: "in subnet" },
+        { from: "aws_alb", path: "subnets[]", targetKind: "aws_subnet", relation: "containment", label: "in subnet" },
+        { from: "aws_lambda_function", path: "vpc_config[].subnet_ids[]", targetKind: "aws_subnet", relation: "containment", label: "in subnet" },
+        { from: "aws_db_subnet_group", path: "subnet_ids[]", targetKind: "aws_subnet", relation: "containment", label: "in subnet" },
+        { from: "aws_elasticache_subnet_group", path: "subnet_ids[]", targetKind: "aws_subnet", relation: "containment", label: "in subnet" },
+        { from: "aws_db_instance", path: "db_subnet_group_name", targetKind: "aws_db_subnet_group", relation: "containment", label: "in subnet group" },
+        { from: "aws_rds_cluster", path: "db_subnet_group_name", targetKind: "aws_db_subnet_group", relation: "containment", label: "in subnet group" },
+        { from: "aws_elasticache_cluster", path: "subnet_group_name", targetKind: "aws_elasticache_subnet_group", relation: "containment", label: "in subnet group" },
+        { from: "aws_ecs_service", path: "network_configuration[].subnets[]", targetKind: "aws_subnet", relation: "containment", label: "in subnet" },
+        { from: "aws_eks_cluster", path: "vpc_config[].subnet_ids[]", targetKind: "aws_subnet", relation: "containment", label: "in subnet" },
+        { from: "aws_eks_node_group", path: "subnet_ids[]", targetKind: "aws_subnet", relation: "containment", label: "in subnet" },
+        // ── references (→ edges) ──
+        { from: "aws_security_group_rule", path: "security_group_id", targetKind: "aws_security_group", relation: "reference", label: "rule on", viaAttr: "security_group_id" },
+        { from: "aws_security_group_rule", path: "source_security_group_id", targetKind: "aws_security_group", relation: "reference", label: "allows" },
+        { from: "aws_vpc_security_group_ingress_rule", path: "security_group_id", targetKind: "aws_security_group", relation: "reference", label: "rule on", viaAttr: "security_group_id" },
+        { from: "aws_vpc_security_group_ingress_rule", path: "referenced_security_group_id", targetKind: "aws_security_group", relation: "reference", label: "allows" },
+        { from: "aws_vpc_security_group_egress_rule", path: "security_group_id", targetKind: "aws_security_group", relation: "reference", label: "rule on", viaAttr: "security_group_id" },
+        { from: "aws_vpc_security_group_egress_rule", path: "referenced_security_group_id", targetKind: "aws_security_group", relation: "reference", label: "allows" },
+        { from: "aws_instance", path: "vpc_security_group_ids[]", targetKind: "aws_security_group", relation: "reference", label: "sg", viaAttr: "vpc_security_group_ids" },
+        { from: "aws_instance", path: "security_groups[]", targetKind: "aws_security_group", relation: "reference", label: "sg", viaAttr: "security_groups" },
+        { from: "aws_instance", path: "iam_instance_profile", targetKind: "aws_iam_instance_profile", relation: "reference", label: "as" },
+        { from: "aws_network_interface", path: "security_groups[]", targetKind: "aws_security_group", relation: "reference", label: "sg" },
+        { from: "aws_lambda_function", path: "vpc_config[].security_group_ids[]", targetKind: "aws_security_group", relation: "reference", label: "sg" },
+        { from: "aws_lambda_function", path: "role", targetKind: "aws_iam_role", relation: "reference", label: "as" },
+        { from: "aws_db_instance", path: "vpc_security_group_ids[]", targetKind: "aws_security_group", relation: "reference", label: "sg" },
+        { from: "aws_rds_cluster", path: "vpc_security_group_ids[]", targetKind: "aws_security_group", relation: "reference", label: "sg" },
+        { from: "aws_rds_cluster_instance", path: "cluster_identifier", targetKind: "aws_rds_cluster", relation: "reference", label: "in cluster" },
+        { from: "aws_elasticache_cluster", path: "security_group_ids[]", targetKind: "aws_security_group", relation: "reference", label: "sg" },
+        { from: "aws_lb", path: "security_groups[]", targetKind: "aws_security_group", relation: "reference", label: "sg" },
+        { from: "aws_alb", path: "security_groups[]", targetKind: "aws_security_group", relation: "reference", label: "sg" },
+        { from: "aws_lb_listener", path: "load_balancer_arn", targetKind: "aws_lb", relation: "reference", label: "on" },
+        { from: "aws_lb_listener", path: "default_action[].target_group_arn", targetKind: "aws_lb_target_group", relation: "reference", label: "forwards to" },
+        { from: "aws_lb_target_group_attachment", path: "target_group_arn", targetKind: "aws_lb_target_group", relation: "reference", label: "in group" },
+        // An instance, a function or an IP; no `targetKind` (see the module doc).
+        { from: "aws_lb_target_group_attachment", path: "target_id", relation: "reference", label: "targets" },
+        { from: "aws_route", path: "route_table_id", targetKind: "aws_route_table", relation: "reference", label: "in table", viaAttr: "route_table_id" },
+        { from: "aws_route", path: "gateway_id", targetKind: "aws_internet_gateway", relation: "reference", label: "via", viaAttr: "gateway_id" },
+        { from: "aws_route", path: "nat_gateway_id", targetKind: "aws_nat_gateway", relation: "reference", label: "via" },
+        { from: "aws_route_table_association", path: "subnet_id", targetKind: "aws_subnet", relation: "reference", label: "associates", viaAttr: "subnet_id" },
+        { from: "aws_route_table_association", path: "route_table_id", targetKind: "aws_route_table", relation: "reference", label: "to table", viaAttr: "route_table_id" },
+        { from: "aws_nat_gateway", path: "allocation_id", targetKind: "aws_eip", relation: "reference", label: "uses" },
+        { from: "aws_eip", path: "instance", targetKind: "aws_instance", relation: "reference", label: "attached to" },
+        { from: "aws_eip", path: "network_interface", targetKind: "aws_network_interface", relation: "reference", label: "attached to" },
+        { from: "aws_ecs_service", path: "cluster", targetKind: "aws_ecs_cluster", relation: "reference", label: "in cluster" },
+        { from: "aws_ecs_service", path: "task_definition", targetKind: "aws_ecs_task_definition", relation: "reference", label: "runs" },
+        { from: "aws_ecs_service", path: "load_balancer[].target_group_arn", targetKind: "aws_lb_target_group", relation: "reference", label: "registered in" },
+        { from: "aws_ecs_service", path: "network_configuration[].security_groups[]", targetKind: "aws_security_group", relation: "reference", label: "sg" },
+        { from: "aws_ecs_task_definition", path: "execution_role_arn", targetKind: "aws_iam_role", relation: "reference", label: "as" },
+        { from: "aws_ecs_task_definition", path: "task_role_arn", targetKind: "aws_iam_role", relation: "reference", label: "as" },
+        { from: "aws_eks_node_group", path: "cluster_name", targetKind: "aws_eks_cluster", relation: "reference", label: "in cluster" },
+        { from: "aws_eks_cluster", path: "role_arn", targetKind: "aws_iam_role", relation: "reference", label: "as" },
+        { from: "aws_s3_bucket_policy", path: "bucket", targetKind: "aws_s3_bucket", relation: "reference", label: "grant on" },
+        { from: "aws_s3_bucket_versioning", path: "bucket", targetKind: "aws_s3_bucket", relation: "reference", label: "setting on" },
+        { from: "aws_s3_bucket_public_access_block", path: "bucket", targetKind: "aws_s3_bucket", relation: "reference", label: "setting on" },
+        { from: "aws_s3_bucket_server_side_encryption_configuration", path: "bucket", targetKind: "aws_s3_bucket", relation: "reference", label: "setting on" },
+        { from: "aws_s3_bucket_lifecycle_configuration", path: "bucket", targetKind: "aws_s3_bucket", relation: "reference", label: "setting on" },
+        { from: "aws_s3_bucket_ownership_controls", path: "bucket", targetKind: "aws_s3_bucket", relation: "reference", label: "setting on" },
+        { from: "aws_s3_bucket_acl", path: "bucket", targetKind: "aws_s3_bucket", relation: "reference", label: "grant on" },
+        { from: "aws_sqs_queue_policy", path: "queue_url", targetKind: "aws_sqs_queue", relation: "reference", label: "grant on" },
+        { from: "aws_lambda_event_source_mapping", path: "event_source_arn", relation: "reference", label: "drains" },
+        { from: "aws_lambda_event_source_mapping", path: "function_name", targetKind: "aws_lambda_function", relation: "reference", label: "invokes" },
+        { from: "aws_lambda_permission", path: "function_name", targetKind: "aws_lambda_function", relation: "reference", label: "grant on" },
+        { from: "aws_sns_topic_subscription", path: "topic_arn", targetKind: "aws_sns_topic", relation: "reference", label: "on" },
+        { from: "aws_cloudwatch_log_group", path: "kms_key_id", targetKind: "aws_kms_key", relation: "reference", label: "encrypted with" },
+        { from: "aws_sns_topic", path: "kms_master_key_id", targetKind: "aws_kms_key", relation: "reference", label: "encrypted with" },
+        { from: "aws_dynamodb_table", path: "server_side_encryption[].kms_key_arn", targetKind: "aws_kms_key", relation: "reference", label: "encrypted with" },
+        { from: "aws_iam_role_policy_attachment", path: "role", targetKind: "aws_iam_role", relation: "reference", label: "on" },
+        { from: "aws_iam_role_policy_attachment", path: "policy_arn", targetKind: "aws_iam_policy", relation: "reference", label: "attaches" },
+        { from: "aws_iam_role_policy", path: "role", targetKind: "aws_iam_role", relation: "reference", label: "on" },
+        { from: "aws_iam_instance_profile", path: "role", targetKind: "aws_iam_role", relation: "reference", label: "holds" },
+        { from: "aws_route53_record", path: "zone_id", targetKind: "aws_route53_zone", relation: "reference", label: "in zone" },
+        // A bucket's regional domain name or a load balancer's DNS name; no `targetKind`.
+        { from: "aws_cloudfront_distribution", path: "origin[].domain_name", relation: "reference", label: "origin" },
+    ],
+};
+/** Every provider type the catalog has at least one rule from. */
+export const CATALOGUED_KINDS = new Set(TERRAFORM_REFERENCE_CATALOG.refs.map((r) => r.from));
+/**
+ * True when nothing would be looked for on a node of this kind: no rule is
+ * written for it, and it is not one of the kinds known to reference nothing.
+ */
+export function isUnresolvedKind(kind) {
+    return !CATALOGUED_KINDS.has(kind) && !REFERENCES_NOTHING.has(kind);
+}