@intentius/chant 0.108.1 → 0.110.0

package/src/fold-provenance.test.ts

@@ -18,6 +18,7 @@ import {
   classifyFieldOrigin,
   emittedFieldPaths,
   foldProvenanceOfEntity,
+  describeCompositeArguments,
   describeFoldFieldOrigin,
   resolveDeepDrift,
   resolveDriftedField,
@@ -76,7 +77,7 @@ describe("classifyFieldOrigin", () => {
   });
 
   test("a recorded composite literal says which composite fixes it", () => {
-    expect(classifyFieldOrigin({ kind: "composite-literal", composite: "WebService" }, composite)).toEqual({
+    expect(classifyFieldOrigin({ kind: "composite-literal", composite: "WebService" }, composite)).toMatchObject({
       kind: "composite-literal",
       composite: "WebService",
       instance: "web",
@@ -102,6 +103,17 @@ describe("classifyFieldOrigin", () => {
     });
   });
 
+  test("a host origin is unknown with that reason, never a direct declaration (typescript-as-data#248)", () => {
+    expect(classifyFieldOrigin({ kind: "host", reason: "host-call" }, authored)).toEqual({
+      kind: "unknown",
+      reason: "host-call",
+    });
+    expect(classifyFieldOrigin({ kind: "host", reason: "host-value" }, authored)).toEqual({
+      kind: "unknown",
+      reason: "host-value",
+    });
+  });
+
   test("no origin on an entity no composite expanded is a direct declaration", () => {
     expect(classifyFieldOrigin(undefined, authored)).toEqual({ kind: "direct" });
   });
@@ -244,6 +256,126 @@ describe("resolveDriftedField", () => {
   });
 });
 
+describe("the drift report's origin line (#3597)", () => {
+  const call = { file: "/p/src/app.ts", line: 10, column: 20 };
+  const compositeProv: EntityProvenance = {
+    sourceFile: "/p/src/app.ts",
+    composite: "WebApp",
+    compositeInstance: "web",
+    compositeCall: call,
+  };
+  const base = { entity: "webDeployment", entityType: "Deployment", root: "/p", declared: 3, live: 5 };
+
+  test("a composite parameter names the call, the argument as written, and its file and line", () => {
+    const resolved = resolveDriftedField({
+      ...base,
+      path: "spec.replicas",
+      origin: {
+        kind: "composite-parameter",
+        composite: "WebApp",
+        parameters: ["replicas"],
+        arguments: [{ parameter: "replicas", file: "/p/src/app.ts", line: 12, column: 3, text: "replicas: 3" }],
+      },
+      provenance: compositeProv,
+    });
+    expect(resolved.summary).toBe(
+      "spec.replicas on Deployment webDeployment comes from WebApp({ replicas: 3 }) at src/app.ts:12",
+    );
+    expect(resolved.resolution.description).toContain("the `web` call of composite WebApp at src/app.ts:12");
+    // The origin object carries the locations, for --json.
+    expect(resolved.origin).toEqual({
+      kind: "composite-parameter",
+      composite: "WebApp",
+      instance: "web",
+      parameters: ["replicas"],
+      call,
+      arguments: [{ parameter: "replicas", file: "/p/src/app.ts", line: 12, column: 3, text: "replicas: 3" }],
+    });
+  });
+
+  test("a nested parameter is shown nested, and a parameter the call does not write says so", () => {
+    expect(describeCompositeArguments("WebService", [
+      { parameter: "iam.path", file: "/p/a.ts", line: 4, column: 9, text: 'path: "/x/"' },
+    ])).toBe('WebService({ iam: { path: "/x/" } })');
+
+    const resolved = resolveDriftedField({
+      ...base,
+      path: "spec.template.spec.containers[#web].image",
+      origin: {
+        kind: "composite-parameter",
+        composite: "WebApp",
+        parameters: ["image"],
+        arguments: [{ parameter: "image", ...call }],
+      },
+      provenance: compositeProv,
+    });
+    expect(resolved.summary).toBe(
+      "spec.template.spec.containers[#web].image on Deployment webDeployment comes from WebApp(...) " +
+        "at src/app.ts:10 (parameter image, not written at the call)",
+    );
+  });
+
+  test("a composite literal says the composite fixes it, at the call", () => {
+    const resolved = resolveDriftedField({
+      ...base,
+      path: "spec.strategy.type",
+      origin: { kind: "composite-literal", composite: "WebApp" },
+      provenance: compositeProv,
+    });
+    expect(resolved.summary).toBe(
+      "spec.strategy.type on Deployment webDeployment is fixed inside composite WebApp; " +
+        "no argument to the call at src/app.ts:10 moves it",
+    );
+    expect(resolved.resolution.description).toContain("fixed by the `web` call of composite WebApp at src/app.ts:10");
+  });
+
+  test("a direct declaration says direct, and the resolution is today's", () => {
+    const resolved = resolveDriftedField({
+      ...base,
+      entity: "worker",
+      path: "spec.replicas",
+      provenance: { sourceFile: "/p/src/app.ts" },
+    });
+    expect(resolved.origin).toEqual({ kind: "direct" });
+    expect(resolved.summary).toBe("spec.replicas on Deployment worker is declared directly in src/app.ts");
+    expect(resolved.resolution).toEqual({
+      kind: "edit-declaration",
+      sourceFile: "/p/src/app.ts",
+      description: "change the declared value of `spec.replicas` in src/app.ts from 3 to 5.",
+    });
+  });
+
+  test("an unknown origin says unknown and why, and never reads as direct", () => {
+    for (const [provenance, why] of [
+      [{ sourceFile: "/p/src/app.ts", composite: "WebApp", compositeInstance: "web" }, "did not interpret"],
+      [undefined, "recorded no provenance"],
+    ] as const) {
+      const resolved = resolveDriftedField({ ...base, path: "spec.replicas", ...(provenance ? { provenance } : {}) });
+      expect(resolved.origin.kind).toBe("unknown");
+      expect(resolved.summary).toMatch(/^spec\.replicas on Deployment webDeployment has an unknown origin: /);
+      expect(resolved.summary).toContain(why);
+      expect(resolved.summary).not.toContain("direct");
+      expect(resolved.resolution.kind).toBe("fall-back");
+    }
+  });
+
+  test("a file outside the project root is printed as recorded", () => {
+    const resolved = resolveDriftedField({
+      ...base,
+      root: "/elsewhere",
+      path: "spec.replicas",
+      origin: {
+        kind: "composite-parameter",
+        composite: "WebApp",
+        parameters: ["replicas"],
+        arguments: [{ parameter: "replicas", file: "/p/src/app.ts", line: 12, column: 3, text: "replicas: 3" }],
+      },
+      provenance: compositeProv,
+    });
+    expect(resolved.summary).toContain("at /p/src/app.ts:12");
+  });
+});
+
 describe("resolveDeepDrift", () => {
   test("reads the drifted list and nothing else", () => {
     const verdicts = resolveDeepDrift(
@@ -399,25 +531,25 @@ describe("fold provenance over a real composite build (#2161)", () => {
     // 1. A field the composite PARAMETERIZES, including a nested parameter
     //    path, one read through a body `const`, and one read from inside an
     //    array literal.
-    expect(result.foldProvenance.webBucket.fields.BucketName).toEqual({
+    expect(result.foldProvenance.webBucket.fields.BucketName).toMatchObject({
       kind: "composite-parameter",
       composite: "WebService",
       instance: "web",
       parameters: ["name"],
     });
-    expect(result.foldProvenance.webBucket.fields.Tags).toEqual({
+    expect(result.foldProvenance.webBucket.fields.Tags).toMatchObject({
       kind: "composite-parameter",
       composite: "WebService",
       instance: "web",
       parameters: ["tier"],
     });
-    expect(result.foldProvenance.webRole.fields.RoleName).toEqual({
+    expect(result.foldProvenance.webRole.fields.RoleName).toMatchObject({
       kind: "composite-parameter",
       composite: "WebService",
       instance: "web",
       parameters: ["name"],
     });
-    expect(result.foldProvenance.webRole.fields.Path).toEqual({
+    expect(result.foldProvenance.webRole.fields.Path).toMatchObject({
       kind: "composite-parameter",
       composite: "WebService",
       instance: "web",
@@ -425,12 +557,12 @@ describe("fold provenance over a real composite build (#2161)", () => {
     });
 
     // 2. A field the composite FIXES.
-    expect(result.foldProvenance.webBucket.fields["VersioningConfiguration.Status"]).toEqual({
+    expect(result.foldProvenance.webBucket.fields["VersioningConfiguration.Status"]).toMatchObject({
       kind: "composite-literal",
       composite: "WebService",
       instance: "web",
     });
-    expect(result.foldProvenance.webRole.fields.Description).toEqual({
+    expect(result.foldProvenance.webRole.fields.Description).toMatchObject({
       kind: "composite-literal",
       composite: "WebService",
       instance: "web",
@@ -507,6 +639,43 @@ describe("fold provenance over a real composite build (#2161)", () => {
     // A direct declaration: today's behaviour, unchanged and unremarked.
     expect(verdicts[3].resolution.kind).toBe("edit-declaration");
   });
+
+  test("the build records where the composite call and each argument were written (#3597)", async () => {
+    const result = await build(srcDir, [namesSerializer], undefined, {
+      fold: true,
+      lexicons: [LEXICON_NAME],
+    });
+    expect(result.errors).toEqual([]);
+    const main = join(srcDir, "main.ts");
+    const lines = MAIN.split("\n");
+    const lineOf = (needle: string) => lines.findIndex((l) => l.includes(needle)) + 1;
+    const columnOf = (needle: string) => (lines.find((l) => l.includes(needle)) as string).indexOf(needle) + 1;
+    const call = { file: main, line: lineOf("WebService({"), column: columnOf("WebService({") };
+
+    expect(result.foldProvenance.webBucket.compositeCall).toEqual(call);
+    expect(result.foldProvenance.webRole.compositeCall).toEqual(call);
+    expect(result.foldProvenance.webBucket.fields.BucketName).toEqual({
+      kind: "composite-parameter",
+      composite: "WebService",
+      instance: "web",
+      parameters: ["name"],
+      call,
+      arguments: [{ parameter: "name", file: main, line: call.line, column: columnOf('name: "data"'), text: 'name: "data"' }],
+    });
+    expect(result.foldProvenance.webRole.fields.Path).toMatchObject({
+      arguments: [{ parameter: "iam.path", line: call.line, column: columnOf('path: "/service/"'), text: 'path: "/service/"' }],
+    });
+    expect(result.foldProvenance.webBucket.fields["VersioningConfiguration.Status"]).toEqual({
+      kind: "composite-literal",
+      composite: "WebService",
+      instance: "web",
+      call,
+    });
+
+    // A direct declaration and an uninterpreted composite record no call.
+    expect(result.foldProvenance.logs.compositeCall).toBeUndefined();
+    expect(result.foldProvenance.legacyBucket.compositeCall).toBeUndefined();
+  });
 });
 
 // ─────────────────────────────────────────────────────────────────────────
@@ -604,18 +773,23 @@ describe("fold provenance through a tagged template in a composite factory (#321
     const at = (parameters: string[]) => ({ kind: "composite-parameter", composite: "EventsTable", instance: "clicks", parameters });
     const fixed = { kind: "composite-literal", composite: "EventsTable", instance: "clicks" };
 
-    expect(events.fields.name).toEqual(at(["name"]));
-    expect(events.fields.ttl).toEqual(at(["ttlDays"]));
-    expect(events.fields.ddl).toEqual(at(["name", "ttlDays"]));
-    expect(events.fields.engine).toEqual(fixed);
-    expect(events.fields.orderBy).toEqual(fixed);
+    expect(events.fields.name).toMatchObject(at(["name"]));
+    expect(events.fields.ttl).toMatchObject(at(["ttlDays"]));
+    expect(events.fields.ddl).toMatchObject(at(["name", "ttlDays"]));
+    expect(events.fields.engine).toMatchObject(fixed);
+    expect(events.fields.orderBy).toMatchObject(fixed);
+    // #3597 — the argument behind a tag-fed field, where the call wrote it.
+    expect(events.fields.ttl).toMatchObject({ arguments: [{ parameter: "ttlDays", line: 6, text: "ttlDays: 30" }] });
+    expect(events.fields.ddl).toMatchObject({
+      arguments: [{ parameter: "name", text: 'name: "clicks"' }, { parameter: "ttlDays", text: "ttlDays: 30" }],
+    });
 
     // Through a body `const`; an interpolated literal string is fixed; an
     // interpolated sibling entity is wiring, so it governs nothing.
-    expect(rollup.fields.name).toEqual(at(["name"]));
-    expect(rollup.fields.engine).toEqual(fixed);
-    expect(rollup.fields.comment).toEqual(fixed);
-    expect(rollup.fields.ddl).toEqual(at(["name"]));
+    expect(rollup.fields.name).toMatchObject(at(["name"]));
+    expect(rollup.fields.engine).toMatchObject(fixed);
+    expect(rollup.fields.comment).toMatchObject(fixed);
+    expect(rollup.fields.ddl).toMatchObject(at(["name"]));
 
     expect(result.foldProvenance.audit.fields.ttl).toBeUndefined();
     expect(result.foldProvenance.audit.fields.name).toEqual({ kind: "direct" });

package/src/fold-provenance.ts

@@ -70,10 +70,21 @@
  */
 
 import { isResourceDeclarable, type Declarable } from "./declarable";
-import { originOfPath, type EntityProvenance, type PathOrigin } from "./provenance";
+import { relative, isAbsolute } from "node:path";
+import {
+  originOfPath,
+  type ArgumentLocation,
+  type EntityProvenance,
+  type PathOrigin,
+  type SourceLocation,
+} from "./provenance";
 import type { DeepEntityDrift, PropertyDrift } from "./lifecycle/deep-diff";
 
-/** Why a field's origin could not be determined. Both are facts about the BUILD, not about the field. */
+/**
+ * Why a field's origin could not be determined. The first two are facts about
+ * the BUILD; the host reasons are facts about the expression, and match the
+ * strings the specification's reference implementation reports.
+ */
 export type UnknownOriginReason =
   /**
    * A composite expanded the entity and this build did not interpret its body,
@@ -87,7 +98,15 @@ export type UnknownOriginReason =
    * composite make it" is answerable. A sandboxed child's entities arrive this
    * way: `discovery/entity-wire-codec.ts` drops build metadata over the wire.
    */
-  | "no-provenance";
+  | "no-provenance"
+  /**
+   * INTENTIUS/typescript-as-data#248: host code computed the value, by a method
+   * called on a real receiver (`"x".toUpperCase()`, `[1, 2].join("-")`) or an
+   * eager lexicon helper. The file wrote the call, not the value.
+   */
+  | "host-call"
+  /** A value a lexicon package exports, bound by an import (`AWS.Region`, `S3Actions.GetObject`). */
+  | "host-value";
 
 /**
  * What produced one emitted property path.
@@ -97,8 +116,17 @@ export type UnknownOriginReason =
  * address and "the `api` call of `AutoscaledService`" is.
  */
 export type FoldFieldOrigin =
-  | { kind: "composite-parameter"; composite: string; instance?: string; parameters: string[] }
-  | { kind: "composite-literal"; composite: string; instance?: string }
+  | {
+      kind: "composite-parameter";
+      composite: string;
+      instance?: string;
+      parameters: string[];
+      /** Where the composite call was written (chant #3597), when the build saw it. */
+      call?: SourceLocation;
+      /** Where each parameter's argument was written at that call, in `parameters` order. */
+      arguments?: ArgumentLocation[];
+    }
+  | { kind: "composite-literal"; composite: string; instance?: string; call?: SourceLocation }
   | { kind: "direct" }
   | { kind: "unknown"; reason: UnknownOriginReason };
 
@@ -110,6 +138,11 @@ export interface EntityFoldProvenance {
   composite?: string;
   /** The composite call (export name) it belongs to, when one expanded it. */
   instance?: string;
+  /**
+   * Where that composite call was written (chant #3597), when the fold
+   * interpreted the factory at a call it saw as written.
+   */
+  compositeCall?: SourceLocation;
   /**
    * Emitted property path to origin, in sorted key order. Every path the entity
    * emits is present: a path with no attribution carries an `unknown` origin
@@ -178,6 +211,7 @@ export function classifyFieldOrigin(
 ): FoldFieldOrigin {
   if (!provenance) return { kind: "unknown", reason: "no-provenance" };
   const instance = provenance.compositeInstance;
+  const call = provenance.compositeCall;
 
   switch (origin?.kind) {
     case "composite-parameter":
@@ -186,15 +220,33 @@ export function classifyFieldOrigin(
         composite: origin.composite,
         ...(instance ? { instance } : {}),
         parameters: [...origin.parameters],
+        ...(call ? { call: { ...call } } : {}),
+        ...(origin.arguments ? { arguments: origin.arguments.map((a) => ({ ...a })) } : {}),
       };
     case "composite-literal":
-      return { kind: "composite-literal", composite: origin.composite, ...(instance ? { instance } : {}) };
+      return {
+        kind: "composite-literal",
+        composite: origin.composite,
+        ...(instance ? { instance } : {}),
+        ...(call ? { call: { ...call } } : {}),
+      };
     case "composite":
       // The coarse kind: a composite expanded this, and nothing said which
       // parameter. Not a parameter, not a fixed literal, and above all not a
       // direct declaration.
       return { kind: "unknown", reason: "composite-not-interpreted" };
     case "authored":
+      // chant#3608 — `authored` is the file's own root record, and it reaches
+      // a path only when nothing finer did. On an entity a composite wrote (a
+      // member destructured from a composite the fold invoked) that means the
+      // fold could not attribute the path, which is `unknown`, never `direct`.
+      return provenance.composite
+        ? { kind: "unknown", reason: "composite-not-interpreted" }
+        : { kind: "direct" };
+    case "host":
+      // INTENTIUS/typescript-as-data#248 — host code produced the value, so
+      // editing the declaration edits a call, not the value it returned.
+      return { kind: "unknown", reason: origin.reason };
     case "build-param":
       // A build parameter governs the expression the AUTHOR wrote in their own
       // source, so the declaration is still theirs to edit.
@@ -224,6 +276,7 @@ export function foldProvenanceOfEntity(
     ...(provenance?.sourceFile ? { sourceFile: provenance.sourceFile } : {}),
     ...(provenance?.composite ? { composite: provenance.composite } : {}),
     ...(provenance?.compositeInstance ? { instance: provenance.compositeInstance } : {}),
+    ...(provenance?.compositeCall ? { compositeCall: { ...provenance.compositeCall } } : {}),
     fields,
   };
 }
@@ -270,6 +323,10 @@ export function unknownOriginText(reason: UnknownOriginReason): string {
       return "expanded by a composite whose factory this build did not interpret";
     case "no-provenance":
       return "this build recorded no provenance for the entity";
+    case "host-call":
+      return "the value is what a host call returned";
+    case "host-value":
+      return "the value is one a host package exports";
   }
 }
 
@@ -278,9 +335,57 @@ function compositeCall(composite: string, instance: string | undefined): string
   return instance ? `the \`${instance}\` call of composite ${composite}` : `composite ${composite}`;
 }
 
-/** `in src/app.infra.ts`, or nothing when the build recorded no file. */
-function inFile(sourceFile: string | undefined): string {
-  return sourceFile ? ` in ${sourceFile}` : "";
+/** A file as a report prints it: relative to `root` when it is inside it, otherwise as recorded. */
+function displayFile(file: string, root: string | undefined): string {
+  if (!root || !isAbsolute(file)) return file;
+  const rel = relative(root, file);
+  return rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel : file;
+}
+
+/** `src/app.ts:12`, relative to `root` when it is inside it. */
+export function formatSourceLocation(location: SourceLocation, root?: string): string {
+  return `${displayFile(location.file, root)}:${location.line}`;
+}
+
+/** ` in src/app.infra.ts`, or nothing when the build recorded no file. */
+function inFile(sourceFile: string | undefined, root: string | undefined): string {
+  return sourceFile ? ` in ${displayFile(sourceFile, root)}` : "";
+}
+
+/**
+ * The composite call as the author wrote the arguments that govern a field:
+ * `WebApp({ replicas: 3 })`, or `WebApp({ iam: { path: "/service/" } })` for a
+ * nested parameter. Only arguments actually written at the call appear; when
+ * none is, the call is shown as `WebApp(...)`.
+ */
+export function describeCompositeArguments(composite: string, locations: readonly ArgumentLocation[]): string {
+  const written = locations.filter((a) => a.text !== undefined);
+  if (written.length === 0) return `${composite}(...)`;
+  const parts = written.map((a) => {
+    const outer = a.parameter.split(".").slice(0, -1);
+    return outer.reduceRight((inner, key) => `${key}: { ${inner} }`, a.text as string);
+  });
+  return `${composite}({ ${parts.join(", ")} })`;
+}
+
+/**
+ * Where a composite-parameter field was set, as `at src/app.ts:12`: the first
+ * argument written at the call, else the call, else the declaring file.
+ */
+function parameterSite(
+  origin: Extract<FoldFieldOrigin, { kind: "composite-parameter" }>,
+  sourceFile: string | undefined,
+  root: string | undefined,
+): string {
+  const written = origin.arguments?.find((a) => a.text !== undefined);
+  const location = written ?? origin.call ?? origin.arguments?.[0];
+  if (location) return ` at ${formatSourceLocation(location, root)}`;
+  return inFile(sourceFile, root);
+}
+
+/** ` at src/app.ts:10` for the composite call, else the declaring file. */
+function callSite(call: SourceLocation | undefined, sourceFile: string | undefined, root: string | undefined): string {
+  return call ? ` at ${formatSourceLocation(call, root)}` : inFile(sourceFile, root);
 }
 
 /** A value as a report prints it. */
@@ -327,6 +432,12 @@ export interface FieldReconcile {
   declared?: unknown;
   live?: unknown;
   origin: FoldFieldOrigin;
+  /**
+   * One line naming where the field came from (chant #3597):
+   * `spec.replicas on Deployment webDeployment comes from WebApp({ replicas: 3 }) at src/app.ts:12`.
+   * An `unknown` origin says so and why; it never reads as a direct declaration.
+   */
+  summary: string;
   resolution: DriftResolution;
 }
 
@@ -337,18 +448,48 @@ export interface FieldReconcile {
  * source declared, whose live value moved. Undeclared fields are held
  * elsewhere and never reach here, so the only question left is which of the
  * four origins produced the field.
+ *
+ * `entityType` names the resource in the summary line, and `root` (the
+ * project directory) makes the file names in it relative. Both are optional;
+ * without them the summary uses the entity name alone and absolute files.
  */
 export function resolveDriftedField(input: {
   entity: string;
+  entityType?: string;
   path: string;
   declared?: unknown;
   live?: unknown;
   origin?: PathOrigin;
   provenance?: EntityProvenance;
+  root?: string;
 }): FieldReconcile {
   const origin = classifyFieldOrigin(input.origin, input.provenance);
   const sourceFile = input.provenance?.sourceFile;
+  const root = input.root;
   const move = `${renderValue(input.declared)} to ${renderValue(input.live)}`;
+  const subject = `${input.path} on ${input.entityType ? `${input.entityType} ` : ""}${input.entity}`;
+
+  const summary = ((): string => {
+    switch (origin.kind) {
+      case "composite-parameter":
+        return (
+          `${subject} comes from ${describeCompositeArguments(origin.composite, origin.arguments ?? [])}` +
+          `${parameterSite(origin, sourceFile, root)}` +
+          (origin.arguments?.some((a) => a.text !== undefined)
+            ? ""
+            : ` (parameter ${origin.parameters.join(", ")}, not written at the call)`)
+        );
+      case "composite-literal":
+        return (
+          `${subject} is fixed inside composite ${origin.composite}; ` +
+          `no argument to the call${callSite(origin.call, sourceFile, root)} moves it`
+        );
+      case "direct":
+        return `${subject} is declared directly${inFile(sourceFile, root)}`;
+      case "unknown":
+        return `${subject} has an unknown origin: ${unknownOriginText(origin.reason)}`;
+    }
+  })();
 
   const resolution: DriftResolution = ((): DriftResolution => {
     switch (origin.kind) {
@@ -363,7 +504,7 @@ export function resolveDriftedField(input: {
           description:
             `change ${parameters.length === 1 ? "parameter" : "parameters"} ` +
             `${parameters.map((p) => `\`${p}\``).join(", ")} of ` +
-            `${compositeCall(origin.composite, origin.instance)}${inFile(sourceFile)} ` +
+            `${compositeCall(origin.composite, origin.instance)}${parameterSite(origin, sourceFile, root)} ` +
             `so \`${input.path}\` moves from ${move}. The composite stays.`,
         };
       }
@@ -375,14 +516,14 @@ export function resolveDriftedField(input: {
           ...(sourceFile ? { sourceFile } : {}),
           description:
             `refused: \`${input.path}\` is fixed by ${compositeCall(origin.composite, origin.instance)}` +
-            `${inFile(sourceFile)}, so no argument at the call site moves it. ` +
+            `${callSite(origin.call, sourceFile, root)}, so no argument at the call site moves it. ` +
             `Parameterize the field in composite ${origin.composite}, or stop using the composite here.`,
         };
       case "direct":
         return {
           kind: "edit-declaration",
           ...(sourceFile ? { sourceFile } : {}),
-          description: `change the declared value of \`${input.path}\`${inFile(sourceFile)} from ${move}.`,
+          description: `change the declared value of \`${input.path}\`${inFile(sourceFile, root)} from ${move}.`,
         };
       case "unknown":
         return {
@@ -391,7 +532,7 @@ export function resolveDriftedField(input: {
           ...(sourceFile ? { sourceFile } : {}),
           description:
             `origin unknown (${unknownOriginText(origin.reason)}), so falling back to changing the ` +
-            `declared value of \`${input.path}\`${inFile(sourceFile)} from ${move}.`,
+            `declared value of \`${input.path}\`${inFile(sourceFile, root)} from ${move}.`,
         };
     }
   })();
@@ -402,6 +543,7 @@ export function resolveDriftedField(input: {
     ...("declared" in input ? { declared: input.declared } : {}),
     ...("live" in input ? { live: input.live } : {}),
     origin,
+    summary,
     resolution,
   };
 }
@@ -420,6 +562,7 @@ export function resolveDriftedField(input: {
 export function resolveDeepDrift(
   drifted: readonly DeepEntityDrift[],
   provenanceOf: (entity: string) => EntityProvenance | undefined,
+  options: { root?: string } = {},
 ): FieldReconcile[] {
   const out: FieldReconcile[] = [];
   for (const entity of drifted) {
@@ -428,11 +571,13 @@ export function resolveDeepDrift(
       out.push(
         resolveDriftedField({
           entity: entity.name,
+          entityType: entity.type,
           path: change.path,
           ...("declared" in change ? { declared: change.declared } : {}),
           ...("live" in change ? { live: change.live } : {}),
           ...(change.origin ? { origin: change.origin } : {}),
           ...(provenance ? { provenance } : {}),
+          ...(options.root ? { root: options.root } : {}),
         }),
       );
     }

package/src/import/ir-utils.ts

@@ -36,10 +36,15 @@ export function hasIntrinsicInValue(value: unknown, name: string): boolean {
  */
 export function irUsesIntrinsic(ir: TemplateIR, name: string): boolean {
   for (const resource of ir.resources) {
-    if (hasIntrinsicInValue(resource.properties, name)) {
+    if (
+      hasIntrinsicInValue(resource.properties, name) ||
+      hasIntrinsicInValue(resource.metadata, name) ||
+      hasIntrinsicInValue(resource.attributes, name)
+    ) {
       return true;
     }
   }
+  if (hasIntrinsicInValue(ir.metadata, name)) return true;
   for (const condition of ir.conditions ?? []) {
     if (hasIntrinsicInValue(condition.expression, name)) {
       return true;

package/src/import/parser.ts

@@ -9,6 +9,9 @@ export interface ParameterIR {
   readonly description?: string;
   readonly defaultValue?: unknown;
   readonly required?: boolean;
+  /** What the value is checked against, under the source format's own keys
+   * and as written (CloudFormation `AllowedValues`, `MinLength`, `NoEcho`). */
+  readonly constraints?: Readonly<Record<string, unknown>>;
 }
 
 /**
@@ -22,6 +25,11 @@ export interface ResourceIR {
   /** Name of the condition gating this resource (CloudFormation `Condition`
    * key, or equivalent), when the source template declares one (#2069). */
   readonly condition?: string;
+  /** Resource-level attributes other than the condition, under the source
+   * format's own keys (CloudFormation `DependsOn`, `DeletionPolicy`,
+   * `UpdateReplacePolicy`, `UpdatePolicy`, `CreationPolicy`). Values are
+   * parsed value trees, like {@link properties}. */
+  readonly attributes?: Readonly<Record<string, unknown>>;
 }
 
 /**