@intentius/chant 0.124.45 → 0.124.48

package/dist/graph-effective.js

@@ -1,3 +1,6 @@
+import { CapabilityEngine } from "./capabilities/matcher.js";
+import { buildView } from "./capabilities/view.js";
+import { resolvePacks, shippedRules } from "./capabilities/catalog.js";
 /**
  * Fold DERIVED reachability facts onto EC2 instance nodes so a single-node query
  * can answer questions that are otherwise a multi-hop join with a union (#1139).
@@ -19,89 +22,233 @@
  * With these, "instances SSH-reachable from the internet" is one predicate:
  *   `kind:EC2::Instance attr:internetFacing=true attr:effectiveIngress=tcp:22:0.0.0.0/0`
  * — no hand-joined CLI sweep, no over/under-counting.
+ *
+ * Both are capability rules (#4375): `internet-facing`, `in-sg` and
+ * `ingress-of` in `capabilities/aws.paths`, over the lexicon-neutral view, so
+ * one rule serves CloudFormation kinds and Terraform's AWS types (#4362)
+ * alike. What stays here is the attribute surface: which nodes get the facts,
+ * and how a rule's evidence is spelled as `proto:port:cidr` and `...Via`.
  */
-export function enrichEffectiveTopology(ir) {
-    const byId = new Map(ir.nodes.map((n) => [n.id, n]));
-    const edges = ir.edges ?? [];
-    const kind = (n) => n?.kind ?? "";
-    const isKind = (n, suffix) => !!n && (kind(n) === suffix || kind(n).endsWith("::" + suffix));
-    const via = (...names) => (v) => names.includes(v);
-    /** Out-neighbours of `id` (edges from → to), optionally filtered by viaAttr. */
-    const out = (id, pred) => edges
-        .filter((e) => e.from === id && (!pred || pred(e.viaAttr ?? e.kind ?? "")))
-        .map((e) => byId.get(e.to))
-        .filter((x) => !!x);
-    /** In-neighbours of `id` (edges to ← from), optionally filtered by viaAttr. */
-    const incoming = (id, pred) => edges
-        .filter((e) => e.to === id && (!pred || pred(e.viaAttr ?? e.kind ?? "")))
-        .map((e) => byId.get(e.from))
-        .filter((x) => !!x);
-    const normalizeIngress = (sg) => {
-        const rules = sg.attrs?.["SecurityGroupIngress"];
-        if (!Array.isArray(rules))
-            return [];
-        return rules.map((r) => {
-            const rule = r;
-            const proto = String(rule.IpProtocol ?? "-1");
-            const from = rule.FromPort;
-            const to = rule.ToPort;
-            const port = from == null ? "all" : from === to ? `${from}` : `${from}-${to}`;
-            const cidr = rule.CidrIp ??
-                rule.CidrIpv6 ??
-                (rule.SourceSecurityGroupId ? `sg:${String(rule.SourceSecurityGroupId)}` : "?");
-            return `${proto}:${port}:${cidr}`;
-        });
-    };
-    /** Security groups reachable from an instance — direct and via launch template. */
-    const effectiveSgs = (inst) => {
-        const direct = out(inst.id, via("SecurityGroupIds", "SecurityGroupId"));
-        const templates = out(inst.id, via("LaunchTemplate", "LaunchTemplateId"));
-        const viaTemplate = templates
-            .flatMap((lt) => out(lt.id, via("LaunchTemplateData", "SecurityGroupIds", "SecurityGroupId")))
-            .filter((n) => isKind(n, "SecurityGroup"));
-        const all = [...direct.filter((n) => isKind(n, "SecurityGroup")), ...viaTemplate];
-        return [...new Map(all.map((s) => [s.id, s])).values()];
-    };
-    /** The IGW an instance's subnet routes to (evidence), or undefined. */
-    const internetFacingVia = (inst) => {
-        for (const subnet of out(inst.id, via("SubnetId")).filter((n) => isKind(n, "Subnet"))) {
-            const assocs = incoming(subnet.id, via("SubnetId")).filter((a) => isKind(a, "SubnetRouteTableAssociation"));
-            const routeTables = assocs.flatMap((a) => out(a.id, via("RouteTableId")).filter((n) => isKind(n, "RouteTable")));
-            for (const rt of routeTables) {
-                const routes = incoming(rt.id, via("RouteTableId")).filter((n) => isKind(n, "Route"));
-                for (const route of routes) {
-                    const dest = route.attrs?.["DestinationCidrBlock"];
-                    const igw = out(route.id, via("GatewayId")).find((g) => isKind(g, "InternetGateway"));
-                    if (igw && (dest == null || dest === "0.0.0.0/0")) {
-                        const id = igw.id.includes("::") ? igw.id.slice(igw.id.lastIndexOf("::") + 2) : igw.id;
-                        return `${rt.id.includes("::") ? rt.id.slice(rt.id.lastIndexOf("::") + 2) : rt.id} → ${id}`;
-                    }
-                }
-            }
-        }
-        return undefined;
-    };
+export function enrichEffectiveTopology(ir, packs = []) {
+    const view = buildView(ir, resolvePacks(packs));
+    const engine = new CapabilityEngine(view, shippedRules().rules);
+    const facing = engine.set("internet-facing");
+    const groups = engine.relation("in-sg").out;
     const nodes = ir.nodes.map((n) => {
-        if (!isKind(n, "Instance"))
+        const tf = terraformResourceType(n) === "aws_instance";
+        if (!tf && !isKind(n, "Instance"))
             return n;
-        const effectiveIngress = effectiveSgs(n).flatMap(normalizeIngress);
+        const attrs = (n.attrs ?? {});
+        const reached = [...(groups.get(n.id) ?? new Map())];
+        const ingress = reached.flatMap(([sg]) => ingressStrings(view, sg));
+        const effectiveIngress = tf ? [...new Set(ingress)] : ingress;
         // A live enrichment may already have set internetFacing (+ its evidence) for
         // a subnet chant doesn't model declaratively (e.g. the account's default
         // VPC). Keep that truth; otherwise derive it from the declared route topology.
-        const attrs = (n.attrs ?? {});
         const liveFacing = attrs["internetFacing"] === true;
-        const declaredVia = internetFacingVia(n);
+        const evidence = facing.get(n.id);
+        const declaredVia = evidence && evidence.hops.length > 0 ? facingVia(view, evidence, tf) : undefined;
         const via = attrs["internetFacingVia"] ?? declaredVia;
+        const ingressVia = tf ? reached.map(([sg, ev]) => groupPath(view, ev, sg)).join(", ") : "";
         return {
             ...n,
-            attrs: { ...attrs, effectiveIngress, internetFacing: liveFacing || !!declaredVia, ...(via ? { internetFacingVia: via } : {}) },
+            attrs: {
+                ...attrs,
+                effectiveIngress,
+                internetFacing: liveFacing || !!declaredVia,
+                ...(via ? { internetFacingVia: via } : {}),
+                ...(ingressVia ? { effectiveIngressVia: `security groups ${ingressVia}` } : {}),
+            },
         };
     });
     // Record what this pass computed, so a caller can report the graph's derived surface
     // without hardcoding attribute names. Only kinds actually enriched are listed.
     const enriched = nodes.some((n) => isKind(n, "Instance"));
-    const derivedAttrs = enriched
-        ? { ...(ir.derivedAttrs ?? {}), Instance: ["internetFacing", "effectiveIngress"] }
+    const enrichedTf = nodes.some((n) => terraformResourceType(n) === "aws_instance");
+    const derivedAttrs = enriched || enrichedTf
+        ? {
+            ...(ir.derivedAttrs ?? {}),
+            ...(enriched ? { Instance: ["internetFacing", "effectiveIngress"] } : {}),
+            ...(enrichedTf ? { aws_instance: ["internetFacing", "effectiveIngress"] } : {}),
+        }
         : ir.derivedAttrs;
     return { ...ir, nodes, ...(derivedAttrs ? { derivedAttrs } : {}) };
 }
+function isKind(n, suffix) {
+    const kind = n?.kind ?? "";
+    return !!n && (kind === suffix || kind.endsWith("::" + suffix));
+}
+function bare(id) {
+    return id.includes("::") ? id.slice(id.lastIndexOf("::") + 2) : id;
+}
+/** A node's name in a fold's evidence: a terraform address, or a bare logical id. */
+function display(view, id) {
+    const v = view.nodes.get(id);
+    if (v && v.lexicon === "terraform")
+        return id.slice(id.lastIndexOf("/") + 1);
+    return bare(id);
+}
+/** The ids an evidence path visits, in walk order. */
+function visited(ev, start) {
+    const out = start ? [start] : [];
+    let at = start;
+    for (const h of ev.hops) {
+        const next = at === undefined ? h.to : h.from === at ? h.to : h.from;
+        if (at === undefined)
+            out.push(h.from === next ? h.to : h.from);
+        out.push(next);
+        at = next;
+    }
+    return out;
+}
+/** `internetFacingVia`, as each fold always spelled it. */
+function facingVia(view, ev, tf) {
+    const ids = visited(ev);
+    const of = (label) => ids.find((id) => view.nodes.get(id)?.label === label);
+    const rt = of("RouteTable");
+    const igw = of("InternetGateway");
+    if (!rt || !igw)
+        return undefined;
+    if (!tf)
+        return `${bare(rt)} → ${bare(igw)}`;
+    const subnet = of("Subnet");
+    const route = of("Route");
+    const how = route && view.nodes.get(route)?.attrs.block ? "inline route" : route ? display(view, route) : "route";
+    return `subnet route ${subnet ? display(view, subnet) : "?"} -> ${display(view, rt)} -> ${display(view, igw)} (${how})`;
+}
+/** One reached group, as `effectiveIngressVia` names it: the group, or the template it came through. */
+function groupPath(view, ev, sg) {
+    const lt = visited(ev).find((id) => view.nodes.get(id)?.label === "LaunchTemplate");
+    return lt ? `${display(view, lt)} -> ${display(view, sg)}` : display(view, sg);
+}
+const STYLE_ORDER = ["cfn", "tf-inline", "tf-sg-rule", "tf-vpc-rule"];
+/** A group's ingress rules as `proto:port:source` strings, inline rules first. */
+function ingressStrings(view, sg) {
+    const rules = view.edges
+        .filter((e) => e.from === sg && e.name === "ingress")
+        .map((e) => view.nodes.get(e.to))
+        .filter((r) => r && r.label === "IngressRule");
+    const order = (r) => (r.attrs.block ? -1 : STYLE_ORDER.indexOf(String(r.attrs.style)));
+    return [...rules]
+        .sort((a, b) => order(a) - order(b))
+        .flatMap((r) => {
+        const raw = (r.body ?? {});
+        switch (r.attrs.style) {
+            case "tf-inline":
+                return terraformIngress(raw, { proto: "protocol", cidrs: ["cidr_blocks", "ipv6_cidr_blocks", "prefix_list_ids"], groups: ["security_groups"] });
+            case "tf-sg-rule":
+                return terraformIngress(raw, { proto: "protocol", cidrs: ["cidr_blocks", "ipv6_cidr_blocks", "prefix_list_ids"], groups: ["source_security_group_id"] });
+            case "tf-vpc-rule":
+                return terraformIngress(raw, { proto: "ip_protocol", cidrs: ["cidr_ipv4", "cidr_ipv6", "prefix_list_id"], groups: ["referenced_security_group_id"] });
+            default:
+                return [cloudFormationIngress(raw)];
+        }
+    });
+}
+/** One CloudFormation ingress rule as `proto:port:source`. */
+function cloudFormationIngress(rule) {
+    const proto = String(rule.IpProtocol ?? "-1");
+    const from = rule.FromPort;
+    const to = rule.ToPort;
+    const port = from == null ? "all" : from === to ? `${from}` : `${from}-${to}`;
+    const source = rule.SourceSecurityGroupId;
+    const group = source && typeof source === "object" && typeof source.$ref === "string"
+        ? String(source.$ref).replace(/\.[A-Za-z]+$/, "")
+        : source;
+    const cidr = rule.CidrIp ??
+        rule.CidrIpv6 ??
+        (group ? `sg:${String(group)}` : "?");
+    return `${proto}:${port}:${cidr}`;
+}
+/** The chant entity types every terraform `resource` and `data` block carries. */
+const TERRAFORM_RESOURCE = "Terraform::Resource";
+const TERRAFORM_DATA = "Terraform::Data";
+/**
+ * The Terraform type of a `resource` or `data` node: `aws_instance` for
+ * `aws_instance.web`, `data.aws_ami` for `data.aws_ami.ubuntu`. Undefined for
+ * any other node.
+ *
+ * This is the one reading of a terraform node's type. `chant search`'s `kind:`
+ * (#4366), its rows and `--explain` count, `--count-by kind` (#4360) and the
+ * effective-topology folds (#4362) all call it, so they cannot disagree.
+ *
+ * The terraform lexicon puts every resource on the IR as `Terraform::Resource`
+ * (and every data source as `Terraform::Data`) and carries the block's type
+ * label as `attrs.type` (#4366), which is read first. A node without one (an
+ * older producer, or a `chant graph --live` node built from state) falls back
+ * to the block's address (`aws_instance.web`, or `module.app.aws_instance.web`)
+ * in `attrs.address`, whose second-to-last segment is the type, and failing
+ * that to its id, whose last path segment is the address too. A data source
+ * keeps its `data.` prefix: `data.aws_ami` reads an AMI, it does not manage one.
+ */
+export function terraformType(n) {
+    if (!n || (n.kind !== TERRAFORM_RESOURCE && n.kind !== TERRAFORM_DATA))
+        return undefined;
+    const label = n.attrs?.["type"];
+    let type = typeof label === "string" && label.length > 0 ? label : undefined;
+    if (type === undefined) {
+        const parts = terraformAddress(n).split(".");
+        type = parts.length >= 2 ? parts[parts.length - 2] : undefined;
+    }
+    if (type === undefined)
+        return undefined;
+    return n.kind === TERRAFORM_DATA ? `data.${type}` : type;
+}
+/**
+ * The provider resource type of a terraform `resource` node (`aws_instance`),
+ * or undefined for any other node, data sources included. See {@link terraformType}.
+ */
+export function terraformResourceType(n) {
+    return n?.kind === TERRAFORM_RESOURCE ? terraformType(n) : undefined;
+}
+function terraformAddress(n) {
+    const address = n.attrs?.["address"];
+    if (typeof address === "string" && address.length > 0)
+        return address;
+    return n.id.slice(n.id.lastIndexOf("/") + 1).replace(/~\d+$/, "");
+}
+function bodyOf(n) {
+    const body = n.attrs?.["body"];
+    return body && typeof body === "object" && !Array.isArray(body) ? body : {};
+}
+/** A block-or-list attribute as a list: hcl2json renders nested blocks as arrays. */
+function list(value) {
+    if (value == null)
+        return [];
+    return Array.isArray(value) ? value : [value];
+}
+/** `${aws_security_group.x.id}` -> `aws_security_group.x`; anything else unchanged. */
+function sourceRef(value) {
+    const s = String(value);
+    const m = /^\$\{([A-Za-z0-9_.-]+?)(?:\.(?:id|arn|name))?\}$/.exec(s);
+    return m ? m[1] : s;
+}
+/**
+ * One terraform ingress rule, in any of its three spellings, normalized to the
+ * `proto:port:source` strings the CloudFormation fold produces. A rule with
+ * several CIDRs or sources yields one string per source, so each is queryable
+ * on its own.
+ */
+function terraformIngress(rule, fields) {
+    const rawProto = String(rule[fields.proto] ?? "-1").toLowerCase();
+    const proto = rawProto === "all" ? "-1" : rawProto;
+    const from = rule["from_port"];
+    const to = rule["to_port"];
+    const port = proto === "-1" || from == null
+        ? "all"
+        : String(from) === String(to ?? from)
+            ? `${from}`
+            : `${from}-${to}`;
+    const sources = [];
+    for (const f of fields.cidrs)
+        for (const c of list(rule[f]))
+            sources.push(String(c));
+    for (const f of fields.groups)
+        for (const g of list(rule[f]))
+            sources.push(`sg:${sourceRef(g)}`);
+    if (rule["self"] === true)
+        sources.push("sg:self");
+    if (sources.length === 0)
+        sources.push("?");
+    return sources.map((src) => `${proto}:${port}:${src}`);
+}

package/dist/graph-ir.d.ts

@@ -1,6 +1,8 @@
 import { type Declarable } from "./declarable.js";
+import { subTemplateRefs } from "./graph-sub-template.js";
 import type { ResourceMetadata } from "./lexicon.js";
 import type { UnobservedEntity } from "./observation.js";
+export { subTemplateRefs };
 /**
  * Graph IR — the engine-neutral, lint-gated representation of a project's
  * resolved infrastructure graph. Painters (mermaid, graphviz, custom SVG) and
@@ -25,6 +27,20 @@ export interface SourceLoc {
 export interface AttrRefEnvelope {
     $ref: string;
 }
+/**
+ * A CloudFormation `Fn::Sub` in an attribute projection (#4373), in place of
+ * `{ $intrinsic: true }`. `$sub` is the template exactly as it serializes, so
+ * `${assets.Arn}/*` names the producer and attribute a reader would otherwise
+ * have to guess. `$vars` is the two-argument form's variable map, each value
+ * projected like any other attr. Every `${Name}` or `${Name.Attr}` in the
+ * template that names a node, and every reference in `$vars`, is also an edge.
+ * `${!Literal}` (CloudFormation's escape), pseudo-parameters (`${AWS::Region}`)
+ * and names `$vars` binds are not.
+ */
+export interface SubEnvelope {
+    $sub: string;
+    $vars?: Record<string, unknown>;
+}
 /** One resource in the graph. */
 export interface IRNode {
     /** Logical name (the export name, or composite-expanded name). */
@@ -174,6 +190,31 @@ export interface LexiconWorkspaceOutputs {
      */
     gaps?: string[];
 }
+/**
+ * One link a lexicon reads from its own declarations (#4397): an output of
+ * another member that a declaration depends on, such as a table an otel
+ * `clickhouse` exporter writes.
+ */
+export interface LexiconWorkspaceLink {
+    /** The producer's output the declaration reads or writes: `default.otel_logs`, `default.otel_logs.Body`. */
+    output: string;
+    /**
+     * The output that picks the producer when `member` is unset; unset, the
+     * output itself. A column is anchored on its table, so a dropped column is
+     * missing from the member that still has the table.
+     */
+    anchor?: string;
+    /** The producer, when the declaration names it. Unset, the one member exposing `anchor`. */
+    member?: string;
+    /** The entity key that states the link, for the finding's file and line. */
+    entity: string;
+}
+/** What a lexicon's `workspaceLinks` hook returns (#4397). */
+export interface LexiconWorkspaceLinks {
+    links: LexiconWorkspaceLink[];
+    /** Places the hook could not read without the environment, one line each. Their links are left out. */
+    gaps?: string[];
+}
 /** What a lexicon's `graphEdges` hook returns (#3910). */
 export interface LexiconGraphEdges {
     references: LexiconGraphReference[];
@@ -420,6 +461,13 @@ export interface GraphIR {
      * the passes produced, not a list maintained by hand.
      */
     derivedAttrs?: Record<string, string[]>;
+    /**
+     * With `chant graph --format ir --capability-view` (#4378): the
+     * lexicon-neutral view capability rules read, built by this chant through
+     * the project's own lexicon mappings and adapters. A `ViewDocument`
+     * (`capabilities/view.ts`). Absent unless asked for.
+     */
+    capabilityView?: unknown;
 }
 /**
  * Build the graph IR from resolved entities (the output of `discover`). Pure and

package/dist/graph-ir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph-ir.d.ts","sourceRoot":"","sources":["../src/graph-ir.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAI7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD;;;;;;;;;GASG;AAEH,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,MAAM;IACrB,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mCAAmC;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAEzF,qFAAqF;AACrF,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,uFAAuF;IACvF,IAAI,EAAE,UAAU,CAAC;IACjB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,IAAI,EAAE,UAAU,CAAC;IACjB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gEAAgE;AAChE,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,qBAAqB,EAAE,CAAC;IACpC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,eAAe,EAAE,CAI/E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAGlE;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC;;;;iFAI6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;;8EAG0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC;;;mDAG+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACvC;AAED;qFACqF;AACrF,MAAM,WAAW,QAAQ;IACvB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;8BAM8B;AAC9B,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;IACd,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB;yEACqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;oEACoE;AACpE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,sEAAsE;IACtE,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB;;gFAE4E;IAC5E,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC;AAwOD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAqGT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAiDlG;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,uBAAuB,EAAE,GAAG,OAAO,CAkBrG;AAYD;4EAC4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,OAAO,CAyEzE;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAInG;AAiBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAwB9F;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAqEpG"}
+{"version":3,"file":"graph-ir.d.ts","sourceRoot":"","sources":["../src/graph-ir.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,UAAU,EAAgB,MAAM,cAAc,CAAC;AAI7D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;;;;;;GASG;AAEH,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,iCAAiC;AACjC,MAAM,WAAW,MAAM;IACrB,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,mCAAmC;IACnC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAEzF,qFAAqF;AACrF,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,uFAAuF;IACvF,IAAI,EAAE,UAAU,CAAC;IACjB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,IAAI,EAAE,UAAU,CAAC;IACjB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gEAAgE;AAChE,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,4GAA4G;IAC5G,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,uGAAuG;IACvG,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,qBAAqB,EAAE,CAAC;IACpC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,eAAe,EAAE,CAI/E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAGlE;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC;;;;iFAI6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC;;;8EAG0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC;;;mDAG+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACvC;AAED;qFACqF;AACrF,MAAM,WAAW,QAAQ;IACvB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;8BAM8B;AAC9B,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;IACd,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB;yEACqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;oEACoE;AACpE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,gFAAgF;AAChF,MAAM,WAAW,OAAO;IACtB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,QAAQ,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,sEAAsE;IACtE,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB;;gFAE4E;IAC5E,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAkWD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAqGT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAiDlG;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,uBAAuB,EAAE,GAAG,OAAO,CAkBrG;AAYD;4EAC4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,OAAO,CAyEzE;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAInG;AAiBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAwB9F;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAqEpG"}

package/dist/graph-ir.js

@@ -4,6 +4,8 @@ import { isDeclarable } from "./declarable.js";
 import { isLexiconOutput } from "./lexicon-output.js";
 import { getProvenance } from "./provenance.js";
 import { INTRINSIC_MARKER } from "./intrinsic.js";
+import { subTemplateRefs } from "./graph-sub-template.js";
+export { subTemplateRefs };
 /** True when `value` has the {@link EntityReference} shape. */
 function isEntityReference(value) {
     return (typeof value === "object" &&
@@ -81,6 +83,81 @@ function refIntrinsicTarget(value) {
     }
     return undefined;
 }
+/** Read `{ "Fn::Sub": "..." }` or `{ "Fn::Sub": ["...", { ... }] }`, or undefined. */
+function subForm(json) {
+    if (json === null || typeof json !== "object" || Array.isArray(json))
+        return undefined;
+    const keys = Object.keys(json);
+    if (keys.length !== 1 || keys[0] !== "Fn::Sub")
+        return undefined;
+    const arg = json["Fn::Sub"];
+    if (typeof arg === "string")
+        return { template: arg };
+    if (Array.isArray(arg) && typeof arg[0] === "string") {
+        const vars = arg[1];
+        return vars !== null && typeof vars === "object" && !Array.isArray(vars)
+            ? { template: arg[0], vars: vars }
+            : { template: arg[0] };
+    }
+    return undefined;
+}
+/** The `Fn::Sub` an intrinsic serializes to (the aws `Sub` tag), or undefined. */
+function subIntrinsicForm(value) {
+    try {
+        return subForm(value.toJSON?.());
+    }
+    catch {
+        // An AttrRef inside whose logical name is not set yet: no template to read.
+        return undefined;
+    }
+}
+/** False when an intrinsic's `toJSON()` throws (an AttrRef inside it has no logical name yet). */
+function serializes(value) {
+    try {
+        value.toJSON?.();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The logical names serialized CloudFormation JSON references: `{ Ref }`,
+ * `{ "Fn::GetAtt" }` in either encoding, and a nested `Fn::Sub`. Reads a
+ * two-argument `Sub`'s variable map after `toJSON()` has turned its live
+ * references into JSON.
+ */
+function cfnJsonRefNames(json, out) {
+    if (json === null || typeof json !== "object")
+        return;
+    if (Array.isArray(json)) {
+        for (const item of json)
+            cfnJsonRefNames(item, out);
+        return;
+    }
+    const obj = json;
+    if (typeof obj.Ref === "string") {
+        out.push(obj.Ref);
+        return;
+    }
+    const getAtt = obj["Fn::GetAtt"];
+    if (getAtt !== undefined) {
+        const id = Array.isArray(getAtt) ? getAtt[0] : typeof getAtt === "string" ? getAtt.split(".")[0] : undefined;
+        if (typeof id === "string")
+            out.push(id);
+        return;
+    }
+    const sub = subForm(obj);
+    if (sub) {
+        for (const r of subTemplateRefs(sub.template, new Set(Object.keys(sub.vars ?? {}))))
+            out.push(r.name);
+        if (sub.vars)
+            cfnJsonRefNames(Object.values(sub.vars), out);
+        return;
+    }
+    for (const v of Object.values(obj))
+        cfnJsonRefNames(v, out);
+}
 /** Resolve the producer (logical name) an AttrRef points at. */
 function refTarget(ref, reverse) {
     // Nested refs (under `props`) aren't assigned a logical name by resolveAttrRefs,
@@ -124,6 +201,10 @@ function project(value, seen, reverse, nodeIds) {
         const to = refIntrinsicTarget(value);
         if (to && nodeIds.has(to))
             return { $ref: to };
+        // A Sub keeps its template, so a reader sees which node and attribute it names (#4373).
+        const sub = subIntrinsicForm(value);
+        if (sub)
+            return subEnvelope(sub, seen, reverse, nodeIds);
         return { $intrinsic: true };
     }
     if (seen.has(value))
@@ -145,6 +226,13 @@ function project(value, seen, reverse, nodeIds) {
         seen.delete(value);
         return out;
     }
+    // A Sub written as plain CloudFormation JSON reads the same as the `Sub` tag's.
+    const plainSub = subForm(value);
+    if (plainSub) {
+        const out = subEnvelope(plainSub, seen, reverse, nodeIds);
+        seen.delete(value);
+        return out;
+    }
     const out = {};
     for (const [k, v] of Object.entries(value)) {
         const p = project(v, seen, reverse, nodeIds);
@@ -154,6 +242,18 @@ function project(value, seen, reverse, nodeIds) {
     seen.delete(value);
     return out;
 }
+/** Project a {@link SubForm} into its {@link SubEnvelope}. */
+function subEnvelope(sub, seen, reverse, nodeIds) {
+    if (!sub.vars)
+        return { $sub: sub.template };
+    const vars = {};
+    for (const [k, v] of Object.entries(sub.vars)) {
+        const p = project(v, seen, reverse, nodeIds);
+        if (p !== undefined)
+            vars[k] = p;
+    }
+    return { $sub: sub.template, $vars: vars };
+}
 // `references` and `stack` are the two duck-typed channels above
 // ({@link entityReferences}, {@link entityStack}). They are metadata about the
 // entity's place in the graph, not declared configuration, and both are read
@@ -213,6 +313,10 @@ function collectEdges(entity, from, nodeIds, reverse) {
         });
     }
     const seen = new Set();
+    const edgeTo = (to, viaAttr) => {
+        if (to !== from && nodeIds.has(to))
+            edges.push({ from, to, kind: "ref", viaAttr });
+    };
     const visit = (value, viaAttr) => {
         if (value === null || typeof value !== "object")
             return;
@@ -229,8 +333,34 @@ function collectEdges(entity, from, nodeIds, reverse) {
             const to = refIntrinsicTarget(value);
             if (to && to !== from && nodeIds.has(to))
                 edges.push({ from, to, kind: "ref", viaAttr });
+            // A Sub's interpolations are references too (#4373): each `${Name}` or
+            // `${Name.Attr}` naming a node, and each reference in a variable map.
+            const sub = subIntrinsicForm(value);
+            if (sub) {
+                const names = subTemplateRefs(sub.template, new Set(Object.keys(sub.vars ?? {}))).map((r) => r.name);
+                if (sub.vars)
+                    cfnJsonRefNames(Object.values(sub.vars), names);
+                for (const name of names)
+                    edgeTo(name, viaAttr);
+            }
+            // The live values the aws `Sub` tag interpolated. Covers an AttrRef whose
+            // logical name was not set, where `toJSON()` throws and leaves no
+            // template to read above. Any other intrinsic stays opaque.
+            const interpolated = value.values;
+            if (Array.isArray(interpolated) && (sub || !serializes(value))) {
+                for (const v of interpolated)
+                    visit(v, viaAttr);
+            }
             return;
         }
+        // A Sub written as plain CloudFormation JSON in props: the template's names
+        // here, then the variable map's live values through the walk below.
+        const plainSub = subForm(value);
+        if (plainSub) {
+            for (const r of subTemplateRefs(plainSub.template, new Set(Object.keys(plainSub.vars ?? {})))) {
+                edgeTo(r.name, viaAttr);
+            }
+        }
         // A whole node held in props or an enumerable field (the sql lexicon's
         // `dependsOn`) is a reference to it: draw the edge, and do not walk its
         // config, whose refs belong to that node's own edges (#3257). Checked

package/dist/graph-sub-template.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The names a `Sub` template interpolates (#4373): `${Name}` and
+ * `${Name.Attr}`, in order. Skips CloudFormation's `${!Literal}` escape,
+ * pseudo-parameters (`${AWS::Region}`, anything with `::`), and names the
+ * two-argument form's variable map binds, which are not resources.
+ */
+export declare function subTemplateRefs(template: string, bound?: ReadonlySet<string>): Array<{
+    name: string;
+    attr?: string;
+}>;
+//# sourceMappingURL=graph-sub-template.d.ts.map

package/dist/graph-sub-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-sub-template.d.ts","sourceRoot":"","sources":["../src/graph-sub-template.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE,WAAW,CAAC,MAAM,CAAa,GACrC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CASxC"}

package/dist/graph-sub-template.js

@@ -0,0 +1,19 @@
+// Kept apart from ./graph-ir so ./graph-detail, which runs in the browser
+// bundle, can read a Sub template without pulling in node:path.
+/**
+ * The names a `Sub` template interpolates (#4373): `${Name}` and
+ * `${Name.Attr}`, in order. Skips CloudFormation's `${!Literal}` escape,
+ * pseudo-parameters (`${AWS::Region}`, anything with `::`), and names the
+ * two-argument form's variable map binds, which are not resources.
+ */
+export function subTemplateRefs(template, bound = new Set()) {
+    const out = [];
+    for (const match of template.matchAll(/\$\{([^}]*)\}/g)) {
+        const token = match[1].trim();
+        if (!token || token.startsWith("!") || token.includes("::") || bound.has(token))
+            continue;
+        const dot = token.indexOf(".");
+        out.push(dot > 0 ? { name: token.slice(0, dot), attr: token.slice(dot + 1) } : { name: token });
+    }
+    return out;
+}