@intentius/chant 0.124.51 → 0.124.54

package/dist/graph-ir.js

@@ -5,6 +5,7 @@ import { isLexiconOutput } from "./lexicon-output.js";
 import { getProvenance } from "./provenance.js";
 import { INTRINSIC_MARKER } from "./intrinsic.js";
 import { subTemplateRefs } from "./graph-sub-template.js";
+import { entityInstanceRollup, observedInstanceNodeId } from "./instance-nodes.js";
 export { subTemplateRefs };
 /** True when `value` has the {@link EntityReference} shape. */
 function isEntityReference(value) {
@@ -43,6 +44,52 @@ export function entityStack(entity) {
     const stack = entity.stack;
     return typeof stack === "string" && stack.length > 0 ? stack : undefined;
 }
+/**
+ * What an ownership engine observed about an entity (#4529), or undefined.
+ * Duck-typed like {@link entityStack}: the pulumi lexicon sets `facts` on a
+ * plunge member's entity from the member's checked-in engine graph. It is
+ * defined non-enumerable there, so a chant older than this reader does not
+ * project it into `attrs`. {@link buildGraphIr} copies it onto the node, and
+ * nothing in chant decides from it (see `IRNode.facts`).
+ */
+export function entityFacts(entity) {
+    const facts = entity.facts;
+    return typeof facts === "object" && facts !== null && !Array.isArray(facts) ? facts : undefined;
+}
+/**
+ * The instance keys an entity says its source expands to (#4454), as the
+ * engine prints them (`[0]`, `["a"]`), or an empty list. Duck-typed like
+ * {@link entityStack}: the terraform lexicon sets `instanceKeys` on a block
+ * whose `count` or `for_each` is a literal.
+ */
+export function entityInstanceKeys(entity) {
+    const keys = entity.instanceKeys;
+    if (!Array.isArray(keys))
+        return [];
+    return keys.filter((k) => typeof k === "string" && k.startsWith("[") && k.endsWith("]"));
+}
+/**
+ * The instance nodes an entity names, given its own key `name`: the
+ * duck-typed `instances` list when it carries one (full ids, which an
+ * instance under an expanded module call needs, #4486), else one per
+ * {@link entityInstanceKeys} key, id `<name><key>`.
+ */
+export function entityInstances(name, entity) {
+    const listed = entity.instances;
+    if (Array.isArray(listed)) {
+        const out = [];
+        for (const item of listed) {
+            if (typeof item !== "object" || item === null)
+                continue;
+            const { id, key, scope } = item;
+            if (typeof id !== "string" || id.length === 0 || id === name)
+                continue;
+            out.push({ id, ...(typeof key === "string" ? { key } : {}), ...(typeof scope === "string" ? { scope } : {}) });
+        }
+        return out;
+    }
+    return entityInstanceKeys(entity).map((key) => ({ id: `${name}${key}`, key }));
+}
 /**
  * The version `chant graph --format ir` writes on its output (#2529, #2524 D8).
  * The format changes only additively: a new field or edge kind never bumps
@@ -259,7 +306,8 @@ function subEnvelope(sub, seen, reverse, nodeIds) {
 // entity's place in the graph, not declared configuration, and both are read
 // directly, so projecting them into `attrs` would only restate an edge and a
 // group key the IR already carries.
-const SKIP_KEYS = new Set(["lexicon", "entityType", "kind", "attributes", "Ref", "references", "stack"]);
+// `facts` (#4529) is an engine's observation, carried onto `IRNode.facts`, not configuration.
+const SKIP_KEYS = new Set(["lexicon", "entityType", "kind", "attributes", "Ref", "references", "stack", "facts"]);
 /** The config bag of a node, paired with each key. Lexicon entities keep their
  * declared props in a (usually non-enumerable) `props` object; simpler entities
  * carry config as enumerable own properties. We surface both, flattening `props`
@@ -310,6 +358,7 @@ function collectEdges(entity, from, nodeIds, reverse) {
             kind: "ref",
             ...(ref.viaAttr ? { viaAttr: ref.viaAttr } : {}),
             ...(ref.toAttr ? { toAttr: ref.toAttr } : {}),
+            ...(ref.grain === "block" || ref.grain === "instance" || ref.grain === "property" ? { grain: ref.grain } : {}),
         });
     }
     const seen = new Set();
@@ -399,7 +448,8 @@ function collectEdges(entity, from, nodeIds, reverse) {
 }
 /** Stable key for deduping and sorting an edge. */
 function edgeKey(e) {
-    return `${e.from}\0${e.to}\0${e.viaAttr ?? ""}`;
+    // `grain` joins the key only when set, so an edge without one keys as before.
+    return `${e.from}\0${e.to}\0${e.viaAttr ?? ""}${e.grain ? `\0${e.grain}` : ""}`;
 }
 /**
  * Build the graph IR from resolved entities (the output of `discover`). Pure and
@@ -438,6 +488,9 @@ export function buildGraphIr(entities, projectPath) {
         const file = relFile(prov?.sourceFile, projectPath);
         if (file)
             node.sourceLoc = { file };
+        const facts = entityFacts(entity);
+        if (facts)
+            node.facts = facts;
         nodes.push(node);
         (byLexicon[_a = entity.lexicon] ?? (byLexicon[_a] = [])).push(name);
         // An entity that names its own deployable unit is taken at its word
@@ -517,6 +570,81 @@ export function buildGraphIr(entities, projectPath) {
         ir.imports = imports;
     return ir;
 }
+/**
+ * Add an instance node (#4454) under each node whose entity names its
+ * instances ({@link entityInstances}): id `<block id><key>`, or the full id
+ * the entity lists under an expanded module call (#4486), the
+ * block's kind, lexicon and source location, `instanceOf` and `instanceKey`,
+ * no attrs and no edges. Each instance joins every group its block is in, so
+ * a renderer draws it in the block's box. A block node whose entity carries
+ * an `instanceRollup` (#4489) gets it. Pure. Returns `ir` itself when no
+ * entity has instance keys or a rollup, so a graph with none prints what it
+ * did before.
+ *
+ * Called by `chant graph` and the declared half of `--live`, not by
+ * {@link buildGraphIr}, so `chant search`, which reads the base IR, still
+ * counts blocks.
+ */
+export function withInstanceNodes(ir, entities) {
+    const byId = new Map(ir.nodes.map((n) => [n.id, n]));
+    const added = [];
+    const childrenOf = new Map();
+    const rolledUp = new Map();
+    for (const [name, entity] of entities) {
+        const block = byId.get(name);
+        if (!block || block.instanceOf)
+            continue;
+        const rollup = entityInstanceRollup(entity);
+        if (rollup)
+            rolledUp.set(name, rollup);
+        for (const { id, key, scope } of entityInstances(name, entity)) {
+            if (byId.has(id))
+                continue;
+            const node = {
+                id,
+                kind: block.kind,
+                lexicon: block.lexicon,
+                attrs: {},
+                instanceOf: name,
+                ...(key !== undefined ? { instanceKey: key } : {}),
+                ...(scope !== undefined ? { instanceScope: scope } : {}),
+            };
+            if (block.sourceLoc)
+                node.sourceLoc = { ...block.sourceLoc };
+            if (block.compositeParent)
+                node.compositeParent = block.compositeParent;
+            if (block.compositeInstance)
+                node.compositeInstance = block.compositeInstance;
+            added.push(node);
+            byId.set(id, node);
+            (childrenOf.get(name) ?? childrenOf.set(name, []).get(name)).push(id);
+        }
+    }
+    if (added.length === 0 && rolledUp.size === 0)
+        return ir;
+    const own = ir.nodes.map((n) => {
+        const rollup = rolledUp.get(n.id);
+        return rollup ? { ...n, instanceRollup: rollup } : n;
+    });
+    if (added.length === 0)
+        return { ...ir, nodes: own };
+    const nodes = [...own, ...added].sort((a, b) => a.id.localeCompare(b.id));
+    const withChildren = (rec) => {
+        if (!rec)
+            return rec;
+        const out = {};
+        for (const [k, ids] of Object.entries(rec))
+            out[k] = [...ids, ...ids.flatMap((id) => childrenOf.get(id) ?? [])].sort();
+        return out;
+    };
+    const groups = { ...ir.groups };
+    for (const key of ["byLexicon", "byComposite", "byStack"]) {
+        const grown = withChildren(ir.groups[key]);
+        if (grown)
+            groups[key] = grown;
+    }
+    return { ...ir, nodes, groups };
+}
 /**
  * Add what the lexicons' `graphEdges` hooks reported (#3910) to a built IR.
  *
@@ -657,10 +785,45 @@ export function buildLiveGraphIr(observations) {
             // declared owner", which is simply the absence of this field.
             if (meta.ownerChain?.root === "declared")
                 node.runtimeOwner = meta.ownerChain.entity;
+            // An engine's facts (#4527) ride beside `physicalId`, as the engine gave them.
+            if (meta.facts)
+                node.facts = meta.facts;
             nodes.push(node);
             (byLexicon[lexicon] ?? (byLexicon[lexicon] = [])).push(name);
             // A live lexicon maps to one deployable stack, same as the source IR.
             (byStack[lexicon] ?? (byStack[lexicon] = [])).push(name);
+            // Each present instance of a `count` or `for_each` block is a node of
+            // its own under the block's (#4454), so the overlay paints it alone.
+            // The block node above is the rollup. An absent or not-observed
+            // instance is no live node: the overlay reads that off `instances`.
+            // Under an expanded module call the id follows the declared graph's
+            // rule (#4486, #4488), `estate/module.app[0]/aws_eip.pool[1]`, with
+            // `instanceScope` and no `instanceKey` when only the call is expanded.
+            for (const inst of meta.instances ?? []) {
+                if (inst.verdict !== "present")
+                    continue;
+                const id = observedInstanceNodeId(name, inst);
+                if (id === undefined)
+                    continue;
+                const child = {
+                    id,
+                    kind: meta.type,
+                    lexicon,
+                    attrs: { address: inst.address, ...(inst.status ? { status: inst.status } : {}) },
+                    instanceOf: name,
+                    ...(inst.key !== undefined ? { instanceKey: inst.key } : {}),
+                    ...(inst.scope !== undefined ? { instanceScope: inst.scope } : {}),
+                };
+                if (inst.physicalId)
+                    child.physicalId = inst.physicalId;
+                if (inst.ownership === "owned" || inst.ownership === "foreign")
+                    child.ownership = inst.ownership;
+                if (inst.facts)
+                    child.facts = inst.facts;
+                nodes.push(child);
+                (byLexicon[lexicon] ?? (byLexicon[lexicon] = [])).push(id);
+                (byStack[lexicon] ?? (byStack[lexicon] = [])).push(id);
+            }
         }
     }
     nodes.sort((a, b) => a.id.localeCompare(b.id));
@@ -685,7 +848,9 @@ export function buildLiveGraphIr(observations) {
         for (const edge of observation.edges ?? []) {
             if (!observedIds.has(edge.from) || !observedIds.has(edge.to))
                 continue;
-            const key = `${edge.from}\u0000${edge.to}\u0000${edge.viaAttr ?? ""}\u0000${edge.toAttr ?? ""}`;
+            // `grain` is in the key (#4527): a block edge and an instance edge
+            // between the same pair stay two edges.
+            const key = `${edge.from}\u0000${edge.to}\u0000${edge.viaAttr ?? ""}\u0000${edge.toAttr ?? ""}\u0000${edge.grain ?? ""}`;
             if (seen.has(key))
                 continue;
             seen.add(key);
@@ -694,7 +859,8 @@ export function buildLiveGraphIr(observations) {
     }
     edges.sort((a, b) => a.from.localeCompare(b.from) ||
         a.to.localeCompare(b.to) ||
-        (a.viaAttr ?? "").localeCompare(b.viaAttr ?? ""));
+        (a.viaAttr ?? "").localeCompare(b.viaAttr ?? "") ||
+        (a.grain ?? "").localeCompare(b.grain ?? ""));
     // Stack exports (#1279) land on the IR's `exports`, the same place the
     // declared graph keeps what a stack publishes — not on the member nodes.
     const exports = [];
@@ -714,16 +880,47 @@ export function collectUnobserved(observations) {
         Object.assign(out, o.unobserved ?? {});
     return out;
 }
+/**
+ * The overlay paint on one node. `_ownership` (#4534, behold#906 Q2) is
+ * chant's own marker verdict, {@link IRNode.ownership}, beside `_status`, so
+ * `chant search` answers ownership with no grammar of its own:
+ * `attr:_ownership=foreign`, `--show _ownership`, `--count-by attr:_ownership`.
+ * It is `owned` or `foreign`; absent means unknown (no marker channel on the
+ * read, or a node nobody observed). It never reads `facts.ownership`, the
+ * engine's verdict, which stays for display (#4520 Q1).
+ */
 function tagStatus(n, status, unobserved) {
     return {
         ...n,
         attrs: {
             ...n.attrs,
             _status: status,
+            ...(n.ownership ? { _ownership: n.ownership } : {}),
             ...(unobserved ? { _unobserved: unobserved.reason } : {}),
         },
     };
 }
+/**
+ * The paint for a declared instance node (#4454) the live graph has no node
+ * for. Its block not observed: `neutral` with the block's reason, since the
+ * rollup put the whole block there. Its block live with instances read: the
+ * instance is not among them, so `accent`, pending. Its block live with no
+ * instance read at all: `neutral`, since nothing said either way. Its block
+ * absent: `accent`, like the block.
+ */
+function missingInstance(n, live, read, unobserved) {
+    const block = n.instanceOf;
+    const u = unobserved[n.id] ?? unobserved[block];
+    if (u)
+        return tagStatus(n, "neutral", u);
+    if (live.has(block) && !read.has(block))
+        return tagStatus(n, "neutral");
+    return tagStatus(n, "accent");
+}
+/** The block ids some live instance node names (#4454): the blocks whose read reported instances. */
+function blocksWithInstances(live) {
+    return new Set(live.nodes.map((n) => n.instanceOf).filter((b) => b !== undefined));
+}
 /**
  * Overlay the declared graph on the provisioned one (#780, `chant graph --live
  * --overlay`) and classify each resource, tagging a `_status` a renderer colours:
@@ -742,8 +939,13 @@ export function overlayGraphs(live, declared, opts) {
     const declaredById = new Map(declared.nodes.map((n) => [n.id, n]));
     const liveIds = new Set(live.nodes.map((n) => n.id));
     const unobserved = opts?.unobserved ?? {};
+    const read = blocksWithInstances(live);
     const nodes = live.nodes.map((n) => {
         const d = declaredById.get(n.id);
+        // A live instance of a declared block whose expansion the source could
+        // not count (`count = var.n`) is managed, never foreign (#4454).
+        if (!d && n.instanceOf && declaredById.has(n.instanceOf))
+            return tagStatus(n, "good");
         if (!d)
             return tagStatus(n, n.runtimeOwner ? "runtime" : "warn");
         // A managed node keeps the composite it was declared in, so `--detail 1`
@@ -757,6 +959,10 @@ export function overlayGraphs(live, declared, opts) {
     for (const n of declared.nodes) {
         if (liveIds.has(n.id))
             continue;
+        if (n.instanceOf) {
+            nodes.push(missingInstance(n, liveIds, read, unobserved));
+            continue;
+        }
         const u = unobserved[n.id];
         nodes.push(u ? tagStatus(n, "neutral", u) : tagStatus(n, "accent"));
     }
@@ -773,7 +979,7 @@ export function overlayGraphs(live, declared, opts) {
  *
  * Each declared node is classified against live observation and tagged `_status`:
  *   - **managed** (declared + provisioned) → `good`, carrying the observed
- *     `physicalId` / `ownership` onto the declared node
+ *     `physicalId` / `ownership` / engine `facts` onto the declared node
  *   - **pending** (declared, provider confirmed absent) → `accent`
  *   - **unobserved** (declared, chant could not look — #1089) → `neutral`, with
  *     the reason on `_unobserved`. A wrong-cluster or unsupported-kind read used
@@ -788,11 +994,19 @@ export function overlayGraphs(live, declared, opts) {
  */
 export function sourceOverlayGraphs(declared, live, opts) {
     const liveById = new Map(live.nodes.map((n) => [n.id, n]));
+    const liveIds = new Set(liveById.keys());
     const declaredIds = new Set(declared.nodes.map((n) => n.id));
-    const foreignIds = new Set(live.nodes.filter((n) => !declaredIds.has(n.id)).map((n) => n.id));
+    // A live instance of a declared block (#4454) the source could not count
+    // is managed: appended `good`, and never foreign.
+    const managedInstances = live.nodes.filter((n) => !declaredIds.has(n.id) && n.instanceOf !== undefined && declaredIds.has(n.instanceOf));
+    const managedInstanceIds = new Set(managedInstances.map((n) => n.id));
+    const foreignIds = new Set(live.nodes.filter((n) => !declaredIds.has(n.id) && !managedInstanceIds.has(n.id)).map((n) => n.id));
     const unobserved = opts?.unobserved ?? {};
+    const read = blocksWithInstances(live);
     const nodes = declared.nodes.map((n) => {
         const obs = liveById.get(n.id);
+        if (!obs && n.instanceOf)
+            return missingInstance(n, liveIds, read, unobserved);
         if (!obs) {
             const u = unobserved[n.id];
             // unobserved — declared, and nobody looked; not "pending"
@@ -803,6 +1017,8 @@ export function sourceOverlayGraphs(declared, live, opts) {
             merged.physicalId = obs.physicalId;
         if (obs.ownership)
             merged.ownership = obs.ownership;
+        if (obs.facts)
+            merged.facts = obs.facts;
         // ...and what was observed ABOUT it (#1279). The declared canvas holds what
         // the source says; the observation holds what the account says, and a fact
         // like `VpcId` exists only on the second. Dropping it here made every
@@ -823,6 +1039,8 @@ export function sourceOverlayGraphs(declared, live, opts) {
             continue;
         nodes.push(tagStatus(n, n.runtimeOwner ? "runtime" : "warn")); // runtime child or foreign
     }
+    for (const n of managedInstances)
+        nodes.push(tagStatus(n, "good"));
     nodes.sort((a, b) => a.id.localeCompare(b.id));
     // Declared edges are the canvas (the cross-substrate topology). Add only the
     // live edges that touch a foreign node — declared edges already cover every

package/dist/graph-refs.d.ts

@@ -34,8 +34,26 @@ export interface RefRule {
     match?: "id" | "arn" | "name" | "any";
     /** Constrain the target kind (disambiguates identifier collisions). */
     targetKind?: string;
+    /**
+     * The target kind when the rule runs over indexed nodes (#4522, ruled on
+     * INTENTIUS/behold#1023 Q4), for a rule that has no {@link targetKind}
+     * because its values are logical ids (`enrichLiveAttrs`), which are unique.
+     * Over an index the same path holds a physical value, often a name, so the
+     * target kind is what keeps it from joining whatever else has that name.
+     */
+    indexedTargetKind?: string;
     /** `reference` → an edge; `containment` → a boundary hint (#779), not an edge. */
     relation: "reference" | "containment";
+    /**
+     * The path holds a reference only sometimes (#4535): an env var's value, a
+     * selector's label, a binding subject that may be a user. A value that
+     * names no node of the rule's kind is then not reported as dangling, since
+     * most such values are not references at all, and a path read by several
+     * rules (one per target kind) would otherwise report every value matched by
+     * one rule as dangling under the others. A match is still a typed, scoped
+     * match, and two candidates still draw no edge.
+     */
+    optional?: boolean;
     /** Edge / containment label (e.g. "in VPC", "sg", "targets"). */
     label?: string;
     /**
@@ -58,10 +76,28 @@ export interface RefRule {
      */
     viaAttr?: string;
 }
+/**
+ * A typed tag rule (#4522, ruled on INTENTIUS/behold#1023 Q5): a tag whose
+ * key names a cloud id, read off an indexed node's `tags`. Tags make edges
+ * only through these, never by matching equal tag values, because two
+ * objects can carry the same value for any reason.
+ */
+export interface TagRefRule {
+    /** Holder kind; absent for every kind of this lexicon. */
+    from?: string;
+    /** The exact tag key, or a key prefix ending in `/` whose remainder is the value. */
+    key: string;
+    /** `value`: the tag's value is the id. `key-suffix`: the key after {@link key} is (`kubernetes.io/cluster/<name>`). */
+    read: "value" | "key-suffix";
+    targetKind: string;
+    label?: string;
+}
 /** A lexicon's reference knowledge — its identity map and reference rules. */
 export interface ReferenceCatalog {
     identities: IdentityRule[];
     refs: RefRule[];
+    /** Typed tag rules, used over indexed nodes only (#4522). */
+    tagRefs?: TagRefRule[];
 }
 /** `child` is contained by `parent` (subnet ∈ VPC). For #779's boundary boxes. */
 export interface ContainmentPair {
@@ -129,4 +165,113 @@ export declare function reconstructEdges(nodes: IRNode[], catalog: ReferenceCata
  * determinism.
  */
 export declare function containmentGroups(pairs: ContainmentPair[]): Record<string, string[]>;
+/** One lexicon's catalog, named, so a derived edge can say which rule made it. */
+export interface NamedCatalog {
+    lexicon: string;
+    catalog: ReferenceCatalog;
+}
+/**
+ * Where an indexed node's identifiers are unique (INTENTIUS/behold#1023 Q2):
+ * its substrate and account, subscription, project or cluster, plus its
+ * region for a regional type. A global type (IAM, Route 53, CloudFront) has
+ * no region, and is matched by account only.
+ */
+export interface IndexedNodeScope {
+    /** `<substrate>/<scopeId>`. */
+    account: string;
+    /** The region or location; undefined for a global type. */
+    region?: string;
+}
+/** A reference whose value matched several nodes: no edge is drawn (behold#1023 Q3). */
+export interface AmbiguousRef {
+    from: string;
+    rule: string;
+    path: string;
+    value: string;
+    /** Every node the value matched, sorted. */
+    candidates: string[];
+}
+/** A reference whose target is not in the index, with the rule that read it. */
+export interface IndexedDanglingRef extends DanglingRef {
+    rule: string;
+}
+export interface IndexedEdges {
+    /** Reference and containment edges, each `origin: "derived"` with its `rule`. */
+    edges: IREdge[];
+    containment: ContainmentPair[];
+    dangling: IndexedDanglingRef[];
+    ambiguous: AmbiguousRef[];
+}
+/** `<lexicon>:<from kind>:<path>`, the id a derived edge carries. */
+export declare function refRuleId(lexicon: string, from: string, path: string): string;
+/**
+ * Derive edges over indexed nodes (#4522) with each lexicon's catalog, under
+ * the rules ruled on INTENTIUS/behold#1023:
+ *
+ * - the join key is the scoped value: a reference on a node in region R
+ *   matches nodes of the same account in R, and global nodes of the same
+ *   account; a reference on a global node matches global nodes only;
+ * - a rule's target kind is `targetKind`, else `indexedTargetKind`;
+ * - a value that matches more than one node draws no edge and is returned in
+ *   `ambiguous` with every candidate, in place of {@link reconstructEdges}'
+ *   first-candidate pick, so two reads of one account in another node order
+ *   give the same edges;
+ * - tags make edges only through a catalog's typed `tagRefs`.
+ *
+ * A node is matched by its id, physical id, native id, cloud ids, and the
+ * catalog's identity paths. Rules apply to nodes of their own lexicon. Pure.
+ */
+export declare function reconstructIndexedEdges(nodes: readonly IRNode[], catalogs: readonly NamedCatalog[], scopeOf: (node: IRNode) => IndexedNodeScope): IndexedEdges;
+/** One value that names an indexed node: its native id, or one of its cloud ids. */
+export interface NodeIdentityValue {
+    /** `native-id`, or the cloud id's kind (`arn`, `provider-id`, ...). */
+    kind: string;
+    value: string;
+}
+/** The lexicon whose nodes can be identity-matched, and the values that name each one. */
+export interface IdentityOwners {
+    lexicon: string;
+    /** The values that name a node of this lexicon. Absent: its native id and its ARN cloud ids. */
+    identities?(node: IRNode): NodeIdentityValue[];
+}
+/** A value that named several nodes: no identity-match edge is drawn (behold#1023 Q3). */
+export interface AmbiguousIdentityRef {
+    from: string;
+    path: string;
+    value: string;
+    /** Every node the value named, sorted. */
+    candidates: string[];
+}
+export interface IdentityEdges {
+    /** Each `origin: "derived"`, `rule: "identity-match:..."`. */
+    edges: IREdge[];
+    ambiguous: AmbiguousIdentityRef[];
+}
+/** The label every edge of the identity pass carries, as the prefix of its `rule`. */
+export declare const IDENTITY_MATCH_RULE = "identity-match";
+/** `identity-match:<owner lexicon>:<owner kind>:<identity kind>`. */
+export declare function identityMatchRuleId(lexicon: string, kind: string, identityKind: string): string;
+/** The default identities of an indexed node: the native id, and any ARN among its cloud ids. */
+export declare function defaultNodeIdentities(node: IRNode): NodeIdentityValue[];
+/**
+ * The identity-match pass (#4523, ruled on INTENTIUS/behold#1023 Q1-Q3): the
+ * second pass over indexed nodes, after {@link reconstructIndexedEdges}. A
+ * string attribute on one node equal to a value that names another node (its
+ * native id, which for aws is the CloudFormation `primaryIdentifier`, or its
+ * ARN) draws an edge labelled `identity-match`:
+ *
+ * - only nodes of a lexicon in `owners` are named; holders are any node;
+ * - the join key is the scoped value, as in the catalog pass: a holder in
+ *   region R reaches nodes of its account in R and global nodes of its
+ *   account; a global holder reaches global nodes only;
+ * - a value naming more than one node draws no edge and is returned in
+ *   `ambiguous` with every candidate;
+ * - tag subtrees are never read, values under {@link MIN_IDENTITY_VALUE}
+ *   characters or with whitespace are skipped, and a value naming the holder
+ *   itself is not a reference;
+ * - a pair the catalog pass already joined (`existing`) gets no second edge.
+ *
+ * Pure, and independent of node order.
+ */
+export declare function reconstructIdentityEdges(nodes: readonly IRNode[], owners: readonly IdentityOwners[], scopeOf: (node: IRNode) => IndexedNodeScope, existing?: readonly IREdge[]): IdentityEdges;
 //# sourceMappingURL=graph-refs.d.ts.map

package/dist/graph-refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph-refs.d.ts","sourceRoot":"","sources":["../src/graph-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEjD,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED,kFAAkF;AAClF,MAAM,WAAW,OAAO;IACtB,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,KAAK,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IACtC,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,QAAQ,EAAE,WAAW,GAAG,aAAa,CAAC;IACtC,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;0DAC0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,WAAW,EAAE,CAAC;CACzB;AAQD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuB7D;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,CAK5E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,kBAAkB,CAgF/F;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAQpF"}
+{"version":3,"file":"graph-refs.d.ts","sourceRoot":"","sources":["../src/graph-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEjD,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED,kFAAkF;AAClF,MAAM,WAAW,OAAO;IACtB,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,KAAK,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IACtC,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kFAAkF;IAClF,QAAQ,EAAE,WAAW,GAAG,aAAa,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,uHAAuH;IACvH,IAAI,EAAE,OAAO,GAAG,YAAY,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;CACxB;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;0DAC0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,WAAW,EAAE,CAAC;CACzB;AAQD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuB7D;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,CAK5E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,kBAAkB,CAoF/F;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAQpF;AAID,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,SAAS,EAAE,YAAY,EAAE,CAAC;CAC3B;AAWD,qEAAqE;AACrE,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7E;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,EAAE,SAAS,YAAY,EAAE,EACjC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,gBAAgB,GAC1C,YAAY,CAoId;AAID,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,0FAA0F;AAC1F,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAAC;CAChD;AAED,0FAA0F;AAC1F,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,oBAAoB,EAAE,CAAC;CACnC;AAED,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/F;AAED,iGAAiG;AACjG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAKvE;AAgCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,gBAAgB,EAC3C,QAAQ,GAAE,SAAS,MAAM,EAAO,GAC/B,aAAa,CAwDf"}