@intentius/chant 0.124.52 → 0.124.54

package/src/health.schema.json

@@ -175,7 +175,8 @@
             "no-credentials",
             "no-binding",
             "unsupported-kind",
-            "filtered"
+            "filtered",
+            "not-reached"
           ]
         },
         "detail": {

package/src/identity.ts

@@ -369,6 +369,8 @@ export function unresolvedReasonText(reason: UnobservedReason | undefined): stri
       return "the substrate exposes no self-query";
     case "filtered":
       return "withheld";
+    case "not-reached":
+      return "the self-query never answered";
     default:
       return "no reason given";
   }

package/src/index.ts

@@ -32,6 +32,8 @@ export * from "./discovery/cache";
 export * from "./build";
 export * from "./env";
 export * from "./graph-ir";
+// Engine facts and the engine graph document (#4527): types for readers that show the graph.
+export * from "./engine-facts";
 export * from "./graph-detail";
 export * from "./graph-mermaid";
 export * from "./graph-dot";

package/src/instance-nodes.ts

@@ -0,0 +1,288 @@
+/**
+ * Instance nodes (#4454): one graph node per `count` or `for_each` instance,
+ * under the node of the block that declares it.
+ *
+ * A lexicon whose entity is a block that expands into instances (terraform's
+ * `aws_eip.pool`, applied as `aws_eip.pool[0]`, `aws_eip.pool[1]`, ...) has
+ * one graph node per block. A plan, a state read and a drift read all speak
+ * per instance. This module is the contract that puts both on the graph:
+ *
+ * - An instance's node id is its block's node id followed by the instance key
+ *   exactly as Terraform prints it: `<blockNode>[0]`, `<blockNode>["a"]`.
+ *   Inside a workspace the member goes in front as for any node, so
+ *   `<member>/<blockNode>[0]`.
+ * - The block node keeps existing and is the rollup: its verdict is the
+ *   aggregate of its instances' ({@link rollupInstances}).
+ * - In the graph IR an instance node is a child of its block node. It carries
+ *   `instanceOf`, the block node's id, and `instanceKey`, the key on its own
+ *   (`IRNode` in `./graph-ir.ts`). It has no edges and no attrs of its own:
+ *   both stay on the block, since a reference in the source is block to block.
+ * - A change-set entry and a drift row for an instance carry the instance
+ *   node's id as `node`, and the block node's id as `instanceOf`.
+ *
+ * The graph lists the instances a read of the source can count: a literal
+ * `count` or a literal `for_each`, or (#4486) one that reads a variable whose
+ * value the root's files give. An expansion that only a plan can count has
+ * no instance nodes in the declared graph, and an entry
+ * for one of its instances still names the instance id by the rule above,
+ * with `instanceOf` saying which block node to hang it under.
+ *
+ * Under a module call that is itself expanded (#4486), the module key goes
+ * on the call segment it belongs to, as Terraform prints it, and the
+ * block's own key stays at the end: `module.app[0].aws_eip.pool[1]` in root
+ * `estate` is `estate/module.app[0]/aws_eip.pool[1]`, under the block node
+ * `estate/module.app/aws_eip.pool`. The node also carries `instanceScope`,
+ * the expanded module path as Terraform prints it (`module.app[0]`), and its
+ * `instanceKey` is the block's own key, absent when only the module call is
+ * expanded. With no module call expanded the rule is the one above. The
+ * module call's own node gets instance nodes by the first rule,
+ * `estate/module.app[0]`.
+ *
+ * Imports nothing at run time, so it bundles with `./change-set.ts`.
+ */
+
+import type { EngineFacts } from "./engine-facts";
+
+/**
+ * Why the declared graph leaves an expanded block as one node (#4489): the
+ * codes of a block node's `instanceRollup`. Each is in the read contract's
+ * closed list (`workspace/reason-codes.ts`).
+ */
+export const INSTANCE_ROLLUP_CODES = [
+  "instances-each-value",
+  "instances-merge",
+  "instances-value-unknown",
+  "instances-form-unread",
+  "instances-over-limit",
+  "instances-module-uncounted",
+] as const;
+export type InstanceRollupCode = (typeof INSTANCE_ROLLUP_CODES)[number];
+
+/**
+ * On a block node whose `count` or `for_each` the declared graph cannot
+ * count (#4489): why, and the expression it could not count. `argument` and
+ * `expression` are the block's own, or with `call` those of the enclosing
+ * module call that could not be counted.
+ */
+export interface InstanceRollup {
+  code: InstanceRollupCode;
+  /** `count` or `for_each`. */
+  argument: "count" | "for_each";
+  /** The expression as written, without the `${ }` around it. */
+  expression: string;
+  /** With `instances-module-uncounted`: the module call, `module.app` or `module.app.module.db`. */
+  call?: string;
+}
+
+/** An entity's duck-typed `instanceRollup`, when it is one (#4489). */
+export function entityInstanceRollup(entity: unknown): InstanceRollup | undefined {
+  const r = (entity as { instanceRollup?: unknown } | null)?.instanceRollup;
+  if (typeof r !== "object" || r === null) return undefined;
+  const { code, argument, expression, call } = r as Record<string, unknown>;
+  if (!(INSTANCE_ROLLUP_CODES as readonly unknown[]).includes(code)) return undefined;
+  if (argument !== "count" && argument !== "for_each") return undefined;
+  if (typeof expression !== "string") return undefined;
+  return { code: code as InstanceRollupCode, argument, expression, ...(typeof call === "string" ? { call } : {}) };
+}
+
+/** A `[...]` instance key, a number or a quoted string with escapes. */
+const KEY = /\[(?:"(?:[^"\\]|\\.)*"|\d+)\]/;
+const TRAILING_KEY = new RegExp(`(${KEY.source})$`);
+
+/** An instance key as Terraform prints it: `[0]` for a `count` index, `["a"]` for a `for_each` key. */
+export function instanceKeyLiteral(key: string | number): string {
+  return typeof key === "number" ? `[${key}]` : `[${JSON.stringify(key)}]`;
+}
+
+/** The instance node id for a block node id and an instance key as Terraform prints it. */
+export function instanceNodeId(blockNode: string, key: string): string {
+  return `${blockNode}${key}`;
+}
+
+/**
+ * The instance key a terraform-family address ends with, as printed
+ * (`[0]`, `["a"]`), or undefined when it has none or when a module call on
+ * the way to it is expanded, which rolls up to the block (see the module doc).
+ */
+export function terraformInstanceKey(address: string): string | undefined {
+  const m = TRAILING_KEY.exec(address);
+  if (!m) return undefined;
+  const head = address.slice(0, m.index);
+  if (head.includes("[")) return undefined;
+  return m[1];
+}
+
+/** One part of a terraform address: a name and the `[...]` key that follows it, if any. */
+interface AddressPart {
+  name: string;
+  key?: string;
+}
+
+/** Split a terraform address on its dots, keeping each part's `[...]` key. Quoted keys may hold `.` or `]`. */
+function addressParts(address: string): AddressPart[] {
+  const parts: AddressPart[] = [];
+  let name = "";
+  let key = "";
+  let depth = 0;
+  let quoted = false;
+  const flush = (): void => {
+    if (name.length > 0) parts.push({ name, ...(key ? { key } : {}) });
+    name = "";
+    key = "";
+  };
+  for (let i = 0; i < address.length; i++) {
+    const c = address[i]!;
+    if (depth > 0) {
+      key += c;
+      if (quoted) {
+        if (c === "\\") key += address[++i] ?? "";
+        else if (c === '"') quoted = false;
+      } else if (c === '"') quoted = true;
+      else if (c === "]") depth--;
+      continue;
+    }
+    if (c === "[") {
+      depth++;
+      key += c;
+    } else if (c === ".") flush();
+    else name += c;
+  }
+  flush();
+  return parts;
+}
+
+/** Where one terraform-family instance address sits, relative to its root (#4486). */
+export interface TerraformInstancePath {
+  /** The block's key in its root: `module.app/aws_eip.pool`. */
+  block: string;
+  /** The instance node's key in its root: `module.app[0]/aws_eip.pool[1]`. */
+  instance: string;
+  /** The block's own instance key, `[1]`, absent when the block itself is not expanded. */
+  key?: string;
+  /** The expanded module path, `module.app[0]`, absent when no module call on the way is expanded. */
+  scope?: string;
+}
+
+/**
+ * The block key and instance node key a terraform-family address names, or
+ * undefined when nothing on it is expanded (no `[...]` anywhere) or the
+ * address is not a block's. `module.app[0].aws_eip.pool[1]` is block
+ * `module.app/aws_eip.pool`, instance `module.app[0]/aws_eip.pool[1]`, key
+ * `[1]`, scope `module.app[0]`.
+ */
+export function terraformInstancePath(address: string): TerraformInstancePath | undefined {
+  const parts = addressParts(address);
+  const blockScope: string[] = [];
+  const instanceScope: string[] = [];
+  let expandedScope = false;
+  let i = 0;
+  while (parts[i]?.name === "module" && i + 1 < parts.length) {
+    const call = parts[i + 1]!;
+    blockScope.push(`module.${call.name}`);
+    instanceScope.push(`module.${call.name}${call.key ?? ""}`);
+    if (call.key) expandedScope = true;
+    i += 2;
+  }
+  const rest = parts.slice(i);
+  let block: string;
+  let key: string | undefined;
+  if (rest.length === 0) {
+    // The module call itself, a block of its caller.
+    if (blockScope.length === 0) return undefined;
+    const call = blockScope.pop()!;
+    const inst = instanceScope.pop()!;
+    block = call;
+    key = inst.length > call.length ? inst.slice(call.length) : undefined;
+    expandedScope = instanceScope.some((s, n) => s !== blockScope[n]);
+  } else if (rest[0]!.name === "data" && rest.length >= 3) {
+    block = `data.${rest[1]!.name}.${rest[2]!.name}`;
+    key = rest[2]!.key;
+  } else if (rest.length >= 2) {
+    block = `${rest[0]!.name}.${rest[1]!.name}`;
+    key = rest[1]!.key;
+  } else return undefined;
+  if (key === undefined && !expandedScope) return undefined;
+  const scope = expandedScope ? instanceScope.join(".") : undefined;
+  return {
+    block: [...blockScope, block].join("/"),
+    instance: [...(expandedScope ? instanceScope : blockScope), `${block}${key ?? ""}`].join("/"),
+    ...(key !== undefined ? { key } : {}),
+    ...(scope !== undefined ? { scope } : {}),
+  };
+}
+
+/**
+ * One instance's observed verdict, carried on its block's
+ * `ResourceMetadata.instances` (`./lexicon.ts`) so the live graph can draw the
+ * instance node and paint it on its own.
+ */
+export interface InstanceObservation {
+  /**
+   * The block's own instance key as Terraform prints it, `[0]` or `["a"]`.
+   * Absent on an instance that only an expanded module call makes (#4488),
+   * which then carries {@link scope}.
+   */
+  key?: string;
+  /**
+   * The expanded module path as Terraform prints it, `module.app[0]`, on an
+   * instance under an expanded module call (#4488). The live graph then
+   * builds the node id by {@link terraformInstancePath} from {@link address},
+   * the same id the declared graph lists: `estate/module.app[0]/aws_eip.pool[1]`.
+   */
+  scope?: string;
+  /** The engine's own instance address, `aws_eip.pool[0]` or `module.app[0].aws_eip.pool[1]`. */
+  address: string;
+  verdict: "present" | "absent" | "not-observed";
+  /** The provider's id, on a present instance, when the read gave one. */
+  physicalId?: string;
+  /** Same meaning as `ResourceMetadata.ownership`, on a present instance. */
+  ownership?: "owned" | "foreign" | "unknown";
+  /** Same meaning as `ResourceMetadata.facts` (#4527), on a present instance. Never read for a decision. */
+  facts?: EngineFacts;
+  /** The lexicon's status word for this instance, as on `ResourceMetadata.status`. */
+  status?: string;
+  /** Why it was not observed, on a not-observed instance. An `UnobservedReason`. */
+  reason?: string;
+  detail?: string;
+}
+
+/**
+ * The live graph's node id for one observed instance of the block node
+ * `blockNode` (#4488): `<blockNode><key>` with no expanded module call on
+ * the way, else the declared graph's rule (#4486) applied to the instance's
+ * address, so `module.app[0].aws_eip.pool[1]` under
+ * `estate/module.app/aws_eip.pool` is `estate/module.app[0]/aws_eip.pool[1]`.
+ * Undefined when the address does not belong to that block node.
+ */
+export function observedInstanceNodeId(blockNode: string, inst: Pick<InstanceObservation, "key" | "scope" | "address">): string | undefined {
+  if (inst.scope === undefined) return inst.key === undefined ? undefined : instanceNodeId(blockNode, inst.key);
+  const path = terraformInstancePath(inst.address);
+  if (!path?.scope) return undefined;
+  if (blockNode !== path.block && !blockNode.endsWith(`/${path.block}`)) return undefined;
+  return `${blockNode.slice(0, blockNode.length - path.block.length)}${path.instance}`;
+}
+
+/**
+ * The block's verdict from its instances' (#4454, the one place the rollup is
+ * written): the first kind in `precedence` that any instance has, or
+ * undefined when there are no instances or none has a kind `precedence`
+ * names. The precedence is the caller's, most significant first; terraform's
+ * is {@link TERRAFORM_INSTANCE_ROLLUP}.
+ *
+ * Partial knowledge is not knowledge: put the not-observed kind first and a
+ * block with one unread instance is unread, never partly owned.
+ */
+export function rollupInstances<V extends { kind: string }>(verdicts: readonly V[], precedence: readonly V["kind"][]): V | undefined {
+  for (const kind of precedence) {
+    const found = verdicts.find((v) => v.kind === kind);
+    if (found) return found;
+  }
+  return undefined;
+}
+
+/**
+ * Terraform's block rollup over live-plan instance verdicts: any instance
+ * not-observed makes the block not-observed, then foreign, then adoptable,
+ * then owned, and a block whose instances are all absent is absent.
+ */
+export const TERRAFORM_INSTANCE_ROLLUP = ["unobserved", "foreign", "adoptable", "owned", "absent"] as const;

package/src/lexicon.ts

@@ -1,3 +1,5 @@
+import type { InstanceObservation } from "./instance-nodes";
+import type { EngineFacts } from "./engine-facts";
 import type { CapabilityPack } from "./capabilities/view";
 import type { Serializer } from "./serializer";
 import type { Declarable } from "./declarable";
@@ -24,8 +26,12 @@ import type { OwnershipChannel, OwnershipMarker } from "./ownership";
 import type { LexiconConfigSchema } from "./lexicon-config";
 import type { RuleMeta } from "./audit/catalog";
 import type { ReferenceCatalog } from "./graph-refs";
+import type { ListedTypeMapping } from "./lifecycle/type-listing";
+import type { IndexIdentity } from "./lifecycle/identity-match";
+import type { IndexImportCodegen } from "./lifecycle/index-import";
 import type { IREdge, LexiconGraphEdges, LexiconUnreadSource, LexiconWorkspaceLinks, LexiconWorkspaceOutputs } from "./graph-ir";
 import type { DescribeResourcesResult, UnobservedReason } from "./observation";
+import type { ReadDriftOptions, ReadDriftResult } from "./drift-record";
 import type { DescribeIdentityOptions, DescribeIdentityResult } from "./identity";
 import type { DeepNormalizationHooks, DeepObservationResult } from "./deep-observation";
 import type { BehaviourResult, PredictBehaviourOptions } from "./behaviour";
@@ -1989,6 +1995,24 @@ export interface LexiconPlugin {
    */
   predictBehaviour?(options: PredictBehaviourOptions): Promise<BehaviourResult>;
 
+  /**
+   * The drift of what this lexicon reads, as drift-record stream lines
+   * (behold#995, `./drift-record.ts`): a `drift-start`, one record per
+   * resource instance and a `drift-settle`, for each root or stack the
+   * project declares. `chant lifecycle drift` calls it and prints the lines,
+   * and `chant workspace drift` runs that command in the reader project of
+   * a member whose kind the lexicon reads, so a terraform or choudoufu
+   * member's drift comes from the engine that owns it.
+   *
+   * Optional. A lexicon without it has no drift read of its own; a chant
+   * member's drift comes from `lifecycle diff --live` instead. A read that
+   * the lexicon cannot answer (a read its engine does not have, or one
+   * resource on an engine that cannot read one alone) is a `refused`
+   * answer. A read that ran and failed is records, `not-observed`, never a
+   * refusal and never a throw.
+   */
+  readDrift?(options: ReadDriftOptions): Promise<ReadDriftResult>;
+
   /**
    * What this lexicon's own entity types are, to an engine that prices them
    * (#2382). Rows, not a capability: core resolves and predicts, and a lexicon
@@ -2175,6 +2199,39 @@ export interface LexiconPlugin {
    */
   referenceCatalog?: ReferenceCatalog;
 
+  /**
+   * How a cloud inventory API's type names map to this lexicon's kinds
+   * (#4521): CloudFormation types for aws, lowercase ARM types for azure,
+   * Cloud Asset types for gcp, group/version/kind for k8s. `typeListing`
+   * (./lifecycle/type-listing.ts) reads it to type an indexed resource, then
+   * normalizes its properties with {@link deepNormalizationHooks}. Data plus
+   * pure functions. Opt-in: a lexicon without it leaves listed objects of its
+   * substrate as unknown-kind nodes.
+   */
+  listedTypes?: ListedTypeMapping;
+
+  /**
+   * How this lexicon's declared entities match indexed resources by identity
+   * (#4523): the identifier a declaration's props spell (aws: the
+   * CloudFormation `primaryIdentifier`), or why there is none (a
+   * server-assigned id). `matchDeclaredToIndex`
+   * (./lifecycle/identity-match.ts) runs it against an index version, and the
+   * identity-match edge pass (./lifecycle/derive-edges.ts) uses it to name
+   * this lexicon's indexed nodes. Data plus pure functions. Opt-in: a lexicon
+   * whose live read already matches by name or state does not need it.
+   */
+  indexIdentity?: IndexIdentity;
+
+  /**
+   * How this lexicon writes an indexed resource as source (#4524, `chant
+   * import --index`): the import IR for one indexed node, a value as a
+   * reference to another imported node, and a parameter for a masked value.
+   * Core hands the IR to {@link templateGenerator}, the codegen a template
+   * import uses. Data plus pure functions. Opt-in: an indexed node of a
+   * lexicon without it is reported as unsupported and written nowhere.
+   */
+  indexImport?: IndexImportCodegen;
+
   /**
    * This lexicon's capability pack (#4375): its mapping onto the
    * lexicon-neutral view the capability rules read (labels, edge names,
@@ -2480,6 +2537,14 @@ export interface ResourceMetadata {
    * a delete, and never escalates `unknown` to one.
    */
   ownership?: "owned" | "foreign" | "unknown";
+  /**
+   * What an ownership engine (choudoufu, plunge) observed about this resource
+   * (#4520, #4527), read from the engine's graph document. `buildLiveGraphIr`
+   * copies it onto the node beside `physicalId`. Never read for a decision:
+   * the change set reads {@link ownership}, and no change set, lifecycle step
+   * or Op imports `EngineFacts`. Absent unless an engine supplied it.
+   */
+  facts?: EngineFacts;
   /**
    * The stack/env identity read off the resource's own ownership marker
    * (#1222) — the tags/labels/metadata chant stamped at synthesis, read back
@@ -2509,6 +2574,17 @@ export interface ResourceMetadata {
    * undeclared live resource stays `orphan`.
    */
   ownerChain?: OwnerChainVerdict;
+  /**
+   * The instances of a `count` or `for_each` block (#4454), each with its own
+   * verdict, keyed as the engine prints them (`[0]`, `["a"]`). The rest of
+   * this metadata is the block's rollup over them. `buildLiveGraphIr` draws
+   * each present instance as a node `<name><key>` under this one, or by the
+   * declared graph's module-key rule when the instance carries a `scope`
+   * (`estate/module.app[0]/aws_eip.pool[1]`, #4488), and the
+   * overlay paints a declared instance from it. Absent when the lexicon reads
+   * no instances, or the block is not expanded.
+   */
+  instances?: InstanceObservation[];
   /**
    * The declared node ids that reference this resource (#1273), set on an
    * undeclared resource observed only because something declared points at it —

package/src/lifecycle/__fixtures__/index-diff/20261026T120000Z-aaaaaaaaaaaa.json

@@ -0,0 +1,149 @@
+{
+  "index": "v1",
+  "stamp": {
+    "source": {
+      "kind": "cloud",
+      "name": "behold-lister",
+      "version": "0.0.0"
+    },
+    "scope": {
+      "kind": "cloud",
+      "substrate": "aws",
+      "scopeId": "000000000000",
+      "locations": [
+        "us-east-1"
+      ],
+      "types": [
+        "AWS::IAM::Role",
+        "AWS::S3::Bucket",
+        "AWS::SQS::Queue"
+      ]
+    },
+    "scopeKey": "cloud/aws/000000000000/5c1f0e2a9b7d",
+    "observedAt": "2026-10-26T12:00:00Z",
+    "completedAt": "2026-10-26T12:00:04Z",
+    "digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+  },
+  "coverage": [
+    {
+      "listedType": "AWS::IAM::Role",
+      "location": "us-east-1",
+      "verdict": "listed"
+    },
+    {
+      "listedType": "AWS::S3::Bucket",
+      "location": "us-east-1",
+      "verdict": "listed"
+    },
+    {
+      "listedType": "AWS::SQS::Queue",
+      "location": "us-east-1",
+      "verdict": "listed"
+    }
+  ],
+  "graph": {
+    "version": 1,
+    "nodes": [
+      {
+        "id": "aws/000000000000/us-east-1/AWS::IAM::Role/app-role",
+        "kind": "AWS::IAM::Role",
+        "lexicon": "aws",
+        "attrs": {
+          "RoleName": "app-role",
+          "Path": "/"
+        },
+        "physicalId": "app-role",
+        "listedType": "AWS::IAM::Role",
+        "location": "us-east-1",
+        "nativeId": "app-role",
+        "facts": {
+          "observedAt": "2026-10-26T12:00:00Z"
+        }
+      },
+      {
+        "id": "aws/000000000000/us-east-1/AWS::S3::Bucket/old-bucket",
+        "kind": "AWS::S3::Bucket",
+        "lexicon": "aws",
+        "attrs": {
+          "BucketName": "old-bucket"
+        },
+        "physicalId": "old-bucket",
+        "listedType": "AWS::S3::Bucket",
+        "location": "us-east-1",
+        "nativeId": "old-bucket",
+        "facts": {
+          "observedAt": "2026-10-26T12:00:00Z"
+        }
+      },
+      {
+        "id": "aws/000000000000/us-east-1/AWS::S3::Bucket/web-logs",
+        "kind": "AWS::S3::Bucket",
+        "lexicon": "aws",
+        "attrs": {
+          "BucketName": "web-logs",
+          "VersioningConfiguration": {
+            "Status": "Suspended"
+          },
+          "Tags": [
+            {
+              "Key": "env",
+              "Value": "dev"
+            }
+          ]
+        },
+        "physicalId": "web-logs",
+        "listedType": "AWS::S3::Bucket",
+        "location": "us-east-1",
+        "nativeId": "web-logs",
+        "facts": {
+          "observedAt": "2026-10-26T12:00:00Z"
+        },
+        "tags": {
+          "env": "dev"
+        }
+      },
+      {
+        "id": "aws/000000000000/us-east-1/AWS::SQS::Queue/jobs",
+        "kind": "AWS::SQS::Queue",
+        "lexicon": "aws",
+        "attrs": {
+          "QueueName": "jobs"
+        },
+        "physicalId": "jobs",
+        "listedType": "AWS::SQS::Queue",
+        "location": "us-east-1",
+        "nativeId": "jobs",
+        "facts": {
+          "observedAt": "2026-10-26T12:00:00Z"
+        }
+      }
+    ],
+    "edges": [
+      {
+        "from": "aws/000000000000/us-east-1/AWS::IAM::Role/app-role",
+        "to": "aws/000000000000/us-east-1/AWS::S3::Bucket/web-logs",
+        "kind": "ref",
+        "viaAttr": "Policies",
+        "origin": "derived",
+        "rule": "aws:AWS::IAM::Role:Policies"
+      },
+      {
+        "from": "aws/000000000000/us-east-1/AWS::IAM::Role/app-role",
+        "to": "aws/000000000000/us-east-1/AWS::SQS::Queue/jobs",
+        "kind": "ref",
+        "viaAttr": "Policies",
+        "origin": "derived",
+        "rule": "aws:AWS::IAM::Role:Policies"
+      },
+      {
+        "from": "aws/000000000000/us-east-1/AWS::IAM::Role/app-role",
+        "to": "aws/000000000000/us-east-1/AWS::S3::Bucket/old-bucket",
+        "kind": "ref",
+        "viaAttr": "Policies",
+        "origin": "derived",
+        "rule": "aws:AWS::IAM::Role:Policies"
+      }
+    ],
+    "groups": {}
+  }
+}