@intentius/chant 0.41.20 → 0.44.1

package/src/okf.ts

@@ -0,0 +1,308 @@
+import { relative, isAbsolute } from "node:path";
+import type { Declarable } from "./declarable";
+import { buildGraphIr } from "./graph-ir";
+import { isLexiconOutput, type LexiconOutput } from "./lexicon-output";
+import { getProvenance } from "./provenance";
+import { emitYAML, parseYAML } from "./yaml";
+
+/**
+ * OKF bundle emitter (#1058, epic #1057) — projects a discovered entity graph
+ * into an Open Knowledge Format v0.2 bundle: a directory of markdown files
+ * with YAML frontmatter, per the spec at
+ * https://github.com/GoogleCloudPlatform/knowledge-catalog/blob/main/okf/SPEC.md
+ *
+ * One concept document per entity, `type` carrying the entity's resource type
+ * string, dependency edges as bundle-relative markdown links (the form the
+ * spec recommends for stability), and a root `index.md` grouping concepts into
+ * per-lexicon sections. Emit-only: OKF as project *input* is #1059.
+ */
+
+export const OKF_VERSION = "0.2";
+
+/** One file of an OKF bundle: a bundle-relative path and its full content. */
+export interface OkfFile {
+  /** Bundle-relative path, e.g. "aws/myBucket.md" or "index.md". */
+  path: string;
+  content: string;
+}
+
+/** The subset of a discovery result the emitter reads. */
+export interface OkfBundleInput {
+  entities: Map<string, Declarable>;
+  dependencies: Map<string, Set<string>>;
+}
+
+/** Make an entity or lexicon name safe as a single path segment. */
+export function slug(name: string): string {
+  const cleaned = name.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^\.+/, "");
+  return cleaned === "" ? "unnamed" : cleaned;
+}
+
+function relFile(file: string | undefined, projectPath?: string): string | undefined {
+  if (!file) return undefined;
+  if (projectPath && isAbsolute(file)) {
+    const rel = relative(projectPath, file);
+    return rel.startsWith("..") ? file : rel;
+  }
+  return file;
+}
+
+/**
+ * Render a flat frontmatter mapping as a YAML block. Keys with undefined
+ * values are dropped; scalar quoting is `emitYAML`'s.
+ */
+export function frontmatter(fields: Record<string, string | undefined>): string {
+  const lines: string[] = ["---"];
+  for (const [key, value] of Object.entries(fields)) {
+    if (value === undefined) continue;
+    lines.push(`${key}: ${emitYAML(value, 0)}`);
+  }
+  lines.push("---");
+  return lines.join("\n");
+}
+
+/**
+ * Split a concept document into its frontmatter block and body. Returns
+ * undefined when the document does not start with a `---` delimited block.
+ * Exported for the conformance tests (and any future OKF consumer, #1059).
+ */
+export function splitFrontmatter(content: string): { frontmatter: string; body: string } | undefined {
+  const lines = content.split("\n");
+  if (lines[0] !== "---") return undefined;
+  const end = lines.indexOf("---", 1);
+  if (end === -1) return undefined;
+  return {
+    frontmatter: lines.slice(1, end).join("\n"),
+    body: lines.slice(end + 1).join("\n"),
+  };
+}
+
+/**
+ * Check a bundle against the OKF v0.2 conformance criteria (spec §11) and
+ * return every violation found: parseable frontmatter on every non-reserved
+ * `.md`, a non-empty `type` everywhere, a well-formed root `index.md`, and
+ * generated cross-link entries that are bundle-absolute (or external URLs).
+ * Empty result means conformant. Shared by the project-bundle tests (#1058)
+ * and every lexicon's bundle tests (#1060).
+ */
+export function okfConformanceProblems(files: OkfFile[]): string[] {
+  const problems: string[] = [];
+  const reserved = new Set(["index.md", "log.md"]);
+  const linkTarget = /\]\(([^)]+)\)/g;
+  const externalOrAbsolute = (target: string): boolean =>
+    target.startsWith("/") || /^[a-z][a-z0-9+.-]*:/i.test(target);
+
+  for (const file of files) {
+    if (!file.path.endsWith(".md")) problems.push(`${file.path}: not a markdown file`);
+    if (file.path.startsWith("/") || file.path.includes("..")) {
+      problems.push(`${file.path}: path is not bundle-relative`);
+    }
+    if (reserved.has(file.path.split("/").pop()!)) continue;
+
+    const split = splitFrontmatter(file.content);
+    if (!split) {
+      problems.push(`${file.path}: no frontmatter block`);
+      continue;
+    }
+    let parsed: unknown;
+    try {
+      parsed = parseYAML(split.frontmatter);
+    } catch {
+      problems.push(`${file.path}: unparseable frontmatter`);
+      continue;
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+      problems.push(`${file.path}: frontmatter is not a mapping`);
+      continue;
+    }
+    const type = (parsed as Record<string, unknown>).type;
+    if (typeof type !== "string" || type.length === 0) {
+      problems.push(`${file.path}: frontmatter has no non-empty type`);
+    }
+    // Cross-link entries (the "- [name](target)" lines the emitters generate)
+    // must point inside the bundle or at an external URL. Broken targets are
+    // permitted (not-yet-written knowledge); malformed ones are not. Free-text
+    // knowledge bodies may carry arbitrary links and are not checked.
+    for (const line of split.body.split("\n")) {
+      if (!line.trimStart().startsWith("- [")) continue;
+      for (const match of line.matchAll(linkTarget)) {
+        if (!externalOrAbsolute(match[1])) {
+          problems.push(`${file.path}: link target "${match[1]}" is neither bundle-absolute nor external`);
+        }
+      }
+    }
+  }
+
+  const index = files.find((f) => f.path === "index.md");
+  if (!index) {
+    problems.push("bundle has no root index.md");
+    return problems;
+  }
+  const split = splitFrontmatter(index.content);
+  if (!split) {
+    problems.push("index.md: no frontmatter block");
+    return problems;
+  }
+  const parsed = parseYAML(split.frontmatter);
+  for (const key of Object.keys(parsed ?? {})) {
+    if (key !== "okf_version") problems.push(`index.md: frontmatter carries "${key}" — okf_version is the only key an index is allowed`);
+  }
+  for (const line of split.body.split("\n")) {
+    if (line.startsWith("*") && !/^\* \[[^\]]+\]\([^)]+\) - .+$/.test(line)) {
+      problems.push(`index.md: malformed entry line: ${line}`);
+    }
+  }
+  return problems;
+}
+
+interface Concept {
+  name: string;
+  entity: Declarable;
+  /** Bundle-relative concept path, e.g. "aws/myBucket.md". */
+  path: string;
+  lexicon: string;
+  /** The frontmatter `type` — the entity's resource type string. */
+  type: string;
+  kind: string;
+}
+
+/**
+ * The `type`/`lexicon`/`kind` a concept carries. Most entities state all
+ * three; a `LexiconOutput` (an `output(...)` bridge) carries none of them
+ * directly, so its facts come from its producing side — `type` must be
+ * non-empty for the bundle to conform, never blank.
+ */
+function conceptFacts(entity: Declarable): { type: string; lexicon: string; kind: string } {
+  if (isLexiconOutput(entity)) {
+    const out = entity as unknown as LexiconOutput;
+    return { type: "Output", lexicon: out.sourceLexicon || "unknown", kind: "output" };
+  }
+  return {
+    type: entity.entityType || "Entity",
+    lexicon: entity.lexicon || "unknown",
+    kind: entity.kind ?? "resource",
+  };
+}
+
+/**
+ * Build the OKF bundle for a discovered graph. Pure and deterministic: the
+ * same entities yield byte-identical files, so bundles are diffable and
+ * snapshot-testable. `projectPath` relativizes source-file paths so the
+ * bundle is portable.
+ */
+export function buildOkfBundle(input: OkfBundleInput, projectPath?: string): OkfFile[] {
+  // Assign each entity a stable concept path: <lexicon>/<name>.md, deduped
+  // when slugging collides two distinct names.
+  const concepts = new Map<string, Concept>();
+  const takenPaths = new Set<string>();
+  const names = [...input.entities.keys()].sort((a, b) => a.localeCompare(b));
+  for (const name of names) {
+    const entity = input.entities.get(name)!;
+    const facts = conceptFacts(entity);
+    const base = `${slug(facts.lexicon)}/${slug(name)}`;
+    let path = `${base}.md`;
+    for (let n = 2; takenPaths.has(path); n++) path = `${base}-${n}.md`;
+    takenPaths.add(path);
+    concepts.set(name, { name, entity, path, ...facts });
+  }
+
+  // Dependency edges: the graph IR's AttrRef/Ref-derived edges (the same
+  // derivation `chant graph --format ir` ships) unioned with discovery's
+  // declared dependency map — the map alone misses references that live only
+  // in attribute values.
+  const dependsOn = new Map<string, Set<string>>();
+  const addEdge = (from: string, to: string): void => {
+    if (!dependsOn.has(from)) dependsOn.set(from, new Set());
+    dependsOn.get(from)!.add(to);
+  };
+  for (const edge of buildGraphIr(input.entities, projectPath).edges) addEdge(edge.from, edge.to);
+  for (const [from, deps] of input.dependencies) for (const to of deps) addEdge(from, to);
+
+  // Reverse edges: who references each entity.
+  const referencedBy = new Map<string, string[]>();
+  for (const [from, deps] of dependsOn) {
+    for (const to of deps) {
+      if (!referencedBy.has(to)) referencedBy.set(to, []);
+      referencedBy.get(to)!.push(from);
+    }
+  }
+
+  const files: OkfFile[] = [];
+
+  for (const name of names) {
+    const concept = concepts.get(name)!;
+    const { entity } = concept;
+    const prov = getProvenance(entity);
+    const source = relFile(prov?.sourceFile, projectPath);
+
+    const head = frontmatter({
+      type: concept.type,
+      title: name,
+      description: `${concept.lexicon} ${concept.kind} of type ${concept.type}`,
+      name,
+      lexicon: concept.lexicon,
+      kind: concept.kind,
+      source,
+      composite: prov?.composite,
+      composite_instance: prov?.compositeInstance,
+    });
+
+    const body: string[] = [""];
+    body.push(source ? `Declared in \`${source}\`.` : `Declared by the ${concept.lexicon} lexicon.`);
+
+    // Cross-resource references become bundle-relative links. A dependency
+    // whose target is not in the bundle still emits a link — the spec permits
+    // broken links (not-yet-written knowledge), so unresolved never fails.
+    const deps = [...(dependsOn.get(name) ?? [])].sort((a, b) => a.localeCompare(b));
+    if (deps.length > 0) {
+      body.push("", "## Depends on", "");
+      for (const dep of deps) {
+        const target = concepts.get(dep)?.path ?? `${slug(dep)}.md`;
+        body.push(`- [${dep}](/${target})`);
+      }
+    }
+
+    const consumers = (referencedBy.get(name) ?? []).sort((a, b) => a.localeCompare(b));
+    if (consumers.length > 0) {
+      body.push("", "## Referenced by", "");
+      for (const consumer of consumers) {
+        const target = concepts.get(consumer)?.path ?? `${slug(consumer)}.md`;
+        body.push(`- [${consumer}](/${target})`);
+      }
+    }
+
+    body.push("");
+    files.push({ path: concept.path, content: head + body.join("\n") });
+  }
+
+  files.push({ path: "index.md", content: buildIndex(concepts, names) });
+  files.sort((a, b) => a.path.localeCompare(b.path));
+  return files;
+}
+
+/**
+ * The bundle-root `index.md` (spec §8): one section per lexicon, each entry a
+ * bundle-relative link plus the concept's description — the spec's
+ * progressive-disclosure mechanism. Root indexes may carry `okf_version`
+ * frontmatter (spec §12), the only frontmatter an index is allowed.
+ */
+function buildIndex(concepts: Map<string, Concept>, names: string[]): string {
+  const byLexicon = new Map<string, Concept[]>();
+  for (const name of names) {
+    const concept = concepts.get(name)!;
+    if (!byLexicon.has(concept.lexicon)) byLexicon.set(concept.lexicon, []);
+    byLexicon.get(concept.lexicon)!.push(concept);
+  }
+
+  const lines: string[] = ["---", `okf_version: '${OKF_VERSION}'`, "---", ""];
+  const lexicons = [...byLexicon.keys()].sort((a, b) => a.localeCompare(b));
+  for (const lexicon of lexicons) {
+    lines.push(`# Lexicon: ${lexicon}`, "");
+    for (const concept of byLexicon.get(lexicon)!) {
+      lines.push(`* [${concept.name}](/${concept.path}) - ${lexicon} ${concept.kind} of type ${concept.type}`);
+    }
+    lines.push("");
+  }
+  if (lexicons.length === 0) lines.push("No entities discovered.", "");
+  return lines.join("\n");
+}

package/src/terraform/__fixtures__/build-graph.ts

@@ -0,0 +1,25 @@
+import { buildGraph, collectExpressions, type ExpressionRefs } from "../graph";
+import type { Hcl2JsonTree, TfGraph } from "../types";
+
+/**
+ * Test-only stand-in for the hcl2json expression AST (`parse.ts`'s
+ * `resolveExpressionRefs`). Fixture expressions are simple `${<accessor>}`
+ * templates, so each one's accessor list is just its interpolation bodies.
+ * Production never takes this path — `parseTerraformDir` resolves every
+ * expression through `getReferencesInExpression`.
+ */
+export function fixtureExprRefs(tree: Hcl2JsonTree): ExpressionRefs {
+  const refs = new Map<string, string[]>();
+  for (const expr of collectExpressions(tree)) {
+    refs.set(
+      expr,
+      [...expr.matchAll(/\$\{([^}]+)\}/g)].map((m) => m[1].trim()),
+    );
+  }
+  return refs;
+}
+
+/** `buildGraph` over a hand-written fixture tree, accessors derived per {@link fixtureExprRefs}. */
+export function buildFixtureGraph(tree: Hcl2JsonTree): TfGraph {
+  return buildGraph(tree, fixtureExprRefs(tree));
+}

package/src/terraform/adopt-state.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { adoptFromState, canAdoptFromState, supportedStateAdoptionTypes } from "./adopt-state";
+import { adoptFromState, canAdoptFromState, supportedStateAdoptionTypes, type DeferredParam } from "./adopt-state";
 import type { StateResource } from "./state";
 
 describe("adoptFromState", () => {
@@ -45,6 +45,39 @@ describe("adoptFromState", () => {
     expect(out.content).toContain("RetentionInDays: 30");
   });
 
+  test("a deferred input renders as a params reference, not the state literal (#998)", () => {
+    const subnet: StateResource = {
+      type: "aws_subnet",
+      name: "a",
+      attributes: { id: "subnet-0aa", vpc_id: "vpc-0abc", cidr_block: "10.0.1.0/24" },
+    };
+    const params: DeferredParam[] = [
+      { name: "vpc_id", tfAttr: "vpc_id", survivor: "aws_vpc.main", attrs: ["id"], default: "vpc-0abc" },
+    ];
+    const out = adoptFromState(subnet, params)!;
+    expect(out.parameterized).toEqual(["vpc_id"]);
+    expect(out.content).toContain('import { params } from "@intentius/chant/params";');
+    expect(out.content).toContain("VpcId: params.vpc_id as string,");
+    expect(out.content).not.toContain('VpcId: "vpc-0abc"');
+    // Non-deferred props keep their state literals.
+    expect(out.content).toContain('CidrBlock: "10.0.1.0/24"');
+  });
+
+  test("a deferred input on an unmapped attribute leaves the source alone", () => {
+    const lambda: StateResource = {
+      type: "aws_lambda_function",
+      name: "api",
+      attributes: { id: "myapp-api", function_name: "myapp-api", environment: [{ variables: { B: "b" } }] },
+    };
+    const params: DeferredParam[] = [
+      { name: "environment", tfAttr: "environment", survivor: "aws_s3_bucket.assets", attrs: ["bucket"] },
+    ];
+    const out = adoptFromState(lambda, params)!;
+    expect(out.parameterized).toEqual([]);
+    expect(out.content).not.toContain("@intentius/chant/params");
+    expect(out.content).toContain('FunctionName: "myapp-api"');
+  });
+
   test("canAdoptFromState gates on a known native constructor", () => {
     expect(canAdoptFromState("aws_s3_bucket")).toBe(true);
     expect(canAdoptFromState("random_pet")).toBe(false);

package/src/terraform/adopt-state.ts

@@ -10,17 +10,47 @@
  * AWS carve-out table (`aws-resources.ts`) — the same table the advisor's tier
  * map derives from, so every AWS type advise ranks can be emitted. Attributes
  * without a mapping are preserved in a reference comment, never dropped.
+ *
+ * Deferred outbound inputs (#998): an attribute whose value the Terraform
+ * source read from a survivor (`vpc_id = aws_vpc.main.id`) is not a fact of
+ * the carved resource — it is a deploy-time input. Those props are emitted as
+ * `params.<name>` references instead of frozen literals, with the state's
+ * resolved value as the declared default (see `carve-emit.ts`'s scaffold).
  */
 
 import { AWS_CARVE_TYPES, AWS_LEXICON_IMPORT, awsCarveType, applyAwsMapper } from "./aws-resources";
 import type { StateResource } from "./state";
 
+/** The core subpath the emitted source reads build parameters from. */
+export const PARAMS_IMPORT = "@intentius/chant/params";
+
+/**
+ * One deferred outbound input turned into a build parameter (#998). Derived
+ * from the boundary report's outbound edges + the state's resolved attributes
+ * in `carve-emit.ts`; consumed here (source substitution) and by the scaffold
+ * (`chant.config.ts` `buildParams` declaration).
+ */
+export interface DeferredParam {
+  /** Build-parameter name, source-referenceable (`params.<name>`). */
+  name: string;
+  /** The carved resource's own Terraform attribute the value enters through. */
+  tfAttr: string;
+  /** The survivor the Terraform source read, e.g. `aws_vpc.main`. */
+  survivor: string;
+  /** Survivor attribute(s) read, e.g. `["id"]`. */
+  attrs: string[];
+  /** The state-resolved value — the parameter's declared default. */
+  default?: string | number | boolean;
+}
+
 export interface AdoptedSource {
   fileName: string;
   content: string;
   /** True when at least one attribute was mapped to a native prop. */
   mapped: boolean;
   nativeType: string;
+  /** Deferred params actually substituted into the emitted props (#998). */
+  parameterized: string[];
 }
 
 /** Is this Terraform type adoptable from state (has a native constructor)? */
@@ -33,16 +63,41 @@ export function supportedStateAdoptionTypes(): string[] {
   return AWS_CARVE_TYPES.map((t) => t.tfType).sort();
 }
 
+/** Marker for a prop whose value is a `params.<name>` reference, not a literal. */
+class ParamRef {
+  constructor(
+    readonly name: string,
+    readonly type: "string" | "number" | "boolean",
+  ) {}
+}
+
 /**
  * Render chant source for a state-adopted resource. Emits the native
  * constructor with mapped properties, plus a reference comment listing the
  * Terraform attributes that were not mapped so nothing is silently dropped.
+ *
+ * A mapped attribute named by a `DeferredParam` renders as a `params.<name>`
+ * reference (a real chant build parameter) instead of the state literal —
+ * the value came from a survivor, so it stays overridable per build.
  */
-export function adoptFromState(resource: StateResource): AdoptedSource | null {
+export function adoptFromState(resource: StateResource, params: DeferredParam[] = []): AdoptedSource | null {
   const entry = awsCarveType(resource.type);
   if (!entry) return null;
 
   const { props, mappedKeys } = applyAwsMapper(entry, resource.attributes);
+
+  // Substitute deferred inputs: only plain (untransformed) field mappings can
+  // carry a parameter reference — a transform ran against the literal at emit
+  // time and cannot re-run at build. Everything else keeps the state literal.
+  const parameterized: string[] = [];
+  for (const param of params) {
+    const spec = entry.fields[param.tfAttr];
+    if (typeof spec !== "string" || !(spec in props)) continue;
+    const type = typeof param.default === "number" ? "number" : typeof param.default === "boolean" ? "boolean" : "string";
+    props[spec] = new ParamRef(param.name, type);
+    parameterized.push(param.name);
+  }
+
   const unmapped: Record<string, unknown> = {};
   for (const [k, v] of Object.entries(resource.attributes)) {
     if (!mappedKeys.includes(k)) unmapped[k] = v;
@@ -52,6 +107,10 @@ export function adoptFromState(resource: StateResource): AdoptedSource | null {
   L.push(`// Adopted from Terraform state: ${resource.type}.${resource.name} -> ${entry.nativeType}`);
   L.push(`// Properties mapped from Terraform attributes (CloudFormation PascalCase).`);
   L.push(`import { ${entry.ctor} } from "${AWS_LEXICON_IMPORT}";`);
+  if (parameterized.length) {
+    L.push(`// Deferred deploy-time input(s) — declared in chant.config.ts's buildParams.`);
+    L.push(`import { params } from "${PARAMS_IMPORT}";`);
+  }
   L.push("");
   L.push(`export const ${resource.name} = new ${entry.ctor}(${renderObject(props, 2)});`);
   if (Object.keys(unmapped).length) {
@@ -66,6 +125,7 @@ export function adoptFromState(resource: StateResource): AdoptedSource | null {
     content: L.join("\n") + "\n",
     mapped: Object.keys(props).length > 0,
     nativeType: entry.nativeType,
+    parameterized,
   };
 }
 
@@ -74,6 +134,13 @@ function renderObject(obj: Record<string, unknown>, indent: number): string {
   const keys = Object.keys(obj);
   if (keys.length === 0) return "{}";
   const pad = " ".repeat(indent);
-  const body = keys.map((k) => `${pad}${k}: ${JSON.stringify(obj[k])},`).join("\n");
+  const body = keys
+    .map((k) => `${pad}${k}: ${renderValue(obj[k])},`)
+    .join("\n");
   return `{\n${body}\n}`;
 }
+
+/** A prop value: a `params.<name>` reference (cast keeps the project tsc-clean) or a literal. */
+function renderValue(value: unknown): string {
+  return value instanceof ParamRef ? `params.${value.name} as ${value.type}` : JSON.stringify(value);
+}

package/src/terraform/aws-resources.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect } from "vitest";
 import { AWS_CARVE_TYPES, awsCarveType, applyAwsMapper } from "./aws-resources";
-import { TIER_MAP } from "./tier-map";
+import { TIER_MAP, FOLDS_INTO, IDENTITY_ATTR } from "./tier-map";
 import { canAdoptFromState } from "./adopt-state";
 
 describe("AWS carve-out table", () => {
@@ -21,10 +21,21 @@ describe("AWS carve-out table", () => {
       "aws_secretsmanager_secret", "aws_ssm_parameter", "aws_ecr_repository",
       "aws_vpc", "aws_subnet", "aws_security_group", "aws_route53_zone",
       "aws_cloudwatch_log_group",
+      // #998 coverage expansion: streaming, EKS, Lambda periphery, networking
+      // periphery, audit, DB groups/clusters, API stages, identity, EFS periphery.
+      "aws_kinesis_stream", "aws_eks_cluster", "aws_eks_node_group",
+      "aws_lambda_permission", "aws_lambda_event_source_mapping",
+      "aws_vpc_endpoint", "aws_route", "aws_route_table_association",
+      "aws_flow_log", "aws_cloudtrail", "aws_cloudwatch_dashboard",
+      "aws_rds_cluster", "aws_db_parameter_group", "aws_elasticache_subnet_group",
+      "aws_lb_listener_rule", "aws_api_gateway_stage", "aws_apigatewayv2_stage",
+      "aws_cognito_user_pool", "aws_appautoscaling_target",
+      "aws_efs_mount_target", "aws_efs_access_point",
+      "aws_sqs_queue_policy", "aws_sns_topic_policy",
     ]) {
       expect(types.has(t)).toBe(true);
     }
-    expect(AWS_CARVE_TYPES.length).toBeGreaterThanOrEqual(20);
+    expect(AWS_CARVE_TYPES.length).toBeGreaterThanOrEqual(60);
   });
 
   test("constructors are non-empty and consistent per native type", () => {
@@ -78,4 +89,43 @@ describe("applyAwsMapper", () => {
     expect(props).toEqual({ VpcId: "vpc-1", CidrBlock: "10.0.1.0/24" });
     expect(props).not.toHaveProperty("AvailabilityZone");
   });
+
+  test("wraps a queue policy's queue_url and parses its policy document", () => {
+    const { props } = applyAwsMapper(awsCarveType("aws_sqs_queue_policy")!, {
+      queue_url: "https://sqs.us-east-1.amazonaws.com/1/q",
+      policy: '{"Version":"2012-10-17","Statement":[]}',
+    });
+    expect(props.Queues).toEqual(["https://sqs.us-east-1.amazonaws.com/1/q"]);
+    expect(props.PolicyDocument).toEqual({ Version: "2012-10-17", Statement: [] });
+  });
+});
+
+describe("tier + identity coverage maps (#998)", () => {
+  test("kubernetes provider types rank, with _v1 aliases sharing the entry", () => {
+    expect(TIER_MAP.kubernetes_manifest).toEqual({ tier: 1, mapsTo: "k8s:manifest" });
+    for (const t of ["kubernetes_deployment", "kubernetes_config_map", "kubernetes_service", "kubernetes_namespace"]) {
+      expect(TIER_MAP[t]).toMatchObject({ tier: 2 });
+      expect(TIER_MAP[`${t}_v1`]).toEqual(TIER_MAP[t]);
+    }
+    expect(TIER_MAP.kubernetes_horizontal_pod_autoscaler_v2).toEqual(TIER_MAP.kubernetes_horizontal_pod_autoscaler);
+  });
+
+  test("S3 and ECR sub-resources fold into their parent", () => {
+    for (const t of [
+      "aws_s3_bucket_website_configuration", "aws_s3_bucket_cors_configuration", "aws_s3_bucket_logging",
+      "aws_s3_bucket_ownership_controls", "aws_s3_bucket_notification",
+    ]) {
+      expect(FOLDS_INTO[t]).toBe("aws_s3_bucket");
+    }
+    expect(FOLDS_INTO.aws_ecr_lifecycle_policy).toBe("aws_ecr_repository");
+    expect(FOLDS_INTO.aws_ecr_repository_policy).toBe("aws_ecr_repository");
+  });
+
+  test("identity attrs cover the expanded types, including a dotted non-AWS path", () => {
+    expect(IDENTITY_ATTR.aws_elasticache_cluster).toBe("cluster_id");
+    expect(IDENTITY_ATTR.aws_ecs_task_definition).toBe("family");
+    expect(IDENTITY_ATTR.aws_route53_record).toBe("name");
+    expect(IDENTITY_ATTR.aws_eks_node_group).toBe("node_group_name");
+    expect(IDENTITY_ATTR.kubernetes_manifest).toBe("manifest.metadata.name");
+  });
 });