@intentius/chant 0.42.1 → 0.44.2

package/src/observation.test.ts

@@ -29,7 +29,7 @@ const meta = (over: Partial<ResourceMetadata> = {}): ResourceMetadata => ({
 
 describe("normalizeObservation", () => {
   test("a bare map means 'I looked at everything'", () => {
-    expect(normalizeObservation({ a: meta() })).toEqual({ resources: { a: meta() }, unobserved: {} });
+    expect(normalizeObservation({ a: meta() })).toEqual({ resources: { a: meta() }, unobserved: {}, queried: {} });
   });
 
   test("the envelope carries both halves", () => {
@@ -37,11 +37,27 @@ describe("normalizeObservation", () => {
     expect(normalizeObservation(value)).toEqual({
       resources: { a: meta() },
       unobserved: { b: { reason: "read-failed" } },
+      queried: {},
     });
   });
 
-  test("undefined normalizes to two empty maps", () => {
-    expect(normalizeObservation(undefined)).toEqual({ resources: {}, unobserved: {} });
+  test("undefined normalizes to empty maps", () => {
+    expect(normalizeObservation(undefined)).toEqual({ resources: {}, unobserved: {}, queried: {} });
+  });
+
+  test("the envelope carries the queried addresses through normalization (#1620)", () => {
+    const value = observation({}, {}, { web: "/apis/apps/v1/namespaces/default/deployments/web" });
+    expect(normalizeObservation(value).queried).toEqual({
+      web: "/apis/apps/v1/namespaces/default/deployments/web",
+    });
+    // Additive metadata only: an entity in `queried` and neither map is still
+    // OBSERVED-ABSENT — the tri-state does not shift.
+    expect(normalizeObservation(value).resources).toEqual({});
+    expect(normalizeObservation(value).unobserved).toEqual({});
+  });
+
+  test("the envelope omits an empty queried map (#1620)", () => {
+    expect(observation({ a: meta() }, {}, {})).toEqual({ observation: "v1", resources: { a: meta() } });
   });
 
   test("an entity literally named `observation` cannot be mistaken for the envelope", () => {
@@ -68,8 +84,8 @@ describe("unobservedAll", () => {
 describe("mergeObservations (multi-stack)", () => {
   test("present beats not-observed beats absent", () => {
     const merged = mergeObservations([
-      { resources: {}, unobserved: { a: { reason: "read-failed" }, b: { reason: "no-binding" } } },
-      { resources: { a: meta() }, unobserved: {} },
+      { resources: {}, unobserved: { a: { reason: "read-failed" }, b: { reason: "no-binding" } }, queried: {} },
+      { resources: { a: meta() }, unobserved: {}, queried: {} },
     ]);
     expect(Object.keys(merged.resources)).toEqual(["a"]);
     expect(Object.keys(merged.unobserved)).toEqual(["b"]);
@@ -77,11 +93,19 @@ describe("mergeObservations (multi-stack)", () => {
 
   test("an entity nobody looked for in any stack stays absent", () => {
     const merged = mergeObservations([
-      { resources: { a: meta() }, unobserved: {} },
-      { resources: { b: meta() }, unobserved: {} },
+      { resources: { a: meta() }, unobserved: {}, queried: {} },
+      { resources: { b: meta() }, unobserved: {}, queried: {} },
     ]);
     expect(merged.unobserved).toEqual({});
   });
+
+  test("queried addresses union across stacks (#1620)", () => {
+    const merged = mergeObservations([
+      { resources: {}, unobserved: {}, queried: { a: "stack-1/a" } },
+      { resources: { b: meta() }, unobserved: {}, queried: { b: "stack-2/b" } },
+    ]);
+    expect(merged.queried).toEqual({ a: "stack-1/a", b: "stack-2/b" });
+  });
 });
 
 describe("reason totality", () => {
@@ -98,6 +122,12 @@ describe("reason totality", () => {
       formatUnobserved("widget", { type: "K8s::X::Widget", reason: "unsupported-kind", detail: "no mapping" }),
     ).toBe("widget (K8s::X::Widget) — no reader for this resource kind: no mapping");
   });
+
+  test("formatUnobserved appends the queried address when the entry carries one (#1620)", () => {
+    expect(
+      formatUnobserved("web", { reason: "read-failed", detail: "HTTP 500", queried: "/apis/apps/v1/namespaces/default/deployments/web" }),
+    ).toBe("web — read failed: HTTP 500 [queried /apis/apps/v1/namespaces/default/deployments/web]");
+  });
 });
 
 describe("boundedConcurrently", () => {
@@ -163,6 +193,23 @@ describe("observeEntities harness (#1201)", () => {
     });
   });
 
+  test("collects the queried address from every variant — the absent one especially (#1620)", async () => {
+    const result = await observeEntities(
+      [entity("a"), entity("b"), entity("c")],
+      adapterOf({
+        a: { present: meta(), queried: "region-1/a" },
+        b: { absent: true, queried: "region-1/b" },
+        c: { unobserved: { reason: "read-failed", detail: "boom" }, queried: "region-1/c" },
+      }),
+    );
+    // The absent entity stays in neither map — additive metadata, tri-state unshifted.
+    expect(Object.keys(result.resources)).toEqual(["a"]);
+    expect(Object.keys(result.unobserved ?? {})).toEqual(["c"]);
+    expect(result.queried).toEqual({ a: "region-1/a", b: "region-1/b", c: "region-1/c" });
+    // The unobserved entry carries its own copy, so a row renders without a join.
+    expect(result.unobserved?.c.queried).toBe("region-1/c");
+  });
+
   test("a bind failure marks every entity NOT-OBSERVED with the typed reason and declared type", async () => {
     const result = await observeEntities(
       [entity("a", "AWS::S3::Bucket"), entity("b", "AWS::S3::Bucket")],

package/src/observation.ts

@@ -79,6 +79,14 @@ export interface UnobservedEntity {
   reason: UnobservedReason;
   /** Human-readable detail: the command that failed, the missing binding key, the unsupported kind. */
   detail?: string;
+  /**
+   * The resolved address the read was issued against (#1620) — for k8s the
+   * request path (`/apis/apps/v1/namespaces/default/deployments/web`), for
+   * other substrates whatever names the endpoint/region/account actually
+   * asked. Optional and purely diagnostic: it never changes the verdict, it
+   * lets a consumer tell "looked in the wrong place" from "not there".
+   */
+  queried?: string;
 }
 
 /**
@@ -92,6 +100,18 @@ export interface ObservationResult {
   resources: Record<string, ResourceMetadata>;
   /** NOT-OBSERVED, keyed by chant entity name. Omit or leave empty when everything asked about was looked at. */
   unobserved?: Record<string, UnobservedEntity>;
+  /**
+   * The resolved query address per declared entity (#1620), keyed by chant
+   * entity name — what was actually asked of the provider, whatever the
+   * verdict came back as. Additive metadata over the tri-state, never part of
+   * it: classification still reads only `resources` and `unobserved`, and an
+   * entity in neither map is still OBSERVED-ABSENT whether or not it appears
+   * here. This map is the only place an ABSENT entity can carry its address —
+   * absence is spelled "in neither map", so there is no row to hang it on —
+   * which is exactly the entry that lets a consumer see that a defaulted
+   * namespace, endpoint or region was read, not the one the resource lives in.
+   */
+  queried?: Record<string, string>;
 }
 
 /**
@@ -100,10 +120,12 @@ export interface ObservationResult {
  */
 export type DescribeResourcesResult = Record<string, ResourceMetadata> | ObservationResult;
 
-/** Normalized form every consumer works with. Both maps always present. */
+/** Normalized form every consumer works with. All maps always present. */
 export interface NormalizedObservation {
   resources: Record<string, ResourceMetadata>;
   unobserved: Record<string, UnobservedEntity>;
+  /** Resolved query address per entity name (#1620). Empty when the lexicon reported none. */
+  queried: Record<string, string>;
 }
 
 /** True when `value` is the versioned {@link ObservationResult} envelope. */
@@ -122,11 +144,13 @@ export function isObservationResult(value: unknown): value is ObservationResult
 export function observation(
   resources: Record<string, ResourceMetadata>,
   unobserved?: Record<string, UnobservedEntity>,
+  queried?: Record<string, string>,
 ): ObservationResult {
   return {
     observation: "v1",
     resources,
     ...(unobserved && Object.keys(unobserved).length > 0 ? { unobserved } : {}),
+    ...(queried && Object.keys(queried).length > 0 ? { queried } : {}),
   };
 }
 
@@ -137,11 +161,11 @@ export function observation(
  * {@link unobservedAll} rather than returning nothing.
  */
 export function normalizeObservation(value: DescribeResourcesResult | undefined): NormalizedObservation {
-  if (!value) return { resources: {}, unobserved: {} };
+  if (!value) return { resources: {}, unobserved: {}, queried: {} };
   if (isObservationResult(value)) {
-    return { resources: value.resources ?? {}, unobserved: value.unobserved ?? {} };
+    return { resources: value.resources ?? {}, unobserved: value.unobserved ?? {}, queried: value.queried ?? {} };
   }
-  return { resources: value, unobserved: {} };
+  return { resources: value, unobserved: {}, queried: {} };
 }
 
 /**
@@ -180,14 +204,16 @@ export function unobservedAll(
 export function mergeObservations(parts: Iterable<NormalizedObservation>): NormalizedObservation {
   const resources: Record<string, ResourceMetadata> = {};
   const unobserved: Record<string, UnobservedEntity> = {};
+  const queried: Record<string, string> = {};
   for (const part of parts) {
     Object.assign(resources, part.resources);
     Object.assign(unobserved, part.unobserved);
+    Object.assign(queried, part.queried);
   }
   // Present wins: a stack that could not be read does not un-observe a resource
   // another stack returned.
   for (const name of Object.keys(resources)) delete unobserved[name];
-  return { resources, unobserved };
+  return { resources, unobserved, queried };
 }
 
 /** One-line human phrasing of a reason, for CLI output. */
@@ -206,10 +232,11 @@ export function unobservedReasonText(reason: UnobservedReason): string {
   }
 }
 
-/** `name — reason (detail)`, the shared rendering for CLI and plan output. */
+/** `name — reason (detail) [queried address]`, the shared rendering for CLI and plan output. */
 export function formatUnobserved(name: string, entry: UnobservedEntity): string {
   const base = `${name}${entry.type ? ` (${entry.type})` : ""} — ${unobservedReasonText(entry.reason)}`;
-  return entry.detail ? `${base}: ${entry.detail}` : base;
+  const detailed = entry.detail ? `${base}: ${entry.detail}` : base;
+  return entry.queried ? `${detailed} [queried ${entry.queried}]` : detailed;
 }
 
 /* ------------------------------------------------------------------------- *
@@ -246,11 +273,16 @@ export interface DeclaredEntity {
  * - `present` — a key in `resources`.
  * - `absent` — in neither map (the provider was asked and reported it missing).
  * - `unobserved` — a typed NOT-OBSERVED (unsupported kind, filtered, read error).
+ *
+ * Every variant may carry `queried` (#1620): the resolved address the read was
+ * issued against. The harness collects it into the result's `queried` map (and
+ * onto the unobserved entry), so even an absent verdict — which records
+ * nothing else — says where the provider was asked.
  */
 export type EntityObservation =
-  | { present: ResourceMetadata }
-  | { absent: true }
-  | { unobserved: { reason: UnobservedReason; detail?: string } };
+  | { present: ResourceMetadata; queried?: string }
+  | { absent: true; queried?: string }
+  | { unobserved: { reason: UnobservedReason; detail?: string }; queried?: string };
 
 /** What a lexicon supplies to drive the harness. `Client` is its transport handle. */
 export interface ObserverAdapter<Client> {
@@ -338,6 +370,7 @@ export async function observeEntities<Client>(
 
   const resources: Record<string, ResourceMetadata> = {};
   const unobserved: Record<string, UnobservedEntity> = {};
+  const queried: Record<string, string> = {};
   const run = adapter.concurrently ?? ((items, fn) => boundedConcurrently(items, fn));
 
   await run(declared, async (entity) => {
@@ -352,13 +385,20 @@ export async function observeEntities<Client>(
         },
       };
     }
+    if (result.queried) queried[entity.name] = result.queried;
     if ("present" in result) {
       resources[entity.name] = result.present;
     } else if ("unobserved" in result) {
-      unobserved[entity.name] = { type: entity.type, ...result.unobserved };
+      unobserved[entity.name] = {
+        type: entity.type,
+        ...result.unobserved,
+        ...(result.queried ? { queried: result.queried } : {}),
+      };
     }
-    // `absent`: record nothing — in neither map is how the contract spells absence.
+    // `absent`: the verdict records nothing — in neither map is how the
+    // contract spells absence — but its address, when the adapter supplied
+    // one, lands in `queried` (#1620) so the absence can explain itself.
   });
 
-  return observation(resources, unobserved);
+  return observation(resources, unobserved, queried);
 }

package/src/reconcile.ts

@@ -7,7 +7,7 @@
  * the plan renderer, and the guardrail framework (rename resolution + a removal
  * cap + a pluggable check runner).
  *
- * A "warden" (e.g. github-warden) builds its provider-specific resource diffing,
+ * A consumer application (e.g. github-warden) builds its provider-specific resource diffing,
  * live-state types, and domain guardrails on top of this, and drives them with
  * the generic `runReconcile` loop + `Cycle` interface (below). It complements
  * chant's `ownership.ts` marker contract: ownership markers make a `delete`
@@ -41,7 +41,7 @@ export interface ChangeSetEntry {
   /** High-level resource category (e.g. "team", "member", "branch-protection"). */
   resourceType: string;
   /**
-   * Cross-provider governance category (#790). `resourceType` stays the
+   * Cross-provider governance category. `resourceType` stays the
    * provider-specific display string; the verb is the shared grammar SCM and
    * cloud plans group by. Stamped by `runReconcile` from the cycle's `verb`.
    */
@@ -221,7 +221,7 @@ export function renderChangeSet(cs: ChangeSet): string {
   for (const kind of ORDER) {
     let group = byKind[kind];
     if (group.length === 0) continue;
-    // Verb-aware grouping (#790): when entries carry governance verbs, order
+    // Verb-aware grouping: when entries carry governance verbs, order
     // each section by verb (vocabulary order, unverbed entries last) so mixed
     // plans read category-by-category. Stable, and line format is unchanged —
     // a verbless change set renders exactly as before.
@@ -417,8 +417,8 @@ export interface Cycle<TClient, TConfig, TLive, TScope = unknown> {
   /** Human-readable name, e.g. "branch-protection". */
   name: string;
   /**
-   * Cross-provider governance category this cycle reconciles (#790). Every
-   * SCM warden cycle stamps one; cloud cycles (epic #787 C2) must. Optional
+   * Cross-provider governance category this cycle reconciles. Every
+   * SCM reconciler cycles stamp one; cloud cycles must. Optional
    * only so provider-external Cycle implementations don't break.
    */
   verb?: GovernanceVerb;
@@ -436,7 +436,7 @@ export interface Cycle<TClient, TConfig, TLive, TScope = unknown> {
 /** Per-cycle outcome recorded in the run result. */
 export interface CycleResult {
   name: string;
-  /** The cycle's governance verb (#790), when it stamps one. */
+  /** The cycle's governance verb, when it stamps one. */
   verb?: GovernanceVerb;
   /** Scope id this result is for (e.g. an org login). */
   org: string;
@@ -560,7 +560,7 @@ export async function runReconcile<TClient, TConfig, TLive, TScope = unknown>(
       }
 
       const changeSet = diffFn(scopeId, desired, live, diffOptions);
-      // Stamp the cycle's governance verb (#790) onto entries that don't
+      // Stamp the cycle's governance verb onto entries that don't
       // carry one, so provider diffs stay verb-unaware.
       if (cycle.verb) {
         for (const e of changeSet.entries) e.verb ??= cycle.verb;

package/src/terraform/aws-resources.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect } from "vitest";
 import { AWS_CARVE_TYPES, awsCarveType, applyAwsMapper } from "./aws-resources";
-import { TIER_MAP } from "./tier-map";
+import { TIER_MAP, FOLDS_INTO, IDENTITY_ATTR } from "./tier-map";
 import { canAdoptFromState } from "./adopt-state";
 
 describe("AWS carve-out table", () => {
@@ -21,10 +21,21 @@ describe("AWS carve-out table", () => {
       "aws_secretsmanager_secret", "aws_ssm_parameter", "aws_ecr_repository",
       "aws_vpc", "aws_subnet", "aws_security_group", "aws_route53_zone",
       "aws_cloudwatch_log_group",
+      // #998 coverage expansion: streaming, EKS, Lambda periphery, networking
+      // periphery, audit, DB groups/clusters, API stages, identity, EFS periphery.
+      "aws_kinesis_stream", "aws_eks_cluster", "aws_eks_node_group",
+      "aws_lambda_permission", "aws_lambda_event_source_mapping",
+      "aws_vpc_endpoint", "aws_route", "aws_route_table_association",
+      "aws_flow_log", "aws_cloudtrail", "aws_cloudwatch_dashboard",
+      "aws_rds_cluster", "aws_db_parameter_group", "aws_elasticache_subnet_group",
+      "aws_lb_listener_rule", "aws_api_gateway_stage", "aws_apigatewayv2_stage",
+      "aws_cognito_user_pool", "aws_appautoscaling_target",
+      "aws_efs_mount_target", "aws_efs_access_point",
+      "aws_sqs_queue_policy", "aws_sns_topic_policy",
     ]) {
       expect(types.has(t)).toBe(true);
     }
-    expect(AWS_CARVE_TYPES.length).toBeGreaterThanOrEqual(20);
+    expect(AWS_CARVE_TYPES.length).toBeGreaterThanOrEqual(60);
   });
 
   test("constructors are non-empty and consistent per native type", () => {
@@ -78,4 +89,43 @@ describe("applyAwsMapper", () => {
     expect(props).toEqual({ VpcId: "vpc-1", CidrBlock: "10.0.1.0/24" });
     expect(props).not.toHaveProperty("AvailabilityZone");
   });
+
+  test("wraps a queue policy's queue_url and parses its policy document", () => {
+    const { props } = applyAwsMapper(awsCarveType("aws_sqs_queue_policy")!, {
+      queue_url: "https://sqs.us-east-1.amazonaws.com/1/q",
+      policy: '{"Version":"2012-10-17","Statement":[]}',
+    });
+    expect(props.Queues).toEqual(["https://sqs.us-east-1.amazonaws.com/1/q"]);
+    expect(props.PolicyDocument).toEqual({ Version: "2012-10-17", Statement: [] });
+  });
+});
+
+describe("tier + identity coverage maps (#998)", () => {
+  test("kubernetes provider types rank, with _v1 aliases sharing the entry", () => {
+    expect(TIER_MAP.kubernetes_manifest).toEqual({ tier: 1, mapsTo: "k8s:manifest" });
+    for (const t of ["kubernetes_deployment", "kubernetes_config_map", "kubernetes_service", "kubernetes_namespace"]) {
+      expect(TIER_MAP[t]).toMatchObject({ tier: 2 });
+      expect(TIER_MAP[`${t}_v1`]).toEqual(TIER_MAP[t]);
+    }
+    expect(TIER_MAP.kubernetes_horizontal_pod_autoscaler_v2).toEqual(TIER_MAP.kubernetes_horizontal_pod_autoscaler);
+  });
+
+  test("S3 and ECR sub-resources fold into their parent", () => {
+    for (const t of [
+      "aws_s3_bucket_website_configuration", "aws_s3_bucket_cors_configuration", "aws_s3_bucket_logging",
+      "aws_s3_bucket_ownership_controls", "aws_s3_bucket_notification",
+    ]) {
+      expect(FOLDS_INTO[t]).toBe("aws_s3_bucket");
+    }
+    expect(FOLDS_INTO.aws_ecr_lifecycle_policy).toBe("aws_ecr_repository");
+    expect(FOLDS_INTO.aws_ecr_repository_policy).toBe("aws_ecr_repository");
+  });
+
+  test("identity attrs cover the expanded types, including a dotted non-AWS path", () => {
+    expect(IDENTITY_ATTR.aws_elasticache_cluster).toBe("cluster_id");
+    expect(IDENTITY_ATTR.aws_ecs_task_definition).toBe("family");
+    expect(IDENTITY_ATTR.aws_route53_record).toBe("name");
+    expect(IDENTITY_ATTR.aws_eks_node_group).toBe("node_group_name");
+    expect(IDENTITY_ATTR.kubernetes_manifest).toBe("manifest.metadata.name");
+  });
 });

package/src/terraform/aws-resources.ts

@@ -120,7 +120,7 @@ export const AWS_CARVE_TYPES: AwsCarveType[] = [
     fields: { name: "AutoScalingGroupName", min_size: "MinSize", max_size: "MaxSize", desired_capacity: "DesiredCapacity", vpc_zone_identifier: "VPCZoneIdentifier", health_check_type: "HealthCheckType" } },
   { tfType: "aws_ecs_cluster", tier: 1, nativeType: "AWS::ECS::Cluster", ctor: "EcsCluster", identityAttr: "name",
     fields: { name: "ClusterName" }, tags: true },
-  { tfType: "aws_ecs_task_definition", tier: 3, nativeType: "AWS::ECS::TaskDefinition", ctor: "TaskDefinition",
+  { tfType: "aws_ecs_task_definition", tier: 3, nativeType: "AWS::ECS::TaskDefinition", ctor: "TaskDefinition", identityAttr: "family",
     fields: { family: "Family", cpu: "Cpu", memory: "Memory", network_mode: "NetworkMode", execution_role_arn: "ExecutionRoleArn", task_role_arn: "TaskRoleArn" }, tags: true },
   { tfType: "aws_ebs_volume", tier: 1, nativeType: "AWS::EC2::Volume", ctor: "EC2Volume",
     fields: { availability_zone: "AvailabilityZone", size: "Size", type: "VolumeType", encrypted: "Encrypted", iops: "Iops" }, tags: true },
@@ -140,13 +140,13 @@ export const AWS_CARVE_TYPES: AwsCarveType[] = [
     fields: { identifier: "DBInstanceIdentifier", engine: "Engine", engine_version: "EngineVersion", instance_class: "DBInstanceClass", allocated_storage: "AllocatedStorage", db_name: "DBName", multi_az: "MultiAZ", storage_encrypted: "StorageEncrypted" }, tags: true },
   { tfType: "aws_db_subnet_group", tier: 1, nativeType: "AWS::RDS::DBSubnetGroup", ctor: "RDSDBSubnetGroup", identityAttr: "name",
     fields: { name: "DBSubnetGroupName", description: "DBSubnetGroupDescription", subnet_ids: "SubnetIds" }, tags: true },
-  { tfType: "aws_elasticache_cluster", tier: 2, nativeType: "AWS::ElastiCache::CacheCluster", ctor: "CacheCluster",
-    fields: { engine: "Engine", node_type: "CacheNodeType", num_cache_nodes: "NumCacheNodes", engine_version: "EngineVersion" }, tags: true },
+  { tfType: "aws_elasticache_cluster", tier: 2, nativeType: "AWS::ElastiCache::CacheCluster", ctor: "CacheCluster", identityAttr: "cluster_id",
+    fields: { cluster_id: "ClusterName", engine: "Engine", node_type: "CacheNodeType", num_cache_nodes: "NumCacheNodes", engine_version: "EngineVersion" }, tags: true },
   { tfType: "aws_elasticache_replication_group", tier: 2, nativeType: "AWS::ElastiCache::ReplicationGroup", ctor: "ReplicationGroup", identityAttr: "replication_group_id",
     fields: { replication_group_id: "ReplicationGroupId", description: "ReplicationGroupDescription", node_type: "CacheNodeType", engine: "Engine" }, tags: true },
 
   // ── DNS, CDN & API ──
-  { tfType: "aws_route53_record", tier: 2, nativeType: "AWS::Route53::RecordSet", ctor: "RecordSet",
+  { tfType: "aws_route53_record", tier: 2, nativeType: "AWS::Route53::RecordSet", ctor: "RecordSet", identityAttr: "name",
     fields: { name: "Name", type: "Type", ttl: "TTL", zone_id: "HostedZoneId", records: "ResourceRecords" } },
   { tfType: "aws_api_gateway_rest_api", tier: 2, nativeType: "AWS::ApiGateway::RestApi", ctor: "RestApi", identityAttr: "name",
     fields: { name: "Name", description: "Description" }, tags: true },
@@ -168,6 +168,97 @@ export const AWS_CARVE_TYPES: AwsCarveType[] = [
     fields: { protocol: "Protocol", endpoint: "Endpoint", topic_arn: "TopicArn" } },
   { tfType: "aws_sfn_state_machine", tier: 3, nativeType: "AWS::StepFunctions::StateMachine", ctor: "StateMachine", identityAttr: "name",
     fields: { name: "StateMachineName", role_arn: "RoleArn", type: "StateMachineType" }, tags: true },
+  { tfType: "aws_sqs_queue_policy", tier: 2, nativeType: "AWS::SQS::QueuePolicy", ctor: "QueuePolicy",
+    fields: { policy: json("PolicyDocument"), queue_url: { prop: "Queues", transform: (v) => (v === undefined ? v : [v]) } } },
+  { tfType: "aws_sns_topic_policy", tier: 2, nativeType: "AWS::SNS::TopicPolicy", ctor: "TopicPolicy",
+    fields: { policy: json("PolicyDocument"), arn: { prop: "Topics", transform: (v) => (v === undefined ? v : [v]) } } },
+
+  // ── Streaming ──
+  { tfType: "aws_kinesis_stream", tier: 1, nativeType: "AWS::Kinesis::Stream", ctor: "KinesisStream", identityAttr: "name",
+    fields: { name: "Name", shard_count: "ShardCount", retention_period: "RetentionPeriodHours" }, tags: true },
+  { tfType: "aws_kinesis_firehose_delivery_stream", tier: 3, nativeType: "AWS::KinesisFirehose::DeliveryStream", ctor: "DeliveryStream", identityAttr: "name",
+    fields: { name: "DeliveryStreamName" }, tags: true },
+
+  // ── EKS ──
+  { tfType: "aws_eks_cluster", tier: 2, nativeType: "AWS::EKS::Cluster", ctor: "EKSCluster", identityAttr: "name",
+    fields: { name: "Name", role_arn: "RoleArn", version: "Version" }, tags: true },
+  { tfType: "aws_eks_node_group", tier: 2, nativeType: "AWS::EKS::Nodegroup", ctor: "Nodegroup", identityAttr: "node_group_name",
+    fields: { cluster_name: "ClusterName", node_group_name: "NodegroupName", node_role_arn: "NodeRole", subnet_ids: "Subnets",
+      instance_types: "InstanceTypes", ami_type: "AmiType", capacity_type: "CapacityType", disk_size: "DiskSize" } },
+
+  // ── Lambda periphery ──
+  { tfType: "aws_lambda_permission", tier: 1, nativeType: "AWS::Lambda::Permission", ctor: "Permission",
+    fields: { action: "Action", function_name: "FunctionName", principal: "Principal", source_arn: "SourceArn", source_account: "SourceAccount" } },
+  { tfType: "aws_lambda_event_source_mapping", tier: 2, nativeType: "AWS::Lambda::EventSourceMapping", ctor: "EventSourceMapping",
+    fields: { event_source_arn: "EventSourceArn", function_name: "FunctionName", batch_size: "BatchSize", enabled: "Enabled",
+      starting_position: "StartingPosition", maximum_batching_window_in_seconds: "MaximumBatchingWindowInSeconds" } },
+  { tfType: "aws_lambda_alias", tier: 1, nativeType: "AWS::Lambda::Alias", ctor: "LambdaAlias", identityAttr: "name",
+    fields: { name: "Name", function_name: "FunctionName", function_version: "FunctionVersion", description: "Description" } },
+  { tfType: "aws_lambda_layer_version", tier: 2, nativeType: "AWS::Lambda::LayerVersion", ctor: "LayerVersion", identityAttr: "layer_name",
+    fields: { layer_name: "LayerName", description: "Description", compatible_runtimes: "CompatibleRuntimes",
+      compatible_architectures: "CompatibleArchitectures", license_info: "LicenseInfo" } },
+
+  // ── Networking (endpoints, routes, peering, flow logs) ──
+  { tfType: "aws_vpc_endpoint", tier: 2, nativeType: "AWS::EC2::VPCEndpoint", ctor: "VPCEndpoint",
+    fields: { vpc_id: "VpcId", service_name: "ServiceName", vpc_endpoint_type: "VpcEndpointType", route_table_ids: "RouteTableIds",
+      subnet_ids: "SubnetIds", security_group_ids: "SecurityGroupIds", private_dns_enabled: "PrivateDnsEnabled", policy: json("PolicyDocument") }, tags: true },
+  { tfType: "aws_route_table_association", tier: 2, nativeType: "AWS::EC2::SubnetRouteTableAssociation", ctor: "SubnetRouteTableAssociation",
+    fields: { subnet_id: "SubnetId", route_table_id: "RouteTableId" } },
+  { tfType: "aws_route", tier: 2, nativeType: "AWS::EC2::Route", ctor: "EC2Route",
+    fields: { route_table_id: "RouteTableId", destination_cidr_block: "DestinationCidrBlock", destination_ipv6_cidr_block: "DestinationIpv6CidrBlock",
+      gateway_id: "GatewayId", nat_gateway_id: "NatGatewayId", transit_gateway_id: "TransitGatewayId",
+      vpc_peering_connection_id: "VpcPeeringConnectionId", network_interface_id: "NetworkInterfaceId" } },
+  { tfType: "aws_egress_only_internet_gateway", tier: 1, nativeType: "AWS::EC2::EgressOnlyInternetGateway", ctor: "EgressOnlyInternetGateway",
+    fields: { vpc_id: "VpcId" } },
+  { tfType: "aws_vpc_peering_connection", tier: 2, nativeType: "AWS::EC2::VPCPeeringConnection", ctor: "VPCPeeringConnection",
+    fields: { vpc_id: "VpcId", peer_vpc_id: "PeerVpcId", peer_owner_id: "PeerOwnerId", peer_region: "PeerRegion" }, tags: true },
+  { tfType: "aws_flow_log", tier: 2, nativeType: "AWS::EC2::FlowLog", ctor: "FlowLog",
+    fields: { traffic_type: "TrafficType", log_destination: "LogDestination", log_destination_type: "LogDestinationType",
+      iam_role_arn: "DeliverLogsPermissionArn", log_group_name: "LogGroupName", max_aggregation_interval: "MaxAggregationInterval" }, tags: true },
+  { tfType: "aws_key_pair", tier: 1, nativeType: "AWS::EC2::KeyPair", ctor: "KeyPair", identityAttr: "key_name",
+    fields: { key_name: "KeyName", public_key: "PublicKeyMaterial" }, tags: true },
+
+  // ── Audit & observability ──
+  { tfType: "aws_cloudtrail", tier: 2, nativeType: "AWS::CloudTrail::Trail", ctor: "Trail", identityAttr: "name",
+    fields: { name: "TrailName", s3_bucket_name: "S3BucketName", s3_key_prefix: "S3KeyPrefix",
+      include_global_service_events: "IncludeGlobalServiceEvents", is_multi_region_trail: "IsMultiRegionTrail",
+      enable_logging: "IsLogging", enable_log_file_validation: "EnableLogFileValidation", kms_key_id: "KMSKeyId",
+      sns_topic_name: "SnsTopicName", cloud_watch_logs_group_arn: "CloudWatchLogsLogGroupArn", cloud_watch_logs_role_arn: "CloudWatchLogsRoleArn" }, tags: true },
+  { tfType: "aws_cloudwatch_dashboard", tier: 1, nativeType: "AWS::CloudWatch::Dashboard", ctor: "CwDashboard", identityAttr: "dashboard_name",
+    fields: { dashboard_name: "DashboardName", dashboard_body: "DashboardBody" } },
+
+  // ── Databases & cache (groups, clusters) ──
+  { tfType: "aws_elasticache_subnet_group", tier: 1, nativeType: "AWS::ElastiCache::SubnetGroup", ctor: "EcSubnetGroup", identityAttr: "name",
+    fields: { name: "CacheSubnetGroupName", description: "Description", subnet_ids: "SubnetIds" }, tags: true },
+  { tfType: "aws_db_parameter_group", tier: 2, nativeType: "AWS::RDS::DBParameterGroup", ctor: "RDSDBParameterGroup", identityAttr: "name",
+    fields: { name: "DBParameterGroupName", family: "Family", description: "Description" }, tags: true },
+  { tfType: "aws_rds_cluster", tier: 2, nativeType: "AWS::RDS::DBCluster", ctor: "DbCluster", identityAttr: "cluster_identifier",
+    fields: { cluster_identifier: "DBClusterIdentifier", engine: "Engine", engine_version: "EngineVersion", database_name: "DatabaseName",
+      master_username: "MasterUsername", backup_retention_period: "BackupRetentionPeriod", preferred_backup_window: "PreferredBackupWindow",
+      storage_encrypted: "StorageEncrypted", kms_key_id: "KmsKeyId", port: "Port" }, tags: true },
+
+  // ── Load balancing & API stages ──
+  { tfType: "aws_lb_listener_rule", tier: 3, nativeType: "AWS::ElasticLoadBalancingV2::ListenerRule", ctor: "ListenerRule",
+    fields: { listener_arn: "ListenerArn", priority: "Priority" } },
+  { tfType: "aws_api_gateway_stage", tier: 2, nativeType: "AWS::ApiGateway::Stage", ctor: "ApigwStage", identityAttr: "stage_name",
+    fields: { rest_api_id: "RestApiId", stage_name: "StageName", deployment_id: "DeploymentId", description: "Description" }, tags: true },
+  { tfType: "aws_api_gateway_deployment", tier: 2, nativeType: "AWS::ApiGateway::Deployment", ctor: "ApigwDeployment",
+    fields: { rest_api_id: "RestApiId", description: "Description" } },
+  { tfType: "aws_apigatewayv2_stage", tier: 2, nativeType: "AWS::ApiGatewayV2::Stage", ctor: "Apigwv2Stage", identityAttr: "name",
+    fields: { api_id: "ApiId", name: "StageName", auto_deploy: "AutoDeploy", description: "Description" } },
+
+  // ── Identity & scaling ──
+  { tfType: "aws_cognito_user_pool", tier: 3, nativeType: "AWS::Cognito::UserPool", ctor: "UserPool", identityAttr: "name",
+    fields: { name: "UserPoolName", mfa_configuration: "MfaConfiguration", deletion_protection: "DeletionProtection" } },
+  { tfType: "aws_appautoscaling_target", tier: 2, nativeType: "AWS::ApplicationAutoScaling::ScalableTarget", ctor: "ScalableTarget",
+    fields: { max_capacity: "MaxCapacity", min_capacity: "MinCapacity", resource_id: "ResourceId",
+      scalable_dimension: "ScalableDimension", service_namespace: "ServiceNamespace", role_arn: "RoleARN" } },
+
+  // ── EFS periphery ──
+  { tfType: "aws_efs_mount_target", tier: 1, nativeType: "AWS::EFS::MountTarget", ctor: "EFSMountTarget",
+    fields: { file_system_id: "FileSystemId", subnet_id: "SubnetId", ip_address: "IpAddress", security_groups: "SecurityGroups" } },
+  { tfType: "aws_efs_access_point", tier: 2, nativeType: "AWS::EFS::AccessPoint", ctor: "EFSAccessPoint",
+    fields: { file_system_id: "FileSystemId" } },
 ];
 
 const BY_TYPE = new Map(AWS_CARVE_TYPES.map((t) => [t.tfType, t]));

package/src/terraform/graph.test.ts

@@ -140,6 +140,23 @@ describe("buildGraph", () => {
     expect(g.edges).toEqual([]);
   });
 
+  test("a dotted identity attr resolves through nested blocks (#998)", () => {
+    const tree: Hcl2JsonTree = {
+      resource: {
+        kubernetes_manifest: {
+          app_config: [{ manifest: { apiVersion: "v1", kind: "ConfigMap", metadata: { name: "app-config", namespace: "web" } } }],
+          templated: [{ manifest: { apiVersion: "v1", kind: "ConfigMap", metadata: { name: "${var.name}" } } }],
+        },
+        aws_s3_bucket: { assets: [{ bucket: "myapp-assets-prod" }] },
+      },
+    };
+    const g = buildFixtureGraph(tree);
+    const byAddr = Object.fromEntries(g.nodes.map((n) => [n.address, n]));
+    expect(byAddr["kubernetes_manifest.app_config"].identity).toBe("app-config");
+    expect(byAddr["kubernetes_manifest.templated"].identity).toBeUndefined(); // interpolated
+    expect(byAddr["aws_s3_bucket.assets"].identity).toBe("myapp-assets-prod"); // flat attr unaffected
+  });
+
   test("var / local references are not edges", () => {
     const tree: Hcl2JsonTree = {
       resource: {

package/src/terraform/graph.ts

@@ -140,11 +140,21 @@ function blockHasMeta(block: unknown, key: string): boolean {
   return !!block && typeof block === "object" && key in (block as Record<string, unknown>);
 }
 
-/** The resource's physical name, if its identity attribute is a plain literal (not interpolated). */
+/**
+ * The resource's physical name, if its identity attribute is a plain literal
+ * (not interpolated). A dotted `IDENTITY_ATTR` entry walks nested blocks —
+ * hcl2json renders a nested block as a one-element array, so arrays step
+ * through their first element (`manifest.metadata.name`).
+ */
 function literalIdentity(block: unknown, type: string): string | undefined {
   const attr = IDENTITY_ATTR[type];
   if (!attr || !block || typeof block !== "object") return undefined;
-  const value = (block as Record<string, unknown>)[attr];
+  let value: unknown = block;
+  for (const segment of attr.split(".")) {
+    if (Array.isArray(value)) value = value[0];
+    if (!value || typeof value !== "object") return undefined;
+    value = (value as Record<string, unknown>)[segment];
+  }
   if (typeof value !== "string" || value.includes("${")) return undefined;
   return value;
 }