fix: expand transitive named value chains and iterative token normalization

Author: Copilot

src/services/extract-service.ts

@@ -473,6 +473,7 @@ async function resolveAndExtractTransitive(
 
   // Build maps for transitive resolution
   const apiJsonMap = new Map<string, Record<string, unknown>>();
+  const namedValueJsonMap = new Map<string, Record<string, unknown>>();
   for (const apiResult of result.apiResults) {
     // Find the API's JSON from type results
     const apiTypeResults = result.typeResults.filter((r) => r.type === ResourceType.Api);
@@ -485,10 +486,21 @@ async function resolveAndExtractTransitive(
     }
   }
 
+  const namedValueTypeResults = result.typeResults.filter((r) => r.type === ResourceType.NamedValue);
+  for (const ntr of namedValueTypeResults) {
+    for (const extracted of ntr.extracted) {
+      if (extracted.status === 'success') {
+        const name = getNamePart(extracted.descriptor.nameParts, 0);
+        namedValueJsonMap.set(name, extracted.json);
+      }
+    }
+  }
+
   // Find transitive dependencies
   const transitiveDeps = findTransitiveDependencies(
     result.collectedPolicies,
-    apiJsonMap
+    apiJsonMap,
+    namedValueJsonMap
   );
 
   // Filter out already-extracted resources

src/services/resource-publisher.ts

@@ -554,31 +554,67 @@ async function normalizeNamedValueReferences(
     return json;
   }
 
-  // Recursively normalize all {{named-value-token}} references to canonical names.
-  // APIM resource shapes vary widely (strings, nested objects, arrays), so traverse
-  // the entire payload structure.
-  const normalizeValue = (value: unknown): unknown => {
-    if (typeof value === 'string') {
-      return value.replace(/\{\{\s*([^}]+?)\s*\}\}/g, (match, tokenName: string) => {
-        const canonicalName = namedValueNames.get(tokenName.toLowerCase());
-        return canonicalName ? `{{${canonicalName}}}` : match;
-      });
+  const normalizeTokenString = (value: string): string =>
+    value.replace(/\{\{\s*([^}]+?)\s*\}\}/g, (match, tokenName: string) => {
+      const canonicalName = namedValueNames.get(tokenName.toLowerCase());
+      return canonicalName ? `{{${canonicalName}}}` : match;
+    });
+
+  const normalizedRoot: Record<string, unknown> = {};
+  const stack: Array<{ source: unknown; assign: (value: unknown) => void }> = [];
+
+  for (const [key, value] of Object.entries(json)) {
+    stack.push({
+      source: value,
+      assign: (normalizedValue: unknown) => {
+        normalizedRoot[key] = normalizedValue;
+      },
+    });
+  }
+
+  while (stack.length > 0) {
+    const frame = stack.pop();
+    if (!frame) {
+      continue;
     }
 
-    if (Array.isArray(value)) {
-      return value.map(normalizeValue);
+    const { source, assign } = frame;
+
+    if (typeof source === 'string') {
+      assign(normalizeTokenString(source));
+      continue;
     }
 
-    if (value && typeof value === 'object') {
-      const normalized: Record<string, unknown> = {};
-      for (const [key, child] of Object.entries(value as Record<string, unknown>)) {
-        normalized[key] = normalizeValue(child);
+    if (Array.isArray(source)) {
+      const out: unknown[] = new Array(source.length);
+      assign(out);
+      for (let i = source.length - 1; i >= 0; i--) {
+        stack.push({
+          source: source[i],
+          assign: (normalizedValue: unknown) => {
+            out[i] = normalizedValue;
+          },
+        });
       }
-      return normalized;
+      continue;
     }
 
-    return value;
-  };
+    if (source && typeof source === 'object') {
+      const out: Record<string, unknown> = {};
+      assign(out);
+      for (const [key, child] of Object.entries(source as Record<string, unknown>)) {
+        stack.push({
+          source: child,
+          assign: (normalizedValue: unknown) => {
+            out[key] = normalizedValue;
+          },
+        });
+      }
+      continue;
+    }
+
+    assign(source);
+  }
 
-  return normalizeValue(json) as Record<string, unknown>;
+  return normalizedRoot;
 }

src/services/transitive-resolver.ts

@@ -113,7 +113,8 @@ export function scanApiVersionSetReference(
 export function resolveTransitiveDependencies(
   extractedPolicies: Map<string, string>,
   extractedApis: Map<string, Record<string, unknown>>,
-  currentFilter: FilterConfig
+  currentFilter: FilterConfig,
+  extractedNamedValues: Map<string, Record<string, unknown>> = new Map()
 ): FilterConfig {
   const expanded = { ...currentFilter };
   let changed = true;
@@ -142,6 +143,23 @@ export function resolveTransitiveDependencies(
         changed = true;
       }
     }
+
+    // Scan extracted named values for references to other named values.
+    for (const [name, namedValueJson] of extractedNamedValues) {
+      const currentNamedValues = expanded.namedValueNames;
+      if (currentNamedValues !== undefined) {
+        const isIncluded = currentNamedValues.some((n) => n.toLowerCase() === name.toLowerCase());
+        if (!isIncluded) {
+          continue;
+        }
+      }
+
+      for (const ref of scanNamedValueReferences(namedValueJson)) {
+        if (addToFilter(expanded, ref)) {
+          changed = true;
+        }
+      }
+    }
   }
 
   if (iterations > 1) {
@@ -195,33 +213,107 @@ function addToFilter(
  */
 export function findTransitiveDependencies(
   policies: Map<string, string>,
-  apis: Map<string, Record<string, unknown>>
+  apis: Map<string, Record<string, unknown>>,
+  namedValues: Map<string, Record<string, unknown>> = new Map()
 ): ResourceDescriptor[] {
   const dependencies: ResourceDescriptor[] = [];
   const seen = new Set<string>();
+  const namedValueKeyToName = new Map<string, string>();
+
+  const addDependency = (dep: TransitiveDependency): boolean => {
+    const key = `${dep.type}:${dep.name.toLowerCase()}`;
+    if (seen.has(key)) {
+      return false;
+    }
+    seen.add(key);
+    dependencies.push({ type: dep.type, nameParts: [dep.name] });
+    return true;
+  };
+
+  for (const [name] of namedValues) {
+    namedValueKeyToName.set(name.toLowerCase(), name);
+  }
+
+  const namedValueQueue: string[] = [];
 
   // Scan all policies
   for (const [, policyXml] of policies) {
     for (const dep of scanPolicyReferences(policyXml)) {
-      const key = `${dep.type}:${dep.name.toLowerCase()}`;
-      if (!seen.has(key)) {
-        seen.add(key);
-        dependencies.push({ type: dep.type, nameParts: [dep.name] });
+      if (addDependency(dep) && dep.type === ResourceType.NamedValue) {
+        namedValueQueue.push(dep.name);
       }
     }
   }
 
   // Scan API version set references
   for (const [, apiJson] of apis) {
     const dep = scanApiVersionSetReference(apiJson);
-    if (dep) {
-      const key = `${dep.type}:${dep.name.toLowerCase()}`;
-      if (!seen.has(key)) {
-        seen.add(key);
-        dependencies.push({ type: dep.type, nameParts: [dep.name] });
+    if (dep && addDependency(dep) && dep.type === ResourceType.NamedValue) {
+      namedValueQueue.push(dep.name);
+    }
+  }
+
+  // Expand named value chains (e.g. A references B, B references C).
+  while (namedValueQueue.length > 0) {
+    const currentName = namedValueQueue.shift();
+    if (!currentName) {
+      continue;
+    }
+
+    const canonicalName = namedValueKeyToName.get(currentName.toLowerCase());
+    if (!canonicalName) {
+      continue;
+    }
+
+    const namedValueJson = namedValues.get(canonicalName);
+    if (!namedValueJson) {
+      continue;
+    }
+
+    for (const dep of scanNamedValueReferences(namedValueJson)) {
+      if (addDependency(dep) && dep.type === ResourceType.NamedValue) {
+        namedValueQueue.push(dep.name);
       }
     }
   }
 
   return dependencies;
 }
+
+/**
+ * Scan named value JSON payload for references to other named values.
+ */
+function scanNamedValueReferences(namedValueJson: Record<string, unknown>): TransitiveDependency[] {
+  const refs: TransitiveDependency[] = [];
+  const stack: unknown[] = [namedValueJson];
+
+  while (stack.length > 0) {
+    const value = stack.pop();
+    if (typeof value === 'string') {
+      for (const match of value.matchAll(NAMED_VALUE_PATTERN)) {
+        if (match[1]) {
+          refs.push({
+            type: ResourceType.NamedValue,
+            name: match[1].trim(),
+          });
+        }
+      }
+      continue;
+    }
+
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        stack.push(item);
+      }
+      continue;
+    }
+
+    if (value && typeof value === 'object') {
+      for (const child of Object.values(value as Record<string, unknown>)) {
+        stack.push(child);
+      }
+    }
+  }
+
+  return refs;
+}

tests/unit/services/resource-publisher.test.ts

@@ -295,6 +295,48 @@ describe('resource-publisher', () => {
       expect(query['token'][0]).toBe(`{{${authTokenName}}}`);
     });
 
+    it('should preserve unknown named value references', async () => {
+      const client = createMockClient();
+      const store = createMockStore();
+      const knownName = 'Known-Token';
+
+      store.readResource.mockResolvedValue({
+        name: 'my-backend',
+        properties: {
+          credentials: {
+            authorization: {
+              parameter: '{{unknown-token}}',
+            },
+            query: {
+              token: ['{{known-token}}'],
+            },
+          },
+        },
+      });
+
+      store.listResources.mockResolvedValue([
+        { type: ResourceType.Backend, nameParts: ['my-backend'] },
+        { type: ResourceType.NamedValue, nameParts: [knownName] },
+      ]);
+
+      const descriptor: ResourceDescriptor = {
+        type: ResourceType.Backend,
+        nameParts: ['my-backend'],
+      };
+
+      await publishResource(client, store, testContext, descriptor, testConfig);
+
+      const putCall = client.putResource.mock.calls[0];
+      const putJson = putCall[2] as Record<string, unknown>;
+      const props = putJson.properties as Record<string, unknown>;
+      const credentials = props.credentials as Record<string, unknown>;
+      const authorization = credentials.authorization as Record<string, unknown>;
+      const query = credentials.query as Record<string, string[]>;
+
+      expect(authorization.parameter).toBe('{{unknown-token}}');
+      expect(query['token'][0]).toBe(`{{${knownName}}}`);
+    });
+
     it('should preserve opaque JSON properties', async () => {
       const client = createMockClient();
       const store = createMockStore();