Module provider 

Provider / account / region resolver (Phase 7, closes M4).

Per 16-provider-resolver.md. The resolver is the last transformation before the exporter. It fills account_id / account_name / region on every Resource and state_account_id / state_region on every StateBackend, by walking the provider alias → provider block → profile / assume-role / cascade → external profile map chain documented in spec § 4.

Public surface

• ProviderResolver / DefaultProviderResolver: trait + default impl.
• ProviderContext: per-resolution context (profile map, default region, strict-mode flag).
• ProfileMap / ProfileEntry: the profile → account/region index.
• SharedProfileMap: ArcSwap<ProfileMap> alias for atomic re-loads.
• load_yaml_profile_map / load_aws_config / empty_profile_map: the three loaders mirroring spec § 3.
• extract_account_id: ARN → 12-digit account id helper (spec § 4.1).
• ProviderError: thiserror enum.

Structs

DefaultProviderResolver

Default implementation per spec § 4. Stateless.

ProfileEntry

One entry in the ProfileMap.

ProfileMap

Profile → entry index used by the provider resolver.

ProviderContext

Per-resolution context — Arc<ProfileMap> plus operator-driven flags.

Enums

ProviderError

Errors raised by the provider-resolver layer.

Constants

AWS_CONFIG_MAX_CHAIN_HOPS

Spec 16 § 3.1: maximum source_profile chain hop count.

PROFILE_MAP_FILE_MAX_BYTES

Spec 16 § 9: hard size cap for the source file (~/.aws/config or profile-map.yaml).

Traits

ProviderResolver

Trait the orchestrator (Phase 9 CLI) calls. Phase 7 ships exactly one implementation, DefaultProviderResolver; downstream tests may swap in a stub.

Functions

empty_profile_map

Return an empty ProfileMap (spec § 3.3 none loader).

extract_account_id

Parse an arn:aws:iam::<12 digits>:role/<...> and return the 12-digit account id. Returns None for any other shape — including assume_role-less providers and malformed ARNs.

load_aws_config

Load a profile map from ~/.aws/config (or any user-supplied INI-shaped file).

load_yaml_profile_map

Load a profile map from a YAML file at path.

shared

Build a SharedProfileMap seeded with initial.

Type Aliases

SharedProfileMap

Atomically-swappable handle for re-runs. Per CLAUDE.md § Async & Concurrency: ArcSwap for infrequently-updated shared data; lock-free reads on the hot resolver path.