@intentius/chant-lexicon-aws 0.124.30 → 0.124.32

package/src/api/read-client.ts

@@ -21,8 +21,11 @@
  *
  * Requests are signed with SigV4 (#1686) when credentials resolve — see
  * `./sigv4.ts`, which holds the implementation so that cedar's AVP client can
- * adopt the same one rather than growing a second. Two cases stay unsigned, and
- * both are deliberate:
+ * adopt the same one rather than growing a second. With none injected, they
+ * resolve through the AWS CLI's chain (`./credential-chain.ts`, the one
+ * `chant lifecycle whoami` walks) once per process, by
+ * {@link withChainCredentials} (#3958). Two cases stay unsigned, and both are
+ * deliberate:
  *
  *   - **No credentials.** The caller's existing no-credentials path is
  *     untouched: the request still goes out carrying only the credential scope
@@ -41,6 +44,8 @@
  * a lexicon build compiles against the published core, so a helper hoisted
  * into core would not be visible to either until the next core release.
  */
+import { homedir } from "node:os";
+import { transportCredentials } from "./credential-chain";
 import { resolveCredentials, signRequest, type AwsCredentialSource } from "./sigv4";
 
 export type { AwsCredentials, AwsCredentialResolver, AwsCredentialSource } from "./sigv4";
@@ -219,6 +224,37 @@ export function requestHeaders(
   });
 }
 
+/**
+ * `options` with literal credentials from the AWS CLI's credential chain
+ * (#3958), when the caller injected none and the request will be signed.
+ *
+ * Every request function awaits this after {@link withEndpointOverride} and
+ * before {@link requestHeaders}, whose seam is synchronous. The chain is not
+ * walked against an endpoint override that is not signed: an emulator read
+ * should not start an SSO refresh or a `credential_process`, the same rule
+ * whoami follows. When nothing resolves the options come back unchanged and
+ * the request goes out unsigned, as it did before.
+ *
+ * An injected `env` without `HOME`, `USERPROFILE`, `AWS_CONFIG_FILE` or
+ * `AWS_SHARED_CREDENTIALS_FILE` names no shared files, so only its keys are
+ * read; the process's own `~/.aws` is not consulted behind it.
+ */
+export async function withChainCredentials(options: AwsReadClientOptions): Promise<AwsReadClientOptions> {
+  if (options.credentials) return options;
+  if (options.endpoint && options.signEndpointOverride !== true) return options;
+  const env = options.env ?? process.env;
+  const home = env.HOME || env.USERPROFILE;
+  if (options.env && options.env !== process.env && !home && !env.AWS_CONFIG_FILE && !env.AWS_SHARED_CREDENTIALS_FILE) {
+    return options;
+  }
+  const credentials = await transportCredentials({
+    env,
+    home: home || homedir(),
+    sts: { ...(options.http ? { http: options.http } : {}), env },
+  });
+  return credentials ? { ...options, credentials } : options;
+}
+
 /* ── CloudFormation Query ─────────────────────────────────────────────────── */
 
 /**
@@ -275,7 +311,7 @@ export async function cfnQuery(
   params: Record<string, string>,
   options: AwsReadClientOptions = {},
 ): Promise<string> {
-  options = withEndpointOverride("cloudformation", options);
+  options = await withChainCredentials(withEndpointOverride("cloudformation", options));
   const http = options.http ?? defaultHttp;
   const url = serviceUrl("cloudformation", options.endpoint, options.region);
   const body = new URLSearchParams({ Action: action, Version: CFN_API_VERSION, ...params }).toString();
@@ -388,7 +424,7 @@ export interface CallerIdentity {
  * and the narrower the surface, the fewer ways a credential reaches a report.
  */
 export async function getCallerIdentity(options: AwsReadClientOptions = {}): Promise<CallerIdentity> {
-  options = withEndpointOverride("sts", options);
+  options = await withChainCredentials(withEndpointOverride("sts", options));
   const http = options.http ?? defaultHttp;
   const url = serviceUrl("sts", options.endpoint, options.region);
   const body = new URLSearchParams({ Action: "GetCallerIdentity", Version: STS_API_VERSION }).toString();
@@ -431,7 +467,7 @@ export async function assumeRole(
   params: { roleArn: string; sessionName: string; externalId?: string; durationSeconds?: number },
   options: AwsReadClientOptions = {},
 ): Promise<AssumedRoleCredentials> {
-  options = withEndpointOverride("sts", options);
+  options = await withChainCredentials(withEndpointOverride("sts", options));
   const http = options.http ?? defaultHttp;
   const url = serviceUrl("sts", options.endpoint, options.region);
   const body = new URLSearchParams({
@@ -484,7 +520,7 @@ async function cloudControl(
   payload: Record<string, unknown>,
   options: AwsReadClientOptions = {},
 ): Promise<Record<string, unknown>> {
-  options = withEndpointOverride("cloudcontrolapi", options);
+  options = await withChainCredentials(withEndpointOverride("cloudcontrolapi", options));
   const http = options.http ?? defaultHttp;
   const url = serviceUrl("cloudcontrolapi", options.endpoint, options.region);
   const payloadJson = JSON.stringify(payload);

package/src/api/sigv4.ts

@@ -70,10 +70,10 @@ export type AwsCredentialSource = AwsCredentials | AwsCredentialResolver;
  * environment — a key id with no secret — is absent rather than a signature
  * that cannot verify.
  *
- * Deliberately not implemented: the profile file, IMDS, and the container
- * credential endpoints. Each is a separate transport with its own failure and
- * caching story; a caller that has those can resolve them itself and pass the
- * result in, which is what the resolver seam is for.
+ * The shared profile files are resolved asynchronously by
+ * `./credential-chain.ts`, and the read transport passes its answer in as
+ * literal credentials (#3958), so this function stays synchronous. Not
+ * implemented anywhere: IMDS and the container credential endpoints.
  */
 export function resolveCredentials(
   source?: AwsCredentialSource,

package/src/caller-identity.ts

@@ -29,11 +29,9 @@
  * while `aws sts get-caller-identity` answered with a principal. An expired
  * SSO session is `no-credentials` naming `aws sso login --profile <p>`.
  *
- * The native read transport still signs with environment keys only
- * (`resolveCredentials` in ./api/sigv4.ts; #3958). So a profile-sourced row says
- * what the CLI, and anything shelling out to it, would act as; it does not
- * yet say what `describeResources` signs with. The `source` column names the
- * profile, so the difference is visible.
+ * The native read transport walks the same chain (`transportCredentials`,
+ * #3958), so a profile-sourced row also says what `describeResources` signs
+ * with.
  *
  * Against an endpoint override the chain is not walked: the emulator call is
  * unsigned whatever resolves, and a whoami against Floci should not start an

package/src/codegen/any-budget.test.ts

@@ -25,9 +25,19 @@ const dtsPath = join(pkgDir, "src/generated/index.d.ts");
  * with nothing beside it, one upstream `$ref` to an undeclared definition, and
  * one `$ref` to a definition that is itself a bare `$ref`. Plus 38
  * non-constructor `any`s (readonly attributes and intrinsic return types).
+ *
+ * The 2026-10-19 spec pin (#3960) added 5 of each, all from schemas the new
+ * spec brought in rather than from a resolver change. `: any;`:
+ * QuickSight::DLPSetting.ProviderConfig, QuickSight::ApprovalPolicy
+ * ApplicableTo.Type (exported twice) and the new Connect::Rule
+ * InAppNotificationRecipientType.UserTags (exported twice). `: any[];`:
+ * QuickSight::ApprovalPolicy Actions and AssetTypes, BedrockAgentCore::GatewayRule
+ * Actions and Conditions, and the new BedrockAgentCore::Gateway
+ * InterceptorPayloadFilter.Exclude (exported twice), less one: the bare `Group`
+ * export now names AWS::QuickSight::Group.
  */
-const ANY_BUDGET = 226;
-const ANY_ARRAY_BUDGET = 20;
+const ANY_BUDGET = 231;
+const ANY_ARRAY_BUDGET = 25;
 
 describe.skipIf(!existsSync(dtsPath))("generated `any` budget", () => {
   const dts = existsSync(dtsPath) ? readFileSync(dtsPath, "utf-8") : "";

package/src/codegen/generate.ts

@@ -104,9 +104,18 @@ const awsPipelineConfig: GeneratePipelineConfig<SchemaParseResult> = {
       const { schemas: patched, stats } = applyPatches(schemas, patchesDir);
       schemas = patched;
       log(`Applied ${stats.patchesApplied} patches across ${stats.resourcesFixed} resources`);
+      for (const s of stats.skipped) {
+        log(`Skipped known-stale patch ${s.stale.typeName}/${s.stale.patchFile}: ${s.stale.reason} (${s.error.message})`);
+      }
       for (const w of stats.warnings) {
         warnings.push({ file: `${w.typeName}/${w.patchFile}`, error: w.error.message });
       }
+      for (const r of stats.retirable) {
+        warnings.push({
+          file: `${r.typeName}/${r.patchFile}`,
+          error: `listed in KNOWN_STALE_PATCHES (src/codegen/patches.ts) but did not fail; retire the entry`,
+        });
+      }
     } catch (err) {
       log(`WARNING: failed to fetch cfn-lint patches: ${err}`);
     }

package/src/codegen/package.ts

@@ -6,7 +6,7 @@
 import { readFileSync } from "fs";
 import { awsPlugin } from "../plugin";
 import { join, dirname } from "path";
-import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import type { IntrinsicDef } from "@intentius/chant/lexicon";
 import {
   packagePipeline,
@@ -18,7 +18,7 @@ import { generate } from "./generate";
 
 export type { PackageOptions, PackageResult };
 
-const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+const pkgDir = dirname(moduleSourceDir(import.meta.url));
 
 /**
  * Map intrinsic name to its CloudFormation output key.

package/src/codegen/patches.test.ts

@@ -0,0 +1,95 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { applyPatches, KNOWN_STALE_PATCHES, typeNameToPatchDir, type StalePatch } from "./patches";
+import { PINNED_VERSIONS } from "./versions";
+
+const MEDIALIVE = "AWS::MediaLive::InputSecurityGroup";
+
+// The patch cfn-lint v1.32.4 ships for MediaLive, verbatim.
+const MEDIALIVE_FORMAT_PATCH = [
+  { op: "add", path: "/definitions/InputWhitelistRuleCidr/properties/Cidr/format", value: "ipv4-network" },
+];
+
+// The shape the 2026-10-19 spec gives the definition, trimmed.
+const medialiveSchema = (definition: string) =>
+  Buffer.from(
+    JSON.stringify({
+      typeName: MEDIALIVE,
+      definitions: { [definition]: { type: "object", properties: { Cidr: { type: "string" } } } },
+      properties: {},
+    }),
+  );
+
+let dir: string;
+
+const writePatch = (typeName: string, file: string, ops: unknown) => {
+  const d = join(dir, typeNameToPatchDir(typeName));
+  mkdirSync(d, { recursive: true });
+  writeFileSync(join(d, file), JSON.stringify(ops));
+};
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "cfn-lint-patches-"));
+});
+
+afterEach(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe("applyPatches known-stale tracking", () => {
+  test("the MediaLive patch against the renamed definition is a skip, not a warning", () => {
+    writePatch(MEDIALIVE, "format.json", MEDIALIVE_FORMAT_PATCH);
+    const schemas = new Map([[MEDIALIVE, medialiveSchema("InputWhitelistRule")]]);
+
+    const { stats } = applyPatches(schemas, dir);
+
+    expect(stats.patchesApplied).toBe(0);
+    expect(stats.warnings).toEqual([]);
+    expect(stats.skipped.map((s) => `${s.stale.typeName}/${s.stale.patchFile}`)).toEqual([`${MEDIALIVE}/format.json`]);
+    expect(stats.skipped[0].error.message).toContain("InputWhitelistRuleCidr");
+    expect(stats.retirable).toEqual([]);
+  });
+
+  test("a failure not on the list stays a warning", () => {
+    writePatch(MEDIALIVE, "format.json", MEDIALIVE_FORMAT_PATCH);
+    const schemas = new Map([[MEDIALIVE, medialiveSchema("InputWhitelistRule")]]);
+
+    const { stats } = applyPatches(schemas, dir, []);
+
+    expect(stats.skipped).toEqual([]);
+    expect(stats.warnings.map((w) => `${w.typeName}/${w.patchFile}`)).toEqual([`${MEDIALIVE}/format.json`]);
+  });
+
+  test("an entry whose patch applies again is retirable", () => {
+    writePatch(MEDIALIVE, "format.json", MEDIALIVE_FORMAT_PATCH);
+    const schemas = new Map([[MEDIALIVE, medialiveSchema("InputWhitelistRuleCidr")]]);
+
+    const { schemas: patched, stats } = applyPatches(schemas, dir);
+
+    expect(stats.patchesApplied).toBe(1);
+    expect(stats.skipped).toEqual([]);
+    expect(stats.retirable.map((s) => s.typeName)).toEqual([MEDIALIVE]);
+    const doc = JSON.parse(patched.get(MEDIALIVE)!.toString("utf-8"));
+    expect(doc.definitions.InputWhitelistRuleCidr.properties.Cidr.format).toBe("ipv4-network");
+  });
+
+  test("an entry with no patch file to fail is retirable", () => {
+    const stale: StalePatch = { typeName: "AWS::Test::Gone", patchFile: "manual.json", cfnLint: "v0", reason: "test" };
+    const { stats } = applyPatches(new Map(), dir, [stale]);
+    expect(stats.retirable).toEqual([stale]);
+  });
+});
+
+describe("KNOWN_STALE_PATCHES", () => {
+  // Moving the cfn-lint pin changes which patches fail, so every entry has to
+  // be re-checked against the new release before this passes again.
+  test("every entry was checked against the pinned cfn-lint release", () => {
+    for (const s of KNOWN_STALE_PATCHES) expect(s.cfnLint).toBe(PINNED_VERSIONS.cfnLint);
+  });
+
+  test("lists the MediaLive rename and nothing else", () => {
+    expect(KNOWN_STALE_PATCHES.map((s) => `${s.typeName}/${s.patchFile}`)).toEqual([`${MEDIALIVE}/format.json`]);
+  });
+});

package/src/codegen/patches.ts

@@ -11,10 +11,12 @@ import { join } from "path";
 import { homedir } from "os";
 import { rfc6902Apply } from "@intentius/chant/codegen/json-patch";
 import { fetchAndExtractTar } from "@intentius/chant/codegen/fetch";
-import { cfnLintTarballUrl } from "./versions";
+import { cfnLintTarballUrl, PINNED_VERSIONS } from "./versions";
 
 const CFN_LINT_TARBALL_URL = cfnLintTarballUrl();
-const PATCHES_DEST_DIR = join(homedir(), ".chant", "cfn-lint-patches");
+// Keyed by version: the cache lives for 7 days, so an unkeyed directory would
+// keep serving the old release's patches after the pin moves.
+const PATCHES_DEST_DIR = join(homedir(), ".chant", `cfn-lint-patches-${PINNED_VERSIONS.cfnLint}`);
 const PATCHES_TAR_PREFIX = "src/cfnlint/data/schemas/patches/extensions/all/";
 const PATCH_FILES = ["manual.json", "smithy.json", "format.json"] as const;
 
@@ -24,10 +26,48 @@ export interface PatchWarning {
   error: Error;
 }
 
+/**
+ * A patch in the pinned cfn-lint release that is known not to apply to the
+ * pinned spec. Its failure is reported as a skip rather than a warning; an
+ * entry that applies again, or whose patch file is gone, is reported as
+ * retirable so the list cannot go stale.
+ */
+export interface StalePatch {
+  typeName: string;
+  patchFile: (typeof PATCH_FILES)[number];
+  /** The cfn-lint release the entry was checked against. */
+  cfnLint: string;
+  reason: string;
+}
+
+export const KNOWN_STALE_PATCHES: readonly StalePatch[] = [
+  {
+    // Adds `format: ipv4-network` to `Cidr`, a constraint only; no generated
+    // type changes. Every cfn-lint release from v1.32.4 to v1.51.5 still
+    // targets the old name, and v1.52.0 removed the patch tree from cfn-lint
+    // (it moved to aws-cloudformation/resource-provider-enhanced-schemas,
+    // which has the corrected path but publishes only a rolling `latest`).
+    typeName: "AWS::MediaLive::InputSecurityGroup",
+    patchFile: "format.json",
+    cfnLint: "v1.32.4",
+    reason: "the 2026-10-19 spec renamed definition InputWhitelistRuleCidr to InputWhitelistRule (#4144)",
+  },
+];
+
+export interface PatchSkip {
+  stale: StalePatch;
+  error: Error;
+}
+
 export interface PatchStats {
   patchesApplied: number;
   resourcesFixed: number;
+  /** Failures not in `KNOWN_STALE_PATCHES`. */
   warnings: PatchWarning[];
+  /** Failures listed in `KNOWN_STALE_PATCHES`. */
+  skipped: PatchSkip[];
+  /** `KNOWN_STALE_PATCHES` entries that did not fail: applied, or no such schema or patch file. */
+  retirable: StalePatch[];
 }
 
 /**
@@ -49,9 +89,11 @@ export async function fetchCfnLintPatches(force = false): Promise<string> {
  */
 export function applyPatches(
   schemas: Map<string, Buffer>,
-  patchesDir: string
+  patchesDir: string,
+  knownStale: readonly StalePatch[] = KNOWN_STALE_PATCHES,
 ): { schemas: Map<string, Buffer>; stats: PatchStats } {
-  const stats: PatchStats = { patchesApplied: 0, resourcesFixed: 0, warnings: [] };
+  const stats: PatchStats = { patchesApplied: 0, resourcesFixed: 0, warnings: [], skipped: [], retirable: [] };
+  const staleByKey = new Map(knownStale.map((s) => [`${s.typeName}/${s.patchFile}`, s]));
   const result = new Map<string, Buffer>();
 
   for (const [typeName, data] of schemas) {
@@ -72,11 +114,10 @@ export function applyPatches(
         patched = Buffer.from(rfc6902Apply(patched.toString("utf-8"), patchData.toString("utf-8")));
         stats.patchesApplied++;
       } catch (err) {
-        stats.warnings.push({
-          typeName,
-          patchFile: pf,
-          error: err instanceof Error ? err : new Error(String(err)),
-        });
+        const error = err instanceof Error ? err : new Error(String(err));
+        const stale = staleByKey.get(`${typeName}/${pf}`);
+        if (stale) stats.skipped.push({ stale, error });
+        else stats.warnings.push({ typeName, patchFile: pf, error });
       }
     }
 
@@ -86,6 +127,9 @@ export function applyPatches(
     result.set(typeName, patched);
   }
 
+  const skippedStale = new Set(stats.skipped.map((s) => s.stale));
+  stats.retirable = knownStale.filter((s) => !skippedStale.has(s));
+
   return { schemas: result, stats };
 }
 

package/src/codegen/property-overlay.json

@@ -1,19 +1,4 @@
 {
   "$comment": "Properties CloudFormation has shipped since the pinned Registry spec (src/spec/pin.ts) was accepted (chant #3953). Hand-maintained, merged into the raw schema at codegen time by src/codegen/property-overlay.ts. Each entry is copied from the live Registry schema; retire it when a pin bump (#3960) brings the property in; generation warns when it does.",
-  "entries": [
-    {
-      "type": "AWS::BedrockAgentCore::Runtime",
-      "property": "PlatformVersion",
-      "issue": 3953,
-      "source": "https://schema.cloudformation.us-east-1.amazonaws.com/CloudformationSchema.zip (aws-bedrockagentcore-runtime.json)",
-      "reviewed": "2026-10-12",
-      "schema": {
-        "type": "string",
-        "description": "The version of the runtime platform",
-        "minLength": 1,
-        "maxLength": 128,
-        "pattern": "^[^\\s]+$"
-      }
-    }
-  ]
+  "entries": []
 }