@intentius/chant-lexicon-aws 0.124.30 → 0.124.32

package/dist/codegen/generate.js

@@ -0,0 +1,234 @@
+/**
+ * AWS CloudFormation generation pipeline — uses core generatePipeline
+ * with AWS-specific fetch, parse, naming, and generation callbacks.
+ */
+import { generatePipeline, writeGeneratedArtifacts, } from "@intentius/chant/codegen/generate";
+import { fetchSchemaZip } from "../spec/fetch.js";
+import { assertPinnedSpec } from "../spec/pin.js";
+import { parseCFNSchema, cfnShortName } from "../spec/parse.js";
+import { fetchCfnLintPatches, applyPatches } from "./patches.js";
+import { fetchCfnLintExtensions, loadExtensionSchemas } from "./extensions.js";
+import { applyEnumOverlay, assertOverlayCoverage, enumOverlayByType, enumOverlayEntries, redundantOverlayWarnings, } from "./enum-overlay.js";
+import { applyPropertyOverlay, assertPropertyOverlayCoverage, propertyOverlayByType, propertyOverlayEntries, redundantPropertyOverlayWarnings, } from "./property-overlay.js";
+import { samResources } from "./sam.js";
+import { fallbackResources } from "./fallback.js";
+import { NamingStrategy, publishedNames, propertyTypeName, extractDefName } from "./naming.js";
+import { generateLexiconJSON, lambdaRuntimeDeprecations } from "./generate-lexicon.js";
+import { generateTypeScriptDeclarations } from "./generate-typescript.js";
+import { generateRuntimeIndex as coreGenerateRuntimeIndex, } from "@intentius/chant/codegen/generate-runtime-index";
+// AWS-specific state shared between pipeline callbacks
+let awsConstraints = new Map();
+/** chant #1459 — spec type → already-published TS name, reset per `generate()` call. */
+let awsReservedNames = {};
+/**
+ * Curated enum overlay state (chant #1497), reset per `generate()` call.
+ *
+ * The overlay runs in `parseSchema` rather than `augmentSchemas` on purpose:
+ * `augmentSchemas` is skipped for a caller-supplied schema set because it
+ * fetches, and the overlay fetches nothing. Running it per schema keeps a
+ * fixture-driven run and a real run on the same code path.
+ */
+let awsOverlay = new Map();
+let awsOverlayApplications = [];
+let awsOverlaySeenTypes = new Set();
+let awsOverlayStrict = false;
+/** Backfilled properties (chant #3953), reset per `generate()` call; strictness and seen types are shared with the enum overlay. */
+let awsPropertyOverlay = new Map();
+let awsPropertyOverlayApplications = [];
+const awsPipelineConfig = {
+    fetchSchemas: async (opts) => {
+        const schemas = await fetchSchemaZip(opts.force);
+        // #1390 — the registry schema has no version in its URL and is republished
+        // constantly, so without this any prepack regenerates against whatever
+        // CloudFormation shipped that morning.
+        assertPinnedSpec(schemas);
+        return schemas;
+    },
+    parseSchema: (typeName, data) => {
+        awsOverlaySeenTypes.add(typeName);
+        // Properties first, so an enum overlay entry could name a backfilled one.
+        const backfilled = applyPropertyOverlay(data, awsPropertyOverlay.get(typeName) ?? []);
+        awsPropertyOverlayApplications.push(...backfilled.applications);
+        const entries = awsOverlay.get(typeName) ?? [];
+        const overlaid = applyEnumOverlay(typeName, backfilled.data, entries, { strict: awsOverlayStrict });
+        awsOverlayApplications.push(...overlaid.applications);
+        const result = parseCFNSchema(overlaid.data);
+        if (!result.resource.typeName)
+            return null;
+        return result;
+    },
+    createNaming: (results) => new NamingStrategy(results, awsReservedNames),
+    augmentSchemas: async (schemas, opts, log) => {
+        const warnings = [];
+        // Fetch and apply cfn-lint patches
+        try {
+            log("Fetching cfn-lint patches...");
+            const patchesDir = await fetchCfnLintPatches(opts.force);
+            const { schemas: patched, stats } = applyPatches(schemas, patchesDir);
+            schemas = patched;
+            log(`Applied ${stats.patchesApplied} patches across ${stats.resourcesFixed} resources`);
+            for (const s of stats.skipped) {
+                log(`Skipped known-stale patch ${s.stale.typeName}/${s.stale.patchFile}: ${s.stale.reason} (${s.error.message})`);
+            }
+            for (const w of stats.warnings) {
+                warnings.push({ file: `${w.typeName}/${w.patchFile}`, error: w.error.message });
+            }
+            for (const r of stats.retirable) {
+                warnings.push({
+                    file: `${r.typeName}/${r.patchFile}`,
+                    error: `listed in KNOWN_STALE_PATCHES (src/codegen/patches.ts) but did not fail; retire the entry`,
+                });
+            }
+        }
+        catch (err) {
+            log(`WARNING: failed to fetch cfn-lint patches: ${err}`);
+        }
+        // Fetch extension constraints (stored for use in generateRegistry)
+        try {
+            log("Fetching cfn-lint extensions...");
+            const extensionsDir = await fetchCfnLintExtensions(opts.force);
+            // We'll apply these later in generateRegistry — store them
+            // The parsedTypes set isn't available yet, so we load all and filter later
+            awsConstraints = loadExtensionSchemas(extensionsDir, new Set(schemas.keys()));
+            log(`Loaded extension constraints for ${awsConstraints.size} resource types`);
+        }
+        catch (err) {
+            log(`WARNING: failed to fetch cfn-lint extensions: ${err}`);
+            awsConstraints = new Map();
+        }
+        return { schemas, warnings };
+    },
+    augmentResults: (results, _opts, log) => {
+        const warnings = [];
+        // Add SAM resources
+        results.push(...samResources());
+        log("Added SAM resources");
+        // Add fallback resources for missing priority types
+        const parsedTypes = new Set(results.map((r) => r.resource.typeName));
+        for (const fb of fallbackResources()) {
+            if (!parsedTypes.has(fb.resource.typeName)) {
+                results.push(fb);
+                parsedTypes.add(fb.resource.typeName);
+                warnings.push({
+                    file: fb.resource.typeName,
+                    error: `Priority resource missing from schema zip; using fallback`,
+                });
+            }
+        }
+        // Re-filter extension constraints now that we have the full type set
+        // (augmentSchemas loaded them before parsing, so we already have them)
+        // A curated enum that reached nothing is a stale entry (chant #1497), and
+        // the only place it can be noticed is here, once every schema has been seen.
+        assertOverlayCoverage(enumOverlayEntries(), awsOverlaySeenTypes, awsOverlayStrict);
+        const applied = awsOverlayApplications.filter((a) => a.outcome === "applied").length;
+        log(`Applied ${applied} curated enum overlay entries`);
+        warnings.push(...redundantOverlayWarnings(awsOverlayApplications));
+        assertPropertyOverlayCoverage(propertyOverlayEntries(), awsOverlaySeenTypes, awsOverlayStrict);
+        const backfilled = awsPropertyOverlayApplications.filter((a) => a.outcome === "applied").length;
+        log(`Backfilled ${backfilled} properties the pinned spec predates`);
+        warnings.push(...redundantPropertyOverlayWarnings(awsPropertyOverlayApplications));
+        log(`Total: ${results.length} resource schemas`);
+        return { results, warnings };
+    },
+    generateRegistry: (results, naming) => {
+        const runtimeDeprecations = lambdaRuntimeDeprecations();
+        return generateLexiconJSON(results, naming, awsConstraints, runtimeDeprecations);
+    },
+    generateTypes: (results, naming) => {
+        return generateTypeScriptDeclarations(results, naming);
+    },
+    generateRuntimeIndex: (results, naming) => {
+        return generateRuntimeIndex(results, naming);
+    },
+};
+/**
+ * Run the full AWS generation pipeline.
+ */
+export async function generate(opts = {}) {
+    // Reset shared state
+    awsConstraints = new Map();
+    awsOverlay = enumOverlayByType();
+    awsOverlayApplications = [];
+    awsOverlaySeenTypes = new Set();
+    awsPropertyOverlay = propertyOverlayByType();
+    awsPropertyOverlayApplications = [];
+    // A fixture set is a trimmed subset, so an entry it never reaches is
+    // expected; a run over the real zip has no such excuse.
+    awsOverlayStrict = !opts.schemaSource;
+    // chant #1459 — names already published keep pointing at the types that
+    // published them. Skipped for a caller-supplied schema set, exactly as
+    // `augmentSchemas` is (see the pipeline's `opts.schemaSource` guard): a
+    // fixture run must depend on its fixtures, not on what the lexicon last
+    // shipped.
+    awsReservedNames = opts.schemaSource ? {} : publishedNames();
+    return generatePipeline(awsPipelineConfig, opts);
+}
+/**
+ * Write generated artifacts to disk.
+ */
+export function writeGeneratedFiles(result, baseDir) {
+    writeGeneratedArtifacts({
+        baseDir,
+        files: {
+            "lexicon-aws.json": result.lexiconJSON,
+            "index.d.ts": result.typesDTS,
+            "index.ts": result.indexTS,
+            "runtime.ts": [
+                "/**",
+                " * Runtime factory constructors — re-exported from core.",
+                " */",
+                'export { createResource, createProperty } from "@intentius/chant/runtime";',
+                "",
+            ].join("\n"),
+        },
+    });
+}
+/**
+ * Generate the runtime index.ts with factory constructor exports.
+ */
+function generateRuntimeIndex(results, naming) {
+    const resourceEntries = [];
+    const propertyEntries = [];
+    for (const r of results) {
+        const cfnType = r.resource.typeName;
+        const tsName = naming.resolve(cfnType);
+        if (!tsName)
+            continue;
+        // Build attrs map: TS key (underscores) → CF attr name (dots)
+        const attrs = {};
+        for (const a of r.resource.attributes) {
+            const tsKey = a.name.replace(/\./g, "_").replace(/\*/g, "Item"); // Subscribers.*.Status → Subscribers_Item_Status
+            attrs[tsKey] = a.name; // maps to "Endpoint.Address" for GetAtt
+        }
+        resourceEntries.push({ tsName, resourceType: cfnType, attrs });
+        for (const alias of naming.aliases(cfnType)) {
+            resourceEntries.push({ tsName: alias, resourceType: cfnType, attrs });
+        }
+        // Property types
+        const shortName = cfnShortName(cfnType);
+        const ptAliases = naming.propertyTypeAliases(cfnType);
+        for (const pt of r.propertyTypes) {
+            const defName = extractDefName(pt.name, shortName);
+            const ptName = propertyTypeName(tsName, defName);
+            const ptCfnType = `${cfnType}.${pt.specType}`;
+            propertyEntries.push({ tsName: ptName, resourceType: ptCfnType });
+            if (ptAliases) {
+                const aliasName = ptAliases.get(defName);
+                if (aliasName) {
+                    propertyEntries.push({ tsName: aliasName, resourceType: ptCfnType });
+                }
+            }
+        }
+    }
+    return coreGenerateRuntimeIndex(resourceEntries, propertyEntries, {
+        lexiconName: "aws",
+        intrinsicReExports: {
+            names: ["Sub", "Ref", "GetAtt", "If", "Join", "Select", "Split", "Base64", "Equals", "And", "Or", "Not"],
+            from: "../intrinsics",
+        },
+        pseudoReExports: {
+            names: ["AWS", "StackName", "Region", "AccountId", "StackId", "URLSuffix", "NoValue", "NotificationARNs", "Partition"],
+            from: "../pseudo",
+        },
+    });
+}

package/dist/codegen/naming.js

@@ -0,0 +1,135 @@
+/**
+ * AWS-specific naming configuration for the core NamingStrategy.
+ *
+ * The algorithm lives in core; only the data tables and helper functions
+ * for extracting names from AWS CloudFormation types are defined here.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { NamingStrategy as CoreNamingStrategy, reservedNamesFromSnapshot, } from "@intentius/chant/codegen/naming";
+export { propertyTypeName, extractDefName } from "@intentius/chant/codegen/naming";
+import { cfnShortName, cfnServiceName } from "../spec/parse.js";
+/**
+ * Fixed TypeScript class names for backward compatibility.
+ */
+const priorityNames = {
+    "AWS::S3::Bucket": "Bucket",
+    "AWS::Lambda::Function": "Function",
+    "AWS::IAM::Role": "Role",
+    "AWS::IAM::Policy": "Policy",
+    "AWS::DynamoDB::Table": "Table",
+    "AWS::SQS::Queue": "Queue",
+    "AWS::SNS::Topic": "Topic",
+    "AWS::EC2::Instance": "Instance",
+    "AWS::EC2::SecurityGroup": "SecurityGroup",
+    "AWS::EC2::VPC": "Vpc",
+    "AWS::EC2::Subnet": "Subnet",
+    "AWS::CloudFormation::Stack": "Stack",
+    "AWS::CloudWatch::Alarm": "Alarm",
+    "AWS::Events::Rule": "EventRule",
+    "AWS::Logs::LogGroup": "LogGroup",
+    "AWS::ApiGateway::RestApi": "RestApi",
+    "AWS::ApiGatewayV2::Api": "HttpApi",
+    "AWS::ECS::Cluster": "EcsCluster",
+    "AWS::ECS::Service": "EcsService",
+    "AWS::ECS::TaskDefinition": "TaskDefinition",
+    "AWS::ElasticLoadBalancingV2::LoadBalancer": "LoadBalancer",
+    "AWS::ElasticLoadBalancingV2::TargetGroup": "TargetGroup",
+    "AWS::ElasticLoadBalancingV2::Listener": "Listener",
+    "AWS::RDS::DBInstance": "DbInstance",
+    "AWS::RDS::DBCluster": "DbCluster",
+    "AWS::StepFunctions::StateMachine": "StateMachine",
+    "AWS::KMS::Key": "KmsKey",
+    "AWS::SecretsManager::Secret": "Secret",
+    "AWS::SSM::Parameter": "SsmParameter",
+    "AWS::Lambda::Permission": "Permission",
+    "AWS::Lambda::LayerVersion": "LayerVersion",
+    "AWS::IAM::ManagedPolicy": "ManagedPolicy",
+    "AWS::IAM::InstanceProfile": "InstanceProfile",
+};
+/**
+ * Additional TypeScript names beyond the primary priority name.
+ */
+const priorityAliases = {
+    "AWS::IAM::Policy": ["IamPolicy"],
+};
+/**
+ * Property type aliases that must always be emitted for backward compat.
+ */
+const priorityPropertyAliases = {
+    "AWS::S3::Bucket": {
+        ServerSideEncryptionByDefault: "ServerSideEncryptionByDefault",
+        ServerSideEncryptionRule: "ServerSideEncryptionRule",
+        BucketEncryption: "BucketEncryption",
+        VersioningConfiguration: "VersioningConfiguration",
+        PublicAccessBlockConfiguration: "PublicAccessBlockConfiguration",
+        LoggingConfiguration: "LoggingConfiguration",
+    },
+    "AWS::Lambda::Function": {
+        Code: "Code",
+        Environment: "Environment",
+    },
+};
+/**
+ * Service name abbreviations for collision-resolved names.
+ */
+const serviceAbbreviations = {
+    ElasticLoadBalancingV2: "Elbv2",
+    CloudFormation: "Cfn",
+    CloudWatch: "Cw",
+    ApiGateway: "Apigw",
+    ApiGatewayV2: "Apigwv2",
+    SecretsManager: "Sm",
+    StepFunctions: "Sfn",
+    CertificateManager: "Acm",
+    ElasticLoadBalancing: "Elb",
+    CloudFront: "Cf",
+    ElastiCache: "Ec",
+};
+const awsNamingConfig = {
+    priorityNames,
+    priorityAliases,
+    priorityPropertyAliases,
+    serviceAbbreviations,
+    shortName: cfnShortName,
+    serviceName: cfnServiceName,
+};
+/**
+ * AWS-specific NamingStrategy — wraps the core algorithm with AWS data tables.
+ */
+export class NamingStrategy extends CoreNamingStrategy {
+    /**
+     * @param reservedNames chant #1459 — spec type → already-published TS name,
+     *   normally {@link publishedNames}. Passed in rather than read here on
+     *   purpose: a fixture-driven codegen run (`./snapshot.test.ts`) must not
+     *   inherit the repo's real 1600-entry surface, or its output would depend on
+     *   whatever the lexicon last shipped instead of on its fixtures.
+     */
+    constructor(results, reservedNames = {}) {
+        const inputs = results.map((r) => ({
+            typeName: r.resource.typeName,
+            propertyTypes: r.propertyTypes,
+        }));
+        super(inputs, { ...awsNamingConfig, reservedNames });
+    }
+}
+/**
+ * Reserved names from the committed surface snapshot, or none when it cannot
+ * be read.
+ *
+ * Defensive: codegen must still run for a lexicon with no snapshot yet, and a
+ * missing or malformed snapshot should degrade to the previous naming
+ * behaviour rather than fail generation outright. `surface-diff` makes the
+ * consequence visible either way.
+ */
+export function publishedNames() {
+    try {
+        const snapshotPath = join(import.meta.dirname, "..", "..", "surface.snapshot.json");
+        if (!existsSync(snapshotPath))
+            return {};
+        return reservedNamesFromSnapshot(JSON.parse(readFileSync(snapshotPath, "utf-8")));
+    }
+    catch {
+        return {};
+    }
+}

package/dist/codegen/package.js

@@ -0,0 +1,67 @@
+/**
+ * AWS lexicon packaging — delegates to core packagePipeline
+ * with AWS-specific manifest building and skill collection.
+ */
+import { readFileSync } from "fs";
+import { awsPlugin } from "../plugin.js";
+import { join, dirname } from "path";
+import { moduleSourceDir } from "@intentius/chant/module-source";
+import { packagePipeline, collectSkills, } from "@intentius/chant/codegen/package";
+import { generate } from "./generate.js";
+const pkgDir = dirname(moduleSourceDir(import.meta.url));
+/**
+ * Map intrinsic name to its CloudFormation output key.
+ */
+function intrinsicOutputKey(name) {
+    switch (name) {
+        case "Ref": return "Ref";
+        default: return `Fn::${name}`;
+    }
+}
+/**
+ * Package the AWS lexicon into a distributable BundleSpec.
+ */
+export async function packageLexicon(opts = {}) {
+    const pkgJson = JSON.parse(readFileSync(join(pkgDir, "..", "package.json"), "utf-8"));
+    return packagePipeline({
+        generate: (genOpts) => generate({ verbose: genOpts.verbose, force: genOpts.force }),
+        buildManifest: (_genResult) => {
+            // Lazy-import to avoid circular dependency
+            // Trust the plugin's own `isTag` registration (chant #1067) — this
+            // used to recompute `isTag: i.name === "Sub"` independently of
+            // ../plugin.ts, a second source of truth that could silently drift
+            // from the real registration (the exact shape of bug #1039 found).
+            const intrinsics = (awsPlugin.intrinsics?.() ?? []).map((i) => ({
+                name: i.name,
+                description: i.description,
+                outputKey: intrinsicOutputKey(i.name),
+                isTag: i.isTag,
+                // chant #1044 — carried through verbatim for the same reason as
+                // `isTag`: the packaged manifest is what a consumer reads to
+                // learn which intrinsics fold, so recomputing it here would be a
+                // second source of truth able to drift from ../plugin.ts.
+                foldsAsCall: i.foldsAsCall,
+            }));
+            const pseudoParams = awsPlugin.pseudoParameters?.() ?? [];
+            const pseudoParameters = {};
+            for (const p of pseudoParams) {
+                const shortName = p.split("::").pop();
+                pseudoParameters[shortName] = p;
+            }
+            return {
+                name: "aws",
+                version: pkgJson.version ?? "0.0.0",
+                chantVersion: ">=0.1.0",
+                namespace: "AWS",
+                intrinsics,
+                pseudoParameters,
+            };
+        },
+        srcDir: pkgDir,
+        collectSkills: () => {
+            const skillDefs = awsPlugin.skills?.() ?? [];
+            return collectSkills(skillDefs);
+        },
+        version: pkgJson.version ?? "0.0.0",
+    }, opts);
+}

package/dist/codegen/patches.d.ts

@@ -5,15 +5,39 @@
  * before parsing. This enriches the schemas with additional type information,
  * enum values, and constraint fixes.
  */
+declare const PATCH_FILES: readonly ["manual.json", "smithy.json", "format.json"];
 export interface PatchWarning {
     typeName: string;
     patchFile: string;
     error: Error;
 }
+/**
+ * A patch in the pinned cfn-lint release that is known not to apply to the
+ * pinned spec. Its failure is reported as a skip rather than a warning; an
+ * entry that applies again, or whose patch file is gone, is reported as
+ * retirable so the list cannot go stale.
+ */
+export interface StalePatch {
+    typeName: string;
+    patchFile: (typeof PATCH_FILES)[number];
+    /** The cfn-lint release the entry was checked against. */
+    cfnLint: string;
+    reason: string;
+}
+export declare const KNOWN_STALE_PATCHES: readonly StalePatch[];
+export interface PatchSkip {
+    stale: StalePatch;
+    error: Error;
+}
 export interface PatchStats {
     patchesApplied: number;
     resourcesFixed: number;
+    /** Failures not in `KNOWN_STALE_PATCHES`. */
     warnings: PatchWarning[];
+    /** Failures listed in `KNOWN_STALE_PATCHES`. */
+    skipped: PatchSkip[];
+    /** `KNOWN_STALE_PATCHES` entries that did not fail: applied, or no such schema or patch file. */
+    retirable: StalePatch[];
 }
 /**
  * Fetch cfn-lint patches from GitHub tarball and extract to cache.
@@ -25,7 +49,7 @@ export declare function fetchCfnLintPatches(force?: boolean): Promise<string>;
  * For each schema, converts type name to directory name and applies
  * manual.json, smithy.json, format.json in order.
  */
-export declare function applyPatches(schemas: Map<string, Buffer>, patchesDir: string): {
+export declare function applyPatches(schemas: Map<string, Buffer>, patchesDir: string, knownStale?: readonly StalePatch[]): {
     schemas: Map<string, Buffer>;
     stats: PatchStats;
 };
@@ -34,4 +58,5 @@ export declare function applyPatches(schemas: Map<string, Buffer>, patchesDir: s
  * AWS::S3::Bucket → aws_s3_bucket
  */
 export declare function typeNameToPatchDir(typeName: string): string;
+export {};
 //# sourceMappingURL=patches.d.ts.map

package/dist/codegen/patches.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patches.d.ts","sourceRoot":"","sources":["../../src/codegen/patches.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAMxE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,GACjB;IAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAqCrD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D"}
+{"version":3,"file":"patches.d.ts","sourceRoot":"","sources":["../../src/codegen/patches.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,QAAA,MAAM,WAAW,YAAI,aAAa,EAAE,aAAa,EAAE,aAAa,CAAU,CAAC;AAE3E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;IACxC,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,mBAAmB,EAAE,SAAS,UAAU,EAYpD,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,6CAA6C;IAC7C,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,gDAAgD;IAChD,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,iGAAiG;IACjG,SAAS,EAAE,UAAU,EAAE,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAMxE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,UAAU,GAAE,SAAS,UAAU,EAAwB,GACtD;IAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAwCrD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/codegen/patches.js

@@ -0,0 +1,90 @@
+/**
+ * cfn-lint patch fetcher and applier.
+ *
+ * Downloads cfn-lint patches from GitHub and applies them to raw schemas
+ * before parsing. This enriches the schemas with additional type information,
+ * enum values, and constraint fixes.
+ */
+import { readFileSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { rfc6902Apply } from "@intentius/chant/codegen/json-patch";
+import { fetchAndExtractTar } from "@intentius/chant/codegen/fetch";
+import { cfnLintTarballUrl, PINNED_VERSIONS } from "./versions.js";
+const CFN_LINT_TARBALL_URL = cfnLintTarballUrl();
+// Keyed by version: the cache lives for 7 days, so an unkeyed directory would
+// keep serving the old release's patches after the pin moves.
+const PATCHES_DEST_DIR = join(homedir(), ".chant", `cfn-lint-patches-${PINNED_VERSIONS.cfnLint}`);
+const PATCHES_TAR_PREFIX = "src/cfnlint/data/schemas/patches/extensions/all/";
+const PATCH_FILES = ["manual.json", "smithy.json", "format.json"];
+export const KNOWN_STALE_PATCHES = [
+    {
+        // Adds `format: ipv4-network` to `Cidr`, a constraint only; no generated
+        // type changes. Every cfn-lint release from v1.32.4 to v1.51.5 still
+        // targets the old name, and v1.52.0 removed the patch tree from cfn-lint
+        // (it moved to aws-cloudformation/resource-provider-enhanced-schemas,
+        // which has the corrected path but publishes only a rolling `latest`).
+        typeName: "AWS::MediaLive::InputSecurityGroup",
+        patchFile: "format.json",
+        cfnLint: "v1.32.4",
+        reason: "the 2026-10-19 spec renamed definition InputWhitelistRuleCidr to InputWhitelistRule (#4144)",
+    },
+];
+/**
+ * Fetch cfn-lint patches from GitHub tarball and extract to cache.
+ * Returns the path to the extracted patches directory.
+ */
+export async function fetchCfnLintPatches(force = false) {
+    return fetchAndExtractTar({ url: CFN_LINT_TARBALL_URL, destDir: PATCHES_DEST_DIR }, PATCHES_TAR_PREFIX, force);
+}
+/**
+ * Apply cfn-lint RFC 6902 patches to raw schema bytes.
+ * For each schema, converts type name to directory name and applies
+ * manual.json, smithy.json, format.json in order.
+ */
+export function applyPatches(schemas, patchesDir, knownStale = KNOWN_STALE_PATCHES) {
+    const stats = { patchesApplied: 0, resourcesFixed: 0, warnings: [], skipped: [], retirable: [] };
+    const staleByKey = new Map(knownStale.map((s) => [`${s.typeName}/${s.patchFile}`, s]));
+    const result = new Map();
+    for (const [typeName, data] of schemas) {
+        const dirName = typeNameToPatchDir(typeName);
+        const patchPath = join(patchesDir, dirName);
+        let patched = data;
+        for (const pf of PATCH_FILES) {
+            const fullPath = join(patchPath, pf);
+            let patchData;
+            try {
+                patchData = readFileSync(fullPath);
+            }
+            catch {
+                continue; // Patch file doesn't exist
+            }
+            try {
+                patched = Buffer.from(rfc6902Apply(patched.toString("utf-8"), patchData.toString("utf-8")));
+                stats.patchesApplied++;
+            }
+            catch (err) {
+                const error = err instanceof Error ? err : new Error(String(err));
+                const stale = staleByKey.get(`${typeName}/${pf}`);
+                if (stale)
+                    stats.skipped.push({ stale, error });
+                else
+                    stats.warnings.push({ typeName, patchFile: pf, error });
+            }
+        }
+        if (patched !== data) {
+            stats.resourcesFixed++;
+        }
+        result.set(typeName, patched);
+    }
+    const skippedStale = new Set(stats.skipped.map((s) => s.stale));
+    stats.retirable = knownStale.filter((s) => !skippedStale.has(s));
+    return { schemas: result, stats };
+}
+/**
+ * Convert CloudFormation type name to cfn-lint patch directory name.
+ * AWS::S3::Bucket → aws_s3_bucket
+ */
+export function typeNameToPatchDir(typeName) {
+    return typeName.replaceAll("::", "_").toLowerCase();
+}

package/dist/codegen/property-overlay.js

@@ -0,0 +1,85 @@
+/**
+ * Backfilled properties (chant #3953).
+ *
+ * The Registry spec is pinned by content (src/spec/pin.ts), so a property AWS
+ * adds after the pin was accepted does not reach the generated types until the
+ * pin moves. Moving it is a reviewed, whole-spec decision: the 2026-08-05 pin
+ * against the October upstream is 185 resource types apart. When one property
+ * is needed before that, it goes here instead of being cast past the types.
+ *
+ * Each entry names a top-level property and the schema fragment to add for it,
+ * copied from the live Registry schema. It is merged into the raw schema before
+ * parsing, so the property reaches the `.d.ts` and the lexicon registry by the
+ * same path a spec property does. The overlay has no way to mark a property
+ * create-only, so it only suits properties that are updatable in place.
+ *
+ * Precedence follows the enum overlay (#1497): where the spec already declares
+ * the property, the spec wins and the entry is reported as redundant, so a pin
+ * bump surfaces the entries it retires.
+ */
+import overlayDocument from "./property-overlay.json" with { type: "json" };
+/** The backfilled entries, in file order. */
+export function propertyOverlayEntries() {
+    return overlayDocument.entries;
+}
+/** Entries grouped by CloudFormation type name. */
+export function propertyOverlayByType(entries = propertyOverlayEntries()) {
+    const byType = new Map();
+    for (const entry of entries) {
+        const list = byType.get(entry.type);
+        if (list)
+            list.push(entry);
+        else
+            byType.set(entry.type, [entry]);
+    }
+    return byType;
+}
+/** Add the entries for one CloudFormation type to its raw schema bytes. */
+export function applyPropertyOverlay(data, entries) {
+    if (entries.length === 0)
+        return { data, applications: [] };
+    const text = typeof data === "string" ? data : data.toString("utf-8");
+    const doc = JSON.parse(text);
+    const properties = (doc.properties ?? (doc.properties = {}));
+    const applications = [];
+    let changed = false;
+    for (const entry of entries) {
+        if (entry.property in properties) {
+            applications.push({ entry, outcome: "redundant" });
+            continue;
+        }
+        properties[entry.property] = structuredClone(entry.schema);
+        changed = true;
+        applications.push({ entry, outcome: "applied" });
+    }
+    if (!changed)
+        return { data, applications };
+    const rewritten = JSON.stringify(doc);
+    return {
+        data: typeof data === "string" ? rewritten : Buffer.from(rewritten),
+        applications,
+    };
+}
+/**
+ * Fail on an entry whose type the run never saw. Only a run over the real
+ * schema zip is strict; a fixture run legitimately lacks most types.
+ */
+export function assertPropertyOverlayCoverage(entries, seenTypes, strict) {
+    if (!strict)
+        return;
+    const missing = [...new Set(entries.filter((e) => !seenTypes.has(e.type)).map((e) => e.type))];
+    if (missing.length === 0)
+        return;
+    throw new Error(`property overlay names type(s) the spec does not contain: ${missing.sort().join(", ")}. ` +
+        `Drop them from src/codegen/property-overlay.json or fix the type name.`);
+}
+/** One warning line per entry the spec has caught up with. */
+export function redundantPropertyOverlayWarnings(applications) {
+    return applications
+        .filter((a) => a.outcome === "redundant")
+        .map((a) => ({
+        file: `${a.entry.type}/properties/${a.entry.property}`,
+        error: `property overlay entry is redundant: the spec already declares this property, ` +
+            `and the spec wins. Retire the entry from src/codegen/property-overlay.json.`,
+    }));
+}