@intentius/chant-lexicon-aws 0.18.24 → 0.18.26

package/dist/integrity.json

@@ -1,9 +1,9 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "52ae6e9623bc2eb09530f0d3a0cb05da75fb609e718222c532d2fa3883801475",
-    "meta.json": "cfe8a6d95016522d834ea5c50a48f2adbdb95996267985a69a95faeba68f32fa",
-    "types/index.d.ts": "f0255702fde8c1d1a369d4d1d2e164829fcd7155f3d111164414f715df9d6f3e",
+    "manifest.json": "e2dc8ba0e70426d435dcc95b5bf651d1166d5c2cfadee725cc65ffe226f248ea",
+    "meta.json": "08ec32bbf13829bcb558b1dfa4619af934baa0b489d65a7c41854c4659299429",
+    "types/index.d.ts": "b1982c427639aceee20e55ddb5c4ce8a4bec8a07656379ca9957dfd0852d6c35",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
     "rules/iam-wildcard.ts": "135d7217d278fef50939e605c5da32603ba35674b8c4b5c4d66a06c77903e945",
     "rules/s3-encryption.ts": "c4f9f8aa8dc382ed98c7b04e820a600590cc75335a8db2e087cbfbfe4003d09e",
@@ -58,5 +58,5 @@
     "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe"
   },
-  "composite": "5b37014e10761043f71edeeb8bac9371b76b1eadb746a21f2d2375e861a26bfa"
+  "composite": "711c9aba15f177414e01e93e8c64abb8391795796d1f919a1b6490d2b6195885"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.18.24",
+  "version": "0.18.26",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/meta.json

@@ -1887,6 +1887,63 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "Action": {
+    "resourceType": "AWS::SageMaker::Action",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Arn": "Arn",
+      "CreationTime": "CreationTime",
+      "LastModifiedTime": "LastModifiedTime"
+    },
+    "propertyConstraints": {
+      "ActionName": {
+        "pattern": "^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,119}$",
+        "minLength": 1,
+        "maxLength": 120
+      },
+      "ActionType": {
+        "maxLength": 256
+      },
+      "Description": {
+        "maxLength": 3072
+      },
+      "Status": {
+        "enum": [
+          "Unknown",
+          "InProgress",
+          "Completed",
+          "Failed",
+          "Stopping",
+          "Stopped"
+        ]
+      },
+      "Arn": {
+        "pattern": "^arn:aws[a-z\\-]*:sagemaker:[a-z0-9\\-]*:[0-9]{12}:action/",
+        "maxLength": 256
+      },
+      "CreationTime": {
+        "format": "date-time"
+      },
+      "LastModifiedTime": {
+        "format": "date-time"
+      }
+    },
+    "createOnly": [
+      "ActionName",
+      "ActionType",
+      "Source",
+      "MetadataProperties"
+    ],
+    "primaryIdentifier": [
+      "Arn"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
+  },
   "ActionConfiguration": {
     "resourceType": "AWS::QBusiness::DataAccessor.ActionConfiguration",
     "kind": "property",
@@ -1990,6 +2047,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "ActionSource": {
+    "resourceType": "AWS::SageMaker::Action.ActionSource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "ActionThreshold": {
     "resourceType": "AWS::Budgets::BudgetsAction.ActionThreshold",
     "kind": "property",
@@ -2000,6 +2062,21 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "Action_ActionSource": {
+    "resourceType": "AWS::SageMaker::Action.ActionSource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "Action_MetadataProperties": {
+    "resourceType": "AWS::SageMaker::Action.MetadataProperties",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "Action_Tag": {
+    "resourceType": "AWS::SageMaker::Action.Tag",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "Actions": {
     "resourceType": "AWS::Connect::Rule.Actions",
     "kind": "property",
@@ -16798,6 +16875,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "CompactionConfiguration": {
+    "resourceType": "AWS::Glue::TableOptimizer.CompactionConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "ComparativeOrder": {
     "resourceType": "AWS::QuickSight::Topic.ComparativeOrder",
     "kind": "property",
@@ -20908,6 +20990,54 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "Context": {
+    "resourceType": "AWS::SageMaker::Context",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Arn": "Arn",
+      "CreationTime": "CreationTime",
+      "LastModifiedTime": "LastModifiedTime"
+    },
+    "propertyConstraints": {
+      "Arn": {
+        "pattern": "^arn:aws[a-z\\-]*:sagemaker:[a-z0-9\\-]*:[0-9]{12}:context/",
+        "maxLength": 256
+      },
+      "ContextName": {
+        "pattern": "^[a-zA-Z0-9]([-_]*[a-zA-Z0-9]){0,119}$",
+        "minLength": 1,
+        "maxLength": 120
+      },
+      "ContextType": {
+        "minLength": 0,
+        "maxLength": 256
+      },
+      "Description": {
+        "minLength": 0,
+        "maxLength": 3072
+      },
+      "CreationTime": {
+        "format": "date-time"
+      },
+      "LastModifiedTime": {
+        "format": "date-time"
+      }
+    },
+    "createOnly": [
+      "ContextName",
+      "ContextType",
+      "Source"
+    ],
+    "primaryIdentifier": [
+      "Arn"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
+  },
   "ContextEnrichmentConfiguration": {
     "resourceType": "AWS::Bedrock::DataSource.ContextEnrichmentConfiguration",
     "kind": "property",
@@ -46045,6 +46175,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "IcebergCompactionConfiguration": {
+    "resourceType": "AWS::Glue::TableOptimizer.IcebergCompactionConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "IcebergConfiguration": {
     "resourceType": "AWS::Glue::TableOptimizer.IcebergConfiguration",
     "kind": "property",
@@ -94469,6 +94604,16 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "TableOptimizer_CompactionConfiguration": {
+    "resourceType": "AWS::Glue::TableOptimizer.CompactionConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "TableOptimizer_IcebergCompactionConfiguration": {
+    "resourceType": "AWS::Glue::TableOptimizer.IcebergCompactionConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "TableOptimizer_IcebergConfiguration": {
     "resourceType": "AWS::Glue::TableOptimizer.IcebergConfiguration",
     "kind": "property",

package/dist/types/index.d.ts

@@ -419,6 +419,36 @@ export declare class ACMPCAPermission {
   }, attributes?: CFResourceAttributes);
 }
 
+export declare class Action {
+  constructor(props: {
+    /** The name of the action. Must be unique to your account in an AWS Region. */
+    ActionName: string;
+    /** The action type. */
+    ActionType: string;
+    /** The source type, ID, and URI. */
+    Source: Action_ActionSource;
+    /** The Amazon Resource Name (ARN) of the action. */
+    Arn?: string;
+    /** When the action was created. */
+    CreationTime?: string;
+    /** The description of the action. */
+    Description?: string;
+    /** When the action was last modified. */
+    LastModifiedTime?: string;
+    /** Metadata properties of the tracking entity, trial, or trial component. */
+    MetadataProperties?: Action_MetadataProperties;
+    /** A list of properties to add to the action. */
+    Properties?: Record<string, unknown>;
+    /** The status of the action. */
+    Status?: "Completed" | "Failed" | "InProgress" | "Stopped" | "Stopping" | "Unknown";
+    /** A list of tags to apply to the action. */
+    Tags?: Action_Tag[];
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly CreationTime: string;
+  readonly LastModifiedTime: string;
+}
+
 export declare class ActionConnector {
   constructor(props: {
     ActionConnectorId: string;
@@ -7452,6 +7482,32 @@ export declare class ContainerRecipe {
   readonly LatestVersion_Patch: string;
 }
 
+export declare class Context {
+  constructor(props: {
+    /** The name of the context. Must be unique to your account in an AWS Region. */
+    ContextName: string;
+    /** The context type. */
+    ContextType: string;
+    /** The source type, ID, and URI. */
+    Source: Record<string, unknown>;
+    /** The Amazon Resource Name (ARN) of the context. */
+    Arn?: string;
+    /** When the context was created. */
+    CreationTime?: string;
+    /** The description of the context. */
+    Description?: string;
+    /** When the context was last modified. */
+    LastModifiedTime?: string;
+    /** A list of properties to add to the context. */
+    Properties?: Record<string, unknown>;
+    /** A list of tags to apply to the context. */
+    Tags?: Record<string, unknown>[];
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly CreationTime: string;
+  readonly LastModifiedTime: string;
+}
+
 export declare class ContinuousDeploymentPolicy {
   constructor(props: {
     /** Contains the configuration for a continuous deployment policy. */
@@ -8659,30 +8715,30 @@ export declare class DataSyncAgent {
 
 export declare class DataTable {
   constructor(props: {
+    /** The identifier of the Amazon Connect instance. */
+    InstanceArn: string;
+    /** The name of the Data Table */
+    Name: string;
+    /** The status of the Data Table */
+    Status: "PUBLISHED";
+    /** The time zone of the Data Table */
+    TimeZone: string;
+    /** The value lock level of the Data Table */
+    ValueLockLevel: "ATTRIBUTE" | "DATA_TABLE" | "NONE" | "PRIMARY_VALUE" | "VALUE";
     /** The arn of the Data Table */
     Arn?: string;
     /** The creation time of the Data Table */
     CreatedTime?: number;
     /** The description of the Data Table. */
     Description?: string;
-    /** The identifier of the Amazon Connect instance. */
-    InstanceArn?: string;
     /** Last modified region. */
     LastModifiedRegion?: string;
     /** Last modified time. */
     LastModifiedTime?: number;
     /** The lock version of the Data Table */
     LockVersion?: Record<string, unknown>;
-    /** The name of the Data Table */
-    Name?: string;
-    /** The status of the Data Table */
-    Status?: "PUBLISHED";
     /** One or more tags. */
     Tags?: DataTable_Tag[];
-    /** The time zone of the Data Table */
-    TimeZone?: string;
-    /** The value lock level of the Data Table */
-    ValueLockLevel?: "ATTRIBUTE" | "DATA_TABLE" | "NONE" | "PRIMARY_VALUE" | "VALUE";
   }, attributes?: CFResourceAttributes);
   readonly Arn: string;
   readonly CreatedTime: number;
@@ -8693,17 +8749,17 @@ export declare class DataTable {
 
 export declare class DataTableAttribute {
   constructor(props: {
+    DataTableArn: string;
+    InstanceArn: string;
+    Name: string;
+    ValueType: "BOOLEAN" | "NUMBER" | "NUMBER_LIST" | "TEXT" | "TEXT_LIST";
     AttributeId?: string;
-    DataTableArn?: string;
     Description?: string;
-    InstanceArn?: string;
     LastModifiedRegion?: string;
     LastModifiedTime?: number;
     LockVersion?: Record<string, unknown>;
-    Name?: string;
     Primary?: boolean;
     Validation?: Record<string, unknown>;
-    ValueType?: "BOOLEAN" | "NUMBER" | "NUMBER_LIST" | "TEXT" | "TEXT_LIST";
   }, attributes?: CFResourceAttributes);
   readonly AttributeId: string;
   readonly LastModifiedRegion: string;
@@ -8713,9 +8769,9 @@ export declare class DataTableAttribute {
 
 export declare class DataTableRecord {
   constructor(props: {
-    DataTableArn?: string;
-    DataTableRecord?: Record<string, unknown>;
-    InstanceArn?: string;
+    DataTableArn: string;
+    DataTableRecord: Record<string, unknown>;
+    InstanceArn: string;
     RecordId?: string;
   }, attributes?: CFResourceAttributes);
   readonly RecordId: string;
@@ -39051,6 +39107,39 @@ export declare class ACMPCACertificate_Validity {
   });
 }
 
+export declare class Action_ActionSource {
+  constructor(props: {
+    /** The URI of the source. */
+    SourceUri: string;
+    /** The ID of the source. */
+    SourceId?: string;
+    /** The type of the source. */
+    SourceType?: string;
+  });
+}
+
+export declare class Action_MetadataProperties {
+  constructor(props: {
+    /** The commit ID. */
+    CommitId?: string;
+    /** The entity this entity was generated by. */
+    GeneratedBy?: string;
+    /** The project ID. */
+    ProjectId?: string;
+    /** The repository. */
+    Repository?: string;
+  });
+}
+
+export declare class Action_Tag {
+  constructor(props: {
+    /** The tag key. */
+    Key: string;
+    /** The tag value. */
+    Value: string;
+  });
+}
+
 export declare class ActionConfiguration {
   constructor(props: {
     Action: string;
@@ -39177,6 +39266,17 @@ export declare class Actions {
   });
 }
 
+export declare class ActionSource {
+  constructor(props: {
+    /** The URI of the source. */
+    SourceUri: string;
+    /** The ID of the source. */
+    SourceId?: string;
+    /** The type of the source. */
+    SourceType?: string;
+  });
+}
+
 export declare class ActionThreshold {
   constructor(props: {
     Type: "ABSOLUTE_VALUE" | "PERCENTAGE";
@@ -52447,6 +52547,7 @@ export declare class CodeBuildProject_Environment {
     DockerServer?: CodeBuildProject_DockerServer;
     EnvironmentVariables?: CodeBuildProject_EnvironmentVariable[];
     Fleet?: CodeBuildProject_ProjectFleet;
+    HostKernel?: string;
     ImagePullCredentialsType?: string;
     PrivilegedMode?: boolean;
     RegistryCredential?: CodeBuildProject_RegistryCredential;
@@ -53307,6 +53408,12 @@ export declare class Compaction {
   });
 }
 
+export declare class CompactionConfiguration {
+  constructor(props: {
+    IcebergConfiguration?: TableOptimizer_IcebergCompactionConfiguration;
+  });
+}
+
 export declare class ComparativeOrder {
   constructor(props: {
     SpecifedOrder?: string[];
@@ -62908,7 +63015,9 @@ export declare class DeploymentCircuitBreaker {
     Enable: boolean;
     /** Determines whether to configure Amazon ECS to roll back the service if a service deployment fails. If rollback is on, when a service deployment fails, the service is rolled back to the last deployment that completed successfully. */
     Rollback: boolean;
+    /** Specifies whether the deployment circuit breaker resets its failure count when a task reaches a healthy state. When set to ``true``, a task that reaches a healthy state resets the failure count to ``0``. When set to ``false``, Amazon ECS does not reset the failure count. The default is ``true``. */
     ResetOnHealthyTask?: boolean;
+    /** The threshold configuration that controls when the deployment circuit breaker triggers. The ``type`` and ``value`` together determine how many task failures are tolerated before the circuit breaker activates. */
     ThresholdConfiguration?: EcsService_ThresholdConfiguration;
   });
 }
@@ -66284,7 +66393,9 @@ export declare class EcsService_DeploymentCircuitBreaker {
     Enable: boolean;
     /** Determines whether to configure Amazon ECS to roll back the service if a service deployment fails. If rollback is on, when a service deployment fails, the service is rolled back to the last deployment that completed successfully. */
     Rollback: boolean;
+    /** Specifies whether the deployment circuit breaker resets its failure count when a task reaches a healthy state. When set to ``true``, a task that reaches a healthy state resets the failure count to ``0``. When set to ``false``, Amazon ECS does not reset the failure count. The default is ``true``. */
     ResetOnHealthyTask?: boolean;
+    /** The threshold configuration that controls when the deployment circuit breaker triggers. The ``type`` and ``value`` together determine how many task failures are tolerated before the circuit breaker activates. */
     ThresholdConfiguration?: EcsService_ThresholdConfiguration;
   });
 }
@@ -66737,7 +66848,9 @@ export declare class EcsService_Tag {
 
 export declare class EcsService_ThresholdConfiguration {
   constructor(props: {
+    /** Determines how Amazon ECS uses ``value`` to calculate the failure threshold. For the percentage types (``BOUNDED_PERCENT`` and ``UNBOUNDED_PERCENT``), Amazon ECS multiplies ``value`` by the latest service desired count. For ``COUNT``, Amazon ECS uses ``value`` directly as the threshold. The default is ``BOUNDED_PERCENT``. */
     Type: "BOUNDED_PERCENT" | "COUNT" | "UNBOUNDED_PERCENT";
+    /** Specifies the integer that Amazon ECS uses to calculate the failure threshold. When ``type`` is ``COUNT``, this value is the failure threshold itself. When ``type`` is a percentage type, Amazon ECS multiplies this value by the latest service desired count to produce the failure threshold. The default is ``50``. */
     Value: number;
   });
 }
@@ -76585,6 +76698,14 @@ export declare class IbmDb2Settings {
   });
 }
 
+export declare class IcebergCompactionConfiguration {
+  constructor(props: {
+    DeleteFileThreshold?: number;
+    MinInputFiles?: number;
+    Strategy?: string;
+  });
+}
+
 export declare class IcebergConfiguration {
   constructor(props: {
     Location?: string;
@@ -116260,6 +116381,20 @@ export declare class TableInput {
   });
 }
 
+export declare class TableOptimizer_CompactionConfiguration {
+  constructor(props: {
+    IcebergConfiguration?: TableOptimizer_IcebergCompactionConfiguration;
+  });
+}
+
+export declare class TableOptimizer_IcebergCompactionConfiguration {
+  constructor(props: {
+    DeleteFileThreshold?: number;
+    MinInputFiles?: number;
+    Strategy?: string;
+  });
+}
+
 export declare class TableOptimizer_IcebergConfiguration {
   constructor(props: {
     Location?: string;
@@ -116291,6 +116426,7 @@ export declare class TableOptimizer_TableOptimizerConfiguration {
   constructor(props: {
     Enabled: boolean;
     RoleArn: string;
+    CompactionConfiguration?: TableOptimizer_CompactionConfiguration;
     OrphanFileDeletionConfiguration?: TableOptimizer_OrphanFileDeletionConfiguration;
     RetentionConfiguration?: TableOptimizer_RetentionConfiguration;
     VpcConfiguration?: TableOptimizer_VpcConfiguration;
@@ -116307,6 +116443,7 @@ export declare class TableOptimizerConfiguration {
   constructor(props: {
     Enabled: boolean;
     RoleArn: string;
+    CompactionConfiguration?: TableOptimizer_CompactionConfiguration;
     OrphanFileDeletionConfiguration?: TableOptimizer_OrphanFileDeletionConfiguration;
     RetentionConfiguration?: TableOptimizer_RetentionConfiguration;
     VpcConfiguration?: TableOptimizer_VpcConfiguration;
@@ -117964,7 +118101,9 @@ export declare class ThreatIntelSet_TagItem {
 
 export declare class ThresholdConfiguration {
   constructor(props: {
+    /** Determines how Amazon ECS uses ``value`` to calculate the failure threshold. For the percentage types (``BOUNDED_PERCENT`` and ``UNBOUNDED_PERCENT``), Amazon ECS multiplies ``value`` by the latest service desired count. For ``COUNT``, Amazon ECS uses ``value`` directly as the threshold. The default is ``BOUNDED_PERCENT``. */
     Type: "BOUNDED_PERCENT" | "COUNT" | "UNBOUNDED_PERCENT";
+    /** Specifies the integer that Amazon ECS uses to calculate the failure threshold. When ``type`` is ``COUNT``, this value is the failure threshold itself. When ``type`` is a percentage type, Amazon ECS multiplies this value by the latest service desired count to produce the failure threshold. The default is ``50``. */
     Value: number;
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.18.24",
+  "version": "0.18.26",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.18.24",
+    "@intentius/chant": "^0.18.26",
     "typescript": "^5.9.3"
   }
 }

package/src/components/cloud-executor.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { applyAwsEndpoint, applyAwsEndpointArgv, ecsDeploymentId, ecsServiceStable } from "./cloud-executor";
+import { applyAwsEndpoint, applyAwsEndpointArgv, awsDeployCapabilities, ecsDeploymentId, ecsServiceStable } from "./cloud-executor";
 
 describe("ecsDeploymentId / ecsServiceStable — tolerate Floci's missing deployments (#937)", () => {
   test("deployment id: real AWS shape", () => {
@@ -62,3 +62,16 @@ describe("applyAwsEndpointArgv (#926)", () => {
     expect(applyAwsEndpointArgv(["docker", "ps"], url)).toEqual(["docker", "ps"]);
   });
 });
+
+describe("awsDeployCapabilities — CAPABILITY_AUTO_EXPAND for Transform macros", () => {
+  test("plain template → CAPABILITY_NAMED_IAM only", () => {
+    expect(awsDeployCapabilities({})).toBe("CAPABILITY_NAMED_IAM");
+    expect(awsDeployCapabilities({ Transform: undefined })).toBe("CAPABILITY_NAMED_IAM");
+  });
+  test("a top-level Transform → adds CAPABILITY_AUTO_EXPAND", () => {
+    expect(awsDeployCapabilities({ Transform: "AWS::SecretsManager-2020-07-23" })).toBe(
+      "CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND",
+    );
+    expect(awsDeployCapabilities({ Transform: ["AWS::LanguageExtensions"] })).toContain("CAPABILITY_AUTO_EXPAND");
+  });
+});

package/src/components/cloud-executor.ts

@@ -384,6 +384,20 @@ async function cfnChangeSetType(stackName: string): Promise<"CREATE" | "UPDATE">
   }
 }
 
+/**
+ * The `--capabilities` a deploy needs for a template. `CAPABILITY_NAMED_IAM` is
+ * always required (chant emits named IAM roles); `CAPABILITY_AUTO_EXPAND` is added
+ * whenever the template declares a top-level `Transform` macro (e.g.
+ * `AWS::SecretsManager-2020-07-23` for a HostedRotationLambda rotation, or SAM) —
+ * the macro expands into nested stacks/resources during change-set creation, and
+ * CloudFormation refuses without the acknowledgement.
+ */
+export function awsDeployCapabilities(template: { Transform?: unknown }): string {
+  return template.Transform !== undefined
+    ? "CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND"
+    : "CAPABILITY_NAMED_IAM";
+}
+
 const realCloudFormation: CloudFormationClient = {
   async createChangeSet(args) {
     const changeSetName = `cs-${Date.now()}`;
@@ -396,10 +410,14 @@ const realCloudFormation: CloudFormationClient = {
     // for one still in REVIEW_IN_PROGRESS (a prior CREATE change set never
     // executed), mirroring what `aws cloudformation deploy` does under the hood.
     const changeSetType = await cfnChangeSetType(args.stackName);
+    let capabilities = "CAPABILITY_NAMED_IAM";
+    try {
+      capabilities = awsDeployCapabilities(JSON.parse(readFileSync(args.templatePath, "utf8")) as { Transform?: unknown });
+    } catch { /* unreadable/non-JSON template — keep the default capability */ }
     await run(
       `aws cloudformation create-change-set --stack-name ${q(args.stackName)} --change-set-name ${q(changeSetName)} ` +
         `--change-set-type ${changeSetType} ` +
-        `--template-body file://${args.templatePath} --capabilities CAPABILITY_NAMED_IAM${paramFlag}`,
+        `--template-body file://${args.templatePath} --capabilities ${capabilities}${paramFlag}`,
     );
     await run(
       `aws cloudformation wait change-set-create-complete --stack-name ${q(args.stackName)} --change-set-name ${q(changeSetName)}`,