@intentius/chant-lexicon-aws 0.18.25 → 0.18.27

package/dist/types/index.d.ts

@@ -419,6 +419,36 @@ export declare class ACMPCAPermission {
   }, attributes?: CFResourceAttributes);
 }
 
+export declare class Action {
+  constructor(props: {
+    /** The name of the action. Must be unique to your account in an AWS Region. */
+    ActionName: string;
+    /** The action type. */
+    ActionType: string;
+    /** The source type, ID, and URI. */
+    Source: Action_ActionSource;
+    /** The Amazon Resource Name (ARN) of the action. */
+    Arn?: string;
+    /** When the action was created. */
+    CreationTime?: string;
+    /** The description of the action. */
+    Description?: string;
+    /** When the action was last modified. */
+    LastModifiedTime?: string;
+    /** Metadata properties of the tracking entity, trial, or trial component. */
+    MetadataProperties?: Action_MetadataProperties;
+    /** A list of properties to add to the action. */
+    Properties?: Record<string, unknown>;
+    /** The status of the action. */
+    Status?: "Completed" | "Failed" | "InProgress" | "Stopped" | "Stopping" | "Unknown";
+    /** A list of tags to apply to the action. */
+    Tags?: Action_Tag[];
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly CreationTime: string;
+  readonly LastModifiedTime: string;
+}
+
 export declare class ActionConnector {
   constructor(props: {
     ActionConnectorId: string;
@@ -7452,6 +7482,32 @@ export declare class ContainerRecipe {
   readonly LatestVersion_Patch: string;
 }
 
+export declare class Context {
+  constructor(props: {
+    /** The name of the context. Must be unique to your account in an AWS Region. */
+    ContextName: string;
+    /** The context type. */
+    ContextType: string;
+    /** The source type, ID, and URI. */
+    Source: Record<string, unknown>;
+    /** The Amazon Resource Name (ARN) of the context. */
+    Arn?: string;
+    /** When the context was created. */
+    CreationTime?: string;
+    /** The description of the context. */
+    Description?: string;
+    /** When the context was last modified. */
+    LastModifiedTime?: string;
+    /** A list of properties to add to the context. */
+    Properties?: Record<string, unknown>;
+    /** A list of tags to apply to the context. */
+    Tags?: Record<string, unknown>[];
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly CreationTime: string;
+  readonly LastModifiedTime: string;
+}
+
 export declare class ContinuousDeploymentPolicy {
   constructor(props: {
     /** Contains the configuration for a continuous deployment policy. */
@@ -27461,6 +27517,39 @@ export declare class QuickSightFlow {
   readonly StepAliases: QuickSightFlow_StepAliasMapping[];
 }
 
+export declare class QuickSightKnowledgeBase {
+  constructor(props: {
+    AwsAccountId: string;
+    DataSourceArn: string;
+    KnowledgeBaseConfiguration: QuickSightKnowledgeBase_KnowledgeBaseConfiguration;
+    KnowledgeBaseId: string;
+    Name: string;
+    AccessControlConfiguration?: QuickSightKnowledgeBase_AccessControlConfiguration;
+    CreatedAt?: string;
+    Description?: string;
+    DocumentCount?: number;
+    IsEmailNotificationOptedForIngestionFailures?: boolean;
+    KnowledgeBaseArn?: string;
+    KnowledgeBaseSizeBytes?: number;
+    MediaExtractionConfiguration?: QuickSightKnowledgeBase_MediaExtractionConfiguration;
+    Permissions?: QuickSightKnowledgeBase_ResourcePermission[];
+    PrimaryOwnerArn?: string;
+    PrimaryOwnerUsername?: string;
+    Status?: QuickSightKnowledgeBase_DataSetStatus;
+    Tags?: QuickSightKnowledgeBase_Tag[];
+    Type?: string;
+    UpdatedAt?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly CreatedAt: string;
+  readonly DocumentCount: number;
+  readonly KnowledgeBaseArn: string;
+  readonly KnowledgeBaseSizeBytes: number;
+  readonly PrimaryOwnerUsername: string;
+  readonly Status: QuickSightKnowledgeBase_DataSetStatus;
+  readonly Type: string;
+  readonly UpdatedAt: string;
+}
+
 export declare class QuickSightTemplate {
   constructor(props: {
     AwsAccountId: string;
@@ -35305,6 +35394,55 @@ export declare class TransferWorkflow {
   readonly WorkflowId: string;
 }
 
+export declare class TransformJob {
+  constructor(props: {
+    /** The name of the model that you want to use for the transform job. */
+    ModelName: string;
+    /** Describes the input source and the way the transform job consumes it. */
+    TransformInput: Record<string, unknown>;
+    /** The name of the transform job. The name must be unique within an AWS Region in an AWS account. */
+    TransformJobName: string;
+    /** Describes the results of the transform job. */
+    TransformOutput: Record<string, unknown>;
+    /** Describes the resources, including ML instance types and ML instance count, to use for the transform job. */
+    TransformResources: Record<string, unknown>;
+    /** Specifies the number of records to include in a mini-batch for an HTTP inference request. */
+    BatchStrategy?: "MultiRecord" | "SingleRecord";
+    /** A timestamp that shows when the transform job was created. */
+    CreationTime?: string;
+    /** Configuration to control how SageMaker captures inference data. */
+    DataCaptureConfig?: Record<string, unknown>;
+    /** The data structure used to specify the data to be used for inference in a batch transform job. */
+    DataProcessing?: Record<string, unknown>;
+    /** The environment variables to set in the Docker container. */
+    Environment?: Record<string, unknown>;
+    /** Associates a SageMaker job as a trial component with an experiment and trial. */
+    ExperimentConfig?: Record<string, unknown>;
+    /** The maximum number of parallel requests that can be sent to each instance in a transform job. */
+    MaxConcurrentTransforms?: number;
+    /** The maximum allowed size of the payload, in MB. */
+    MaxPayloadInMB?: number;
+    /** Configures the timeout and maximum number of retries for processing a transform job invocation. */
+    ModelClientConfig?: Record<string, unknown>;
+    /** An array of key-value pairs. */
+    Tags?: Record<string, unknown>[];
+    /** Indicates when the transform job has been completed, or has stopped or failed. */
+    TransformEndTime?: string;
+    /** The Amazon Resource Name (ARN) of the transform job. */
+    TransformJobArn?: string;
+    /** The status of the transform job. */
+    TransformJobStatus?: "Completed" | "Failed" | "InProgress" | "Stopped" | "Stopping";
+    /** Indicates when the transform job starts on ML instances. */
+    TransformStartTime?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly CreationTime: string;
+  readonly TransformEndTime: string;
+  readonly TransformJobArn: string;
+  readonly TransformJobName: string;
+  readonly TransformJobStatus: "Completed" | "Failed" | "InProgress" | "Stopped" | "Stopping";
+  readonly TransformStartTime: string;
+}
+
 export declare class TransitGateway {
   constructor(props: {
     AmazonSideAsn?: number;
@@ -38544,6 +38682,12 @@ export declare class AccessControlAllowOrigins {
   });
 }
 
+export declare class AccessControlConfiguration {
+  constructor(props: {
+    IsACLEnabled?: boolean;
+  });
+}
+
 export declare class AccessControlExposeHeaders {
   constructor(props: {
     /** The list of HTTP headers. You can specify ``*`` to expose all headers. */
@@ -39051,6 +39195,39 @@ export declare class ACMPCACertificate_Validity {
   });
 }
 
+export declare class Action_ActionSource {
+  constructor(props: {
+    /** The URI of the source. */
+    SourceUri: string;
+    /** The ID of the source. */
+    SourceId?: string;
+    /** The type of the source. */
+    SourceType?: string;
+  });
+}
+
+export declare class Action_MetadataProperties {
+  constructor(props: {
+    /** The commit ID. */
+    CommitId?: string;
+    /** The entity this entity was generated by. */
+    GeneratedBy?: string;
+    /** The project ID. */
+    ProjectId?: string;
+    /** The repository. */
+    Repository?: string;
+  });
+}
+
+export declare class Action_Tag {
+  constructor(props: {
+    /** The tag key. */
+    Key: string;
+    /** The tag value. */
+    Value: string;
+  });
+}
+
 export declare class ActionConfiguration {
   constructor(props: {
     Action: string;
@@ -39177,6 +39354,17 @@ export declare class Actions {
   });
 }
 
+export declare class ActionSource {
+  constructor(props: {
+    /** The URI of the source. */
+    SourceUri: string;
+    /** The ID of the source. */
+    SourceId?: string;
+    /** The type of the source. */
+    SourceType?: string;
+  });
+}
+
 export declare class ActionThreshold {
   constructor(props: {
     Type: "ABSOLUTE_VALUE" | "PERCENTAGE";
@@ -44528,12 +44716,6 @@ export declare class AudioDescription {
   });
 }
 
-export declare class AudioExtractionConfiguration {
-  constructor(props: {
-    AudioExtractionStatus: QBusinessDataSource_AudioExtractionStatus;
-  });
-}
-
 export declare class AudioFeedInput {
   constructor(props: {
     AudioSelectorName?: string;
@@ -52447,6 +52629,7 @@ export declare class CodeBuildProject_Environment {
     DockerServer?: CodeBuildProject_DockerServer;
     EnvironmentVariables?: CodeBuildProject_EnvironmentVariable[];
     Fleet?: CodeBuildProject_ProjectFleet;
+    HostKernel?: string;
     ImagePullCredentialsType?: string;
     PrivilegedMode?: boolean;
     RegistryCredential?: CodeBuildProject_RegistryCredential;
@@ -53307,6 +53490,12 @@ export declare class Compaction {
   });
 }
 
+export declare class CompactionConfiguration {
+  constructor(props: {
+    IcebergConfiguration?: TableOptimizer_IcebergCompactionConfiguration;
+  });
+}
+
 export declare class ComparativeOrder {
   constructor(props: {
     SpecifedOrder?: string[];
@@ -62908,7 +63097,9 @@ export declare class DeploymentCircuitBreaker {
     Enable: boolean;
     /** Determines whether to configure Amazon ECS to roll back the service if a service deployment fails. If rollback is on, when a service deployment fails, the service is rolled back to the last deployment that completed successfully. */
     Rollback: boolean;
+    /** Specifies whether the deployment circuit breaker resets its failure count when a task reaches a healthy state. When set to ``true``, a task that reaches a healthy state resets the failure count to ``0``. When set to ``false``, Amazon ECS does not reset the failure count. The default is ``true``. */
     ResetOnHealthyTask?: boolean;
+    /** The threshold configuration that controls when the deployment circuit breaker triggers. The ``type`` and ``value`` together determine how many task failures are tolerated before the circuit breaker activates. */
     ThresholdConfiguration?: EcsService_ThresholdConfiguration;
   });
 }
@@ -66284,7 +66475,9 @@ export declare class EcsService_DeploymentCircuitBreaker {
     Enable: boolean;
     /** Determines whether to configure Amazon ECS to roll back the service if a service deployment fails. If rollback is on, when a service deployment fails, the service is rolled back to the last deployment that completed successfully. */
     Rollback: boolean;
+    /** Specifies whether the deployment circuit breaker resets its failure count when a task reaches a healthy state. When set to ``true``, a task that reaches a healthy state resets the failure count to ``0``. When set to ``false``, Amazon ECS does not reset the failure count. The default is ``true``. */
     ResetOnHealthyTask?: boolean;
+    /** The threshold configuration that controls when the deployment circuit breaker triggers. The ``type`` and ``value`` together determine how many task failures are tolerated before the circuit breaker activates. */
     ThresholdConfiguration?: EcsService_ThresholdConfiguration;
   });
 }
@@ -66737,7 +66930,9 @@ export declare class EcsService_Tag {
 
 export declare class EcsService_ThresholdConfiguration {
   constructor(props: {
+    /** Determines how Amazon ECS uses ``value`` to calculate the failure threshold. For the percentage types (``BOUNDED_PERCENT`` and ``UNBOUNDED_PERCENT``), Amazon ECS multiplies ``value`` by the latest service desired count. For ``COUNT``, Amazon ECS uses ``value`` directly as the threshold. The default is ``BOUNDED_PERCENT``. */
     Type: "BOUNDED_PERCENT" | "COUNT" | "UNBOUNDED_PERCENT";
+    /** Specifies the integer that Amazon ECS uses to calculate the failure threshold. When ``type`` is ``COUNT``, this value is the failure threshold itself. When ``type`` is a percentage type, Amazon ECS multiplies this value by the latest service desired count to produce the failure threshold. The default is ``50``. */
     Value: number;
   });
 }
@@ -76585,6 +76780,14 @@ export declare class IbmDb2Settings {
   });
 }
 
+export declare class IcebergCompactionConfiguration {
+  constructor(props: {
+    DeleteFileThreshold?: number;
+    MinInputFiles?: number;
+    Strategy?: string;
+  });
+}
+
 export declare class IcebergConfiguration {
   constructor(props: {
     Location?: string;
@@ -77420,12 +77623,6 @@ export declare class ImageConfigurationInput {
   });
 }
 
-export declare class ImageExtractionConfiguration {
-  constructor(props: {
-    ImageExtractionStatus: QBusinessDataSource_ImageExtractionStatus;
-  });
-}
-
 export declare class ImageLoggingConfiguration {
   constructor(props: {
     /** The name of the log group for image build logs. */
@@ -81948,6 +82145,12 @@ export declare class KafkaSettings {
   });
 }
 
+export declare class KbTemplateConfiguration {
+  constructor(props: {
+    Template?: any;
+  });
+}
+
 export declare class KendraConfiguration {
   constructor(props: {
     KendraIndex: string;
@@ -83104,16 +83307,6 @@ export declare class KmsKey_Tag {
   });
 }
 
-export declare class KnowledgeBaseConfiguration {
-  constructor(props: {
-    Type: BedrockKnowledgeBase_KnowledgeBaseType;
-    KendraKnowledgeBaseConfiguration?: BedrockKnowledgeBase_KendraKnowledgeBaseConfiguration;
-    ManagedKnowledgeBaseConfiguration?: BedrockKnowledgeBase_ManagedKnowledgeBaseConfiguration;
-    SqlKnowledgeBaseConfiguration?: BedrockKnowledgeBase_SqlKnowledgeBaseConfiguration;
-    VectorKnowledgeBaseConfiguration?: BedrockKnowledgeBase_VectorKnowledgeBaseConfiguration;
-  });
-}
-
 export declare class KubernetesNetworkConfig {
   constructor(props: {
     /** Todo: add description */
@@ -102298,6 +102491,84 @@ export declare class QuickSightFlow_StepAliasMapping {
   });
 }
 
+export declare class QuickSightKnowledgeBase_AccessControlConfiguration {
+  constructor(props: {
+    IsACLEnabled?: boolean;
+  });
+}
+
+export declare class QuickSightKnowledgeBase_AudioExtractionConfiguration {
+  constructor(props: {
+    AudioExtractionStatus: QuickSightKnowledgeBase_AudioExtractionStatus;
+  });
+}
+
+export declare class QuickSightKnowledgeBase_ImageExtractionConfiguration {
+  constructor(props: {
+    ImageExtractionStatus: QuickSightKnowledgeBase_ImageExtractionStatus;
+  });
+}
+
+export declare class QuickSightKnowledgeBase_KbTemplateConfiguration {
+  constructor(props: {
+    Template?: any;
+  });
+}
+
+export declare class QuickSightKnowledgeBase_KnowledgeBaseConfiguration {
+  constructor(props: {
+    TemplateConfiguration?: QuickSightKnowledgeBase_KbTemplateConfiguration;
+  });
+}
+
+export declare class QuickSightKnowledgeBase_MediaExtractionConfiguration {
+  constructor(props: {
+    AudioExtractionConfiguration?: QuickSightKnowledgeBase_AudioExtractionConfiguration;
+    ImageExtractionConfiguration?: QuickSightKnowledgeBase_ImageExtractionConfiguration;
+    VideoExtractionConfiguration?: QuickSightKnowledgeBase_VideoExtractionConfiguration;
+  });
+}
+
+export declare class QuickSightKnowledgeBase_ResourcePermission {
+  constructor(props: {
+    /** <p>The IAM action to grant or revoke permissions on.</p> */
+    Actions: string[];
+    /** <p>The Amazon Resource Name (ARN) of the principal. This can be one of the
+            following:</p>
+         <ul>
+            <li>
+               <p>The ARN of an Amazon Quick user or group associated with a data source or dataset. (This is common.)</p>
+            </li>
+            <li>
+               <p>The ARN of an Amazon Quick user, group, or namespace associated with an analysis, dashboard, template, or theme. (This is common.)</p>
+            </li>
+            <li>
+               <p>The ARN of an Amazon Web Services account root: This is an IAM ARN rather than a QuickSight
+                    ARN. Use this option only to share resources (templates) across Amazon Web Services accounts.
+                    (This is less common.) </p>
+            </li>
+         </ul> */
+    Principal: string;
+    Resource?: string;
+  });
+}
+
+export declare class QuickSightKnowledgeBase_Tag {
+  constructor(props: {
+    /** <p>Tag key.</p> */
+    Key: string;
+    /** <p>Tag value.</p> */
+    Value: string;
+  });
+}
+
+export declare class QuickSightKnowledgeBase_VideoExtractionConfiguration {
+  constructor(props: {
+    VideoExtractionStatus: QuickSightKnowledgeBase_VideoExtractionStatus;
+    VideoExtractionType?: QuickSightKnowledgeBase_VideoExtractionType;
+  });
+}
+
 export declare class QuickSightTemplate_AnalysisDefaults {
   constructor(props: {
     DefaultNewSheetConfiguration: QuickSightTemplate_DefaultNewSheetConfiguration;
@@ -116260,6 +116531,20 @@ export declare class TableInput {
   });
 }
 
+export declare class TableOptimizer_CompactionConfiguration {
+  constructor(props: {
+    IcebergConfiguration?: TableOptimizer_IcebergCompactionConfiguration;
+  });
+}
+
+export declare class TableOptimizer_IcebergCompactionConfiguration {
+  constructor(props: {
+    DeleteFileThreshold?: number;
+    MinInputFiles?: number;
+    Strategy?: string;
+  });
+}
+
 export declare class TableOptimizer_IcebergConfiguration {
   constructor(props: {
     Location?: string;
@@ -116291,6 +116576,7 @@ export declare class TableOptimizer_TableOptimizerConfiguration {
   constructor(props: {
     Enabled: boolean;
     RoleArn: string;
+    CompactionConfiguration?: TableOptimizer_CompactionConfiguration;
     OrphanFileDeletionConfiguration?: TableOptimizer_OrphanFileDeletionConfiguration;
     RetentionConfiguration?: TableOptimizer_RetentionConfiguration;
     VpcConfiguration?: TableOptimizer_VpcConfiguration;
@@ -116307,6 +116593,7 @@ export declare class TableOptimizerConfiguration {
   constructor(props: {
     Enabled: boolean;
     RoleArn: string;
+    CompactionConfiguration?: TableOptimizer_CompactionConfiguration;
     OrphanFileDeletionConfiguration?: TableOptimizer_OrphanFileDeletionConfiguration;
     RetentionConfiguration?: TableOptimizer_RetentionConfiguration;
     VpcConfiguration?: TableOptimizer_VpcConfiguration;
@@ -117964,7 +118251,9 @@ export declare class ThreatIntelSet_TagItem {
 
 export declare class ThresholdConfiguration {
   constructor(props: {
+    /** Determines how Amazon ECS uses ``value`` to calculate the failure threshold. For the percentage types (``BOUNDED_PERCENT`` and ``UNBOUNDED_PERCENT``), Amazon ECS multiplies ``value`` by the latest service desired count. For ``COUNT``, Amazon ECS uses ``value`` directly as the threshold. The default is ``BOUNDED_PERCENT``. */
     Type: "BOUNDED_PERCENT" | "COUNT" | "UNBOUNDED_PERCENT";
+    /** Specifies the integer that Amazon ECS uses to calculate the failure threshold. When ``type`` is ``COUNT``, this value is the failure threshold itself. When ``type`` is a percentage type, Amazon ECS multiplies this value by the latest service desired count to produce the failure threshold. The default is ``50``. */
     Value: number;
   });
 }
@@ -121128,12 +121417,6 @@ export declare class VideoDescription {
   });
 }
 
-export declare class VideoExtractionConfiguration {
-  constructor(props: {
-    VideoExtractionStatus: QBusinessDataSource_VideoExtractionStatus;
-  });
-}
-
 export declare class VideoMonitoringSetting {
   constructor(props: {
     BlackFrames?: MediaConnectFlow_BlackFrames;
@@ -126731,6 +127014,8 @@ export type BedrockAgentCoreGateway_AuthorizerType =
 
 export type BedrockAgentCoreGateway_ClaimMatchOperator = "CONTAINS" | "CONTAINS_ANY" | "EQUALS";
 
+export type BedrockAgentCoreGateway_EndpointIpAddressType = "IPV4" | "IPV6";
+
 export type BedrockAgentCoreGateway_ExceptionLevel = "DEBUG";
 
 export type BedrockAgentCoreGateway_GatewayInterceptionPoint = "REQUEST" | "RESPONSE";
@@ -128828,7 +129113,8 @@ export type KinesisStream_EnhancedMetric =
 export type LambdaCapacityProvider_Architecture = "arm64" | "x86_64";
 
 export type LambdaCapacityProvider_CapacityProviderPredefinedMetricType =
-  | "LambdaCapacityProviderAverageCPUUtilization";
+  | "LambdaCapacityProviderAverageCPUUtilization"
+  | "LambdaCapacityProviderAverageGPUUtilization";
 
 export type LambdaCapacityProvider_CapacityProviderScalingMode = "Auto" | "Manual";
 
@@ -130493,6 +130779,23 @@ export type QuickSightDataSource_StarburstProductType = "ENTERPRISE" | "GALAXY";
 
 export type QuickSightFlow_FlowPublishState = "DRAFT" | "PENDING_APPROVAL" | "PUBLISHED";
 
+export type QuickSightKnowledgeBase_AudioExtractionStatus = "DISABLED" | "ENABLED";
+
+export type QuickSightKnowledgeBase_DataSetStatus =
+  | "ACTIVE"
+  | "CREATING"
+  | "DELETING"
+  | "FAILED"
+  | "UPDATING";
+
+export type QuickSightKnowledgeBase_ImageExtractionStatus = "DISABLED" | "ENABLED";
+
+export type QuickSightKnowledgeBase_VideoExtractionStatus = "DISABLED" | "ENABLED";
+
+export type QuickSightKnowledgeBase_VideoExtractionType =
+  | "AUDIO_TRANSCRIPTION_ONLY"
+  | "VISUAL_CONTENT_AND_AUDIO_TRANSCRIPTION";
+
 export type QuickSightTemplate_AnchorOption = "NOW";
 
 export type QuickSightTemplate_ArcThickness = "LARGE" | "MEDIUM" | "SMALL" | "WHOLE";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.18.25",
-  "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
+  "version": "0.18.27",
+  "description": "AWS CloudFormation lexicon for chant \u2014 declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
   "repository": {
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.18.25",
+    "@intentius/chant": "^0.18.27",
     "typescript": "^5.9.3"
   }
 }

package/src/components/cloud-executor.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { applyAwsEndpoint, applyAwsEndpointArgv, ecsDeploymentId, ecsServiceStable } from "./cloud-executor";
+import { applyAwsEndpoint, applyAwsEndpointArgv, awsDeployCapabilities, ecsDeploymentId, ecsServiceStable } from "./cloud-executor";
 
 describe("ecsDeploymentId / ecsServiceStable — tolerate Floci's missing deployments (#937)", () => {
   test("deployment id: real AWS shape", () => {
@@ -62,3 +62,16 @@ describe("applyAwsEndpointArgv (#926)", () => {
     expect(applyAwsEndpointArgv(["docker", "ps"], url)).toEqual(["docker", "ps"]);
   });
 });
+
+describe("awsDeployCapabilities — CAPABILITY_AUTO_EXPAND for Transform macros", () => {
+  test("plain template → CAPABILITY_NAMED_IAM only", () => {
+    expect(awsDeployCapabilities({})).toBe("CAPABILITY_NAMED_IAM");
+    expect(awsDeployCapabilities({ Transform: undefined })).toBe("CAPABILITY_NAMED_IAM");
+  });
+  test("a top-level Transform → adds CAPABILITY_AUTO_EXPAND", () => {
+    expect(awsDeployCapabilities({ Transform: "AWS::SecretsManager-2020-07-23" })).toBe(
+      "CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND",
+    );
+    expect(awsDeployCapabilities({ Transform: ["AWS::LanguageExtensions"] })).toContain("CAPABILITY_AUTO_EXPAND");
+  });
+});

package/src/components/cloud-executor.ts

@@ -384,6 +384,20 @@ async function cfnChangeSetType(stackName: string): Promise<"CREATE" | "UPDATE">
   }
 }
 
+/**
+ * The `--capabilities` a deploy needs for a template. `CAPABILITY_NAMED_IAM` is
+ * always required (chant emits named IAM roles); `CAPABILITY_AUTO_EXPAND` is added
+ * whenever the template declares a top-level `Transform` macro (e.g.
+ * `AWS::SecretsManager-2020-07-23` for a HostedRotationLambda rotation, or SAM) —
+ * the macro expands into nested stacks/resources during change-set creation, and
+ * CloudFormation refuses without the acknowledgement.
+ */
+export function awsDeployCapabilities(template: { Transform?: unknown }): string {
+  return template.Transform !== undefined
+    ? "CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND"
+    : "CAPABILITY_NAMED_IAM";
+}
+
 const realCloudFormation: CloudFormationClient = {
   async createChangeSet(args) {
     const changeSetName = `cs-${Date.now()}`;
@@ -396,10 +410,14 @@ const realCloudFormation: CloudFormationClient = {
     // for one still in REVIEW_IN_PROGRESS (a prior CREATE change set never
     // executed), mirroring what `aws cloudformation deploy` does under the hood.
     const changeSetType = await cfnChangeSetType(args.stackName);
+    let capabilities = "CAPABILITY_NAMED_IAM";
+    try {
+      capabilities = awsDeployCapabilities(JSON.parse(readFileSync(args.templatePath, "utf8")) as { Transform?: unknown });
+    } catch { /* unreadable/non-JSON template — keep the default capability */ }
     await run(
       `aws cloudformation create-change-set --stack-name ${q(args.stackName)} --change-set-name ${q(changeSetName)} ` +
         `--change-set-type ${changeSetType} ` +
-        `--template-body file://${args.templatePath} --capabilities CAPABILITY_NAMED_IAM${paramFlag}`,
+        `--template-body file://${args.templatePath} --capabilities ${capabilities}${paramFlag}`,
     );
     await run(
       `aws cloudformation wait change-set-create-complete --stack-name ${q(args.stackName)} --change-set-name ${q(changeSetName)}`,