@intentius/chant-lexicon-aws 0.18.36 → 0.19.0

package/dist/integrity.json

@@ -1,9 +1,9 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "8c3853140be2403fc990fafc5ddf08d77901c0e59e1ab2b49009fe59a0d64e87",
-    "meta.json": "f753beb9ef6a89191cc76afc3be19f4bc7142751ce6b2d37bea8008bc37c7793",
-    "types/index.d.ts": "22463a37dc0a2e3dd8baf0ddbb72f9e12ec4e5b6dd33ecfe22a1a8a8cff272b9",
+    "manifest.json": "c4fcc55981ac6878554f4afdc25a9b52e36abb57119e5dbc44486a8f70d2f178",
+    "meta.json": "34f746d3e7e7ee7bb2578ac0ec3aa20b67567506620df877191f0f2393f2f98a",
+    "types/index.d.ts": "57e7010c803978f9f16fa9fd9198095d00a86e6a2a87c0dd866f578e3439e41c",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
     "rules/iam-wildcard.ts": "135d7217d278fef50939e605c5da32603ba35674b8c4b5c4d66a06c77903e945",
     "rules/s3-encryption.ts": "c4f9f8aa8dc382ed98c7b04e820a600590cc75335a8db2e087cbfbfe4003d09e",
@@ -56,7 +56,8 @@
     "rules/waw054.ts": "a1a9c1d1d04aebd72e14c01340f6203231d9513add64958edd42366aaa419d42",
     "rules/waw055.ts": "f924e6bca957da1860c7d56dd385d28d91ab57bfd0f1499077d63a9cfc5b81e5",
     "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
-    "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe"
+    "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
+    "skills/chant-aws-carve-terraform.md": "f4c6fe1c702250665f90d82b3bdaba5ea50ae75e380a8ae321dad6eb1c39683e"
   },
-  "composite": "c52c85b1cbb3e694e53b68183c580ba607766c7364cd8bbedd6bd36ddb98778a"
+  "composite": "0cf3e823720dc0c6add6a0781d3e62d00f3cbd265c8656135d41bec3ad4b18a2"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.18.36",
+  "version": "0.19.0",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/meta.json

@@ -3050,6 +3050,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "AllowedWorkloadConfiguration": {
+    "resourceType": "AWS::BedrockAgentCore::Runtime.AllowedWorkloadConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "AlternatePathHint": {
     "resourceType": "AWS::EC2::NetworkInsightsAnalysis.AlternatePathHint",
     "kind": "property",
@@ -17331,6 +17336,21 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "ComputeNodeGroup_NodeLifecycleActions": {
+    "resourceType": "AWS::PCS::ComputeNodeGroup.NodeLifecycleActions",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "ComputeNodeGroup_NodeLifecycleScript": {
+    "resourceType": "AWS::PCS::ComputeNodeGroup.NodeLifecycleScript",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "ComputeNodeGroup_NodeLifecycleStages": {
+    "resourceType": "AWS::PCS::ComputeNodeGroup.NodeLifecycleStages",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "ComputeOptimizerAutomationRule": {
     "resourceType": "AWS::ComputeOptimizer::AutomationRule",
     "kind": "resource",
@@ -25965,6 +25985,93 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "DataTransformationProfile": {
+    "resourceType": "AWS::HealthLake::DataTransformationProfile",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Arn": "Arn",
+      "ProfileId": "ProfileId",
+      "TargetFormat": "TargetFormat"
+    },
+    "propertyConstraints": {
+      "Arn": {
+        "pattern": "^arn:aws(-[a-z]+)*:healthlake:[a-z0-9-]+:[0-9]{12}:dataTransformationProfile/[a-f0-9]{32}$"
+      },
+      "ProfileId": {
+        "pattern": "^[a-f0-9]{32}$",
+        "minLength": 32,
+        "maxLength": 32
+      },
+      "ProfileName": {
+        "minLength": 1,
+        "maxLength": 256
+      },
+      "SourceFormat": {
+        "enum": [
+          "CCDA",
+          "CSV"
+        ]
+      },
+      "TargetFormat": {
+        "enum": [
+          "FHIR_R4"
+        ]
+      },
+      "KmsKeyId": {
+        "minLength": 1,
+        "maxLength": 2048
+      },
+      "ProfileDescription": {
+        "minLength": 0,
+        "maxLength": 1000
+      }
+    },
+    "createOnly": [
+      "ProfileName",
+      "SourceFormat",
+      "Source",
+      "KmsKeyId",
+      "ProfileDescription"
+    ],
+    "writeOnly": [
+      "Source",
+      "KmsKeyId"
+    ],
+    "primaryIdentifier": [
+      "Arn"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
+  },
+  "DataTransformationProfile_ExistingVersionedProfileSource": {
+    "resourceType": "AWS::HealthLake::DataTransformationProfile.ExistingVersionedProfileSource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "DataTransformationProfile_ProfileMappingSource": {
+    "resourceType": "AWS::HealthLake::DataTransformationProfile.ProfileMappingSource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "DataTransformationProfile_Source": {
+    "resourceType": "AWS::HealthLake::DataTransformationProfile.Source",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "DataTransformationProfile_StarterProfileSource": {
+    "resourceType": "AWS::HealthLake::DataTransformationProfile.StarterProfileSource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "DataTransformationProfile_Tag": {
+    "resourceType": "AWS::HealthLake::DataTransformationProfile.Tag",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "DataZoneConnection": {
     "resourceType": "AWS::DataZone::Connection",
     "kind": "resource",
@@ -28930,6 +29037,75 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "DefaultPromptRouter": {
+    "resourceType": "AWS::Bedrock::DefaultPromptRouter",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "PromptRouterArn": "PromptRouterArn",
+      "PromptRouterId": "PromptRouterId",
+      "PromptRouterName": "PromptRouterName",
+      "Description": "Description",
+      "RoutingCriteria": "RoutingCriteria",
+      "FallbackModel": "FallbackModel",
+      "Models": "Models",
+      "Status": "Status",
+      "Type": "Type",
+      "CreatedAt": "CreatedAt",
+      "UpdatedAt": "UpdatedAt"
+    },
+    "propertyConstraints": {
+      "PromptRouterArn": {
+        "pattern": "^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:default-prompt-router/[a-zA-Z0-9-:.]+$",
+        "minLength": 1,
+        "maxLength": 2048
+      },
+      "PromptRouterId": {
+        "minLength": 1,
+        "maxLength": 2048
+      },
+      "PromptRouterName": {
+        "pattern": "^([0-9a-zA-Z][ _-]?)+$",
+        "minLength": 1,
+        "maxLength": 64
+      },
+      "Description": {
+        "pattern": "^([0-9a-zA-Z:.][ _-]?)+$",
+        "minLength": 1,
+        "maxLength": 200
+      },
+      "Status": {
+        "enum": [
+          "AVAILABLE"
+        ]
+      },
+      "Type": {
+        "enum": [
+          "custom",
+          "default"
+        ]
+      },
+      "CreatedAt": {
+        "format": "date-time"
+      },
+      "UpdatedAt": {
+        "format": "date-time"
+      }
+    },
+    "primaryIdentifier": [
+      "PromptRouterArn"
+    ]
+  },
+  "DefaultPromptRouter_PromptRouterTargetModel": {
+    "resourceType": "AWS::Bedrock::DefaultPromptRouter.PromptRouterTargetModel",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "DefaultPromptRouter_RoutingCriteria": {
+    "resourceType": "AWS::Bedrock::DefaultPromptRouter.RoutingCriteria",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "DefaultPushNotificationTemplate": {
     "resourceType": "AWS::Pinpoint::PushTemplate.DefaultPushNotificationTemplate",
     "kind": "property",
@@ -30250,14 +30426,10 @@
     "createOnly": [
       "ServiceType",
       "ServiceDetails/Dynatrace",
-      "ServiceDetails/MCPServer",
       "ServiceDetails/MCPServerSplunk",
-      "ServiceDetails/MCPServerNewRelic",
-      "ServiceDetails/GitLab",
       "ServiceDetails/ServiceNow",
       "ServiceDetails/PagerDuty",
       "ServiceDetails/AzureIdentity",
-      "ServiceDetails/MCPServerGrafana",
       "KmsKeyArn"
     ],
     "writeOnly": [
@@ -37912,6 +38084,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "ExistingVersionedProfileSource": {
+    "resourceType": "AWS::HealthLake::DataTransformationProfile.ExistingVersionedProfileSource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "ExperimentConfig": {
     "resourceType": "AWS::SageMaker::ProcessingJob.ExperimentConfig",
     "kind": "property",
@@ -53601,15 +53778,29 @@
       },
       "HookArn": {
         "pattern": "^arn:aws[A-Za-z0-9-]{0,64}:cloudformation:[A-Za-z0-9-]{1,64}:([0-9]{12})?:type/hook/.+$"
+      },
+      "AutoUpdate": {
+        "default": true
       }
     },
     "createOnly": [
-      "Alias"
+      "Alias",
+      "AutoUpdate",
+      "LoggingConfig"
+    ],
+    "writeOnly": [
+      "AutoUpdate",
+      "LoggingConfig"
     ],
     "primaryIdentifier": [
       "HookArn"
     ]
   },
+  "LambdaHook_LoggingConfig": {
+    "resourceType": "AWS::CloudFormation::LambdaHook.LoggingConfig",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "LambdaLinuxProcessParams": {
     "resourceType": "AWS::GreengrassV2::ComponentVersion.LambdaLinuxProcessParams",
     "kind": "property",
@@ -59080,7 +59271,8 @@
       }
     },
     "createOnly": [
-      "WorkflowName"
+      "WorkflowName",
+      "ResolutionTechniques/EnableRealTimeMatching"
     ],
     "primaryIdentifier": [
       "WorkflowName"
@@ -65451,6 +65643,21 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "NodeLifecycleActions": {
+    "resourceType": "AWS::PCS::ComputeNodeGroup.NodeLifecycleActions",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "NodeLifecycleScript": {
+    "resourceType": "AWS::PCS::ComputeNodeGroup.NodeLifecycleScript",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "NodeLifecycleStages": {
+    "resourceType": "AWS::PCS::ComputeNodeGroup.NodeLifecycleStages",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "NodeOption": {
     "resourceType": "AWS::OpenSearchService::Domain.NodeOption",
     "kind": "property",
@@ -65837,7 +66044,12 @@
     ],
     "primaryIdentifier": [
       "Arn"
-    ]
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
   },
   "NotificationRule_Target": {
     "resourceType": "AWS::CodeStarNotifications::NotificationRule.Target",
@@ -68009,6 +68221,9 @@
     "resourceType": "AWS::Config::OrganizationConformancePack",
     "kind": "resource",
     "lexicon": "aws",
+    "attrs": {
+      "OrganizationConformancePackArn": "OrganizationConformancePackArn"
+    },
     "propertyConstraints": {
       "OrganizationConformancePackName": {
         "pattern": "[a-zA-Z][-a-zA-Z0-9]*",
@@ -68042,13 +68257,23 @@
     ],
     "primaryIdentifier": [
       "OrganizationConformancePackName"
-    ]
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
   },
   "OrganizationConformancePack_ConformancePackInputParameter": {
     "resourceType": "AWS::Config::OrganizationConformancePack.ConformancePackInputParameter",
     "kind": "property",
     "lexicon": "aws"
   },
+  "OrganizationConformancePack_Tag": {
+    "resourceType": "AWS::Config::OrganizationConformancePack.Tag",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "OrganizationCustomPolicyRuleMetadata": {
     "resourceType": "AWS::Config::OrganizationConfigRule.OrganizationCustomPolicyRuleMetadata",
     "kind": "property",
@@ -71612,7 +71837,8 @@
     "kind": "resource",
     "lexicon": "aws",
     "attrs": {
-      "GroupName": "GroupName"
+      "GroupName": "GroupName",
+      "GroupId": "GroupId"
     },
     "createOnly": [
       "Tags",
@@ -73481,6 +73707,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "ProfileMappingSource": {
+    "resourceType": "AWS::HealthLake::DataTransformationProfile.ProfileMappingSource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "ProfilePermission": {
     "resourceType": "AWS::Signer::ProfilePermission",
     "kind": "resource",
@@ -73761,11 +73992,6 @@
     "kind": "property",
     "lexicon": "aws"
   },
-  "PromptRouterTargetModel": {
-    "resourceType": "AWS::Bedrock::IntelligentPromptRouter.PromptRouterTargetModel",
-    "kind": "property",
-    "lexicon": "aws"
-  },
   "PromptVersion": {
     "resourceType": "AWS::Bedrock::PromptVersion",
     "kind": "resource",
@@ -76786,7 +77012,8 @@
     "lexicon": "aws",
     "propertyConstraints": {
       "DBClusterParameterGroupName": {
-        "pattern": "^[a-zA-Z]{1}(?:-?[a-zA-Z0-9])*$"
+        "pattern": "^[a-zA-Z]{1}(?:-?[a-zA-Z0-9])*$",
+        "minLength": 1
       }
     },
     "createOnly": [
@@ -76840,6 +77067,9 @@
     "resourceType": "AWS::RDS::DBSubnetGroup",
     "kind": "resource",
     "lexicon": "aws",
+    "attrs": {
+      "DBSubnetGroupArn": "DBSubnetGroupArn"
+    },
     "createOnly": [
       "DBSubnetGroupName"
     ],
@@ -83275,11 +83505,6 @@
       "RoutingControlArn"
     ]
   },
-  "RoutingCriteria": {
-    "resourceType": "AWS::Bedrock::IntelligentPromptRouter.RoutingCriteria",
-    "kind": "property",
-    "lexicon": "aws"
-  },
   "RoutingProfile": {
     "resourceType": "AWS::Connect::RoutingProfile",
     "kind": "resource",
@@ -83743,6 +83968,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "Runtime_AllowedWorkloadConfiguration": {
+    "resourceType": "AWS::BedrockAgentCore::Runtime.AllowedWorkloadConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "Runtime_AuthorizerConfiguration": {
     "resourceType": "AWS::BedrockAgentCore::Runtime.AuthorizerConfiguration",
     "kind": "property",
@@ -92501,6 +92731,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "StarterProfileSource": {
+    "resourceType": "AWS::HealthLake::DataTransformationProfile.StarterProfileSource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "StateMachine": {
     "resourceType": "AWS::StepFunctions::StateMachine",
     "kind": "resource",

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAA+G,MAAM,0BAA0B,CAAC;AAwB3K;;sFAEsF;AACtF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,aAytBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAA+G,MAAM,0BAA0B,CAAC;AAwB3K;;sFAEsF;AACtF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,aA+vBvB,CAAC"}

package/dist/skills/chant-aws-carve-terraform.md

@@ -0,0 +1,102 @@
+---
+skill: chant-aws-carve-terraform
+description: Demo carving a resource out of Terraform into native chant — advise, emit, bridge, apply — fully offline
+user-invocable: true
+---
+
+# Carve a resource out of Terraform (demo)
+
+Use this skill to cleanly demonstrate chant's Terraform carve-out flow for
+someone. The whole demo runs **offline** — no cloud account, no Terraform
+binary, no state backend. It carves an AWS S3 bucket out of a small Terraform
+estate into native chant source, patches the survivors, and plans the
+graduation.
+
+## When to use
+
+- Someone asks "how does chant move things off Terraform?"
+- You want to show the advise → emit → bridge → apply loop end to end.
+- You are evaluating whether a Terraform estate is worth carving.
+
+## Preconditions
+
+- `chant --version` succeeds.
+- `@cdktf/hcl2json` is installed (the HCL parser). If a command reports it is
+  missing, run `npm install -D @cdktf/hcl2json` once.
+
+## The fastest path: run the bundled demo
+
+The `examples/terraform-carve-out` example ships a runnable estate + state and a
+script that runs all four steps with commentary:
+
+```bash
+cd examples/terraform-carve-out
+./demo.sh
+```
+
+Walk the person through the output. That is the whole demo.
+
+## Driving it step by step (to explain each stage)
+
+From `examples/terraform-carve-out`, with `TF=./terraform`:
+
+1. **Advise — what is cheap to carve.**
+   ```bash
+   chant carve advise --from ./terraform
+   ```
+   Point out the three bands: clean leaves (carve now), carvable with edits,
+   and leave-in-Terraform. `aws_s3_bucket.assets` is a clean leaf held back one
+   notch by the Lambda that reads it; `random_pet` has no native mapping.
+
+2. **Emit — adopt the bucket into chant source, offline, from state.**
+   ```bash
+   chant carve emit --from ./terraform --select aws_s3_bucket.assets \
+     --state ./terraform/terraform.tfstate --output ./carveout
+   ```
+   Show `./carveout/assets.ts` — a real `new Bucket({ BucketName, Tags })` with
+   CloudFormation-style properties mapped from the Terraform state attributes.
+   Explain: a Terraform-managed resource is not in any CloudFormation stack, so
+   the correct source of its live shape is the state file, not a cloud read.
+
+3. **Lint the inherited resource — optional, offer it.**
+   ```bash
+   chant lint ./carveout --lexicon aws
+   ```
+   After emit, offer to lint the carved source. chant audits the resource you
+   inherited from Terraform against the AWS lexicon's rules. Findings have a
+   severity: `error` (must fix before `chant build` will emit — e.g. an S3
+   bucket with no public-access block) and `warning`/`info` (advisory — e.g.
+   DynamoDB point-in-time recovery). This is a feature of carving: chant
+   immediately tells the person what is wrong with what they adopted. Whether to
+   fix an advisory finding is their call; errors block the build until resolved.
+
+4. **Bridge — patch the surviving Terraform.**
+   ```bash
+   chant carve bridge --from ./terraform --select aws_s3_bucket.assets --output ./carveout
+   ```
+   Show the generated `data "aws_s3_bucket" "assets"` and the rewired survivor.
+   Emphasize it is dry-run: nothing in `./terraform` changed. `--apply-rewrites`
+   would edit it in place.
+
+5. **Apply — graduation plan.**
+   ```bash
+   chant carve apply --from ./terraform --select aws_s3_bucket.assets --env prod --stack assets
+   ```
+   Show the ownership marker (`chant:managed-by/stack/env`) and the finalized
+   runbook. Stress this makes no cloud call — the apply is the person's own
+   lifecycle; chant just plans it.
+
+## Key points to land
+
+- Nothing is destroyed or applied; every step before graduation is reversible
+  with `terraform import`.
+- You carve one resource at a time. The gnarly long tail stays in Terraform.
+- `advise` and `bridge` work against **any** Terraform tree — offer to point
+  them at the person's own estate.
+
+## Going live (only if asked)
+
+The real handoff adds three Terraform commands between bridge and apply:
+`terraform state rm <addr>` (stops managing it, does not destroy), then
+`terraform plan && terraform apply` to land the survivor patch. See the
+generated runbook in `./carveout/<addr>-runbook.md`.