@intentius/chant-lexicon-aws 0.34.0 → 0.37.0

package/dist/api/read-client.d.ts

@@ -0,0 +1,108 @@
+/**
+ * The native AWS read transport (#1206) — the read half of what
+ * `op/activities/aws-apply.ts` already does for writes.
+ *
+ * Every AWS observer shelled `aws …` once per entity, serially, and parsed
+ * stderr to find out what went wrong (#1085). The applier does not: `awsApply`
+ * speaks the CloudFormation Query protocol over `fetch`, honours an endpoint
+ * override, and is injectable for tests. This module is that same transport
+ * pointed at the two APIs the read path needs:
+ *
+ *   - **CloudFormation Query** (form-encoded POST, XML back) — the stack reads
+ *     `describeResources` and the deep pass both start from.
+ *   - **Cloud Control** (AWS JSON 1.0, `X-Amz-Target: CloudApiService.*`) — the
+ *     property-level reads (#1015).
+ *
+ * Both take the endpoint the same way the applier does, so `chant emulator` /
+ * behold `--local` keep working by construction rather than by each observer
+ * remembering to inject `--endpoint-url`.
+ *
+ * ## Signing
+ *
+ * Requests are unsigned, exactly like `awsApply`'s. That is what makes the
+ * emulator-first lanes work with no credential plumbing, and it is the reason
+ * this is scoped to the Floci lanes (#1198) rather than announced as a
+ * real-cloud read path: real AWS rejects an unsigned request. The CLI path
+ * remains available for a signed read until SigV4 lands here.
+ */
+/** Injectable HTTP, mirroring `AwsHttp` in the applier so tests avoid the network. */
+export type AwsReadHttp = (url: string, init: {
+    headers: Record<string, string>;
+    body: string;
+}, signal?: AbortSignal) => Promise<{
+    status: number;
+    text: string;
+}>;
+/** A failed read, carrying enough to classify it without parsing prose. */
+export declare class AwsReadError extends Error {
+    readonly status: number;
+    /** The API's own error code (`ValidationError`, `UnsupportedOperation`, …) when it sent one. */
+    readonly code?: string | undefined;
+    constructor(message: string, status: number, 
+    /** The API's own error code (`ValidationError`, `UnsupportedOperation`, …) when it sent one. */
+    code?: string | undefined);
+}
+export interface AwsReadClientOptions {
+    /** Endpoint override (Floci `http://localhost:4566`). Omit for real AWS hosts. */
+    endpoint?: string;
+    /** Region for the real-AWS host and the Query `Version` context. */
+    region?: string;
+    http?: AwsReadHttp;
+    signal?: AbortSignal;
+}
+/** Service host for `service`, honouring an endpoint override. */
+export declare function serviceUrl(service: string, endpoint?: string, region?: string): string;
+/**
+ * The `<Tag>text</Tag>` pairs of one XML fragment, as a flat record. Repeated
+ * tags keep the first occurrence, which is what a `<member>` body wants —
+ * nested lists inside a member are not modelled, because nothing the read path
+ * needs from `DescribeStackResources` / `DescribeStacks` is nested that deep.
+ */
+export declare function xmlLeaves(fragment: string): Record<string, string>;
+/**
+ * Every `<member>…</member>` under `listTag`, each flattened by
+ * {@link xmlLeaves}. The Query protocol renders a list as repeated `<member>`
+ * elements, and `xmlField` in the applier deliberately does not handle them —
+ * it was written for scalar status fields.
+ */
+export declare function xmlMembers(xml: string, listTag: string): Array<Record<string, string>>;
+/** `<Error><Code>…</Code><Message>…</Message></Error>`, when the response carries one. */
+export declare function xmlError(xml: string): {
+    code?: string;
+    message?: string;
+} | undefined;
+/**
+ * One CloudFormation Query call. Returns the raw XML; throws
+ * {@link AwsReadError} for a non-2xx or an `<Error>` body, so a caller
+ * classifies a typed failure instead of matching on stderr.
+ */
+export declare function cfnQuery(action: string, params: Record<string, string>, options?: AwsReadClientOptions): Promise<string>;
+/** One stack resource, as `DescribeStackResources` reports it. */
+export interface StackResource {
+    logicalId: string;
+    type: string;
+    physicalId?: string;
+    status?: string;
+    timestamp?: string;
+}
+/** `DescribeStackResources` for one stack, mapped off the Query XML. */
+export declare function describeStackResources(stackName: string, options?: AwsReadClientOptions): Promise<StackResource[]>;
+/** `DescribeStacks` outputs for one stack, as `key → value`. */
+export declare function describeStackOutputs(stackName: string, options?: AwsReadClientOptions): Promise<Record<string, string>>;
+/** One live resource, as Cloud Control describes it. */
+export interface CloudControlDescription {
+    identifier: string;
+    properties: Record<string, unknown>;
+}
+/**
+ * Cloud Control returns a resource model as a JSON *string* inside the
+ * envelope, so every description unwraps twice. Returns null when either level
+ * does not parse to an object — an unparseable body is a failed read, not an
+ * empty resource.
+ */
+export declare function parseResourceDescription(raw: unknown): CloudControlDescription | null;
+/** `GetResource` — the full live model for one identifier. */
+export declare function getResource(typeName: string, identifier: string, options?: AwsReadClientOptions): Promise<CloudControlDescription | null>;
+/** `ListResources` — every live resource of one type, paginated to exhaustion. */
+export declare function listResources(typeName: string, options?: AwsReadClientOptions): Promise<CloudControlDescription[]>;
+//# sourceMappingURL=read-client.d.ts.map

package/dist/api/read-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,2EAA2E;AAC3E,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBAHtB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,gGAAgG;IACvF,IAAI,CAAC,EAAE,MAAM,YAAA;CAKzB;AAED,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAE9F;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOlE;AAYD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAItF;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAIrF;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,aAAa,EAAE,CAAC,CAS1B;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOjC;AAID,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AA4CD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAQrF;AAWD,8DAA8D;AAC9D,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAGzC;AAED,kFAAkF;AAClF,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAiBpC"}

package/dist/codegen/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0EH;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0iCjF"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0EH;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA2jCjF"}

package/dist/composites/lambda-function.d.ts

@@ -23,8 +23,8 @@ export type LambdaFunctionResult = {
 export declare const LambdaFunction: import("@intentius/chant").CompositeDefinition<LambdaFunctionProps, LambdaFunctionResult>;
 export declare const LambdaNode: import("@intentius/chant").CompositeDefinition<{
     name: string | ReturnType<typeof Sub>;
-    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Code: ConstructorParameters<typeof Function>[0]["Code"];
+    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Environment?: ConstructorParameters<typeof Function>[0]["Environment"];
     VpcConfig?: ConstructorParameters<typeof Function_VpcConfig>[0] | undefined;
     MemorySize?: number | undefined;
@@ -39,8 +39,8 @@ export declare const LambdaNode: import("@intentius/chant").CompositeDefinition<
 }, LambdaFunctionResult>;
 export declare const LambdaPython: import("@intentius/chant").CompositeDefinition<{
     name: string | ReturnType<typeof Sub>;
-    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Code: ConstructorParameters<typeof Function>[0]["Code"];
+    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Environment?: ConstructorParameters<typeof Function>[0]["Environment"];
     VpcConfig?: ConstructorParameters<typeof Function_VpcConfig>[0] | undefined;
     MemorySize?: number | undefined;
@@ -56,8 +56,8 @@ export declare const LambdaPython: import("@intentius/chant").CompositeDefinitio
 /** @deprecated Use `LambdaNode` instead */
 export declare const NodeLambda: import("@intentius/chant").CompositeDefinition<{
     name: string | ReturnType<typeof Sub>;
-    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Code: ConstructorParameters<typeof Function>[0]["Code"];
+    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Environment?: ConstructorParameters<typeof Function>[0]["Environment"];
     VpcConfig?: ConstructorParameters<typeof Function_VpcConfig>[0] | undefined;
     MemorySize?: number | undefined;
@@ -73,8 +73,8 @@ export declare const NodeLambda: import("@intentius/chant").CompositeDefinition<
 /** @deprecated Use `LambdaPython` instead */
 export declare const PythonLambda: import("@intentius/chant").CompositeDefinition<{
     name: string | ReturnType<typeof Sub>;
-    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Code: ConstructorParameters<typeof Function>[0]["Code"];
+    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Environment?: ConstructorParameters<typeof Function>[0]["Environment"];
     VpcConfig?: ConstructorParameters<typeof Function_VpcConfig>[0] | undefined;
     MemorySize?: number | undefined;

package/dist/composites/lambda-function.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lambda-function.d.ts","sourceRoot":"","sources":["../../src/composites/lambda-function.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAkBpC,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IACvE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC;IAC9C,SAAS,CAAC,EAAE,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,IAAI,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,cAAc,2FA6BP,CAAC;AAErB,eAAO,MAAM,UAAU;UApDf,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;eAQ1B,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;UALvC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;kBAGzC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBA0CD,CAAC;AAEH,eAAO,MAAM,YAAY;UAzDjB,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;eAQ1B,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;UALvC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;kBAGzC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBA+CD,CAAC;AAEH,2CAA2C;AAC3C,eAAO,MAAM,UAAU;UA/Df,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;eAQ1B,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;UALvC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;kBAGzC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBAkDiC,CAAC;AACrC,6CAA6C;AAC7C,eAAO,MAAM,YAAY;UAjEjB,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;eAQ1B,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;UALvC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;kBAGzC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBAoDqC,CAAC"}
+{"version":3,"file":"lambda-function.d.ts","sourceRoot":"","sources":["../../src/composites/lambda-function.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAkBpC,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IACvE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC;IAC9C,SAAS,CAAC,EAAE,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,IAAI,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,cAAc,2FA6BP,CAAC;AAErB,eAAO,MAAM,UAAU;UApDf,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBA0CD,CAAC;AAEH,eAAO,MAAM,YAAY;UAzDjB,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBA+CD,CAAC;AAEH,2CAA2C;AAC3C,eAAO,MAAM,UAAU;UA/Df,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBAkDiC,CAAC;AACrC,6CAA6C;AAC7C,eAAO,MAAM,YAAY;UAjEjB,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBAoDqC,CAAC"}

package/dist/deep-observe.d.ts

@@ -16,27 +16,80 @@
  * `describe-stack-resources` already reports per logical id, so the results
  * line up with the same IR node ids `live-attrs.ts` relies on.
  *
- * ## Scope of the first cut
+ * ## One reader, several sources (#1269)
  *
- * Four high-signal types (S3 buckets, IAM roles and managed policies, EC2
- * security groups) rather than all 30+. The point of the first row is to prove
- * the contract and the noise rules; widening the type table is additive and
- * needs no contract change. A declared resource of any other type reports
- * NOT-OBSERVED with `unsupported-kind` — it may well exist, and saying nothing
- * about it is the only honest answer.
+ * Cloud Control is the default source, not the only one. It has the property
+ * this reader wants most — it returns the *CloudFormation resource model*, so
+ * its payload lines up with the declared side without translation — but its
+ * coverage is not the same as the provider's. A security group read through
+ * Cloud Control comes back as identity and a description; read through
+ * `ec2 describe-security-groups` it comes back with every ingress and egress
+ * rule, which is the property people actually edit out of band.
+ *
+ * So each type names its source in {@link DEEP_SOURCES}, and a source that is
+ * not Cloud Control supplies a `toModel` that maps the provider's shape onto
+ * the CloudFormation one. Translation is the price of the richer read, and it
+ * belongs next to the type it translates rather than inside the diff.
+ *
+ * A declared resource of a type with no source reports NOT-OBSERVED with
+ * `unsupported-kind` — it may well exist, and saying nothing about it is the
+ * only honest answer.
  *
  * ## Nothing here talks to real AWS on its own terms
  *
- * Every call goes through the runtime adapter's `spawn` and
- * `applyAwsEndpointArgv`, so `AWS_ENDPOINT_URL` redirects the whole reader at a
- * local emulator exactly as the existing describe path does.
+ * Every call goes through `./api/read-client.ts` — the applier's own transport,
+ * pointed at the read APIs (#1206) — so `AWS_ENDPOINT_URL` redirects the whole
+ * reader at a local emulator, with no CLI to spawn and typed failures instead of
+ * parsed stderr.
  */
 import type { DeepNormalizationHooks, DeepObservationResult } from "@intentius/chant/lexicon";
+import { type AwsReadHttp } from "./api/read-client.js";
+/**
+ * Where each type's live model comes from.
+ *
+ * `cloud-control` is addressed by the physical id `describe-stack-resources`
+ * already reports, and needs no translation. An `ec2` source names a bulk
+ * describe — one call for every id of that type, not one per resource — plus
+ * the mapping from the EC2 shape onto the CloudFormation model the declared
+ * side is written in.
+ */
+export type DeepSource = {
+    via: "cloud-control";
+} | {
+    via: "ec2";
+    /** Bulk describe argv, minus the ids and the region. */
+    argv: string[];
+    /** Flag the physical ids are passed under. */
+    idFlag: string;
+    /** Top-level key of the result array. */
+    key: string;
+    /** Field on each row carrying the physical id, for the join back. */
+    id: string;
+    /** EC2 row -> CloudFormation resource model. */
+    toModel: (row: Record<string, unknown>) => Record<string, unknown>;
+};
+export declare const DEEP_SOURCES: Record<string, DeepSource>;
 /**
- * CloudFormation types this reader can read live. Each is addressable in Cloud
- * Control by the physical id CloudFormation already reports.
+ * Types this reader can read live. Derived from {@link DEEP_SOURCES} so the two
+ * cannot drift apart — the shape of bug #1280 is about.
  */
 export declare const DEEP_READABLE_TYPES: ReadonlySet<string>;
+/**
+ * `describe-security-groups` -> the `AWS::EC2::SecurityGroup` resource model.
+ *
+ * The two surfaces disagree about names and about nesting. EC2 says
+ * `Description` where the template says `GroupDescription`, and nests rule
+ * sources under `IpRanges[]` / `Ipv6Ranges[]` / `UserIdGroupPairs[]` where the
+ * template writes one flat rule per source. `toIngressRules` already resolves
+ * the nesting for the topology fold (#1273); this reuses it so there is one
+ * translation of that shape in the lexicon, not two.
+ *
+ * Rules are matched by their whole canonical value (the `orderKey` hook below),
+ * so a field the template carries and this mapping drops is not a smaller diff —
+ * it is every rule reported twice, once absent and once undeclared. That is why
+ * a range's own `Description` is carried through.
+ */
+export declare function securityGroupToModel(row: Record<string, unknown>): Record<string, unknown>;
 /**
  * Property names that are server-populated wherever they appear — identifiers
  * the service mints, timestamps it stamps, counters it maintains. Matched on
@@ -56,6 +109,16 @@ export declare const AWS_READ_ONLY_NAMES: ReadonlySet<string>;
  * the property in the diff, so a later change to it still reports.
  */
 export declare const AWS_SERVICE_DEFAULTS: Record<string, Record<string, unknown>>;
+/**
+ * Names the service mints when a template does not supply one (#1269).
+ *
+ * Unlike {@link AWS_SERVICE_DEFAULTS} there is no fixed value to compare: a
+ * CloudFormation-generated security-group name is a different random string on
+ * every deploy. Pruned on the live side only, and only where source is silent —
+ * a template that names the group keeps the property in the diff, so a later
+ * rename still reports.
+ */
+export declare const AWS_GENERATED_NAMES: Record<string, ReadonlySet<string>>;
 /**
  * The aws lexicon's noise rules. The three classes the epic names for AWS —
  * server-populated fields, unstable ordering (tags, policy statements), and
@@ -63,18 +126,11 @@ export declare const AWS_SERVICE_DEFAULTS: Record<string, Record<string, unknown
  * rule that hides drift.
  */
 export declare const awsDeepNormalizationHooks: DeepNormalizationHooks;
-/** One live resource as `cloudcontrol get-resource` returns it. Exported for tests. */
+/** One live resource as Cloud Control returns it. Exported for tests. */
 export interface CloudControlResource {
     identifier: string;
     properties: Record<string, unknown>;
 }
-/**
- * Parse a `cloudcontrol get-resource` payload. Cloud Control returns the model
- * as a JSON *string* inside the envelope, so this unwraps twice. Returns null
- * for anything that does not parse to an object — an unparseable body is a
- * failed read, not an empty resource.
- */
-export declare function parseCloudControlResource(stdout: string): CloudControlResource | null;
 /** True when the live property tree carries chant's ownership marker tag. */
 export declare function hasOwnershipMarker(properties: Record<string, unknown>): boolean;
 export interface AwsDeepObserveOptions {
@@ -91,16 +147,21 @@ export interface AwsDeepObserveOptions {
      * silently records no properties for them. */
     region?: string;
     owned?: boolean;
+    /** Injectable transport, mirroring `awsApply`'s `http` — tests reach the reader without a network. */
+    http?: AwsReadHttp;
 }
 /**
  * Read the live property tree for each declared entity via Cloud Control.
  *
- * Two reads per run plus one per readable resource: `describe-stack-resources`
- * resolves logical id → (type, physical id), then `cloudcontrol get-resource`
- * fetches each model. The first read's failure modes are the thin path's,
- * verbatim — a stack that does not exist yet is a real absence (nothing is
- * deployed, so there are no properties to drift), anything else is a hole for
- * every declared entity.
+ * Two reads per run plus one per readable resource: `DescribeStackResources`
+ * resolves logical id → (type, physical id), then `GetResource` fetches each
+ * model. The first read's failure modes are the thin path's, verbatim — a stack
+ * that does not exist yet is a real absence (nothing is deployed, so there are
+ * no properties to drift), anything else is a hole for every declared entity.
+ *
+ * The per-resource reads run concurrently (#1201/#1206). They were serial when
+ * each one was a process spawn, which made a deep snapshot of a large stack
+ * cost N round trips end to end.
  */
 export declare function observeResourcesDeepAws(options: AwsDeepObserveOptions): Promise<DeepObservationResult>;
 //# sourceMappingURL=deep-observe.d.ts.map

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,0BAA0B,CAAC;AAKlC;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAKlD,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAkBlD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBxE,CAAC;AAkBF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAmDvC,CAAC;AAMF,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAuBrF;AASD,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAI/E;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;kDAG8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CA4HhC"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAK3B;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,GAAG,EAAE,eAAe,CAAA;CAAE,GACxB;IACE,GAAG,EAAE,KAAK,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpE,CAAC;AAEN,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAenD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AAE3F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAkBlD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBxE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAEnE,CAAC;AAkBF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAiEvC,CAAC;AAMF,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAmED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAI/E;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;kDAG8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAqIhC"}

package/dist/dependencies.d.ts

@@ -22,12 +22,15 @@ interface RawIpPermission {
     ToPort?: number;
     IpRanges?: Array<{
         CidrIp?: string;
+        Description?: string;
     }>;
     Ipv6Ranges?: Array<{
         CidrIpv6?: string;
+        Description?: string;
     }>;
     UserIdGroupPairs?: Array<{
         GroupId?: string;
+        Description?: string;
     }>;
 }
 /**

package/dist/dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAU,MAAM,0BAA0B,CAAC;AAKhG,uEAAuE;AACvE,UAAU,eAAe;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1C,gBAAgB,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmB7F;AASD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6OjC"}
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAU,MAAM,0BAA0B,CAAC;AAKhG,uEAAuE;AACvE,UAAU,eAAe;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,gBAAgB,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAwB7F;AASD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6OjC"}

package/dist/generated/index.d.ts

@@ -1353,6 +1353,7 @@ export declare const ServiceNetworkServiceAssociation: new (props: Record<string
 export declare const ServiceNetworkVpcAssociation: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
 export declare const ServicePrincipalName: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
 export declare const ServiceProfile: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
+export declare const ServiceSetting: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
 export declare const ServiceTemplate: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
 export declare const SESConfigurationSet: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;
 export declare const SESConfigurationSetEventDestination: new (props: Record<string, unknown>, attributes?: Record<string, unknown>) => import("packages/core/src").Declarable & Record<string, string>;