@intentius/chant-lexicon-aws 0.34.0 → 0.37.0

package/dist/index.d.ts

@@ -13,7 +13,8 @@ export type { StackOutput } from "@intentius/chant/stack-output";
 export { output, isLexiconOutput } from "@intentius/chant/lexicon-output";
 export type { LexiconOutput } from "@intentius/chant/lexicon-output";
 export { awsPlugin } from "./plugin.js";
-export { observeResourcesDeepAws, awsDeepNormalizationHooks, parseCloudControlResource, hasOwnershipMarker, DEEP_READABLE_TYPES, AWS_READ_ONLY_NAMES, AWS_SERVICE_DEFAULTS, } from "./deep-observe.js";
+export { observeResourcesDeepAws, awsDeepNormalizationHooks, hasOwnershipMarker, DEEP_READABLE_TYPES, AWS_READ_ONLY_NAMES, AWS_SERVICE_DEFAULTS, } from "./deep-observe.js";
+export { describeStackResources, describeStackOutputs, getResource, listResources, parseResourceDescription, AwsReadError, type AwsReadHttp, type AwsReadClientOptions, type CloudControlDescription, type StackResource, } from "./api/read-client.js";
 export { Sub, Ref, GetAtt, If, Join, Select, Split, Base64, GetAZs, SubIntrinsic, RefIntrinsic, GetAttIntrinsic, IfIntrinsic, JoinIntrinsic, SelectIntrinsic, SplitIntrinsic, Base64Intrinsic, GetAZsIntrinsic, } from "./intrinsics.js";
 export { AWS, StackName, Region, AccountId, StackId, URLSuffix, NoValue, NotificationARNs, Partition, } from "./pseudo.js";
 export * from "./generated/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EACjE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAC3E,kBAAkB,EAClB,eAAe,EAAE,UAAU,EAC3B,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAC1F,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EACzG,uBAAuB,EACvB,oBAAoB,EAAE,eAAe,EACrC,mBAAmB,EAAE,oBAAoB,GAC1C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EACjE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAC3E,kBAAkB,EAClB,eAAe,EAAE,UAAU,EAC3B,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAC1F,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EACzG,uBAAuB,EACvB,oBAAoB,EAAE,eAAe,EACrC,mBAAmB,EAAE,oBAAoB,GAC1C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/integrity.json

@@ -1,9 +1,9 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "3c7b5e21a39f86218b481199f51f2d045af99311e67dbae6d3f4f0a7a3569506",
-    "meta.json": "ffe08a1fc279b969d8760332917ddaa0fdf2eca083f861d608f2c55ee8ec147d",
-    "types/index.d.ts": "cd6ca943e0753ae32530aadad245b72f910990d5ee7244d5e79cf22f9ff0cf1f",
+    "manifest.json": "39b9cb89de0be79ec9f96b84e9ab60369410b4ca7562b4aba91116ac75443ae1",
+    "meta.json": "f430880414df1288383dc91c313e50ecab26d8e7bcce520bf894eeb89b220e9f",
+    "types/index.d.ts": "4d6f07139586f3d7fc4d9ea0756161587709a39e21f20fbdb05e31f32a44f1c1",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
     "rules/iam-wildcard.ts": "135d7217d278fef50939e605c5da32603ba35674b8c4b5c4d66a06c77903e945",
     "rules/s3-encryption.ts": "c4f9f8aa8dc382ed98c7b04e820a600590cc75335a8db2e087cbfbfe4003d09e",
@@ -59,5 +59,5 @@
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "f4c6fe1c702250665f90d82b3bdaba5ea50ae75e380a8ae321dad6eb1c39683e"
   },
-  "composite": "b23b837556489ce43cf6d8ba4ebb13ecf700868ac0cd8698be4af926585915c3"
+  "composite": "ad1f16796cbb0c159d1d7f525c199b3229ac4f427508b0ad4a22cb0ea30a324b"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.34.0",
+  "version": "0.37.0",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/meta.json

@@ -91208,6 +91208,36 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "ServiceSetting": {
+    "resourceType": "AWS::SSM::ServiceSetting",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Status": "Status",
+      "LastModifiedDate": "LastModifiedDate",
+      "LastModifiedUser": "LastModifiedUser",
+      "Arn": "Arn"
+    },
+    "propertyConstraints": {
+      "SettingId": {
+        "minLength": 1,
+        "maxLength": 1000
+      },
+      "SettingValue": {
+        "minLength": 1,
+        "maxLength": 4096
+      },
+      "LastModifiedDate": {
+        "format": "date-time"
+      }
+    },
+    "createOnly": [
+      "SettingId"
+    ],
+    "primaryIdentifier": [
+      "Arn"
+    ]
+  },
   "ServiceSoftwareOptions": {
     "resourceType": "AWS::OpenSearchService::Domain.ServiceSoftwareOptions",
     "kind": "property",

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AA6B5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAWnD,eAAO,MAAM,SAAS,EAAE,aAm5BvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAoC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAWnD,eAAO,MAAM,SAAS,EAAE,aAu5BvB,CAAC"}

package/dist/properties.d.ts

@@ -34,15 +34,31 @@ import type { ResourceMetadata } from "@intentius/chant/lexicon";
 export declare function stampRegion(resources: Record<string, ResourceMetadata>, region?: string): Record<string, ResourceMetadata>;
 /** True when this lexicon can read the kind's own properties. */
 export declare function canDescribe(kind: string): boolean;
+/** What an enrichment pass managed to do, so a caller can tell a miss from a no-op. */
+export interface OwnPropertiesResult {
+    resources: Record<string, ResourceMetadata>;
+    /**
+     * True when enrichment was attempted and *every* kind's read failed — the
+     * transport is unavailable rather than the account being quiet. Callers must
+     * not present the result as a complete observation (#1089).
+     */
+    transportFailed: boolean;
+    /** Why each failed kind failed, keyed by CloudFormation type, so a caller can attribute per resource. */
+    failures: Map<string, string>;
+}
 /**
  * Merge each resource's own properties into an observation, in place of nothing.
  *
- * Best-effort per kind, and per kind only: an endpoint that cannot answer
- * `describe-subnets` still yields instance properties, and a total failure
- * leaves the observation exactly as it arrived. The managed observation is
- * already complete without any of this — these are additional facts about
- * resources chant has already identified, so a miss costs detail, never
- * correctness.
+ * Best-effort per kind: an endpoint that cannot answer `describe-subnets` still
+ * yields instance properties. A miss costs detail — with one exception that used
+ * to be silent and is now reported.
+ *
+ * The exception (#1206): these attributes are compared by `lifecycle diff`, so a
+ * read that fails after the resource is already identified does not degrade to
+ * "less detail", it degrades to *drift* — the snapshot has `GroupId`, the live
+ * read has nothing, and the differ reports the property as removed. A partial
+ * failure still rides the best-effort path, but a total one is a hole the caller
+ * has to declare rather than a thinner set of facts.
  */
-export declare function describeOwnProperties(resources: Record<string, ResourceMetadata>, region?: string): Promise<Record<string, ResourceMetadata>>;
+export declare function describeOwnProperties(resources: Record<string, ResourceMetadata>, region?: string): Promise<OwnPropertiesResult>;
 //# sourceMappingURL=properties.d.ts.map

package/dist/properties.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"properties.d.ts","sourceRoot":"","sources":["../src/properties.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAkCjE;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAUlC;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAgE3C"}
+{"version":3,"file":"properties.d.ts","sourceRoot":"","sources":["../src/properties.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAkCjE;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAUlC;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,yGAAyG;IACzG,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CAyE9B"}

package/dist/types/index.d.ts

@@ -32891,6 +32891,27 @@ export declare class ServiceProfile {
   readonly LoRaWAN_UlRatePolicy: string;
 }
 
+export declare class ServiceSetting {
+  constructor(props: {
+    /** The ID of the service setting, such as /ssm/parameter-store/high-throughput-enabled. */
+    SettingId: string;
+    /** The value of the service setting. */
+    SettingValue: string;
+    /** The ARN of the service setting. */
+    Arn?: string;
+    /** The last time the service setting was modified. */
+    LastModifiedDate?: string;
+    /** The ARN of the last modified user. */
+    LastModifiedUser?: string;
+    /** The status of the service setting. The value can be Default, Customized or PendingUpdate. */
+    Status?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly LastModifiedDate: string;
+  readonly LastModifiedUser: string;
+  readonly Status: string;
+}
+
 export declare class ServiceTemplate {
   constructor(props: {
     /** <p>The Amazon Resource Name (ARN) of the service template.</p> */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.34.0",
+  "version": "0.37.0",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.34.0",
+    "@intentius/chant": "^0.37.0",
     "typescript": "^5.9.3"
   }
 }

package/src/api/read-client.test.ts

@@ -0,0 +1,203 @@
+/**
+ * The native AWS read transport (#1206).
+ *
+ * The transport is injected everywhere, so nothing here reaches a network. The
+ * XML cases are the ones worth being careful about: the applier's `xmlField`
+ * only ever handled flat scalars, and the read path needs `<member>` lists.
+ */
+import { describe, test, expect } from "vitest";
+import {
+  AwsReadError,
+  describeStackOutputs,
+  describeStackResources,
+  getResource,
+  listResources,
+  parseResourceDescription,
+  serviceUrl,
+  xmlLeaves,
+  xmlMembers,
+  xmlError,
+  type AwsReadHttp,
+} from "./read-client";
+
+const respond = (text: string, status = 200): ReturnType<AwsReadHttp> => Promise.resolve({ status, text });
+
+/** Records every call so a test can assert what went on the wire. */
+function recording(handler: (body: string, headers: Record<string, string>) => ReturnType<AwsReadHttp>) {
+  const calls: Array<{ url: string; headers: Record<string, string>; body: string }> = [];
+  const http: AwsReadHttp = (url, init) => {
+    calls.push({ url, headers: init.headers, body: init.body });
+    return handler(init.body, init.headers);
+  };
+  return { http, calls };
+}
+
+const stackXml = `
+<DescribeStackResourcesResponse><DescribeStackResourcesResult><StackResources>
+  <member>
+    <LogicalResourceId>dataBucket</LogicalResourceId>
+    <ResourceType>AWS::S3::Bucket</ResourceType>
+    <PhysicalResourceId>acme-assets</PhysicalResourceId>
+    <ResourceStatus>CREATE_COMPLETE</ResourceStatus>
+    <Timestamp>2026-01-01T00:00:00Z</Timestamp>
+  </member>
+  <member>
+    <LogicalResourceId>vpc</LogicalResourceId>
+    <ResourceType>AWS::EC2::VPC</ResourceType>
+    <PhysicalResourceId>vpc-01</PhysicalResourceId>
+    <ResourceStatus>CREATE_COMPLETE</ResourceStatus>
+  </member>
+</StackResources></DescribeStackResourcesResult></DescribeStackResourcesResponse>`;
+
+describe("serviceUrl", () => {
+  test("an override wins over the regional host, with exactly one trailing slash", () => {
+    expect(serviceUrl("cloudformation", "http://localhost:4566")).toBe("http://localhost:4566/");
+    expect(serviceUrl("cloudformation", "http://localhost:4566/")).toBe("http://localhost:4566/");
+  });
+
+  test("without an override it is the real regional host for that service", () => {
+    expect(serviceUrl("cloudcontrolapi", undefined, "eu-west-1")).toBe("https://cloudcontrolapi.eu-west-1.amazonaws.com/");
+  });
+});
+
+describe("the Query XML shapes", () => {
+  test("xmlLeaves flattens one fragment and decodes entities", () => {
+    expect(xmlLeaves("<A>1</A><B>x &amp; y</B>")).toEqual({ A: "1", B: "x & y" });
+  });
+
+  test("xmlLeaves keeps the first of a repeated tag", () => {
+    expect(xmlLeaves("<A>first</A><A>second</A>")).toEqual({ A: "first" });
+  });
+
+  test("xmlMembers reads a member list, which xmlField never could", () => {
+    expect(xmlMembers(stackXml, "StackResources")).toHaveLength(2);
+  });
+
+  test("xmlMembers is empty for an absent list rather than throwing", () => {
+    expect(xmlMembers("<Response/>", "StackResources")).toEqual([]);
+  });
+
+  test("xmlError finds a Query error document, and nothing in a success body", () => {
+    expect(xmlError("<ErrorResponse><Error><Code>ValidationError</Code><Message>nope</Message></Error></ErrorResponse>")).toEqual({
+      code: "ValidationError",
+      message: "nope",
+    });
+    expect(xmlError(stackXml)).toBeUndefined();
+  });
+});
+
+describe("describeStackResources", () => {
+  test("maps members onto the read path's shape, keeping optional fields optional", async () => {
+    const { http, calls } = recording(() => respond(stackXml));
+    const resources = await describeStackResources("local", { endpoint: "http://localhost:4566", http });
+
+    expect(resources).toEqual([
+      {
+        logicalId: "dataBucket",
+        type: "AWS::S3::Bucket",
+        physicalId: "acme-assets",
+        status: "CREATE_COMPLETE",
+        timestamp: "2026-01-01T00:00:00Z",
+      },
+      { logicalId: "vpc", type: "AWS::EC2::VPC", physicalId: "vpc-01", status: "CREATE_COMPLETE" },
+    ]);
+    expect(calls[0].url).toBe("http://localhost:4566/");
+    expect(calls[0].body).toContain("Action=DescribeStackResources");
+    expect(calls[0].body).toContain("StackName=local");
+  });
+
+  test("a Query error becomes a typed throw carrying the service's own code", async () => {
+    const { http } = recording(() =>
+      respond("<ErrorResponse><Error><Code>ValidationError</Code><Message>Stack with id local does not exist</Message></Error></ErrorResponse>", 400),
+    );
+    await expect(describeStackResources("local", { http })).rejects.toMatchObject({
+      name: "AwsReadError",
+      code: "ValidationError",
+      status: 400,
+    });
+  });
+
+  test("a non-2xx with no error document still throws rather than parsing as empty", async () => {
+    const { http } = recording(() => respond("<html>502</html>", 502));
+    await expect(describeStackResources("local", { http })).rejects.toBeInstanceOf(AwsReadError);
+  });
+});
+
+describe("describeStackOutputs", () => {
+  test("reads the output members as a flat record", async () => {
+    const { http } = recording(() =>
+      respond(`<DescribeStacksResponse><Outputs>
+        <member><OutputKey>VpcId</OutputKey><OutputValue>vpc-01</OutputValue></member>
+        <member><OutputKey>Empty</OutputKey></member>
+      </Outputs></DescribeStacksResponse>`),
+    );
+    expect(await describeStackOutputs("local", { http })).toEqual({ VpcId: "vpc-01", Empty: "" });
+  });
+});
+
+describe("Cloud Control", () => {
+  const description = (identifier: string, properties: Record<string, unknown>) => ({
+    Identifier: identifier,
+    Properties: JSON.stringify(properties),
+  });
+
+  test("getResource unwraps the doubly-encoded model and targets the JSON 1.0 operation", async () => {
+    const { http, calls } = recording(() =>
+      respond(JSON.stringify({ ResourceDescription: description("acme-assets", { BucketName: "acme-assets" }) })),
+    );
+    expect(await getResource("AWS::S3::Bucket", "acme-assets", { http })).toEqual({
+      identifier: "acme-assets",
+      properties: { BucketName: "acme-assets" },
+    });
+    expect(calls[0].headers["x-amz-target"]).toBe("CloudApiService.GetResource");
+    expect(calls[0].headers["content-type"]).toBe("application/x-amz-json-1.0");
+  });
+
+  test("a modelled error becomes a typed throw — UnsupportedOperation is not a miss", async () => {
+    const { http } = recording(() =>
+      respond(JSON.stringify({ __type: "UnsupportedOperation", message: "Operation GetResource is not supported." }), 400),
+    );
+    await expect(getResource("AWS::S3::Bucket", "b", { http })).rejects.toMatchObject({
+      code: "UnsupportedOperation",
+      status: 400,
+    });
+  });
+
+  test("a `__type` carrying a shape prefix is reported by its bare name", async () => {
+    const { http } = recording(() =>
+      respond(JSON.stringify({ __type: "com.amazonaws.cloudapi#ThrottlingException", message: "Rate exceeded" }), 400),
+    );
+    await expect(getResource("AWS::S3::Bucket", "b", { http })).rejects.toMatchObject({ code: "ThrottlingException" });
+  });
+
+  test("listResources follows NextToken to exhaustion", async () => {
+    let page = 0;
+    const { http, calls } = recording(() => {
+      page += 1;
+      return respond(
+        JSON.stringify(
+          page === 1
+            ? { ResourceDescriptions: [description("a", { BucketName: "a" })], NextToken: "more" }
+            : { ResourceDescriptions: [description("b", { BucketName: "b" })] },
+        ),
+      );
+    });
+    const all = await listResources("AWS::S3::Bucket", { http });
+    expect(all.map((r) => r.identifier)).toEqual(["a", "b"]);
+    expect(calls).toHaveLength(2);
+    expect(calls[1].body).toContain("more");
+  });
+
+  test("an unparseable description is dropped, not returned as an empty resource", async () => {
+    const { http } = recording(() =>
+      respond(JSON.stringify({ ResourceDescriptions: [{ Identifier: "a", Properties: "{oops" }] })),
+    );
+    expect(await listResources("AWS::S3::Bucket", { http })).toEqual([]);
+  });
+
+  test("parseResourceDescription refuses anything that is not a model object", () => {
+    expect(parseResourceDescription(null)).toBeNull();
+    expect(parseResourceDescription({ Identifier: "a" })).toBeNull();
+    expect(parseResourceDescription({ Properties: JSON.stringify(["not", "an", "object"]) })).toBeNull();
+  });
+});