@intentius/chant-lexicon-aws 0.34.1 → 0.37.0

package/dist/api/read-client.d.ts

@@ -0,0 +1,108 @@
+/**
+ * The native AWS read transport (#1206) — the read half of what
+ * `op/activities/aws-apply.ts` already does for writes.
+ *
+ * Every AWS observer shelled `aws …` once per entity, serially, and parsed
+ * stderr to find out what went wrong (#1085). The applier does not: `awsApply`
+ * speaks the CloudFormation Query protocol over `fetch`, honours an endpoint
+ * override, and is injectable for tests. This module is that same transport
+ * pointed at the two APIs the read path needs:
+ *
+ *   - **CloudFormation Query** (form-encoded POST, XML back) — the stack reads
+ *     `describeResources` and the deep pass both start from.
+ *   - **Cloud Control** (AWS JSON 1.0, `X-Amz-Target: CloudApiService.*`) — the
+ *     property-level reads (#1015).
+ *
+ * Both take the endpoint the same way the applier does, so `chant emulator` /
+ * behold `--local` keep working by construction rather than by each observer
+ * remembering to inject `--endpoint-url`.
+ *
+ * ## Signing
+ *
+ * Requests are unsigned, exactly like `awsApply`'s. That is what makes the
+ * emulator-first lanes work with no credential plumbing, and it is the reason
+ * this is scoped to the Floci lanes (#1198) rather than announced as a
+ * real-cloud read path: real AWS rejects an unsigned request. The CLI path
+ * remains available for a signed read until SigV4 lands here.
+ */
+/** Injectable HTTP, mirroring `AwsHttp` in the applier so tests avoid the network. */
+export type AwsReadHttp = (url: string, init: {
+    headers: Record<string, string>;
+    body: string;
+}, signal?: AbortSignal) => Promise<{
+    status: number;
+    text: string;
+}>;
+/** A failed read, carrying enough to classify it without parsing prose. */
+export declare class AwsReadError extends Error {
+    readonly status: number;
+    /** The API's own error code (`ValidationError`, `UnsupportedOperation`, …) when it sent one. */
+    readonly code?: string | undefined;
+    constructor(message: string, status: number, 
+    /** The API's own error code (`ValidationError`, `UnsupportedOperation`, …) when it sent one. */
+    code?: string | undefined);
+}
+export interface AwsReadClientOptions {
+    /** Endpoint override (Floci `http://localhost:4566`). Omit for real AWS hosts. */
+    endpoint?: string;
+    /** Region for the real-AWS host and the Query `Version` context. */
+    region?: string;
+    http?: AwsReadHttp;
+    signal?: AbortSignal;
+}
+/** Service host for `service`, honouring an endpoint override. */
+export declare function serviceUrl(service: string, endpoint?: string, region?: string): string;
+/**
+ * The `<Tag>text</Tag>` pairs of one XML fragment, as a flat record. Repeated
+ * tags keep the first occurrence, which is what a `<member>` body wants —
+ * nested lists inside a member are not modelled, because nothing the read path
+ * needs from `DescribeStackResources` / `DescribeStacks` is nested that deep.
+ */
+export declare function xmlLeaves(fragment: string): Record<string, string>;
+/**
+ * Every `<member>…</member>` under `listTag`, each flattened by
+ * {@link xmlLeaves}. The Query protocol renders a list as repeated `<member>`
+ * elements, and `xmlField` in the applier deliberately does not handle them —
+ * it was written for scalar status fields.
+ */
+export declare function xmlMembers(xml: string, listTag: string): Array<Record<string, string>>;
+/** `<Error><Code>…</Code><Message>…</Message></Error>`, when the response carries one. */
+export declare function xmlError(xml: string): {
+    code?: string;
+    message?: string;
+} | undefined;
+/**
+ * One CloudFormation Query call. Returns the raw XML; throws
+ * {@link AwsReadError} for a non-2xx or an `<Error>` body, so a caller
+ * classifies a typed failure instead of matching on stderr.
+ */
+export declare function cfnQuery(action: string, params: Record<string, string>, options?: AwsReadClientOptions): Promise<string>;
+/** One stack resource, as `DescribeStackResources` reports it. */
+export interface StackResource {
+    logicalId: string;
+    type: string;
+    physicalId?: string;
+    status?: string;
+    timestamp?: string;
+}
+/** `DescribeStackResources` for one stack, mapped off the Query XML. */
+export declare function describeStackResources(stackName: string, options?: AwsReadClientOptions): Promise<StackResource[]>;
+/** `DescribeStacks` outputs for one stack, as `key → value`. */
+export declare function describeStackOutputs(stackName: string, options?: AwsReadClientOptions): Promise<Record<string, string>>;
+/** One live resource, as Cloud Control describes it. */
+export interface CloudControlDescription {
+    identifier: string;
+    properties: Record<string, unknown>;
+}
+/**
+ * Cloud Control returns a resource model as a JSON *string* inside the
+ * envelope, so every description unwraps twice. Returns null when either level
+ * does not parse to an object — an unparseable body is a failed read, not an
+ * empty resource.
+ */
+export declare function parseResourceDescription(raw: unknown): CloudControlDescription | null;
+/** `GetResource` — the full live model for one identifier. */
+export declare function getResource(typeName: string, identifier: string, options?: AwsReadClientOptions): Promise<CloudControlDescription | null>;
+/** `ListResources` — every live resource of one type, paginated to exhaustion. */
+export declare function listResources(typeName: string, options?: AwsReadClientOptions): Promise<CloudControlDescription[]>;
+//# sourceMappingURL=read-client.d.ts.map

package/dist/api/read-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,2EAA2E;AAC3E,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBAHtB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,gGAAgG;IACvF,IAAI,CAAC,EAAE,MAAM,YAAA;CAKzB;AAED,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAE9F;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOlE;AAYD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAItF;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAIrF;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,aAAa,EAAE,CAAC,CAS1B;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOjC;AAID,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AA4CD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAQrF;AAWD,8DAA8D;AAC9D,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAGzC;AAED,kFAAkF;AAClF,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAiBpC"}

package/dist/codegen/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0EH;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0iCjF"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA0EH;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA2jCjF"}

package/dist/composites/lambda-function.d.ts

@@ -23,8 +23,8 @@ export type LambdaFunctionResult = {
 export declare const LambdaFunction: import("@intentius/chant").CompositeDefinition<LambdaFunctionProps, LambdaFunctionResult>;
 export declare const LambdaNode: import("@intentius/chant").CompositeDefinition<{
     name: string | ReturnType<typeof Sub>;
-    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Code: ConstructorParameters<typeof Function>[0]["Code"];
+    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Environment?: ConstructorParameters<typeof Function>[0]["Environment"];
     VpcConfig?: ConstructorParameters<typeof Function_VpcConfig>[0] | undefined;
     MemorySize?: number | undefined;
@@ -39,8 +39,8 @@ export declare const LambdaNode: import("@intentius/chant").CompositeDefinition<
 }, LambdaFunctionResult>;
 export declare const LambdaPython: import("@intentius/chant").CompositeDefinition<{
     name: string | ReturnType<typeof Sub>;
-    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Code: ConstructorParameters<typeof Function>[0]["Code"];
+    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Environment?: ConstructorParameters<typeof Function>[0]["Environment"];
     VpcConfig?: ConstructorParameters<typeof Function_VpcConfig>[0] | undefined;
     MemorySize?: number | undefined;
@@ -56,8 +56,8 @@ export declare const LambdaPython: import("@intentius/chant").CompositeDefinitio
 /** @deprecated Use `LambdaNode` instead */
 export declare const NodeLambda: import("@intentius/chant").CompositeDefinition<{
     name: string | ReturnType<typeof Sub>;
-    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Code: ConstructorParameters<typeof Function>[0]["Code"];
+    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Environment?: ConstructorParameters<typeof Function>[0]["Environment"];
     VpcConfig?: ConstructorParameters<typeof Function_VpcConfig>[0] | undefined;
     MemorySize?: number | undefined;
@@ -73,8 +73,8 @@ export declare const NodeLambda: import("@intentius/chant").CompositeDefinition<
 /** @deprecated Use `LambdaPython` instead */
 export declare const PythonLambda: import("@intentius/chant").CompositeDefinition<{
     name: string | ReturnType<typeof Sub>;
-    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Code: ConstructorParameters<typeof Function>[0]["Code"];
+    Policies?: InstanceType<typeof Role_Policy>[] | undefined;
     Environment?: ConstructorParameters<typeof Function>[0]["Environment"];
     VpcConfig?: ConstructorParameters<typeof Function_VpcConfig>[0] | undefined;
     MemorySize?: number | undefined;

package/dist/composites/lambda-function.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lambda-function.d.ts","sourceRoot":"","sources":["../../src/composites/lambda-function.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAkBpC,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IACvE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC;IAC9C,SAAS,CAAC,EAAE,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,IAAI,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,cAAc,2FA6BP,CAAC;AAErB,eAAO,MAAM,UAAU;UApDf,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;eAQ1B,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;UALvC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;kBAGzC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBA0CD,CAAC;AAEH,eAAO,MAAM,YAAY;UAzDjB,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;eAQ1B,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;UALvC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;kBAGzC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBA+CD,CAAC;AAEH,2CAA2C;AAC3C,eAAO,MAAM,UAAU;UA/Df,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;eAQ1B,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;UALvC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;kBAGzC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBAkDiC,CAAC;AACrC,6CAA6C;AAC7C,eAAO,MAAM,YAAY;UAjEjB,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;eAQ1B,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;UALvC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;kBAGzC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBAoDqC,CAAC"}
+{"version":3,"file":"lambda-function.d.ts","sourceRoot":"","sources":["../../src/composites/lambda-function.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAkBpC,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IACvE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC;IAC9C,SAAS,CAAC,EAAE,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,IAAI,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,CAAC;CACrC,CAAC;AAEF,eAAO,MAAM,cAAc,2FA6BP,CAAC;AAErB,eAAO,MAAM,UAAU;UApDf,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBA0CD,CAAC;AAEH,eAAO,MAAM,YAAY;UAzDjB,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBA+CD,CAAC;AAEH,2CAA2C;AAC3C,eAAO,MAAM,UAAU;UA/Df,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBAkDiC,CAAC;AACrC,6CAA6C;AAC7C,eAAO,MAAM,YAAY;UAjEjB,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;UAG/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;eAK5C,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE;kBAF/B,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAG1D,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;iBAJlD,MAAM;cADT,MAAM;wBAGI,MAAM,EAAE;eAGjB;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D;;;wBAoDqC,CAAC"}

package/dist/deep-observe.d.ts

@@ -16,27 +16,80 @@
  * `describe-stack-resources` already reports per logical id, so the results
  * line up with the same IR node ids `live-attrs.ts` relies on.
  *
- * ## Scope of the first cut
+ * ## One reader, several sources (#1269)
  *
- * Four high-signal types (S3 buckets, IAM roles and managed policies, EC2
- * security groups) rather than all 30+. The point of the first row is to prove
- * the contract and the noise rules; widening the type table is additive and
- * needs no contract change. A declared resource of any other type reports
- * NOT-OBSERVED with `unsupported-kind` — it may well exist, and saying nothing
- * about it is the only honest answer.
+ * Cloud Control is the default source, not the only one. It has the property
+ * this reader wants most — it returns the *CloudFormation resource model*, so
+ * its payload lines up with the declared side without translation — but its
+ * coverage is not the same as the provider's. A security group read through
+ * Cloud Control comes back as identity and a description; read through
+ * `ec2 describe-security-groups` it comes back with every ingress and egress
+ * rule, which is the property people actually edit out of band.
+ *
+ * So each type names its source in {@link DEEP_SOURCES}, and a source that is
+ * not Cloud Control supplies a `toModel` that maps the provider's shape onto
+ * the CloudFormation one. Translation is the price of the richer read, and it
+ * belongs next to the type it translates rather than inside the diff.
+ *
+ * A declared resource of a type with no source reports NOT-OBSERVED with
+ * `unsupported-kind` — it may well exist, and saying nothing about it is the
+ * only honest answer.
  *
  * ## Nothing here talks to real AWS on its own terms
  *
- * Every call goes through the runtime adapter's `spawn` and
- * `applyAwsEndpointArgv`, so `AWS_ENDPOINT_URL` redirects the whole reader at a
- * local emulator exactly as the existing describe path does.
+ * Every call goes through `./api/read-client.ts` — the applier's own transport,
+ * pointed at the read APIs (#1206) — so `AWS_ENDPOINT_URL` redirects the whole
+ * reader at a local emulator, with no CLI to spawn and typed failures instead of
+ * parsed stderr.
  */
 import type { DeepNormalizationHooks, DeepObservationResult } from "@intentius/chant/lexicon";
+import { type AwsReadHttp } from "./api/read-client.js";
+/**
+ * Where each type's live model comes from.
+ *
+ * `cloud-control` is addressed by the physical id `describe-stack-resources`
+ * already reports, and needs no translation. An `ec2` source names a bulk
+ * describe — one call for every id of that type, not one per resource — plus
+ * the mapping from the EC2 shape onto the CloudFormation model the declared
+ * side is written in.
+ */
+export type DeepSource = {
+    via: "cloud-control";
+} | {
+    via: "ec2";
+    /** Bulk describe argv, minus the ids and the region. */
+    argv: string[];
+    /** Flag the physical ids are passed under. */
+    idFlag: string;
+    /** Top-level key of the result array. */
+    key: string;
+    /** Field on each row carrying the physical id, for the join back. */
+    id: string;
+    /** EC2 row -> CloudFormation resource model. */
+    toModel: (row: Record<string, unknown>) => Record<string, unknown>;
+};
+export declare const DEEP_SOURCES: Record<string, DeepSource>;
 /**
- * CloudFormation types this reader can read live. Each is addressable in Cloud
- * Control by the physical id CloudFormation already reports.
+ * Types this reader can read live. Derived from {@link DEEP_SOURCES} so the two
+ * cannot drift apart — the shape of bug #1280 is about.
  */
 export declare const DEEP_READABLE_TYPES: ReadonlySet<string>;
+/**
+ * `describe-security-groups` -> the `AWS::EC2::SecurityGroup` resource model.
+ *
+ * The two surfaces disagree about names and about nesting. EC2 says
+ * `Description` where the template says `GroupDescription`, and nests rule
+ * sources under `IpRanges[]` / `Ipv6Ranges[]` / `UserIdGroupPairs[]` where the
+ * template writes one flat rule per source. `toIngressRules` already resolves
+ * the nesting for the topology fold (#1273); this reuses it so there is one
+ * translation of that shape in the lexicon, not two.
+ *
+ * Rules are matched by their whole canonical value (the `orderKey` hook below),
+ * so a field the template carries and this mapping drops is not a smaller diff —
+ * it is every rule reported twice, once absent and once undeclared. That is why
+ * a range's own `Description` is carried through.
+ */
+export declare function securityGroupToModel(row: Record<string, unknown>): Record<string, unknown>;
 /**
  * Property names that are server-populated wherever they appear — identifiers
  * the service mints, timestamps it stamps, counters it maintains. Matched on
@@ -56,6 +109,16 @@ export declare const AWS_READ_ONLY_NAMES: ReadonlySet<string>;
  * the property in the diff, so a later change to it still reports.
  */
 export declare const AWS_SERVICE_DEFAULTS: Record<string, Record<string, unknown>>;
+/**
+ * Names the service mints when a template does not supply one (#1269).
+ *
+ * Unlike {@link AWS_SERVICE_DEFAULTS} there is no fixed value to compare: a
+ * CloudFormation-generated security-group name is a different random string on
+ * every deploy. Pruned on the live side only, and only where source is silent —
+ * a template that names the group keeps the property in the diff, so a later
+ * rename still reports.
+ */
+export declare const AWS_GENERATED_NAMES: Record<string, ReadonlySet<string>>;
 /**
  * The aws lexicon's noise rules. The three classes the epic names for AWS —
  * server-populated fields, unstable ordering (tags, policy statements), and
@@ -63,18 +126,11 @@ export declare const AWS_SERVICE_DEFAULTS: Record<string, Record<string, unknown
  * rule that hides drift.
  */
 export declare const awsDeepNormalizationHooks: DeepNormalizationHooks;
-/** One live resource as `cloudcontrol get-resource` returns it. Exported for tests. */
+/** One live resource as Cloud Control returns it. Exported for tests. */
 export interface CloudControlResource {
     identifier: string;
     properties: Record<string, unknown>;
 }
-/**
- * Parse a `cloudcontrol get-resource` payload. Cloud Control returns the model
- * as a JSON *string* inside the envelope, so this unwraps twice. Returns null
- * for anything that does not parse to an object — an unparseable body is a
- * failed read, not an empty resource.
- */
-export declare function parseCloudControlResource(stdout: string): CloudControlResource | null;
 /** True when the live property tree carries chant's ownership marker tag. */
 export declare function hasOwnershipMarker(properties: Record<string, unknown>): boolean;
 export interface AwsDeepObserveOptions {
@@ -91,16 +147,21 @@ export interface AwsDeepObserveOptions {
      * silently records no properties for them. */
     region?: string;
     owned?: boolean;
+    /** Injectable transport, mirroring `awsApply`'s `http` — tests reach the reader without a network. */
+    http?: AwsReadHttp;
 }
 /**
  * Read the live property tree for each declared entity via Cloud Control.
  *
- * Two reads per run plus one per readable resource: `describe-stack-resources`
- * resolves logical id → (type, physical id), then `cloudcontrol get-resource`
- * fetches each model. The first read's failure modes are the thin path's,
- * verbatim — a stack that does not exist yet is a real absence (nothing is
- * deployed, so there are no properties to drift), anything else is a hole for
- * every declared entity.
+ * Two reads per run plus one per readable resource: `DescribeStackResources`
+ * resolves logical id → (type, physical id), then `GetResource` fetches each
+ * model. The first read's failure modes are the thin path's, verbatim — a stack
+ * that does not exist yet is a real absence (nothing is deployed, so there are
+ * no properties to drift), anything else is a hole for every declared entity.
+ *
+ * The per-resource reads run concurrently (#1201/#1206). They were serial when
+ * each one was a process spawn, which made a deep snapshot of a large stack
+ * cost N round trips end to end.
  */
 export declare function observeResourcesDeepAws(options: AwsDeepObserveOptions): Promise<DeepObservationResult>;
 //# sourceMappingURL=deep-observe.d.ts.map

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,0BAA0B,CAAC;AAKlC;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAKlD,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAkBlD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBxE,CAAC;AAkBF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAmDvC,CAAC;AAMF,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAuBrF;AASD,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAI/E;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;kDAG8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CA4HhC"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAK3B;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,GAAG,EAAE,eAAe,CAAA;CAAE,GACxB;IACE,GAAG,EAAE,KAAK,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpE,CAAC;AAEN,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAenD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AAE3F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAkBlD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBxE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAEnE,CAAC;AAkBF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAiEvC,CAAC;AAMF,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAmED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAI/E;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;kDAG8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAqIhC"}

package/dist/dependencies.d.ts

@@ -22,12 +22,15 @@ interface RawIpPermission {
     ToPort?: number;
     IpRanges?: Array<{
         CidrIp?: string;
+        Description?: string;
     }>;
     Ipv6Ranges?: Array<{
         CidrIpv6?: string;
+        Description?: string;
     }>;
     UserIdGroupPairs?: Array<{
         GroupId?: string;
+        Description?: string;
     }>;
 }
 /**

package/dist/dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAU,MAAM,0BAA0B,CAAC;AAKhG,uEAAuE;AACvE,UAAU,eAAe;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1C,gBAAgB,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmB7F;AASD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6OjC"}
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAU,MAAM,0BAA0B,CAAC;AAKhG,uEAAuE;AACvE,UAAU,eAAe;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,gBAAgB,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAwB7F;AASD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6OjC"}

package/dist/index.d.ts

@@ -13,7 +13,8 @@ export type { StackOutput } from "@intentius/chant/stack-output";
 export { output, isLexiconOutput } from "@intentius/chant/lexicon-output";
 export type { LexiconOutput } from "@intentius/chant/lexicon-output";
 export { awsPlugin } from "./plugin.js";
-export { observeResourcesDeepAws, awsDeepNormalizationHooks, parseCloudControlResource, hasOwnershipMarker, DEEP_READABLE_TYPES, AWS_READ_ONLY_NAMES, AWS_SERVICE_DEFAULTS, } from "./deep-observe.js";
+export { observeResourcesDeepAws, awsDeepNormalizationHooks, hasOwnershipMarker, DEEP_READABLE_TYPES, AWS_READ_ONLY_NAMES, AWS_SERVICE_DEFAULTS, } from "./deep-observe.js";
+export { describeStackResources, describeStackOutputs, getResource, listResources, parseResourceDescription, AwsReadError, type AwsReadHttp, type AwsReadClientOptions, type CloudControlDescription, type StackResource, } from "./api/read-client.js";
 export { Sub, Ref, GetAtt, If, Join, Select, Split, Base64, GetAZs, SubIntrinsic, RefIntrinsic, GetAttIntrinsic, IfIntrinsic, JoinIntrinsic, SelectIntrinsic, SplitIntrinsic, Base64Intrinsic, GetAZsIntrinsic, } from "./intrinsics.js";
 export { AWS, StackName, Region, AccountId, StackId, URLSuffix, NoValue, NotificationARNs, Partition, } from "./pseudo.js";
 export * from "./generated/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EACjE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAC3E,kBAAkB,EAClB,eAAe,EAAE,UAAU,EAC3B,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAC1F,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EACzG,uBAAuB,EACvB,oBAAoB,EAAE,eAAe,EACrC,mBAAmB,EAAE,oBAAoB,GAC1C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EACjE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAC3E,kBAAkB,EAClB,eAAe,EAAE,UAAU,EAC3B,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAC1F,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EACzG,uBAAuB,EACvB,oBAAoB,EAAE,eAAe,EACrC,mBAAmB,EAAE,oBAAoB,GAC1C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "19b9bbcad97c5b76a22524d8a05039ecbca4752d72db220091c254f0afab5380",
+    "manifest.json": "39b9cb89de0be79ec9f96b84e9ab60369410b4ca7562b4aba91116ac75443ae1",
     "meta.json": "f430880414df1288383dc91c313e50ecab26d8e7bcce520bf894eeb89b220e9f",
     "types/index.d.ts": "4d6f07139586f3d7fc4d9ea0756161587709a39e21f20fbdb05e31f32a44f1c1",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
@@ -59,5 +59,5 @@
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "f4c6fe1c702250665f90d82b3bdaba5ea50ae75e380a8ae321dad6eb1c39683e"
   },
-  "composite": "cdde845bc0699082a87af1b7b7558e73c1ddc0db5310eaad60aa26ce8814c41b"
+  "composite": "ad1f16796cbb0c159d1d7f525c199b3229ac4f427508b0ad4a22cb0ea30a324b"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.34.1",
+  "version": "0.37.0",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AA6B5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAWnD,eAAO,MAAM,SAAS,EAAE,aAm5BvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAoC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAWnD,eAAO,MAAM,SAAS,EAAE,aAu5BvB,CAAC"}

package/dist/properties.d.ts

@@ -34,15 +34,31 @@ import type { ResourceMetadata } from "@intentius/chant/lexicon";
 export declare function stampRegion(resources: Record<string, ResourceMetadata>, region?: string): Record<string, ResourceMetadata>;
 /** True when this lexicon can read the kind's own properties. */
 export declare function canDescribe(kind: string): boolean;
+/** What an enrichment pass managed to do, so a caller can tell a miss from a no-op. */
+export interface OwnPropertiesResult {
+    resources: Record<string, ResourceMetadata>;
+    /**
+     * True when enrichment was attempted and *every* kind's read failed — the
+     * transport is unavailable rather than the account being quiet. Callers must
+     * not present the result as a complete observation (#1089).
+     */
+    transportFailed: boolean;
+    /** Why each failed kind failed, keyed by CloudFormation type, so a caller can attribute per resource. */
+    failures: Map<string, string>;
+}
 /**
  * Merge each resource's own properties into an observation, in place of nothing.
  *
- * Best-effort per kind, and per kind only: an endpoint that cannot answer
- * `describe-subnets` still yields instance properties, and a total failure
- * leaves the observation exactly as it arrived. The managed observation is
- * already complete without any of this — these are additional facts about
- * resources chant has already identified, so a miss costs detail, never
- * correctness.
+ * Best-effort per kind: an endpoint that cannot answer `describe-subnets` still
+ * yields instance properties. A miss costs detail — with one exception that used
+ * to be silent and is now reported.
+ *
+ * The exception (#1206): these attributes are compared by `lifecycle diff`, so a
+ * read that fails after the resource is already identified does not degrade to
+ * "less detail", it degrades to *drift* — the snapshot has `GroupId`, the live
+ * read has nothing, and the differ reports the property as removed. A partial
+ * failure still rides the best-effort path, but a total one is a hole the caller
+ * has to declare rather than a thinner set of facts.
  */
-export declare function describeOwnProperties(resources: Record<string, ResourceMetadata>, region?: string): Promise<Record<string, ResourceMetadata>>;
+export declare function describeOwnProperties(resources: Record<string, ResourceMetadata>, region?: string): Promise<OwnPropertiesResult>;
 //# sourceMappingURL=properties.d.ts.map

package/dist/properties.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"properties.d.ts","sourceRoot":"","sources":["../src/properties.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAkCjE;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAUlC;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAgE3C"}
+{"version":3,"file":"properties.d.ts","sourceRoot":"","sources":["../src/properties.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAkCjE;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAUlC;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,yGAAyG;IACzG,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CAyE9B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.34.1",
+  "version": "0.37.0",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.34.1",
+    "@intentius/chant": "^0.37.0",
     "typescript": "^5.9.3"
   }
 }