@intentius/chant-lexicon-aws 0.37.1 → 0.38.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "919d024bfe36da3435a4e8b28e94b3d3aa75e093f4d4b65fabb5cbf2a9a96d62",
+    "manifest.json": "95bf7ddba781fb01df8e17f73ff1c8d8beae128136f3458fb83b4757f44f2cf1",
     "meta.json": "f430880414df1288383dc91c313e50ecab26d8e7bcce520bf894eeb89b220e9f",
     "types/index.d.ts": "4d6f07139586f3d7fc4d9ea0756161587709a39e21f20fbdb05e31f32a44f1c1",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
@@ -59,5 +59,5 @@
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "f4c6fe1c702250665f90d82b3bdaba5ea50ae75e380a8ae321dad6eb1c39683e"
   },
-  "composite": "034351de5b76706e1b33852470ec6813a2df36bfa0fef5c9781e778f5dd78b85"
+  "composite": "5a99ab85d8ba103ccf99396616ea95d3df082a490cc5076429f4b2633ddf9ec9"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.37.1",
+  "version": "0.38.0",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/op/activities/floci.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"floci.d.ts","sourceRoot":"","sources":["../../../src/op/activities/floci.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AASpG,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO7E;AAaD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,EAAE,YAAkD,CAAC;AAE5E;4DAC4D;AAC5D,eAAO,MAAM,cAAc,EAAE,kBAQ5B,CAAC;AAMF,eAAO,MAAM,kBAAkB,0BAAyB,CAAC;AACzD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AACjD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AAEjD,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,IAAI,GAAE,WAAgB,GAAG,MAAM,CAO9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,OAAO,CAAC,IAAI,GAAE,WAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBzG;AAED,kFAAkF;AAClF,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F"}
+{"version":3,"file":"floci.d.ts","sourceRoot":"","sources":["../../../src/op/activities/floci.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAapG,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO7E;AAcD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,EAAE,YAAkD,CAAC;AAE5E;4DAC4D;AAC5D,eAAO,MAAM,cAAc,EAAE,kBAQ5B,CAAC;AAMF,eAAO,MAAM,kBAAkB,0BAAyB,CAAC;AACzD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AACjD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AAEjD,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,IAAI,GAAE,WAAgB,GAAG,MAAM,CAO9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,OAAO,CAAC,IAAI,GAAE,WAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBzG;AAED,kFAAkF;AAClF,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAoC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAWnD,eAAO,MAAM,SAAS,EAAE,aAu5BvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAqC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAWnD,eAAO,MAAM,SAAS,EAAE,aA05BvB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.37.1",
+  "version": "0.38.0",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.37.0",
+    "@intentius/chant": "^0.38.0",
     "typescript": "^5.9.3"
   }
 }

package/src/lifecycle-integration.test.ts

@@ -239,6 +239,7 @@ describe("aws lifecycle integration (#163)", () => {
 // The shared conformance suite (#1089).
 describeObservationConformance({
   lexicon: "aws",
+  ownershipChannel: awsPlugin.ownershipChannel,
   scenarios: [
     {
       name: "a stack read that fails on credentials",
@@ -286,5 +287,29 @@ describeObservationConformance({
         });
       },
     },
+    {
+      // aws declares a marker channel on the deep read and on live export, but
+      // not here: describe-stack-resources returns no tags, so the filter has
+      // nothing to filter on. The suite holds it to that — an `owned` verdict
+      // from this path would be a claim the transport cannot support (#1348).
+      name: "an owned read on a path with no marker channel",
+      declared: ["MyBucket"],
+      expectPresent: ["MyBucket"],
+      owned: true,
+      run: () => {
+        stubCfn((action) =>
+          action === "DescribeStackResources"
+            ? { text: stackResourcesXml([{ logicalId: "MyBucket", type: "AWS::S3::Bucket", physicalId: "my-bucket" }]) }
+            : { text: stackOutputsXml() },
+        );
+        return awsPlugin.describeResources!({
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["MyBucket"],
+          entities: new Map(),
+          owned: true,
+        });
+      },
+    },
   ],
 });

package/src/op/activities/floci.test.ts

@@ -13,7 +13,7 @@ import {
 describe("flociRunCommand (#704)", () => {
   test("minimal — defaults name/port/image, no docker socket", () => {
     expect(flociRunCommand({})).toBe(
-      "docker run -d --rm --name chant-floci -p 4566:4566 floci/floci:latest",
+      "docker run -d --rm --name chant-floci -p 4566:4566 floci/floci:1.5.34",
     );
   });
 
@@ -60,7 +60,7 @@ describe("flociHealthUrl / flociEnv (#704)", () => {
 describe("FLOCI_SPEC / FLOCI_EMULATOR — the aws plugin's emulator capability (#920)", () => {
   test("spec pins the Floci container identity the shared lifecycle boots", () => {
     expect(FLOCI_SPEC.name).toBe("chant-floci");
-    expect(FLOCI_SPEC.image).toBe("floci/floci:latest");
+    expect(FLOCI_SPEC.image).toBe("floci/floci:1.5.34");
     expect(FLOCI_SPEC.containerPort).toBe(4566);
     expect(FLOCI_SPEC.healthPath).toBe("/_localstack/health");
   });

package/src/op/activities/floci.ts

@@ -2,7 +2,11 @@ import { emulatorLifecycle, type EmulatorSpec, type EmulatorCapability } from "@
 
 const DEFAULT_NAME = "chant-floci";
 const DEFAULT_PORT = 4566;
-const DEFAULT_IMAGE = "floci/floci:latest";
+// Pinned, not `:latest` (#1345). An image that moves underneath a passing
+// local suite is the drift a pin exists to stop, and the freshness check in
+// core reports how far behind this is rather than bumping it — the tag moves
+// when a consuming test needs the newer emulator (#808).
+const DEFAULT_IMAGE = "floci/floci:1.5.34";
 const DEFAULT_REGION = "us-east-1";
 const DEFAULT_READY_SERVICE = "cloudformation";
 const DOCKER_SOCK = ["-v", "/var/run/docker.sock:/var/run/docker.sock"] as const;
@@ -55,6 +59,7 @@ const flociSpecFor = (readyService: string): EmulatorSpec => ({
   containerPort: DEFAULT_PORT,
   healthPath: "/_localstack/health",
   ready: (body) => isFlociReady(body, readyService),
+  upstream: { repo: "floci-io/floci" },
 });
 
 /** The Floci emulator spec — the aws plugin's `emulator` capability (#920). */

package/src/plugin.ts

@@ -35,6 +35,7 @@ import { CFGenerator } from "./import/generator";
 import { parseStackTemplate } from "./import/live-export";
 import { awsCompletions } from "./lsp/completions";
 import { awsHover } from "./lsp/hover";
+import { AWS_TAG_OWNERSHIP_KEYS } from "./ownership";
 
 /** Re-exported from ./stack-errors so the long-standing import path (and its
  * tests) keep working now that the deep reader shares the classifier. */
@@ -51,6 +52,9 @@ let warnedOwnership = false;
 
 export const awsPlugin: LexiconPlugin = {
   name: "aws",
+  // The thin read is sourced from describe-stack-resources, which returns no
+  // tags — so `owned` on that path can only answer `unknown`, and does (#1348).
+  ownershipChannel: { keys: AWS_TAG_OWNERSHIP_KEYS, reads: ["observeResourcesDeep", "exportResources"] },
   serializer: awsSerializer,
   // Local emulator (#920): Floci + the AWS env that redirects the SDK / observe.
   emulator: FLOCI_EMULATOR,