@intentius/chant-lexicon-aws 0.37.2 → 0.40.0

package/dist/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAElG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAIvF;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAapF"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAElG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAIvF;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAkBpF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.37.2",
+  "version": "0.40.0",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.37.2",
+    "@intentius/chant": "^0.39.0",
     "typescript": "^5.9.3"
   }
 }

package/src/ambient.test.ts

@@ -42,6 +42,27 @@ describe("observeAwsAmbient (#1278)", () => {
     expect(found["sg-default"].attributes).toMatchObject({ GroupName: "default", VpcId: "vpc-1" });
   });
 
+  // The empty ones are the answer, and they were the ones being dropped: both
+  // other observers resolve outward from declarations, so a subnet is recorded
+  // only when something in it is.
+  it("reports subnets nothing occupies", async () => {
+    spawnMock.mockResolvedValue(
+      ok({
+        Subnets: [
+          { SubnetId: "subnet-used", VpcId: "vpc-1" },
+          { SubnetId: "subnet-empty-a", VpcId: "vpc-default" },
+          { SubnetId: "subnet-empty-b", VpcId: "vpc-default" },
+        ],
+      }),
+    );
+    const found = await observeAwsAmbient({
+      kinds: ["AWS::EC2::Subnet"],
+      observed: { public: { type: "AWS::EC2::Subnet", status: "OK", physicalId: "subnet-used" } },
+    });
+    expect(Object.keys(found).sort()).toEqual(["subnet-empty-a", "subnet-empty-b"]);
+    expect(found["subnet-empty-a"].attributes).toMatchObject({ VpcId: "vpc-default" });
+  });
+
   it("is bounded by the kinds the project declares", async () => {
     // A project managing security groups is not made to enumerate the account.
     const found = await observeAwsAmbient({ kinds: ["AWS::S3::Bucket"], observed: {} });

package/src/ambient.ts

@@ -44,6 +44,22 @@ const ENUMERABLE: Record<string, { argv: string[]; key: string; id: string; name
     key: "NetworkInterfaces",
     id: "NetworkInterfaceId",
   },
+  // A subnet holding nothing is the same shape as an unused security group, and
+  // it was reachable by neither of the other paths. Both resolve outward from
+  // what is declared, so a subnet gets recorded only when something in it does —
+  // and the empty ones are exactly what "which of my subnets are empty" asks
+  // for.
+  //
+  // Found by measuring a snapshot rather than by reading the code: an estate
+  // with seven subnets recorded five, and the two it dropped were the two with
+  // nothing in them. The default VPC's subnets are the archetype again — nothing
+  // declares them, and the only one ever recorded was the one that happened to
+  // hold an instance.
+  "AWS::EC2::Subnet": {
+    argv: ["ec2", "describe-subnets"],
+    key: "Subnets",
+    id: "SubnetId",
+  },
 };
 
 /**

package/src/api/read-client.test.ts

@@ -201,3 +201,34 @@ describe("Cloud Control", () => {
     expect(parseResourceDescription({ Properties: JSON.stringify(["not", "an", "object"]) })).toBeNull();
   });
 });
+
+describe("the region an endpoint override cannot carry in its host", () => {
+  // An override is one host for every region, so the hostname says nothing and
+  // the region has to travel in the request. It did not, and a stack declared
+  // `region: "us-west-1"` was read against the emulator's default region —
+  // where it genuinely does not exist, so the read came back empty and the
+  // snapshot recorded that region as holding nothing.
+  test("the request names the region in its credential scope", async () => {
+    const { http, calls } = recording(() => respond(stackXml));
+    await describeStackResources("web", { endpoint: "http://localhost:4566", region: "us-west-1", http });
+    expect(calls[0].headers.authorization).toContain("/us-west-1/cloudformation/aws4_request");
+  });
+
+  test("Cloud Control carries it too, scoped to its own service", async () => {
+    const { http, calls } = recording(() => respond(JSON.stringify({ ResourceDescription: {} })));
+    await getResource("AWS::EC2::VPC", "vpc-01", { endpoint: "http://localhost:4566", region: "eu-west-1", http });
+    expect(calls[0].headers.authorization).toContain("/eu-west-1/cloudcontrolapi/aws4_request");
+  });
+
+  test("no region, no header — nothing invents one", async () => {
+    const { http, calls } = recording(() => respond(stackXml));
+    await describeStackResources("web", { endpoint: "http://localhost:4566", http });
+    expect(calls[0].headers.authorization).toBeUndefined();
+  });
+
+  test("it is a scope, not a signature — the placeholder says so", async () => {
+    const { http, calls } = recording(() => respond(stackXml));
+    await describeStackResources("web", { region: "us-west-1", http });
+    expect(calls[0].headers.authorization).toContain("Signature=unsigned");
+  });
+});

package/src/api/read-client.ts

@@ -69,6 +69,37 @@ export function serviceUrl(service: string, endpoint?: string, region = DEFAULT_
   return `${(endpoint ?? `https://${service}.${region}.amazonaws.com`).replace(/\/$/, "")}/`;
 }
 
+/**
+ * How the request says which region it is for.
+ *
+ * Against real AWS the region is the hostname, which is why `serviceUrl` takes
+ * it. Against an endpoint override there is only one host for every region, so
+ * the hostname carries nothing and the region has to travel in the request —
+ * and every emulator reads it where a real SDK puts it, in the credential scope
+ * of the `Authorization` header.
+ *
+ * Without this, a stack observed with `region: "us-west-1"` was read against
+ * whatever region the emulator defaults to. The result is not an error: the
+ * stack genuinely does not exist in us-east-1, so `describeResources` returned
+ * an empty observation and the snapshot recorded the region as holding nothing.
+ * A three-region estate snapshotted as one region and nothing said so.
+ *
+ * This is NOT SigV4. The signature is a placeholder and real AWS rejects it —
+ * as it already rejects every request from this module, which is unsigned by
+ * design (see the header comment). It carries the scope, nothing more, and it
+ * must not be mistaken for the signed read path that would replace it.
+ */
+function regionScope(service: string, region?: string): Record<string, string> {
+  if (!region) return {};
+  const day = new Date().toISOString().slice(0, 10).replace(/-/g, "");
+  const key = process.env.AWS_ACCESS_KEY_ID || "chant";
+  return {
+    authorization:
+      `AWS4-HMAC-SHA256 Credential=${key}/${day}/${region}/${service}/aws4_request, ` +
+      "SignedHeaders=host, Signature=unsigned",
+  };
+}
+
 /* ── CloudFormation Query ─────────────────────────────────────────────────── */
 
 /**
@@ -128,7 +159,17 @@ export async function cfnQuery(
   const http = options.http ?? defaultHttp;
   const url = serviceUrl("cloudformation", options.endpoint, options.region);
   const body = new URLSearchParams({ Action: action, Version: CFN_API_VERSION, ...params }).toString();
-  const res = await http(url, { headers: { "content-type": "application/x-www-form-urlencoded" }, body }, options.signal);
+  const res = await http(
+    url,
+    {
+      headers: {
+        "content-type": "application/x-www-form-urlencoded",
+        ...regionScope("cloudformation", options.region),
+      },
+      body,
+    },
+    options.signal,
+  );
   const err = xmlError(res.text);
   if (err || res.status >= 400) {
     throw new AwsReadError(
@@ -203,6 +244,7 @@ async function cloudControl(
       headers: {
         "content-type": "application/x-amz-json-1.0",
         "x-amz-target": `${CLOUD_CONTROL_TARGET_PREFIX}.${operation}`,
+        ...regionScope("cloudcontrolapi", options.region),
       },
       body: JSON.stringify(payload),
     },

package/src/codegen/generate.ts

@@ -14,12 +14,13 @@ import {
   type AugmentResult,
 } from "@intentius/chant/codegen/generate";
 import { fetchSchemaZip } from "../spec/fetch";
+import { assertPinnedSpec } from "../spec/pin";
 import { parseCFNSchema, cfnShortName, type SchemaParseResult } from "../spec/parse";
 import { fetchCfnLintPatches, applyPatches } from "./patches";
 import { fetchCfnLintExtensions, loadExtensionSchemas, type ExtensionConstraint } from "./extensions";
 import { samResources } from "./sam";
 import { fallbackResources } from "./fallback";
-import { NamingStrategy, propertyTypeName, extractDefName } from "./naming";
+import { NamingStrategy, publishedNames, propertyTypeName, extractDefName } from "./naming";
 import { generateLexiconJSON, lambdaRuntimeDeprecations } from "./generate-lexicon";
 import { generateTypeScriptDeclarations } from "./generate-typescript";
 import {
@@ -32,10 +33,17 @@ export type { GenerateOptions, GenerateResult };
 
 // AWS-specific state shared between pipeline callbacks
 let awsConstraints = new Map<string, ExtensionConstraint[]>();
+/** chant #1459 — spec type → already-published TS name, reset per `generate()` call. */
+let awsReservedNames: Record<string, string> = {};
 
 const awsPipelineConfig: GeneratePipelineConfig<SchemaParseResult> = {
   fetchSchemas: async (opts) => {
-    return fetchSchemaZip(opts.force);
+    const schemas = await fetchSchemaZip(opts.force);
+    // #1390 — the registry schema has no version in its URL and is republished
+    // constantly, so without this any prepack regenerates against whatever
+    // CloudFormation shipped that morning.
+    assertPinnedSpec(schemas);
+    return schemas;
   },
 
   parseSchema: (_typeName, data) => {
@@ -44,7 +52,7 @@ const awsPipelineConfig: GeneratePipelineConfig<SchemaParseResult> = {
     return result;
   },
 
-  createNaming: (results) => new NamingStrategy(results),
+  createNaming: (results) => new NamingStrategy(results, awsReservedNames),
 
   augmentSchemas: async (schemas, opts, log) => {
     const warnings: Array<{ file: string; error: string }> = [];
@@ -131,6 +139,12 @@ const awsPipelineConfig: GeneratePipelineConfig<SchemaParseResult> = {
 export async function generate(opts: GenerateOptions = {}): Promise<GenerateResult> {
   // Reset shared state
   awsConstraints = new Map();
+  // chant #1459 — names already published keep pointing at the types that
+  // published them. Skipped for a caller-supplied schema set, exactly as
+  // `augmentSchemas` is (see the pipeline's `opts.schemaSource` guard): a
+  // fixture run must depend on its fixtures, not on what the lexicon last
+  // shipped.
+  awsReservedNames = opts.schemaSource ? {} : publishedNames();
   return generatePipeline(awsPipelineConfig, opts);
 }
 

package/src/codegen/naming.ts

@@ -5,8 +5,11 @@
  * for extracting names from AWS CloudFormation types are defined here.
  */
 
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 import {
   NamingStrategy as CoreNamingStrategy,
+  reservedNamesFromSnapshot,
   type NamingConfig,
   type NamingInput,
 } from "@intentius/chant/codegen/naming";
@@ -110,11 +113,37 @@ const awsNamingConfig: NamingConfig = {
  * AWS-specific NamingStrategy — wraps the core algorithm with AWS data tables.
  */
 export class NamingStrategy extends CoreNamingStrategy {
-  constructor(results: SchemaParseResult[]) {
+  /**
+   * @param reservedNames chant #1459 — spec type → already-published TS name,
+   *   normally {@link publishedNames}. Passed in rather than read here on
+   *   purpose: a fixture-driven codegen run (`./snapshot.test.ts`) must not
+   *   inherit the repo's real 1600-entry surface, or its output would depend on
+   *   whatever the lexicon last shipped instead of on its fixtures.
+   */
+  constructor(results: SchemaParseResult[], reservedNames: Record<string, string> = {}) {
     const inputs: NamingInput[] = results.map((r) => ({
       typeName: r.resource.typeName,
       propertyTypes: r.propertyTypes,
     }));
-    super(inputs, awsNamingConfig);
+    super(inputs, { ...awsNamingConfig, reservedNames });
+  }
+}
+
+/**
+ * Reserved names from the committed surface snapshot, or none when it cannot
+ * be read.
+ *
+ * Defensive: codegen must still run for a lexicon with no snapshot yet, and a
+ * missing or malformed snapshot should degrade to the previous naming
+ * behaviour rather than fail generation outright. `surface-diff` makes the
+ * consequence visible either way.
+ */
+export function publishedNames(): Record<string, string> {
+  try {
+    const snapshotPath = join(import.meta.dirname, "..", "..", "surface.snapshot.json");
+    if (!existsSync(snapshotPath)) return {};
+    return reservedNamesFromSnapshot(JSON.parse(readFileSync(snapshotPath, "utf-8")));
+  } catch {
+    return {};
   }
 }

package/src/composites/alb-shared.ts

@@ -29,7 +29,7 @@ export interface AlbSharedProps {
   };
 }
 
-export const AlbShared = Composite<AlbSharedProps>((props) => {
+export const AlbShared = Composite((props: AlbSharedProps) => {
   const listenerPort = props.listenerPort ?? 80;
   const protocol = props.protocol ?? "HTTP";
   const { defaults: defs } = props;

package/src/composites/ec2-instance-role.ts

@@ -22,7 +22,7 @@ const EC2_ASSUME_ROLE = {
   ],
 };
 
-export const Ec2InstanceRole = Composite<Ec2InstanceRoleProps>((props) => {
+export const Ec2InstanceRole = Composite((props: Ec2InstanceRoleProps) => {
   const { defaults } = props;
 
   const role = new Role(mergeDefaults({

package/src/composites/efs-with-access-point.ts

@@ -28,7 +28,7 @@ export interface EfsWithAccessPointProps {
   throughputMode?: "bursting" | "provisioned" | "elastic";
 }
 
-export const EfsWithAccessPoint = Composite<EfsWithAccessPointProps>((props) => {
+export const EfsWithAccessPoint = Composite((props: EfsWithAccessPointProps) => {
   // Ternary (not push-inside-if) keeps the `new`s out of control flow (EVL002).
   const ingressRules: InstanceType<typeof SecurityGroup_Ingress>[] = props.sourceSecurityGroupId
     ? [new SecurityGroup_Ingress({ IpProtocol: "tcp", FromPort: 2049, ToPort: 2049, SourceSecurityGroupId: props.sourceSecurityGroupId })]

package/src/composites/fargate-alb.ts

@@ -68,7 +68,7 @@ export interface FargateAlbProps {
   };
 }
 
-export const FargateAlb = Composite<FargateAlbProps>((props) => {
+export const FargateAlb = Composite((props: FargateAlbProps) => {
   const containerPort = props.containerPort ?? 80;
   const cpu = props.cpu ?? "256";
   const memory = props.memory ?? "512";

package/src/composites/fargate-service.ts

@@ -1,4 +1,4 @@
-import { Composite, mergeDefaults } from "@intentius/chant";
+import { Composite, mergeDefaults, type Value } from "@intentius/chant";
 import {
   EcsService,
   EcsService_LoadBalancer,
@@ -33,11 +33,16 @@ import { Sub, Join, Select, Split } from "../intrinsics";
 import { ecsTrustPolicy } from "./ecs-trust-policy";
 
 export interface FargateServiceProps {
-  // Wiring to shared ALB
-  clusterArn: string;
-  listenerArn: string;
-  albSecurityGroupId: string;
-  executionRoleArn: string;
+  // Wiring to shared ALB.
+  //
+  // `Value<string>` rather than `string`: these are exactly the props a
+  // consuming stack fills from a cross-stack reference, and the documented way
+  // to do that is `Ref(param)` — an Intrinsic, not a literal. Typing them
+  // `string` made the composite's own examples a type error (#1366).
+  clusterArn: Value<string>;
+  listenerArn: Value<string>;
+  albSecurityGroupId: Value<string>;
+  executionRoleArn: Value<string>;
 
   // Routing — at least one required
   priority: number;
@@ -45,7 +50,7 @@ export interface FargateServiceProps {
   hostHeaders?: string[];
 
   // Container
-  image: string;
+  image: Value<string>;
   containerPort?: number;
   cpu?: string;
   memory?: string;
@@ -71,8 +76,8 @@ export interface FargateServiceProps {
   }>;
 
   // Networking
-  vpcId: string;
-  privateSubnetIds: string[];
+  vpcId: Value<string>;
+  privateSubnetIds: Array<Value<string>>;
   healthCheckPath?: string;
 
   // Ulimits (container-level)
@@ -90,7 +95,7 @@ export interface FargateServiceProps {
   };
 }
 
-export const FargateService = Composite<FargateServiceProps>((props) => {
+export const FargateService = Composite((props: FargateServiceProps) => {
   if (!props.pathPatterns && !props.hostHeaders) {
     throw new Error("FargateService requires at least one of pathPatterns or hostHeaders");
   }

package/src/composites/index.ts

@@ -32,7 +32,7 @@ export { Ec2InstanceRole } from "./ec2-instance-role";
 export type { Ec2InstanceRoleProps } from "./ec2-instance-role";
 export { MinimalVpc } from "./minimal-vpc";
 export type { MinimalVpcProps } from "./minimal-vpc";
-export { MicrovmApp } from "./microvm-app";
-export type { MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps } from "./microvm-app";
+export { MicrovmApp, MICROVM_LIMITS } from "./microvm-app";
+export type { MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps, MicrovmMemoryMiB } from "./microvm-app";
 export { AgentCoreAgent } from "./agentcore-agent";
 export type { AgentCoreAgentProps, AgentCoreAgentResult } from "./agentcore-agent";

package/src/composites/lambda-api.ts

@@ -1,9 +1,10 @@
-import { Composite, mergeDefaults } from "@intentius/chant";
+import { Composite, mergeDefaults, type Value } from "@intentius/chant";
 import { Permission } from "../generated";
 import { LambdaFunction, type LambdaFunctionProps, type LambdaFunctionResult } from "./lambda-function";
 
 export interface LambdaApiProps extends LambdaFunctionProps {
-  sourceArn?: string;
+  /** `Value<string>`: an ARN is routinely built with `Sub` from pseudo-parameters (#1366). */
+  sourceArn?: Value<string>;
   defaults?: LambdaFunctionProps["defaults"] & {
     permission?: Partial<ConstructorParameters<typeof Permission>[0]>;
   };

package/src/composites/lambda-dynamodb.ts

@@ -1,4 +1,4 @@
-import { Composite, mergeDefaults } from "@intentius/chant";
+import { Composite, mergeDefaults, type Value } from "@intentius/chant";
 import {
   Table,
   Table_AttributeDefinition,
@@ -11,7 +11,8 @@ import { dynamoDBActionsFor } from "../actions/dynamodb";
 import { LambdaFunction, type LambdaFunctionProps } from "./lambda-function";
 
 export interface LambdaDynamoDBProps extends LambdaFunctionProps {
-  tableName?: string;
+  /** `Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366). */
+  tableName?: Value<string>;
   partitionKey: string;
   sortKey?: string;
   access?: "ReadOnly" | "ReadWrite" | "Full" | "None";
@@ -27,7 +28,7 @@ export interface LambdaDynamoDBProps extends LambdaFunctionProps {
   };
 }
 
-export const LambdaDynamoDB = Composite<LambdaDynamoDBProps>((props) => {
+export const LambdaDynamoDB = Composite((props: LambdaDynamoDBProps) => {
   // Conditional entries via spread keep the `new`s out of the `if` (EVL002).
   const attributeDefinitions = [
     new Table_AttributeDefinition({ AttributeName: props.partitionKey, AttributeType: "S" }),

package/src/composites/lambda-eventbridge.ts

@@ -1,9 +1,10 @@
-import { Composite, mergeDefaults } from "@intentius/chant";
+import { Composite, mergeDefaults, type Value } from "@intentius/chant";
 import { EventRule, EventRule_Target, Permission } from "../generated";
 import { LambdaFunction, type LambdaFunctionProps } from "./lambda-function";
 
 export interface LambdaEventBridgeProps extends LambdaFunctionProps {
-  ruleName?: string;
+  /** `Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366). */
+  ruleName?: Value<string>;
   schedule?: string;
   eventPattern?: Record<string, unknown>;
   enabled?: boolean;
@@ -13,7 +14,7 @@ export interface LambdaEventBridgeProps extends LambdaFunctionProps {
   };
 }
 
-export const LambdaEventBridge = Composite<LambdaEventBridgeProps>((props) => {
+export const LambdaEventBridge = Composite((props: LambdaEventBridgeProps) => {
   const { defaults } = props;
   const { role, func } = LambdaFunction(props);
 

package/src/composites/lambda-s3.ts

@@ -1,4 +1,4 @@
-import { Composite, mergeDefaults } from "@intentius/chant";
+import { Composite, mergeDefaults, type Value } from "@intentius/chant";
 import {
   Bucket,
   Bucket_BucketEncryption,
@@ -15,7 +15,8 @@ import { s3ActionsFor } from "../actions/s3";
 import { LambdaFunction, type LambdaFunctionProps, type LambdaFunctionResult } from "./lambda-function";
 
 export interface LambdaS3Props extends LambdaFunctionProps {
-  bucketName?: string;
+  /** `Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366). */
+  bucketName?: Value<string>;
   access?: "ReadOnly" | "ReadWrite" | "Full";
   trigger?: {
     events?: string[];

package/src/composites/lambda-sns.ts

@@ -1,9 +1,10 @@
-import { Composite, mergeDefaults } from "@intentius/chant";
+import { Composite, mergeDefaults, type Value } from "@intentius/chant";
 import { Topic, Subscription, Permission } from "../generated";
 import { LambdaFunction, type LambdaFunctionProps } from "./lambda-function";
 
 export interface LambdaSnsProps extends LambdaFunctionProps {
-  topicName?: string;
+  /** `Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366). */
+  topicName?: Value<string>;
   defaults?: LambdaFunctionProps["defaults"] & {
     topic?: Partial<ConstructorParameters<typeof Topic>[0]>;
     subscription?: Partial<ConstructorParameters<typeof Subscription>[0]>;
@@ -11,7 +12,7 @@ export interface LambdaSnsProps extends LambdaFunctionProps {
   };
 }
 
-export const LambdaSns = Composite<LambdaSnsProps>((props) => {
+export const LambdaSns = Composite((props: LambdaSnsProps) => {
   const { defaults } = props;
   const { role, func } = LambdaFunction(props);
 

package/src/composites/lambda-sqs.ts

@@ -1,10 +1,11 @@
-import { Composite, mergeDefaults } from "@intentius/chant";
+import { Composite, mergeDefaults, type Value } from "@intentius/chant";
 import { Queue, EventSourceMapping, Role_Policy } from "../generated";
 import { SQSActions } from "../actions/sqs";
 import { LambdaFunction, type LambdaFunctionProps } from "./lambda-function";
 
 export interface LambdaSqsProps extends LambdaFunctionProps {
-  queueName?: string;
+  /** `Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366). */
+  queueName?: Value<string>;
   batchSize?: number;
   maxBatchingWindow?: number;
   defaults?: LambdaFunctionProps["defaults"] & {
@@ -13,7 +14,7 @@ export interface LambdaSqsProps extends LambdaFunctionProps {
   };
 }
 
-export const LambdaSqs = Composite<LambdaSqsProps>((props) => {
+export const LambdaSqs = Composite((props: LambdaSqsProps) => {
   const { defaults } = props;
 
   const queue = new Queue(mergeDefaults({

package/src/composites/microvm-app.test.ts

@@ -3,7 +3,7 @@ import { expandComposite } from "@intentius/chant";
 import { AttrRef } from "@intentius/chant/attrref";
 import { resolveAttrRefs } from "@intentius/chant/discovery/resolve";
 import { awsSerializer } from "../serializer";
-import { MicrovmApp } from "./microvm-app";
+import { MicrovmApp, MICROVM_LIMITS } from "./microvm-app";
 
 const baseProps = {
   name: "worker-image",
@@ -232,3 +232,41 @@ describe("MicrovmApp", () => {
     });
   });
 });
+
+describe("MICROVM_LIMITS", () => {
+  // The composite validates against these; a consumer driving the same service
+  // through a different control plane needs the same numbers, and copying them
+  // is how two sources of truth start (#1374).
+  test("is reachable from the package root", async () => {
+    const root = await import("../index");
+    expect(root.MICROVM_LIMITS).toBe(MICROVM_LIMITS);
+  });
+
+  test("is what the composite actually enforces", () => {
+    // Not a restatement of the constants — a probe through the public API, so
+    // the two cannot drift apart while both look right.
+    expect(() => MicrovmApp({ ...baseProps, memoryMiB: 3072 as never })).toThrow(
+      new RegExp(MICROVM_LIMITS.memoryMiB.join(", ")),
+    );
+    expect(() => MicrovmApp({ ...baseProps, name: "no spaces allowed" })).toThrow(/name must match/);
+    expect(() =>
+      MicrovmApp({ ...baseProps, name: "x".repeat(MICROVM_LIMITS.maxNameLength + 1) }),
+    ).toThrow(/≤64 chars/);
+    expect(() =>
+      MicrovmApp({ ...baseProps, environment: { AWS_REGION: "us-east-1" } }),
+    ).toThrow(/AWS_REGION/);
+  });
+
+  test("names every limit the composite checks", () => {
+    // A limit enforced and not named here is one a consumer cannot see.
+    expect(Object.keys(MICROVM_LIMITS).sort()).toEqual([
+      "connectorSubnets",
+      "maxEgressConnectors",
+      "maxEnvironmentVariables",
+      "maxNameLength",
+      "memoryMiB",
+      "namePattern",
+      "reservedEnvironmentKeys",
+    ]);
+  });
+});

package/src/composites/microvm-app.ts

@@ -47,17 +47,38 @@ import { Sub } from "../intrinsics";
 const MICROVM_SERVICE_PRINCIPAL = "lambda.amazonaws.com";
 const CONNECTOR_MANAGED_RESOURCE_OPERATOR = "network-connectors.lambda.amazonaws.com";
 
-/** Documented baseline memory tiers (MiB) — the CFN schema types it as an open int, but the service accepts only these five; vCPU auto-scales with the tier. */
-const VALID_MEMORY_MIB = [512, 1024, 2048, 4096, 8192] as const;
-type MicrovmMemoryMiB = (typeof VALID_MEMORY_MIB)[number];
-
-const NAME_PATTERN = /^[a-zA-Z0-9-_]+$/;
-const MAX_NAME_LENGTH = 64;
-const RESERVED_ENV_KEYS = new Set(["AWS_REGION"]);
-const MAX_ENVIRONMENT_VARIABLES = 50;
-const MAX_EGRESS_CONNECTORS = 10;
-const MIN_CONNECTOR_SUBNETS = 1;
-const MAX_CONNECTOR_SUBNETS = 16;
+/**
+ * The Lambda MicroVMs service's real limits, verified against the upstream
+ * `ran-isenberg/lambda-microvm-cdk-python` construct and the AWS docs.
+ *
+ * Exported because a consumer driving the same service through a different
+ * control plane needs the same numbers, and copying them is how two sources of
+ * truth start (#1374). The CFN schema types most of these as open ints and
+ * strings, so nothing but this object knows them.
+ */
+export const MICROVM_LIMITS = {
+  /** Documented baseline memory tiers (MiB). The schema says int; the service accepts five values. vCPU auto-scales with the tier. */
+  memoryMiB: [512, 1024, 2048, 4096, 8192],
+  namePattern: /^[a-zA-Z0-9-_]+$/,
+  maxNameLength: 64,
+  /** Set by the service on every MicroVM; supplying it is rejected. */
+  reservedEnvironmentKeys: ["AWS_REGION"],
+  maxEnvironmentVariables: 50,
+  maxEgressConnectors: 10,
+  connectorSubnets: { min: 1, max: 16 },
+} as const;
+
+/** One of the five memory tiers {@link MICROVM_LIMITS} names. */
+export type MicrovmMemoryMiB = (typeof MICROVM_LIMITS.memoryMiB)[number];
+
+const VALID_MEMORY_MIB = MICROVM_LIMITS.memoryMiB;
+const NAME_PATTERN = MICROVM_LIMITS.namePattern;
+const MAX_NAME_LENGTH = MICROVM_LIMITS.maxNameLength;
+const RESERVED_ENV_KEYS = new Set<string>(MICROVM_LIMITS.reservedEnvironmentKeys);
+const MAX_ENVIRONMENT_VARIABLES = MICROVM_LIMITS.maxEnvironmentVariables;
+const MAX_EGRESS_CONNECTORS = MICROVM_LIMITS.maxEgressConnectors;
+const MIN_CONNECTOR_SUBNETS = MICROVM_LIMITS.connectorSubnets.min;
+const MAX_CONNECTOR_SUBNETS = MICROVM_LIMITS.connectorSubnets.max;
 
 /**
  * `sts:AssumeRole` + `sts:TagSession` trust for `lambda.amazonaws.com` — the

package/src/composites/minimal-vpc.ts

@@ -21,7 +21,7 @@ export interface MinimalVpcProps {
   };
 }
 
-export const MinimalVpc = Composite<MinimalVpcProps>((props) => {
+export const MinimalVpc = Composite((props: MinimalVpcProps) => {
   const { defaults } = props;
   const cidr = props.cidr ?? "10.0.0.0/24";
   const subnetCidr = props.subnetCidr ?? "10.0.0.0/25";

package/src/composites/rds-instance.ts

@@ -76,7 +76,7 @@ export interface RdsInstanceProps {
   };
 }
 
-export const RdsInstance = Composite<RdsInstanceProps>((props) => {
+export const RdsInstance = Composite((props: RdsInstanceProps) => {
   const engine = props.engine ?? "postgres";
   const defaults = ENGINE_DEFAULTS.get(engine)!;
   const port = props.port ?? defaults.port;