@intentius/chant-lexicon-aws 0.40.0 → 0.41.0

package/src/spec/pin.test.ts

@@ -125,9 +125,16 @@ describe("assertPinnedSpec", () => {
     expect(() => assertPinnedSpec(pinned, { pin, pinnedNames: names, env: {} })).not.toThrow();
   });
 
-  test("refuses a drifted archive — generation does not proceed", () => {
-    expect(() => assertPinnedSpec(archive("AWS::A::One", "AWS::B::Two"), { pin, pinnedNames: names, env: {} }))
-      .toThrow(/upstream CloudFormation schema has moved/);
+  test("reports a drifted archive — generation proceeds (#1473)", () => {
+    // Was a throw. Enforcement moved to the release-time surface gate, so a
+    // moving upstream can no longer redden an unrelated PR.
+    const warnings: string[] = [];
+    expect(() =>
+      assertPinnedSpec(archive("AWS::A::One", "AWS::B::Two"), {
+        pin, pinnedNames: names, env: {}, warn: (m) => warnings.push(m),
+      }),
+    ).not.toThrow();
+    expect(warnings[0]).toMatch(/upstream CloudFormation schema has moved/);
   });
 
   test("the accept env proceeds and reports instead", () => {
@@ -196,16 +203,26 @@ describe("byte churn vs a moved resource set (#1473)", () => {
     expect(warnings[0]).toContain("surface.snapshot.json");
   });
 
-  test("a type removed — still refuses", () => {
-    const { threw } = capture(archive("AWS::S3::Bucket"));
-    expect(threw?.message).toContain("Generation refuses");
-    expect(threw?.message).toContain("removed");
+  test("a type removed — reports loudly, does not throw", () => {
+    // Enforcement is the release-time surface gate; a removed type always
+    // shows up there. Throwing here made every aws PR hostage to upstream.
+    const { warnings, threw } = capture(archive("AWS::S3::Bucket"));
+    expect(threw).toBeUndefined();
+    expect(warnings[0]).toContain("removed");
+    expect(warnings[0]).toContain("Generation refuses");
   });
 
-  test("a type added — still refuses", () => {
-    const { threw } = capture(archive("AWS::S3::Bucket", "AWS::IAM::Role", "AWS::SQS::Queue"));
-    expect(threw?.message).toContain("Generation refuses");
-    expect(threw?.message).toContain("added");
+  test("a type added — reports loudly, does not throw", () => {
+    const { warnings, threw } = capture(archive("AWS::S3::Bucket", "AWS::IAM::Role", "AWS::SQS::Queue"));
+    expect(threw).toBeUndefined();
+    expect(warnings[0]).toContain("added");
+  });
+
+  test("a moved type set is reported more urgently than byte churn", () => {
+    const edited = new Map(pinned);
+    edited.set("AWS::S3::Bucket", schema("AWS::S3::Bucket", "reworded"));
+    expect(capture(edited).warnings[0]).toContain("resource set is unchanged");
+    expect(capture(archive("AWS::S3::Bucket")).warnings[0]).not.toContain("resource set is unchanged");
   });
 
   test("an unchanged archive neither warns nor throws", () => {
@@ -214,15 +231,13 @@ describe("byte churn vs a moved resource set (#1473)", () => {
     expect(warnings).toEqual([]);
   });
 
-  test("with no previous type set to compare, a mismatch stays fatal", () => {
-    // `specDrift` reports empty added/removed when it cannot compare, which
-    // would otherwise read as "no type moved" and downgrade every mismatch.
+  test("generation is never blocked by the pin, whatever moved", () => {
+    // The invariant that matters now: `generate` always completes. Whether the
+    // result may SHIP is decided by the surface gate in validate.
     const edited = new Map(pinned);
     edited.set("AWS::S3::Bucket", schema("AWS::S3::Bucket", "reworded"));
-
-    expect(() =>
-      assertPinnedSpec(edited, { pin, pinnedNames: new Set(), env: {}, warn: () => {} }),
-    ).toThrow(/Generation refuses/);
+    expect(() => assertPinnedSpec(edited, { pin, pinnedNames: new Set(), env: {}, warn: () => {} })).not.toThrow();
+    expect(() => assertPinnedSpec(archive("AWS::X::Y"), { pin, pinnedNames: names, env: {}, warn: () => {} })).not.toThrow();
   });
 
   test("the accept env still short-circuits both cases", () => {

package/src/spec/pin.ts

@@ -56,8 +56,8 @@ export interface SpecPin {
  * want, and paste the printed pin here in its own commit.
  */
 export const AWS_SPEC_PIN: SpecPin = {
-  digest: "sha256:f2a0f4f2c0685116fa928a01d889b2aa2a03e4f02cd3257b124cbb184f7e533b",
-  resources: 1650,
+  digest: "sha256:30bca5721afaaa891d17f528af4bc9b2fc5f707e34e5c6c78d3afeb6f0f259b8",
+  resources: 1651,
   accepted: "2026-08-04",
 };
 
@@ -235,13 +235,20 @@ export function assertPinnedSpec(
   // Guarded on actually HAVING a previous type set: `specDrift` reports empty
   // added/removed when it has nothing to compare against, which would
   // otherwise read as "no type moved" and downgrade every mismatch.
-  const typeSetKnown = pinnedNames !== undefined && pinnedNames.size > 0;
-  const typeSetMoved = drift.added.length > 0 || drift.removed.length > 0;
-
-  if (typeSetKnown && !typeSetMoved) {
-    warn(driftMessage(drift, pin, { fatal: false }));
-    return;
-  }
-
-  throw new Error(driftMessage(drift, pin));
+  // chant #1473 — the pin reports, it does not gate.
+  //
+  // Refusing here made every aws PR hostage to CloudFormation: the archive
+  // gains and edits types through the day, and `generate` runs on every CI
+  // job, so an unrelated change goes red the moment upstream moves. Both the
+  // 0.39.0 and 0.40.1 releases died this way, and a PR *accepting* the drift
+  // was itself refused by a newer drift that arrived while its CI queued.
+  //
+  // Enforcement lives where the consequence is: core's
+  // `validateLexiconArtifacts` compares the generated API against the reviewed
+  // `surface.snapshot.json` and, armed by CHANT_RELEASE_GATE, refuses to
+  // publish a surface nobody reviewed. A new or removed type always shows up
+  // there, so nothing is lost by reporting rather than throwing here — while a
+  // description edit, which changes the digest and no declaration, stops
+  // costing a red build.
+  warn(driftMessage(drift, pin, { fatal: drift.added.length > 0 || drift.removed.length > 0 }));
 }

package/src/spec/pinned-types.json

@@ -1273,6 +1273,7 @@
   "AWS::Redshift::EventSubscription",
   "AWS::Redshift::Integration",
   "AWS::Redshift::ScheduledAction",
+  "AWS::Redshift::SnapshotSchedule",
   "AWS::RedshiftServerless::Namespace",
   "AWS::RedshiftServerless::Snapshot",
   "AWS::RedshiftServerless::Workgroup",