@intentius/chant-lexicon-aws 0.40.0 → 0.41.3

package/src/generated/lexicon-aws.json

@@ -12778,7 +12778,11 @@
     "attrs": {
       "Id": "Id",
       "State": "State",
-      "Code_SourceLocationArn": "Code.SourceLocationArn"
+      "Code_SourceLocationArn": "Code.SourceLocationArn",
+      "Replicas_*_VpcConfig_VpcId": "Replicas.*.VpcConfig.VpcId",
+      "Replicas_*_CanaryState": "Replicas.*.CanaryState",
+      "Replicas_*_LastModified": "Replicas.*.LastModified",
+      "Replicas_*_ReplicationStatus": "Replicas.*.ReplicationStatus"
     },
     "propertyConstraints": {
       "Name": {
@@ -12792,6 +12796,9 @@
           "AUTOMATIC",
           "OFF"
         ]
+      },
+      "KmsKeyArn": {
+        "pattern": "^arn:[a-z0-9-]+:kms:[a-z0-9-]+:[0-9]{12}:(key/([a-f0-9-]{36}|mrk-[a-f0-9]{32})|alias/[a-zA-Z0-9:/_.-]+)$"
       }
     },
     "createOnly": [
@@ -12808,7 +12815,10 @@
       "RunConfig/EnvironmentVariables",
       "VisualReference",
       "VisualReferences",
-      "DryRunAndUpdate"
+      "DryRunAndUpdate",
+      "Replicas/*/Tags",
+      "Replicas/*/ResourcesToReplicateTags",
+      "Replicas/*/KmsKeyArn"
     ],
     "primaryIdentifier": [
       "Name"
@@ -12853,6 +12863,16 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "Canary_Replica": {
+    "resourceType": "AWS::Synthetics::Canary.Replica",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "Canary_ReplicaReplicationStatus": {
+    "resourceType": "AWS::Synthetics::Canary.ReplicaReplicationStatus",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "Canary_RetryConfig": {
     "resourceType": "AWS::Synthetics::Canary.RetryConfig",
     "kind": "property",
@@ -22236,11 +22256,6 @@
     "kind": "property",
     "lexicon": "aws"
   },
-  "CustomInstructions": {
-    "resourceType": "AWS::QuickSight::Topic.CustomInstructions",
-    "kind": "property",
-    "lexicon": "aws"
-  },
   "CustomLineItem": {
     "resourceType": "AWS::BillingConductor::CustomLineItem",
     "kind": "resource",
@@ -23725,16 +23740,18 @@
     "resourceType": "AWS::DMS::EventSubscription",
     "kind": "resource",
     "lexicon": "aws",
-    "attrs": {
-      "Id": "Id"
-    },
     "createOnly": [
       "SubscriptionName",
       "SourceIds"
     ],
     "primaryIdentifier": [
-      "Id"
-    ]
+      "SubscriptionName"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
   },
   "DMSEventSubscription_Tag": {
     "resourceType": "AWS::DMS::EventSubscription.Tag",
@@ -25885,6 +25902,16 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "DataSetRelation": {
+    "resourceType": "AWS::QuickSight::TopicV2.DataSetRelation",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "DataSetRelationEndpoint": {
+    "resourceType": "AWS::QuickSight::TopicV2.DataSetRelationEndpoint",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "DataSetSchema": {
     "resourceType": "AWS::QuickSight::Template.DataSetSchema",
     "kind": "property",
@@ -30694,6 +30721,21 @@
       "KmsKeyArn": {
         "minLength": 1,
         "maxLength": 2048
+      },
+      "PrivateConnectionName": {
+        "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$",
+        "minLength": 3,
+        "maxLength": 30
+      },
+      "TargetUrlPrivateConnectionName": {
+        "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$",
+        "minLength": 3,
+        "maxLength": 30
+      },
+      "ExchangeUrlPrivateConnectionName": {
+        "pattern": "^[a-z0-9]([a-z0-9-]*[a-z0-9])?$",
+        "minLength": 3,
+        "maxLength": 30
       }
     },
     "createOnly": [
@@ -30703,10 +30745,15 @@
       "ServiceDetails/ServiceNow",
       "ServiceDetails/PagerDuty",
       "ServiceDetails/AzureIdentity",
-      "KmsKeyArn"
+      "KmsKeyArn",
+      "PrivateConnectionName",
+      "TargetUrlPrivateConnectionName",
+      "ExchangeUrlPrivateConnectionName"
     ],
     "writeOnly": [
-      "ServiceDetails"
+      "ServiceDetails",
+      "TargetUrlPrivateConnectionName",
+      "ExchangeUrlPrivateConnectionName"
     ],
     "primaryIdentifier": [
       "ServiceId"
@@ -49910,6 +49957,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "InstanceRuleStatement": {
+    "resourceType": "AWS::LicenseManager::LicenseAssetRuleSet.InstanceRuleStatement",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "InstanceSnapshot": {
     "resourceType": "AWS::Lightsail::InstanceSnapshot",
     "kind": "resource",
@@ -55068,6 +55120,74 @@
       "tagUpdatable": true
     }
   },
+  "LicenseAssetRule": {
+    "resourceType": "AWS::LicenseManager::LicenseAssetRuleSet.LicenseAssetRule",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "LicenseAssetRuleSet": {
+    "resourceType": "AWS::LicenseManager::LicenseAssetRuleSet",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "LicenseAssetRulesetArn": "LicenseAssetRulesetArn"
+    },
+    "propertyConstraints": {
+      "Name": {
+        "maxLength": 128
+      },
+      "LicenseAssetRulesetArn": {
+        "pattern": "^arn:aws[a-zA-Z-]*:[A-Za-z0-9][A-Za-z0-9_/.-]{0,62}:[A-Za-z0-9_/.-]{0,63}:[A-Za-z0-9_/.-]{0,63}:[A-Za-z0-9][A-Za-z0-9:_/+=,@.-]{0,1023}$",
+        "maxLength": 2048
+      },
+      "Description": {
+        "maxLength": 1024
+      }
+    },
+    "primaryIdentifier": [
+      "LicenseAssetRulesetArn"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
+  },
+  "LicenseAssetRuleSet_InstanceRuleStatement": {
+    "resourceType": "AWS::LicenseManager::LicenseAssetRuleSet.InstanceRuleStatement",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "LicenseAssetRuleSet_LicenseAssetRule": {
+    "resourceType": "AWS::LicenseManager::LicenseAssetRuleSet.LicenseAssetRule",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "LicenseAssetRuleSet_LicenseConfigurationRuleStatement": {
+    "resourceType": "AWS::LicenseManager::LicenseAssetRuleSet.LicenseConfigurationRuleStatement",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "LicenseAssetRuleSet_LicenseRuleStatement": {
+    "resourceType": "AWS::LicenseManager::LicenseAssetRuleSet.LicenseRuleStatement",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "LicenseAssetRuleSet_RuleStatement": {
+    "resourceType": "AWS::LicenseManager::LicenseAssetRuleSet.RuleStatement",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "LicenseAssetRuleSet_Tag": {
+    "resourceType": "AWS::LicenseManager::LicenseAssetRuleSet.Tag",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "LicenseConfigurationRuleStatement": {
+    "resourceType": "AWS::LicenseManager::LicenseAssetRuleSet.LicenseConfigurationRuleStatement",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "LicenseEndpoint": {
     "resourceType": "AWS::Deadline::LicenseEndpoint",
     "kind": "resource",
@@ -55118,6 +55238,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "LicenseRuleStatement": {
+    "resourceType": "AWS::LicenseManager::LicenseAssetRuleSet.LicenseRuleStatement",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "License_BorrowConfiguration": {
     "resourceType": "AWS::LicenseManager::License.BorrowConfiguration",
     "kind": "property",
@@ -59608,6 +59733,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "ManagedVpcResource": {
+    "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.ManagedVpcResource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "ManagedWordsConfig": {
     "resourceType": "AWS::Bedrock::Guardrail.ManagedWordsConfig",
     "kind": "property",
@@ -66523,7 +66653,8 @@
       "CallbackUrl": "CallbackUrl",
       "Oauth2ProviderConfigOutput": "Oauth2ProviderConfigOutput",
       "CreatedTime": "CreatedTime",
-      "LastUpdatedTime": "LastUpdatedTime"
+      "LastUpdatedTime": "LastUpdatedTime",
+      "Status": "Status"
     },
     "propertyConstraints": {
       "Name": {
@@ -66578,6 +66709,17 @@
       },
       "LastUpdatedTime": {
         "format": "date-time"
+      },
+      "Status": {
+        "enum": [
+          "CREATING",
+          "CREATE_FAILED",
+          "UPDATING",
+          "UPDATE_FAILED",
+          "READY",
+          "DELETING",
+          "DELETE_FAILED"
+        ]
       }
     },
     "createOnly": [
@@ -66631,6 +66773,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "OAuth2CredentialProvider_ManagedVpcResource": {
+    "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.ManagedVpcResource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "OAuth2CredentialProvider_MicrosoftOauth2ProviderConfigInput": {
     "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.MicrosoftOauth2ProviderConfigInput",
     "kind": "property",
@@ -66661,6 +66808,26 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "OAuth2CredentialProvider_PrivateEndpoint": {
+    "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.PrivateEndpoint",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "OAuth2CredentialProvider_PrivateEndpointOverride": {
+    "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.PrivateEndpointOverride",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "OAuth2CredentialProvider_PrivateKeyJwtConfig": {
+    "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.PrivateKeyJwtConfig",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "OAuth2CredentialProvider_PrivateKeySource": {
+    "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.PrivateKeySource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "OAuth2CredentialProvider_SalesforceOauth2ProviderConfigInput": {
     "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.SalesforceOauth2ProviderConfigInput",
     "kind": "property",
@@ -66671,6 +66838,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "OAuth2CredentialProvider_SelfManagedLatticeResource": {
+    "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.SelfManagedLatticeResource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "OAuth2CredentialProvider_SlackOauth2ProviderConfigInput": {
     "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.SlackOauth2ProviderConfigInput",
     "kind": "property",
@@ -73766,16 +73938,6 @@
     "kind": "property",
     "lexicon": "aws"
   },
-  "PrivateEndpoint": {
-    "resourceType": "AWS::BedrockAgentCore::Harness.PrivateEndpoint",
-    "kind": "property",
-    "lexicon": "aws"
-  },
-  "PrivateEndpointOverride": {
-    "resourceType": "AWS::BedrockAgentCore::Harness.PrivateEndpointOverride",
-    "kind": "property",
-    "lexicon": "aws"
-  },
   "PrivateGraphEndpoint": {
     "resourceType": "AWS::NeptuneGraph::PrivateGraphEndpoint",
     "kind": "resource",
@@ -73810,6 +73972,16 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "PrivateKeyJwtConfig": {
+    "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.PrivateKeyJwtConfig",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "PrivateKeySource": {
+    "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.PrivateKeySource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "PrivateRegistryAccess": {
     "resourceType": "AWS::Lightsail::Container.PrivateRegistryAccess",
     "kind": "property",
@@ -79953,6 +80125,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "Replica": {
+    "resourceType": "AWS::Synthetics::Canary.Replica",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "ReplicaGlobalSecondaryIndexSpecification": {
     "resourceType": "AWS::DynamoDB::GlobalTable.ReplicaGlobalSecondaryIndexSpecification",
     "kind": "property",
@@ -80005,6 +80182,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "ReplicaReplicationStatus": {
+    "resourceType": "AWS::Synthetics::Canary.ReplicaReplicationStatus",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "ReplicaSSESpecification": {
     "resourceType": "AWS::DynamoDB::GlobalTable.ReplicaSSESpecification",
     "kind": "property",
@@ -84462,6 +84644,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "RuleStatement": {
+    "resourceType": "AWS::LicenseManager::LicenseAssetRuleSet.RuleStatement",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "RuleTriggerEventSource": {
     "resourceType": "AWS::Connect::Rule.RuleTriggerEventSource",
     "kind": "property",
@@ -89713,6 +89900,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "SelfManagedLatticeResource": {
+    "resourceType": "AWS::BedrockAgentCore::OAuth2CredentialProvider.SelfManagedLatticeResource",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "SemanticChunkingConfiguration": {
     "resourceType": "AWS::Bedrock::DataSource.SemanticChunkingConfiguration",
     "kind": "property",
@@ -92262,6 +92454,32 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "SnapshotSchedule": {
+    "resourceType": "AWS::Redshift::SnapshotSchedule",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Arn": "Arn",
+      "AssociatedClusterCount": "AssociatedClusterCount"
+    },
+    "createOnly": [
+      "ScheduleIdentifier",
+      "ScheduleDescription"
+    ],
+    "primaryIdentifier": [
+      "Arn"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
+  },
+  "SnapshotSchedule_Tag": {
+    "resourceType": "AWS::Redshift::SnapshotSchedule.Tag",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "SnowflakeBufferingHints": {
     "resourceType": "AWS::KinesisFirehose::DeliveryStream.SnowflakeBufferingHints",
     "kind": "property",
@@ -93371,13 +93589,11 @@
     "resourceType": "AWS::AppStream::StackFleetAssociation",
     "kind": "resource",
     "lexicon": "aws",
-    "createOnly": [
-      "FleetName",
-      "StackName"
-    ],
+    "attrs": {
+      "Id": "Id"
+    },
     "primaryIdentifier": [
-      "FleetName",
-      "StackName"
+      "Id"
     ]
   },
   "StackInstances": {
@@ -98586,6 +98802,83 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "TopicV2": {
+    "resourceType": "AWS::QuickSight::TopicV2",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Arn": "Arn"
+    },
+    "propertyConstraints": {
+      "AwsAccountId": {
+        "pattern": "^[0-9]{12}$",
+        "minLength": 12,
+        "maxLength": 12
+      },
+      "Description": {
+        "minLength": 0,
+        "maxLength": 256
+      },
+      "Name": {
+        "minLength": 1,
+        "maxLength": 128
+      },
+      "TopicId": {
+        "pattern": "^[A-Za-z0-9-_.\\\\+]*$",
+        "minLength": 0,
+        "maxLength": 256
+      }
+    },
+    "createOnly": [
+      "AwsAccountId",
+      "FolderArns",
+      "TopicId",
+      "Tags"
+    ],
+    "writeOnly": [
+      "FolderArns",
+      "DataSets/*/DataSetName"
+    ],
+    "primaryIdentifier": [
+      "AwsAccountId",
+      "TopicId"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": false
+    }
+  },
+  "TopicV2_CustomInstructions": {
+    "resourceType": "AWS::QuickSight::TopicV2.CustomInstructions",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "TopicV2_DataSetReference": {
+    "resourceType": "AWS::QuickSight::TopicV2.DataSetReference",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "TopicV2_DataSetRelation": {
+    "resourceType": "AWS::QuickSight::TopicV2.DataSetRelation",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "TopicV2_DataSetRelationEndpoint": {
+    "resourceType": "AWS::QuickSight::TopicV2.DataSetRelationEndpoint",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "TopicV2_ResourcePermission": {
+    "resourceType": "AWS::QuickSight::TopicV2.ResourcePermission",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "TopicV2_Tag": {
+    "resourceType": "AWS::QuickSight::TopicV2.Tag",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "Topic_LoggingConfig": {
     "resourceType": "AWS::SNS::Topic.LoggingConfig",
     "kind": "property",

package/src/spec/fetch.test.ts

@@ -1,5 +1,9 @@
 import { describe, test, expect } from "vitest";
-import { fetchSchemaZip } from "./fetch";
+import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { fetchSchemaZip, loadPinnedSchemas, pinAssetName, pinAssetUrl } from "./fetch";
+import { specContentDigest } from "./pin";
 
 describe("fetchSchemaZip", () => {
   test("exports fetchSchemaZip function", () => {
@@ -25,3 +29,99 @@ describe("fetchSchemaZip", () => {
     }
   });
 });
+
+// #1511 — the pinned release asset is the deterministic source: verified
+// content loads (from local cache or the download), a digest mismatch refuses
+// loudly wherever the bytes came from, and an unreachable asset falls back to
+// the live path by returning undefined.
+describe("loadPinnedSchemas (#1511)", () => {
+  const schemaA = Buffer.from(JSON.stringify({ typeName: "AWS::Test::A", properties: {} }));
+  const schemaB = Buffer.from(JSON.stringify({ typeName: "AWS::Test::B", properties: {} }));
+
+  async function makeZip(): Promise<{ zip: Buffer; digest: string }> {
+    const { zipSync } = await import("fflate");
+    const zip = Buffer.from(zipSync({ "aws-test-a.json": schemaA, "aws-test-b.json": schemaB }));
+    const digest = specContentDigest(
+      new Map([
+        ["AWS::Test::A", schemaA],
+        ["AWS::Test::B", schemaB],
+      ]),
+    );
+    return { zip, digest };
+  }
+
+  test("a downloaded asset that digests to the pin loads, and is cached only after verifying", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-spec-pin-"));
+    try {
+      const { zip, digest } = await makeZip();
+      const pin = { digest, resources: 2, accepted: "2026-08-05" };
+      let downloads = 0;
+      const download = async () => (downloads++, zip);
+
+      const first = await loadPinnedSchemas({ pin, cacheDir: dir, download });
+      expect([...first!.keys()].sort()).toEqual(["AWS::Test::A", "AWS::Test::B"]);
+      expect(downloads).toBe(1);
+
+      // Second load: served from the verified local cache, no download.
+      const second = await loadPinnedSchemas({ pin, cacheDir: dir, download });
+      expect(second!.size).toBe(2);
+      expect(downloads).toBe(1);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("content that does not digest to the pin throws, naming both digests — and is never cached", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-spec-pin-"));
+    try {
+      const { zip } = await makeZip();
+      const pin = { digest: "sha256:" + "0".repeat(64), resources: 2, accepted: "2026-08-05" };
+      let downloads = 0;
+      const download = async () => (downloads++, zip);
+
+      await expect(loadPinnedSchemas({ pin, cacheDir: dir, download })).rejects.toThrow(
+        /extracts to sha256:.*declares sha256:0{8}/s,
+      );
+      // A second call downloads again: the bad copy must not have been cached.
+      await expect(loadPinnedSchemas({ pin, cacheDir: dir, download })).rejects.toThrow();
+      expect(downloads).toBe(2);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("a corrupted local cache copy refuses the same way — cache is not more trusted than the network", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-spec-pin-"));
+    try {
+      const { zip, digest } = await makeZip();
+      const pin = { digest, resources: 2, accepted: "2026-08-05" };
+      mkdirSync(dir, { recursive: true });
+      // A DIFFERENT zip planted at the pin's cache path.
+      const { zipSync } = await import("fflate");
+      const wrong = Buffer.from(zipSync({ "other.json": Buffer.from(JSON.stringify({ typeName: "AWS::Test::Other" })) }));
+      writeFileSync(join(dir, pinAssetName(pin)), wrong);
+
+      await expect(loadPinnedSchemas({ pin, cacheDir: dir, download: async () => zip })).rejects.toThrow(/extracts to/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("unreachable asset: undefined, so the caller falls back to the live fetch", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-spec-pin-"));
+    try {
+      const pin = { digest: "sha256:" + "1".repeat(64), resources: 2, accepted: "2026-08-05" };
+      const schemas = await loadPinnedSchemas({ pin, cacheDir: dir, download: async () => undefined });
+      expect(schemas).toBeUndefined();
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("the asset URL is public, content-addressed, and on the dedicated pin release", () => {
+    const pin = { digest: "sha256:" + "ab".repeat(32), resources: 1, accepted: "2026-08-05" };
+    expect(pinAssetUrl(pin)).toBe(
+      "https://github.com/INTENTIUS/chant/releases/download/aws-spec-pin/abababababab.zip",
+    );
+  });
+});