@intentius/chant-lexicon-aws 0.46.0 → 0.50.0

package/src/deep-topology.ts

@@ -0,0 +1,237 @@
+/**
+ * Deep-read sources for the EC2 topology types (#1269).
+ *
+ * chant's distinguishing answers are folds over topology: `internetFacing`
+ * resolves subnet -> route table -> internet gateway, `effectiveIngress`
+ * resolves rules across attached security groups, and the default-VPC
+ * classification (`defaults.ts`) reads the provider's own markers. The inputs
+ * to all of them are the types this file covers — with only the original four
+ * kinds readable, a deep snapshot of an EC2 estate carried almost no
+ * properties, and a snapshot-backed query could answer identity questions but
+ * not a single fold question.
+ *
+ * Two sources, chosen per type:
+ *
+ * - The container types (VPC, subnet, route table, internet gateway) read
+ *   through the EC2 describes. The fold facts live there and nowhere else:
+ *   `IsDefault`, `DefaultForAz` and a subnet's live `MapPublicIpOnLaunch` are
+ *   not part of the CloudFormation resource model, so Cloud Control cannot
+ *   report them. The describes are also bulk (one call per type for the whole
+ *   stack) and are implemented by the emulators that do not serve Cloud
+ *   Control's `GetResource`.
+ *
+ * - The join types (route, association, gateway attachment) and the two whose
+ *   describes do not fit a flat bulk join (instance rows nest inside
+ *   reservations; launch-template data lives in a separate versions call) read
+ *   through Cloud Control, which returns their model in the declared side's
+ *   own shape.
+ *
+ * Each type carries its normalization entries alongside (#1269's note: adding
+ * a type without them trades a hole for a false positive, which is worse).
+ * They are merged into the tables in `deep-observe.ts`.
+ */
+
+import type { DeepSource } from "./deep-observe";
+
+/**
+ * `describe-vpcs` -> the `AWS::EC2::VPC` resource model, plus `IsDefault`.
+ *
+ * `IsDefault` is the provider's own marker for the VPC nobody wrote — the fact
+ * the default classification reads — and it exists only on this surface.
+ * Carried even though the model does not name it; the diff subtracts it as a
+ * service default (`false`, gated on source silence) so a CloudFormation-made
+ * VPC does not report it as undeclared drift.
+ */
+export function vpcToModel(row: Record<string, unknown>): Record<string, unknown> {
+  return {
+    // The schema's readOnlyProperties prune the id after the ownership check.
+    ...(typeof row.VpcId === "string" ? { VpcId: row.VpcId } : {}),
+    ...(typeof row.CidrBlock === "string" ? { CidrBlock: row.CidrBlock } : {}),
+    ...(typeof row.InstanceTenancy === "string" ? { InstanceTenancy: row.InstanceTenancy } : {}),
+    ...(typeof row.IsDefault === "boolean" ? { IsDefault: row.IsDefault } : {}),
+    ...nonEmptyTags(row),
+  };
+}
+
+/**
+ * `describe-subnets` -> the `AWS::EC2::Subnet` resource model, plus
+ * `DefaultForAz`.
+ *
+ * `MapPublicIpOnLaunch` is half of `internetFacing`; `DefaultForAz` is the
+ * provider's default-subnet marker, off the model for the same reason as a
+ * VPC's `IsDefault` and handled the same way.
+ */
+export function subnetToModel(row: Record<string, unknown>): Record<string, unknown> {
+  return {
+    ...(typeof row.SubnetId === "string" ? { SubnetId: row.SubnetId } : {}),
+    ...(typeof row.VpcId === "string" ? { VpcId: row.VpcId } : {}),
+    ...(typeof row.CidrBlock === "string" ? { CidrBlock: row.CidrBlock } : {}),
+    ...(typeof row.AvailabilityZone === "string" ? { AvailabilityZone: row.AvailabilityZone } : {}),
+    ...(typeof row.AvailabilityZoneId === "string" ? { AvailabilityZoneId: row.AvailabilityZoneId } : {}),
+    ...(typeof row.MapPublicIpOnLaunch === "boolean" ? { MapPublicIpOnLaunch: row.MapPublicIpOnLaunch } : {}),
+    ...(typeof row.AssignIpv6AddressOnCreation === "boolean"
+      ? { AssignIpv6AddressOnCreation: row.AssignIpv6AddressOnCreation }
+      : {}),
+    ...(typeof row.EnableDns64 === "boolean" ? { EnableDns64: row.EnableDns64 } : {}),
+    ...(typeof row.Ipv6Native === "boolean" ? { Ipv6Native: row.Ipv6Native } : {}),
+    ...(typeof row.DefaultForAz === "boolean" ? { DefaultForAz: row.DefaultForAz } : {}),
+    ...nonEmptyTags(row),
+  };
+}
+
+/**
+ * `describe-route-tables` -> the `AWS::EC2::RouteTable` resource model.
+ *
+ * The row also carries `Routes` and `Associations`, and this mapping drops
+ * them on purpose: a template declares each route as its own
+ * `AWS::EC2::Route` and each association as its own
+ * `AWS::EC2::SubnetRouteTableAssociation`, both covered below, so carrying
+ * them here would report every declared route twice — once as an undeclared
+ * array on the table and once through its own resource.
+ */
+export function routeTableToModel(row: Record<string, unknown>): Record<string, unknown> {
+  return {
+    ...(typeof row.RouteTableId === "string" ? { RouteTableId: row.RouteTableId } : {}),
+    ...(typeof row.VpcId === "string" ? { VpcId: row.VpcId } : {}),
+    ...nonEmptyTags(row),
+  };
+}
+
+/** `describe-internet-gateways` -> the `AWS::EC2::InternetGateway` model, which is tags and nothing else. */
+export function internetGatewayToModel(row: Record<string, unknown>): Record<string, unknown> {
+  return {
+    ...(typeof row.InternetGatewayId === "string" ? { InternetGatewayId: row.InternetGatewayId } : {}),
+    ...nonEmptyTags(row),
+  };
+}
+
+/**
+ * An empty tag set is the absence of tags, not a value. EC2 always sends the
+ * key, so carrying it through reports `Tags: <undeclared> -> []` on every
+ * untagged resource — agreement rendered as drift. Same rule as the
+ * security-group mapping.
+ */
+function nonEmptyTags(row: Record<string, unknown>): Record<string, unknown> {
+  return Array.isArray(row.Tags) && row.Tags.length > 0 ? { Tags: row.Tags } : {};
+}
+
+/**
+ * The topology types' entries for `DEEP_SOURCES`.
+ *
+ * The routing-chain joins are addressed by their physical id — for a
+ * registry-backed type CloudFormation's physical id *is* the Cloud Control
+ * identifier (`rtb-…|0.0.0.0/0` for a route) — so Cloud Control's
+ * one-get-per-resource shape fits them exactly and returns the declared
+ * model's own field names.
+ */
+export const EC2_TOPOLOGY_SOURCES: Record<string, DeepSource> = {
+  "AWS::EC2::VPC": {
+    via: "ec2",
+    argv: ["ec2", "describe-vpcs"],
+    idFlag: "--vpc-ids",
+    key: "Vpcs",
+    id: "VpcId",
+    toModel: vpcToModel,
+  },
+  "AWS::EC2::Subnet": {
+    via: "ec2",
+    argv: ["ec2", "describe-subnets"],
+    idFlag: "--subnet-ids",
+    key: "Subnets",
+    id: "SubnetId",
+    toModel: subnetToModel,
+  },
+  "AWS::EC2::RouteTable": {
+    via: "ec2",
+    argv: ["ec2", "describe-route-tables"],
+    idFlag: "--route-table-ids",
+    key: "RouteTables",
+    id: "RouteTableId",
+    toModel: routeTableToModel,
+  },
+  "AWS::EC2::InternetGateway": {
+    via: "ec2",
+    argv: ["ec2", "describe-internet-gateways"],
+    idFlag: "--internet-gateway-ids",
+    key: "InternetGateways",
+    id: "InternetGatewayId",
+    toModel: internetGatewayToModel,
+  },
+  // The `0.0.0.0/0` -> igw edge `internetFacing` walks.
+  "AWS::EC2::Route": { via: "cloud-control" },
+  // Subnet -> route table.
+  "AWS::EC2::SubnetRouteTableAssociation": { via: "cloud-control" },
+  // Igw -> VPC.
+  "AWS::EC2::VPCGatewayAttachment": { via: "cloud-control" },
+  // Subnet, security groups, launch template — the instance end of both folds.
+  "AWS::EC2::Instance": { via: "cloud-control" },
+  // The indirect security-group hop `effectiveIngress` resolves through.
+  "AWS::EC2::LaunchTemplate": { via: "cloud-control" },
+};
+
+/**
+ * Service defaults for the topology types, merged into
+ * `AWS_SERVICE_DEFAULTS`. Subtracted on the live side only where source never
+ * declared the property — which is how the fold facts (`IsDefault`,
+ * `DefaultForAz`, a live `MapPublicIpOnLaunch`) stay in the snapshot for a
+ * query to read while never surfacing as drift on a resource CloudFormation
+ * itself created.
+ */
+export const EC2_TOPOLOGY_SERVICE_DEFAULTS: Record<string, Record<string, unknown>> = {
+  "AWS::EC2::VPC": {
+    InstanceTenancy: "default",
+    IsDefault: false,
+  },
+  "AWS::EC2::Subnet": {
+    MapPublicIpOnLaunch: false,
+    AssignIpv6AddressOnCreation: false,
+    EnableDns64: false,
+    Ipv6Native: false,
+    DefaultForAz: false,
+  },
+  "AWS::EC2::Instance": {
+    Tenancy: "default",
+    Monitoring: false,
+    EbsOptimized: false,
+    SourceDestCheck: true,
+    DisableApiTermination: false,
+  },
+};
+
+/**
+ * Values the service picks when the template does not supply one, merged into
+ * `AWS_GENERATED_NAMES`. A subnet that names no availability zone gets one
+ * assigned — a different one is real placement drift only when the template
+ * had an opinion, which is exactly the counterpart gate.
+ */
+export const EC2_TOPOLOGY_GENERATED_NAMES: Record<string, ReadonlySet<string>> = {
+  "AWS::EC2::Subnet": new Set(["AvailabilityZone", "AvailabilityZoneId"]),
+  "AWS::EC2::Instance": new Set(["AvailabilityZone"]),
+};
+
+/**
+ * Declared properties a type's source cannot see (#1269).
+ *
+ * `describe-vpcs` does not return the DNS attributes — they live behind
+ * `describe-vpc-attribute` — and neither describe returns the IPAM inputs,
+ * which are consumed at creation. A declared value for one of these has
+ * nothing live to stand against, so the diff would report `value -> <absent>`
+ * on every clean apply: a blind spot rendered as drift. Pruned on the
+ * declared side, and only where the live tree is silent, so a source that
+ * does report the field (Cloud Control, some day) is still compared.
+ */
+export const AWS_DEEP_BLIND_SPOTS: Record<string, ReadonlySet<string>> = {
+  "AWS::EC2::VPC": new Set([
+    "EnableDnsSupport",
+    "EnableDnsHostnames",
+    "Ipv4IpamPoolId",
+    "Ipv4NetmaskLength",
+  ]),
+  "AWS::EC2::Subnet": new Set([
+    "Ipv6CidrBlock",
+    "Ipv4IpamPoolId",
+    "Ipv4NetmaskLength",
+    "Ipv6IpamPoolId",
+    "Ipv6NetmaskLength",
+  ]),
+};

package/src/effect-receipt-row.test.ts

@@ -0,0 +1,164 @@
+import { describe, it, expect } from "vitest";
+import {
+  EffectReceipt,
+  receiptParameterName,
+  AWS_EFFECT_RECEIPT_ENTITY_TYPE,
+  EFFECT_RECEIPTS_METADATA_KEY,
+  RECEIPT_UNRESOLVED_VALUE_NOTE,
+} from "./effect-receipt-row";
+import { awsSerializer } from "./serializer";
+import { AWS_TAG_OWNERSHIP_KEYS } from "./ownership";
+import {
+  EXISTENCE_EXPECTATION,
+  isEffectReceipt,
+  receiptExpectation,
+  EFFECT_RECEIPT_MARKER,
+} from "@intentius/chant/effect-receipt";
+import { receiptCheckInput } from "@intentius/chant/op/receipt-store";
+import { coreReceiptChecks, RECEIPT_PLAIN_STORE_CHECK_ID } from "@intentius/chant/lint/receipt-checks";
+import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
+import { INTRINSIC_MARKER } from "@intentius/chant/intrinsic";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+
+/** A minimal deploy-time reference, for the placeholder-value case. */
+const someRef = { [INTRINSIC_MARKER]: true as const, toJSON: () => ({ Ref: "other" }) };
+
+function serializeReceipts(
+  receipts: Map<string, Declarable>,
+  ownership?: { stack: string; env?: string },
+): { Metadata?: Record<string, unknown>; Resources: Record<string, unknown> } {
+  const out = awsSerializer.serialize(new Map(), [], {
+    ...(ownership ? { ownership } : {}),
+    receipts,
+  });
+  return JSON.parse(typeof out === "string" ? out : out.primary);
+}
+
+function metadataRows(template: { Metadata?: Record<string, unknown> }) {
+  return template.Metadata?.[EFFECT_RECEIPTS_METADATA_KEY] as Record<
+    string,
+    { Type: string; Properties: Record<string, unknown> }
+  >;
+}
+
+describe("EffectReceipt (aws materialization row)", () => {
+  it("declares under the aws lexicon with the real resource kind, carrying the marker", () => {
+    const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+    expect(r.lexicon).toBe("aws");
+    expect(r.entityType).toBe(AWS_EFFECT_RECEIPT_ENTITY_TYPE);
+    expect(isEffectReceipt(r)).toBe(true);
+    expect(r.props.Type).toBe("String");
+  });
+
+  it("is accepted by the effect() step's receiptCheckInput, expectation stamped when static", () => {
+    const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "hash", inputs: { v: 1 } });
+    const input = receiptCheckInput(r);
+    expect(input.receipt.effect).toBe("db-seed");
+    expect(input.expectation).toBe(receiptExpectation(r));
+  });
+
+  it("validates the effect as a path segment at declaration", () => {
+    expect(() => EffectReceipt("bad", { effect: "a/b", flavor: "existence" })).toThrow(/path segment/);
+    expect(() => EffectReceipt("bad", { effect: "", flavor: "existence" })).toThrow(/non-empty/);
+  });
+});
+
+describe("receiptParameterName", () => {
+  it("derives /chant-receipts/<stack>/<env>/<effect>", () => {
+    expect(receiptParameterName("demo", "dev", "db-seed")).toBe("/chant-receipts/demo/dev/db-seed");
+  });
+
+  it("refuses a segment that would deepen the hierarchy", () => {
+    expect(() => receiptParameterName("a/b", "dev", "seed")).toThrow(/stack/);
+    expect(() => receiptParameterName("demo", "", "seed")).toThrow(/env/);
+  });
+});
+
+describe("awsSerializer receipt rows", () => {
+  const ownership = { stack: "demo", env: "dev" };
+
+  it("renders each receipt as a plain-String SSM parameter row at the derived path, ownership-tagged", () => {
+    const seeded = EffectReceipt("seeded", { effect: "db-seed", flavor: "hash", inputs: { v: 1 } });
+    const template = serializeReceipts(new Map([["seeded", seeded]]), ownership);
+    const row = metadataRows(template).seeded;
+    expect(row.Type).toBe("AWS::SSM::Parameter");
+    expect(row.Properties.Name).toBe("/chant-receipts/demo/dev/db-seed");
+    expect(row.Properties.Type).toBe("String");
+    expect(row.Properties.Value).toBe(receiptExpectation(seeded));
+    expect(row.Properties.Tags).toContainEqual({ Key: AWS_TAG_OWNERSHIP_KEYS.managedBy, Value: "chant" });
+    expect(row.Properties.Tags).toContainEqual({ Key: AWS_TAG_OWNERSHIP_KEYS.stack, Value: "demo" });
+    expect(row.Properties.Tags).toContainEqual({ Key: AWS_TAG_OWNERSHIP_KEYS.env, Value: "dev" });
+  });
+
+  it("keeps the receipt out of Resources — the section appliers write from", () => {
+    const seeded = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+    const template = serializeReceipts(new Map([["seeded", seeded]]), ownership);
+    expect(Object.keys(template.Resources)).toHaveLength(0);
+    expect(metadataRows(template).seeded).toBeDefined();
+  });
+
+  it("renders the existence expectation for an existence receipt", () => {
+    const r = EffectReceipt("booted", { effect: "bootstrap", flavor: "existence" });
+    const template = serializeReceipts(new Map([["booted", r]]), ownership);
+    expect(metadataRows(template).booted.Properties.Value).toBe(EXISTENCE_EXPECTATION);
+  });
+
+  it("renders the placeholder note, never a placeholder digest, for reference inputs", () => {
+    const r = EffectReceipt("wired", { effect: "wire-up", flavor: "hash", inputs: { target: someRef } });
+    const template = serializeReceipts(new Map([["wired", r]]), ownership);
+    expect(metadataRows(template).wired.Properties.Value).toBe(RECEIPT_UNRESOLVED_VALUE_NOTE);
+  });
+
+  it("errors when no ownership marker resolves", () => {
+    const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+    expect(() => serializeReceipts(new Map([["seeded", r]]))).toThrow(/ownership/);
+  });
+
+  it("errors when ownership resolves no env — the segment is explicit, never guessed", () => {
+    const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+    expect(() => serializeReceipts(new Map([["seeded", r]]), { stack: "demo" })).toThrow(/env/);
+  });
+
+  it("emits no receipt block when the context carries no receipts", () => {
+    const out = awsSerializer.serialize(new Map(), [], { ownership });
+    const template = JSON.parse(typeof out === "string" ? out : out.primary);
+    expect(template.Metadata?.[EFFECT_RECEIPTS_METADATA_KEY]).toBeUndefined();
+  });
+});
+
+describe("#1833's plain-store guard over the aws row", () => {
+  const check = coreReceiptChecks().find((c) => c.id === RECEIPT_PLAIN_STORE_CHECK_ID)!;
+
+  function runCheck(entities: Map<string, Declarable>) {
+    const ctx: PostSynthContext = {
+      outputs: new Map(),
+      entities,
+      buildResult: { outputs: new Map(), entities, warnings: [], errors: [], sourceFileCount: 0 },
+    };
+    return check.check(ctx);
+  }
+
+  it("passes the factory's row — SSM plain String", () => {
+    const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+    expect(runCheck(new Map([["seeded", r]]))).toEqual([]);
+  });
+
+  it("fails a SecureString fixture", () => {
+    const secure = {
+      [DECLARABLE_MARKER]: true as const,
+      [EFFECT_RECEIPT_MARKER]: true as const,
+      lexicon: "aws",
+      entityType: "AWS::SSM::Parameter",
+      name: "sneaky",
+      effect: "db-seed",
+      flavor: "existence" as const,
+      inputs: {},
+      props: { Type: "SecureString" },
+    };
+    const diagnostics = runCheck(new Map([["sneaky", secure as unknown as Declarable]]));
+    expect(diagnostics).toHaveLength(1);
+    expect(diagnostics[0].checkId).toBe(RECEIPT_PLAIN_STORE_CHECK_ID);
+    expect(diagnostics[0].severity).toBe("error");
+    expect(diagnostics[0].message).toMatch(/SecureString/);
+  });
+});

package/src/effect-receipt-row.ts

@@ -0,0 +1,147 @@
+/**
+ * The aws effect-receipt materialization row (#1835, epic #1703): an effect
+ * receipt stored as an `AWS::SSM::Parameter`, plain `String`, at
+ * `/chant-receipts/<stack>/<env>/<effect>`.
+ *
+ * Core's `EffectReceipt` factory (#1831) declares a receipt under the `chant`
+ * pseudo-lexicon, which no serializer claims — the designed shape until a
+ * lexicon materializes it. This module is that materialization for aws: the
+ * {@link EffectReceipt} factory here produces the same declaration shape but
+ * under `lexicon: "aws"`, so the build partitions it to the aws serializer,
+ * #1832's write-exclusion seam withholds it from the apply-bound entity set,
+ * and the serializer renders it for visibility through
+ * `SerializeContext.receipts` (see ./serializer.ts).
+ *
+ * Path identity (epic decision 4): the parameter name derives from the SAME
+ * ownership-block fields that stamp markers — `ownership.stack` and an
+ * explicit `ownership.env` — plus the receipt's `effect`. One derivation,
+ * {@link receiptParameterName}, shared by the serializer (the rendered row),
+ * the receipt store (../receipt-store.ts — what `receiptRead`/`receiptWrite`
+ * actually touch), and the observation leg (plan's live read). No env, no
+ * path: the callers error rather than guessing a segment.
+ *
+ * Plain store (epic decision 7, #1833's COR023): the parameter type is pinned
+ * to `String` at the source — the factory does not take a type, and the
+ * declared `props.Type` is the literal `"String"`. A receipt value is a
+ * witness (an existence marker or a `sha256:` digest), never a secret; a
+ * `SecureString` invites masking and rotation semantics that defeat the
+ * observe-and-compare loop, and the lint guard fails it.
+ */
+
+import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
+import {
+  EffectReceipt as CoreEffectReceipt,
+  EFFECT_RECEIPT_MARKER,
+  type EffectReceiptFlavor,
+  type EffectReceiptOptions,
+} from "@intentius/chant/effect-receipt";
+
+/** The entityType of the aws materialization row — the real resource kind the
+ * receipt is stored as, which is what lint's plain-store guard checks. */
+export const AWS_EFFECT_RECEIPT_ENTITY_TYPE = "AWS::SSM::Parameter";
+
+/** Template-level `Metadata` key the serializer renders receipt rows under.
+ * Beside `chant:ownership` (./ownership.ts) and like it deliberately outside
+ * `Resources` — the applier writes from `Resources`, and a receipt must never
+ * enter the apply-bound document (#1832; the `effect()` step is the sole
+ * writer, epic decision 3). */
+export const EFFECT_RECEIPTS_METADATA_KEY = "chant:effect-receipts";
+
+/** Every receipt parameter lives under this prefix, so read-only IAM can be
+ * scoped to `arn:…:parameter/chant-receipts/*` and nothing else. */
+export const RECEIPT_PATH_PREFIX = "/chant-receipts";
+
+/**
+ * The rendered `Value` of a hash-flavor receipt that still carries reference
+ * inputs at synthesis. References resolve at plan and at run, never at
+ * synthesis (epic decision 5) — so the row carries this note instead of a
+ * digest hashed over placeholders.
+ */
+export const RECEIPT_UNRESOLVED_VALUE_NOTE =
+  "unresolved at synthesis — reference inputs; the expectation resolves at plan and at run (chant #1703, decision 5)";
+
+/** One path segment of the receipt parameter name. SSM hierarchical names are
+ * `/`-separated `[\w.-]+` segments, and the identity must stay one segment per
+ * field — a `/` inside a stack name would silently deepen the hierarchy. */
+const PATH_SEGMENT = /^[\w.-]+$/;
+
+function checkSegment(field: string, value: string): string {
+  if (!PATH_SEGMENT.test(value)) {
+    throw new Error(
+      `receipt path: ${field} "${value}" is not a valid SSM path segment — ` +
+        `use only letters, digits, ".", "_", "-" (the segment becomes one level of ` +
+        `${RECEIPT_PATH_PREFIX}/<stack>/<env>/<effect>)`,
+    );
+  }
+  return value;
+}
+
+/**
+ * The SSM parameter name of one effect's receipt:
+ * `/chant-receipts/<stack>/<env>/<effect>`, from the resolved ownership
+ * marker fields (epic decision 4). The single source of the path identity —
+ * the serializer's rendered row, the receipt store's reads and writes, and
+ * the observation leg all call this.
+ */
+export function receiptParameterName(stack: string, env: string, effect: string): string {
+  return `${RECEIPT_PATH_PREFIX}/${checkSegment("stack", stack)}/${checkSegment("env", env)}/${checkSegment("effect", effect)}`;
+}
+
+/**
+ * An aws-materialized effect receipt: core's declaration shape (so
+ * `isEffectReceipt`, `effect(...)`, lint, and the plan engine all recognize it
+ * through the marker), under the aws lexicon and the real resource kind, with
+ * the store variant pinned plain.
+ */
+export interface AwsEffectReceiptDeclaration extends Declarable {
+  readonly [EFFECT_RECEIPT_MARKER]: true;
+  readonly lexicon: "aws";
+  readonly entityType: typeof AWS_EFFECT_RECEIPT_ENTITY_TYPE;
+  /** The receipt's own name (the export-level identity of the witness). */
+  readonly name: string;
+  /** The effect this receipt witnesses — the path's final segment. */
+  readonly effect: string;
+  /** How the receipt is compared: mere presence, or a digest of the inputs. */
+  readonly flavor: EffectReceiptFlavor;
+  /** The effect's inputs as recorded at synthesis (references as placeholders). */
+  readonly inputs: Readonly<Record<string, unknown>>;
+  /** The declared parameter variant — pinned `String` at the source, which is
+   * the concrete half of #1833's plain-store guard. */
+  readonly props: { readonly Type: "String" };
+}
+
+/**
+ * Declare an aws-materialized effect receipt. Same signature and semantics as
+ * core's `EffectReceipt` (#1831) — the options are validated and frozen by the
+ * core factory — but the declaration lands in the aws partition, so the aws
+ * serializer renders the `AWS::SSM::Parameter` row and the receipt store
+ * (../receipt-store.ts) is its writer. Pass the returned const straight to the
+ * `effect(...)` op step.
+ */
+export function EffectReceipt(name: string, options: EffectReceiptOptions): AwsEffectReceiptDeclaration {
+  // Fail at declaration, not at serialize: the effect is the path's final
+  // segment, and a name that cannot become a segment has no receipt address.
+  if (typeof options?.effect === "string" && options.effect.length > 0) {
+    checkSegment("effect", options.effect);
+  }
+  const core = CoreEffectReceipt(name, options);
+  const decl: AwsEffectReceiptDeclaration = {
+    [DECLARABLE_MARKER]: true,
+    [EFFECT_RECEIPT_MARKER]: true,
+    lexicon: "aws",
+    entityType: AWS_EFFECT_RECEIPT_ENTITY_TYPE,
+    name: core.name,
+    effect: core.effect,
+    flavor: core.flavor,
+    // The same frozen structure the core factory built — intrinsic inputs stay
+    // live so discovery can stamp logical names onto attr-refs.
+    inputs: core.inputs,
+    props: Object.freeze({ Type: "String" as const }),
+  };
+  // Declared fields immutable, object extensible for discovery's own
+  // symbol-keyed metadata — the same lock the core factory applies.
+  for (const key of Object.keys(decl)) {
+    Object.defineProperty(decl, key, { writable: false, configurable: false });
+  }
+  return decl;
+}

package/src/generated/lexicon-aws.json

@@ -6222,6 +6222,9 @@
     "deprecatedProperties": [
       "DeleteStorageConnectors"
     ],
+    "inferredDeprecations": [
+      "DeleteStorageConnectors"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -11669,6 +11672,9 @@
     "deprecatedProperties": [
       "AccessControl"
     ],
+    "inferredDeprecations": [
+      "AccessControl"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -14989,6 +14995,9 @@
     "deprecatedProperties": [
       "ComputeModel"
     ],
+    "inferredDeprecations": [
+      "ComputeModel"
+    ],
     "replacementStrategy": "delete_then_create",
     "tagging": {
       "taggable": true,
@@ -15385,6 +15394,9 @@
     "deprecatedProperties": [
       "ComputeModel"
     ],
+    "inferredDeprecations": [
+      "ComputeModel"
+    ],
     "conditionalCreateOnly": [
       "DbNodes"
     ],
@@ -17085,6 +17097,9 @@
     "deprecatedProperties": [
       "Deprecated"
     ],
+    "inferredDeprecations": [
+      "Deprecated"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -29032,6 +29047,9 @@
       "TdeCredentialPassword",
       "DBSecurityGroups"
     ],
+    "inferredDeprecations": [
+      "DBSecurityGroups"
+    ],
     "conditionalCreateOnly": [
       "AutoMinorVersionUpgrade",
       "AvailabilityZone",
@@ -33246,6 +33264,9 @@
     "deprecatedProperties": [
       "ImageScanningConfiguration"
     ],
+    "inferredDeprecations": [
+      "ImageScanningConfiguration"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -41749,6 +41770,9 @@
     "deprecatedProperties": [
       "Runtime"
     ],
+    "inferredDeprecations": [
+      "Runtime"
+    ],
     "conditionalCreateOnly": [
       "DurableConfig"
     ],
@@ -49621,6 +49645,10 @@
       "ElasticGpuSpecifications",
       "ElasticInferenceAccelerators"
     ],
+    "inferredDeprecations": [
+      "ElasticGpuSpecifications",
+      "ElasticInferenceAccelerators"
+    ],
     "conditionalCreateOnly": [
       "AdditionalInfo",
       "Affinity",
@@ -64878,6 +64906,9 @@
     "deprecatedProperties": [
       "DBPort"
     ],
+    "inferredDeprecations": [
+      "DBPort"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -100101,6 +100132,9 @@
     "deprecatedProperties": [
       "State"
     ],
+    "inferredDeprecations": [
+      "State"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,