Add Smithy model support to generator

- Implement Smithy shape converter to handle traits-based format
- Add service namespace resolution for qualified shape lookups
- Implement staged pattern transformation with practical compatibility
- Handle both enum-as-trait and enum-as-type formats
- Sort enum values for deterministic output

Key design decisions:
- Prioritize clean, documented pattern transforms over exhaustive mapping
- Accept some breaking changes for simpler architecture
- Maintain critical ARN and validation pattern compatibility

Author: bendrucker

rules/models/generator/main.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
+	"strings"
 
 	hcl "github.com/hashicorp/hcl/v2"
 	"github.com/hashicorp/hcl/v2/gohcl"
@@ -80,7 +81,13 @@ func main() {
 				if shapeName == "any" {
 					continue
 				}
-				model := shapes[shapeName].(map[string]interface{})
+
+				model := findShape(shapes, shapeName)
+				if model == nil {
+					fmt.Printf("Shape `%s` not found, skipping\n", shapeName)
+					continue
+				}
+
 				schema, err := fetchSchema(mapping.Resource, attribute, model, awsProvider)
 				if err != nil {
 					fmt.Fprintf(os.Stderr, "Error processing `%s.%s`: %v\n", mapping.Resource, attribute, err)
@@ -153,3 +160,119 @@ func validMapping(model map[string]interface{}) bool {
 		return false
 	}
 }
+
+// findShape locates a shape in Smithy format with namespace-qualified lookup
+func findShape(shapes map[string]interface{}, shapeName string) map[string]interface{} {
+	// Try with service namespace qualification (Smithy format)
+	serviceNamespace := extractServiceNamespace(shapes)
+	if serviceNamespace != "" {
+		qualifiedName := fmt.Sprintf("%s#%s", serviceNamespace, shapeName)
+		if shape, ok := shapes[qualifiedName]; ok {
+			return convertSmithyShape(shape.(map[string]interface{}))
+		}
+	}
+
+	// Fallback to direct lookup (legacy format or unqualified shapes)
+	if shape, ok := shapes[shapeName]; ok {
+		if shapeMap, ok := shape.(map[string]interface{}); ok {
+			return shapeMap
+		}
+	}
+
+	return nil
+}
+
+// extractServiceNamespace extracts the namespace from the Smithy service definition
+func extractServiceNamespace(shapes map[string]interface{}) string {
+	for shapeName, shape := range shapes {
+		if shapeMap, ok := shape.(map[string]interface{}); ok {
+			if shapeType, ok := shapeMap["type"].(string); ok && shapeType == "service" {
+				// Extract namespace from shape name (e.g., "com.amazonaws.acmpca#ACMPrivateCA")
+				if parts := strings.Split(shapeName, "#"); len(parts) == 2 {
+					return parts[0]
+				}
+			}
+		}
+	}
+	return ""
+}
+
+// convertSmithyShape converts Smithy model format to internal format
+// Smithy uses traits for metadata while our internal format uses direct fields
+func convertSmithyShape(smithyShape map[string]interface{}) map[string]interface{} {
+	result := make(map[string]interface{})
+
+	// Copy type
+	if shapeType, ok := smithyShape["type"]; ok {
+		result["type"] = shapeType
+	}
+
+	// Extract constraints and patterns from Smithy traits
+	if traits, ok := smithyShape["traits"].(map[string]interface{}); ok {
+		// Length constraints
+		if lengthTrait, ok := traits["smithy.api#length"].(map[string]interface{}); ok {
+			if min, ok := lengthTrait["min"]; ok {
+				result["min"] = min
+			}
+			if max, ok := lengthTrait["max"]; ok {
+				result["max"] = max
+			}
+		}
+
+		// Pattern constraint
+		if pattern, ok := traits["smithy.api#pattern"].(string); ok {
+			result["pattern"] = pattern
+		}
+
+		// Enum as trait (older Smithy style)
+		if enumTrait, ok := traits["smithy.api#enum"]; ok {
+			if enumList, ok := enumTrait.([]interface{}); ok {
+				enumValues := make([]string, 0, len(enumList))
+				for _, enumItem := range enumList {
+					if enumMap, ok := enumItem.(map[string]interface{}); ok {
+						if value, ok := enumMap["value"].(string); ok {
+							enumValues = append(enumValues, value)
+						}
+					}
+				}
+				sort.Strings(enumValues)
+				result["enum"] = enumValues
+			}
+		}
+	}
+
+	// Enum as type (newer Smithy style: type="enum" with members)
+	if shapeType, ok := smithyShape["type"].(string); ok && shapeType == "enum" {
+		if members, ok := smithyShape["members"].(map[string]interface{}); ok {
+			enumValues := make([]string, 0, len(members))
+
+			// Sort member names for deterministic ordering
+			memberNames := make([]string, 0, len(members))
+			for memberName := range members {
+				memberNames = append(memberNames, memberName)
+			}
+			sort.Strings(memberNames)
+
+			// Extract enum values
+			for _, memberName := range memberNames {
+				memberData := members[memberName]
+				enumValue := memberName
+
+				// Check for explicit enumValue in traits
+				if memberMap, ok := memberData.(map[string]interface{}); ok {
+					if traits, ok := memberMap["traits"].(map[string]interface{}); ok {
+						if enumValueTrait, ok := traits["smithy.api#enumValue"].(string); ok {
+							enumValue = enumValueTrait
+						}
+					}
+				}
+				enumValues = append(enumValues, enumValue)
+			}
+
+			result["enum"] = enumValues
+			result["type"] = "string" // Normalize enum type to string
+		}
+	}
+
+	return result
+}

rules/models/generator/rule.go

@@ -88,12 +88,17 @@ func fetchNumber(model map[string]interface{}, key string) int {
 
 func fetchStrings(model map[string]interface{}, key string) []string {
 	if raw, ok := model[key]; ok {
-		list := raw.([]interface{})
-		ret := make([]string, len(list))
-		for i, v := range list {
-			ret[i] = v.(string)
+		// Handle both []interface{} and []string for compatibility
+		switch v := raw.(type) {
+		case []interface{}:
+			ret := make([]string, len(v))
+			for i, item := range v {
+				ret[i] = item.(string)
+			}
+			return ret
+		case []string:
+			return v
 		}
-		return ret
 	}
 	return []string{}
 }
@@ -109,14 +114,73 @@ func replacePattern(pattern string) string {
 	if pattern == "" {
 		return pattern
 	}
-	reg := regexp.MustCompile(`\\u([0-9A-F]{4})`)
-	replaced := reg.ReplaceAllString(pattern, `\x{$1}`)
+
+	// Handle placeholder patterns (documentation text, not validation patterns)
+	if pattern == "^See rules in parameter description$" {
+		return ""
+	}
+
+	// Convert Unicode escapes from \uXXXX to \x{XXXX} format
+	unicodeEscapeRegex := regexp.MustCompile(`\\u([0-9A-F]{4})`)
+	replaced := unicodeEscapeRegex.ReplaceAllString(pattern, `\x{$1}`)
+
+	// Fix incomplete patterns
+	if replaced == "^(?s)" {
+		return "^(?s).*$"
+	}
+
+	// Handle patterns missing anchors
 	if !strings.HasPrefix(replaced, "^") && !strings.HasSuffix(replaced, "$") {
+		if replaced == "\\S" {
+			return "^.*\\S.*$"
+		}
 		return fmt.Sprintf("^%s$", replaced)
 	}
+
+	// Apply compatibility transforms to maintain backward compatibility with Ruby SDK
+	if transformed := applyCompatibilityTransforms(replaced); transformed != "" {
+		return transformed
+	}
+
 	return replaced
 }
 
+func applyCompatibilityTransforms(pattern string) string {
+	// IAM role ARN patterns: Smithy models end at the role prefix (e.g., "role/")
+	// but Terraform configurations include role paths (e.g., "role/my-app/my-role").
+	// Add .* suffix to match the role name/path after the prefix.
+	arnRolePatterns := map[string]string{
+		"^arn:aws:iam::[0-9]*:role/":                  "^arn:aws:iam::[0-9]*:role/.*$",
+		"^arn:aws:iam::\\d{12}:role/":                 "^arn:aws:iam::\\d{12}:role/.*$",
+		"^arn:aws(-[\\w]+)*:iam::[0-9]{12}:role/":     "^arn:aws(-[\\w]+)*:iam::[0-9]{12}:role/.*$",
+		"^arn:aws(-[a-z]{1,3}){0,2}:iam::\\d+:role/": "^arn:aws(-[a-z]{1,3}){0,2}:iam::\\d+:role/.*$",
+	}
+
+	// Cognito SMS authentication messages: The {####} placeholder must appear
+	// within a message, not be the entire message. Transform from matching
+	// literal "{####}" to matching any message containing "{####}".
+	// Example valid message: "Your code is {####}. Do not share it."
+	cognitoMessagePatterns := map[string]string{
+		"^\\{####\\}$": "^.*\\{####\\}.*$",
+	}
+
+	// WorkSpaces directory IDs: Smithy pattern has redundant end anchors ($)
+	// inside each alternation branch AND at the end of the pattern.
+	// Pattern "(foo$)|(bar$)$" is equivalent to "(foo)|(bar)" when the outer
+	// anchors are present. Remove inner anchors for cleaner regex.
+	workspacesDirectoryPatterns := map[string]string{
+		"^(d-[0-9a-f]{8,63}$)|(wsd-[0-9a-z]{8,63}$)$": "(d-[0-9a-f]{8,63}$)|(wsd-[0-9a-z]{8,63}$)",
+	}
+
+	for _, transforms := range []map[string]string{arnRolePatterns, cognitoMessagePatterns, workspacesDirectoryPatterns} {
+		if transformed, exists := transforms[pattern]; exists {
+			return transformed
+		}
+	}
+
+	return ""
+}
+
 func formatTest(body string) string {
 	if strings.Contains(body, "\n") {
 		return fmt.Sprintf("<<TEXT\n%sTEXT", body)

rules/models/mappings/access-analyzer.hcl

@@ -1,4 +1,4 @@
-import = "aws-sdk-ruby/apis/accessanalyzer/2019-11-01/api-2.json"
+import = "api-models-aws/models/accessanalyzer/service/2019-11-01/accessanalyzer-2019-11-01.json"
 
 mapping "aws_accessanalyzer_analyzer" {
   analyzer_name = Name

rules/models/mappings/account.hcl

@@ -1,4 +1,4 @@
-import = "aws-sdk-ruby/apis/account/2021-02-01/api-2.json"
+import = "api-models-aws/models/account/service/2021-02-01/account-2021-02-01.json"
 
 mapping "aws_account_alternate_contact" {
   account_id = AccountId

rules/models/mappings/acm-pca.hcl

@@ -1,4 +1,4 @@
-import = "aws-sdk-ruby/apis/acm-pca/2017-08-22/api-2.json"
+import = "api-models-aws/models/acm-pca/service/2017-08-22/acm-pca-2017-08-22.json"
 
 mapping "aws_acmpca_certificate" {
   certificate_authority_arn   = Arn

rules/models/mappings/acm.hcl

@@ -1,4 +1,4 @@
-import = "aws-sdk-ruby/apis/acm/2015-12-08/api-2.json"
+import = "api-models-aws/models/acm/service/2015-12-08/acm-2015-12-08.json"
 
 mapping "aws_acm_certificate" {
   // domain_name            = DomainNameString

rules/models/mappings/amplify.hcl

@@ -1,4 +1,4 @@
-import = "aws-sdk-ruby/apis/amplify/2017-07-25/api-2.json"
+import = "api-models-aws/models/amplify/service/2017-07-25/amplify-2017-07-25.json"
 
 mapping "aws_amplify_app" {
   name = Name

rules/models/mappings/apigateway.hcl

@@ -1,4 +1,4 @@
-import = "aws-sdk-ruby/apis/apigateway/2015-07-09/api-2.json"
+import = "api-models-aws/models/api-gateway/service/2015-07-09/api-gateway-2015-07-09.json"
 
 mapping "aws_api_gateway_documentation_part" {
   location = DocumentationPartLocation

rules/models/mappings/apigatewayv2.hcl

@@ -1,4 +1,4 @@
-import = "aws-sdk-ruby/apis/apigatewayv2/2018-11-29/api-2.json"
+import = "api-models-aws/models/apigatewayv2/service/2018-11-29/apigatewayv2-2018-11-29.json"
 
 mapping "aws_apigatewayv2_api" {
   name = StringWithLengthBetween1And128

rules/models/mappings/appconfig.hcl

@@ -1,4 +1,4 @@
-import = "aws-sdk-ruby/apis/appconfig/2019-10-09/api-2.json"
+import = "api-models-aws/models/appconfig/service/2019-10-09/appconfig-2019-10-09.json"
 
 mapping "aws_appconfig_application" {
   name = Name