@intentius/behold 0.2.3 → 0.3.0

package/example-writes/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "behold-example-writes",
+  "private": true,
+  "type": "module",
+  "description": "A cheap AWS project (one S3 bucket) + Ops, for behold's delegated Sync/Adopt demos.",
+  "scripts": {
+    "build": "./node_modules/.bin/chant build src --lexicon aws -o template.json"
+  },
+  "dependencies": {
+    "@intentius/chant": "^0.32.0",
+    "@intentius/chant-lexicon-aws": "^0.32.0",
+    "@intentius/chant-lexicon-temporal": "^0.32.0"
+  }
+}

package/example-writes/src/bucket.ts

@@ -0,0 +1,54 @@
+import {
+  Bucket,
+  Bucket_PublicAccessBlockConfiguration,
+  Bucket_BucketEncryption,
+  Bucket_ServerSideEncryptionRule,
+  Bucket_ServerSideEncryptionByDefault,
+  S3BucketPolicy,
+  Ref,
+} from "@intentius/chant-lexicon-aws";
+
+// One S3 bucket — the whole "infra" for behold's first-apply demo. With
+// `behold serve … --local` this deploys to the local Floci emulator (no cloud
+// creds); against a real account, change BucketName to something globally unique.
+export const store = new Bucket({
+  BucketName: "behold-floci-demo",
+  PublicAccessBlockConfiguration: new Bucket_PublicAccessBlockConfiguration({
+    BlockPublicAcls: true,
+    BlockPublicPolicy: true,
+    IgnorePublicAcls: true,
+    RestrictPublicBuckets: true,
+  }),
+  // Server-side encryption (WAW006).
+  BucketEncryption: new Bucket_BucketEncryption({
+    ServerSideEncryptionConfiguration: [
+      new Bucket_ServerSideEncryptionRule({
+        ServerSideEncryptionByDefault: new Bucket_ServerSideEncryptionByDefault({ SSEAlgorithm: "AES256" }),
+      }),
+    ],
+  }),
+});
+
+// Deny non-TLS access (WAW042). Both values are hoisted to consts so they're plain
+// identifier references in the constructor (EVL001 forbids call expressions and
+// inline objects as property values). `Ref(store)` ties the policy to `store` by
+// logical id, which is how WAW042 matches policy → bucket.
+const storeRef = Ref(store);
+const denyInsecureTransport = {
+  Version: "2012-10-17",
+  Statement: [
+    {
+      Sid: "DenyInsecureTransport",
+      Effect: "Deny",
+      Principal: "*",
+      Action: "s3:*",
+      Resource: ["arn:aws:s3:::behold-floci-demo", "arn:aws:s3:::behold-floci-demo/*"],
+      Condition: { Bool: { "aws:SecureTransport": "false" } },
+    },
+  ],
+};
+
+export const storePolicy = new S3BucketPolicy({
+  Bucket: storeRef,
+  PolicyDocument: denyInsecureTransport,
+});

package/example-writes/tsconfig.json

@@ -0,0 +1 @@
+{ "compilerOptions": { "target": "ES2022", "module": "ESNext", "moduleResolution": "Bundler", "strict": true, "skipLibCheck": true, "noEmit": true }, "include": ["src/**/*", "ops/**/*", "chant.config.ts"] }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/behold",
-  "version": "0.2.3",
+  "version": "0.3.0",
   "type": "module",
   "description": "behold — a live control plane on chant. See your whole estate (every substrate in one graph), coloured by drift; act through delegated, gated Ops.",
   "bin": {
@@ -9,7 +9,9 @@
   "files": [
     "bin",
     "dist",
-    "web"
+    "web",
+    "example-writes",
+    "AGENTS.md"
   ],
   "publishConfig": {
     "access": "public",