@intentius/chant-lexicon-aws 0.124.30 → 0.124.32

package/dist/composites/step-functions-workflow.js

@@ -0,0 +1,78 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Role, Role_Policy, LogGroup, StateMachine, StateMachine_LoggingConfiguration, StateMachine_LogDestination, StateMachine_CloudWatchLogsLogGroup, } from "../generated/index.js";
+import { LambdaActions } from "../actions/lambda.js";
+const stepFunctionsTrustPolicy = {
+    Version: "2012-10-17",
+    Statement: [
+        {
+            Effect: "Allow",
+            Principal: { Service: "states.amazonaws.com" },
+            Action: "sts:AssumeRole",
+        },
+    ],
+};
+/**
+ * CloudWatch Logs delivery actions a state machine's role needs to write to a
+ * log group via `LoggingConfiguration`. These act on the account's log
+ * delivery configuration rather than a specific ARN, so AWS documents them
+ * granted with `Resource: "*"` — see
+ * https://docs.aws.amazon.com/step-functions/latest/dg/cw-logs.html#cloudwatch-iam-policy
+ */
+const LOG_DELIVERY_ACTIONS = [
+    "logs:CreateLogDelivery",
+    "logs:GetLogDelivery",
+    "logs:UpdateLogDelivery",
+    "logs:DeleteLogDelivery",
+    "logs:ListLogDeliveries",
+    "logs:PutResourcePolicy",
+    "logs:DescribeResourcePolicies",
+    "logs:DescribeLogGroups",
+];
+const logDeliveryPolicyDocument = {
+    Version: "2012-10-17",
+    // Log-delivery actions operate on the account's delivery configuration
+    // rather than a specific ARN — AWS documents them with Resource: "*".
+    Statement: [{ Effect: "Allow", Action: LOG_DELIVERY_ACTIONS, Resource: "*" }],
+};
+/** A Step Functions state machine with its execution role and a log group. */
+export const StepFunctionsWorkflow = Composite((props) => {
+    const { defaults } = props;
+    const logGroup = new LogGroup(mergeDefaults({
+        RetentionInDays: props.logRetentionDays ?? 14,
+    }, defaults?.logGroup));
+    const logDeliveryPolicy = new Role_Policy({
+        PolicyName: "StepFunctionsLogDelivery",
+        PolicyDocument: logDeliveryPolicyDocument,
+    });
+    const invokePolicyDocument = {
+        Version: "2012-10-17",
+        Statement: [{ Effect: "Allow", Action: LambdaActions.Invoke, Resource: props.lambdaFunctionArns }],
+    };
+    // Conditional entry via spread keeps the `new` out of the `if` (EVL002).
+    const invokePolicies = props.lambdaFunctionArns && props.lambdaFunctionArns.length > 0
+        ? [new Role_Policy({ PolicyName: "InvokeLambdaTasks", PolicyDocument: invokePolicyDocument })]
+        : [];
+    const policies = [logDeliveryPolicy, ...invokePolicies, ...(props.Policies ?? [])];
+    const role = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: stepFunctionsTrustPolicy,
+        ManagedPolicyArns: props.ManagedPolicyArns,
+        Policies: policies,
+    }, defaults?.role));
+    const loggingConfiguration = new StateMachine_LoggingConfiguration({
+        Destinations: [
+            new StateMachine_LogDestination({
+                CloudWatchLogsLogGroup: new StateMachine_CloudWatchLogsLogGroup({ LogGroupArn: logGroup.Arn }),
+            }),
+        ],
+        IncludeExecutionData: true,
+        Level: props.loggingLevel ?? "ALL",
+    });
+    const stateMachine = new StateMachine(mergeDefaults({
+        StateMachineName: props.name,
+        RoleArn: role.Arn,
+        Definition: props.definition,
+        StateMachineType: props.stateMachineType ?? "STANDARD",
+        LoggingConfiguration: loggingConfiguration,
+    }, defaults?.stateMachine));
+    return { role, logGroup, stateMachine };
+}, "StepFunctionsWorkflow");

package/dist/composites/vpc-default.js

@@ -0,0 +1,132 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Vpc, Subnet, InternetGateway, VPCGatewayAttachment, RouteTable, EC2Route, SubnetRouteTableAssociation, EIP, NatGateway, } from "../generated/index.js";
+import { Select, GetAZs } from "../intrinsics.js";
+/** A VPC across two or three availability zones with public and private subnets, an internet gateway, a NAT gateway and their route tables. */
+export const VpcDefault = Composite((props) => {
+    const { defaults: defs } = props;
+    const cidr = props.cidr ?? "10.0.0.0/16";
+    const azCount = props.azCount ?? 2;
+    const publicSubnet1Cidr = props.publicSubnet1Cidr ?? "10.0.0.0/20";
+    const publicSubnet2Cidr = props.publicSubnet2Cidr ?? "10.0.16.0/20";
+    const privateSubnet1Cidr = props.privateSubnet1Cidr ?? "10.0.128.0/20";
+    const privateSubnet2Cidr = props.privateSubnet2Cidr ?? "10.0.144.0/20";
+    const az1 = Select(0, GetAZs(""));
+    const az2 = Select(1, GetAZs(""));
+    const vpc = new Vpc(mergeDefaults({
+        CidrBlock: cidr,
+        EnableDnsSupport: true,
+        EnableDnsHostnames: true,
+    }, defs?.vpc));
+    const igw = new InternetGateway({});
+    const igwAttachment = new VPCGatewayAttachment({
+        VpcId: vpc.VpcId,
+        InternetGatewayId: igw.InternetGatewayId,
+    });
+    // Public subnets
+    const publicSubnet1 = new Subnet(mergeDefaults({
+        VpcId: vpc.VpcId,
+        CidrBlock: publicSubnet1Cidr,
+        AvailabilityZone: az1,
+        MapPublicIpOnLaunch: true,
+    }, defs?.publicSubnet1));
+    const publicSubnet2 = new Subnet(mergeDefaults({
+        VpcId: vpc.VpcId,
+        CidrBlock: publicSubnet2Cidr,
+        AvailabilityZone: az2,
+        MapPublicIpOnLaunch: true,
+    }, defs?.publicSubnet2));
+    // Private subnets
+    const privateSubnet1 = new Subnet(mergeDefaults({
+        VpcId: vpc.VpcId,
+        CidrBlock: privateSubnet1Cidr,
+        AvailabilityZone: az1,
+    }, defs?.privateSubnet1));
+    const privateSubnet2 = new Subnet(mergeDefaults({
+        VpcId: vpc.VpcId,
+        CidrBlock: privateSubnet2Cidr,
+        AvailabilityZone: az2,
+    }, defs?.privateSubnet2));
+    // Public route table
+    const publicRouteTable = new RouteTable({
+        VpcId: vpc.VpcId,
+    });
+    const publicRoute = new EC2Route({
+        RouteTableId: publicRouteTable.RouteTableId,
+        DestinationCidrBlock: "0.0.0.0/0",
+        GatewayId: igw.InternetGatewayId,
+    }, { DependsOn: [igwAttachment] });
+    const publicRta1 = new SubnetRouteTableAssociation({
+        SubnetId: publicSubnet1.SubnetId,
+        RouteTableId: publicRouteTable.RouteTableId,
+    });
+    const publicRta2 = new SubnetRouteTableAssociation({
+        SubnetId: publicSubnet2.SubnetId,
+        RouteTableId: publicRouteTable.RouteTableId,
+    });
+    // NAT gateway
+    const natEip = new EIP({
+        Domain: "vpc",
+    });
+    const natGateway = new NatGateway(mergeDefaults({
+        AllocationId: natEip.AllocationId,
+        SubnetId: publicSubnet1.SubnetId,
+    }, defs?.natGateway));
+    // Private route table
+    const privateRouteTable = new RouteTable({
+        VpcId: vpc.VpcId,
+    });
+    const privateRoute = new EC2Route({
+        RouteTableId: privateRouteTable.RouteTableId,
+        DestinationCidrBlock: "0.0.0.0/0",
+        NatGatewayId: natGateway.NatGatewayId,
+    });
+    const privateRta1 = new SubnetRouteTableAssociation({
+        SubnetId: privateSubnet1.SubnetId,
+        RouteTableId: privateRouteTable.RouteTableId,
+    });
+    const privateRta2 = new SubnetRouteTableAssociation({
+        SubnetId: privateSubnet2.SubnetId,
+        RouteTableId: privateRouteTable.RouteTableId,
+    });
+    // ── AZ3 (optional) ──────────────────────────────────────────────
+    // Ternaries keep the `new`s out of the `if` (EVL002); the AZ3 resources fold
+    // into one return via a conditional spread.
+    const publicSubnet3 = azCount >= 3
+        ? new Subnet(mergeDefaults({
+            VpcId: vpc.VpcId,
+            CidrBlock: props.publicSubnet3Cidr ?? "10.0.32.0/20",
+            AvailabilityZone: Select(2, GetAZs("")),
+            MapPublicIpOnLaunch: true,
+        }, defs?.publicSubnet3))
+        : undefined;
+    const privateSubnet3 = azCount >= 3
+        ? new Subnet(mergeDefaults({
+            VpcId: vpc.VpcId,
+            CidrBlock: props.privateSubnet3Cidr ?? "10.0.160.0/20",
+            AvailabilityZone: Select(2, GetAZs("")),
+        }, defs?.privateSubnet3))
+        : undefined;
+    const publicRta3 = publicSubnet3
+        ? new SubnetRouteTableAssociation({
+            SubnetId: publicSubnet3.SubnetId,
+            RouteTableId: publicRouteTable.RouteTableId,
+        })
+        : undefined;
+    const privateRta3 = privateSubnet3
+        ? new SubnetRouteTableAssociation({
+            SubnetId: privateSubnet3.SubnetId,
+            RouteTableId: privateRouteTable.RouteTableId,
+        })
+        : undefined;
+    return {
+        vpc, igw, igwAttachment,
+        publicSubnet1, publicSubnet2,
+        privateSubnet1, privateSubnet2,
+        publicRouteTable, publicRoute,
+        publicRta1, publicRta2,
+        privateRouteTable, privateRoute,
+        privateRta1, privateRta2,
+        natEip, natGateway,
+        ...(publicSubnet3 ? { publicSubnet3, privateSubnet3, publicRta3, privateRta3 } : {}),
+    };
+}, "VpcDefault");

package/dist/condition.js

@@ -0,0 +1,43 @@
+/**
+ * CloudFormation template condition (#2068).
+ *
+ * A `Condition` declarable is lifted into the template's `Conditions`
+ * section by the serializer, the way `Parameter` is lifted into
+ * `Parameters`. Reference it from a resource's `Condition` attribute, an
+ * output's `condition` option, `If(...)`, or inside another condition via
+ * `And`/`Or`/`Not`.
+ */
+var _a;
+import { DECLARABLE_MARKER, isDeclarable } from "@intentius/chant/declarable";
+import { isIntrinsic } from "@intentius/chant/intrinsic";
+import { getLogicalName } from "@intentius/chant/utils";
+export const CONDITION_ENTITY_TYPE = "AWS::CloudFormation::Condition";
+export class Condition {
+    constructor(expression, options) {
+        this[_a] = true;
+        this.lexicon = "aws";
+        this.entityType = CONDITION_ENTITY_TYPE;
+        if (!isIntrinsic(expression)) {
+            throw new Error("new Condition(expression): expression must be a condition intrinsic (Equals, And, Or, Not)");
+        }
+        this.expression = expression;
+        if (options?.name !== undefined)
+            this.name = options.name;
+    }
+}
+_a = DECLARABLE_MARKER;
+/**
+ * The name a condition has in the template: its `name` option, else the
+ * logical name discovery gave it (the export name).
+ */
+export function conditionName(condition, entityNames) {
+    return condition.name ?? entityNames?.get(condition) ?? getLogicalName(condition);
+}
+/**
+ * Type guard for the `Condition` declarable. Duck-typed on `entityType`
+ * rather than `instanceof` so a lexicon built against a separate copy of
+ * `@intentius/chant` still matches (the #1137 convention).
+ */
+export function isCondition(value) {
+    return isDeclarable(value) && value.entityType === CONDITION_ENTITY_TYPE;
+}

package/dist/coverage.js

@@ -0,0 +1,4 @@
+/**
+ * Re-export from core — coverage analysis is lexicon-agnostic.
+ */
+export { computeCoverage, overallPct, formatSummary, formatVerbose, checkThresholds, } from "@intentius/chant/codegen/coverage";

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,mBAAmB,CAAC;AAe3B;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,GAAG,EAAE,eAAe,CAAA;CAAE,GACxB;IACE,GAAG,EAAE,KAAK,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpE,CAAC;AAEN,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAkBnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AAE3F;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,6EAA6E;QAC7E,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;KAClD,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAkBzE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAkBlD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBxE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAGnE,CAAC;AAWF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAU9E;AA6BD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBA+EvC,CAAC;AAMF,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAmED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAI/E;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;kDAG8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAoKhC"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,mBAAmB,CAAC;AAgB3B;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,GAAG,EAAE,eAAe,CAAA;CAAE,GACxB;IACE,GAAG,EAAE,KAAK,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpE,CAAC;AAEN,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAkBnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AAE3F;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,6EAA6E;QAC7E,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;KAClD,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAkBzE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAkBlD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBxE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAGnE,CAAC;AAWF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAU9E;AA6BD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBA+EvC,CAAC;AAMF,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAmED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAI/E;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;kDAG8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAoKhC"}