@intentius/chant-lexicon-aws 0.124.31 → 0.124.32

package/dist/components/safety.js

@@ -0,0 +1,62 @@
+/**
+ * safety / rollback family — explicit snapshot-and-restore capabilities, used
+ * alongside the per-capability `rollback` compensation for cases that need an
+ * up-front capture (e.g. before a `cfn-deploy` with `onReplace: "snapshot-first"`).
+ *
+ * Both dispatch to the kind-appropriate AWS backup/restore mechanism through the
+ * injectable `CloudExecutor` (DynamoDB backup, RDS DB snapshot, EBS snapshot).
+ */
+import { defaultCloudExecutor } from "./cloud-executor.js";
+/**
+ * Capture a restorable snapshot before a risky/destructive apply step, via the
+ * kind-appropriate AWS backup mechanism through the injectable `CloudExecutor`
+ * (DynamoDB on-demand backup, RDS DB snapshot, or EBS volume snapshot). Returns
+ * the backup/snapshot id `rollback-previous` restores from.
+ */
+export function createSnapshotBeforeCapability(executor = defaultCloudExecutor()) {
+    return {
+        kind: "snapshot-before",
+        async run(_ctx, input) {
+            return executor.snapshot.create({ resource: input.resource, resourceKind: input.resourceKind });
+        },
+    };
+}
+/** Default `snapshot-before` capability, backed by the real `CloudExecutor`. */
+export const snapshotBeforeCapability = createSnapshotBeforeCapability();
+/**
+ * Roll a resource back to its prior state — an explicit, caller-composed
+ * compensation (not the auto-triggered per-capability `rollback`). Dispatches by
+ * the input shape: an ECS service (`{service, cluster, taskDefinition}`) rolls to
+ * that task definition, and fails without one (#2605); a snapshot (`{snapshotId, resource}`) restores that capture.
+ * An unrecognized shape fails with a clear message rather than a cryptic
+ * `undefined` access (chant #990 — an ECS-shaped input used to reach the
+ * snapshot path and throw "reading 'includes'" on the absent snapshotId).
+ */
+export function createRollbackPreviousCapability(executor = defaultCloudExecutor()) {
+    return {
+        kind: "rollback-previous",
+        async run(_ctx, input) {
+            if ("service" in input && input.service) {
+                if (!input.taskDefinition) {
+                    throw new Error(`rollback-previous: ECS service "${input.service}" needs a taskDefinition to roll back to; ` +
+                        `nothing records the previous one. For an earlier release use \`chant components rollback\``);
+                }
+                await executor.ecs.rollbackService({
+                    cluster: input.cluster,
+                    service: input.service,
+                    taskDefinition: input.taskDefinition,
+                    desiredCount: input.desiredCount,
+                });
+                return { restored: true };
+            }
+            if ("snapshotId" in input && input.snapshotId) {
+                await executor.snapshot.restore({ resource: input.resource, snapshotId: input.snapshotId });
+                return { restored: true };
+            }
+            throw new Error(`rollback-previous: unrecognized input — expected { service, cluster } (ECS service rollback) or ` +
+                `{ snapshotId, resource } (snapshot restore), got keys [${Object.keys(input).join(", ")}]`);
+        },
+    };
+}
+/** Default `rollback-previous` capability, backed by the real `CloudExecutor`. */
+export const rollbackPreviousCapability = createRollbackPreviousCapability();

package/dist/components/wait-aws.js

@@ -0,0 +1,68 @@
+/**
+ * wait / verify family — the cloud-specific members, owned by the aws lexicon:
+ * `wait-for-stack` (CloudFormation), `wait-steady-state` (ECS), `wait-job`
+ * (EMR). The agnostic waits (`wait-cluster-healthy`, `wait-endpoint`,
+ * `health-gate`) stay in core. All poll a real cloud through the injectable aws
+ * `CloudExecutor` (./cloud-executor.ts); none has a rollback — a wait is a
+ * read-only observation, never a mutation.
+ */
+import { defaultCloudExecutor, sleep } from "./cloud-executor.js";
+/** Poll a CloudFormation stack until it reaches a terminal status. No rollback: a wait is a read-only observation. */
+export function createWaitForStackCapability(executor = defaultCloudExecutor()) {
+    return {
+        kind: "wait-for-stack",
+        async run(_ctx, input) {
+            const { stackStatus } = await executor.cloudformation.waitForStack(input.stack, {
+                intervalMs: input.intervalMs,
+                timeoutMs: input.timeoutMs,
+            });
+            return { stackStatus };
+        },
+    };
+}
+/** Default `wait-for-stack` capability, backed by the real aws `CloudExecutor`. */
+export const waitForStackCapability = createWaitForStackCapability();
+/** Poll an ECS service until running count matches desired and no deployment is in flight. No rollback: read-only. */
+export function createWaitSteadyStateCapability(executor = defaultCloudExecutor()) {
+    return {
+        kind: "wait-steady-state",
+        async run(_ctx, input) {
+            const cluster = input.cluster ?? "default";
+            const intervalMs = input.intervalMs ?? 10000;
+            const deadline = Date.now() + (input.timeoutMs ?? 10 * 60000);
+            while (true) {
+                const state = await executor.ecs.describeService(cluster, input.service);
+                if (state.stable)
+                    return { runningCount: state.runningCount };
+                if (Date.now() > deadline) {
+                    throw new Error(`wait-steady-state "${input.service}" timed out before reaching steady state`);
+                }
+                await sleep(intervalMs);
+            }
+        },
+    };
+}
+/** Default `wait-steady-state` capability, backed by the real aws `CloudExecutor`. */
+export const waitSteadyStateCapability = createWaitSteadyStateCapability();
+/**
+ * Poll a submitted job/step (e.g. an EMR job run started by `emr-start-job-run`)
+ * until it reaches a terminal state, failing the step if that state is not
+ * `COMPLETED`. No rollback: read-only observation.
+ */
+export function createWaitJobCapability(executor = defaultCloudExecutor()) {
+    return {
+        kind: "wait-job",
+        async run(_ctx, input) {
+            const { state } = await executor.emr.waitForJobRun(input.runId, {
+                intervalMs: input.intervalMs,
+                timeoutMs: input.timeoutMs,
+            });
+            if (state !== "COMPLETED") {
+                throw new Error(`wait-job "${input.runId}" ended in terminal state "${state}", expected "COMPLETED"`);
+            }
+            return { state };
+        },
+    };
+}
+/** Default `wait-job` capability, backed by the real aws `CloudExecutor`. */
+export const waitJobCapability = createWaitJobCapability();

package/dist/composites/agentcore-agent.js

@@ -0,0 +1,187 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Role, Runtime, Runtime_AgentRuntimeArtifact, Runtime_Code, Runtime_CodeConfiguration, Runtime_ContainerConfiguration, Runtime_NetworkConfiguration, Runtime_VpcConfig, RuntimeEndpoint, Memory, BedrockAgentCoreGateway, GatewayTarget, WorkloadIdentity, } from "../generated/index.js";
+import { agentCoreTrustPolicy } from "./agentcore-trust-policy.js";
+import { Sub } from "../intrinsics.js";
+/**
+ * ARN of the managed `DEFAULT` endpoint AgentCore provisions with a Runtime,
+ * as an `Fn::Sub` over the Runtime's ARN. No CloudFormation attribute carries
+ * it (the Runtime schema exposes only `AgentRuntimeArn`/`AgentRuntimeId`/
+ * `AgentRuntimeVersion`/`Status`), but the format is fixed by the
+ * CreateAgentRuntimeEndpoint API:
+ * `arn:aws:bedrock-agentcore:<region>:<account>:runtime/<id>/runtime-endpoint/<name>`.
+ */
+export function agentCoreDefaultEndpointArn(runtime) {
+    return Sub `${runtime.AgentRuntimeArn}/runtime-endpoint/DEFAULT`;
+}
+/**
+ * Bedrock AgentCore's real limits, verified against the CloudFormation
+ * registry schema for `AWS::BedrockAgentCore::{Runtime,RuntimeEndpoint,Memory}`
+ * (#882).
+ *
+ * Exported for the same reason as `MICROVM_LIMITS` (#1374, #1420): a
+ * consumer driving AgentCore through another control plane needs the same
+ * numbers, and copying them is how two sources of truth start.
+ */
+export const AGENTCORE_LIMITS = {
+    /**
+     * `Runtime`/`RuntimeEndpoint`/`Memory` `Name`/`AgentRuntimeName` fields
+     * are bound to this pattern — no hyphens, unlike chant's usual kebab-case
+     * component names. `Gateway`/`GatewayTarget`/`WorkloadIdentity` names
+     * accept hyphens, so only the Runtime family needs sanitizing.
+     */
+    runtimeNamePattern: /^[a-zA-Z][a-zA-Z0-9_]{0,47}$/,
+    maxRuntimeNameLength: 48,
+    /** `Memory` event retention bounds, in days. */
+    memoryEventExpiryDays: { min: 3, max: 365, default: 30 },
+};
+/**
+ * Non-identifier characters become `_`, and a leading digit/underscore gets
+ * an `A` prefix so the result always starts with a letter — then truncated
+ * to {@link AGENTCORE_LIMITS}'s `maxRuntimeNameLength`.
+ */
+function toRuntimeIdentifier(name) {
+    const cleaned = name.replace(/[^a-zA-Z0-9_]/g, "_");
+    const identifier = /^[a-zA-Z]/.test(cleaned) ? cleaned : `A${cleaned}`;
+    return identifier.slice(0, AGENTCORE_LIMITS.maxRuntimeNameLength);
+}
+/**
+ * A Bedrock AgentCore agent as one CloudFormation-serializable bundle — the
+ * composite/base path from #882: `Runtime` + `Memory` +
+ * `Gateway`/`GatewayTarget` + `WorkloadIdentity` + IAM, deployable with
+ * `cfn-deploy` + `wait-for-stack` and no bespoke verb.
+ *
+ * `WorkloadIdentityDetails` on both `Runtime` and `BedrockAgentCoreGateway`
+ * is CFN `readOnly` — AWS provisions a workload identity per resource
+ * automatically, and neither accepts one as an input. The `WorkloadIdentity`
+ * resource this composite creates is therefore standalone (not cross-wired
+ * to `runtime`/`gateway`), included because #882 calls for it — it exists
+ * for workflows (e.g. a future credential-provider capability) that need an
+ * explicit workload identity of their own.
+ *
+ * There is no `RuntimeEndpoint` in the bundle by default. AgentCore creates a
+ * managed `DEFAULT` endpoint with every Runtime and repoints it at each new
+ * version on its own, so a CloudFormation `DEFAULT` endpoint is redundant. It
+ * is also the race that sank a live deploy (#978): the Runtime resource's
+ * `CREATE_COMPLETE` fires while AgentCore is still turning the artifact into
+ * a READY agent version, and the endpoint's CREATE then fails with "Agent
+ * version 1 must be in READY status". Invoking the Runtime with no qualifier
+ * hits the managed DEFAULT endpoint; {@link agentCoreDefaultEndpointArn}
+ * builds its ARN from the Runtime's. `endpointName` adds an explicit
+ * non-DEFAULT endpoint for the `agentcore-deploy` version-promotion flow,
+ * which is deferred (GA-gated, #882) — this composite only wires the
+ * CloudFormation shape it would eventually apply against.
+ */
+export const AgentCoreAgent = Composite((props) => {
+    const { defaults } = props;
+    // Exactly one artifact source. Both-or-neither is a modeling mistake CFN
+    // would also reject (AgentRuntimeArtifact is a one-of), caught here so the
+    // error names the composite prop rather than a raw CFN validation string.
+    if ((props.containerUri === undefined) === (props.code === undefined)) {
+        throw new Error("AgentCoreAgent requires exactly one of containerUri or code");
+    }
+    const networkMode = props.networkMode ?? "PUBLIC";
+    // Check presence, not `.length`: a cross-stack value (Fn::Split of a Parameter,
+    // the shape stackOutput/Ref/Split produce) is a truthy intrinsic object with no
+    // `.length`, so a `.length` check wrongly rejects a value that WAS supplied
+    // (#938). An actually-empty list is caught by CloudFormation at deploy time.
+    if (networkMode === "VPC" && (props.vpcSubnetIds === undefined || props.vpcSecurityGroupIds === undefined)) {
+        throw new Error("AgentCoreAgent requires vpcSubnetIds and vpcSecurityGroupIds when networkMode is \"VPC\"");
+    }
+    const memoryEventExpiryDays = props.memoryEventExpiryDays ?? AGENTCORE_LIMITS.memoryEventExpiryDays.default;
+    if (memoryEventExpiryDays < AGENTCORE_LIMITS.memoryEventExpiryDays.min ||
+        memoryEventExpiryDays > AGENTCORE_LIMITS.memoryEventExpiryDays.max) {
+        throw new Error(`AgentCoreAgent memoryEventExpiryDays must be between ${AGENTCORE_LIMITS.memoryEventExpiryDays.min} and ${AGENTCORE_LIMITS.memoryEventExpiryDays.max}`);
+    }
+    const runtimeName = toRuntimeIdentifier(props.name);
+    // Runtime + Memory share one execution role — both are AgentCore-hosted
+    // and assume the same service principal (see agentcore-trust-policy.ts).
+    const role = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: agentCoreTrustPolicy,
+        ManagedPolicyArns: props.ManagedPolicyArns,
+        Policies: props.Policies,
+    }, defaults?.role));
+    // Gateway assumes its own role to invoke targets (e.g. this agent's own
+    // Runtime endpoint) — kept separate from the Runtime/Memory role so its
+    // permissions don't have to grow with the agent's own execution needs.
+    const gatewayRole = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: agentCoreTrustPolicy,
+    }, defaults?.gatewayRole));
+    const networkConfiguration = new Runtime_NetworkConfiguration({
+        NetworkMode: networkMode,
+        NetworkModeConfig: networkMode === "VPC"
+            ? new Runtime_VpcConfig({
+                SecurityGroups: props.vpcSecurityGroupIds,
+                Subnets: props.vpcSubnetIds,
+            })
+            : undefined,
+    });
+    // CFN `Code.S3` is a free-form location object in the generated type; its
+    // keys (Bucket/Prefix/VersionId) come straight from the CloudFormation
+    // schema for AWS::BedrockAgentCore::Runtime.
+    const artifact = props.code
+        ? new Runtime_AgentRuntimeArtifact({
+            CodeConfiguration: new Runtime_CodeConfiguration({
+                Code: new Runtime_Code({
+                    S3: {
+                        Bucket: props.code.s3Bucket,
+                        Prefix: props.code.s3Prefix,
+                        ...(props.code.s3VersionId !== undefined ? { VersionId: props.code.s3VersionId } : {}),
+                    },
+                }),
+                EntryPoint: props.code.entryPoint,
+                Runtime: props.code.runtime,
+            }),
+        })
+        : new Runtime_AgentRuntimeArtifact({
+            ContainerConfiguration: new Runtime_ContainerConfiguration({
+                ContainerUri: props.containerUri,
+            }),
+        });
+    const runtime = new Runtime(mergeDefaults({
+        AgentRuntimeName: runtimeName,
+        AgentRuntimeArtifact: artifact,
+        RoleArn: role.Arn,
+        NetworkConfiguration: networkConfiguration,
+        ProtocolConfiguration: props.protocolConfiguration ?? "MCP",
+        EnvironmentVariables: props.environmentVariables,
+    }, defaults?.runtime));
+    // Explicit endpoints only for a non-DEFAULT alias (#978): AgentCore owns
+    // DEFAULT, and creating it here races the Runtime's async version-READY.
+    if (props.endpointName === "DEFAULT") {
+        throw new Error("AgentCoreAgent endpointName must not be \"DEFAULT\": AgentCore provisions the managed DEFAULT endpoint itself");
+    }
+    const endpoint = props.endpointName !== undefined
+        ? new RuntimeEndpoint(mergeDefaults({
+            AgentRuntimeId: runtime.AgentRuntimeId,
+            Name: toRuntimeIdentifier(props.endpointName),
+        }, defaults?.endpoint))
+        : undefined;
+    const memory = new Memory(mergeDefaults({
+        Name: `${runtimeName}Memory`.slice(0, 48),
+        EventExpiryDuration: memoryEventExpiryDays,
+        MemoryExecutionRoleArn: role.Arn,
+    }, defaults?.memory));
+    const workloadIdentity = new WorkloadIdentity(mergeDefaults({
+        Name: `${props.name}-identity`,
+        AllowedResourceOauth2ReturnUrls: props.allowedResourceOauth2ReturnUrls,
+    }, defaults?.workloadIdentity));
+    const gateway = new BedrockAgentCoreGateway(mergeDefaults({
+        Name: `${props.name}-gateway`,
+        AuthorizerType: props.gatewayAuthorizerType ?? "AWS_IAM",
+        RoleArn: gatewayRole.Arn,
+    }, defaults?.gateway));
+    // Default target: route the gateway's MCP tools straight back to this
+    // agent's own Runtime endpoint (the shape Gateway's HTTP/AgentcoreRuntime
+    // target configuration exists for). Override `defaults.gatewayTarget` to
+    // point at a Lambda/OpenAPI/other target instead.
+    const gatewayTarget = new GatewayTarget(mergeDefaults({
+        GatewayIdentifier: gateway.GatewayIdentifier,
+        Name: `${props.name}-target`,
+        TargetConfiguration: {
+            Http: {
+                AgentcoreRuntime: { Arn: runtime.AgentRuntimeArn },
+            },
+        },
+    }, defaults?.gatewayTarget));
+    return { role, gatewayRole, runtime, ...(endpoint ? { endpoint } : {}), memory, workloadIdentity, gateway, gatewayTarget };
+}, "AgentCoreAgent");

package/dist/composites/agentcore-trust-policy.js

@@ -0,0 +1,13 @@
+// The service principal Bedrock AgentCore assumes to run a Runtime and to
+// invoke Gateway targets. Same shape as ecs-trust-policy.ts/lambdaTrustPolicy
+// in lambda-function.ts, one principal shared by both AgentCore-hosted roles.
+export const agentCoreTrustPolicy = {
+    Version: "2012-10-17",
+    Statement: [
+        {
+            Effect: "Allow",
+            Principal: { Service: "bedrock-agentcore.amazonaws.com" },
+            Action: "sts:AssumeRole",
+        },
+    ],
+};

package/dist/composites/alb-shared.js

@@ -0,0 +1,84 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { EcsCluster, LoadBalancer, Listener, Listener_Action, Listener_FixedResponseConfig, Listener_Certificate, SecurityGroup, SecurityGroup_Ingress, Role, Role_Policy, } from "../generated/index.js";
+import { ECRActions } from "../actions/ecr.js";
+import { LogsActions } from "../actions/logs.js";
+import { ecsTrustPolicy } from "./ecs-trust-policy.js";
+/** A shared ECS cluster and internet-facing Application Load Balancer with its listener and execution role, for FargateService instances to attach to. */
+export const AlbShared = Composite((props) => {
+    const listenerPort = props.listenerPort ?? 80;
+    const protocol = props.protocol ?? "HTTP";
+    const { defaults: defs } = props;
+    // ECS Cluster
+    const cluster = new EcsCluster(mergeDefaults({}, defs?.cluster));
+    // Execution role — ECR pull + CloudWatch Logs write
+    const executionPolicyDocument = {
+        Version: "2012-10-17",
+        Statement: [
+            {
+                Effect: "Allow",
+                Action: ECRActions.Pull,
+                Resource: "*",
+            },
+            {
+                Effect: "Allow",
+                Action: LogsActions.Write,
+                Resource: "*",
+            },
+        ],
+    };
+    const executionPolicy = new Role_Policy({
+        PolicyName: "ExecutionPolicy",
+        PolicyDocument: executionPolicyDocument,
+    });
+    const executionRole = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: ecsTrustPolicy,
+        Policies: [executionPolicy],
+    }, defs?.executionRole));
+    // ALB security group — ingress on listener port from anywhere
+    const albIngress = new SecurityGroup_Ingress({
+        IpProtocol: "tcp",
+        FromPort: listenerPort,
+        ToPort: listenerPort,
+        CidrIp: "0.0.0.0/0",
+    });
+    const albSg = new SecurityGroup({
+        GroupDescription: "ALB security group",
+        VpcId: props.vpcId,
+        SecurityGroupIngress: [albIngress],
+    });
+    // Application Load Balancer
+    const alb = new LoadBalancer(mergeDefaults({
+        Type: "application",
+        Scheme: "internet-facing",
+        Subnets: props.publicSubnetIds,
+        SecurityGroups: [albSg.GroupId],
+    }, defs?.alb));
+    // Listener — default action is fixed-response 404
+    const fixedResponse = new Listener_FixedResponseConfig({
+        StatusCode: "404",
+        ContentType: "text/plain",
+        MessageBody: "Not Found",
+    });
+    const defaultAction = new Listener_Action({
+        Type: "fixed-response",
+        FixedResponseConfig: fixedResponse,
+    });
+    const listenerProps = {
+        LoadBalancerArn: alb.LoadBalancerArn,
+        Port: listenerPort,
+        Protocol: protocol,
+        DefaultActions: [defaultAction],
+        // HTTPS listeners carry a cert; a ternary keeps the `new` out of an `if` (EVL002).
+        Certificates: protocol === "HTTPS" && props.certificateArn
+            ? [new Listener_Certificate({ CertificateArn: props.certificateArn })]
+            : undefined,
+    };
+    const listener = new Listener(mergeDefaults(listenerProps, defs?.listener));
+    return {
+        cluster,
+        executionRole,
+        albSg,
+        alb,
+        listener,
+    };
+}, "AlbShared");

package/dist/composites/bucket-deployment.js

@@ -0,0 +1,93 @@
+/**
+ * BucketDeployment — the seeded-bucket shape: an S3 bucket sized to receive
+ * deploy-time content, encrypted and access-blocked by default, its
+ * deletion behaviour and (optionally) its public-read policy declared up
+ * front rather than left to CloudFormation's own defaults.
+ *
+ * `s3deploy.BucketDeployment` is the most-used CDK pattern across the
+ * aws-bench corpus (37 instantiations across 8 apps, chant#1139) and it
+ * names two things CDK bundles together that chant keeps apart on purpose:
+ *
+ *  - The bucket itself: `AWS::S3::Bucket` plus its encryption, access-block
+ *    and (for the static-site shape) website/public-policy configuration.
+ *    That is a fixed set of CloudFormation resources, so it is what this
+ *    composite declares — the same shape `LambdaS3` (../composites) already
+ *    gives a bucket, minus the Lambda trigger wiring.
+ *  - Uploading local files into it at deploy time. CDK does this with a
+ *    Lambda-backed custom resource (`cr.AwsCustomResource`, the same family
+ *    the epic notes maps to chant Ops rather than composites — chant has no
+ *    CloudFormation custom-resource machinery, and inventing one just to
+ *    reproduce a `PutObject` loop would be new plumbing for a solved
+ *    problem). chant already ships this as a deploy-time **capability**,
+ *    `s3-sync` (`../components/apply.ts`'s `createS3SyncCapability`, backed
+ *    by the real `aws s3 sync`/`aws s3 cp` CLI through `CloudExecutor`, with
+ *    the typed step-builder `s3Sync` in `../components/builders.ts`) — it
+ *    was defined for exactly this and, before this composite, had no
+ *    composite pairing it with a bucket to sync into. A component composes
+ *    the two:
+ *
+ *      const seeded = BucketDeployment({ bucketName: Sub`${AWS.StackName}-site` });
+ *      // ...component `deploy` phase:
+ *      s3Sync({ from: "archive:site-build", to: Sub`s3://${seeded.bucket.Ref}` })
+ *
+ * That split — graph-time declaration here, deploy-time action in the
+ * component layer — is the existing precedent (`s3-sync` shipped in #566
+ * unused by any composite until this one), not a new one invented for this
+ * composite.
+ *
+ * "Cleanup" (the epic's third word) is `removalPolicy`, CloudFormation's own
+ * `DeletionPolicy` on the bucket resource. CDK's `autoDeleteObjects` — the
+ * Lambda-backed hook that empties a bucket before CloudFormation is allowed
+ * to delete it — has the same custom-resource shape as content upload and
+ * the same answer: out of scope here, and worth an `s3 rm --recursive`
+ * step ahead of a stack teardown in the component that owns the deploy.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Bucket, Bucket_BucketEncryption, Bucket_ServerSideEncryptionRule, Bucket_ServerSideEncryptionByDefault, Bucket_PublicAccessBlockConfiguration, Bucket_VersioningConfiguration, Bucket_WebsiteConfiguration, S3BucketPolicy, } from "../generated/index.js";
+import { Sub } from "../intrinsics.js";
+export const BucketDeployment = Composite((props) => {
+    const { defaults } = props;
+    const publicRead = props.website !== undefined;
+    const encryptionDefault = new Bucket_ServerSideEncryptionByDefault({ SSEAlgorithm: "AES256" });
+    const encryptionRule = new Bucket_ServerSideEncryptionRule({ ServerSideEncryptionByDefault: encryptionDefault });
+    const bucketEncryption = new Bucket_BucketEncryption({ ServerSideEncryptionConfiguration: [encryptionRule] });
+    // A ternary, not an `if`, so the block-scoped `new` stays an expression
+    // (EVL002) — the same reasoning eks-cluster.ts's addon slots document.
+    const publicAccessBlock = new Bucket_PublicAccessBlockConfiguration(publicRead
+        ? { BlockPublicAcls: false, BlockPublicPolicy: false, IgnorePublicAcls: false, RestrictPublicBuckets: false }
+        : { BlockPublicAcls: true, BlockPublicPolicy: true, IgnorePublicAcls: true, RestrictPublicBuckets: true });
+    const versioningConfiguration = props.versioned
+        ? new Bucket_VersioningConfiguration({ Status: "Enabled" })
+        : undefined;
+    const websiteConfiguration = props.website
+        ? new Bucket_WebsiteConfiguration({
+            IndexDocument: props.website.indexDocument,
+            ...(props.website.errorDocument ? { ErrorDocument: props.website.errorDocument } : {}),
+        })
+        : undefined;
+    const bucket = new Bucket(mergeDefaults({
+        BucketName: props.bucketName,
+        BucketEncryption: bucketEncryption,
+        PublicAccessBlockConfiguration: publicAccessBlock,
+        ...(versioningConfiguration ? { VersioningConfiguration: versioningConfiguration } : {}),
+        ...(websiteConfiguration ? { WebsiteConfiguration: websiteConfiguration } : {}),
+        Tags: props.tags,
+    }, defaults?.bucket), { DeletionPolicy: props.removalPolicy === "destroy" ? "Delete" : "Retain" });
+    const bucketPolicy = publicRead
+        ? new S3BucketPolicy(mergeDefaults({
+            Bucket: bucket.Ref,
+            PolicyDocument: {
+                Version: "2012-10-17",
+                Statement: [
+                    { Effect: "Allow", Principal: "*", Action: "s3:GetObject", Resource: Sub `${bucket.Arn}/*` },
+                ],
+            },
+        }, defaults?.bucketPolicy))
+        : undefined;
+    // Spread rather than a ternary between two object shapes (EksCluster's
+    // addon slots, ../eks-cluster.ts, hit the same union-return typing wall):
+    // a key that is sometimes present, never a key whose value is sometimes
+    // `undefined` — `CompositeMembers`' index signature requires `Declarable`,
+    // not `Declarable | undefined`.
+    return { bucket, ...(bucketPolicy ? { bucketPolicy } : {}) };
+}, "BucketDeployment");