@intentius/chant-lexicon-aws 0.124.31 → 0.124.32

package/dist/composites/microvm-app.js

@@ -0,0 +1,293 @@
+/**
+ * MicrovmApp — composite-first delivery of AWS Lambda MicroVM support (#879).
+ *
+ * Emits `AWS::Lambda::MicrovmImage` (a preview CFN resource type — see the
+ * issue's "Preview-API gate") plus the least-privilege build/execution IAM
+ * roles the upstream `ran-isenberg/lambda-microvm-cdk-python` construct
+ * creates, and — only when build-time VPC egress is requested — an
+ * `AWS::Lambda::NetworkConnector`, its deny-all-egress security group, and its
+ * ENI operator role.
+ *
+ * Base path only (#879 scope): `chant build` serializes this composite to a
+ * CloudFormation template; `cfn-deploy` + `wait-for-stack` deploy it and wait
+ * for the image snapshot to build, with no bespoke verb. The
+ * `microvm-image-build` capability (build-once / promote-by-ARN) is deferred
+ * — see the issue's "Settled decisions".
+ *
+ * The IAM shapes below mirror `lambda_microvm_cdk._impl.security` (build role
+ * scoped to the exact S3 code-artifact object + the image's own log group;
+ * execution role scoped to runtime logs only; connector operator role scoped
+ * to the AWS-documented `ec2:CreateNetworkInterface`/`CreateTags` grant), and
+ * the deny-all security group reproduces `aws-cdk-lib`'s own
+ * `MATCH_NO_TRAFFIC` placeholder rule (`aws-ec2/lib/security-group.ts`) —
+ * spot-checked against both upstream sources so the shapes match what the
+ * MicroVM service actually expects, not a guess.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { MicrovmImage, MicrovmImage_CloudWatchLogging, MicrovmImage_CodeArtifact, MicrovmImage_CpuConfiguration, MicrovmImage_EnvironmentVariable, MicrovmImage_Hooks, MicrovmImage_Logging, MicrovmImage_Resources, NetworkConnector, NetworkConnector_Config, NetworkConnector_VpcEgressConfiguration, Role, Role_Policy, SecurityGroup, SecurityGroup_Egress, } from "../generated/index.js";
+import { Sub } from "../intrinsics.js";
+const MICROVM_SERVICE_PRINCIPAL = "lambda.amazonaws.com";
+const CONNECTOR_MANAGED_RESOURCE_OPERATOR = "network-connectors.lambda.amazonaws.com";
+/**
+ * The Lambda MicroVMs service's real limits, verified against the upstream
+ * `ran-isenberg/lambda-microvm-cdk-python` construct and the AWS docs.
+ *
+ * Exported because a consumer driving the same service through a different
+ * control plane needs the same numbers, and copying them is how two sources of
+ * truth start (#1374). The CFN schema types most of these as open ints and
+ * strings, so nothing but this object knows them.
+ */
+export const MICROVM_LIMITS = {
+    /** Documented baseline memory tiers (MiB). The schema says int; the service accepts five values. vCPU auto-scales with the tier. */
+    memoryMiB: [512, 1024, 2048, 4096, 8192],
+    namePattern: /^[a-zA-Z0-9-_]+$/,
+    maxNameLength: 64,
+    /** Set by the service on every MicroVM; supplying it is rejected. */
+    reservedEnvironmentKeys: ["AWS_REGION"],
+    maxEnvironmentVariables: 50,
+    maxEgressConnectors: 10,
+    connectorSubnets: { min: 1, max: 16 },
+};
+const VALID_MEMORY_MIB = MICROVM_LIMITS.memoryMiB;
+const NAME_PATTERN = MICROVM_LIMITS.namePattern;
+const MAX_NAME_LENGTH = MICROVM_LIMITS.maxNameLength;
+const RESERVED_ENV_KEYS = new Set(MICROVM_LIMITS.reservedEnvironmentKeys);
+const MAX_ENVIRONMENT_VARIABLES = MICROVM_LIMITS.maxEnvironmentVariables;
+const MAX_EGRESS_CONNECTORS = MICROVM_LIMITS.maxEgressConnectors;
+const MIN_CONNECTOR_SUBNETS = MICROVM_LIMITS.connectorSubnets.min;
+const MAX_CONNECTOR_SUBNETS = MICROVM_LIMITS.connectorSubnets.max;
+/**
+ * `sts:AssumeRole` + `sts:TagSession` trust for `lambda.amazonaws.com` — the
+ * MicroVM service assumes the build/execution roles with session tags
+ * (`lambda_microvm_cdk._impl.security._microvm_service_trust`).
+ */
+const microvmServiceTrustPolicy = {
+    Version: "2012-10-17",
+    Statement: [
+        { Effect: "Allow", Principal: { Service: MICROVM_SERVICE_PRINCIPAL }, Action: "sts:AssumeRole" },
+        { Effect: "Allow", Principal: { Service: MICROVM_SERVICE_PRINCIPAL }, Action: "sts:TagSession" },
+    ],
+};
+/** Plain `sts:AssumeRole` trust — the connector operator role's documented trust (no session tags). */
+const lambdaTrustPolicy = {
+    Version: "2012-10-17",
+    Statement: [
+        { Effect: "Allow", Principal: { Service: MICROVM_SERVICE_PRINCIPAL }, Action: "sts:AssumeRole" },
+    ],
+};
+/**
+ * CDK's synthesized "deny all outbound" placeholder rule. A security group
+ * with no egress rules gets CloudFormation's allow-all-outbound default, so
+ * this rule (which matches no real traffic — `255.255.255.255/32` is
+ * unassignable) is added explicitly to override that default. Verbatim
+ * `MATCH_NO_TRAFFIC` from `aws-cdk-lib/aws-ec2/lib/security-group.ts`.
+ */
+const DENY_ALL_EGRESS = new SecurityGroup_Egress({
+    CidrIp: "255.255.255.255/32",
+    Description: "Disallow all traffic",
+    IpProtocol: "icmp",
+    FromPort: 252,
+    ToPort: 86,
+});
+export const MicrovmApp = Composite((props) => {
+    if (!NAME_PATTERN.test(props.name) || props.name.length > MAX_NAME_LENGTH) {
+        throw new Error(`MicrovmApp name must match ${NAME_PATTERN} and be ≤${MAX_NAME_LENGTH} chars, got: ${JSON.stringify(props.name)}`);
+    }
+    const memoryMiB = props.memoryMiB ?? 2048;
+    if (!VALID_MEMORY_MIB.includes(memoryMiB)) {
+        throw new Error(`MicrovmApp memoryMiB must be one of ${VALID_MEMORY_MIB.join(", ")}, got: ${memoryMiB}`);
+    }
+    const environment = props.environment ?? {};
+    const environmentKeys = Object.keys(environment);
+    if (environmentKeys.length > MAX_ENVIRONMENT_VARIABLES) {
+        throw new Error(`MicrovmApp environment supports at most ${MAX_ENVIRONMENT_VARIABLES} variables, got ${environmentKeys.length}`);
+    }
+    for (const key of environmentKeys) {
+        if (RESERVED_ENV_KEYS.has(key)) {
+            throw new Error(`MicrovmApp environment key "${key}" is reserved — the MicroVM runtime injects it`);
+        }
+    }
+    const additionalEgressConnectors = props.additionalEgressConnectors ?? [];
+    const totalConnectors = additionalEgressConnectors.length + (props.buildConnector ? 1 : 0);
+    if (totalConnectors > MAX_EGRESS_CONNECTORS) {
+        throw new Error(`MicrovmApp supports at most ${MAX_EGRESS_CONNECTORS} egress connectors total, got ${totalConnectors}`);
+    }
+    if (props.buildConnector) {
+        const subnetCount = props.buildConnector.subnetIds.length;
+        if (subnetCount < MIN_CONNECTOR_SUBNETS || subnetCount > MAX_CONNECTOR_SUBNETS) {
+            throw new Error(`MicrovmApp buildConnector needs ${MIN_CONNECTOR_SUBNETS}-${MAX_CONNECTOR_SUBNETS} subnets, got ${subnetCount}`);
+        }
+    }
+    const { defaults } = props;
+    // Service-owned log group the build + execution roles are scoped to
+    // (`lambda_microvm_cdk._impl.security.log_group_arn`) — the MicroVM service
+    // creates and owns this group; this composite only references its ARN for
+    // the IAM grants, never declares the group itself.
+    const logGroupName = `/aws/lambda/microvms/${props.name}`;
+    const logGroupArn = Sub `arn:\${AWS::Partition}:logs:\${AWS::Region}:\${AWS::AccountId}:log-group:${logGroupName}`;
+    const logGroupArnWildcard = Sub `arn:\${AWS::Partition}:logs:\${AWS::Region}:\${AWS::AccountId}:log-group:${logGroupName}:*`;
+    // ── Build role ── s3:GetObject on the exact code artifact object, logs:* on the image's own log group.
+    const buildRole = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: microvmServiceTrustPolicy,
+        Description: "Least-privilege build role for the Lambda MicroVM image build",
+        Policies: [
+            new Role_Policy({
+                PolicyName: "MicrovmImageBuild",
+                PolicyDocument: {
+                    Version: "2012-10-17",
+                    Statement: [
+                        {
+                            Sid: "ReadExactCodeArtifact",
+                            Effect: "Allow",
+                            Action: "s3:GetObject",
+                            Resource: props.codeArtifactObjectArn,
+                        },
+                        {
+                            Sid: "WriteBuildLogs",
+                            Effect: "Allow",
+                            Action: ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
+                            Resource: [logGroupArn, logGroupArnWildcard],
+                        },
+                    ],
+                },
+            }),
+        ],
+    }, defaults?.buildRole));
+    // ── Execution role ── runtime-logs only; the consumer adds workload permissions on top.
+    const executionRole = new Role(mergeDefaults({
+        AssumeRolePolicyDocument: microvmServiceTrustPolicy,
+        Description: "Least-privilege execution role assumed by the running MicroVM",
+        Policies: [
+            new Role_Policy({
+                PolicyName: "MicrovmRuntimeLogs",
+                PolicyDocument: {
+                    Version: "2012-10-17",
+                    Statement: [
+                        {
+                            Sid: "WriteRuntimeLogs",
+                            Effect: "Allow",
+                            Action: ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
+                            Resource: [logGroupArn, logGroupArnWildcard],
+                        },
+                    ],
+                },
+            }),
+        ],
+    }, defaults?.executionRole));
+    // ── Optional build-time egress connector ──────────────────────────────────
+    let connectorSecurityGroup;
+    let connectorOperatorRole;
+    let connector;
+    const egressConnectorArns = [...additionalEgressConnectors];
+    // A closure (invoked below) keeps the connector `new`s out of the `if` (EVL002);
+    // the early-return guard also narrows `props.buildConnector` for the body.
+    const buildConnectorResources = () => {
+        if (!props.buildConnector)
+            return;
+        // Deny-all by default — the security group's rules ARE the egress policy;
+        // open specific traffic via `defaults.connectorSecurityGroup`.
+        connectorSecurityGroup = new SecurityGroup(mergeDefaults({
+            GroupDescription: "MicroVM egress connector security group (rules ARE the egress policy)",
+            VpcId: props.buildConnector.vpcId,
+            SecurityGroupEgress: [DENY_ALL_EGRESS],
+        }, defaults?.connectorSecurityGroup));
+        // Reproduces verbatim the AWS-documented `NetworkConnector` operator-role
+        // policy: `ec2:CreateNetworkInterface` on the ENI/subnet/security-group
+        // resource types (region/account wildcarded — Lambda creates the ENIs in
+        // its own context, so pinning them would deny the call and the connector
+        // would never become ACTIVE), plus `ec2:CreateTags` on ENIs conditioned on
+        // the connector's own managed-resource operator so the grant can't tag
+        // arbitrary interfaces.
+        connectorOperatorRole = new Role(mergeDefaults({
+            AssumeRolePolicyDocument: lambdaTrustPolicy,
+            Description: "Least-privilege operator role Lambda assumes to manage the MicroVM connector ENIs",
+            Policies: [
+                new Role_Policy({
+                    PolicyName: "MicrovmConnectorEnis",
+                    PolicyDocument: {
+                        Version: "2012-10-17",
+                        Statement: [
+                            {
+                                Sid: "CreateENI",
+                                Effect: "Allow",
+                                Action: "ec2:CreateNetworkInterface",
+                                Resource: [
+                                    Sub `arn:\${AWS::Partition}:ec2:*:*:network-interface/*`,
+                                    Sub `arn:\${AWS::Partition}:ec2:*:*:subnet/*`,
+                                    Sub `arn:\${AWS::Partition}:ec2:*:*:security-group/*`,
+                                ],
+                            },
+                            {
+                                Sid: "TagENI",
+                                Effect: "Allow",
+                                Action: "ec2:CreateTags",
+                                Resource: Sub `arn:\${AWS::Partition}:ec2:*:*:network-interface/*`,
+                                Condition: {
+                                    StringEquals: { "ec2:ManagedResourceOperator": CONNECTOR_MANAGED_RESOURCE_OPERATOR },
+                                },
+                            },
+                        ],
+                    },
+                }),
+            ],
+        }, defaults?.connectorOperatorRole));
+        connector = new NetworkConnector(mergeDefaults({
+            OperatorRole: connectorOperatorRole.Arn,
+            Configuration: new NetworkConnector_Config({
+                VpcEgressConfiguration: new NetworkConnector_VpcEgressConfiguration({
+                    AssociatedComputeResourceTypes: ["MicroVm"],
+                    SubnetIds: props.buildConnector.subnetIds,
+                    SecurityGroupIds: [connectorSecurityGroup.GroupId],
+                    NetworkProtocol: props.buildConnector.networkProtocol ?? "IPv4",
+                }),
+            }),
+        }, defaults?.connector));
+        egressConnectorArns.push(connector.Arn);
+    };
+    if (props.buildConnector)
+        buildConnectorResources();
+    // ── The image itself ───────────────────────────────────────────────────────
+    const logging = props.disableLogging
+        ? new MicrovmImage_Logging({ Disabled: true })
+        : new MicrovmImage_Logging({ CloudWatch: new MicrovmImage_CloudWatchLogging({ LogGroup: logGroupName }) });
+    // Object.entries avoids the computed `environment[key]` access (EVL003, #952).
+    const environmentVariables = Object.entries(environment).map(([key, value]) => new MicrovmImage_EnvironmentVariable({ Key: key, Value: value }));
+    // `Hooks` is required by the CFN schema but every nested field is optional —
+    // "no hooks configured" (all lifecycle hooks disabled) is a real, valid `{}`.
+    // The serializer drops a wrapped property object down to `undefined` when its
+    // `.props` has zero keys (so an *optional* empty nested object vanishes
+    // rather than serializing as `{}`), which would silently drop this
+    // *required* property from the template. Emit a plain object literal instead
+    // of the `MicrovmImage_Hooks` wrapper so an empty `Hooks` still serializes
+    // as `{}`, not nothing.
+    const hasHooks = props.hooks !== undefined && Object.keys(props.hooks).length > 0;
+    const hooks = hasHooks ? new MicrovmImage_Hooks(props.hooks) : {};
+    // Short alias (e.g. "al2023-1") -> the AWS-managed base-image ARN; full ARNs pass through.
+    const baseImageArn = props.baseImage.startsWith("arn:")
+        ? props.baseImage
+        : Sub `arn:\${AWS::Partition}:lambda:\${AWS::Region}:aws:microvm-image:${props.baseImage}`;
+    const image = new MicrovmImage(mergeDefaults({
+        Name: props.name,
+        Description: props.description ?? "",
+        BaseImageArn: baseImageArn,
+        BaseImageVersion: props.baseImageVersion ?? "0",
+        BuildRoleArn: buildRole.Arn,
+        CodeArtifact: new MicrovmImage_CodeArtifact({ Uri: props.codeArtifactUri }),
+        // ARM_64 is the only architecture the service accepts today.
+        CpuConfigurations: [new MicrovmImage_CpuConfiguration({ Architecture: "ARM_64" })],
+        Resources: [new MicrovmImage_Resources({ MinimumMemoryInMiB: memoryMiB })],
+        AdditionalOsCapabilities: props.additionalOsCapabilities ?? [],
+        EgressNetworkConnectors: egressConnectorArns,
+        EnvironmentVariables: environmentVariables,
+        Hooks: hooks,
+        Logging: logging,
+    }, defaults?.image));
+    return {
+        buildRole,
+        executionRole,
+        image,
+        ...(connectorSecurityGroup ? { connectorSecurityGroup } : {}),
+        ...(connectorOperatorRole ? { connectorOperatorRole } : {}),
+        ...(connector ? { connector } : {}),
+    };
+}, "MicrovmApp");

package/dist/composites/minimal-vpc.js

@@ -0,0 +1,40 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Vpc, Subnet, InternetGateway, VPCGatewayAttachment, RouteTable, EC2Route, SubnetRouteTableAssociation, SecurityGroup, } from "../generated/index.js";
+import { Select, GetAZs } from "../intrinsics.js";
+/** A VPC with one public subnet, an internet gateway, a public route and a security group. */
+export const MinimalVpc = Composite((props) => {
+    const { defaults } = props;
+    const cidr = props.cidr ?? "10.0.0.0/24";
+    const subnetCidr = props.subnetCidr ?? "10.0.0.0/25";
+    const vpc = new Vpc(mergeDefaults({
+        CidrBlock: cidr,
+        EnableDnsHostnames: true,
+        EnableDnsSupport: true,
+    }, defaults?.vpc));
+    const subnet = new Subnet(mergeDefaults({
+        VpcId: vpc.VpcId,
+        CidrBlock: subnetCidr,
+        AvailabilityZone: Select(0, GetAZs("")),
+        MapPublicIpOnLaunch: true,
+    }, defaults?.subnet));
+    const igw = new InternetGateway({});
+    const igwAttachment = new VPCGatewayAttachment({
+        VpcId: vpc.VpcId,
+        InternetGatewayId: igw.InternetGatewayId,
+    });
+    const routeTable = new RouteTable({ VpcId: vpc.VpcId });
+    const defaultRoute = new EC2Route({
+        RouteTableId: routeTable.RouteTableId,
+        DestinationCidrBlock: "0.0.0.0/0",
+        GatewayId: igw.InternetGatewayId,
+    }, { DependsOn: [igwAttachment] });
+    const subnetRta = new SubnetRouteTableAssociation({
+        SubnetId: subnet.SubnetId,
+        RouteTableId: routeTable.RouteTableId,
+    });
+    const securityGroup = new SecurityGroup(mergeDefaults({
+        GroupDescription: "MinimalVpc default security group",
+        VpcId: vpc.VpcId,
+    }, defaults?.securityGroup));
+    return { vpc, subnet, igw, igwAttachment, routeTable, defaultRoute, subnetRta, securityGroup };
+}, "MinimalVpc");

package/dist/composites/monitoring-stack.js

@@ -0,0 +1,105 @@
+/**
+ * MonitoringStack — a CloudWatch dashboard wired to up to three named
+ * metrics, with an optional alarm per metric.
+ *
+ * The recurring hand-rolled shape the aws-bench corpus surfaced: a team
+ * stands up a `cloudwatch.Dashboard`, a `cloudwatch.Metric` per resource it
+ * cares about, and a near-identical `cloudwatch.Alarm` next to each one — 44
+ * combined dashboard+alarm+metric instantiations across the corpus' 8 real
+ * CDK apps, nothing equivalent shipped in chant (epic #1139).
+ *
+ * Fixed `metric1..metric3` slots, not a `metrics: MetricSpec[]` array — a
+ * loop building `Alarm` resources from an array is exactly the control-flow-
+ * over-resources shape EVL002/EVL003 rule out for reference composites (see
+ * `EksCluster`'s `addon1..addon3`, this directory). A fourth metric is a bare
+ * `Alarm` + a hand-edited `CwDashboard.DashboardBody` the estate declares
+ * directly.
+ *
+ * What is deliberately NOT here:
+ *  - Notification wiring. `alarm.alarmActions` on each metric takes ARNs the
+ *    caller already has (an SNS topic from `LambdaSns`, or hand-declared);
+ *    this composite does not create a `Topic`/`Subscription` itself — who
+ *    gets paged and on what channel is a real per-estate decision, not a
+ *    default worth guessing. `defaults.alarm1..3` is the escape hatch for
+ *    anything else on the alarm (e.g. `OKActions`, `DatapointsToAlarm`).
+ *  - Math-expression / composite / anomaly-detection alarms (`Alarm.Metrics`,
+ *    `AlarmModel`) — single-metric threshold alarms only.
+ *  - Dynamic (`Ref`/`GetAtt`/`Sub`) values inside the dashboard body.
+ *    `CwDashboard.DashboardBody` is one flat JSON string CloudFormation does
+ *    not template, so each metric's `namespace`/`metricName`/`dimension.value`
+ *    must be a literal the caller already knows — the physical name they set
+ *    on the monitored resource, not one CloudFormation generates. The `Alarm`
+ *    resources carry no such limit: `Dimensions` is a real structured
+ *    property, so `alarm.dimensionValue` accepts `Value<string>` and can
+ *    reference a sibling resource by `Ref`/`GetAtt`.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Alarm, CwDashboard } from "../generated/index.js";
+/** A CloudWatch dashboard "metric" widget, stacked full-width below the last. */
+function widget(spec, index) {
+    // Two literal-array branches, not a spread — EVL004 only traces a spread
+    // source to a *module-level* const (packages/core/src/lint/rules/
+    // evl004-spread-non-const.ts's isConstIdentifier walks sourceFile.statements
+    // only), so a same-function `const dims = [...]` here reads as non-const
+    // even though it is one. A ternary between two literals sidesteps the gap
+    // instead of fighting it.
+    const metricTuple = spec.dimension
+        ? [spec.namespace, spec.metricName, spec.dimension.name, spec.dimension.value]
+        : [spec.namespace, spec.metricName];
+    return {
+        type: "metric",
+        x: 0,
+        y: index * 6,
+        width: 24,
+        height: 6,
+        properties: {
+            title: spec.title,
+            metrics: [metricTuple],
+            period: spec.period ?? 300,
+            stat: spec.statistic ?? "Sum",
+            view: "timeSeries",
+        },
+    };
+}
+function alarmProps(spec) {
+    const a = spec.alarm;
+    return {
+        AlarmName: spec.title,
+        AlarmDescription: `${spec.title} breached its threshold`,
+        Namespace: spec.namespace,
+        MetricName: spec.metricName,
+        Dimensions: spec.dimension
+            ? [{ Name: spec.dimension.name, Value: a.dimensionValue ?? spec.dimension.value }]
+            : undefined,
+        Statistic: spec.statistic ?? "Sum",
+        Period: spec.period ?? 300,
+        Threshold: a.threshold,
+        ComparisonOperator: a.comparisonOperator ?? "GreaterThanThreshold",
+        EvaluationPeriods: a.evaluationPeriods ?? 1,
+        TreatMissingData: a.treatMissingData,
+        AlarmActions: a.alarmActions,
+    };
+}
+export const MonitoringStack = Composite((props) => {
+    const { defaults } = props;
+    const specs = [props.metric1, props.metric2, props.metric3].filter((s) => s !== undefined);
+    const dashboard = new CwDashboard(mergeDefaults({
+        DashboardName: props.dashboardName,
+        DashboardBody: JSON.stringify({ widgets: specs.map(widget) }),
+    }, defaults?.dashboard));
+    const alarm1 = props.metric1.alarm
+        ? new Alarm(mergeDefaults(alarmProps(props.metric1), defaults?.alarm1))
+        : undefined;
+    const alarm2 = props.metric2?.alarm
+        ? new Alarm(mergeDefaults(alarmProps(props.metric2), defaults?.alarm2))
+        : undefined;
+    const alarm3 = props.metric3?.alarm
+        ? new Alarm(mergeDefaults(alarmProps(props.metric3), defaults?.alarm3))
+        : undefined;
+    return {
+        dashboard,
+        ...(alarm1 ? { alarm1 } : {}),
+        ...(alarm2 ? { alarm2 } : {}),
+        ...(alarm3 ? { alarm3 } : {}),
+    };
+}, "MonitoringStack");

package/dist/composites/nlb-service.js

@@ -0,0 +1,61 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { LoadBalancer, TargetGroup, TargetGroup_TargetDescription, Listener, Listener_Action, Listener_Certificate, } from "../generated/index.js";
+/** A Network Load Balancer with a target group and listener. */
+export const NlbService = Composite((props) => {
+    if (props.protocol === "TLS" && !props.certificateArn) {
+        throw new Error("NlbService requires certificateArn when protocol is TLS");
+    }
+    const listenerPort = props.listenerPort ?? 80;
+    const targetPort = props.targetPort ?? listenerPort;
+    const protocol = props.protocol ?? "TCP";
+    const scheme = props.scheme ?? "internet-facing";
+    const targetType = props.targetType ?? "ip";
+    const { defaults: defs } = props;
+    // Network Load Balancer. Unlike the ALB composites, no security group is
+    // created here — NLBs pass through the client's source IP by default, so
+    // access control belongs on the target side (or via an explicit SG passed
+    // through `defaults.nlb`), not on the load balancer itself.
+    const nlb = new LoadBalancer(mergeDefaults({
+        Type: "network",
+        Scheme: scheme,
+        Subnets: props.subnetIds,
+    }, defs?.nlb));
+    // Target group. Static targets are optional — a `.map` keeps the `new`s
+    // out of a conditional (EVL002).
+    const targets = props.targets?.map((t) => new TargetGroup_TargetDescription({
+        Id: t.id,
+        Port: t.port,
+        AvailabilityZone: t.availabilityZone,
+    }));
+    const targetGroup = new TargetGroup(mergeDefaults({
+        TargetType: targetType,
+        Protocol: protocol,
+        Port: targetPort,
+        VpcId: props.vpcId,
+        HealthCheckProtocol: props.healthCheckProtocol ?? "TCP",
+        HealthCheckPort: props.healthCheckPort,
+        HealthCheckPath: props.healthCheckPath,
+        Targets: targets,
+    }, defs?.targetGroup));
+    // Listener — forwards to the target group. TLS carries the cert; a
+    // ternary keeps the `new` out of the `if` (EVL002).
+    const forwardAction = new Listener_Action({
+        Type: "forward",
+        TargetGroupArn: targetGroup.TargetGroupArn,
+    });
+    const listenerProps = {
+        LoadBalancerArn: nlb.LoadBalancerArn,
+        Port: listenerPort,
+        Protocol: protocol,
+        DefaultActions: [forwardAction],
+        Certificates: protocol === "TLS" && props.certificateArn
+            ? [new Listener_Certificate({ CertificateArn: props.certificateArn })]
+            : undefined,
+    };
+    const listener = new Listener(mergeDefaults(listenerProps, defs?.listener));
+    return {
+        nlb,
+        targetGroup,
+        listener,
+    };
+}, "NlbService");

package/dist/composites/rds-instance.js

@@ -0,0 +1,98 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { DbInstance, RDSDBSubnetGroup, RDSDBParameterGroup, SecurityGroup, SecurityGroup_Ingress, } from "../generated/index.js";
+// A Map (not a Record) so the per-engine lookup uses `.get()` rather than the
+// computed `ENGINE_DEFAULTS[engine]` element access the evaluability lint flags (#952).
+const ENGINE_DEFAULTS = new Map([
+    ["postgres", { port: 5432, username: "postgres", version: "16.6", logExport: "postgresql" }],
+    ["mysql", { port: 3306, username: "admin", version: "8.0.40", logExport: "general" }],
+    ["mariadb", { port: 3306, username: "admin", version: "11.4.3", logExport: "general" }],
+]);
+/** An RDS database instance with its subnet group, parameter group and security group, defaulting to PostgreSQL. */
+export const RdsInstance = Composite((props) => {
+    const engine = props.engine ?? "postgres";
+    const defaults = ENGINE_DEFAULTS.get(engine);
+    const port = props.port ?? defaults.port;
+    const masterUsername = props.masterUsername ?? defaults.username;
+    const engineVersion = props.engineVersion ?? defaults.version;
+    const instanceClass = props.instanceClass ?? "db.t4g.micro";
+    const allocatedStorage = props.allocatedStorage ?? 20;
+    const storageType = props.storageType ?? "gp3";
+    const multiAZ = props.multiAZ ?? false;
+    const storageEncrypted = props.storageEncrypted ?? true;
+    const backupRetentionPeriod = props.backupRetentionPeriod ?? 7;
+    const copyTagsToSnapshot = props.copyTagsToSnapshot ?? true;
+    const autoMinorVersionUpgrade = props.autoMinorVersionUpgrade ?? true;
+    const publiclyAccessible = props.publiclyAccessible ?? false;
+    const deletionProtection = props.deletionProtection ?? false;
+    const { defaults: defs } = props;
+    // DB Subnet Group
+    const subnetGroup = new RDSDBSubnetGroup(mergeDefaults({
+        DBSubnetGroupDescription: "Subnet group for RDS instance",
+        SubnetIds: props.subnetIds,
+    }, defs?.subnetGroup));
+    // Security Group
+    // Ternary (not push-inside-if) keeps the `new`s out of control flow (EVL002).
+    const ingressRules = props.ingressSourceSG
+        ? [new SecurityGroup_Ingress({ IpProtocol: "tcp", FromPort: port, ToPort: port, SourceSecurityGroupId: props.ingressSourceSG })]
+        : props.ingressCidr
+            ? [new SecurityGroup_Ingress({ IpProtocol: "tcp", FromPort: port, ToPort: port, CidrIp: props.ingressCidr })]
+            : [];
+    const sg = new SecurityGroup(mergeDefaults({
+        GroupDescription: "Security group for RDS instance",
+        VpcId: props.vpcId,
+        SecurityGroupIngress: ingressRules.length > 0 ? ingressRules : undefined,
+    }, defs?.sg));
+    // Optional Parameter Group — ternary keeps the `new` out of the `if` (EVL002).
+    const parameterGroup = props.parameterGroupFamily
+        ? new RDSDBParameterGroup(mergeDefaults({
+            Family: props.parameterGroupFamily,
+            Description: "Custom parameter group",
+            Parameters: props.parameters,
+        }, defs?.parameterGroup))
+        : undefined;
+    // DB Instance
+    const dbProps = {
+        Engine: engine,
+        EngineVersion: engineVersion,
+        DBInstanceClass: instanceClass,
+        MasterUsername: masterUsername,
+        MasterUserPassword: props.masterPassword,
+        AllocatedStorage: String(allocatedStorage),
+        StorageType: storageType,
+        DBSubnetGroupName: subnetGroup.Ref,
+        VPCSecurityGroups: [sg.GroupId],
+        Port: String(port),
+        PubliclyAccessible: publiclyAccessible,
+        MultiAZ: multiAZ,
+        StorageEncrypted: storageEncrypted,
+        BackupRetentionPeriod: backupRetentionPeriod,
+        CopyTagsToSnapshot: copyTagsToSnapshot,
+        AutoMinorVersionUpgrade: autoMinorVersionUpgrade,
+        DeletionProtection: deletionProtection,
+    };
+    if (props.databaseName)
+        dbProps.DBName = props.databaseName;
+    if (props.kmsKeyId)
+        dbProps.KmsKeyId = props.kmsKeyId;
+    if (props.maxAllocatedStorage)
+        dbProps.MaxAllocatedStorage = props.maxAllocatedStorage;
+    if (props.preferredBackupWindow)
+        dbProps.PreferredBackupWindow = props.preferredBackupWindow;
+    if (props.preferredMaintenanceWindow)
+        dbProps.PreferredMaintenanceWindow = props.preferredMaintenanceWindow;
+    if (props.enableCloudwatchLogs)
+        dbProps.EnableCloudwatchLogsExports = [defaults.logExport];
+    if (props.enablePerformanceInsights) {
+        dbProps.EnablePerformanceInsights = true;
+        if (props.performanceInsightsRetentionPeriod) {
+            dbProps.PerformanceInsightsRetentionPeriod = props.performanceInsightsRetentionPeriod;
+        }
+    }
+    if (parameterGroup)
+        dbProps.DBParameterGroupName = parameterGroup.Ref;
+    const db = new DbInstance(mergeDefaults(dbProps, defs?.db));
+    const result = { subnetGroup, sg, db };
+    if (parameterGroup)
+        result.parameterGroup = parameterGroup;
+    return result;
+}, "RdsInstance");

package/dist/composites/scheduled-lambda.js

@@ -0,0 +1,28 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { EventRule, EventRule_Target, Permission } from "../generated/index.js";
+import { LambdaFunction } from "./lambda-function.js";
+/** A Lambda function run on a schedule by an EventBridge rule. */
+export const LambdaScheduled = Composite((props) => {
+    const { defaults } = props;
+    const { role, func } = LambdaFunction(props);
+    const rule = new EventRule(mergeDefaults({
+        Name: props.ruleName,
+        ScheduleExpression: props.schedule,
+        State: (props.enabled ?? true) ? "ENABLED" : "DISABLED",
+        Targets: [
+            new EventRule_Target({
+                Arn: func.Arn,
+                Id: "Target0",
+            }),
+        ],
+    }, defaults?.rule));
+    const permission = new Permission(mergeDefaults({
+        FunctionName: func.Arn,
+        Action: "lambda:InvokeFunction",
+        Principal: "events.amazonaws.com",
+        SourceArn: rule.Arn,
+    }, defaults?.permission));
+    return { role, func, rule, permission };
+}, "LambdaScheduled");
+/** @deprecated Use `LambdaScheduled` instead */
+export const ScheduledLambda = LambdaScheduled;

package/dist/composites/solr-fargate-service.js

@@ -0,0 +1,33 @@
+import { Composite } from "@intentius/chant";
+import { FargateService } from "./fargate-service.js";
+/**
+ * A FargateService preset for Apache Solr, with JVM heap and GC settings.
+ *
+ * A pass-through composite: it returns another composite's instance rather than
+ * building a members record. `CompositeFactoryMembers` admits that explicitly
+ * (#1366) — it works at runtime because a composite instance keeps `members`
+ * and `_definition` non-enumerable, so only its member resources are visible.
+ */
+export const SolrFargateService = Composite((props) => {
+    const memoryMb = parseInt(props.memory ?? "4096");
+    const solrHeap = props.solrHeap ?? `${Math.floor(memoryMb * 0.45)}m`;
+    const gcOpts = props.gcOpts ?? "-XX:+UseG1GC -XX:MaxGCPauseMillis=200";
+    // Solr env defaults — user-supplied environment entries override these
+    const solrEnv = {
+        SOLR_HEAP: solrHeap,
+        GC_TUNE: gcOpts,
+        SOLR_OPTS: "-XX:-UseLargePages",
+        ...props.environment,
+    };
+    // Solr-specific ulimit default — user-supplied ulimits override
+    const solrUlimits = props.ulimits ?? [
+        { name: "nofile", softLimit: 65535, hardLimit: 65535 },
+    ];
+    return FargateService({
+        containerPort: 8983,
+        healthCheckPath: "/solr/admin/info/health",
+        ...props,
+        environment: solrEnv,
+        ulimits: solrUlimits,
+    });
+}, "SolrFargateService");