@intentius/chant-lexicon-aws 0.124.31 → 0.124.33

package/dist/okf/types/Workspace.md

@@ -0,0 +1,28 @@
+---
+type: resource-type
+title: Workspace
+description: aws resource type AWS::IoTSiteWise::Workspace
+name: Workspace
+lexicon: aws
+resource_type: AWS::IoTSiteWise::Workspace
+---
+`AWS::IoTSiteWise::Workspace`, a resource type of the aws lexicon.
+
+## Properties
+
+- `EncryptionConfiguration` (`Workspace_EncryptionConfiguration`, required)
+- `WorkspaceName` (`string`, required): The name of the workspace.
+- `CreatedAt` (`string`, optional): The time the workspace was created.
+- `KmsKeyId` (`string`, optional): The ARN of the AWS KMS key used for KMS_BASED_ENCRYPTION. Required when EncryptionConfiguration.EncryptionType is KMS_BASED_ENCRYPTION.
+- `Status` (`"ACTIVE" | "CREATING" | "DELETING" | "FAILED" | "UPDATING"`, optional): The current state of the workspace.
+- `Tags` (`Workspace_Tag[]`, optional): An array of key-value pairs to apply to this resource.
+- `UpdatedAt` (`string`, optional): The time the workspace was last updated.
+- `WorkspaceArn` (`string`, optional): The ARN of the workspace.
+- `WorkspaceDescription` (`string`, optional): A description of the workspace.
+
+## Attributes
+
+- `CreatedAt`
+- `Status`
+- `UpdatedAt`
+- `WorkspaceArn`

package/dist/okf/types/Workteam.md

@@ -10,14 +10,14 @@ resource_type: AWS::SageMaker::Workteam
 
 ## Properties
 
-- `Description` (`string`, optional)
-- `Id` (`string`, optional)
-- `MemberDefinitions` (`Workteam_MemberDefinition[]`, optional)
-- `NotificationConfiguration` (`Workteam_NotificationConfiguration`, optional)
-- `Tags` (`Workteam_Tag[]`, optional)
-- `WorkforceName` (`string`, optional)
-- `WorkteamName` (`string`, optional)
+- `Description` (`string`, required): A description of the work team.
+- `MemberDefinitions` (`Workteam_MemberDefinition[]`, required): A list of MemberDefinition objects that contains objects that identify the workers that make up the work team.
+- `NotificationConfiguration` (`Workteam_NotificationConfiguration`, optional): Configures SNS notifications of available or expiring work items for work teams.
+- `Tags` (`Workteam_Tag[]`, optional): An array of key-value pairs.
+- `WorkforceName` (`string`, optional): The name of the Workforce
+- `WorkteamArn` (`string`, optional): The Amazon Resource Name (ARN) that identifies the work team.
+- `WorkteamName` (`string`, optional): The name of the work team.
 
 ## Attributes
 
-- `Id`
+- `WorkteamArn`

package/dist/op/activities/aws-apply.js

@@ -0,0 +1,214 @@
+import { readFileSync } from "node:fs";
+import { sleep } from "@intentius/chant/op";
+import { awsDeployCapabilitiesForBody } from "../../components/cloud-executor.js";
+import { resolveEndpointOverride } from "../../api/read-client.js";
+import { ownershipStackTagsForBody } from "../../ownership.js";
+const DEFAULT_REGION = "us-east-1";
+const CFN_API_VERSION = "2010-05-15";
+const defaultHttp = async (url, form, signal) => {
+    const res = await fetch(url, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(form).toString(),
+        signal,
+    });
+    return { status: res.status, text: await res.text() };
+};
+// ── Pure helpers (CFN Query protocol) ─────────────────────────────────────────
+/**
+ * The CloudFormation endpoint URL — the override, or the real regional host.
+ * `env` is what the ambient-variable fallback reads; injectable for tests.
+ */
+export function cfnUrl(endpoint, region = DEFAULT_REGION, env = process.env) {
+    const override = resolveEndpointOverride("cloudformation", endpoint, env);
+    return `${(override ?? `https://cloudformation.${region}.amazonaws.com`).replace(/\/$/, "")}/`;
+}
+/** A CFN Query-protocol form body: `Action` + `Version` + params. */
+export function cfnForm(action, params) {
+    return { Action: action, Version: CFN_API_VERSION, ...params };
+}
+/** Capabilities as the CFN `Capabilities.member.N` list params. */
+export function capabilityParams(capabilities) {
+    const out = {};
+    capabilities.forEach((c, i) => (out[`Capabilities.member.${i + 1}`] = c));
+    return out;
+}
+/**
+ * Stack tags as the CFN `Tags.member.N.Key/Value` list params (#1222). Sorted
+ * so the request is deterministic. Empty in, empty out — a template without an
+ * ownership marker adds no `Tags` parameter at all.
+ */
+export function tagParams(tags) {
+    const out = {};
+    Object.keys(tags)
+        .sort()
+        .forEach((key, i) => {
+        out[`Tags.member.${i + 1}.Key`] = key;
+        out[`Tags.member.${i + 1}.Value`] = tags[key];
+    });
+    return out;
+}
+/**
+ * First `<tag>…</tag>` text in a CFN XML response.
+ *
+ * Assumes flat scalar fields — the CloudFormation Query API returns simple
+ * `<StackStatus>…</StackStatus>` style leaves, so `[^<]*` is sufficient. It does
+ * NOT handle nested tags or XML entities in the value; if a field ever carries
+ * either, replace this with a real XML parser.
+ */
+export function xmlField(xml, tag) {
+    return xml.match(new RegExp(`<${tag}>([^<]*)</${tag}>`))?.[1];
+}
+export const stackStatus = (xml) => xmlField(xml, "StackStatus");
+export const stackId = (xml) => xmlField(xml, "StackId");
+export const cfnErrorMessage = (xml) => xmlField(xml, "Message");
+/** A DescribeStacks error for an absent stack (drives create-vs-update). */
+export const isStackMissing = (xml) => /does not exist/i.test(xml);
+/** The real-AWS UpdateStack no-op error (Floci returns 200 instead). */
+export const isNoUpdates = (xml) => /No updates are to be performed/i.test(xml);
+const SUCCESS_STATUS = new Set(["CREATE_COMPLETE", "UPDATE_COMPLETE", "IMPORT_COMPLETE"]);
+export const isSuccessStatus = (status) => SUCCESS_STATUS.has(status);
+export const isFailureStatus = (status) => /FAILED|ROLLBACK/.test(status);
+/** A settled stack state — success, failure, or deleted. Transient `*_IN_PROGRESS` states aren't. */
+export const isTerminalStatus = (status) => isSuccessStatus(status) || isFailureStatus(status) || status === "DELETE_COMPLETE";
+// ── Poll ──────────────────────────────────────────────────────────────────────
+/** Poll DescribeStacks until the stack reaches a terminal state; returns that status. */
+export async function waitForStackSettled(url, stackName, http, opts, signal) {
+    const deadline = Date.now() + opts.timeoutMs;
+    while (Date.now() < deadline) {
+        if (signal?.aborted)
+            throw new Error("awsApply aborted");
+        const res = await http(url, cfnForm("DescribeStacks", { StackName: stackName }), signal);
+        const status = stackStatus(res.text);
+        if (status && isTerminalStatus(status))
+            return status;
+        await sleep(opts.intervalMs, signal);
+    }
+    throw new Error(`CloudFormation stack ${stackName} did not settle within ${opts.timeoutMs}ms`);
+}
+// ── Apply / delete ──────────────────────────────────────────────────────────
+/**
+ * The native AWS applier — deploy a built CloudFormation template by calling the
+ * CloudFormation API directly (create-or-update + poll to a settled stack),
+ * targeting a local Floci emulator or real AWS by endpoint override. The direct
+ * twin of `azApply`/`gcpApply`: it speaks the CloudFormation Query API over HTTP
+ * rather than shelling `aws cloudformation deploy` — and since chant #1449 it is
+ * also what `nativeApply({ target: "cloudformation" })` runs, so no CLI path
+ * remains. The stack is the ownership boundary, so deletes ride CloudFormation
+ * itself — no separate prune. `http` is injectable for tests.
+ */
+export async function awsApply(args, signal, http = defaultHttp) {
+    const url = cfnUrl(args.endpoint, args.region);
+    const templateBody = readFileSync(args.templatePath, "utf8");
+    const capabilities = args.capabilities ?? awsDeployCapabilitiesForBody(templateBody);
+    const timeoutMs = args.timeoutMs ?? 300000;
+    const intervalMs = args.intervalMs ?? 3000;
+    const desc = await http(url, cfnForm("DescribeStacks", { StackName: args.stackName }), signal);
+    if (desc.status >= 300 && !isStackMissing(desc.text)) {
+        throw new Error(`CloudFormation DescribeStacks failed (${desc.status}): ${cfnErrorMessage(desc.text) ?? desc.text}`);
+    }
+    const exists = desc.status < 300;
+    // Stamp the template's ownership marker as the STACK's own tags (#1222):
+    // stack-level teardown verifies ownership on DescribeStacks tags, and this
+    // is the write that makes every future stack teardown-eligible. A template
+    // carrying no marker adds nothing.
+    const stackTags = ownershipStackTagsForBody(templateBody);
+    const params = {
+        StackName: args.stackName,
+        TemplateBody: templateBody,
+        ...capabilityParams(capabilities),
+        ...tagParams(stackTags),
+    };
+    let action;
+    if (!exists) {
+        const res = await http(url, cfnForm("CreateStack", params), signal);
+        if (res.status >= 300) {
+            throw new Error(`CloudFormation CreateStack failed (${res.status}): ${cfnErrorMessage(res.text) ?? res.text}`);
+        }
+        action = "created";
+    }
+    else {
+        const res = await http(url, cfnForm("UpdateStack", params), signal);
+        if (res.status >= 300) {
+            if (isNoUpdates(res.text)) {
+                console.log(`unchanged: ${args.stackName} (no updates)`);
+                return { stackName: args.stackName, status: "UPDATE_COMPLETE", action: "unchanged" };
+            }
+            throw new Error(`CloudFormation UpdateStack failed (${res.status}): ${cfnErrorMessage(res.text) ?? res.text}`);
+        }
+        action = "updated";
+    }
+    const status = await waitForStackSettled(url, args.stackName, http, { timeoutMs, intervalMs }, signal);
+    if (isFailureStatus(status)) {
+        throw new Error(`CloudFormation stack ${args.stackName} ${action} → ${status}`);
+    }
+    console.log(`${action}: ${args.stackName} (${status}) [${url}]`);
+    return { stackName: args.stackName, status, action };
+}
+/**
+ * The inverse of {@link awsApply} — DeleteStack, then poll until the stack is
+ * gone. Idempotent: an already-absent stack is a no-op. `http` is injectable.
+ */
+export async function awsDelete(args, signal, http = defaultHttp) {
+    const url = cfnUrl(args.endpoint, args.region);
+    const timeoutMs = args.timeoutMs ?? 300000;
+    const intervalMs = args.intervalMs ?? 3000;
+    const res = await http(url, cfnForm("DeleteStack", { StackName: args.stackName }), signal);
+    if (res.status >= 300 && !isStackMissing(res.text)) {
+        throw new Error(`CloudFormation DeleteStack failed (${res.status}): ${cfnErrorMessage(res.text) ?? res.text}`);
+    }
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (signal?.aborted)
+            throw new Error("awsDelete aborted");
+        const d = await http(url, cfnForm("DescribeStacks", { StackName: args.stackName }), signal);
+        if (d.status >= 300 && isStackMissing(d.text))
+            return { stackName: args.stackName, deleted: true };
+        const status = stackStatus(d.text);
+        if (status === "DELETE_COMPLETE")
+            return { stackName: args.stackName, deleted: true };
+        if (status === "DELETE_FAILED")
+            throw new Error(`CloudFormation stack ${args.stackName} delete → DELETE_FAILED`);
+        await sleep(intervalMs, signal);
+    }
+    throw new Error(`CloudFormation stack ${args.stackName} delete did not complete within ${timeoutMs}ms`);
+}
+/**
+ * The saga compensation for {@link awsApply} — CloudFormation `RollbackStack`
+ * via the same Query-API client, then poll until the stack settles. Returns the
+ * stack to its last known stable state after a failed update (#1449 — this
+ * replaces the Temporal lexicon exec-ing `aws cloudformation rollback-stack`).
+ *
+ * Degrades rather than crashes in two cases where there is nothing to do:
+ * an absent stack (nothing applied, nothing to revert) and a target that does
+ * not implement the action — Floci answers `UnknownAction` (#947). Both return
+ * `rolledBack: false` with a logged warning; every other API error throws,
+ * because a compensation that silently fails leaves partial state looking
+ * reverted when it isn't. `http` is injectable for tests.
+ */
+export async function rollbackStack(args, signal, http = defaultHttp) {
+    const url = cfnUrl(args.endpoint, args.region);
+    const timeoutMs = args.timeoutMs ?? 300000;
+    const intervalMs = args.intervalMs ?? 3000;
+    const res = await http(url, cfnForm("RollbackStack", { StackName: args.stackName }), signal);
+    if (res.status >= 300) {
+        if (isStackMissing(res.text)) {
+            console.warn(`rollbackStack: stack ${args.stackName} does not exist — nothing to roll back`);
+            return { stackName: args.stackName, rolledBack: false };
+        }
+        // Local emulators (Floci) don't implement RollbackStack → `UnknownAction` (#947).
+        if (/UnknownAction|not supported/i.test(res.text)) {
+            console.warn(`rollbackStack: the target doesn't support RollbackStack (a local emulator such as Floci) — skipping automated rollback of ${args.stackName}`);
+            return { stackName: args.stackName, rolledBack: false };
+        }
+        throw new Error(`CloudFormation RollbackStack failed (${res.status}): ${cfnErrorMessage(res.text) ?? res.text}`);
+    }
+    const status = await waitForStackSettled(url, args.stackName, http, { timeoutMs, intervalMs }, signal);
+    // A settled rollback ends in `ROLLBACK_COMPLETE`/`UPDATE_ROLLBACK_COMPLETE` —
+    // classified a failure by the deploy-path matcher, but the success state here.
+    if (!/ROLLBACK_COMPLETE$/.test(status)) {
+        throw new Error(`CloudFormation stack ${args.stackName} rollback → ${status}`);
+    }
+    console.log(`rolled back: ${args.stackName} (${status}) [${url}]`);
+    return { stackName: args.stackName, rolledBack: true, status };
+}

package/dist/op/activities/floci.js

@@ -0,0 +1,97 @@
+import { emulatorLifecycle } from "@intentius/chant/op";
+const DEFAULT_NAME = "chant-floci";
+const DEFAULT_PORT = 4566;
+// Pinned, not `:latest` (#1345). An image that moves underneath a passing
+// local suite is the drift a pin exists to stop, and the freshness check in
+// core reports how far behind this is rather than bumping it — the tag moves
+// when a consuming test needs the newer emulator (#808).
+const DEFAULT_IMAGE = "floci/floci:1.5.34";
+const DEFAULT_REGION = "us-east-1";
+const DEFAULT_READY_SERVICE = "cloudformation";
+const DOCKER_SOCK = ["-v", "/var/run/docker.sock:/var/run/docker.sock"];
+/** True once the health body reports the required service (e.g. `"cloudformation"`). */
+export function isFlociReady(healthBody, service) {
+    return healthBody.includes(`"${service}"`);
+}
+/** The AWS env vars that point the `aws` CLI / SDK at a local Floci endpoint. */
+export function flociEnv(port, region) {
+    return {
+        AWS_ENDPOINT_URL: `http://localhost:${port}`,
+        AWS_ACCESS_KEY_ID: "test",
+        AWS_SECRET_ACCESS_KEY: "test",
+        AWS_REGION: region,
+    };
+}
+// AWS runs the LocalStack-compatible floci/floci image, so readiness is gated on
+// a service (`cloudformation`) appearing in `/_localstack/health` — unlike the
+// bespoke az/gcp fakes. Shared lifecycle: emulatorLifecycle (#746).
+const flociSpecFor = (readyService) => ({
+    name: DEFAULT_NAME,
+    image: DEFAULT_IMAGE,
+    containerPort: DEFAULT_PORT,
+    healthPath: "/_localstack/health",
+    ready: (body) => isFlociReady(body, readyService),
+    upstream: { repo: "floci-io/floci" },
+    settingsPrefix: "FLOCI_",
+});
+/** The Floci emulator spec — the aws plugin's `emulator` capability (#920). */
+export const FLOCI_SPEC = flociSpecFor(DEFAULT_READY_SERVICE);
+/** The aws plugin's emulator capability (#920): Floci + the AWS env that points
+ * the SDK / `chant graph --live` / a triggered Op at it. */
+export const FLOCI_EMULATOR = {
+    spec: FLOCI_SPEC,
+    env: (endpoint) => ({
+        AWS_ENDPOINT_URL: endpoint,
+        AWS_ACCESS_KEY_ID: "test",
+        AWS_SECRET_ACCESS_KEY: "test",
+        AWS_REGION: DEFAULT_REGION,
+    }),
+};
+const flociFor = (readyService) => emulatorLifecycle(flociSpecFor(readyService));
+const builders = flociFor(DEFAULT_READY_SERVICE);
+export const flociExistsCommand = builders.existsCommand;
+export const flociRmCommand = builders.rmCommand;
+export const flociHealthUrl = builders.healthUrl;
+/** Build the `docker run` command that boots Floci. */
+export function flociRunCommand(args = {}) {
+    return builders.runCommand({
+        name: args.name,
+        port: args.port,
+        image: args.image,
+        network: args.network,
+        settings: args.settings,
+        loopback: args.loopback,
+        extraArgs: args.dockerSocket ? [...DOCKER_SOCK] : [],
+    });
+}
+/**
+ * Boot a local Floci AWS emulator in Docker and point subsequent steps at it.
+ *
+ * Idempotent: reuses a running container of the same name. Waits for the health
+ * endpoint to report `readyService`, then sets `AWS_ENDPOINT_URL` + test creds in
+ * the process environment so a following `nativeApply`/`cfn-deploy` targets the
+ * emulator. Env injection works because the local executor runs every step of a
+ * run in this process; a step that runs anywhere else needs the endpoint passed
+ * to it explicitly.
+ */
+export async function flociUp(args = {}, signal) {
+    const region = args.region ?? DEFAULT_REGION;
+    const service = args.readyService ?? DEFAULT_READY_SERVICE;
+    const { endpoint } = await flociFor(service).up({
+        name: args.name,
+        port: args.port,
+        image: args.image,
+        network: args.network,
+        settings: args.settings,
+        loopback: args.loopback,
+        timeoutMs: args.timeoutMs,
+        intervalMs: args.intervalMs,
+        extraArgs: args.dockerSocket ? [...DOCKER_SOCK] : [],
+    }, signal);
+    Object.assign(process.env, flociEnv(args.port ?? DEFAULT_PORT, region));
+    return { endpoint };
+}
+/** Stop and remove the local Floci emulator container (no-op if already gone). */
+export async function flociDown(args = {}, signal) {
+    return builders.down(args, signal);
+}

package/dist/op/activities/index.js

@@ -0,0 +1,32 @@
+/**
+ * AWS Op activities — resolved by the core activity registry when a project's
+ * `chant.config.ts` lists the `aws` lexicon. Contributes the local Floci AWS
+ * emulator lifecycle (`flociUp`/`flociDown`) and the native CloudFormation
+ * applier (`awsApply`, with `awsDelete` and the `rollbackStack` compensation),
+ * which calls the CloudFormation API directly rather than shelling `aws` — the
+ * direct twin of `azApply`/`gcpApply`.
+ *
+ * The registry keys every exported *function* here by its name, so only the
+ * activities themselves belong in this barrel. `awsAgentCoreFetchTrace`'s
+ * helpers — the normalizer, the JSON coercion, the `ListEvents` walk — stay
+ * importable from `@intentius/chant-lexicon-aws/agentcore/trace-fetch` rather
+ * than being registered as activities nobody would ever name in a step, and the
+ * pure renderer lives one module further out again, in
+ * `@intentius/chant-lexicon-aws/agentcore/trace-render`.
+ */
+export { flociUp, flociDown, flociRunCommand, flociRmCommand, flociExistsCommand, flociHealthUrl, flociEnv, isFlociReady, } from "./floci.js";
+export { awsApply, awsDelete, rollbackStack, waitForStackSettled, cfnUrl, cfnForm, capabilityParams, xmlField, stackStatus, stackId, cfnErrorMessage, isStackMissing, isNoUpdates, isSuccessStatus, isFailureStatus, isTerminalStatus, } from "./aws-apply.js";
+// Effect-receipt activities (#1835) — core's receipt seam (#1834) bound to
+// the SSM store, the way the k8s lexicon binds `ensureSecret` (#1830). The
+// registry keys exported functions by name, so the three bound activities are
+// re-exported individually: `receiptRead`/`receiptWrite` serve the `effect()`
+// step's read-compare-run-write, `receiptStaleness` serves WatchOp's
+// read-only phase. The store resolves its path identity and endpoint lazily
+// at first use, so this module stays cheap to load.
+import { receiptActivities } from "@intentius/chant/op/receipt-store";
+import { awsReceiptStore } from "../../receipt-store.js";
+const boundReceiptActivities = receiptActivities(awsReceiptStore());
+export const receiptRead = boundReceiptActivities.receiptRead;
+export const receiptWrite = boundReceiptActivities.receiptWrite;
+export const receiptStaleness = boundReceiptActivities.receiptStaleness;
+export { awsAgentCoreFetchTrace } from "../../agentcore/trace-fetch.js";

package/dist/op/builders.js

@@ -0,0 +1,50 @@
+/**
+ * Typed step-builder wrappers for this lexicon's activities (chant #1288
+ * Stage 2). See `lexicons/k8s/src/op/builders.ts`'s module doc for why these
+ * live beside their `*Args` interfaces rather than in core: core cannot
+ * import a lexicon's types (lexicons depend on core, not the reverse), so a
+ * wrapper whose `opts` IS the activity's own `*Args` interface can only sit
+ * in the lexicon that declares that interface. `opts`'s type in
+ * each wrapper below IS the activity's own `*Args` interface (via
+ * `Omit`/`WithStepRefs`) — never restated. `core`'s own
+ * `awsApply`/`awsDelete`/`flociUp`/`flociDown` are unchanged and produce
+ * byte-identical `ActivityStep` output; these are purely additive.
+ */
+import { activity, takeProfileAndId, } from "@intentius/chant/op";
+/**
+ * Deploy a built CloudFormation template directly against the CFN API — the
+ * fully typed twin of core's `awsApply`. `opts` is {@link AwsApplyArgs}
+ * itself, minus the positional `templatePath`. Defaults to the `longInfra`
+ * profile.
+ */
+export const awsApply = (templatePath, opts) => {
+    const { args, profile, id } = takeProfileAndId(opts);
+    return activity("awsApply", { templatePath, ...args }, { profile: profile ?? "longInfra", ...(id ? { id } : {}) });
+};
+/**
+ * Delete a CloudFormation stack — the inverse of {@link awsApply}, fully
+ * typed twin of core's `awsDelete`. `opts` is {@link AwsDeleteArgs} itself,
+ * minus the positional `templatePath`. Defaults to the `longInfra` profile.
+ */
+export const awsDelete = (templatePath, opts) => {
+    const { args, profile, id } = takeProfileAndId(opts);
+    return activity("awsDelete", { templatePath, ...args }, { profile: profile ?? "longInfra", ...(id ? { id } : {}) });
+};
+/**
+ * Boot the local Floci AWS emulator — the fully typed twin of core's
+ * `flociUp`. `opts` is {@link FlociUpArgs} itself. Defaults to the
+ * `longInfra` profile.
+ */
+export const flociUp = (opts) => {
+    const { args, profile, id } = takeProfileAndId(opts);
+    return activity("flociUp", args, { profile: profile ?? "longInfra", ...(id ? { id } : {}) });
+};
+/**
+ * Stop and remove the local Floci emulator container — the fully typed twin
+ * of core's `flociDown`. `opts` is {@link FlociDownArgs} itself. Defaults to
+ * the `fastIdempotent` profile.
+ */
+export const flociDown = (opts) => {
+    const { args, profile, id } = takeProfileAndId(opts);
+    return activity("flociDown", args, { profile: profile ?? "fastIdempotent", ...(id ? { id } : {}) });
+};

package/dist/ownership.js

@@ -0,0 +1,52 @@
+/**
+ * The aws lexicon's ownership tag convention. AWS tag keys allow `:`, so
+ * chant's markers use the `chant:<name>` form (distinct from the label-based
+ * convention core keeps for k8s/gcp). Core owns the generic stamp/detect logic
+ * (@intentius/chant/ownership); this is the aws-specific key naming it stamps.
+ */
+/** AWS tag keys for chant's ownership markers. */
+export const AWS_TAG_OWNERSHIP_KEYS = {
+    managedBy: "chant:managed-by",
+    stack: "chant:stack",
+    env: "chant:env",
+};
+/**
+ * Template-level `Metadata` key the serializer stamps the ownership marker
+ * under (#1222). Stack-level teardown verifies ownership on the *stack's own*
+ * tags, and CloudFormation stack tags are an API parameter, not a template
+ * section — so the template carries the marker here and the apply paths
+ * (`awsApply`, the `cfn-deploy` change set) turn it into stack tags on
+ * create/update. One source: the same build that stamps resource tags decides
+ * the stack tags.
+ */
+export const OWNERSHIP_METADATA_KEY = "chant:ownership";
+/**
+ * The stack tags a template body asks for: the flat tag map under
+ * `Metadata["chant:ownership"]`, or nothing. Total on bad input — a body that
+ * is not JSON (a YAML template, a handwritten one) or carries no marker
+ * returns `{}`, and the stack simply stays untagged, which teardown reports
+ * as unverified rather than deleting.
+ */
+export function ownershipStackTagsForBody(body) {
+    let template;
+    try {
+        template = JSON.parse(body);
+    }
+    catch {
+        return {};
+    }
+    if (typeof template !== "object" || template === null)
+        return {};
+    const metadata = template.Metadata;
+    if (typeof metadata !== "object" || metadata === null)
+        return {};
+    const marker = metadata[OWNERSHIP_METADATA_KEY];
+    if (typeof marker !== "object" || marker === null)
+        return {};
+    const tags = {};
+    for (const [key, value] of Object.entries(marker)) {
+        if (typeof value === "string")
+            tags[key] = value;
+    }
+    return tags;
+}

package/dist/package-cli.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env tsx
+/**
+ * Thin entry point for `npm run bundle` in lexicon-aws.
+ * Generates src/generated/ files and writes dist/ bundle.
+ *
+ * NOTE: Does NOT call plugin.package() because that internally spawns
+ * `npm pack`, which would cause infinite recursion when invoked
+ * from a prepack lifecycle script.
+ */
+import { generate, writeGeneratedFiles } from "./codegen/generate.js";
+import { packageLexicon } from "./codegen/package.js";
+import { writeBundleSpec } from "@intentius/chant/codegen/package";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+// 1. Generate src/generated/ files
+const genResult = await generate({ verbose: true });
+writeGeneratedFiles(genResult, pkgDir);
+console.error(`Generated ${genResult.resources} resources, ${genResult.properties} property types, ${genResult.enums} enums`);
+// 2. Run package pipeline and write dist/
+const { spec, stats } = await packageLexicon({ verbose: true });
+const distDir = join(pkgDir, "dist");
+writeBundleSpec(spec, distDir);
+console.error(`Packaged ${stats.resources} resources, ${stats.ruleCount} rules, ${stats.skillCount} skills`);
+console.error(`dist/ written to ${distDir}`);

package/dist/parameter.js

@@ -0,0 +1,19 @@
+var _a;
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+export class Parameter {
+    constructor(type, options) {
+        this[_a] = true;
+        this.lexicon = "aws";
+        this.entityType = "AWS::CloudFormation::Parameter";
+        this.parameterType = type;
+        this.description = options?.description;
+        this.defaultValue = options?.defaultValue;
+        if (options) {
+            const { description: _d, defaultValue: _v, ...constraints } = options;
+            const set = Object.entries(constraints).filter(([, v]) => v !== undefined);
+            if (set.length > 0)
+                this.constraints = Object.fromEntries(set);
+        }
+    }
+}
+_a = DECLARABLE_MARKER;

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAqQ,MAAM,0BAA0B,CAAC;AAuCjU;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aAujCvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAqQ,MAAM,0BAA0B,CAAC;AAwCjU;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aA+jCvB,CAAC"}