@intentius/chant-lexicon-aws 0.124.45 → 0.124.48

package/dist/capabilities/mapping.json

@@ -0,0 +1,150 @@
+{
+    "lexicon": "aws",
+    "types": "kind",
+    "refs": "cloudformation",
+    "labels": {
+        "AWS::EC2::VPC": "Vpc",
+        "AWS::EC2::NetworkInterface": "NetworkInterface",
+        "AWS::EC2::Volume": "Volume",
+        "AWS::Lambda::Function": "Function",
+        "AWS::Lambda::Url": "FunctionUrl",
+        "AWS::IAM::InstanceProfile": "InstanceProfile",
+        "AWS::IAM::Role": "Role",
+        "AWS::IAM::Policy": "Policy",
+        "AWS::IAM::ManagedPolicy": "Policy",
+        "AWS::S3::BucketPolicy": "ResourcePolicy",
+        "AWS::SQS::QueuePolicy": "ResourcePolicy",
+        "AWS::S3::Bucket": "Bucket",
+        "AWS::DynamoDB::Table": "Table",
+        "AWS::DynamoDB::GlobalTable": "Table",
+        "AWS::RDS::DBInstance": "Database",
+        "AWS::RDS::DBCluster": "Database",
+        "AWS::SecretsManager::Secret": "Secret",
+        "AWS::SQS::Queue": "Queue",
+        "AWS::EFS::FileSystem": "FileSystem",
+        "AWS::SSM::Parameter": "Parameter",
+        "AWS::ECS::Service": "Service",
+        "AWS::ECS::TaskDefinition": "TaskDefinition",
+        "AWS::RDS::DBSubnetGroup": "SubnetGroup",
+        "AWS::EC2::NatGateway": "NatGateway",
+        "AWS::ElasticLoadBalancingV2::LoadBalancer": "LoadBalancer"
+    },
+    "edges": {
+        "Instance": {
+            "IamInstanceProfile": "profile",
+            "VpcId": "vpc"
+        },
+        "LaunchTemplate": {
+            "LaunchTemplateData": {
+                "InstanceProfile": "profile"
+            }
+        },
+        "Subnet": {
+            "VpcId": "vpc"
+        },
+        "SecurityGroup": {
+            "VpcId": "vpc"
+        },
+        "NetworkInterface": {
+            "SubnetId": "subnet",
+            "GroupSet": "sg"
+        },
+        "Database": {
+            "VPCSecurityGroups": "sg",
+            "VpcSecurityGroupIds": "sg",
+            "DBSubnetGroupName": "subnetGroup"
+        },
+        "Function": {
+            "Role": "role",
+            "VpcConfig": {
+                "SecurityGroup": "sg",
+                "Subnet": "subnet"
+            }
+        },
+        "FunctionUrl": {
+            "TargetFunctionArn": "function"
+        },
+        "InstanceProfile": {
+            "Roles": "role"
+        },
+        "Policy": {
+            "Roles": "attachedTo"
+        },
+        "Role": {
+            "ManagedPolicyArns": "-attachedTo"
+        },
+        "ResourcePolicy": {
+            "Bucket": "policyOf",
+            "Queues": "policyOf"
+        },
+        "Service": {
+            "TaskDefinition": "task",
+            "NetworkConfiguration": {
+                "SecurityGroup": "sg",
+                "Subnet": "subnet"
+            }
+        },
+        "TaskDefinition": {
+            "TaskRoleArn": "role"
+        },
+        "SubnetGroup": {
+            "SubnetIds": "subnet"
+        },
+        "NatGateway": {
+            "SubnetId": "subnet"
+        },
+        "LoadBalancer": {
+            "Subnets": "subnet",
+            "SecurityGroups": "sg"
+        }
+    },
+    "attrs": {
+        "FunctionUrl": {
+            "authType": "AuthType"
+        },
+        "Role": {
+            "name": "RoleName"
+        },
+        "Bucket": {
+            "name": "BucketName",
+            "acl": "AccessControl",
+            "blockPublicPolicy": "PublicAccessBlockConfiguration.BlockPublicPolicy"
+        },
+        "Table": {
+            "name": "TableName"
+        },
+        "Database": {
+            "encrypted": "StorageEncrypted"
+        },
+        "FileSystem": {
+            "encrypted": "Encrypted"
+        },
+        "Volume": {
+            "encrypted": "Encrypted"
+        },
+        "Parameter": {
+            "paramType": "Type"
+        },
+        "Vpc": {
+            "isDefault": "IsDefault"
+        }
+    },
+    "documents": {
+        "Role": {
+            "AssumeRolePolicyDocument": "trust",
+            "Policies[].PolicyDocument": "permission"
+        },
+        "Policy": {
+            "PolicyDocument": "permission"
+        },
+        "ResourcePolicy": {
+            "PolicyDocument": "resource"
+        }
+    },
+    "tags": [
+        "Tags"
+    ],
+    "classificationTags": [
+        "data-classification"
+    ]
+}

package/dist/capabilities/pack.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The aws lexicon's capability pack (#4375): its mapping of CloudFormation
+ * kinds onto the lexicon-neutral view the capability rules read. All data;
+ * CloudFormation policy documents are JSON already, so no adapter code.
+ */
+import type { CapabilityPack } from "@intentius/chant/capabilities/view";
+export declare const awsCapabilityPack: CapabilityPack;
+//# sourceMappingURL=pack.d.ts.map

package/dist/capabilities/pack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack.d.ts","sourceRoot":"","sources":["../../src/capabilities/pack.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAqB,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAG5F,eAAO,MAAM,iBAAiB,EAAE,cAA0D,CAAC"}

package/dist/capabilities/pack.js

@@ -0,0 +1,2 @@
+import mapping from "./mapping.json" with { type: "json" };
+export const awsCapabilityPack = { mapping: mapping };

package/dist/components/capability-plugin.d.ts

@@ -11,7 +11,7 @@ import { type CapabilityPlugin } from "@intentius/chant/components/capability-pl
 /** The AWS verb families this plugin contributes, grouped for `families()` — mirrors core's `STARTER_VERB_FAMILIES` shape. */
 export declare const AWS_VERB_FAMILIES: {
     readonly sbom: readonly ["extract-config-bom"];
-    readonly publish: readonly ["publish-image", "load-image-on-host", "publish-artifact"];
+    readonly publish: readonly ["load-image-on-host"];
     readonly apply: readonly ["cfn-deploy", "ecs-update-service", "lambda-deploy", "s3-sync", "cdn-invalidate", "run-migration"];
     readonly jobSubmission: readonly ["emr-start-job-run", "emr-submit-step"];
     readonly hostDelivery: readonly ["code-deploy", "copy-to-host", "remote-exec"];

package/dist/components/capability-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAiBzG,8HAA8H;AAC9H,eAAO,MAAM,iBAAiB;aAE5B,IAAI,YAAG,oBAAoB;aAC3B,OAAO,YAAG,eAAe,EAAE,oBAAoB,EAAE,kBAAkB;aACnE,KAAK,YAAG,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe;aACzG,aAAa,YAAG,mBAAmB,EAAE,iBAAiB;aACtD,YAAY,YAAG,aAAa,EAAE,cAAc,EAAE,aAAa;aAC3D,UAAU,YAAG,gBAAgB,EAAE,mBAAmB,EAAE,UAAU;aAC9D,MAAM,YAAG,iBAAiB,EAAE,mBAAmB;CACvC,CAAC;AA4BX,yHAAyH;AACzH,eAAO,MAAM,mBAAmB,EAAE,gBAWjC,CAAC"}
+{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAiBzG,8HAA8H;AAC9H,eAAO,MAAM,iBAAiB;aAE5B,IAAI,YAAG,oBAAoB;aAG3B,OAAO,YAAG,oBAAoB;aAC9B,KAAK,YAAG,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe;aACzG,aAAa,YAAG,mBAAmB,EAAE,iBAAiB;aACtD,YAAY,YAAG,aAAa,EAAE,cAAc,EAAE,aAAa;aAC3D,UAAU,YAAG,gBAAgB,EAAE,mBAAmB,EAAE,UAAU;aAC9D,MAAM,YAAG,iBAAiB,EAAE,mBAAmB;CACvC,CAAC;AA0BX,yHAAyH;AACzH,eAAO,MAAM,mBAAmB,EAAE,gBAajC,CAAC"}

package/dist/components/capability-plugin.js

@@ -8,7 +8,7 @@
  * set carries only the agnostic verbs; the cloud leaves live here.
  */
 import { ownPackageVersion } from "@intentius/chant/components/capability-plugin";
-import { publishImageCapability, loadImageOnHostCapability, publishArtifactCapability } from "./publish.js";
+import { ecrRegistryBackend, s3StorageBackend, loadImageOnHostCapability } from "./publish.js";
 import { extractConfigBomCapability } from "./config-bom.js";
 import { cfnDeployCapability, ecsUpdateServiceCapability, lambdaDeployCapability, s3SyncCapability, cdnInvalidateCapability, runMigrationCapability, } from "./apply.js";
 import { emrStartJobRunCapability, emrSubmitStepCapability } from "./job-submission.js";
@@ -19,7 +19,9 @@ import { snapshotBeforeCapability, rollbackPreviousCapability } from "./safety.j
 export const AWS_VERB_FAMILIES = {
     // `extract-config-bom` parses a synthesized CloudFormation template (#684).
     sbom: ["extract-config-bom"],
-    publish: ["publish-image", "load-image-on-host", "publish-artifact"],
+    // `publish-image` is core's verb (#3142, #3143); aws contributes its ECR login as a registry backend.
+    // `publish-artifact` is core's verb (#4408); aws contributes S3 as a storage backend.
+    publish: ["load-image-on-host"],
     apply: ["cfn-deploy", "ecs-update-service", "lambda-deploy", "s3-sync", "cdn-invalidate", "run-migration"],
     jobSubmission: ["emr-start-job-run", "emr-submit-step"],
     hostDelivery: ["code-deploy", "copy-to-host", "remote-exec"],
@@ -30,9 +32,7 @@ export const AWS_VERB_FAMILIES = {
 function awsCapabilities() {
     return [
         extractConfigBomCapability,
-        publishImageCapability,
         loadImageOnHostCapability,
-        publishArtifactCapability,
         cfnDeployCapability,
         ecsUpdateServiceCapability,
         lambdaDeployCapability,
@@ -62,5 +62,7 @@ export const awsCapabilityPlugin = {
         return ownPackageVersion(import.meta.url);
     },
     capabilities: awsCapabilities,
+    registryBackends: () => [ecrRegistryBackend],
+    storageBackends: () => [s3StorageBackend],
     families: () => AWS_VERB_FAMILIES,
 };

package/dist/components/publish.d.ts

@@ -47,89 +47,25 @@
 import type { Capability } from "@intentius/chant/components/capability";
 import { type CloudExecutor } from "./cloud-executor.js";
 import { type ProcessRunner } from "@intentius/chant/components/verbs/process-runner";
+import { type PublishImageBackend, type RegistryLoginBackend } from "@intentius/chant/components/verbs/publish-image";
+import { type ArtifactStorageBackend, type PublishArtifactInput, type PublishArtifactOutput } from "@intentius/chant/components/verbs/publish-artifact";
+export type { PublishImageInput, PublishImageOutput, PublishImageBackend, ReferrerAttachResult, } from "@intentius/chant/components/verbs/publish-image";
 /**
- * Common input shape both image-publish backends accept: promote the image
- * bytes at archive path `from` to wherever the deploy target can consume
- * them. `to` (registry) and `host` (bare host) are each meaningful to only
- * one backend, so a component authors one step shape (see
- * docs/components/build-archive.mdx) and the env-selected backend (see
- * `selectPublishBackend` below) reads whichever field it needs — the
- * unselected backend's field is simply unused, never a pipeline fork.
+ * The aws lexicon's registry login for core's `publish-image` (#3142, #3143):
+ * `aws ecr get-login-password | docker login`. The aws plugin contributes it;
+ * core owns load, tag, push and the digest read-back.
  */
-export interface PublishImageInput {
-    /** Path of the image tarball inside the build archive (as produced by `docker-build`; an `archive:`-prefixed reference is accepted and stripped). */
-    from: string;
-    /** Destination registry — required by `publish-image`, ignored by `load-image-on-host` (e.g. `$env.registry` resolved by the orchestrator). */
-    to?: string;
-    /** Target host — required by `load-image-on-host`, ignored by `publish-image` (SSM instance id, hostname, or host group). */
-    host?: string;
-    /** Destination path for the tarball on the host, used only by `load-image-on-host`. Default: `/tmp/chant-archive/<basename of from>`. */
-    hostPath?: string;
-    /** Additional tags to apply alongside the digest, used only by `publish-image`. */
-    tags?: string[];
-    /**
-     * #610: the artifact's software SBOM (typically wired from a prior
-     * `generate-sbom` step's `sbom` output — see ./sbom.ts's
-     * `GenerateSbomOutput`) to attach as an OCI referrer on the pushed image
-     * digest, via `oras attach`. Used only by `publish-image`; ignored by
-     * `load-image-on-host` (registry-less — nothing to attach to). Omit to
-     * skip the attach step entirely (the archive-carried copy remains the
-     * SBOM's home either way).
-     */
-    sbom?: {
-        bytes: string;
-        mediaType: string;
-    };
-    /**
-     * #610: the component-level aggregate BOM (wired from
-     * ./component-bom.ts's `aggregateComponentBom` output), attached as a
-     * second OCI referrer alongside `sbom` when supplied. Optional and
-     * independent of `sbom` — a caller may attach either, both, or neither.
-     */
-    componentBom?: {
-        bytes: string;
-        mediaType: string;
-    };
-}
-/** Result of `publish-image`'s best-effort OCI-referrer attach step (#610) — always present when `input.sbom`/`input.componentBom` was supplied, `undefined` when neither was (nothing to attach, attach step skipped entirely). */
-export interface ReferrerAttachResult {
-    /** True once every requested attach (`sbom`, `componentBom`) succeeded. `false` if `oras` was unavailable or any `oras attach` invocation failed. */
-    attached: boolean;
-    /** Human-readable reason `attached` is `false` (e.g. "oras is not installed"), omitted when `attached` is `true`. */
-    reason?: string;
-}
-export interface PublishImageOutput {
-    /** Content-addressed digest of the promoted image (`sha256:...`) — what the apply step references. */
-    digest: string;
-    /** Image reference the apply step can pull/run: `registry/repo@sha256:...` for `publish-image`, a host-local reference for `load-image-on-host`. */
-    uri: string;
-    /** #610: outcome of the best-effort SBOM/component-BOM referrer attach, when `input.sbom`/`input.componentBom` was supplied. `undefined` for `load-image-on-host` (no attach concept — registry-less) and for `publish-image` calls that supplied neither. */
-    referrerAttach?: ReferrerAttachResult;
-}
+export declare function createEcrRegistryBackend(executor?: CloudExecutor): RegistryLoginBackend;
+/** The ECR backend the aws plugin contributes, over the real `CloudExecutor`. */
+export declare const ecrRegistryBackend: RegistryLoginBackend;
 /**
- * Common shape both image-publish backends satisfy: promote the image bytes
- * held in the build archive to wherever the deploy target can consume them,
- * and return the identity the apply step references. The backend is
- * selected per environment (`selectPublishBackend`), never per component.
- */
-export type PublishImageBackend = Capability<PublishImageInput, PublishImageOutput>;
-/**
- * Promote a built image from the archive into the environment's container
- * registry: `docker load` the archived tarball, tag it for `to` (the env
- * registry), `aws ecr get-login-password | docker login`, then `docker push`.
- * Returns the pushed image's registry digest — what `cfn-deploy`/
- * `ecs-update-service` reference via `imageRef: "@Publish.digest"`. No
- * rollback: an already-pushed, still-valid image in the registry is not
- * itself a problem to compensate (immutable, content-addressed, and simply
- * unreferenced if a later step fails) — the opt-out this capability takes.
- *
- * #610: when `input.sbom` and/or `input.componentBom` are supplied, also
- * attaches them as OCI referrers on the pushed digest via `oras attach` (see
- * `attachReferrers` above) — best-effort, guarded on `oras` availability,
- * surfaced on the output's `referrerAttach` rather than failing the publish.
+ * `publish-image` with ECR as its only login backend: core's verb, bound to
+ * this executor. Kept so aws-only callers and tests build it the way they
+ * always did; behaviour is unchanged (load, tag, ECR login, push, optional
+ * referrer attach).
  */
 export declare function createPublishImageCapability(executor?: CloudExecutor, processRunner?: ProcessRunner): PublishImageBackend;
-/** Default `publish-image` capability, backed by the real `CloudExecutor`. */
+/** `publish-image` bound to the real executor; the registered verb is core's, with this lexicon's ECR backend injected. */
 export declare const publishImageCapability: PublishImageBackend;
 /**
  * Copy the image tarball straight onto a host and `docker load` it there —
@@ -167,28 +103,23 @@ export type PublishImageBackendKind = "publish-image" | "load-image-on-host";
  * backends built above.
  */
 export declare function selectPublishBackend(kind: PublishImageBackendKind, backends?: Partial<Record<PublishImageBackendKind, PublishImageBackend>>): PublishImageBackend;
-export interface PublishArtifactInput {
-    /** Path of the artifact inside the build archive (e.g. a jar or zip). */
-    from: string;
-    /** Destination (e.g. `$env.s3` resolved by the orchestrator). */
-    to: string;
-}
-export interface PublishArtifactOutput {
-    /** Location the artifact was published to — referenced downstream as `@<component>.publish.uri`. */
-    uri: string;
-    /** Content hash of the published artifact. */
-    digest: string;
-}
-/** Promote a non-image artifact (jar, zip, arbitrary asset) from the archive to S3/CodeArtifact. */
+export type { PublishArtifactInput, PublishArtifactOutput } from "@intentius/chant/components/verbs/publish-artifact";
+/**
+ * The aws lexicon's storage backend for core's `publish-artifact`: `aws s3 cp`
+ * (endpoint-aware through the `CloudExecutor`). Core owns the digest and the
+ * object URI; this only uploads.
+ */
+export declare function createS3StorageBackend(executor?: CloudExecutor): ArtifactStorageBackend;
+/** The S3 backend the aws plugin contributes, over the real `CloudExecutor`. */
+export declare const s3StorageBackend: ArtifactStorageBackend;
 /**
- * Publish a single archive artifact (a jar, zip, or asset) to S3 via `aws s3 cp`
- * (endpoint-aware through the `CloudExecutor`). Returns the object's URI —
- * referenced downstream as `@<component>.publish.uri` — and a content digest of
- * the exact bytes uploaded.
+ * `publish-artifact` with S3 as its only storage backend: core's verb, bound
+ * to this executor. Kept so aws-only callers and tests build it the way they
+ * always did; behaviour is unchanged (upload, return uri + content digest).
  */
 export declare function createPublishArtifactCapability(executor?: CloudExecutor): Capability<PublishArtifactInput, PublishArtifactOutput>;
-/** Default `publish-artifact` capability, backed by the real `CloudExecutor`. */
+/** Default `publish-artifact`, bound to the real executor; the registered verb is core's, with this lexicon's S3 backend injected. */
 export declare const publishArtifactCapability: Capability<PublishArtifactInput, PublishArtifactOutput>;
-/** Alias for `publish-artifact` — same capability, the docs/epic use both names for the same verb. */
+/** Alias for `publish-artifact`: same capability, the docs/epic use both names for the same verb. */
 export declare const publishAssetCapability: Capability<PublishArtifactInput, PublishArtifactOutput>;
 //# sourceMappingURL=publish.d.ts.map

package/dist/components/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/components/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAGzE,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,kDAAkD,CAAC;AAI/G;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,qJAAqJ;IACrJ,IAAI,EAAE,MAAM,CAAC;IACb,+IAA+I;IAC/I,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,6HAA6H;IAC7H,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yIAAyI;IACzI,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;;;;;OAKG;IACH,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED,oOAAoO;AACpO,MAAM,WAAW,oBAAoB;IACnC,qJAAqJ;IACrJ,QAAQ,EAAE,OAAO,CAAC;IAClB,qHAAqH;IACrH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,sGAAsG;IACtG,MAAM,EAAE,MAAM,CAAC;IACf,oJAAoJ;IACpJ,GAAG,EAAE,MAAM,CAAC;IACZ,8PAA8P;IAC9P,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;AA4DpF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,GAAE,aAAsC,EAChD,aAAa,GAAE,aAAsC,GACpD,mBAAmB,CAgCrB;AAED,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,EAAE,mBAAoD,CAAC;AAU1F;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,GAAE,aAAsC,GAC/C,mBAAmB,CAYrB;AAED,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,EAAE,mBAAuD,CAAC;AAIhG,wGAAwG;AACxG,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,uBAAuB,EAC7B,QAAQ,GAAE,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,CAGrE,GACA,mBAAmB,CAQrB;AAID,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,qBAAqB;IACpC,oGAAoG;IACpG,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oGAAoG;AACpG;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,GAAE,aAAsC,GAC/C,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAYzD;AAED,iFAAiF;AACjF,eAAO,MAAM,yBAAyB,EAAE,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAC3D,CAAC;AAEpC,sGAAsG;AACtG,eAAO,MAAM,sBAAsB,yDAA4B,CAAC"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/components/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,kDAAkD,CAAC;AAC5G,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,oDAAoD,CAAC;AAI5D,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,iDAAiD,CAAC;AAIzD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,oBAAoB,CAOvF;AAED,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,EAAE,oBAAiD,CAAC;AAEnF;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,GAAE,aAAsC,EAChD,aAAa,GAAE,aAAsC,GACpD,mBAAmB,CAErB;AAED,2HAA2H;AAC3H,eAAO,MAAM,sBAAsB,EAAE,mBAAoD,CAAC;AAU1F;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,GAAE,aAAsC,GAC/C,mBAAmB,CAYrB;AAED,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,EAAE,mBAAuD,CAAC;AAIhG,wGAAwG;AACxG,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,uBAAuB,EAC7B,QAAQ,GAAE,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,CAGrE,GACA,mBAAmB,CAQrB;AAID,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oDAAoD,CAAC;AAEtH;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,sBAAsB,CAOvF;AAED,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,EAAE,sBAAiD,CAAC;AAEjF;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,GAAE,aAAsC,GAC/C,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAEzD;AAED,sIAAsI;AACtI,eAAO,MAAM,yBAAyB,EAAE,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAC3D,CAAC;AAEpC,qGAAqG;AACrG,eAAO,MAAM,sBAAsB,yDAA4B,CAAC"}

package/dist/components/publish.js

@@ -44,107 +44,37 @@
  * image is already successfully promoted by the time this step runs — the
  * one part of this capability that is genuinely best-effort.
  */
-import { readFileSync } from "node:fs";
-import { createHash } from "node:crypto";
 import { defaultCloudExecutor } from "./cloud-executor.js";
 import { archiveRelativePath } from "@intentius/chant/components/verbs/build-archive";
-import { defaultProcessRunner, q } from "@intentius/chant/components/verbs/process-runner";
-// ── publish-image (registry backend) ────────────────────────────────────────
+import { defaultProcessRunner } from "@intentius/chant/components/verbs/process-runner";
+import { createPublishImageCapability as createCorePublishImage, } from "@intentius/chant/components/verbs/publish-image";
+import { createPublishArtifactCapability as createCorePublishArtifact, } from "@intentius/chant/components/verbs/publish-artifact";
+// ── publish-image: the ECR backend (the verb itself is core's) ──────────────
 /**
- * Attempt to `oras attach` one referrer document (SBOM or component BOM) to
- * `imageRef`'s digest. Writes the document's bytes to a scratch file (`oras
- * attach` reads from a file path, not stdin) and shells out through
- * `runner`. Never throws — a failure here is reported back to the caller as
- * `{ ok: false, reason }` so a missing/erroring `oras` never fails the
- * publish itself (see `attachReferrers`'s doc comment for why).
+ * The aws lexicon's registry login for core's `publish-image` (#3142, #3143):
+ * `aws ecr get-login-password | docker login`. The aws plugin contributes it;
+ * core owns load, tag, push and the digest read-back.
  */
-async function attachOneReferrer(runner, imageRef, doc, label) {
-    try {
-        const scratchFile = `/tmp/chant-referrer-attach/${label}-${Date.now()}.json`;
-        await runner.run(`mkdir -p ${q("/tmp/chant-referrer-attach")}`);
-        await runner.run(`printf '%s' ${q(doc.bytes)} > ${q(scratchFile)}`);
-        await runner.run(`oras attach --artifact-type ${q(doc.mediaType)} ${q(imageRef)} ${q(scratchFile)}:${q(doc.mediaType)}`);
-        return { ok: true };
-    }
-    catch (err) {
-        return { ok: false, reason: err instanceof Error ? err.message : String(err) };
-    }
-}
-/**
- * Best-effort OCI-referrer attach for a just-pushed image (#610): attaches
- * `input.sbom` and/or `input.componentBom`, when supplied, to `imageRef` via
- * `oras attach`. Guarded on `oras` availability — a missing binary is
- * reported back as `{ attached: false, reason }` rather than thrown, since
- * the image itself is already successfully promoted by the time this step
- * runs (attach is additive registry-side convenience on top of the
- * archive-carried copy, per this module's doc comment, never a condition the
- * core promote-by-digest job depends on). Returns `undefined` when neither
- * `input.sbom` nor `input.componentBom` was supplied — nothing to attach,
- * skipped entirely, no `oras` call at all.
- */
-async function attachReferrers(runner, imageRef, input) {
-    if (!input.sbom && !input.componentBom)
-        return undefined;
-    if (!(await runner.available("oras"))) {
-        return { attached: false, reason: `"oras" is not installed or not on PATH — required to attach OCI referrers` };
-    }
-    const results = [];
-    if (input.sbom)
-        results.push(await attachOneReferrer(runner, imageRef, input.sbom, "sbom"));
-    if (input.componentBom)
-        results.push(await attachOneReferrer(runner, imageRef, input.componentBom, "component-bom"));
-    const failed = results.find((r) => !r.ok);
-    return failed ? { attached: false, reason: failed.reason } : { attached: true };
+export function createEcrRegistryBackend(executor) {
+    return {
+        name: "ecr",
+        matches: (registry) => /\.dkr\.ecr(-fips)?\.[a-z0-9-]+\.amazonaws\.com(\.cn)?$/.test(registry),
+        // The real executor is built on first login, so loading the plugin shells out to nothing.
+        login: (registry) => (executor ?? defaultCloudExecutor()).ecr.login(registry),
+    };
 }
+/** The ECR backend the aws plugin contributes, over the real `CloudExecutor`. */
+export const ecrRegistryBackend = createEcrRegistryBackend();
 /**
- * Promote a built image from the archive into the environment's container
- * registry: `docker load` the archived tarball, tag it for `to` (the env
- * registry), `aws ecr get-login-password | docker login`, then `docker push`.
- * Returns the pushed image's registry digest — what `cfn-deploy`/
- * `ecs-update-service` reference via `imageRef: "@Publish.digest"`. No
- * rollback: an already-pushed, still-valid image in the registry is not
- * itself a problem to compensate (immutable, content-addressed, and simply
- * unreferenced if a later step fails) — the opt-out this capability takes.
- *
- * #610: when `input.sbom` and/or `input.componentBom` are supplied, also
- * attaches them as OCI referrers on the pushed digest via `oras attach` (see
- * `attachReferrers` above) — best-effort, guarded on `oras` availability,
- * surfaced on the output's `referrerAttach` rather than failing the publish.
+ * `publish-image` with ECR as its only login backend: core's verb, bound to
+ * this executor. Kept so aws-only callers and tests build it the way they
+ * always did; behaviour is unchanged (load, tag, ECR login, push, optional
+ * referrer attach).
  */
 export function createPublishImageCapability(executor = defaultCloudExecutor(), processRunner = defaultProcessRunner()) {
-    return {
-        kind: "publish-image",
-        async run(_ctx, input) {
-            if (!input.to)
-                throw new Error(`publish-image "${input.from}": "to" (destination registry) is required`);
-            // `docker load` reports the archived image's local reference — a name:tag
-            // for a tagged build, or an image id. It's a valid `docker tag` source but
-            // never a registry digest, so the promoted digest is read back from the
-            // push below, not constructed from this.
-            const { digest: localRef } = await executor.docker.load({ inFile: archiveRelativePath(input.from) });
-            const repo = input.to.replace(/\/+$/, "");
-            // Publish under a tag: docker can neither tag nor push a digest-qualified
-            // reference (`repo@sha256:...`), so the transport is a tag and the stable
-            // identifier is the digest the push returns.
-            const pushRef = `${repo}:latest`;
-            await executor.docker.tag({ source: localRef, target: pushRef });
-            const registry = repo.split("/")[0];
-            await executor.ecr.login(registry);
-            const { digest: pushed } = await executor.docker.push({ image: pushRef });
-            // Normalize to a bare `sha256:...`, whether the client returned that or a
-            // full `repo@sha256:...` RepoDigest.
-            const digest = pushed.includes("@") ? pushed.slice(pushed.indexOf("@") + 1) : pushed;
-            for (const tag of input.tags ?? []) {
-                const tagged = `${repo}:${tag}`;
-                await executor.docker.tag({ source: localRef, target: tagged });
-                await executor.docker.push({ image: tagged });
-            }
-            const referrerAttach = await attachReferrers(processRunner, `${repo}@${digest}`, input);
-            return { digest, uri: `${repo}@${digest}`, ...(referrerAttach ? { referrerAttach } : {}) };
-        },
-    };
+    return createCorePublishImage({ docker: executor.docker, processRunner, backends: [createEcrRegistryBackend(executor)] });
 }
-/** Default `publish-image` capability, backed by the real `CloudExecutor`. */
+/** `publish-image` bound to the real executor; the registered verb is core's, with this lexicon's ECR backend injected. */
 export const publishImageCapability = createPublishImageCapability();
 // ── load-image-on-host (host backend) ───────────────────────────────────────
 /** Default on-host tarball destination when `hostPath` is omitted, derived from the archive path's basename. */
@@ -208,27 +138,30 @@ export function selectPublishBackend(kind, backends = {
     }
     return backend;
 }
-/** Promote a non-image artifact (jar, zip, arbitrary asset) from the archive to S3/CodeArtifact. */
 /**
- * Publish a single archive artifact (a jar, zip, or asset) to S3 via `aws s3 cp`
- * (endpoint-aware through the `CloudExecutor`). Returns the object's URI —
- * referenced downstream as `@<component>.publish.uri` — and a content digest of
- * the exact bytes uploaded.
+ * The aws lexicon's storage backend for core's `publish-artifact`: `aws s3 cp`
+ * (endpoint-aware through the `CloudExecutor`). Core owns the digest and the
+ * object URI; this only uploads.
  */
-export function createPublishArtifactCapability(executor = defaultCloudExecutor()) {
+export function createS3StorageBackend(executor) {
     return {
-        kind: "publish-artifact",
-        async run(_ctx, input) {
-            const localPath = archiveRelativePath(input.from);
-            const digest = `sha256:${createHash("sha256").update(readFileSync(localPath)).digest("hex")}`;
-            const basename = localPath.split("/").pop() ?? localPath;
-            const uri = input.to.endsWith("/") ? `${input.to}${basename}` : input.to;
-            await executor.s3.cp({ from: localPath, to: uri });
-            return { uri, digest };
-        },
+        name: "s3",
+        matches: (uri) => uri.startsWith("s3://"),
+        // The real executor is built on first upload, so loading the plugin shells out to nothing.
+        upload: (args) => (executor ?? defaultCloudExecutor()).s3.cp(args),
     };
 }
-/** Default `publish-artifact` capability, backed by the real `CloudExecutor`. */
+/** The S3 backend the aws plugin contributes, over the real `CloudExecutor`. */
+export const s3StorageBackend = createS3StorageBackend();
+/**
+ * `publish-artifact` with S3 as its only storage backend: core's verb, bound
+ * to this executor. Kept so aws-only callers and tests build it the way they
+ * always did; behaviour is unchanged (upload, return uri + content digest).
+ */
+export function createPublishArtifactCapability(executor = defaultCloudExecutor()) {
+    return createCorePublishArtifact({ backends: [createS3StorageBackend(executor)] });
+}
+/** Default `publish-artifact`, bound to the real executor; the registered verb is core's, with this lexicon's S3 backend injected. */
 export const publishArtifactCapability = createPublishArtifactCapability();
-/** Alias for `publish-artifact` — same capability, the docs/epic use both names for the same verb. */
+/** Alias for `publish-artifact`: same capability, the docs/epic use both names for the same verb. */
 export const publishAssetCapability = publishArtifactCapability;

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "4e87272580ed7978235350ce2c7631c83b575c7bc765f3c27002e63bc02c18b6",
+    "manifest.json": "6d63402ac557c9c432818176908605ad1bd86ba72ce417b50aa3f283ed473620",
     "meta.json": "6f48557ed4203cbdeafdb47e7270fdf3533f6d6e6189987246301ed8e72170e9",
     "types/index.d.ts": "8651f9ae166668f4311eea1fe61c3fe235f345947951c1d23d1df24a4fd3384f",
     "rules/hardcoded-region.ts": "957eadcaa9f39cc17d21437565d7a94607d9b082cf28918b178fa067f07498a9",
@@ -75,5 +75,5 @@
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "8780b94ce60aded935938d5ef20ea667738354051da1bf9ca6d70d9886f65d21"
   },
-  "composite": "6e6034cc52fcfa710c8daa010fd67a0f510a61a93cf862910a0b85791d67d96f"
+  "composite": "5425340cfa33d03f1d5772e1819704c43dd9c0524249be73bdb021716b180719"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.124.45",
+  "version": "0.124.48",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAqQ,MAAM,0BAA0B,CAAC;AAwCjU;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aA+jCvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAqQ,MAAM,0BAA0B,CAAC;AAwCjU;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aAgkCvB,CAAC"}

package/dist/plugin.js

@@ -2,6 +2,7 @@ import { compositeCatalog } from "./composites/catalog.js";
 import { createRequire } from "module";
 import { awsBehaviourKinds } from "./behaviour-kinds.js";
 import { detectTemplate } from "./detect.js";
+import { awsCapabilityPack } from "./capabilities/pack.js";
 const require = createRequire(moduleSourceUrl(import.meta.url));
 import { discoverLintRules } from "@intentius/chant/lint/discover";
 import { postSynthChecks as postSynthCheckList } from "./lint/post-synth/index.js";
@@ -63,6 +64,7 @@ export const awsPlugin = {
     auditCatalog: () => awsAuditCatalog,
     // Live edge reconstruction for `chant graph --live` (#778).
     referenceCatalog: awsReferenceCatalog,
+    capabilityPack: awsCapabilityPack,
     lintRules() {
         const rulesDir = join(dirname(fileURLToPath(import.meta.url)), "lint", "rules");
         return discoverLintRules(rulesDir, import.meta.url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.124.45",
+  "version": "0.124.48",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,6 +80,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.45"
+    "@intentius/chant": "^0.124.48"
   }
 }