@intentius/chant-lexicon-aws 0.124.46 → 0.124.49

package/dist/components/capability-plugin.d.ts

@@ -11,7 +11,7 @@ import { type CapabilityPlugin } from "@intentius/chant/components/capability-pl
 /** The AWS verb families this plugin contributes, grouped for `families()` — mirrors core's `STARTER_VERB_FAMILIES` shape. */
 export declare const AWS_VERB_FAMILIES: {
     readonly sbom: readonly ["extract-config-bom"];
-    readonly publish: readonly ["publish-image", "load-image-on-host", "publish-artifact"];
+    readonly publish: readonly ["load-image-on-host"];
     readonly apply: readonly ["cfn-deploy", "ecs-update-service", "lambda-deploy", "s3-sync", "cdn-invalidate", "run-migration"];
     readonly jobSubmission: readonly ["emr-start-job-run", "emr-submit-step"];
     readonly hostDelivery: readonly ["code-deploy", "copy-to-host", "remote-exec"];

package/dist/components/capability-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAiBzG,8HAA8H;AAC9H,eAAO,MAAM,iBAAiB;aAE5B,IAAI,YAAG,oBAAoB;aAC3B,OAAO,YAAG,eAAe,EAAE,oBAAoB,EAAE,kBAAkB;aACnE,KAAK,YAAG,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe;aACzG,aAAa,YAAG,mBAAmB,EAAE,iBAAiB;aACtD,YAAY,YAAG,aAAa,EAAE,cAAc,EAAE,aAAa;aAC3D,UAAU,YAAG,gBAAgB,EAAE,mBAAmB,EAAE,UAAU;aAC9D,MAAM,YAAG,iBAAiB,EAAE,mBAAmB;CACvC,CAAC;AA4BX,yHAAyH;AACzH,eAAO,MAAM,mBAAmB,EAAE,gBAWjC,CAAC"}
+{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAiBzG,8HAA8H;AAC9H,eAAO,MAAM,iBAAiB;aAE5B,IAAI,YAAG,oBAAoB;aAG3B,OAAO,YAAG,oBAAoB;aAC9B,KAAK,YAAG,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe;aACzG,aAAa,YAAG,mBAAmB,EAAE,iBAAiB;aACtD,YAAY,YAAG,aAAa,EAAE,cAAc,EAAE,aAAa;aAC3D,UAAU,YAAG,gBAAgB,EAAE,mBAAmB,EAAE,UAAU;aAC9D,MAAM,YAAG,iBAAiB,EAAE,mBAAmB;CACvC,CAAC;AA0BX,yHAAyH;AACzH,eAAO,MAAM,mBAAmB,EAAE,gBAajC,CAAC"}

package/dist/components/capability-plugin.js

@@ -8,7 +8,7 @@
  * set carries only the agnostic verbs; the cloud leaves live here.
  */
 import { ownPackageVersion } from "@intentius/chant/components/capability-plugin";
-import { publishImageCapability, loadImageOnHostCapability, publishArtifactCapability } from "./publish.js";
+import { ecrRegistryBackend, s3StorageBackend, loadImageOnHostCapability } from "./publish.js";
 import { extractConfigBomCapability } from "./config-bom.js";
 import { cfnDeployCapability, ecsUpdateServiceCapability, lambdaDeployCapability, s3SyncCapability, cdnInvalidateCapability, runMigrationCapability, } from "./apply.js";
 import { emrStartJobRunCapability, emrSubmitStepCapability } from "./job-submission.js";
@@ -19,7 +19,9 @@ import { snapshotBeforeCapability, rollbackPreviousCapability } from "./safety.j
 export const AWS_VERB_FAMILIES = {
     // `extract-config-bom` parses a synthesized CloudFormation template (#684).
     sbom: ["extract-config-bom"],
-    publish: ["publish-image", "load-image-on-host", "publish-artifact"],
+    // `publish-image` is core's verb (#3142, #3143); aws contributes its ECR login as a registry backend.
+    // `publish-artifact` is core's verb (#4408); aws contributes S3 as a storage backend.
+    publish: ["load-image-on-host"],
     apply: ["cfn-deploy", "ecs-update-service", "lambda-deploy", "s3-sync", "cdn-invalidate", "run-migration"],
     jobSubmission: ["emr-start-job-run", "emr-submit-step"],
     hostDelivery: ["code-deploy", "copy-to-host", "remote-exec"],
@@ -30,9 +32,7 @@ export const AWS_VERB_FAMILIES = {
 function awsCapabilities() {
     return [
         extractConfigBomCapability,
-        publishImageCapability,
         loadImageOnHostCapability,
-        publishArtifactCapability,
         cfnDeployCapability,
         ecsUpdateServiceCapability,
         lambdaDeployCapability,
@@ -62,5 +62,7 @@ export const awsCapabilityPlugin = {
         return ownPackageVersion(import.meta.url);
     },
     capabilities: awsCapabilities,
+    registryBackends: () => [ecrRegistryBackend],
+    storageBackends: () => [s3StorageBackend],
     families: () => AWS_VERB_FAMILIES,
 };

package/dist/components/publish.d.ts

@@ -47,89 +47,25 @@
 import type { Capability } from "@intentius/chant/components/capability";
 import { type CloudExecutor } from "./cloud-executor.js";
 import { type ProcessRunner } from "@intentius/chant/components/verbs/process-runner";
+import { type PublishImageBackend, type RegistryLoginBackend } from "@intentius/chant/components/verbs/publish-image";
+import { type ArtifactStorageBackend, type PublishArtifactInput, type PublishArtifactOutput } from "@intentius/chant/components/verbs/publish-artifact";
+export type { PublishImageInput, PublishImageOutput, PublishImageBackend, ReferrerAttachResult, } from "@intentius/chant/components/verbs/publish-image";
 /**
- * Common input shape both image-publish backends accept: promote the image
- * bytes at archive path `from` to wherever the deploy target can consume
- * them. `to` (registry) and `host` (bare host) are each meaningful to only
- * one backend, so a component authors one step shape (see
- * docs/components/build-archive.mdx) and the env-selected backend (see
- * `selectPublishBackend` below) reads whichever field it needs — the
- * unselected backend's field is simply unused, never a pipeline fork.
+ * The aws lexicon's registry login for core's `publish-image` (#3142, #3143):
+ * `aws ecr get-login-password | docker login`. The aws plugin contributes it;
+ * core owns load, tag, push and the digest read-back.
  */
-export interface PublishImageInput {
-    /** Path of the image tarball inside the build archive (as produced by `docker-build`; an `archive:`-prefixed reference is accepted and stripped). */
-    from: string;
-    /** Destination registry — required by `publish-image`, ignored by `load-image-on-host` (e.g. `$env.registry` resolved by the orchestrator). */
-    to?: string;
-    /** Target host — required by `load-image-on-host`, ignored by `publish-image` (SSM instance id, hostname, or host group). */
-    host?: string;
-    /** Destination path for the tarball on the host, used only by `load-image-on-host`. Default: `/tmp/chant-archive/<basename of from>`. */
-    hostPath?: string;
-    /** Additional tags to apply alongside the digest, used only by `publish-image`. */
-    tags?: string[];
-    /**
-     * #610: the artifact's software SBOM (typically wired from a prior
-     * `generate-sbom` step's `sbom` output — see ./sbom.ts's
-     * `GenerateSbomOutput`) to attach as an OCI referrer on the pushed image
-     * digest, via `oras attach`. Used only by `publish-image`; ignored by
-     * `load-image-on-host` (registry-less — nothing to attach to). Omit to
-     * skip the attach step entirely (the archive-carried copy remains the
-     * SBOM's home either way).
-     */
-    sbom?: {
-        bytes: string;
-        mediaType: string;
-    };
-    /**
-     * #610: the component-level aggregate BOM (wired from
-     * ./component-bom.ts's `aggregateComponentBom` output), attached as a
-     * second OCI referrer alongside `sbom` when supplied. Optional and
-     * independent of `sbom` — a caller may attach either, both, or neither.
-     */
-    componentBom?: {
-        bytes: string;
-        mediaType: string;
-    };
-}
-/** Result of `publish-image`'s best-effort OCI-referrer attach step (#610) — always present when `input.sbom`/`input.componentBom` was supplied, `undefined` when neither was (nothing to attach, attach step skipped entirely). */
-export interface ReferrerAttachResult {
-    /** True once every requested attach (`sbom`, `componentBom`) succeeded. `false` if `oras` was unavailable or any `oras attach` invocation failed. */
-    attached: boolean;
-    /** Human-readable reason `attached` is `false` (e.g. "oras is not installed"), omitted when `attached` is `true`. */
-    reason?: string;
-}
-export interface PublishImageOutput {
-    /** Content-addressed digest of the promoted image (`sha256:...`) — what the apply step references. */
-    digest: string;
-    /** Image reference the apply step can pull/run: `registry/repo@sha256:...` for `publish-image`, a host-local reference for `load-image-on-host`. */
-    uri: string;
-    /** #610: outcome of the best-effort SBOM/component-BOM referrer attach, when `input.sbom`/`input.componentBom` was supplied. `undefined` for `load-image-on-host` (no attach concept — registry-less) and for `publish-image` calls that supplied neither. */
-    referrerAttach?: ReferrerAttachResult;
-}
+export declare function createEcrRegistryBackend(executor?: CloudExecutor): RegistryLoginBackend;
+/** The ECR backend the aws plugin contributes, over the real `CloudExecutor`. */
+export declare const ecrRegistryBackend: RegistryLoginBackend;
 /**
- * Common shape both image-publish backends satisfy: promote the image bytes
- * held in the build archive to wherever the deploy target can consume them,
- * and return the identity the apply step references. The backend is
- * selected per environment (`selectPublishBackend`), never per component.
- */
-export type PublishImageBackend = Capability<PublishImageInput, PublishImageOutput>;
-/**
- * Promote a built image from the archive into the environment's container
- * registry: `docker load` the archived tarball, tag it for `to` (the env
- * registry), `aws ecr get-login-password | docker login`, then `docker push`.
- * Returns the pushed image's registry digest — what `cfn-deploy`/
- * `ecs-update-service` reference via `imageRef: "@Publish.digest"`. No
- * rollback: an already-pushed, still-valid image in the registry is not
- * itself a problem to compensate (immutable, content-addressed, and simply
- * unreferenced if a later step fails) — the opt-out this capability takes.
- *
- * #610: when `input.sbom` and/or `input.componentBom` are supplied, also
- * attaches them as OCI referrers on the pushed digest via `oras attach` (see
- * `attachReferrers` above) — best-effort, guarded on `oras` availability,
- * surfaced on the output's `referrerAttach` rather than failing the publish.
+ * `publish-image` with ECR as its only login backend: core's verb, bound to
+ * this executor. Kept so aws-only callers and tests build it the way they
+ * always did; behaviour is unchanged (load, tag, ECR login, push, optional
+ * referrer attach).
  */
 export declare function createPublishImageCapability(executor?: CloudExecutor, processRunner?: ProcessRunner): PublishImageBackend;
-/** Default `publish-image` capability, backed by the real `CloudExecutor`. */
+/** `publish-image` bound to the real executor; the registered verb is core's, with this lexicon's ECR backend injected. */
 export declare const publishImageCapability: PublishImageBackend;
 /**
  * Copy the image tarball straight onto a host and `docker load` it there —
@@ -167,28 +103,23 @@ export type PublishImageBackendKind = "publish-image" | "load-image-on-host";
  * backends built above.
  */
 export declare function selectPublishBackend(kind: PublishImageBackendKind, backends?: Partial<Record<PublishImageBackendKind, PublishImageBackend>>): PublishImageBackend;
-export interface PublishArtifactInput {
-    /** Path of the artifact inside the build archive (e.g. a jar or zip). */
-    from: string;
-    /** Destination (e.g. `$env.s3` resolved by the orchestrator). */
-    to: string;
-}
-export interface PublishArtifactOutput {
-    /** Location the artifact was published to — referenced downstream as `@<component>.publish.uri`. */
-    uri: string;
-    /** Content hash of the published artifact. */
-    digest: string;
-}
-/** Promote a non-image artifact (jar, zip, arbitrary asset) from the archive to S3/CodeArtifact. */
+export type { PublishArtifactInput, PublishArtifactOutput } from "@intentius/chant/components/verbs/publish-artifact";
+/**
+ * The aws lexicon's storage backend for core's `publish-artifact`: `aws s3 cp`
+ * (endpoint-aware through the `CloudExecutor`). Core owns the digest and the
+ * object URI; this only uploads.
+ */
+export declare function createS3StorageBackend(executor?: CloudExecutor): ArtifactStorageBackend;
+/** The S3 backend the aws plugin contributes, over the real `CloudExecutor`. */
+export declare const s3StorageBackend: ArtifactStorageBackend;
 /**
- * Publish a single archive artifact (a jar, zip, or asset) to S3 via `aws s3 cp`
- * (endpoint-aware through the `CloudExecutor`). Returns the object's URI —
- * referenced downstream as `@<component>.publish.uri` — and a content digest of
- * the exact bytes uploaded.
+ * `publish-artifact` with S3 as its only storage backend: core's verb, bound
+ * to this executor. Kept so aws-only callers and tests build it the way they
+ * always did; behaviour is unchanged (upload, return uri + content digest).
  */
 export declare function createPublishArtifactCapability(executor?: CloudExecutor): Capability<PublishArtifactInput, PublishArtifactOutput>;
-/** Default `publish-artifact` capability, backed by the real `CloudExecutor`. */
+/** Default `publish-artifact`, bound to the real executor; the registered verb is core's, with this lexicon's S3 backend injected. */
 export declare const publishArtifactCapability: Capability<PublishArtifactInput, PublishArtifactOutput>;
-/** Alias for `publish-artifact` — same capability, the docs/epic use both names for the same verb. */
+/** Alias for `publish-artifact`: same capability, the docs/epic use both names for the same verb. */
 export declare const publishAssetCapability: Capability<PublishArtifactInput, PublishArtifactOutput>;
 //# sourceMappingURL=publish.d.ts.map

package/dist/components/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/components/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAGzE,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,kDAAkD,CAAC;AAI/G;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,qJAAqJ;IACrJ,IAAI,EAAE,MAAM,CAAC;IACb,+IAA+I;IAC/I,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,6HAA6H;IAC7H,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yIAAyI;IACzI,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;;;;;OAKG;IACH,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED,oOAAoO;AACpO,MAAM,WAAW,oBAAoB;IACnC,qJAAqJ;IACrJ,QAAQ,EAAE,OAAO,CAAC;IAClB,qHAAqH;IACrH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,sGAAsG;IACtG,MAAM,EAAE,MAAM,CAAC;IACf,oJAAoJ;IACpJ,GAAG,EAAE,MAAM,CAAC;IACZ,8PAA8P;IAC9P,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;AA4DpF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,GAAE,aAAsC,EAChD,aAAa,GAAE,aAAsC,GACpD,mBAAmB,CAgCrB;AAED,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB,EAAE,mBAAoD,CAAC;AAU1F;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,GAAE,aAAsC,GAC/C,mBAAmB,CAYrB;AAED,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,EAAE,mBAAuD,CAAC;AAIhG,wGAAwG;AACxG,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,uBAAuB,EAC7B,QAAQ,GAAE,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,CAGrE,GACA,mBAAmB,CAQrB;AAID,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,qBAAqB;IACpC,oGAAoG;IACpG,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oGAAoG;AACpG;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,GAAE,aAAsC,GAC/C,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAYzD;AAED,iFAAiF;AACjF,eAAO,MAAM,yBAAyB,EAAE,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAC3D,CAAC;AAEpC,sGAAsG;AACtG,eAAO,MAAM,sBAAsB,yDAA4B,CAAC"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/components/publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,kDAAkD,CAAC;AAC5G,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,oDAAoD,CAAC;AAI5D,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,iDAAiD,CAAC;AAIzD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,oBAAoB,CAOvF;AAED,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,EAAE,oBAAiD,CAAC;AAEnF;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,GAAE,aAAsC,EAChD,aAAa,GAAE,aAAsC,GACpD,mBAAmB,CAErB;AAED,2HAA2H;AAC3H,eAAO,MAAM,sBAAsB,EAAE,mBAAoD,CAAC;AAU1F;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,GAAE,aAAsC,GAC/C,mBAAmB,CAYrB;AAED,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,EAAE,mBAAuD,CAAC;AAIhG,wGAAwG;AACxG,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,uBAAuB,EAC7B,QAAQ,GAAE,OAAO,CAAC,MAAM,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,CAGrE,GACA,mBAAmB,CAQrB;AAID,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oDAAoD,CAAC;AAEtH;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,sBAAsB,CAOvF;AAED,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,EAAE,sBAAiD,CAAC;AAEjF;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,GAAE,aAAsC,GAC/C,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,CAEzD;AAED,sIAAsI;AACtI,eAAO,MAAM,yBAAyB,EAAE,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAC3D,CAAC;AAEpC,qGAAqG;AACrG,eAAO,MAAM,sBAAsB,yDAA4B,CAAC"}

package/dist/components/publish.js

@@ -44,107 +44,37 @@
  * image is already successfully promoted by the time this step runs — the
  * one part of this capability that is genuinely best-effort.
  */
-import { readFileSync } from "node:fs";
-import { createHash } from "node:crypto";
 import { defaultCloudExecutor } from "./cloud-executor.js";
 import { archiveRelativePath } from "@intentius/chant/components/verbs/build-archive";
-import { defaultProcessRunner, q } from "@intentius/chant/components/verbs/process-runner";
-// ── publish-image (registry backend) ────────────────────────────────────────
+import { defaultProcessRunner } from "@intentius/chant/components/verbs/process-runner";
+import { createPublishImageCapability as createCorePublishImage, } from "@intentius/chant/components/verbs/publish-image";
+import { createPublishArtifactCapability as createCorePublishArtifact, } from "@intentius/chant/components/verbs/publish-artifact";
+// ── publish-image: the ECR backend (the verb itself is core's) ──────────────
 /**
- * Attempt to `oras attach` one referrer document (SBOM or component BOM) to
- * `imageRef`'s digest. Writes the document's bytes to a scratch file (`oras
- * attach` reads from a file path, not stdin) and shells out through
- * `runner`. Never throws — a failure here is reported back to the caller as
- * `{ ok: false, reason }` so a missing/erroring `oras` never fails the
- * publish itself (see `attachReferrers`'s doc comment for why).
+ * The aws lexicon's registry login for core's `publish-image` (#3142, #3143):
+ * `aws ecr get-login-password | docker login`. The aws plugin contributes it;
+ * core owns load, tag, push and the digest read-back.
  */
-async function attachOneReferrer(runner, imageRef, doc, label) {
-    try {
-        const scratchFile = `/tmp/chant-referrer-attach/${label}-${Date.now()}.json`;
-        await runner.run(`mkdir -p ${q("/tmp/chant-referrer-attach")}`);
-        await runner.run(`printf '%s' ${q(doc.bytes)} > ${q(scratchFile)}`);
-        await runner.run(`oras attach --artifact-type ${q(doc.mediaType)} ${q(imageRef)} ${q(scratchFile)}:${q(doc.mediaType)}`);
-        return { ok: true };
-    }
-    catch (err) {
-        return { ok: false, reason: err instanceof Error ? err.message : String(err) };
-    }
-}
-/**
- * Best-effort OCI-referrer attach for a just-pushed image (#610): attaches
- * `input.sbom` and/or `input.componentBom`, when supplied, to `imageRef` via
- * `oras attach`. Guarded on `oras` availability — a missing binary is
- * reported back as `{ attached: false, reason }` rather than thrown, since
- * the image itself is already successfully promoted by the time this step
- * runs (attach is additive registry-side convenience on top of the
- * archive-carried copy, per this module's doc comment, never a condition the
- * core promote-by-digest job depends on). Returns `undefined` when neither
- * `input.sbom` nor `input.componentBom` was supplied — nothing to attach,
- * skipped entirely, no `oras` call at all.
- */
-async function attachReferrers(runner, imageRef, input) {
-    if (!input.sbom && !input.componentBom)
-        return undefined;
-    if (!(await runner.available("oras"))) {
-        return { attached: false, reason: `"oras" is not installed or not on PATH — required to attach OCI referrers` };
-    }
-    const results = [];
-    if (input.sbom)
-        results.push(await attachOneReferrer(runner, imageRef, input.sbom, "sbom"));
-    if (input.componentBom)
-        results.push(await attachOneReferrer(runner, imageRef, input.componentBom, "component-bom"));
-    const failed = results.find((r) => !r.ok);
-    return failed ? { attached: false, reason: failed.reason } : { attached: true };
+export function createEcrRegistryBackend(executor) {
+    return {
+        name: "ecr",
+        matches: (registry) => /\.dkr\.ecr(-fips)?\.[a-z0-9-]+\.amazonaws\.com(\.cn)?$/.test(registry),
+        // The real executor is built on first login, so loading the plugin shells out to nothing.
+        login: (registry) => (executor ?? defaultCloudExecutor()).ecr.login(registry),
+    };
 }
+/** The ECR backend the aws plugin contributes, over the real `CloudExecutor`. */
+export const ecrRegistryBackend = createEcrRegistryBackend();
 /**
- * Promote a built image from the archive into the environment's container
- * registry: `docker load` the archived tarball, tag it for `to` (the env
- * registry), `aws ecr get-login-password | docker login`, then `docker push`.
- * Returns the pushed image's registry digest — what `cfn-deploy`/
- * `ecs-update-service` reference via `imageRef: "@Publish.digest"`. No
- * rollback: an already-pushed, still-valid image in the registry is not
- * itself a problem to compensate (immutable, content-addressed, and simply
- * unreferenced if a later step fails) — the opt-out this capability takes.
- *
- * #610: when `input.sbom` and/or `input.componentBom` are supplied, also
- * attaches them as OCI referrers on the pushed digest via `oras attach` (see
- * `attachReferrers` above) — best-effort, guarded on `oras` availability,
- * surfaced on the output's `referrerAttach` rather than failing the publish.
+ * `publish-image` with ECR as its only login backend: core's verb, bound to
+ * this executor. Kept so aws-only callers and tests build it the way they
+ * always did; behaviour is unchanged (load, tag, ECR login, push, optional
+ * referrer attach).
  */
 export function createPublishImageCapability(executor = defaultCloudExecutor(), processRunner = defaultProcessRunner()) {
-    return {
-        kind: "publish-image",
-        async run(_ctx, input) {
-            if (!input.to)
-                throw new Error(`publish-image "${input.from}": "to" (destination registry) is required`);
-            // `docker load` reports the archived image's local reference — a name:tag
-            // for a tagged build, or an image id. It's a valid `docker tag` source but
-            // never a registry digest, so the promoted digest is read back from the
-            // push below, not constructed from this.
-            const { digest: localRef } = await executor.docker.load({ inFile: archiveRelativePath(input.from) });
-            const repo = input.to.replace(/\/+$/, "");
-            // Publish under a tag: docker can neither tag nor push a digest-qualified
-            // reference (`repo@sha256:...`), so the transport is a tag and the stable
-            // identifier is the digest the push returns.
-            const pushRef = `${repo}:latest`;
-            await executor.docker.tag({ source: localRef, target: pushRef });
-            const registry = repo.split("/")[0];
-            await executor.ecr.login(registry);
-            const { digest: pushed } = await executor.docker.push({ image: pushRef });
-            // Normalize to a bare `sha256:...`, whether the client returned that or a
-            // full `repo@sha256:...` RepoDigest.
-            const digest = pushed.includes("@") ? pushed.slice(pushed.indexOf("@") + 1) : pushed;
-            for (const tag of input.tags ?? []) {
-                const tagged = `${repo}:${tag}`;
-                await executor.docker.tag({ source: localRef, target: tagged });
-                await executor.docker.push({ image: tagged });
-            }
-            const referrerAttach = await attachReferrers(processRunner, `${repo}@${digest}`, input);
-            return { digest, uri: `${repo}@${digest}`, ...(referrerAttach ? { referrerAttach } : {}) };
-        },
-    };
+    return createCorePublishImage({ docker: executor.docker, processRunner, backends: [createEcrRegistryBackend(executor)] });
 }
-/** Default `publish-image` capability, backed by the real `CloudExecutor`. */
+/** `publish-image` bound to the real executor; the registered verb is core's, with this lexicon's ECR backend injected. */
 export const publishImageCapability = createPublishImageCapability();
 // ── load-image-on-host (host backend) ───────────────────────────────────────
 /** Default on-host tarball destination when `hostPath` is omitted, derived from the archive path's basename. */
@@ -208,27 +138,30 @@ export function selectPublishBackend(kind, backends = {
     }
     return backend;
 }
-/** Promote a non-image artifact (jar, zip, arbitrary asset) from the archive to S3/CodeArtifact. */
 /**
- * Publish a single archive artifact (a jar, zip, or asset) to S3 via `aws s3 cp`
- * (endpoint-aware through the `CloudExecutor`). Returns the object's URI —
- * referenced downstream as `@<component>.publish.uri` — and a content digest of
- * the exact bytes uploaded.
+ * The aws lexicon's storage backend for core's `publish-artifact`: `aws s3 cp`
+ * (endpoint-aware through the `CloudExecutor`). Core owns the digest and the
+ * object URI; this only uploads.
  */
-export function createPublishArtifactCapability(executor = defaultCloudExecutor()) {
+export function createS3StorageBackend(executor) {
     return {
-        kind: "publish-artifact",
-        async run(_ctx, input) {
-            const localPath = archiveRelativePath(input.from);
-            const digest = `sha256:${createHash("sha256").update(readFileSync(localPath)).digest("hex")}`;
-            const basename = localPath.split("/").pop() ?? localPath;
-            const uri = input.to.endsWith("/") ? `${input.to}${basename}` : input.to;
-            await executor.s3.cp({ from: localPath, to: uri });
-            return { uri, digest };
-        },
+        name: "s3",
+        matches: (uri) => uri.startsWith("s3://"),
+        // The real executor is built on first upload, so loading the plugin shells out to nothing.
+        upload: (args) => (executor ?? defaultCloudExecutor()).s3.cp(args),
     };
 }
-/** Default `publish-artifact` capability, backed by the real `CloudExecutor`. */
+/** The S3 backend the aws plugin contributes, over the real `CloudExecutor`. */
+export const s3StorageBackend = createS3StorageBackend();
+/**
+ * `publish-artifact` with S3 as its only storage backend: core's verb, bound
+ * to this executor. Kept so aws-only callers and tests build it the way they
+ * always did; behaviour is unchanged (upload, return uri + content digest).
+ */
+export function createPublishArtifactCapability(executor = defaultCloudExecutor()) {
+    return createCorePublishArtifact({ backends: [createS3StorageBackend(executor)] });
+}
+/** Default `publish-artifact`, bound to the real executor; the registered verb is core's, with this lexicon's S3 backend injected. */
 export const publishArtifactCapability = createPublishArtifactCapability();
-/** Alias for `publish-artifact` — same capability, the docs/epic use both names for the same verb. */
+/** Alias for `publish-artifact`: same capability, the docs/epic use both names for the same verb. */
 export const publishAssetCapability = publishArtifactCapability;

package/dist/import/parser.d.ts

@@ -1,5 +1,7 @@
 import type { TemplateParser, TemplateIR } from "@intentius/chant/import/parser";
 import { BaseValueParser } from "@intentius/chant/import/base-parser";
+import yaml from "js-yaml";
+export declare const CF_SCHEMA: yaml.Schema;
 /**
  * Parser for CloudFormation JSON templates.
  * Extends BaseValueParser for generic recursive value walking;

package/dist/import/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EAKX,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AA4KtE;;;;GAIG;AACH,qBAAa,QAAS,SAAQ,eAAgB,YAAW,cAAc;IACrE;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CA4BjC;IAED;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CASrC;IAEH,OAAO,CAAC,6BAA6B;IAUrC;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB,CAAS;IAEtC,OAAO,CAAC,eAAe;IAWvB;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB;;OAEG;IACH,OAAO,CAAC,eAAe;IAgBvB;;OAEG;IACH,OAAO,CAAC,cAAc;IAkBtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAUvB;;OAEG;IACH,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,IAAI,CAuJtG;CACF"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EAKX,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,IAAI,MAAM,SAAS,CAAC;AAyG3B,eAAO,MAAM,SAAS,aAA2C,CAAC;AAkElE;;;;GAIG;AACH,qBAAa,QAAS,SAAQ,eAAgB,YAAW,cAAc;IACrE;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CA4BjC;IAED;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CASrC;IAEH,OAAO,CAAC,6BAA6B;IAUrC;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB,CAAS;IAEtC,OAAO,CAAC,eAAe;IAWvB;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB;;OAEG;IACH,OAAO,CAAC,eAAe;IAgBvB;;OAEG;IACH,OAAO,CAAC,cAAc;IAkBtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAUvB;;OAEG;IACH,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,IAAI,CAuJtG;CACF"}

package/dist/import/parser.js

@@ -102,7 +102,7 @@ const cfnYamlTypes = [
         construct: (data) => ({ Condition: data }),
     }),
 ];
-const CF_SCHEMA = yaml.DEFAULT_SCHEMA.extend(cfnYamlTypes);
+export const CF_SCHEMA = yaml.DEFAULT_SCHEMA.extend(cfnYamlTypes);
 /** Parameter keys import carries besides Type, Description and Default. */
 const PARAMETER_CONSTRAINT_KEYS = [
     "AllowedValues",

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "8c88e8750ff98569d97921403ae44dfba0065e512d6dee2de6a912897cd84e66",
+    "manifest.json": "1faf3be1e82f5522c3e68e47075e42fecbd612aed648a58632778973376570cc",
     "meta.json": "6f48557ed4203cbdeafdb47e7270fdf3533f6d6e6189987246301ed8e72170e9",
     "types/index.d.ts": "8651f9ae166668f4311eea1fe61c3fe235f345947951c1d23d1df24a4fd3384f",
     "rules/hardcoded-region.ts": "957eadcaa9f39cc17d21437565d7a94607d9b082cf28918b178fa067f07498a9",
@@ -75,5 +75,5 @@
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "8780b94ce60aded935938d5ef20ea667738354051da1bf9ca6d70d9886f65d21"
   },
-  "composite": "c3e022363a232d4ee358a6f31700ecb1ee3d51b871d2a1efddb4655291562233"
+  "composite": "1a1d9184cfab96a1e828dbec19a1848c145ec74ab63cc8c1fb04d50dd2048250"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.124.46",
+  "version": "0.124.49",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAqQ,MAAM,0BAA0B,CAAC;AAwCjU;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aAgkCvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAqQ,MAAM,0BAA0B,CAAC;AAyCjU;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aA+kCvB,CAAC"}

package/dist/plugin.js

@@ -24,6 +24,7 @@ import { canDescribe, describeOwnProperties, stampRegion } from "./properties.js
 import { stampProviderDefaults } from "./defaults.js";
 import { resolveTemplateAttrs } from "./live-attrs.js";
 import { CFParser } from "./import/parser.js";
+import { lastMemberReport, readCloudFormationMember, setLastMemberReport } from "./workspace-member.js";
 import { CFGenerator } from "./import/generator.js";
 import { parseStackTemplate } from "./import/live-export.js";
 import { awsCompletions } from "./lsp/completions.js";
@@ -49,6 +50,22 @@ const OWNERSHIP_UNRESOLVED_NOTE = "ownership filter not applied on describeResou
 export const awsPlugin = {
     behaviourKinds: awsBehaviourKinds,
     name: "aws",
+    // A cloudformation workspace member's reader project (#3179): the template's
+    // resources as nodes, its Ref, GetAtt, Sub and DependsOn as edges. See
+    // ./workspace-member.ts.
+    async buildRoots(ctx) {
+        setLastMemberReport(undefined);
+        const member = ctx.config.aws?.member;
+        if (!member)
+            return { entities: new Map() };
+        const read = readCloudFormationMember({ member });
+        setLastMemberReport(read.report);
+        return { entities: read.entities, warnings: read.warnings };
+    },
+    graphMeta() {
+        const report = lastMemberReport();
+        return report ? { awsMember: report } : undefined;
+    },
     // The thin read's marker channel is the STACK's own tags (#1998), read off
     // the DescribeStacks call it already makes for the outputs.
     // describe-stack-resources carries no per-resource tags, so the stack is the

package/dist/workspace-member.d.ts

@@ -0,0 +1,34 @@
+import { type Declarable } from "@intentius/chant/declarable";
+export interface AwsMemberConfig {
+    /** `cloudformation` (the default) or `cdk`. */
+    kind?: "cloudformation" | "cdk";
+    /** The member's directory, absolute. */
+    dir: string;
+    /** Names the entities (`<label>/Bucket`): the member's name. */
+    label?: string;
+}
+/** What the read found, carried on the graph's `meta.awsMember`. */
+export interface AwsMemberReport {
+    /** The template files read, relative to the member's directory (or its assembly's). */
+    templates: string[];
+    objects: number;
+    /** CDK only: false when the app has no synthesized assembly to read. */
+    synthesized?: boolean;
+    /** Why nothing was read; set with `synthesized: false`. */
+    reason?: string;
+}
+export declare function readCloudFormationMember(opts: {
+    member: AwsMemberConfig;
+}): {
+    entities: Map<string, Declarable>;
+    warnings: string[];
+    report: AwsMemberReport;
+};
+/**
+ * The report of the read in this process. `graphMeta` receives only the
+ * entities, so the hook that read the member leaves its report here for the
+ * hook that publishes it; `chant graph` runs the two in order in one process.
+ */
+export declare function setLastMemberReport(report: AwsMemberReport | undefined): void;
+export declare function lastMemberReport(): AwsMemberReport | undefined;
+//# sourceMappingURL=workspace-member.d.ts.map

package/dist/workspace-member.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-member.d.ts","sourceRoot":"","sources":["../src/workspace-member.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAKjF,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,IAAI,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAC;IAChC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAoED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAAG;IAC3E,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,eAAe,CAAC;CACzB,CA4DA;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAE7E;AAED,wBAAgB,gBAAgB,IAAI,eAAe,GAAG,SAAS,CAE9D"}