@intentius/chant-lexicon-aws 0.124.46 → 0.124.49

package/dist/workspace-member.js

@@ -0,0 +1,179 @@
+/**
+ * Reading a cloudformation workspace member into the graph (#3179).
+ *
+ * `chant workspace graph` writes a reader project for a member of kind
+ * `cloudformation`, with `aws.member` in its config (see `workspace-kinds.json`).
+ * The plugin's `buildRoots` hook calls {@link readCloudFormationMember}: each
+ * CloudFormation template directly in the member's directory is parsed with the
+ * import parser's YAML schema (short-form tags included), and every resource
+ * becomes a node keyed `<label>/<LogicalId>`.
+ *
+ * Edges come from what the template says: `Ref`, `Fn::GetAtt` and the `${...}`
+ * references in `Fn::Sub`, wherever they sit in a resource's properties, plus
+ * `DependsOn`. Parameters, pseudo parameters and names that are not a resource
+ * of the same template (`AWS::Region`, an `Fn::ImportValue`) draw no edge.
+ * Nothing runs and no AWS call is made.
+ *
+ * A `cdk` member is read the same way from the cloud assembly its app already
+ * synthesized (`cdk.out`, or the `output` its cdk.json names): the assembly's
+ * `*.template.json` files are CloudFormation templates, and core's CDK
+ * assembly reader says whether the directory is one. chant does not run the
+ * app. With no assembly there is nothing to read, and the report says
+ * `synthesized: false` with the reason.
+ */
+import { readdirSync, readFileSync } from "node:fs";
+import { basename, extname, join } from "node:path";
+import yaml from "js-yaml";
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+import { isCloudAssembly } from "@intentius/chant/cdk/assembly";
+import { CF_SCHEMA } from "./import/parser.js";
+function parseTemplate(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        try {
+            parsed = yaml.load(text, { schema: CF_SCHEMA });
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return undefined;
+    const t = parsed;
+    // The probe's two claims: a format version, or a Resources section.
+    const resources = t.Resources;
+    if (t.AWSTemplateFormatVersion === undefined && (!resources || typeof resources !== "object"))
+        return undefined;
+    return t;
+}
+/** Logical ids named by `${X}` and `${X.Attr}` in an `Fn::Sub` string, with the attribute when one is named. */
+function subReferences(text) {
+    const out = [];
+    for (const m of text.matchAll(/\$\{([^}!][^}]*)\}/g)) {
+        const [id, ...rest] = m[1].trim().split(".");
+        if (id)
+            out.push({ id, ...(rest.length ? { attr: rest.join(".") } : {}) });
+    }
+    return out;
+}
+/** Every name a value reaches through Ref, Fn::GetAtt or Fn::Sub. */
+function collectNames(value, out) {
+    if (Array.isArray(value)) {
+        for (const v of value)
+            collectNames(v, out);
+        return;
+    }
+    if (!value || typeof value !== "object")
+        return;
+    for (const [k, v] of Object.entries(value)) {
+        if (k === "Ref" && typeof v === "string") {
+            out.push({ id: v });
+        }
+        else if (k === "Fn::GetAtt") {
+            const [id, attr] = Array.isArray(v) ? v : typeof v === "string" ? [v.slice(0, v.indexOf(".")), v.slice(v.indexOf(".") + 1)] : [];
+            if (typeof id === "string" && id)
+                out.push({ id, ...(typeof attr === "string" && attr ? { attr } : {}) });
+        }
+        else if (k === "Fn::Sub") {
+            const text = Array.isArray(v) ? v[0] : v;
+            if (typeof text === "string")
+                out.push(...subReferences(text));
+            if (Array.isArray(v))
+                collectNames(v[1], out);
+        }
+        else {
+            collectNames(v, out);
+        }
+    }
+}
+/** The directory a CDK app synthesizes into: cdk.json's `output`, else `cdk.out`. */
+function cdkOutput(dir) {
+    try {
+        const output = JSON.parse(readFileSync(join(dir, "cdk.json"), "utf-8")).output;
+        if (typeof output === "string" && output)
+            return output;
+    }
+    catch {
+        /* no readable cdk.json: the default */
+    }
+    return "cdk.out";
+}
+export function readCloudFormationMember(opts) {
+    const { member } = opts;
+    const label = member.label ?? basename(member.dir);
+    const warnings = [];
+    const templates = [];
+    let source = member.dir;
+    if (member.kind === "cdk") {
+        source = join(member.dir, cdkOutput(member.dir));
+        if (!isCloudAssembly(source)) {
+            const reason = `no synthesized cloud assembly at ${source}; run \`cdk synth\` in the app, and chant will read the templates it writes`;
+            warnings.push(`cdk member "${label}" was not read: ${reason}`);
+            return { entities: new Map(), warnings, report: { templates: [], objects: 0, synthesized: false, reason } };
+        }
+    }
+    const pattern = member.kind === "cdk" ? /\.template\.json$/ : /\.(ya?ml|json|template)$/;
+    for (const file of readdirSync(source).filter((f) => pattern.test(f)).sort()) {
+        const template = parseTemplate(readFileSync(join(source, file), "utf-8"));
+        if (template)
+            templates.push({ file, template });
+    }
+    const entities = new Map();
+    for (const { file, template } of templates) {
+        // One template per member is the usual case and keeps ids short; two share a directory, so the file name qualifies them.
+        const prefix = templates.length === 1 ? label : `${label}/${basename(file, extname(file)).replace(/\.template$/, "")}`;
+        const resources = Object.entries(template.Resources ?? {}).filter(([, r]) => typeof r?.Type === "string");
+        const keyOf = new Map(resources.map(([id]) => [id, `${prefix}/${id}`]));
+        for (const [id, resource] of resources) {
+            const references = new Map();
+            const add = (name, via) => {
+                const to = keyOf.get(name.id);
+                if (!to || to === keyOf.get(id))
+                    return;
+                references.set(`${to}|${via}|${name.attr ?? ""}`, { to, viaAttr: via, ...(name.attr ? { toAttr: name.attr } : {}) });
+            };
+            for (const [prop, value] of Object.entries(resource.Properties ?? {})) {
+                const names = [];
+                collectNames(value, names);
+                for (const n of names)
+                    add(n, prop);
+            }
+            const dependsOn = resource.DependsOn;
+            for (const d of Array.isArray(dependsOn) ? dependsOn : dependsOn === undefined ? [] : [dependsOn]) {
+                if (typeof d === "string")
+                    add({ id: d }, "DependsOn");
+            }
+            const entity = {
+                lexicon: "aws",
+                entityType: resource.Type,
+                kind: "resource",
+                props: { ...(resource.Properties ?? {}) },
+                references: [...references.values()],
+                [DECLARABLE_MARKER]: true,
+            };
+            entities.set(keyOf.get(id), entity);
+        }
+    }
+    if (templates.length === 0)
+        warnings.push(`${member.kind ?? "cloudformation"} member "${label}" has no CloudFormation template directly in ${source}`);
+    return {
+        entities,
+        warnings,
+        report: { templates: templates.map((t) => t.file), objects: entities.size, ...(member.kind === "cdk" ? { synthesized: true } : {}) },
+    };
+}
+let lastReport;
+/**
+ * The report of the read in this process. `graphMeta` receives only the
+ * entities, so the hook that read the member leaves its report here for the
+ * hook that publishes it; `chant graph` runs the two in order in one process.
+ */
+export function setLastMemberReport(report) {
+    lastReport = report;
+}
+export function lastMemberReport() {
+    return lastReport;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.124.46",
+  "version": "0.124.49",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -23,12 +23,15 @@
   "type": "module",
   "files": [
     "src/",
-    "dist/"
+    "dist/",
+    "schemas/",
+    "workspace-kinds.json"
   ],
   "publishConfig": {
     "access": "public"
   },
   "exports": {
+    "./workspace-kinds": "./workspace-kinds.json",
     ".": {
       "development": "./src/index.ts",
       "types": "./dist/index.d.ts",
@@ -80,6 +83,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.46"
+    "@intentius/chant": "^0.124.49"
   }
 }

package/schemas/cdk.schema.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "cdk.json",
+  "type": "object",
+  "required": [
+    "app"
+  ],
+  "properties": {
+    "app": {
+      "type": "string",
+      "minLength": 1
+    }
+  }
+}

package/src/components/capability-plugin.ts

@@ -11,7 +11,7 @@
 import type { Capability } from "@intentius/chant/components/capability";
 import { ownPackageVersion, type CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
 
-import { publishImageCapability, loadImageOnHostCapability, publishArtifactCapability } from "./publish";
+import { ecrRegistryBackend, s3StorageBackend, loadImageOnHostCapability } from "./publish";
 import { extractConfigBomCapability } from "./config-bom";
 import {
   cfnDeployCapability,
@@ -30,7 +30,9 @@ import { snapshotBeforeCapability, rollbackPreviousCapability } from "./safety";
 export const AWS_VERB_FAMILIES = {
   // `extract-config-bom` parses a synthesized CloudFormation template (#684).
   sbom: ["extract-config-bom"],
-  publish: ["publish-image", "load-image-on-host", "publish-artifact"],
+  // `publish-image` is core's verb (#3142, #3143); aws contributes its ECR login as a registry backend.
+  // `publish-artifact` is core's verb (#4408); aws contributes S3 as a storage backend.
+  publish: ["load-image-on-host"],
   apply: ["cfn-deploy", "ecs-update-service", "lambda-deploy", "s3-sync", "cdn-invalidate", "run-migration"],
   jobSubmission: ["emr-start-job-run", "emr-submit-step"],
   hostDelivery: ["code-deploy", "copy-to-host", "remote-exec"],
@@ -42,9 +44,7 @@ export const AWS_VERB_FAMILIES = {
 function awsCapabilities(): Array<Capability<never, unknown>> {
   return [
     extractConfigBomCapability,
-    publishImageCapability,
     loadImageOnHostCapability,
-    publishArtifactCapability,
     cfnDeployCapability,
     ecsUpdateServiceCapability,
     lambdaDeployCapability,
@@ -75,5 +75,7 @@ export const awsCapabilityPlugin: CapabilityPlugin = {
     return ownPackageVersion(import.meta.url);
   },
   capabilities: awsCapabilities,
+  registryBackends: () => [ecrRegistryBackend],
+  storageBackends: () => [s3StorageBackend],
   families: () => AWS_VERB_FAMILIES,
 };

package/src/components/publish.ts

@@ -46,189 +46,64 @@
  */
 
 import type { Capability } from "@intentius/chant/components/capability";
-import { readFileSync } from "node:fs";
-import { createHash } from "node:crypto";
 import { defaultCloudExecutor, type CloudExecutor } from "./cloud-executor";
 import { archiveRelativePath } from "@intentius/chant/components/verbs/build-archive";
-import { defaultProcessRunner, q, type ProcessRunner } from "@intentius/chant/components/verbs/process-runner";
+import { defaultProcessRunner, type ProcessRunner } from "@intentius/chant/components/verbs/process-runner";
+import {
+  createPublishImageCapability as createCorePublishImage,
+  type PublishImageBackend,
+  type RegistryLoginBackend,
+} from "@intentius/chant/components/verbs/publish-image";
+
+import {
+  createPublishArtifactCapability as createCorePublishArtifact,
+  type ArtifactStorageBackend,
+  type PublishArtifactInput,
+  type PublishArtifactOutput,
+} from "@intentius/chant/components/verbs/publish-artifact";
 
 // ── shared backend interface ─────────────────────────────────────────────────
 
-/**
- * Common input shape both image-publish backends accept: promote the image
- * bytes at archive path `from` to wherever the deploy target can consume
- * them. `to` (registry) and `host` (bare host) are each meaningful to only
- * one backend, so a component authors one step shape (see
- * docs/components/build-archive.mdx) and the env-selected backend (see
- * `selectPublishBackend` below) reads whichever field it needs — the
- * unselected backend's field is simply unused, never a pipeline fork.
- */
-export interface PublishImageInput {
-  /** Path of the image tarball inside the build archive (as produced by `docker-build`; an `archive:`-prefixed reference is accepted and stripped). */
-  from: string;
-  /** Destination registry — required by `publish-image`, ignored by `load-image-on-host` (e.g. `$env.registry` resolved by the orchestrator). */
-  to?: string;
-  /** Target host — required by `load-image-on-host`, ignored by `publish-image` (SSM instance id, hostname, or host group). */
-  host?: string;
-  /** Destination path for the tarball on the host, used only by `load-image-on-host`. Default: `/tmp/chant-archive/<basename of from>`. */
-  hostPath?: string;
-  /** Additional tags to apply alongside the digest, used only by `publish-image`. */
-  tags?: string[];
-  /**
-   * #610: the artifact's software SBOM (typically wired from a prior
-   * `generate-sbom` step's `sbom` output — see ./sbom.ts's
-   * `GenerateSbomOutput`) to attach as an OCI referrer on the pushed image
-   * digest, via `oras attach`. Used only by `publish-image`; ignored by
-   * `load-image-on-host` (registry-less — nothing to attach to). Omit to
-   * skip the attach step entirely (the archive-carried copy remains the
-   * SBOM's home either way).
-   */
-  sbom?: { bytes: string; mediaType: string };
-  /**
-   * #610: the component-level aggregate BOM (wired from
-   * ./component-bom.ts's `aggregateComponentBom` output), attached as a
-   * second OCI referrer alongside `sbom` when supplied. Optional and
-   * independent of `sbom` — a caller may attach either, both, or neither.
-   */
-  componentBom?: { bytes: string; mediaType: string };
-}
-
-/** Result of `publish-image`'s best-effort OCI-referrer attach step (#610) — always present when `input.sbom`/`input.componentBom` was supplied, `undefined` when neither was (nothing to attach, attach step skipped entirely). */
-export interface ReferrerAttachResult {
-  /** True once every requested attach (`sbom`, `componentBom`) succeeded. `false` if `oras` was unavailable or any `oras attach` invocation failed. */
-  attached: boolean;
-  /** Human-readable reason `attached` is `false` (e.g. "oras is not installed"), omitted when `attached` is `true`. */
-  reason?: string;
-}
-
-export interface PublishImageOutput {
-  /** Content-addressed digest of the promoted image (`sha256:...`) — what the apply step references. */
-  digest: string;
-  /** Image reference the apply step can pull/run: `registry/repo@sha256:...` for `publish-image`, a host-local reference for `load-image-on-host`. */
-  uri: string;
-  /** #610: outcome of the best-effort SBOM/component-BOM referrer attach, when `input.sbom`/`input.componentBom` was supplied. `undefined` for `load-image-on-host` (no attach concept — registry-less) and for `publish-image` calls that supplied neither. */
-  referrerAttach?: ReferrerAttachResult;
-}
-
-/**
- * Common shape both image-publish backends satisfy: promote the image bytes
- * held in the build archive to wherever the deploy target can consume them,
- * and return the identity the apply step references. The backend is
- * selected per environment (`selectPublishBackend`), never per component.
- */
-export type PublishImageBackend = Capability<PublishImageInput, PublishImageOutput>;
+export type {
+  PublishImageInput,
+  PublishImageOutput,
+  PublishImageBackend,
+  ReferrerAttachResult,
+} from "@intentius/chant/components/verbs/publish-image";
 
-// ── publish-image (registry backend) ────────────────────────────────────────
+// ── publish-image: the ECR backend (the verb itself is core's) ──────────────
 
 /**
- * Attempt to `oras attach` one referrer document (SBOM or component BOM) to
- * `imageRef`'s digest. Writes the document's bytes to a scratch file (`oras
- * attach` reads from a file path, not stdin) and shells out through
- * `runner`. Never throws — a failure here is reported back to the caller as
- * `{ ok: false, reason }` so a missing/erroring `oras` never fails the
- * publish itself (see `attachReferrers`'s doc comment for why).
+ * The aws lexicon's registry login for core's `publish-image` (#3142, #3143):
+ * `aws ecr get-login-password | docker login`. The aws plugin contributes it;
+ * core owns load, tag, push and the digest read-back.
  */
-async function attachOneReferrer(
-  runner: ProcessRunner,
-  imageRef: string,
-  doc: { bytes: string; mediaType: string },
-  label: string,
-): Promise<{ ok: boolean; reason?: string }> {
-  try {
-    const scratchFile = `/tmp/chant-referrer-attach/${label}-${Date.now()}.json`;
-    await runner.run(`mkdir -p ${q("/tmp/chant-referrer-attach")}`);
-    await runner.run(`printf '%s' ${q(doc.bytes)} > ${q(scratchFile)}`);
-    await runner.run(`oras attach --artifact-type ${q(doc.mediaType)} ${q(imageRef)} ${q(scratchFile)}:${q(doc.mediaType)}`);
-    return { ok: true };
-  } catch (err) {
-    return { ok: false, reason: err instanceof Error ? err.message : String(err) };
-  }
+export function createEcrRegistryBackend(executor?: CloudExecutor): RegistryLoginBackend {
+  return {
+    name: "ecr",
+    matches: (registry) => /\.dkr\.ecr(-fips)?\.[a-z0-9-]+\.amazonaws\.com(\.cn)?$/.test(registry),
+    // The real executor is built on first login, so loading the plugin shells out to nothing.
+    login: (registry) => (executor ?? defaultCloudExecutor()).ecr.login(registry),
+  };
 }
 
-/**
- * Best-effort OCI-referrer attach for a just-pushed image (#610): attaches
- * `input.sbom` and/or `input.componentBom`, when supplied, to `imageRef` via
- * `oras attach`. Guarded on `oras` availability — a missing binary is
- * reported back as `{ attached: false, reason }` rather than thrown, since
- * the image itself is already successfully promoted by the time this step
- * runs (attach is additive registry-side convenience on top of the
- * archive-carried copy, per this module's doc comment, never a condition the
- * core promote-by-digest job depends on). Returns `undefined` when neither
- * `input.sbom` nor `input.componentBom` was supplied — nothing to attach,
- * skipped entirely, no `oras` call at all.
- */
-async function attachReferrers(
-  runner: ProcessRunner,
-  imageRef: string,
-  input: Pick<PublishImageInput, "sbom" | "componentBom">,
-): Promise<ReferrerAttachResult | undefined> {
-  if (!input.sbom && !input.componentBom) return undefined;
-
-  if (!(await runner.available("oras"))) {
-    return { attached: false, reason: `"oras" is not installed or not on PATH — required to attach OCI referrers` };
-  }
-
-  const results: Array<{ ok: boolean; reason?: string }> = [];
-  if (input.sbom) results.push(await attachOneReferrer(runner, imageRef, input.sbom, "sbom"));
-  if (input.componentBom) results.push(await attachOneReferrer(runner, imageRef, input.componentBom, "component-bom"));
-
-  const failed = results.find((r) => !r.ok);
-  return failed ? { attached: false, reason: failed.reason } : { attached: true };
-}
+/** The ECR backend the aws plugin contributes, over the real `CloudExecutor`. */
+export const ecrRegistryBackend: RegistryLoginBackend = createEcrRegistryBackend();
 
 /**
- * Promote a built image from the archive into the environment's container
- * registry: `docker load` the archived tarball, tag it for `to` (the env
- * registry), `aws ecr get-login-password | docker login`, then `docker push`.
- * Returns the pushed image's registry digest — what `cfn-deploy`/
- * `ecs-update-service` reference via `imageRef: "@Publish.digest"`. No
- * rollback: an already-pushed, still-valid image in the registry is not
- * itself a problem to compensate (immutable, content-addressed, and simply
- * unreferenced if a later step fails) — the opt-out this capability takes.
- *
- * #610: when `input.sbom` and/or `input.componentBom` are supplied, also
- * attaches them as OCI referrers on the pushed digest via `oras attach` (see
- * `attachReferrers` above) — best-effort, guarded on `oras` availability,
- * surfaced on the output's `referrerAttach` rather than failing the publish.
+ * `publish-image` with ECR as its only login backend: core's verb, bound to
+ * this executor. Kept so aws-only callers and tests build it the way they
+ * always did; behaviour is unchanged (load, tag, ECR login, push, optional
+ * referrer attach).
  */
 export function createPublishImageCapability(
   executor: CloudExecutor = defaultCloudExecutor(),
   processRunner: ProcessRunner = defaultProcessRunner(),
 ): PublishImageBackend {
-  return {
-    kind: "publish-image",
-    async run(_ctx, input) {
-      if (!input.to) throw new Error(`publish-image "${input.from}": "to" (destination registry) is required`);
-      // `docker load` reports the archived image's local reference — a name:tag
-      // for a tagged build, or an image id. It's a valid `docker tag` source but
-      // never a registry digest, so the promoted digest is read back from the
-      // push below, not constructed from this.
-      const { digest: localRef } = await executor.docker.load({ inFile: archiveRelativePath(input.from) });
-      const repo = input.to.replace(/\/+$/, "");
-      // Publish under a tag: docker can neither tag nor push a digest-qualified
-      // reference (`repo@sha256:...`), so the transport is a tag and the stable
-      // identifier is the digest the push returns.
-      const pushRef = `${repo}:latest`;
-      await executor.docker.tag({ source: localRef, target: pushRef });
-      const registry = repo.split("/")[0]!;
-      await executor.ecr.login(registry);
-      const { digest: pushed } = await executor.docker.push({ image: pushRef });
-      // Normalize to a bare `sha256:...`, whether the client returned that or a
-      // full `repo@sha256:...` RepoDigest.
-      const digest = pushed.includes("@") ? pushed.slice(pushed.indexOf("@") + 1) : pushed;
-      for (const tag of input.tags ?? []) {
-        const tagged = `${repo}:${tag}`;
-        await executor.docker.tag({ source: localRef, target: tagged });
-        await executor.docker.push({ image: tagged });
-      }
-
-      const referrerAttach = await attachReferrers(processRunner, `${repo}@${digest}`, input);
-      return { digest, uri: `${repo}@${digest}`, ...(referrerAttach ? { referrerAttach } : {}) };
-    },
-  };
+  return createCorePublishImage({ docker: executor.docker, processRunner, backends: [createEcrRegistryBackend(executor)] });
 }
 
-/** Default `publish-image` capability, backed by the real `CloudExecutor`. */
+/** `publish-image` bound to the real executor; the registered verb is core's, with this lexicon's ECR backend injected. */
 export const publishImageCapability: PublishImageBackend = createPublishImageCapability();
 
 // ── load-image-on-host (host backend) ───────────────────────────────────────
@@ -309,48 +184,41 @@ export function selectPublishBackend(
   return backend;
 }
 
-// ── publish-asset / publish-artifact ────────────────────────────────────────
+// ── publish-asset / publish-artifact (the verb is core's, #4408) ───────────
 
-export interface PublishArtifactInput {
-  /** Path of the artifact inside the build archive (e.g. a jar or zip). */
-  from: string;
-  /** Destination (e.g. `$env.s3` resolved by the orchestrator). */
-  to: string;
-}
+export type { PublishArtifactInput, PublishArtifactOutput } from "@intentius/chant/components/verbs/publish-artifact";
 
-export interface PublishArtifactOutput {
-  /** Location the artifact was published to — referenced downstream as `@<component>.publish.uri`. */
-  uri: string;
-  /** Content hash of the published artifact. */
-  digest: string;
+/**
+ * The aws lexicon's storage backend for core's `publish-artifact`: `aws s3 cp`
+ * (endpoint-aware through the `CloudExecutor`). Core owns the digest and the
+ * object URI; this only uploads.
+ */
+export function createS3StorageBackend(executor?: CloudExecutor): ArtifactStorageBackend {
+  return {
+    name: "s3",
+    matches: (uri) => uri.startsWith("s3://"),
+    // The real executor is built on first upload, so loading the plugin shells out to nothing.
+    upload: (args) => (executor ?? defaultCloudExecutor()).s3.cp(args),
+  };
 }
 
-/** Promote a non-image artifact (jar, zip, arbitrary asset) from the archive to S3/CodeArtifact. */
+/** The S3 backend the aws plugin contributes, over the real `CloudExecutor`. */
+export const s3StorageBackend: ArtifactStorageBackend = createS3StorageBackend();
+
 /**
- * Publish a single archive artifact (a jar, zip, or asset) to S3 via `aws s3 cp`
- * (endpoint-aware through the `CloudExecutor`). Returns the object's URI —
- * referenced downstream as `@<component>.publish.uri` — and a content digest of
- * the exact bytes uploaded.
+ * `publish-artifact` with S3 as its only storage backend: core's verb, bound
+ * to this executor. Kept so aws-only callers and tests build it the way they
+ * always did; behaviour is unchanged (upload, return uri + content digest).
  */
 export function createPublishArtifactCapability(
   executor: CloudExecutor = defaultCloudExecutor(),
 ): Capability<PublishArtifactInput, PublishArtifactOutput> {
-  return {
-    kind: "publish-artifact",
-    async run(_ctx, input) {
-      const localPath = archiveRelativePath(input.from);
-      const digest = `sha256:${createHash("sha256").update(readFileSync(localPath)).digest("hex")}`;
-      const basename = localPath.split("/").pop() ?? localPath;
-      const uri = input.to.endsWith("/") ? `${input.to}${basename}` : input.to;
-      await executor.s3.cp({ from: localPath, to: uri });
-      return { uri, digest };
-    },
-  };
+  return createCorePublishArtifact({ backends: [createS3StorageBackend(executor)] });
 }
 
-/** Default `publish-artifact` capability, backed by the real `CloudExecutor`. */
+/** Default `publish-artifact`, bound to the real executor; the registered verb is core's, with this lexicon's S3 backend injected. */
 export const publishArtifactCapability: Capability<PublishArtifactInput, PublishArtifactOutput> =
   createPublishArtifactCapability();
 
-/** Alias for `publish-artifact` — same capability, the docs/epic use both names for the same verb. */
+/** Alias for `publish-artifact`: same capability, the docs/epic use both names for the same verb. */
 export const publishAssetCapability = publishArtifactCapability;

package/src/import/parser.ts

@@ -112,7 +112,7 @@ const cfnYamlTypes = [
   }),
 ];
 
-const CF_SCHEMA = yaml.DEFAULT_SCHEMA.extend(cfnYamlTypes);
+export const CF_SCHEMA = yaml.DEFAULT_SCHEMA.extend(cfnYamlTypes);
 
 /**
  * CloudFormation template structure

package/src/plugin.ts

@@ -36,6 +36,7 @@ import { canDescribe, describeOwnProperties, stampRegion } from "./properties";
 import { stampProviderDefaults } from "./defaults";
 import { resolveTemplateAttrs } from "./live-attrs";
 import { CFParser } from "./import/parser";
+import { lastMemberReport, readCloudFormationMember, setLastMemberReport } from "./workspace-member";
 import { CFGenerator } from "./import/generator";
 import { parseStackTemplate } from "./import/live-export";
 import { awsCompletions } from "./lsp/completions";
@@ -65,6 +66,21 @@ const OWNERSHIP_UNRESOLVED_NOTE =
 export const awsPlugin: LexiconPlugin = {
   behaviourKinds: awsBehaviourKinds,
   name: "aws",
+  // A cloudformation workspace member's reader project (#3179): the template's
+  // resources as nodes, its Ref, GetAtt, Sub and DependsOn as edges. See
+  // ./workspace-member.ts.
+  async buildRoots(ctx) {
+    setLastMemberReport(undefined);
+    const member = (ctx.config as { aws?: { member?: { kind?: "cloudformation" | "cdk"; dir: string; label?: string } } }).aws?.member;
+    if (!member) return { entities: new Map() };
+    const read = readCloudFormationMember({ member });
+    setLastMemberReport(read.report);
+    return { entities: read.entities, warnings: read.warnings };
+  },
+  graphMeta() {
+    const report = lastMemberReport();
+    return report ? { awsMember: report } : undefined;
+  },
   // The thin read's marker channel is the STACK's own tags (#1998), read off
   // the DescribeStacks call it already makes for the outputs.
   // describe-stack-resources carries no per-resource tags, so the stack is the

package/src/testdata/cdk-member/cdk.json

@@ -0,0 +1 @@
+{"app": "npx ts-node bin/app.ts"}

package/src/testdata/cdk-member/cdk.out/AppStack.template.json

@@ -0,0 +1,20 @@
+{
+  "Resources": {
+    "QueueABC123": {
+      "Type": "AWS::SQS::Queue",
+      "Properties": { "VisibilityTimeout": 30 }
+    },
+    "HandlerRoleDEF456": {
+      "Type": "AWS::IAM::Role",
+      "Properties": { "AssumeRolePolicyDocument": { "Statement": [] } }
+    },
+    "HandlerGHI789": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Role": { "Fn::GetAtt": ["HandlerRoleDEF456", "Arn"] },
+        "Environment": { "Variables": { "QUEUE_URL": { "Ref": "QueueABC123" } } }
+      },
+      "DependsOn": ["HandlerRoleDEF456"]
+    }
+  }
+}

package/src/testdata/cdk-member/cdk.out/manifest.json

@@ -0,0 +1 @@
+{"version": "36.0.0", "artifacts": {}}

package/src/testdata/cdk-unsynthesized/cdk.json

@@ -0,0 +1 @@
+{"app": "npx ts-node bin/app.ts"}

package/src/testdata/cfn-member/README.txt

@@ -0,0 +1 @@
+not a template