@intentius/chant-lexicon-aws 0.14.0 → 0.15.0

package/dist/components/cloud-executor.d.ts

@@ -0,0 +1,350 @@
+/**
+ * Injectable cloud I/O boundary for the AWS-leaf capability implementations
+ * (#557, epic #551), living in the aws lexicon so a project's cloud verbs are
+ * contributed by its active lexicon rather than baked into core (see
+ * docs/components/cloud-boundary). Every AWS-leaf capability here goes through
+ * a `CloudExecutor` instead of shelling out directly, so:
+ *
+ *  - production code gets a real executor that shells out to the `aws` and
+ *    `docker` CLIs (this codebase shells out to native CLIs rather than
+ *    depending on AWS SDK v3 packages);
+ *  - tests get a `MockCloudExecutor` (./__tests__/mock-cloud-executor.ts) that
+ *    records calls and returns canned results — no live AWS, no live docker.
+ *
+ * The `docker` client is genuinely agnostic and shared: its type + real
+ * implementation (`realDocker`) come from core; only the AWS-specific clients
+ * (ECR, CloudFormation, ECS, CodeDeploy, Lambda, EMR, SSM host, S3, CloudFront,
+ * snapshot) are defined here.
+ */
+import { type DockerClient } from "@intentius/chant/components/verbs/cloud-executor";
+export type { DockerClient };
+export interface EcrClient {
+    /** Authenticate the local docker client against a registry (`aws ecr get-login-password | docker login`). */
+    login(registry: string): Promise<void>;
+}
+export interface CfnChange {
+    action: "Add" | "Modify" | "Remove" | "Import" | "Dynamic";
+    logicalResourceId: string;
+    resourceType: string;
+    /** True when CloudFormation must replace (destroy + recreate) this resource to apply the change. */
+    replacement: boolean;
+    /** Resource-specific detail, when the executor's changeset backend provides it (e.g. property/scope). */
+    details?: string[];
+}
+export interface CfnChangeSet {
+    changeSetName: string;
+    stackName: string;
+    status: string;
+    /** True the first time this stack is created (no prior stack exists). */
+    isCreate: boolean;
+    changes: CfnChange[];
+}
+export interface CfnCreateChangeSetArgs {
+    stackName: string;
+    templatePath: string;
+    parameters?: Record<string, string>;
+}
+export interface CfnExecuteChangeSetArgs {
+    stackName: string;
+    changeSetName: string;
+}
+export interface CfnStackStatus {
+    stackStatus: string;
+    outputs: Record<string, string>;
+}
+export interface CloudFormationClient {
+    /** Create (but do not execute) a changeset, returning its proposed changes for preview/safety checks. */
+    createChangeSet(args: CfnCreateChangeSetArgs): Promise<CfnChangeSet>;
+    /** Execute a previously created changeset. */
+    executeChangeSet(args: CfnExecuteChangeSetArgs): Promise<void>;
+    /** Delete a changeset without executing it (used when a safety policy blocks the apply). */
+    deleteChangeSet(args: CfnExecuteChangeSetArgs): Promise<void>;
+    /** Poll a stack until it reaches a terminal status (`*_COMPLETE`/`*_FAILED`), returning final status + outputs. */
+    waitForStack(stackName: string, opts?: {
+        intervalMs?: number;
+        timeoutMs?: number;
+    }): Promise<CfnStackStatus>;
+    /** Current stack status + outputs, without waiting. */
+    describeStack(stackName: string): Promise<CfnStackStatus>;
+    /** Trigger CloudFormation's native rollback-to-last-known-good-state for a stack (saga compensation). */
+    rollbackStack(stackName: string): Promise<void>;
+}
+export interface EcsUpdateServiceArgs {
+    cluster: string;
+    service: string;
+    taskDefinition?: string;
+    desiredCount?: number;
+    forceNewDeployment?: boolean;
+}
+export interface EcsServiceState {
+    runningCount: number;
+    desiredCount: number;
+    /** True once `runningCount === desiredCount` and no deployments are in flight. */
+    stable: boolean;
+}
+export interface EcsRunTaskArgs {
+    cluster: string;
+    /** Task definition family (`:revision` optional) to run. */
+    taskDefinition: string;
+    /** Container to apply the command override to. Defaults to the task def's single container when omitted. */
+    container?: string;
+    /** Command (argv) override — e.g. the migration runner's invocation. */
+    command?: string[];
+    /** Launch type. Default: "FARGATE". */
+    launchType?: "FARGATE" | "EC2";
+    /** awsvpc subnets (required for FARGATE). */
+    subnets?: string[];
+    /** awsvpc security groups. */
+    securityGroups?: string[];
+    /** Whether the task gets a public IP (needed for FARGATE tasks in a public subnet pulling images). Default: false. */
+    assignPublicIp?: boolean;
+}
+export interface EcsRunTaskResult {
+    /** Terminal task status (`STOPPED`). */
+    lastStatus: string;
+    /** Exit code of the (first) container, once the task has stopped; undefined if the container never started (e.g. image pull failure). */
+    exitCode: number | undefined;
+    /** Reason the task stopped, when it did not run to a clean container exit. */
+    stoppedReason?: string;
+}
+export interface EcsClient {
+    /** Roll a new task definition/desired count out to a service; returns the new deployment's id. */
+    updateService(args: EcsUpdateServiceArgs): Promise<{
+        deploymentId: string;
+    }>;
+    /** Current running/desired counts for a service, used by `wait-steady-state`. */
+    describeService(cluster: string, service: string): Promise<EcsServiceState>;
+    /** Roll a service back to a previously recorded task definition/count (saga compensation). */
+    rollbackService(args: EcsUpdateServiceArgs): Promise<void>;
+    /** Run a one-off task (e.g. a DB migration) and return its arn for `waitForTask`. */
+    runTask(args: EcsRunTaskArgs): Promise<{
+        taskArn: string;
+    }>;
+    /** Wait for a one-off task to stop, returning its terminal status and container exit code. */
+    waitForTask(cluster: string, taskArn: string): Promise<EcsRunTaskResult>;
+}
+export interface CodeDeployCreateArgs {
+    application: string;
+    deploymentGroup: string;
+    revision: {
+        type: "s3";
+        uri: string;
+    } | {
+        type: "github";
+        repository: string;
+        commitId: string;
+    };
+    strategy?: "in-place" | "blue-green";
+}
+export interface CodeDeployStatus {
+    status: string;
+    /** True for a terminal status (`Succeeded`, `Failed`, `Stopped`). */
+    terminal: boolean;
+}
+export interface CodeDeployClient {
+    /** Create a deployment of a revision to a deployment group; returns the deployment id. */
+    createDeployment(args: CodeDeployCreateArgs): Promise<{
+        deploymentId: string;
+    }>;
+    /** Poll a deployment until it reaches a terminal status. */
+    waitForDeployment(deploymentId: string, opts?: {
+        intervalMs?: number;
+        timeoutMs?: number;
+    }): Promise<CodeDeployStatus>;
+    /** Stop an in-flight deployment and roll the deployment group back to the last known-good revision (native auto-rollback, invoked as saga compensation). */
+    stopAndRollback(deploymentId: string): Promise<void>;
+}
+export interface HostCopyFileArgs {
+    /** Target host (SSM instance id, hostname, or host group — same identifier space as `copy-to-host`/`remote-exec`). */
+    host: string;
+    /** Source path of the file to copy (typically an archive-relative image tarball path). */
+    from: string;
+    /** Destination path on the host. */
+    to: string;
+}
+export interface HostDockerLoadArgs {
+    /** Target host the tarball was copied to. */
+    host: string;
+    /** Path of the tarball on the host (matches `HostCopyFileArgs.to`). */
+    path: string;
+}
+export interface HostClient {
+    /** Copy a file (an image tarball from the build archive) onto a host, via SSM Run Command / SCP-over-SSH depending on config — the same transport `copy-to-host` documents. */
+    copyFile(args: HostCopyFileArgs): Promise<void>;
+    /** Run `docker load` on the host against a previously copied tarball; returns the digest `docker load` reports, straight into the host's local Docker store (no registry involved). */
+    dockerLoad(args: HostDockerLoadArgs): Promise<{
+        digest: string;
+    }>;
+    /** Run a shell command on a host via SSM Run Command, waiting for it to finish; returns captured stdout and exit code (rejects on a non-zero SSM invocation). */
+    exec(args: {
+        host: string;
+        command: string;
+        cwd?: string;
+    }): Promise<{
+        stdout: string;
+        exitCode: number;
+    }>;
+}
+export interface LambdaUpdateCodeArgs {
+    functionName: string;
+    /** Container image URI (registry/repo@sha256:...) for an image-package Lambda. */
+    imageUri: string;
+}
+export interface LambdaPublishVersionArgs {
+    functionName: string;
+}
+export interface LambdaUpdateAliasArgs {
+    functionName: string;
+    alias: string;
+    version: string;
+}
+export interface LambdaClient {
+    /** Point the function at a new container image; returns the function ARN (unqualified). */
+    updateFunctionCode(args: LambdaUpdateCodeArgs): Promise<{
+        functionArn: string;
+    }>;
+    /** Wait for the function's last update to finish applying (`Successful`/`Failed`). */
+    waitForUpdate(functionName: string): Promise<{
+        status: string;
+    }>;
+    /** Publish an immutable numbered version from the function's current `$LATEST`. */
+    publishVersion(args: LambdaPublishVersionArgs): Promise<{
+        version: string;
+        functionArn: string;
+    }>;
+    /** Repoint a named alias at a published version (e.g. "live" -> "42"). */
+    updateAlias(args: LambdaUpdateAliasArgs): Promise<{
+        aliasArn: string;
+    }>;
+    /** Current published version an alias points at, so rollback can restore it. */
+    getAliasVersion(functionName: string, alias: string): Promise<string | undefined>;
+    /** Synchronously invoke a function (e.g. a migration runner) with an optional JSON payload; returns the status code, response payload text, and any function error. */
+    invoke(args: {
+        functionName: string;
+        payload?: string;
+    }): Promise<{
+        statusCode: number;
+        payload: string;
+        functionError?: string;
+    }>;
+}
+export interface EmrStartJobRunArgs {
+    /** EMR Serverless application id, or EMR-on-EC2 cluster id. */
+    clusterOrApplicationId: string;
+    /** Entry point artifact reference (resolved by the graph before this executor is called, e.g. an S3 URI). */
+    jar: string;
+    args?: string[];
+    executionRoleArn?: string;
+}
+export interface EmrJobRunStatus {
+    /** Terminal job state (`COMPLETED`, `FAILED`, `CANCELLED`), or an in-flight state (`RUNNING`, `PENDING`) while polling. */
+    state: string;
+}
+export interface EmrAddStepArgs {
+    /** EMR-on-EC2 cluster id to submit the step to. */
+    clusterId: string;
+    /** Step name (shown in the EMR console). */
+    name: string;
+    /** Jar the step runs — an S3 jar, or `command-runner.jar` with a `spark-submit …` arg list. */
+    jar: string;
+    args?: string[];
+    /** What EMR does if the step fails. Default: "CONTINUE". */
+    actionOnFailure?: "CONTINUE" | "CANCEL_AND_WAIT" | "TERMINATE_CLUSTER";
+}
+export interface EmrClient {
+    /** Start a job run (EMR Serverless application or EMR-on-EC2 cluster) against a published artifact; returns the run id for polling. */
+    startJobRun(args: EmrStartJobRunArgs): Promise<{
+        runId: string;
+    }>;
+    /** Submit a step to a long-running EMR-on-EC2 cluster; returns the step id for polling. */
+    addStep(args: EmrAddStepArgs): Promise<{
+        stepId: string;
+    }>;
+    /** Poll a job run until it reaches a terminal state (`COMPLETED`/`FAILED`/`CANCELLED`). */
+    waitForJobRun(runId: string, opts?: {
+        intervalMs?: number;
+        timeoutMs?: number;
+    }): Promise<EmrJobRunStatus>;
+    /** Current state of a job run, without waiting. */
+    describeJobRun(runId: string): Promise<EmrJobRunStatus>;
+    /** Cancel an in-flight job run (saga compensation). */
+    cancelJobRun(runId: string): Promise<void>;
+}
+/**
+ * The full injectable cloud I/O surface the AWS-leaf capabilities depend on.
+ * A capability module never imports `node:child_process`/an AWS SDK/`net`
+ * directly — it takes a `CloudExecutor` (defaulted to `realCloudExecutor()`
+ * at module scope, overridable via each capability family's
+ * `create*Capability(executor)` factory) so tests can swap in a full mock.
+ */
+export interface S3SyncArgs {
+    from: string;
+    to: string;
+    /** Delete destination keys not present in the source. */
+    delete?: boolean;
+}
+export interface S3Client {
+    /** `aws s3 sync from to [--delete]`; returns how many objects were uploaded/deleted. */
+    sync(args: S3SyncArgs): Promise<{
+        uploaded: number;
+        deleted: number;
+    }>;
+    /** `aws s3 cp from to` — upload a single local file to an S3 URI. */
+    cp(args: {
+        from: string;
+        to: string;
+    }): Promise<void>;
+}
+export interface CloudFrontInvalidateArgs {
+    distributionId: string;
+    paths: string[];
+}
+export interface CloudFrontClient {
+    /** `aws cloudfront create-invalidation`; returns the invalidation batch id. */
+    createInvalidation(args: CloudFrontInvalidateArgs): Promise<{
+        invalidationId: string;
+    }>;
+}
+export type SnapshotResourceKind = "dynamodb-table" | "rds-instance" | "opensearch-domain" | "ebs-volume";
+export interface SnapshotClient {
+    /** Take an on-demand snapshot/backup of a resource, dispatched by kind; returns the backup/snapshot identifier `rollback-previous` restores from. */
+    create(args: {
+        resource: string;
+        resourceKind: SnapshotResourceKind;
+    }): Promise<{
+        snapshotId: string;
+    }>;
+    /** Restore a resource from a prior snapshot/backup, dispatched by the snapshot-id shape (DynamoDB/RDS ARN); waits for the restore to become available. */
+    restore(args: {
+        resource: string;
+        snapshotId: string;
+    }): Promise<void>;
+}
+export interface CloudExecutor {
+    docker: DockerClient;
+    ecr: EcrClient;
+    cloudformation: CloudFormationClient;
+    ecs: EcsClient;
+    codeDeploy: CodeDeployClient;
+    lambda: LambdaClient;
+    emr: EmrClient;
+    host: HostClient;
+    s3: S3Client;
+    cloudfront: CloudFrontClient;
+    snapshot: SnapshotClient;
+}
+/**
+ * Inject `--endpoint-url` into an `aws …` command when an endpoint is set, so the
+ * same component can target a local AWS emulator (Floci, LocalStack, …) or any
+ * custom endpoint without a wrapper. We add the flag ourselves rather than rely
+ * on the CLI reading `AWS_ENDPOINT_URL` — older `aws` v2 releases (<2.13) don't.
+ * Non-`aws` commands (docker, …) pass through untouched.
+ */
+export declare function applyAwsEndpoint(command: string, endpoint: string | undefined): string;
+/** Build a `CloudExecutor` that shells out to real `docker`/`aws` CLIs and probes real bolt ports. Never used in tests. */
+export declare function realCloudExecutor(): CloudExecutor;
+/** The default `CloudExecutor` each capability factory falls back to when none is supplied. */
+export declare function defaultCloudExecutor(): CloudExecutor;
+/** Sleep for `ms`. Shared by every polling capability (`wait-*`) between attempts. */
+export declare function sleep(ms: number): Promise<void>;
+//# sourceMappingURL=cloud-executor.d.ts.map

package/dist/components/cloud-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-executor.d.ts","sourceRoot":"","sources":["../../src/components/cloud-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,kDAAkD,CAAC;AAGjG,YAAY,EAAE,YAAY,EAAE,CAAC;AAM7B,MAAM,WAAW,SAAS;IACxB,6GAA6G;IAC7G,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAID,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,WAAW,EAAE,OAAO,CAAC;IACrB,yGAAyG;IACzG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,SAAS,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,yGAAyG;IACzG,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACrE,8CAA8C;IAC9C,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,4FAA4F;IAC5F,eAAe,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,mHAAmH;IACnH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7G,uDAAuD;IACvD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1D,yGAAyG;IACzG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAID,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,cAAc,EAAE,MAAM,CAAC;IACvB,4GAA4G;IAC5G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,uCAAuC;IACvC,UAAU,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;IAC/B,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,8BAA8B;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,sHAAsH;IACtH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,yIAAyI;IACzI,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,kGAAkG;IAClG,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,iFAAiF;IACjF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5E,8FAA8F;IAC9F,eAAe,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,qFAAqF;IACrF,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,8FAA8F;IAC9F,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC1E;AAID,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACjG,QAAQ,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChF,4DAA4D;IAC5D,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACvH,4JAA4J;IAC5J,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAID,MAAM,WAAW,gBAAgB;IAC/B,sHAAsH;IACtH,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,kBAAkB;IACjC,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,+KAA+K;IAC/K,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,uLAAuL;IACvL,UAAU,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,iKAAiK;IACjK,IAAI,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5G;AAID,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,2FAA2F;IAC3F,kBAAkB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjF,sFAAsF;IACtF,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,mFAAmF;IACnF,cAAc,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClG,0EAA0E;IAC1E,WAAW,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,gFAAgF;IAChF,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAClF,uKAAuK;IACvK,MAAM,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpI;AAID,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,sBAAsB,EAAE,MAAM,CAAC;IAC/B,6GAA6G;IAC7G,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,2HAA2H;IAC3H,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,4DAA4D;IAC5D,eAAe,CAAC,EAAE,UAAU,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;CACxE;AAED,MAAM,WAAW,SAAS;IACxB,uIAAuI;IACvI,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,2FAA2F;IAC3F,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,2FAA2F;IAC3F,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3G,mDAAmD;IACnD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACxD,uDAAuD;IACvD,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAID;;;;;;GAMG;AAGH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,yDAAyD;IACzD,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,wFAAwF;IACxF,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE,qEAAqE;IACrE,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,kBAAkB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAID,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,GAAG,cAAc,GAAG,mBAAmB,GAAG,YAAY,CAAC;AAE1G,MAAM,WAAW,cAAc;IAC7B,qJAAqJ;IACrJ,MAAM,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,oBAAoB,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxG,0JAA0J;IAC1J,OAAO,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,SAAS,CAAC;IACf,cAAc,EAAE,oBAAoB,CAAC;IACrC,GAAG,EAAE,SAAS,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,EAAE,SAAS,CAAC;IACf,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,QAAQ,CAAC;IACb,UAAU,EAAE,gBAAgB,CAAC;IAC7B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAID;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAGtF;AAwbD,2HAA2H;AAC3H,wBAAgB,iBAAiB,IAAI,aAAa,CAcjD;AAKD,+FAA+F;AAC/F,wBAAgB,oBAAoB,IAAI,aAAa,CAGpD;AAED,sFAAsF;AACtF,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C"}

package/dist/components/config-bom.d.ts

@@ -0,0 +1,135 @@
+/**
+ * `extract-config-bom` capability (#613, epic #551 follow-up to #606).
+ *
+ * chant synthesis is deterministic, so a synthesized IaC template (the
+ * CloudFormation JSON `chant build` already produces — see ../../build.ts
+ * and lexicons/aws/src/serializer.ts's `CFTemplate`) is itself a
+ * reproducible artifact with a legitimate bill-of-materials: it declares
+ * resources, may nest child stacks, and references external artifacts
+ * (container image digests, AMI ids, other lexicons' versions) that are not
+ * declared dependencies in any lockfile. This module is the config-BOM
+ * analogue of ./sbom.ts's `generate-sbom`: same archive/manifest wiring,
+ * same SPDX/CycloneDX writer (./bom-writer.ts), different subject (a
+ * template's structure instead of a lockfile's package list).
+ *
+ * **Scope.** The extractor is a pure, hermetic AST-ish walk over the
+ * template's already-parsed JSON — no cloud calls, no `cfn describe-stacks`,
+ * no network. It only reads chant's own synthesized output, so it works
+ * identically for any lexicon whose serializer emits a JSON document shaped
+ * like CloudFormation's `{ Resources: { name: { Type, Properties } } }` (the
+ * ../../serializer.ts `SerializerResult.primary`/`files` convention every
+ * lexicon serializer already produces). Non-JSON serializer output (a raw
+ * Kubernetes YAML manifest, say) is out of scope for this first cut — see
+ * `extractConfigBom`'s doc comment.
+ *
+ * **Why config-only/infra components get a BOM.** #606 shipped
+ * `generate-sbom` keyed to *artifact* types (image/jar/zip/dir); a
+ * config-only component (no `build` phase, e.g. a DynamoDB table or an EMR
+ * cluster definition — see epic #551's "Infra" archetype) has none of those
+ * and so was previously assumed to have nothing to attach a BOM to. That
+ * assumption undercounts what's true: the synthesized template *is* that
+ * component's build output. Treating it as a first-class archive artifact
+ * (a `template`-kind entry with its own content digest, peer to `image`/
+ * `asset` — see ./build-archive.ts's `addArchiveTemplate`) means a
+ * config-BOM can attach to it exactly the way a software SBOM attaches to
+ * an image digest, closing the gap.
+ */
+import type { Capability } from "@intentius/chant/components/capability";
+import { type BuildArchiveManifest } from "@intentius/chant/components/verbs/build-archive";
+import { type BomPackage } from "@intentius/chant/components/verbs/bom-writer";
+import { type SbomDocument, type SbomFormat } from "@intentius/chant/components/verbs/sbom-generator";
+/** One external reference a template's resources point at — an image digest, an AMI id, or another lexicon's declared version. Enumerated separately from declared resources since these aren't things chant itself owns/synthesizes. */
+export interface ExternalReference {
+    kind: "image-digest" | "ami" | "lexicon-version";
+    /** The reference value itself (a digest, an AMI id, a version string). */
+    value: string;
+    /** Logical resource name the reference was found on, when known. */
+    resourceName?: string;
+}
+/** One nested stack/module a template references (an `AWS::CloudFormation::Stack` resource, or the equivalent nesting concept in another lexicon). */
+export interface NestedStackReference {
+    /** Logical name of the nesting resource in the parent template. */
+    resourceName: string;
+    /** Referenced child template's filename/path, when the parent's `Properties` names one (e.g. CFN's `TemplateURL`). */
+    templatePath?: string;
+}
+/** Structural summary produced by walking a synthesized template — the data `extractConfigBom` projects into a `BomPackage[]` for the SPDX/CycloneDX writer. */
+export interface ConfigBomInventory {
+    /** Every declared resource, keyed by logical name, with its CFN-style `Type` (e.g. `"AWS::S3::Bucket"`). */
+    resources: Array<{
+        name: string;
+        type: string;
+    }>;
+    /** Nested stacks/modules this template declares. */
+    nestedStacks: NestedStackReference[];
+    /** External artifacts referenced by any resource (image digests, AMIs, lexicon versions). */
+    externalReferences: ExternalReference[];
+}
+/**
+ * Walk a synthesized template's parsed JSON, enumerating declared resources,
+ * nested stack/module references, and external artifact references (image
+ * digests, AMI ids, lexicon versions found in resource properties).
+ *
+ * Deliberately structural, not semantic: this never talks to AWS/any cloud
+ * to resolve what an AMI id or image digest actually *is* — it only records
+ * that a resource's properties reference one, the same "surface the
+ * reference, don't interpret it" stance ./sbom-generator.ts's module doc
+ * takes for SBOM content generally.
+ */
+export declare function inventoryTemplate(templateJson: string): ConfigBomInventory;
+/** Project a `ConfigBomInventory` into the standard-agnostic `BomPackage[]` shape ./bom-writer.ts's writers consume. Every declared resource becomes a `type: "config"` component; every external reference becomes a `type: "external-reference"` component, so a config-BOM reader sees "what chant declared" and "what chant points at but doesn't own" as distinguishable entries rather than a flat, ambiguous list. */
+export declare function inventoryToBomPackages(inventory: ConfigBomInventory): BomPackage[];
+export interface ExtractConfigBomInput {
+    /** Archive-relative (or local) path to the synthesized template being scanned — the `template` archive entry's `path`. An `archive:`-prefixed reference is accepted and stripped, matching `generate-sbom`'s `path` convention. */
+    path: string;
+    /** Serialized template content (the same bytes `addArchiveTemplate`, ./build.ts, was/will be given) — this capability never reads from disk itself, keeping it pure/hermetic and testable with an in-memory fixture. */
+    content: string;
+    /** Digest of the `template` archive entry this config-BOM describes (see ./build-archive.ts's `contentDigest`). Omitted when scanning a template ahead of it being archived. */
+    digest?: string;
+    /** BOM format to emit. Defaults to `DEFAULT_SBOM_FORMAT` (SPDX), same precedence story as `generate-sbom` (see ../../config.ts's `resolveSbomFormat`). */
+    format?: SbomFormat;
+    /** Where the config-BOM document is written inside the build archive. Defaults to `<path>.config-bom.json`. */
+    into?: string;
+    /** Manifest to extend, so a component's whole build phase (template + config-BOM, alongside any image + software SBOM) accumulates one manifest — same accumulation convention as `generate-sbom`'s `manifest` input. */
+    manifest?: BuildArchiveManifest;
+    /** Directory to also write the config-BOM document to on disk, mirroring the software SBOM's `sbom.<format>.json` convention (see ./lockfile-sbom-generator.ts's `sbomOutputPath`). Omitted: archive-only, no disk write (useful in tests). */
+    outDir?: string;
+    /** Clock override for deterministic tests. */
+    now?: () => Date;
+}
+export interface ExtractConfigBomOutput {
+    /** The generated config-BOM document (format, media type, bytes, package count, generator — reuses `SbomDocument`'s shape since a config-BOM is structurally the same kind of document as a software SBOM). */
+    bom: SbomDocument;
+    /** Structural inventory this config-BOM was derived from — resources, nested stacks, external references — surfaced directly so a caller/test can assert on template structure without re-parsing the BOM bytes. */
+    inventory: ConfigBomInventory;
+    /** Where the config-BOM was written inside the build archive. */
+    archivePath: string;
+    /** Content-addressed digest of the config-BOM document's own bytes. */
+    digest: string;
+    /** The build archive's manifest, now including this config-BOM's entry (`kind: "sbom"`, `bomKind: "config"`) alongside whatever `input.manifest` already held. */
+    manifest: BuildArchiveManifest;
+}
+/**
+ * Extract a config-BOM from a synthesized IaC template's declared resources,
+ * nested stacks, and external references, and fold the result into the
+ * build-archive manifest as an `sbom`-kind entry (`bomKind: "config"`) linked
+ * to the template artifact's digest — the config-BOM peer of `generate-sbom`
+ * (./sbom.ts). No rollback, for the same reason `generate-sbom` declares
+ * none: an already-generated, content-addressed BOM is evidence, not mutable
+ * state to compensate.
+ */
+export declare function createExtractConfigBomCapability(): Capability<ExtractConfigBomInput, ExtractConfigBomOutput>;
+/**
+ * Default `extract-config-bom` capability. Pure/hermetic — no injectable
+ * backend needed since template inventory is a structural walk, not a scan
+ * requiring an external tool.
+ *
+ * Typically composed immediately after `addArchiveTemplate` (./build.ts) in
+ * a config-only/infra component's build phase — `addArchiveTemplate` folds
+ * the synthesized template into the archive as a first-class `template`-kind
+ * entry with its own content digest (#613 — IaC as a first-class build
+ * artifact, peer to `image`/`jar`), and this capability attaches the
+ * resulting config-BOM to that same digest.
+ */
+export declare const extractConfigBomCapability: Capability<ExtractConfigBomInput, ExtractConfigBomOutput>;
+//# sourceMappingURL=config-bom.d.ts.map

package/dist/components/config-bom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-bom.d.ts","sourceRoot":"","sources":["../../src/components/config-bom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EAAY,KAAK,UAAU,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAuB,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,kDAAkD,CAAC;AAgB3H,yOAAyO;AACzO,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,GAAG,KAAK,GAAG,iBAAiB,CAAC;IACjD,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,sJAAsJ;AACtJ,MAAM,WAAW,oBAAoB;IACnC,mEAAmE;IACnE,YAAY,EAAE,MAAM,CAAC;IACrB,sHAAsH;IACtH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,gKAAgK;AAChK,MAAM,WAAW,kBAAkB;IACjC,4GAA4G;IAC5G,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,oDAAoD;IACpD,YAAY,EAAE,oBAAoB,EAAE,CAAC;IACrC,6FAA6F;IAC7F,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;CACzC;AA4DD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAkB1E;AAED,6ZAA6Z;AAC7Z,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,kBAAkB,GAAG,UAAU,EAAE,CAmBlF;AAID,MAAM,WAAW,qBAAqB;IACpC,mOAAmO;IACnO,IAAI,EAAE,MAAM,CAAC;IACb,wNAAwN;IACxN,OAAO,EAAE,MAAM,CAAC;IAChB,gLAAgL;IAChL,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0JAA0J;IAC1J,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,+GAA+G;IAC/G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yNAAyN;IACzN,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,+OAA+O;IAC/O,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,+MAA+M;IAC/M,GAAG,EAAE,YAAY,CAAC;IAClB,oNAAoN;IACpN,SAAS,EAAE,kBAAkB,CAAC;IAC9B,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,kKAAkK;IAClK,QAAQ,EAAE,oBAAoB,CAAC;CAChC;AAUD;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,IAAI,UAAU,CAAC,qBAAqB,EAAE,sBAAsB,CAAC,CA2C5G;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,EAAE,UAAU,CAAC,qBAAqB,EAAE,sBAAsB,CAC7D,CAAC"}

package/dist/components/host-delivery.d.ts

@@ -0,0 +1,110 @@
+/**
+ * host / code delivery family — run against a mutable host.
+ *
+ * `code-deploy` (AWS CodeDeploy) is the managed, nearly AWS-only leaf: create
+ * a deployment of a revision (S3/GitHub) to a deployment group, appspec-driven
+ * lifecycle hooks (BeforeInstall/AfterInstall/ApplicationStart/ValidateService),
+ * in-place or blue/green, native automatic rollback, wait for terminal status.
+ * Pairs with `publish-artifact` — the revision is the published S3 bundle
+ * (`@publish.uri`).
+ *
+ * `copy-to-host` / `remote-exec` (SSM Run Command or SSH) are the portable,
+ * lower-level generic verbs for host bootstrap, on-host migrations, and
+ * single-host compose where CodeDeploy is not used or not available
+ * (no clean Azure/GCP peer — see docs/components/cloud-boundary).
+ *
+ * `code-deploy` is a real implementation (#557, epic #551) over the
+ * injectable `CloudExecutor` (./cloud-executor.ts) — the capability the
+ * Neo4j fan-out pilot uses once per instance. `copy-to-host` and `remote-exec`
+ * are also real, over the executor's `host.exec` (SSM Run Command, waited to
+ * completion); the SSH transport is not yet implemented.
+ */
+import type { Capability } from "@intentius/chant/components/capability";
+import { type CloudExecutor } from "./cloud-executor.js";
+export interface CodeDeployInput {
+    /** CodeDeploy application name. Default: derived from `ctx.component` when omitted (per-instance fan-out steps, e.g. the Neo4j pilot, don't repeat it per node). */
+    application?: string;
+    /** CodeDeploy deployment group name. Default: `<application>-<instance>` when `instance` is given, else `<application>`. */
+    deploymentGroup?: string;
+    /**
+     * Revision location — an S3 bundle (typically `"@publish.uri"`), a GitHub
+     * reference, or a bare wired string (e.g. `"@Seed.templateUri"`, as the
+     * Neo4j pilot passes) treated as an S3 URI shorthand.
+     */
+    revision: {
+        type: "s3";
+        uri: string;
+    } | {
+        type: "github";
+        repository: string;
+        commitId: string;
+    } | string;
+    /** Deployment strategy. Default: "in-place". */
+    strategy?: "in-place" | "blue-green";
+    /** Cluster-relative instance index, for a per-instance fan-out step (e.g. one Neo4j node). Folded into the deployment group name when `deploymentGroup` is not given explicitly. */
+    instance?: number;
+}
+export interface CodeDeployOutput {
+    /** CodeDeploy deployment id, for polling terminal status. */
+    deploymentId: string;
+    /** Terminal deployment status once complete (`Succeeded`, `Failed`, `Stopped`). */
+    status: string;
+}
+/**
+ * Deploy a revision to a host (fleet) via AWS CodeDeploy: create the
+ * deployment, then wait for a terminal status. Rollback re-invokes
+ * `stopAndRollback` against the deployment id this step created (captured in
+ * a closure-scoped map keyed by application/deploymentGroup, since the
+ * driver's saga rollback calls `rollback(ctx, sameInput)` rather than passing
+ * `run`'s output) — riding CodeDeploy's own native automatic rollback to the
+ * last known-good revision rather than a chant-scripted compensation, the
+ * "auto" rollback style the Neo4j pilot's docs comment contrasts with the
+ * ALB/ECS pilot's component-declared one.
+ */
+export declare function createCodeDeployCapability(executor?: CloudExecutor): Capability<CodeDeployInput, CodeDeployOutput>;
+/** Default `code-deploy` capability, backed by the real `CloudExecutor`. */
+export declare const codeDeployCapability: Capability<CodeDeployInput, CodeDeployOutput>;
+export interface CopyToHostInput {
+    /** Source path (local, or archive-relative reference). */
+    from: string;
+    /** Target host (SSM instance id, hostname, or host group). */
+    host: string;
+    /** Destination path on the host. */
+    to: string;
+}
+export interface CopyToHostOutput {
+    /** Number of bytes copied. */
+    bytesCopied: number;
+}
+/**
+ * Copy a file to a host via SSM Run Command: the host pulls `from` (an S3 URI)
+ * to `to` with `aws s3 cp`, then `stat`s the result for the byte count. `from`
+ * must be reachable from the host (typically a prior `publish-artifact`'s URI).
+ */
+export declare function createCopyToHostCapability(executor?: CloudExecutor): Capability<CopyToHostInput, CopyToHostOutput>;
+/** Default `copy-to-host` capability, backed by the real `CloudExecutor`. */
+export declare const copyToHostCapability: Capability<CopyToHostInput, CopyToHostOutput>;
+export interface RemoteExecInput {
+    /** Target host (SSM instance id, hostname, or host group). */
+    host: string;
+    /** Command to run on the host. */
+    command: string;
+    /** Working directory on the host. */
+    cwd?: string;
+    /** Transport. Default: "ssm". */
+    via?: "ssm" | "ssh";
+}
+export interface RemoteExecOutput {
+    /** Process exit code. */
+    exitCode: number;
+    /** Captured stdout. */
+    stdout: string;
+}
+/**
+ * Run a command on a remote host via SSM Run Command, waiting for it to finish
+ * and returning its stdout + exit code. SSH transport is not yet supported.
+ */
+export declare function createRemoteExecCapability(executor?: CloudExecutor): Capability<RemoteExecInput, RemoteExecOutput>;
+/** Default `remote-exec` capability, backed by the real `CloudExecutor`. */
+export declare const remoteExecCapability: Capability<RemoteExecInput, RemoteExecOutput>;
+//# sourceMappingURL=host-delivery.d.ts.map

package/dist/components/host-delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-delivery.d.ts","sourceRoot":"","sources":["../../src/components/host-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAI5E,MAAM,WAAW,eAAe;IAC9B,oKAAoK;IACpK,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4HAA4H;IAC5H,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,EAAE;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IAC1G,gDAAgD;IAChD,QAAQ,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;IACrC,oLAAoL;IACpL,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAsBD;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,GAAE,aAAsC,GAC/C,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAC,CA2B/C;AAED,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAgC,CAAC;AAIhH,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,GAAE,aAAsC,GAAG,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAY1I;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAgC,CAAC;AAIhH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,GAAE,aAAsC,GAAG,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAW1I;AAED,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAgC,CAAC"}

package/dist/components/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The aws lexicon's component/release surface: the AWS-leaf capabilities, their
+ * typed step-builders, the injectable aws `CloudExecutor`, and the
+ * `awsCapabilityPlugin` core loads when a project declares `lexicons: ["aws"]`.
+ * Component authors import the AWS verbs' builders from here
+ * (`@intentius/chant-lexicon-aws/components`), the way agnostic verbs come from
+ * `@intentius/chant/components`.
+ */
+export { awsCapabilityPlugin, AWS_VERB_FAMILIES } from "./capability-plugin.js";
+export * from "./builders.js";
+export * from "./config-bom.js";
+export * from "./apply.js";
+export * from "./job-submission.js";
+export * from "./host-delivery.js";
+export * from "./safety.js";
+export * from "./wait-aws.js";
+export * from "./publish.js";
+export * from "./cloud-executor.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/components/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC"}