@intentius/chant-lexicon-aws 0.45.0 → 0.49.0

package/src/composites/dynamodb-table.ts

@@ -0,0 +1,124 @@
+import { Composite, mergeDefaults, type Value } from "@intentius/chant";
+import {
+  Table,
+  Table_AttributeDefinition,
+  Table_KeySchema,
+  Table_GlobalSecondaryIndex,
+  Table_Projection,
+  Table_ProvisionedThroughput,
+  Table_StreamSpecification,
+  Table_TimeToLiveSpecification,
+} from "../generated";
+
+export interface DynamoDBKey {
+  name: string;
+  type?: "S" | "N" | "B";
+}
+
+export interface DynamoDBCapacity {
+  readCapacity: number;
+  writeCapacity: number;
+}
+
+export interface DynamoDBGlobalSecondaryIndex {
+  name: string;
+  partitionKey: DynamoDBKey;
+  sortKey?: DynamoDBKey;
+  /** Defaults to "ALL" — projecting the whole item is the common case; narrow it deliberately. */
+  projectionType?: "ALL" | "KEYS_ONLY" | "INCLUDE";
+  /** Only meaningful with projectionType "INCLUDE". */
+  nonKeyAttributes?: string[];
+  /** PROVISIONED tables only. Falls back to the table's own capacity when a GSI doesn't need its own. */
+  provisionedThroughput?: DynamoDBCapacity;
+}
+
+export interface DynamoDBTableProps {
+  /** `Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366). */
+  tableName?: Value<string>;
+  partitionKey: DynamoDBKey;
+  sortKey?: DynamoDBKey;
+  /** Defaults to "PAY_PER_REQUEST" — the recommended default for most workloads (matches LambdaDynamoDB). */
+  billingMode?: "PAY_PER_REQUEST" | "PROVISIONED";
+  /** Required when billingMode is "PROVISIONED"; ignored otherwise. Falls back to 5/5 (the DynamoDB console default) if omitted. */
+  provisionedThroughput?: DynamoDBCapacity;
+  globalSecondaryIndexes?: DynamoDBGlobalSecondaryIndex[];
+  /** Attribute name that carries the expiry timestamp. Enables TimeToLiveSpecification when set. */
+  ttlAttribute?: string;
+  /** Enables StreamSpecification. `true` defaults to NEW_AND_OLD_IMAGES (the shape most stream consumers want). */
+  stream?: boolean | { viewType?: "NEW_IMAGE" | "OLD_IMAGE" | "NEW_AND_OLD_IMAGES" | "KEYS_ONLY" };
+  defaults?: {
+    table?: Partial<ConstructorParameters<typeof Table>[0]>;
+  };
+}
+
+const DEFAULT_CAPACITY: DynamoDBCapacity = { readCapacity: 5, writeCapacity: 5 };
+
+function toProvisionedThroughput(capacity: DynamoDBCapacity): InstanceType<typeof Table_ProvisionedThroughput> {
+  return new Table_ProvisionedThroughput({
+    ReadCapacityUnits: capacity.readCapacity,
+    WriteCapacityUnits: capacity.writeCapacity,
+  });
+}
+
+function toKeySchema(partitionKey: DynamoDBKey, sortKey?: DynamoDBKey): InstanceType<typeof Table_KeySchema>[] {
+  // A ternary (not an `if`) keeps the `new`s unconditional per EVL002, and
+  // returning array literals directly from each branch — no spread — sidesteps
+  // EVL004 (outside a Composite factory, EVL004 only traces a spread source to a
+  // module-top-level const or a literal, not a local variable).
+  const partitionEntry = new Table_KeySchema({ AttributeName: partitionKey.name, KeyType: "HASH" });
+  const sortEntry = sortKey ? new Table_KeySchema({ AttributeName: sortKey.name, KeyType: "RANGE" }) : undefined;
+  return sortEntry ? [partitionEntry, sortEntry] : [partitionEntry];
+}
+
+export const DynamoDBTable = Composite((props: DynamoDBTableProps) => {
+  const billingMode = props.billingMode ?? "PAY_PER_REQUEST";
+  const { defaults } = props;
+
+  // Every key attribute used anywhere (table keys + every GSI's keys) needs exactly
+  // one AttributeDefinition. A Map dedupes by name so a GSI reusing the table's
+  // partition key (a common pattern) doesn't produce a duplicate definition.
+  const attributeTypes = new Map<string, "S" | "N" | "B">();
+  attributeTypes.set(props.partitionKey.name, props.partitionKey.type ?? "S");
+  if (props.sortKey) attributeTypes.set(props.sortKey.name, props.sortKey.type ?? "S");
+  for (const gsi of props.globalSecondaryIndexes ?? []) {
+    attributeTypes.set(gsi.partitionKey.name, gsi.partitionKey.type ?? "S");
+    if (gsi.sortKey) attributeTypes.set(gsi.sortKey.name, gsi.sortKey.type ?? "S");
+  }
+  const attributeDefinitions = [...attributeTypes.entries()].map(
+    ([AttributeName, AttributeType]) => new Table_AttributeDefinition({ AttributeName, AttributeType }),
+  );
+
+  const globalSecondaryIndexes = (props.globalSecondaryIndexes ?? []).map((gsi) => new Table_GlobalSecondaryIndex({
+    IndexName: gsi.name,
+    KeySchema: toKeySchema(gsi.partitionKey, gsi.sortKey),
+    Projection: new Table_Projection({
+      ProjectionType: gsi.projectionType ?? "ALL",
+      ...(gsi.nonKeyAttributes ? { NonKeyAttributes: gsi.nonKeyAttributes } : {}),
+    }),
+    ...(billingMode === "PROVISIONED"
+      ? { ProvisionedThroughput: toProvisionedThroughput(gsi.provisionedThroughput ?? props.provisionedThroughput ?? DEFAULT_CAPACITY) }
+      : {}),
+  }));
+
+  const streamConfig = props.stream === true ? {} : props.stream || undefined;
+  const ttlEnabled = props.ttlAttribute !== undefined;
+
+  const table = new Table(mergeDefaults({
+    TableName: props.tableName,
+    BillingMode: billingMode,
+    AttributeDefinitions: attributeDefinitions,
+    KeySchema: toKeySchema(props.partitionKey, props.sortKey),
+    ...(globalSecondaryIndexes.length > 0 ? { GlobalSecondaryIndexes: globalSecondaryIndexes } : {}),
+    ...(billingMode === "PROVISIONED"
+      ? { ProvisionedThroughput: toProvisionedThroughput(props.provisionedThroughput ?? DEFAULT_CAPACITY) }
+      : {}),
+    ...(streamConfig
+      ? { StreamSpecification: new Table_StreamSpecification({ StreamViewType: streamConfig.viewType ?? "NEW_AND_OLD_IMAGES" }) }
+      : {}),
+    ...(ttlEnabled
+      ? { TimeToLiveSpecification: new Table_TimeToLiveSpecification({ Enabled: true, AttributeName: props.ttlAttribute }) }
+      : {}),
+  }, defaults?.table));
+
+  return { table };
+}, "DynamoDBTable");

package/src/composites/ec2-instance-bundle.ts

@@ -0,0 +1,134 @@
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { Instance, InstanceProfile, Role, SecurityGroup, SecurityGroup_Ingress } from "../generated";
+import { Base64, Ref } from "../intrinsics";
+
+const EC2_ASSUME_ROLE = {
+  Version: "2012-10-17" as const,
+  Statement: [
+    {
+      Effect: "Allow" as const,
+      Principal: { Service: "ec2.amazonaws.com" },
+      Action: "sts:AssumeRole",
+    },
+  ],
+};
+
+/**
+ * One inbound rule for the instance's security group. Exactly one of `cidr`,
+ * `cidrIpv6`, or `sourceSecurityGroupId` selects the traffic source — the same
+ * constraint CloudFormation enforces on `AWS::EC2::SecurityGroup.Ingress`.
+ */
+export interface Ec2InstanceBundleIngressRule {
+  /** Starting port (or the only port, when `toPort` is omitted). */
+  fromPort: number;
+  /** Ending port of the range. Defaults to `fromPort` (a single port). */
+  toPort?: number;
+  /** IP protocol. Default: `"tcp"`. */
+  protocol?: string;
+  /** IPv4 CIDR source. */
+  cidr?: string;
+  /** IPv6 CIDR source. */
+  cidrIpv6?: string;
+  /** Security-group source (allow traffic from another SG rather than a CIDR). */
+  sourceSecurityGroupId?: string;
+  description?: string;
+}
+
+export interface Ec2InstanceBundleProps {
+  /** AMI id to launch. */
+  imageId: string;
+  /** VPC the instance and its security group live in. */
+  vpcId: string;
+  /** Subnet the instance launches into — fixes its AZ and public/private placement. */
+  subnetId: string;
+  /** EC2 instance type. Default: `"t3.micro"`. */
+  instanceType?: string;
+  /** SSH key pair name. Omit for keyless access (e.g. SSM Session Manager only). */
+  keyName?: string;
+  /** Plain-text user-data script; wrapped in `Fn::Base64` for the instance. */
+  userData?: string;
+  /** Inbound security-group rules. Default: none (no inbound traffic). */
+  ingress?: Ec2InstanceBundleIngressRule[];
+  /** IAM managed policy ARNs attached to the instance role. */
+  ManagedPolicyArns?: string[];
+  /** Inline IAM policies attached to the instance role. */
+  Policies?: ConstructorParameters<typeof Role>[0]["Policies"];
+  defaults?: {
+    role?: Partial<ConstructorParameters<typeof Role>[0]>;
+    instanceProfile?: Partial<ConstructorParameters<typeof InstanceProfile>[0]>;
+    sg?: Partial<ConstructorParameters<typeof SecurityGroup>[0]>;
+    instance?: Partial<ConstructorParameters<typeof Instance>[0]>;
+  };
+}
+
+// A rule needs exactly one traffic source. Kept as a lookup (not an if/else
+// chain that builds the `SecurityGroup_Ingress` inline) so the `new` stays out
+// of control flow (EVL002).
+function ingressSource(rule: Ec2InstanceBundleIngressRule): Partial<Pick<
+  ConstructorParameters<typeof SecurityGroup_Ingress>[0],
+  "CidrIp" | "CidrIpv6" | "SourceSecurityGroupId"
+>> {
+  if (rule.cidr) return { CidrIp: rule.cidr };
+  if (rule.cidrIpv6) return { CidrIpv6: rule.cidrIpv6 };
+  if (rule.sourceSecurityGroupId) return { SourceSecurityGroupId: rule.sourceSecurityGroupId };
+  throw new Error(
+    `Ec2InstanceBundle ingress rule for port ${rule.fromPort} needs one of cidr, cidrIpv6, or sourceSecurityGroupId`,
+  );
+}
+
+/**
+ * EC2 instance bundle — instance + security group + role/profile + subnet
+ * placement, the hand-rolled unit the aws-bench corpus showed 25 times
+ * (`ec2.Instance`) alongside 79 `ec2.SecurityGroup` instantiations (#1139).
+ * `Ec2InstanceRole` already covers the role/profile half; this composite adds
+ * the instance and its security group, wired to that same role.
+ */
+export const Ec2InstanceBundle = Composite((props: Ec2InstanceBundleProps) => {
+  const { defaults } = props;
+  const instanceType = props.instanceType ?? "t3.micro";
+  const ingress = props.ingress ?? [];
+
+  const role = new Role(mergeDefaults({
+    AssumeRolePolicyDocument: EC2_ASSUME_ROLE,
+    ManagedPolicyArns: props.ManagedPolicyArns ?? [],
+    Policies: props.Policies ?? [],
+  }, defaults?.role));
+
+  const instanceProfile = new InstanceProfile(mergeDefaults({
+    Roles: [Ref(role)],
+  }, defaults?.instanceProfile));
+
+  // The list-length is dynamic (a caller-supplied array of rules, unlike the
+  // fixed one-or-zero-rule shape RdsInstance's ternary handles), so this
+  // `.map()` — and the `ingressSource(rule)` spread inside it — has to live
+  // in the factory rather than be pre-computed as a const above it. Both are
+  // the accepted, already-shipped shape for this in the codebase: EVL004
+  // exempts spreads inside the Composite factory precisely for this case,
+  // and EVL010's warning on the `.map()` here matches the same warning on
+  // FargateAlb, FargateService, and EksCluster's per-item resource lists.
+  const ingressRules = ingress.map((rule) => new SecurityGroup_Ingress({
+    IpProtocol: rule.protocol ?? "tcp",
+    FromPort: rule.fromPort,
+    ToPort: rule.toPort ?? rule.fromPort,
+    Description: rule.description,
+    ...ingressSource(rule),
+  }));
+
+  const sg = new SecurityGroup(mergeDefaults({
+    GroupDescription: "Security group for EC2 instance",
+    VpcId: props.vpcId,
+    SecurityGroupIngress: ingressRules.length > 0 ? ingressRules : undefined,
+  }, defaults?.sg));
+
+  const instance = new Instance(mergeDefaults({
+    ImageId: props.imageId,
+    InstanceType: instanceType,
+    SubnetId: props.subnetId,
+    SecurityGroupIds: [sg.GroupId],
+    IamInstanceProfile: Ref(instanceProfile),
+    KeyName: props.keyName,
+    UserData: props.userData ? Base64(props.userData) : undefined,
+  }, defaults?.instance));
+
+  return { role, instanceProfile, sg, instance };
+}, "Ec2InstanceBundle");

package/src/composites/ecr-repository.test.ts

@@ -0,0 +1,118 @@
+import { describe, test, expect } from "vitest";
+import { expandComposite } from "@intentius/chant";
+import { EcrRepository } from "./ecr-repository";
+
+// Generated property-kind instances (ECRRepository_ImageScanningConfiguration, ...) store
+// their data on a non-enumerable `.props`, so `toEqual` against a plain object
+// compares empty own-enumerable-property sets unless each instance is unwrapped first.
+const p = (x: any) => x.props;
+
+describe("EcrRepository", () => {
+  test("no props: single member, scan-on-push defaults on, default lifecycle policy present", () => {
+    const instance = EcrRepository({});
+    expect(Object.keys(instance.members)).toEqual(["repository"]);
+    const props = (instance.repository as any).props;
+    expect(p(props.ImageScanningConfiguration)).toEqual({ ScanOnPush: true });
+    expect(props.LifecyclePolicy).toBeDefined();
+  });
+
+  test("expandComposite produces the repository's logical name", () => {
+    const expanded = expandComposite("app", EcrRepository({}));
+    expect(expanded.has("appRepository")).toBe(true);
+    expect(expanded.size).toBe(1);
+  });
+
+  test("default lifecycle policy expires untagged images after 14 days", () => {
+    const props = (EcrRepository({}).repository as any).props;
+    const policy = JSON.parse(p(props.LifecyclePolicy).LifecyclePolicyText);
+    expect(policy.rules).toEqual([{
+      rulePriority: 1,
+      description: "Expire untagged images after 14 days",
+      selection: { tagStatus: "untagged", countType: "sinceImagePushed", countUnit: "days", countNumber: 14 },
+      action: { type: "expire" },
+    }]);
+  });
+
+  test("scanOnPush: false is threaded through, not just omitted", () => {
+    const props = (EcrRepository({ scanOnPush: false }).repository as any).props;
+    expect(p(props.ImageScanningConfiguration)).toEqual({ ScanOnPush: false });
+  });
+
+  test("empty lifecycleRules array ships the repository with no lifecycle policy at all", () => {
+    const props = (EcrRepository({ lifecycleRules: [] }).repository as any).props;
+    expect(props.LifecyclePolicy).toBeUndefined();
+  });
+
+  test("custom lifecycle rules render selection and action, omitting unset optional fields", () => {
+    const props = (EcrRepository({
+      lifecycleRules: [
+        { rulePriority: 1, tagStatus: "tagged", tagPrefixList: ["v"], countType: "imageCountMoreThan", countNumber: 10 },
+      ],
+    }).repository as any).props;
+    const policy = JSON.parse(p(props.LifecyclePolicy).LifecyclePolicyText);
+    expect(policy.rules).toEqual([{
+      rulePriority: 1,
+      selection: { tagStatus: "tagged", tagPrefixList: ["v"], countType: "imageCountMoreThan", countNumber: 10 },
+      action: { type: "expire" },
+    }]);
+  });
+
+  test("multiple lifecycle rules keep rulePriority order", () => {
+    const props = (EcrRepository({
+      lifecycleRules: [
+        { rulePriority: 1, tagStatus: "tagged", tagPrefixList: ["prod"], countType: "imageCountMoreThan", countNumber: 20 },
+        { rulePriority: 2, tagStatus: "untagged", countType: "sinceImagePushed", countUnit: "days", countNumber: 7 },
+      ],
+    }).repository as any).props;
+    const policy = JSON.parse(p(props.LifecyclePolicy).LifecyclePolicyText);
+    expect(policy.rules.map((r: any) => r.rulePriority)).toEqual([1, 2]);
+  });
+
+  test("no encryption block by default", () => {
+    const props = (EcrRepository({}).repository as any).props;
+    expect(props.EncryptionConfiguration).toBeUndefined();
+  });
+
+  test("encryption defaults its type to AES256 when only kmsKeyId-less block is given", () => {
+    const props = (EcrRepository({ encryption: {} }).repository as any).props;
+    expect(p(props.EncryptionConfiguration)).toEqual({ EncryptionType: "AES256" });
+  });
+
+  test("KMS encryption threads the key id through", () => {
+    const props = (EcrRepository({
+      encryption: { type: "KMS", kmsKeyId: "alias/my-key" },
+    }).repository as any).props;
+    expect(p(props.EncryptionConfiguration)).toEqual({ EncryptionType: "KMS", KmsKey: "alias/my-key" });
+  });
+
+  test("repositoryName is threaded through when given", () => {
+    const props = (EcrRepository({ repositoryName: "my-app" }).repository as any).props;
+    expect(props.RepositoryName).toBe("my-app");
+  });
+
+  test("imageTagMutability is threaded through; omitted when not set", () => {
+    const withIt = (EcrRepository({ imageTagMutability: "IMMUTABLE" }).repository as any).props;
+    expect(withIt.ImageTagMutability).toBe("IMMUTABLE");
+
+    const withoutIt = (EcrRepository({}).repository as any).props;
+    expect(withoutIt.ImageTagMutability).toBeUndefined();
+  });
+
+  test("repositoryPolicy is threaded through as RepositoryPolicyText", () => {
+    const policy = { Version: "2012-10-17", Statement: [{ Effect: "Allow", Principal: "*", Action: "ecr:GetDownloadUrlForLayer" }] };
+    const props = (EcrRepository({ repositoryPolicy: policy }).repository as any).props;
+    expect(props.RepositoryPolicyText).toEqual(policy);
+  });
+
+  test("emptyOnDelete is threaded through", () => {
+    const props = (EcrRepository({ emptyOnDelete: true }).repository as any).props;
+    expect(props.EmptyOnDelete).toBe(true);
+  });
+
+  test("defaults escape hatch reaches the repository (e.g. tags)", () => {
+    const props = (EcrRepository({
+      defaults: { repository: { Tags: [{ Key: "team", Value: "platform" } as any] } },
+    }).repository as any).props;
+    expect(props.Tags).toEqual([{ Key: "team", Value: "platform" }]);
+  });
+});

package/src/composites/ecr-repository.ts

@@ -0,0 +1,117 @@
+import { Composite, mergeDefaults, type Value } from "@intentius/chant";
+import {
+  ECRRepository,
+  ECRRepository_EncryptionConfiguration,
+  ECRRepository_ImageScanningConfiguration,
+  ECRRepository_LifecyclePolicy,
+} from "../generated";
+
+export interface EcrLifecycleRule {
+  /** Rules are evaluated in ascending priority order; each image is matched by exactly one rule. */
+  rulePriority: number;
+  description?: string;
+  /** Defaults to "any" — matches every image regardless of tag state. */
+  tagStatus?: "tagged" | "untagged" | "any";
+  /** Only meaningful with tagStatus "tagged". */
+  tagPrefixList?: string[];
+  /** Only meaningful with tagStatus "tagged". */
+  tagPatternList?: string[];
+  countType: "imageCountMoreThan" | "sinceImagePushed";
+  /** Required (and only meaningful) with countType "sinceImagePushed". */
+  countUnit?: "days";
+  countNumber: number;
+}
+
+export interface EcrEncryption {
+  /** Defaults to "AES256" (Amazon S3-managed keys) when this block is provided without a type. */
+  type?: "AES256" | "KMS" | "KMS_DSSE";
+  /** KMS/KMS_DSSE only. Falls back to the default AWS-managed ECR key when omitted. */
+  kmsKeyId?: string;
+}
+
+export interface EcrRepositoryProps {
+  /** `Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366). Omitted, CloudFormation generates one. */
+  repositoryName?: Value<string>;
+  imageTagMutability?: "MUTABLE" | "IMMUTABLE" | "MUTABLE_WITH_EXCLUSION" | "IMMUTABLE_WITH_EXCLUSION";
+  /** Defaults to true — scanning freshly pushed images is the safe default for a new repository. */
+  scanOnPush?: boolean;
+  /**
+   * Lifecycle rules, evaluated in `rulePriority` order and rendered into the repository's
+   * `LifecyclePolicyText`. Defaults to a single "expire untagged images after 14 days" rule
+   * -- AWS's own starter policy -- when omitted. Pass `[]` to ship the repository with no
+   * lifecycle policy at all.
+   */
+  lifecycleRules?: EcrLifecycleRule[];
+  encryption?: EcrEncryption;
+  /** If true, deleting the repository force-deletes its contents instead of requiring it to be empty first. */
+  emptyOnDelete?: boolean;
+  /** JSON repository policy document (cross-account pull access, etc). */
+  repositoryPolicy?: Record<string, unknown>;
+  defaults?: {
+    repository?: Partial<ConstructorParameters<typeof ECRRepository>[0]>;
+  };
+}
+
+const DEFAULT_LIFECYCLE_RULES: EcrLifecycleRule[] = [
+  {
+    rulePriority: 1,
+    description: "Expire untagged images after 14 days",
+    tagStatus: "untagged",
+    countType: "sinceImagePushed",
+    countUnit: "days",
+    countNumber: 14,
+  },
+];
+
+function toJsonRule(rule: EcrLifecycleRule): Record<string, unknown> {
+  // Plain conditional assignment (not spread) keeps this traceable for EVL004 —
+  // that rule only exempts spreads inside a Composite factory, and this helper
+  // runs outside one.
+  const selection: Record<string, unknown> = {
+    tagStatus: rule.tagStatus ?? "any",
+    countType: rule.countType,
+    countNumber: rule.countNumber,
+  };
+  if (rule.tagPrefixList) selection.tagPrefixList = rule.tagPrefixList;
+  if (rule.tagPatternList) selection.tagPatternList = rule.tagPatternList;
+  if (rule.countUnit) selection.countUnit = rule.countUnit;
+
+  const jsonRule: Record<string, unknown> = {
+    rulePriority: rule.rulePriority,
+    selection,
+    action: { type: "expire" },
+  };
+  if (rule.description) jsonRule.description = rule.description;
+  return jsonRule;
+}
+
+function toLifecyclePolicyText(rules: EcrLifecycleRule[]): string {
+  return JSON.stringify({ rules: rules.map(toJsonRule) });
+}
+
+export const EcrRepository = Composite((props: EcrRepositoryProps) => {
+  const { defaults } = props;
+  const scanOnPush = props.scanOnPush ?? true;
+  const lifecycleRules = props.lifecycleRules ?? DEFAULT_LIFECYCLE_RULES;
+
+  const repository = new ECRRepository(mergeDefaults({
+    RepositoryName: props.repositoryName,
+    ImageTagMutability: props.imageTagMutability,
+    EmptyOnDelete: props.emptyOnDelete,
+    ImageScanningConfiguration: new ECRRepository_ImageScanningConfiguration({ ScanOnPush: scanOnPush }),
+    ...(lifecycleRules.length > 0
+      ? { LifecyclePolicy: new ECRRepository_LifecyclePolicy({ LifecyclePolicyText: toLifecyclePolicyText(lifecycleRules) }) }
+      : {}),
+    ...(props.encryption
+      ? {
+          EncryptionConfiguration: new ECRRepository_EncryptionConfiguration({
+            EncryptionType: props.encryption.type ?? "AES256",
+            ...(props.encryption.kmsKeyId ? { KmsKey: props.encryption.kmsKeyId } : {}),
+          }),
+        }
+      : {}),
+    ...(props.repositoryPolicy ? { RepositoryPolicyText: props.repositoryPolicy } : {}),
+  }, defaults?.repository));
+
+  return { repository };
+}, "EcrRepository");

package/src/composites/fargate-service.ts

@@ -32,6 +32,20 @@ import {
 import { Sub, Join, Select, Split } from "../intrinsics";
 import { ecsTrustPolicy } from "./ecs-trust-policy";
 
+/**
+ * The ALB `ListenerRule`'s real `Priority` bounds (documented on
+ * `elasticloadbalancing:CreateRule`, and enforced the same way for a
+ * CloudFormation-managed rule) — not an opinion this composite holds.
+ *
+ * Exported for the same reason as `MICROVM_LIMITS` (#1374, #1420): a
+ * consumer routing to the same shared ALB through another control plane
+ * needs the same numbers, and copying them is how two sources of truth
+ * start.
+ */
+export const FARGATE_SERVICE_LIMITS = {
+  priority: { min: 1, max: 50000 },
+} as const;
+
 export interface FargateServiceProps {
   // Wiring to shared ALB.
   //
@@ -44,7 +58,7 @@ export interface FargateServiceProps {
   albSecurityGroupId: Value<string>;
   executionRoleArn: Value<string>;
 
-  // Routing — at least one required
+  // Routing — at least one required. Bounds: {@link FARGATE_SERVICE_LIMITS.priority}.
   priority: number;
   pathPatterns?: string[];
   hostHeaders?: string[];
@@ -99,8 +113,10 @@ export const FargateService = Composite((props: FargateServiceProps) => {
   if (!props.pathPatterns && !props.hostHeaders) {
     throw new Error("FargateService requires at least one of pathPatterns or hostHeaders");
   }
-  if (props.priority < 1 || props.priority > 50000) {
-    throw new Error("FargateService priority must be between 1 and 50000");
+  if (props.priority < FARGATE_SERVICE_LIMITS.priority.min || props.priority > FARGATE_SERVICE_LIMITS.priority.max) {
+    throw new Error(
+      `FargateService priority must be between ${FARGATE_SERVICE_LIMITS.priority.min} and ${FARGATE_SERVICE_LIMITS.priority.max}`,
+    );
   }
 
   const containerPort = props.containerPort ?? 80;

package/src/composites/index.ts

@@ -17,6 +17,15 @@ export { LambdaEventBridge } from "./lambda-eventbridge";
 export type { LambdaEventBridgeProps } from "./lambda-eventbridge";
 export { LambdaDynamoDB } from "./lambda-dynamodb";
 export type { LambdaDynamoDBProps } from "./lambda-dynamodb";
+export { EcrRepository } from "./ecr-repository";
+export type { EcrRepositoryProps, EcrLifecycleRule, EcrEncryption } from "./ecr-repository";
+export { DynamoDBTable } from "./dynamodb-table";
+export type {
+  DynamoDBTableProps,
+  DynamoDBKey,
+  DynamoDBCapacity,
+  DynamoDBGlobalSecondaryIndex,
+} from "./dynamodb-table";
 export { LambdaS3 } from "./lambda-s3";
 export type { LambdaS3Props } from "./lambda-s3";
 export { LambdaSns } from "./lambda-sns";
@@ -27,8 +36,10 @@ export { FargateAlb } from "./fargate-alb";
 export type { FargateAlbProps } from "./fargate-alb";
 export { AlbShared } from "./alb-shared";
 export type { AlbSharedProps } from "./alb-shared";
-export { FargateService } from "./fargate-service";
+export { FargateService, FARGATE_SERVICE_LIMITS } from "./fargate-service";
 export type { FargateServiceProps } from "./fargate-service";
+export { NlbService } from "./nlb-service";
+export type { NlbServiceProps } from "./nlb-service";
 export { RdsInstance, RdsInstance as RdsPostgres } from "./rds-instance";
 export type { RdsInstanceProps, RdsInstanceProps as RdsPostgresProps } from "./rds-instance";
 export { EfsWithAccessPoint } from "./efs-with-access-point";
@@ -37,11 +48,19 @@ export { SolrFargateService } from "./solr-fargate-service";
 export type { SolrFargateServiceProps } from "./solr-fargate-service";
 export { Ec2InstanceRole } from "./ec2-instance-role";
 export type { Ec2InstanceRoleProps } from "./ec2-instance-role";
+export { Ec2InstanceBundle } from "./ec2-instance-bundle";
+export type { Ec2InstanceBundleProps, Ec2InstanceBundleIngressRule } from "./ec2-instance-bundle";
 export { MinimalVpc } from "./minimal-vpc";
 export type { MinimalVpcProps } from "./minimal-vpc";
 export { EksCluster } from "./eks-cluster";
 export type { EksClusterProps } from "./eks-cluster";
 export { MicrovmApp, MICROVM_LIMITS } from "./microvm-app";
 export type { MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps, MicrovmMemoryMiB } from "./microvm-app";
-export { AgentCoreAgent, agentCoreDefaultEndpointArn } from "./agentcore-agent";
+export { AgentCoreAgent, agentCoreDefaultEndpointArn, AGENTCORE_LIMITS } from "./agentcore-agent";
 export type { AgentCoreAgentProps, AgentCoreAgentResult } from "./agentcore-agent";
+export { StepFunctionsWorkflow } from "./step-functions-workflow";
+export type { StepFunctionsWorkflowProps } from "./step-functions-workflow";
+export { MonitoringStack } from "./monitoring-stack";
+export type { MonitoringStackProps, MonitoringMetricSpec } from "./monitoring-stack";
+export { BucketDeployment } from "./bucket-deployment";
+export type { BucketDeploymentProps, BucketDeploymentResult } from "./bucket-deployment";