@intentius/chant-lexicon-aws 0.57.0 → 0.58.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/agentcore/trace-fetch.d.ts +5 -4
- package/dist/agentcore/trace-fetch.d.ts.map +1 -1
- package/dist/integrity.json +2 -2
- package/dist/lint/audit-catalog.d.ts.map +1 -1
- package/dist/lint/audit-lineage.d.ts +10 -0
- package/dist/lint/audit-lineage.d.ts.map +1 -0
- package/dist/manifest.json +1 -1
- package/dist/op/activities/aws-apply.d.ts.map +1 -1
- package/dist/op/activities/floci.d.ts +3 -2
- package/dist/op/activities/floci.d.ts.map +1 -1
- package/dist/op/builders.d.ts +4 -4
- package/package.json +2 -2
- package/src/agentcore/trace-fetch.ts +5 -4
- package/src/codegen/docs.ts +3 -3
- package/src/deep-observe.test.ts +23 -15
- package/src/deep-topology.test.ts +7 -3
- package/src/index.ts +3 -3
- package/src/lint/audit-catalog.ts +5 -1
- package/src/lint/audit-lineage.ts +159 -0
- package/src/op/activities/aws-apply.ts +1 -3
- package/src/op/activities/floci.ts +3 -2
- package/src/op/builders.ts +4 -4
|
@@ -6,10 +6,11 @@
|
|
|
6
6
|
* lexicon contributes `dogwoodReplay`: a plain exported async function taking
|
|
7
7
|
* one args object, re-exported from `src/op/activities/index.ts`, resolved **by
|
|
8
8
|
* name** by core's activity registry when a project lists the `aws` lexicon.
|
|
9
|
-
*
|
|
10
|
-
*
|
|
11
|
-
* the same `AwsReadHttp` seam `src/api/read-client.ts`
|
|
12
|
-
* never touch the network and `endpoint` retargets the
|
|
9
|
+
* It imports no runtime of its own, so the local executor
|
|
10
|
+
* (`packages/core/src/op/local-executor.ts`) calls it as-is. Transport is
|
|
11
|
+
* injectable through the same `AwsReadHttp` seam `src/api/read-client.ts`
|
|
12
|
+
* already uses, so tests never touch the network and `endpoint` retargets the
|
|
13
|
+
* whole thing.
|
|
13
14
|
*
|
|
14
15
|
* The output is text. The cedar lexicon's `PolicyReplayOp` reads a trace from
|
|
15
16
|
* `tracePath`, so `outPath` here is the handoff — and it is the *only* handoff.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"trace-fetch.d.ts","sourceRoot":"","sources":["../../src/agentcore/trace-fetch.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"trace-fetch.d.ts","sourceRoot":"","sources":["../../src/agentcore/trace-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAIH,OAAO,EAKL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAE7B,MAAM,gBAAgB,CAAC;AASxB;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB;AAC9B,wEAAwE;AACtE,QAAQ;AACV,uEAAuE;GACrE,cAAc;AAChB,0EAA0E;GACxE,OAAO,CAAC;AAEZ,2EAA2E;AAC3E,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC;AAE5E;;;;;;;GAOG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;IAErD,QAAQ,CAAC,MAAM,EAAE,oBAAoB;gBAA5B,MAAM,EAAE,oBAAoB,EACrC,OAAO,EAAE,MAAM;CAKlB;AAuBD,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,2FAA2F;AAC3F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAW9D;AAID,oEAAoE;AACpE,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAIzD,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAanE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IAAE,oBAAoB,CAAC,EAAE,wBAAwB,CAAA;CAAO,EACjE,IAAI,SAAK,EACT,OAAO,GAAE,WAAW,EAAO,GAC1B;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,WAAW,EAAE,CAAA;CAAE,CA6BrD;AAmDD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,kGAAkG;AAClG,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAKtE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,yDAA0D,CAAC;AAEjF,yDAAyD;AACzD,MAAM,WAAW,yBAAyB;IACxC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACvD,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,0BAA0B;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC;CAC1D;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,OAAO,GAAE,yBAA8B,GACtC,iBAAiB,CAgFnB;AASD,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,wHAAwH;IACxH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAC3C,kGAAkG;IAClG,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAClD,iFAAiF;IACjF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,uEAAuE;IACvE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;CACrB;AA4CD,2CAA2C;AAC3C,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAAyB,GAC9B,OAAO,CAAC,WAAW,EAAE,CAAC,CAiCxB;AAID,iDAAiD;AACjD,MAAM,WAAW,0BAA2B,SAAQ,oBAAoB,EAAE,yBAAyB;IACjG,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,oCAAoC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAEpD,iFAAiF;IACjF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,mDAAmD;AACnD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACjD;AAOD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,0BAA0B,EAChC,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,WAAyB,GAC9B,OAAO,CAAC,4BAA4B,CAAC,CAqDvC"}
|
package/dist/integrity.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"algorithm": "sha256",
|
|
3
3
|
"artifacts": {
|
|
4
|
-
"manifest.json": "
|
|
4
|
+
"manifest.json": "f9bda2cfd04abd35a72109eba35683b99c4181edd770dff3b969cc5155982429",
|
|
5
5
|
"meta.json": "49cbb2ca9b454391a7644e14ee9cfd91bcf906c6af683bf46a182aa85047ecc4",
|
|
6
6
|
"types/index.d.ts": "624cf99a0be147e922baf957e31a9007e830b50397d098c8f4adb9dabf417ff8",
|
|
7
7
|
"rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
|
|
@@ -73,5 +73,5 @@
|
|
|
73
73
|
"skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
|
|
74
74
|
"skills/chant-aws-carve-terraform.md": "0ae4376590db47979be144d3ac6cdcfd56c9640d0536421aacf7330459d38e52"
|
|
75
75
|
},
|
|
76
|
-
"composite": "
|
|
76
|
+
"composite": "25c7e2315302394c89e6c10decde8f233b275ec6879aba26ccf0fd05da94080f"
|
|
77
77
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,
|
|
1
|
+
{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAgC,MAAM,gCAAgC,CAAC;AASxG,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA2EpD,CAAC"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Prior art for these audit rules: the open-source tools whose checks cover the
|
|
3
|
+
* same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
|
|
4
|
+
* the registry, the relation vocabulary, and why this is credit rather than
|
|
5
|
+
* authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
|
|
6
|
+
* when a credited tool's index no longer lists a rule cited here.
|
|
7
|
+
*/
|
|
8
|
+
import type { Lineage } from "@intentius/chant/audit/catalog";
|
|
9
|
+
export declare const awsAuditLineage: Record<string, Lineage[]>;
|
|
10
|
+
//# sourceMappingURL=audit-lineage.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAqJrD,CAAC"}
|
package/dist/manifest.json
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"aws-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/aws-apply.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4HAA4H;AAC5H,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAcrI;;;GAGG;AACH,wBAAgB,MAAM,CACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,SAAiB,EACvB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAGR;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9F;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAyC,CAAC;AAC7F,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AACrF,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AAE7F,4EAA4E;AAC5E,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,OAAsC,CAAC;AACpF,wEAAwE;AACxE,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OAAsD,CAAC;AAGjG,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAqC,CAAC;AACvF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAyC,CAAC;AAC3F,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,OACkC,CAAC;AAIrF,yFAAyF;AACzF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC/C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,
|
|
1
|
+
{"version":3,"file":"aws-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/aws-apply.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4HAA4H;AAC5H,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAcrI;;;GAGG;AACH,wBAAgB,MAAM,CACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,SAAiB,EACvB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAGR;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9F;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAyC,CAAC;AAC7F,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AACrF,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AAE7F,4EAA4E;AAC5E,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,OAAsC,CAAC;AACpF,wEAAwE;AACxE,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OAAsD,CAAC;AAGjG,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAqC,CAAC;AACvF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAyC,CAAC;AAC3F,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,OACkC,CAAC;AAIrF,yFAAyF;AACzF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC/C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAID;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAiD7F;AAED;;;yBAGyB;AACzB,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAqBlD;AAED,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BtE"}
|
|
@@ -41,8 +41,9 @@ export declare function flociRunCommand(args?: FlociUpArgs): string;
|
|
|
41
41
|
* Idempotent: reuses a running container of the same name. Waits for the health
|
|
42
42
|
* endpoint to report `readyService`, then sets `AWS_ENDPOINT_URL` + test creds in
|
|
43
43
|
* the process environment so a following `nativeApply`/`cfn-deploy` targets the
|
|
44
|
-
* emulator. Env injection
|
|
45
|
-
*
|
|
44
|
+
* emulator. Env injection works because the local executor runs every step of a
|
|
45
|
+
* run in this process; a step that runs anywhere else needs the endpoint passed
|
|
46
|
+
* to it explicitly.
|
|
46
47
|
*/
|
|
47
48
|
export declare function flociUp(args?: FlociUpArgs, signal?: AbortSignal): Promise<{
|
|
48
49
|
endpoint: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"floci.d.ts","sourceRoot":"","sources":["../../../src/op/activities/floci.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAapG,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO7E;AAcD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,EAAE,YAAkD,CAAC;AAE5E;4DAC4D;AAC5D,eAAO,MAAM,cAAc,EAAE,kBAQ5B,CAAC;AAMF,eAAO,MAAM,kBAAkB,0BAAyB,CAAC;AACzD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AACjD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AAEjD,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,IAAI,GAAE,WAAgB,GAAG,MAAM,CAO9D;AAED
|
|
1
|
+
{"version":3,"file":"floci.d.ts","sourceRoot":"","sources":["../../../src/op/activities/floci.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAapG,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO7E;AAcD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,EAAE,YAAkD,CAAC;AAE5E;4DAC4D;AAC5D,eAAO,MAAM,cAAc,EAAE,kBAQ5B,CAAC;AAMF,eAAO,MAAM,kBAAkB,0BAAyB,CAAC;AACzD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AACjD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AAEjD,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,IAAI,GAAE,WAAgB,GAAG,MAAM,CAO9D;AAED;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAAC,IAAI,GAAE,WAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBzG;AAED,kFAAkF;AAClF,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F"}
|
package/dist/op/builders.d.ts
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Typed step-builder wrappers for this lexicon's activities (chant #1288
|
|
3
3
|
* Stage 2). See `lexicons/k8s/src/op/builders.ts`'s module doc for why these
|
|
4
|
-
* live beside their `*Args` interfaces rather than in core
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
4
|
+
* live beside their `*Args` interfaces rather than in core: core cannot
|
|
5
|
+
* import a lexicon's types (lexicons depend on core, not the reverse), so a
|
|
6
|
+
* wrapper whose `opts` IS the activity's own `*Args` interface can only sit
|
|
7
|
+
* in the lexicon that declares that interface. `opts`'s type in
|
|
8
8
|
* each wrapper below IS the activity's own `*Args` interface (via
|
|
9
9
|
* `Omit`/`WithStepRefs`) — never restated. `core`'s own
|
|
10
10
|
* `awsApply`/`awsDelete`/`flociUp`/`flociDown` are unchanged and produce
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@intentius/chant-lexicon-aws",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.58.0",
|
|
4
4
|
"description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"homepage": "https://intentius.io/chant",
|
|
@@ -80,7 +80,7 @@
|
|
|
80
80
|
"typescript": "^5.9.3"
|
|
81
81
|
},
|
|
82
82
|
"peerDependencies": {
|
|
83
|
-
"@intentius/chant": "^0.
|
|
83
|
+
"@intentius/chant": "^0.58.0",
|
|
84
84
|
"typescript": "^5.9.3"
|
|
85
85
|
}
|
|
86
86
|
}
|
|
@@ -6,10 +6,11 @@
|
|
|
6
6
|
* lexicon contributes `dogwoodReplay`: a plain exported async function taking
|
|
7
7
|
* one args object, re-exported from `src/op/activities/index.ts`, resolved **by
|
|
8
8
|
* name** by core's activity registry when a project lists the `aws` lexicon.
|
|
9
|
-
*
|
|
10
|
-
*
|
|
11
|
-
* the same `AwsReadHttp` seam `src/api/read-client.ts`
|
|
12
|
-
* never touch the network and `endpoint` retargets the
|
|
9
|
+
* It imports no runtime of its own, so the local executor
|
|
10
|
+
* (`packages/core/src/op/local-executor.ts`) calls it as-is. Transport is
|
|
11
|
+
* injectable through the same `AwsReadHttp` seam `src/api/read-client.ts`
|
|
12
|
+
* already uses, so tests never touch the network and `endpoint` retargets the
|
|
13
|
+
* whole thing.
|
|
13
14
|
*
|
|
14
15
|
* The output is text. The cedar lexicon's `PolicyReplayOp` reads a trace from
|
|
15
16
|
* `tracePath`, so `outPath` here is the handoff — and it is the *only* handoff.
|
package/src/codegen/docs.ts
CHANGED
|
@@ -113,9 +113,9 @@ export async function generateDocs(options?: { verbose?: boolean }): Promise<voi
|
|
|
113
113
|
// `rules` is NOT suppressed: the hand-written `lint-rules` page in docs/pages/
|
|
114
114
|
// explains 26 of the lexicon's 50 rules in depth, and the whole WAW032+
|
|
115
115
|
// hardening pass had no entry there at all (#1312). The generated table is
|
|
116
|
-
// the complete, always-current list, so both ship
|
|
117
|
-
//
|
|
118
|
-
// would just create a third copy to drift.
|
|
116
|
+
// the complete, always-current list, so both ship: a hand-written overview
|
|
117
|
+
// beside a generated reference. Duplicating 24 descriptions into the prose
|
|
118
|
+
// page would just create a third copy to drift.
|
|
119
119
|
suppressPages: ["pseudo-parameters"],
|
|
120
120
|
examplesDir: join(pkgDir, "examples"),
|
|
121
121
|
};
|
package/src/deep-observe.test.ts
CHANGED
|
@@ -949,12 +949,15 @@ describe("end to end: declared + mutated live + baseline (#1015)", () => {
|
|
|
949
949
|
// all subtracted.
|
|
950
950
|
expect(result.unchanged).toEqual(["AppRole"]);
|
|
951
951
|
|
|
952
|
-
// The platform team's tag is
|
|
953
|
-
//
|
|
954
|
-
|
|
955
|
-
|
|
956
|
-
|
|
957
|
-
|
|
952
|
+
// The platform team's tag is on a path source never declared, so since
|
|
953
|
+
// #2160 the claim answers before the baseline gets a chance to: it is held
|
|
954
|
+
// elsewhere, at its live value, and it is not drift. AWS records no field
|
|
955
|
+
// manager, so the claimed-field set is the only source that can answer.
|
|
956
|
+
expect(result.accepted).toEqual([]);
|
|
957
|
+
expect(result.unclaimed.map((e) => e.name)).toEqual(["Assets"]);
|
|
958
|
+
expect(result.unclaimed[0].fields).toEqual([
|
|
959
|
+
{ path: "Tags[#cost-center].Key", live: "cost-center", source: "claimed-fields", baseline: "cost-center" },
|
|
960
|
+
{ path: "Tags[#cost-center].Value", live: "platform", source: "claimed-fields", baseline: "platform" },
|
|
958
961
|
]);
|
|
959
962
|
|
|
960
963
|
// An unreadable deep read is a hole with a reason — never silence, never
|
|
@@ -976,7 +979,10 @@ describe("end to end: declared + mutated live + baseline (#1015)", () => {
|
|
|
976
979
|
]);
|
|
977
980
|
});
|
|
978
981
|
|
|
979
|
-
test("
|
|
982
|
+
test("the claim silences the platform tag with no baseline at all (#2160)", async () => {
|
|
983
|
+
// Before #2160 this tag was drift until somebody accepted it. The
|
|
984
|
+
// declaration is the table AWS cannot provide, and it answers on the first
|
|
985
|
+
// read, with nothing recorded anywhere.
|
|
980
986
|
wireMocks();
|
|
981
987
|
const result = await deepDiffForLexicon(awsPlugin, {
|
|
982
988
|
environment: "prod",
|
|
@@ -984,15 +990,16 @@ describe("end to end: declared + mutated live + baseline (#1015)", () => {
|
|
|
984
990
|
entities: declared,
|
|
985
991
|
});
|
|
986
992
|
const assets = result.drifted.find((d) => d.name === "Assets");
|
|
987
|
-
expect(assets?.changes.map((c) => c.path)
|
|
993
|
+
expect(assets?.changes.map((c) => c.path)).toEqual(["VersioningConfiguration.Status"]);
|
|
994
|
+
expect(result.unclaimed[0].fields.map((f) => f.path)).toEqual([
|
|
988
995
|
"Tags[#cost-center].Key",
|
|
989
996
|
"Tags[#cost-center].Value",
|
|
990
|
-
"VersioningConfiguration.Status",
|
|
991
997
|
]);
|
|
992
998
|
expect(result.accepted).toEqual([]);
|
|
993
999
|
});
|
|
994
1000
|
|
|
995
1001
|
test("an accepted value that later changes is drift again, with all three axes", async () => {
|
|
1002
|
+
// The baseline's value-bound rule, on the path that is actually declared.
|
|
996
1003
|
wireMocks();
|
|
997
1004
|
const result = await deepDiffForLexicon(awsPlugin, {
|
|
998
1005
|
environment: "prod",
|
|
@@ -1000,18 +1007,19 @@ describe("end to end: declared + mutated live + baseline (#1015)", () => {
|
|
|
1000
1007
|
entities: declared,
|
|
1001
1008
|
baseline: {
|
|
1002
1009
|
Assets: {
|
|
1003
|
-
accepted: [{ path: "
|
|
1010
|
+
accepted: [{ path: "VersioningConfiguration.Status", value: "Enabled" }],
|
|
1004
1011
|
},
|
|
1005
1012
|
},
|
|
1006
1013
|
});
|
|
1007
1014
|
const change = result.drifted
|
|
1008
1015
|
.find((d) => d.name === "Assets")
|
|
1009
|
-
?.changes.find((c) => c.path === "
|
|
1016
|
+
?.changes.find((c) => c.path === "VersioningConfiguration.Status");
|
|
1010
1017
|
expect(change).toEqual({
|
|
1011
|
-
path: "
|
|
1012
|
-
kind: "
|
|
1013
|
-
|
|
1014
|
-
|
|
1018
|
+
path: "VersioningConfiguration.Status",
|
|
1019
|
+
kind: "changed",
|
|
1020
|
+
declared: "Enabled",
|
|
1021
|
+
live: "Suspended",
|
|
1022
|
+
baseline: "Enabled",
|
|
1015
1023
|
});
|
|
1016
1024
|
});
|
|
1017
1025
|
|
|
@@ -360,7 +360,7 @@ describe("the fold answers (#1269)", () => {
|
|
|
360
360
|
]);
|
|
361
361
|
});
|
|
362
362
|
|
|
363
|
-
test("an out-of-band MapPublicIpOnLaunch flip reports; the service default does not", async () => {
|
|
363
|
+
test("an out-of-band MapPublicIpOnLaunch flip reports as unclaimed; the service default does not", async () => {
|
|
364
364
|
const subnetRow = (mapPublic: boolean) => ({
|
|
365
365
|
Subnets: [{ SubnetId: "subnet-01", VpcId: "vpc-01", CidrBlock: "10.0.1.0/24", MapPublicIpOnLaunch: mapPublic }],
|
|
366
366
|
});
|
|
@@ -381,11 +381,15 @@ describe("the fold answers (#1269)", () => {
|
|
|
381
381
|
|
|
382
382
|
ec2Describes({ "describe-subnets": subnetRow(true) });
|
|
383
383
|
const diff = diffDeepObservation(declared, await observe(), awsDeepNormalizationHooks);
|
|
384
|
-
|
|
384
|
+
// Source never set MapPublicIpOnLaunch, so the flip is somebody else's
|
|
385
|
+
// (#2160): reported with its value, not counted as drift, and never
|
|
386
|
+
// proposed for an update.
|
|
387
|
+
expect(diff.drifted).toEqual([]);
|
|
388
|
+
expect(diff.unclaimed).toEqual([
|
|
385
389
|
{
|
|
386
390
|
name: "PublicSubnet",
|
|
387
391
|
type: "AWS::EC2::Subnet",
|
|
388
|
-
|
|
392
|
+
fields: [{ path: "MapPublicIpOnLaunch", live: true, source: "claimed-fields" }],
|
|
389
393
|
},
|
|
390
394
|
]);
|
|
391
395
|
});
|
package/src/index.ts
CHANGED
|
@@ -28,9 +28,9 @@ export type { AwsReceiptStoreOptions, ReceiptRowObservation } from "./receipt-st
|
|
|
28
28
|
// Typed Op step-builder wrappers (chant #1288 Stage 2) — awsApply/awsDelete/
|
|
29
29
|
// flociUp/flociDown with authoring-time types derived from this lexicon's
|
|
30
30
|
// own *Args interfaces (see ./op/builders.ts's module doc for why these live
|
|
31
|
-
// here rather than in core
|
|
32
|
-
//
|
|
33
|
-
//
|
|
31
|
+
// here rather than in core). Opt-in: `@intentius/chant/op`'s same-named
|
|
32
|
+
// exports are core's original untyped builders, unchanged, for
|
|
33
|
+
// cloud-agnostic authoring.
|
|
34
34
|
export { awsApply, awsDelete, flociUp, flociDown } from "./op/builders";
|
|
35
35
|
|
|
36
36
|
// Serializer
|
|
@@ -5,7 +5,8 @@
|
|
|
5
5
|
* #350); core keeps only the generic catalog machinery + cross-cutting ids.
|
|
6
6
|
*/
|
|
7
7
|
|
|
8
|
-
import { auditRule, type RuleMeta, type Authority } from "@intentius/chant/audit/catalog";
|
|
8
|
+
import { auditRule, type RuleMeta, type Authority, applyLineage } from "@intentius/chant/audit/catalog";
|
|
9
|
+
import { awsAuditLineage } from "./audit-lineage";
|
|
9
10
|
|
|
10
11
|
/** AWS Well-Architected Security Pillar — the authority chant cites for AWS security findings. */
|
|
11
12
|
const AWS_SEC: Authority = {
|
|
@@ -90,3 +91,6 @@ export const awsAuditCatalog: Record<string, RuleMeta> = {
|
|
|
90
91
|
WAW068: auditRule("WAW068", "report-only", "guidance", "VPN Gateway or Transit Gateway has only one attached VPN Connection", "Attach a second VPNConnection (ideally to a separate Customer Gateway) for redundancy.", { category: "best-practice" }),
|
|
91
92
|
WAW069: auditRule("WAW069", "merge-worthy", "guidance", "Template references a condition it never declares", "Declare the condition in the Conditions section (new Condition(...)), or fix the referenced name.", { category: "correctness" }),
|
|
92
93
|
};
|
|
94
|
+
|
|
95
|
+
// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
|
|
96
|
+
applyLineage(awsAuditCatalog, awsAuditLineage);
|
|
@@ -0,0 +1,159 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Prior art for these audit rules: the open-source tools whose checks cover the
|
|
3
|
+
* same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
|
|
4
|
+
* the registry, the relation vocabulary, and why this is credit rather than
|
|
5
|
+
* authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
|
|
6
|
+
* when a credited tool's index no longer lists a rule cited here.
|
|
7
|
+
*/
|
|
8
|
+
import type { Lineage } from "@intentius/chant/audit/catalog";
|
|
9
|
+
|
|
10
|
+
export const awsAuditLineage: Record<string, Lineage[]> = {
|
|
11
|
+
WAW010: [
|
|
12
|
+
{ tool: "cfn-lint", rule: "W3005", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#W3005", relation: "equivalent" },
|
|
13
|
+
],
|
|
14
|
+
WAW011: [
|
|
15
|
+
{ tool: "cfn-lint", rule: "W2531", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#W2531", relation: "equivalent" },
|
|
16
|
+
{ tool: "checkov", rule: "CKV_AWS_363", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
17
|
+
],
|
|
18
|
+
WAW017: [
|
|
19
|
+
{ tool: "kics", rule: "Lambda Function Without Tags", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/8df8e857-bd59-44fa-9f4c-d77594b95b46/", relation: "extends" },
|
|
20
|
+
{ tool: "kics", rule: "EFS Without Tags", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/08e39832-5e42-4304-98a0-aa5b43393162/", relation: "extends" },
|
|
21
|
+
],
|
|
22
|
+
WAW018: [
|
|
23
|
+
{ tool: "guard-rules-registry", rule: "S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_s3/s3_bucket_level_public_access_prohibited.guard", relation: "equivalent" },
|
|
24
|
+
{ tool: "checkov", rule: "CKV_AWS_53", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "extends" },
|
|
25
|
+
{ tool: "checkov", rule: "CKV_AWS_56", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "extends" },
|
|
26
|
+
],
|
|
27
|
+
WAW019: [
|
|
28
|
+
{ tool: "guard-rules-registry", rule: "RESTRICTED_INCOMING_TRAFFIC", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_ec2/restricted_common_ports.guard", relation: "overlaps" },
|
|
29
|
+
{ tool: "kics", rule: "EC2 Sensitive Port Is Publicly Exposed", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/494b03d3-bf40-4464-8524-7c56ad0700ed/", relation: "overlaps" },
|
|
30
|
+
{ tool: "checkov", rule: "CKV_AWS_24", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "extends" },
|
|
31
|
+
],
|
|
32
|
+
WAW020: [
|
|
33
|
+
{ tool: "checkov", rule: "CKV_AWS_63", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
34
|
+
{ tool: "cfn-nag", rule: "F4", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/IamPolicyWildcardActionRule.rb", relation: "overlaps" },
|
|
35
|
+
{ tool: "guard-rules-registry", rule: "IAM_ROLE_NO_WILDCARD_ACTIONS_ON_PERMISSIONS", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/iam/iam_role_no_wildcard_actions_on_permissions.guard", relation: "overlaps" },
|
|
36
|
+
],
|
|
37
|
+
WAW021: [
|
|
38
|
+
{ tool: "cfn-nag", rule: "F27", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/RDSDBInstanceStorageEncryptedRule.rb", relation: "equivalent" },
|
|
39
|
+
{ tool: "checkov", rule: "CKV_AWS_16", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
40
|
+
{ tool: "guard-rules-registry", rule: "RDS_STORAGE_ENCRYPTED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_rds/rds_storage_encrypted.guard", relation: "equivalent" },
|
|
41
|
+
],
|
|
42
|
+
WAW022: [
|
|
43
|
+
{ tool: "cfn-nag", rule: "W89", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/LambdaFunctionInsideVPCRule.rb", relation: "equivalent" },
|
|
44
|
+
{ tool: "checkov", rule: "CKV_AWS_117", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
45
|
+
{ tool: "guard-rules-registry", rule: "LAMBDA_INSIDE_VPC", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/lambda/lambda_inside_vpc.guard", relation: "equivalent" },
|
|
46
|
+
],
|
|
47
|
+
WAW023: [
|
|
48
|
+
{ tool: "checkov", rule: "CKV_AWS_68", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
49
|
+
{ tool: "kics", rule: "CloudFront Without WAF", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/0f139403-303f-467c-96bd-e717e6cfd62d/", relation: "equivalent" },
|
|
50
|
+
],
|
|
51
|
+
WAW024: [
|
|
52
|
+
{ tool: "cfn-nag", rule: "W52", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/ElasticLoadBalancerV2AccessLoggingRule.rb", relation: "equivalent" },
|
|
53
|
+
{ tool: "checkov", rule: "CKV_AWS_91", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
54
|
+
{ tool: "kics", rule: "ELBv2 ALB Access Log Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/c62e8b7d-1fdf-4050-ac4c-76ba9e1d9621/", relation: "equivalent" },
|
|
55
|
+
],
|
|
56
|
+
WAW025: [
|
|
57
|
+
{ tool: "cfn-nag", rule: "W47", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/SnsTopicKmsMasterKeyIdRule.rb", relation: "equivalent" },
|
|
58
|
+
{ tool: "checkov", rule: "CKV_AWS_26", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
59
|
+
{ tool: "guard-rules-registry", rule: "SNS_ENCRYPTED_KMS", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_sns/sns_encrypted_kms.guard", relation: "equivalent" },
|
|
60
|
+
],
|
|
61
|
+
WAW026: [
|
|
62
|
+
{ tool: "checkov", rule: "CKV_AWS_27", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
63
|
+
{ tool: "kics", rule: "SQS With SSE Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/12726829-93ed-4d51-9cbe-13423f4299e1/", relation: "equivalent" },
|
|
64
|
+
{ tool: "cfn-nag", rule: "W48", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/SqsQueueKmsMasterKeyIdRule.rb", relation: "overlaps" },
|
|
65
|
+
],
|
|
66
|
+
WAW027: [
|
|
67
|
+
{ tool: "cfn-nag", rule: "W78", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/DynamoDBBackupRule.rb", relation: "equivalent" },
|
|
68
|
+
{ tool: "checkov", rule: "CKV_AWS_28", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
69
|
+
{ tool: "guard-rules-registry", rule: "DYNAMODB_PITR_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/dynamodb/dynamodb_pitr_enabled.guard", relation: "equivalent" },
|
|
70
|
+
],
|
|
71
|
+
WAW028: [
|
|
72
|
+
{ tool: "cfn-nag", rule: "F1", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/EbsVolumeHasSseRule.rb", relation: "equivalent" },
|
|
73
|
+
{ tool: "checkov", rule: "CKV_AWS_3", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
74
|
+
{ tool: "guard-rules-registry", rule: "ENCRYPTED_VOLUMES", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_ec2/encrypted_volumes.guard", relation: "equivalent" },
|
|
75
|
+
],
|
|
76
|
+
WAW029: [
|
|
77
|
+
{ tool: "cfn-lint", rule: "E3005", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3005", relation: "equivalent" },
|
|
78
|
+
],
|
|
79
|
+
WAW032: [
|
|
80
|
+
{ tool: "checkov", rule: "CKV_AWS_97", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
81
|
+
{ tool: "kics", rule: "EFS Volume With Disabled Transit Encryption", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/c1282e03-b285-4637-aee7-eefe3a7bb658/", relation: "equivalent" },
|
|
82
|
+
],
|
|
83
|
+
WAW038: [
|
|
84
|
+
{ tool: "cfn-nag", rule: "F22", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/RDSInstancePubliclyAccessibleRule.rb", relation: "equivalent" },
|
|
85
|
+
{ tool: "checkov", rule: "CKV_AWS_17", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
86
|
+
{ tool: "kics", rule: "RDS DB Instance Publicly Accessible", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/de38e1d5-54cb-4111-a868-6f7722695007/", relation: "equivalent" },
|
|
87
|
+
],
|
|
88
|
+
WAW039: [
|
|
89
|
+
{ tool: "cfn-nag", rule: "W75", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/RDSInstanceBackupRetentionPeriodRule.rb", relation: "equivalent" },
|
|
90
|
+
{ tool: "guard-rules-registry", rule: "DB_INSTANCE_BACKUP_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_rds/db_instance_backup_enabled.guard", relation: "equivalent" },
|
|
91
|
+
{ tool: "kics", rule: "RDS With Backup Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/8c415f6f-7b90-4a27-a44a-51047e1506f9/", relation: "equivalent" },
|
|
92
|
+
],
|
|
93
|
+
WAW040: [
|
|
94
|
+
{ tool: "cfn-nag", rule: "F80", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/RDSInstanceDeletionProtectionRule.rb", relation: "equivalent" },
|
|
95
|
+
{ tool: "guard-rules-registry", rule: "RDS_INSTANCE_DELETION_PROTECTION_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_rds/rds_instance_deletion_protection_enabled.guard", relation: "equivalent" },
|
|
96
|
+
{ tool: "kics", rule: "RDS DB Instance With Deletion Protection Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/2c161e58-cb52-454f-abea-6470c37b5e6e/", relation: "equivalent" },
|
|
97
|
+
],
|
|
98
|
+
WAW042: [
|
|
99
|
+
{ tool: "guard-rules-registry", rule: "S3_BUCKET_SSL_REQUESTS_ONLY", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_s3/s3_bucket_ssl_requests_only.guard", relation: "equivalent" },
|
|
100
|
+
{ tool: "kics", rule: "S3 Bucket Without SSL In Write Actions", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/38c64e76-c71e-4d92-a337-60174d1de1c9/", relation: "overlaps" },
|
|
101
|
+
],
|
|
102
|
+
WAW043: [
|
|
103
|
+
{ tool: "cfn-nag", rule: "F19", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/KMSKeyRotationRule.rb", relation: "equivalent" },
|
|
104
|
+
{ tool: "checkov", rule: "CKV_AWS_7", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
105
|
+
{ tool: "guard-rules-registry", rule: "CMK_BACKING_KEY_ROTATION_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/aws_kms/cmk_backing_key_rotation_enabled.guard", relation: "equivalent" },
|
|
106
|
+
],
|
|
107
|
+
WAW044: [
|
|
108
|
+
{ tool: "checkov", rule: "CKV_AWS_2", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "overlaps" },
|
|
109
|
+
{ tool: "cfn-nag", rule: "W56", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/ElasticLoadBalancerV2ListenerProtocolRule.rb", relation: "overlaps" },
|
|
110
|
+
],
|
|
111
|
+
WAW045: [
|
|
112
|
+
{ tool: "cfn-nag", rule: "W55", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/ElasticLoadBalancerV2ListenerSslPolicyRule.rb", relation: "equivalent" },
|
|
113
|
+
{ tool: "checkov", rule: "CKV_AWS_103", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
114
|
+
{ tool: "guard-rules-registry", rule: "ELBV2_LISTENER_SSL_POLICY_RULE", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/elastic_load_balancing_v2/elbv2_listener_ssl_policy_rule.guard", relation: "equivalent" },
|
|
115
|
+
],
|
|
116
|
+
WAW049: [
|
|
117
|
+
{ tool: "cfn-nag", rule: "W2", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/SecurityGroupIngressOpenToWorldRule.rb", relation: "overlaps" },
|
|
118
|
+
{ tool: "guard-rules-registry", rule: "EC2_SECURITY_GROUP_INGRESS_OPEN_TO_WORLD_RULE", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/amazon_ec2/ec2_security_group_ingress_open_to_world_rule.guard", relation: "overlaps" },
|
|
119
|
+
{ tool: "kics", rule: "Unrestricted Security Group Ingress", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/4a1e6b34-1008-4e61-a5f2-1f7c276f8d14/", relation: "overlaps" },
|
|
120
|
+
],
|
|
121
|
+
WAW052: [
|
|
122
|
+
{ tool: "cfn-nag", rule: "F78", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/CognitoUserPoolMfaConfigurationOnorOptionalRule.rb", relation: "overlaps" },
|
|
123
|
+
{ tool: "guard-rules-registry", rule: "COGNITO_USER_POOL_MFA_CONFIGURATION_RULE", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/aws_cognito/cognito_user_pool_mfa_configuration_rule.guard", relation: "overlaps" },
|
|
124
|
+
{ tool: "kics", rule: "Cognito UserPool Without MFA", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/74a18d1a-cf02-4a31-8791-ed0967ad7fdc/", relation: "overlaps" },
|
|
125
|
+
],
|
|
126
|
+
WAW053: [
|
|
127
|
+
{ tool: "cfn-nag", rule: "W79", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/ECRRepositoryScanOnPushRule.rb", relation: "equivalent" },
|
|
128
|
+
{ tool: "checkov", rule: "CKV_AWS_163", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
129
|
+
{ tool: "guard-rules-registry", rule: "ECR_REPO_SCAN_ON_PUSH", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/aws_ecr/ecr_repo_scan_on_push_rule.guard", relation: "equivalent" },
|
|
130
|
+
],
|
|
131
|
+
WAW054: [
|
|
132
|
+
{ tool: "checkov", rule: "CKV_AWS_51", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
133
|
+
{ tool: "kics", rule: "ECR Image Tag Not Immutable", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/33f41d31-86b1-46a4-81f7-9c9a671f59ac/", relation: "equivalent" },
|
|
134
|
+
],
|
|
135
|
+
WAW055: [
|
|
136
|
+
{ tool: "cfn-nag", rule: "W86", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/LogsLogGroupRetentionRule.rb", relation: "equivalent" },
|
|
137
|
+
{ tool: "checkov", rule: "CKV_AWS_66", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "equivalent" },
|
|
138
|
+
{ tool: "guard-rules-registry", rule: "CW_LOGGROUP_RETENTION_PERIOD_CHECK", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/cloudwatch/cw_loggroup_retention_period_check.guard", relation: "equivalent" },
|
|
139
|
+
],
|
|
140
|
+
WAW058: [
|
|
141
|
+
{ tool: "guard-rules-registry", rule: "MULTI_REGION_CLOUD_TRAIL_ENABLED", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/cloudtrail/multi_region_cloud_trail_enabled.guard", relation: "overlaps" },
|
|
142
|
+
{ tool: "checkov", rule: "CKV_AWS_67", url: "https://www.checkov.io/5.Policy%20Index/cloudformation.html", relation: "overlaps" },
|
|
143
|
+
{ tool: "kics", rule: "CloudTrail Logging Disabled", url: "https://docs.kics.io/latest/queries/cloudformation-queries/aws/5c0b06d5-b7a4-484c-aeb0-75a836269ff0/", relation: "overlaps" },
|
|
144
|
+
],
|
|
145
|
+
WAW059: [
|
|
146
|
+
{ tool: "cfn-nag", rule: "W12", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/IamPolicyWildcardResourceRule.rb", relation: "overlaps" },
|
|
147
|
+
{ tool: "cfn-nag", rule: "W11", url: "https://github.com/stelligent/cfn_nag/blob/master/lib/cfn-nag/custom_rules/IamRoleWildcardResourceOnPermissionsPolicyRule.rb", relation: "overlaps" },
|
|
148
|
+
{ tool: "guard-rules-registry", rule: "IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE", url: "https://github.com/aws-cloudformation/aws-guard-rules-registry/blob/main/rules/aws/iam/iam_policydocument_no_wildcard_resource.guard", relation: "overlaps" },
|
|
149
|
+
],
|
|
150
|
+
WAW061: [
|
|
151
|
+
{ tool: "cfn-lint", rule: "E3059", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3059", relation: "equivalent" },
|
|
152
|
+
],
|
|
153
|
+
WAW062: [
|
|
154
|
+
{ tool: "cfn-lint", rule: "E3019", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3019", relation: "overlaps" },
|
|
155
|
+
],
|
|
156
|
+
WAW069: [
|
|
157
|
+
{ tool: "cfn-lint", rule: "E8002", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E8002", relation: "equivalent" },
|
|
158
|
+
],
|
|
159
|
+
};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { readFileSync } from "node:fs";
|
|
2
|
-
import {
|
|
2
|
+
import { sleep } from "@intentius/chant/op";
|
|
3
3
|
import { awsDeployCapabilitiesForBody } from "../../components/cloud-executor.js";
|
|
4
4
|
import { resolveEndpointOverride } from "../../api/read-client.js";
|
|
5
5
|
import { ownershipStackTagsForBody } from "../../ownership.js";
|
|
@@ -128,7 +128,6 @@ export async function waitForStackSettled(
|
|
|
128
128
|
const deadline = Date.now() + opts.timeoutMs;
|
|
129
129
|
while (Date.now() < deadline) {
|
|
130
130
|
if (signal?.aborted) throw new Error("awsApply aborted");
|
|
131
|
-
safeHeartbeat({ step: "awsApply", stack: stackName });
|
|
132
131
|
const res = await http(url, cfnForm("DescribeStacks", { StackName: stackName }), signal);
|
|
133
132
|
const status = stackStatus(res.text);
|
|
134
133
|
if (status && isTerminalStatus(status)) return status;
|
|
@@ -231,7 +230,6 @@ export async function awsDelete(
|
|
|
231
230
|
const deadline = Date.now() + timeoutMs;
|
|
232
231
|
while (Date.now() < deadline) {
|
|
233
232
|
if (signal?.aborted) throw new Error("awsDelete aborted");
|
|
234
|
-
safeHeartbeat({ step: "awsDelete", stack: args.stackName });
|
|
235
233
|
const d = await http(url, cfnForm("DescribeStacks", { StackName: args.stackName }), signal);
|
|
236
234
|
if (d.status >= 300 && isStackMissing(d.text)) return { stackName: args.stackName, deleted: true };
|
|
237
235
|
const status = stackStatus(d.text);
|
|
@@ -101,8 +101,9 @@ export function flociRunCommand(args: FlociUpArgs = {}): string {
|
|
|
101
101
|
* Idempotent: reuses a running container of the same name. Waits for the health
|
|
102
102
|
* endpoint to report `readyService`, then sets `AWS_ENDPOINT_URL` + test creds in
|
|
103
103
|
* the process environment so a following `nativeApply`/`cfn-deploy` targets the
|
|
104
|
-
* emulator. Env injection
|
|
105
|
-
*
|
|
104
|
+
* emulator. Env injection works because the local executor runs every step of a
|
|
105
|
+
* run in this process; a step that runs anywhere else needs the endpoint passed
|
|
106
|
+
* to it explicitly.
|
|
106
107
|
*/
|
|
107
108
|
export async function flociUp(args: FlociUpArgs = {}, signal?: AbortSignal): Promise<{ endpoint: string }> {
|
|
108
109
|
const region = args.region ?? DEFAULT_REGION;
|
package/src/op/builders.ts
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Typed step-builder wrappers for this lexicon's activities (chant #1288
|
|
3
3
|
* Stage 2). See `lexicons/k8s/src/op/builders.ts`'s module doc for why these
|
|
4
|
-
* live beside their `*Args` interfaces rather than in core
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
4
|
+
* live beside their `*Args` interfaces rather than in core: core cannot
|
|
5
|
+
* import a lexicon's types (lexicons depend on core, not the reverse), so a
|
|
6
|
+
* wrapper whose `opts` IS the activity's own `*Args` interface can only sit
|
|
7
|
+
* in the lexicon that declares that interface. `opts`'s type in
|
|
8
8
|
* each wrapper below IS the activity's own `*Args` interface (via
|
|
9
9
|
* `Omit`/`WithStepRefs`) — never restated. `core`'s own
|
|
10
10
|
* `awsApply`/`awsDelete`/`flociUp`/`flociDown` are unchanged and produce
|