@intentius/chant-lexicon-aws 0.124.43 → 0.124.45

package/dist/codegen/generate-lexicon.d.ts

@@ -3,7 +3,7 @@
  *
  * Output is a Record<string, LexiconEntry> keyed by generated class name.
  */
-import type { SchemaParseResult } from "../spec/parse.js";
+import type { ResourceTagging, SchemaParseResult } from "../spec/parse.js";
 import type { NamingStrategy } from "./naming.js";
 import type { ExtensionConstraint } from "./extensions.js";
 import type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
@@ -25,11 +25,7 @@ export interface LexiconEntry {
     inferredDeprecations?: string[];
     conditionalCreateOnly?: string[];
     replacementStrategy?: "delete_then_create" | "create_then_delete";
-    tagging?: {
-        taggable: boolean;
-        tagOnCreate: boolean;
-        tagUpdatable: boolean;
-    };
+    tagging?: ResourceTagging;
     runtimeDeprecations?: Record<string, string>;
 }
 /**

package/dist/codegen/generate-lexicon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-lexicon.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-lexicon.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC1D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAClE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,iBAAiB,EAAE,EAC5B,MAAM,EAAE,cAAc,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,EAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GACjD,MAAM,CA+CR;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYlE"}
+{"version":3,"file":"generate-lexicon.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-lexicon.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC1D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAClE,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,iBAAiB,EAAE,EAC5B,MAAM,EAAE,cAAc,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,EAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GACjD,MAAM,CA+CR;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYlE"}

package/dist/deep-observe.d.ts

@@ -197,8 +197,12 @@ export interface CloudControlResource {
     identifier: string;
     properties: Record<string, unknown>;
 }
-/** True when the live property tree carries chant's ownership marker tag. */
-export declare function hasOwnershipMarker(properties: Record<string, unknown>): boolean;
+/**
+ * True when the live property tree carries chant's ownership marker tag. With
+ * a `type`, the tags are read from that type's own tag property
+ * (`UserPoolTags`); either way a list or a map reads (#4350).
+ */
+export declare function hasOwnershipMarker(properties: Record<string, unknown>, type?: string): boolean;
 export interface AwsDeepObserveOptions {
     environment: string;
     entityNames: string[];

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,mBAAmB,CAAC;AAgB3B;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,GAAG,EAAE,eAAe,CAAA;CAAE,GACxB;IACE,GAAG,EAAE,KAAK,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpE,CAAC;AAEN,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAkBnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AAE3F;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,6EAA6E;QAC7E,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;KAClD,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAkBzE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAkBlD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBxE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAGnE,CAAC;AAWF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAU9E;AA6BD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBA+EvC,CAAC;AAMF,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAmED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAI/E;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;kDAG8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAoKhC"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,mBAAmB,CAAC;AAiB3B;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,GAAG,EAAE,eAAe,CAAA;CAAE,GACxB;IACE,GAAG,EAAE,KAAK,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpE,CAAC;AAEN,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAkBnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AAE3F;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,6EAA6E;QAC7E,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;KAClD,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAkBzE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAkBlD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBxE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAGnE,CAAC;AAWF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAU9E;AA6BD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAiFvC,CAAC;AAMF,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAyED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAE9F;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;kDAG8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAoKhC"}

package/dist/deep-observe.js

@@ -45,6 +45,7 @@
 import { AwsReadError, describeStackResources, getResource, listResources, } from "./api/read-client.js";
 import { declaredIdentifier } from "./identity-observe.js";
 import { AWS_TAG_OWNERSHIP_KEYS } from "./ownership.js";
+import { readResourceTags, tagPlacementFor } from "./taggable.js";
 import { AWS_DEEP_BLIND_SPOTS, EC2_TOPOLOGY_GENERATED_NAMES, EC2_TOPOLOGY_SERVICE_DEFAULTS, EC2_TOPOLOGY_SOURCES, } from "./deep-topology.js";
 import { applyAwsEndpointArgv } from "./components/cloud-executor.js";
 import { toIngressRules } from "./dependencies.js";
@@ -304,6 +305,9 @@ export const awsDeepNormalizationHooks = {
         // still compared against what is live.
         if (isOwnershipTag(node.value))
             return true;
+        // The same marker as a map entry, on a map-tagged type (#4350).
+        if (OWNERSHIP_TAG_KEYS.has(node.key) && isMapTagEntry(node.entityType, node.pattern, node.key))
+            return true;
         // A name the service generated because source did not supply one.
         if (AWS_GENERATED_NAMES[node.entityType]?.has(node.pattern))
             return true;
@@ -412,12 +416,18 @@ const OWNERSHIP_TAG_KEYS = new Set(Object.values(AWS_TAG_OWNERSHIP_KEYS));
 function isOwnershipTag(value) {
     return isRecord(value) && typeof value.Key === "string" && OWNERSHIP_TAG_KEYS.has(value.Key);
 }
-/** True when the live property tree carries chant's ownership marker tag. */
-export function hasOwnershipMarker(properties) {
-    const tags = properties.Tags;
-    if (!Array.isArray(tags))
-        return false;
-    return tags.some((t) => isRecord(t) && t.Key === AWS_TAG_OWNERSHIP_KEYS.managedBy);
+/** True when `pattern` is `<tagProperty>.<key>` on a type whose tags are a map. */
+function isMapTagEntry(type, pattern, key) {
+    const placement = tagPlacementFor(type);
+    return placement?.shape === "map" && pattern === `${placement.property}.${key}`;
+}
+/**
+ * True when the live property tree carries chant's ownership marker tag. With
+ * a `type`, the tags are read from that type's own tag property
+ * (`UserPoolTags`); either way a list or a map reads (#4350).
+ */
+export function hasOwnershipMarker(properties, type) {
+    return readResourceTags(type, properties)[AWS_TAG_OWNERSHIP_KEYS.managedBy] !== undefined;
 }
 /**
  * Read the live property tree for each declared entity via Cloud Control.
@@ -530,7 +540,7 @@ export async function observeResourcesDeepAws(options) {
         // thin path this one can answer the ownership question (#1015's open note).
         // A resource withheld by the filter is `filtered`, never absent: it exists,
         // it just isn't chant's.
-        const owned = hasOwnershipMarker(properties);
+        const owned = hasOwnershipMarker(properties, type);
         if (options.owned && !owned) {
             unobserved[entityName] = {
                 type,

package/dist/import/live-export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-export.d.ts","sourceRoot":"","sources":["../../src/import/live-export.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKnF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,OAAO,EACrB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,KAAK,CAAC,EAAE,OAAO,GACd,gBAAgB,CAoBlB"}
+{"version":3,"file":"live-export.d.ts","sourceRoot":"","sources":["../../src/import/live-export.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAMnF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,OAAO,EACrB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,KAAK,CAAC,EAAE,OAAO,GACd,gBAAgB,CAuBlB"}

package/dist/import/live-export.js

@@ -1,5 +1,6 @@
-import { hasOwnershipMarker, tagArrayToMap } from "@intentius/chant/ownership";
-import { AWS_TAG_OWNERSHIP_KEYS } from "../ownership.js";
+import { hasOwnershipMarker } from "@intentius/chant/ownership";
+import { AWS_TAG_OWNERSHIP_KEYS, OWNERSHIP_METADATA_KEY } from "../ownership.js";
+import { readResourceTags, readTagValue } from "../taggable.js";
 import { CFParser } from "./parser.js";
 /**
  * Map a live CloudFormation template body to full-fidelity export IR.
@@ -24,8 +25,11 @@ export function parseStackTemplate(templateBody, selector, owned) {
             if (selector?.name !== undefined && r.logicalId !== selector.name)
                 return false;
             if (owned) {
-                const tags = r.properties.Tags;
-                if (!hasOwnershipMarker(tagArrayToMap(tags), AWS_TAG_OWNERSHIP_KEYS))
+                // The marker sits in the type's own tag property, in either shape, or
+                // in the resource's Metadata for a type whose tags can't be stamped (#4350).
+                const tags = readResourceTags(r.type, r.properties);
+                const marker = readTagValue(r.metadata?.[OWNERSHIP_METADATA_KEY]);
+                if (!hasOwnershipMarker(tags, AWS_TAG_OWNERSHIP_KEYS) && !hasOwnershipMarker(marker, AWS_TAG_OWNERSHIP_KEYS))
                     return false;
             }
             return true;

package/dist/integrity.json

@@ -1,8 +1,8 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "4d860e44d1e4e6e356a9d88757706b0a5baf926d1056848631845a7eca1d4893",
-    "meta.json": "3e18663eb9eb09920882f8014020432330a74ccd480689e7384c2022cbb10f39",
+    "manifest.json": "4e87272580ed7978235350ce2c7631c83b575c7bc765f3c27002e63bc02c18b6",
+    "meta.json": "6f48557ed4203cbdeafdb47e7270fdf3533f6d6e6189987246301ed8e72170e9",
     "types/index.d.ts": "8651f9ae166668f4311eea1fe61c3fe235f345947951c1d23d1df24a4fd3384f",
     "rules/hardcoded-region.ts": "957eadcaa9f39cc17d21437565d7a94607d9b082cf28918b178fa067f07498a9",
     "rules/iam-wildcard.ts": "10f5065fa2bbf2c8ce23dfb475a56df33f280df87784e44fec641b2584cbf333",
@@ -16,7 +16,7 @@
     "rules/waw014.ts": "889f1b06899b50f98941d05b029954cf375ac8a130933b98c9586079096216aa",
     "rules/waw015.ts": "071c940fb6432cd8b42a44d083921e9491d5063417839109c10b2bd13dd2032e",
     "rules/waw016.ts": "2c4e230c98056a03ecdbfa0e408e36a31733e83cc96419910ae3ec9fd4b7fd9e",
-    "rules/waw017.ts": "658554008954f71036e23b514dece7063142198fbdca125f11d09026f1d21ab2",
+    "rules/waw017.ts": "cb7386f8c91285da46e55ba28191ba2ce38eb070e3bed037d2419352f3b9d152",
     "rules/waw018.ts": "a4aa83a25104f039a6c5e0f3e1f5b8b65e493b0ba162c985988190a726b90d2f",
     "rules/waw019.ts": "f14ebf024a3cce7005d54c762e4e0979537d6a854fb123344107d40d92a94b5c",
     "rules/waw020.ts": "3958b724a4b6e2c954e6f85a611a928003fd13282632d6bae8f560d805b97f8b",
@@ -70,9 +70,10 @@
     "rules/waw068.ts": "adbfe84e9b3cdafc072346d87a5df81a97ab07bc5171f3d4abb824c29e9a66a0",
     "rules/waw069.ts": "4792bb3943d5e08039f45cbf554f45263703288acf4ca01d88ad778083023d27",
     "rules/waw070.ts": "35bd2281ab072a1d6138e0db9f9d6f4f0b6c5af4deacb28aa693177c654db66a",
+    "rules/waw071.ts": "d0d6e82aa7b347c1a3f41803c53906ea31a085bf04efca7f9bd7894e180b2846",
     "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "8780b94ce60aded935938d5ef20ea667738354051da1bf9ca6d70d9886f65d21"
   },
-  "composite": "e42eeece34dd3644f68145fae8204a7fc97d2414d8f8dbab29f62c49bc5f4f88"
+  "composite": "6e6034cc52fcfa710c8daa010fd67a0f510a61a93cf862910a0b85791d67d96f"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAgC,MAAM,gCAAgC,CAAC;AASxG,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA4EpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAgC,MAAM,gCAAgC,CAAC;AASxG,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA6EpD,CAAC"}

package/dist/lint/audit-catalog.js

@@ -83,6 +83,7 @@ export const awsAuditCatalog = {
     WAW068: auditRule("WAW068", "report-only", "guidance", "VPN Gateway or Transit Gateway has only one attached VPN Connection", "Attach a second VPNConnection (ideally to a separate Customer Gateway) for redundancy.", { category: "best-practice" }),
     WAW069: auditRule("WAW069", "merge-worthy", "guidance", "Template references a condition it never declares", "Declare the condition in the Conditions section (new Condition(...)), or fix the referenced name.", { category: "correctness" }),
     WAW070: auditRule("WAW070", "merge-worthy", "guidance", "Ref or Fn::GetAtt names something the template doesn't declare", "Reference a resource or parameter in this template. A value from another lexicon's resource arrives as a parameter.", { category: "correctness" }),
+    WAW071: auditRule("WAW071", "merge-worthy", "guidance", "Tags are in the wrong property or the wrong shape for the resource type", "Write the tags in the property the type uses and in the shape it takes, which is a list of Key and Value pairs for most types and a map for some, such as UserPoolTags on AWS::Cognito::UserPool.", { category: "correctness" }),
 };
 // Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
 applyLineage(awsAuditCatalog, awsAuditLineage);

package/dist/lint/audit-lineage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAyJrD,CAAC"}
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CA6JrD,CAAC"}

package/dist/lint/audit-lineage.js

@@ -151,4 +151,8 @@ export const awsAuditLineage = {
         { tool: "cfn-lint", rule: "E1012", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E1012", relation: "equivalent" },
         { tool: "cfn-lint", rule: "E1010", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E1010", relation: "overlaps" },
     ],
+    WAW071: [
+        { tool: "cfn-lint", rule: "E3002", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3002", relation: "overlaps" },
+        { tool: "cfn-lint", rule: "E3012", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3012", relation: "overlaps" },
+    ],
 };

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAgEvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA+D3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAiEvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAgE3C,CAAC"}

package/dist/lint/post-synth/index.js

@@ -60,6 +60,7 @@ import { waw067 } from "./waw067.js";
 import { waw068 } from "./waw068.js";
 import { waw069 } from "./waw069.js";
 import { waw070 } from "./waw070.js";
+import { waw071 } from "./waw071.js";
 export const postSynthChecks = [
     cor020,
     ext001,
@@ -123,4 +124,5 @@ export const postSynthChecks = [
     waw068,
     waw069,
     waw070,
+    waw071,
 ];

package/dist/lint/post-synth/waw017.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"waw017.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw017.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAI9G;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,mBAAmB,EAAE,CA0BvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}
+{"version":3,"file":"waw017.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw017.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAI9G;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,mBAAmB,EAAE,CA2BvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw017.js

@@ -5,7 +5,7 @@
  * Encourages adding tags for cost allocation and compliance.
  */
 import { parseCFTemplate } from "./cf-refs.js";
-import { loadTaggableResources } from "../../taggable.js";
+import { loadTaggableResources, tagPlacementFor } from "../../taggable.js";
 /**
  * Core detection logic — exported for direct testing with synthetic data.
  */
@@ -21,7 +21,8 @@ export function checkMissingTags(ctx, taggable) {
             if (!taggable.has(resource.Type))
                 continue;
             const props = resource.Properties ?? {};
-            if (!("Tags" in props)) {
+            const tagProperty = tagPlacementFor(resource.Type)?.property ?? "Tags";
+            if (!(tagProperty in props)) {
                 diagnostics.push({
                     checkId: "WAW017",
                     severity: "warning",

package/dist/lint/post-synth/waw071.d.ts

@@ -0,0 +1,19 @@
+/**
+ * WAW071: Tags are in the wrong property or the wrong shape for the type
+ *
+ * Each taggable type names its tag property and shape in its schema
+ * (`tagging.tagProperty`): a `[{Key, Value}]` list for most types, a map for
+ * types such as `AWS::SSM::Parameter`, and a property other than `Tags` for
+ * types such as `AWS::Cognito::UserPool` (`UserPoolTags`). CloudFormation
+ * rejects a template that puts tags anywhere else. chant stamped the ownership
+ * marker as a `Tags` list on every type until #4350; this check catches the
+ * next such template.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { type TagPlacement } from "../../taggable.js";
+/**
+ * Core detection logic — exported for direct testing with synthetic data.
+ */
+export declare function checkTagShapes(ctx: PostSynthContext, placements: Map<string, TagPlacement | null>): PostSynthDiagnostic[];
+export declare const waw071: PostSynthCheck;
+//# sourceMappingURL=waw071.d.ts.map

package/dist/lint/post-synth/waw071.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw071.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw071.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE9G,OAAO,EAAqC,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAiBtF;;GAEG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC,GAC3C,mBAAmB,EAAE,CAsCvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw071.js

@@ -0,0 +1,76 @@
+/**
+ * WAW071: Tags are in the wrong property or the wrong shape for the type
+ *
+ * Each taggable type names its tag property and shape in its schema
+ * (`tagging.tagProperty`): a `[{Key, Value}]` list for most types, a map for
+ * types such as `AWS::SSM::Parameter`, and a property other than `Tags` for
+ * types such as `AWS::Cognito::UserPool` (`UserPoolTags`). CloudFormation
+ * rejects a template that puts tags anywhere else. chant stamped the ownership
+ * marker as a `Tags` list on every type until #4350; this check catches the
+ * next such template.
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+import { isTagIntrinsic, loadTagPlacements } from "../../taggable.js";
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Why `value` doesn't fit `placement`, or undefined when it does. */
+function shapeProblem(value, placement) {
+    if (isTagIntrinsic(value))
+        return undefined;
+    if (placement.shape === "map") {
+        return isPlainObject(value) ? undefined : "a list, but the type takes a key-to-value map";
+    }
+    if (!Array.isArray(value))
+        return "a map, but the type takes a [{Key, Value}] list";
+    const bad = value.some((t) => !isTagIntrinsic(t) && !(isPlainObject(t) && "Key" in t && "Value" in t));
+    return bad ? "a list with an entry that has no Key and Value" : undefined;
+}
+/**
+ * Core detection logic — exported for direct testing with synthetic data.
+ */
+export function checkTagShapes(ctx, placements) {
+    const diagnostics = [];
+    for (const [lexicon, output] of ctx.outputs) {
+        if (lexicon !== "aws")
+            continue;
+        const template = parseCFTemplate(output);
+        if (!template?.Resources)
+            continue;
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            const placement = placements.get(resource.Type);
+            if (!placement)
+                continue;
+            const props = resource.Properties ?? {};
+            if (placement.property !== "Tags" && "Tags" in props) {
+                diagnostics.push({
+                    checkId: "WAW071",
+                    severity: "error",
+                    message: `Resource "${logicalId}" (${resource.Type}) has Tags, but the type takes its tags in ${placement.property}`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+            if (!(placement.property in props))
+                continue;
+            const problem = shapeProblem(props[placement.property], placement);
+            if (problem) {
+                diagnostics.push({
+                    checkId: "WAW071",
+                    severity: "error",
+                    message: `Resource "${logicalId}" (${resource.Type}) has ${placement.property} as ${problem}`,
+                    entity: logicalId,
+                    lexicon: "aws",
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+export const waw071 = {
+    id: "WAW071",
+    description: "Tags are in the wrong property or the wrong shape for the resource type",
+    check(ctx) {
+        return checkTagShapes(ctx, loadTagPlacements());
+    },
+};

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.124.43",
+  "version": "0.124.45",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [