@intentius/chant-lexicon-aws 0.15.2 → 0.16.0

package/dist/integrity.json

@@ -1,9 +1,9 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "ebb81ef771d7eb7cb8397a82fa80d25a60122ea6fa641b7f8444fb2bd076d134",
-    "meta.json": "511f57814cc8d99a30cbcef2830f21ec374f2919f1d4cffcdc40986b0bf754da",
-    "types/index.d.ts": "096157407bc4a48fe332cd67cc5b3832d513e63995a5b199b89dc34914ba348d",
+    "manifest.json": "4282939cf051b4da7ca9e313ccb46b0630a416bebd2a7b936ec4ec7c39c038f5",
+    "meta.json": "db6740cf5f9f4905356254ed1e7ae0d1a085a2654b39b88f05430d6b5bdeec45",
+    "types/index.d.ts": "ab992861cae92b9457e0f50126d40af6d4bf201080cdd39c1141c9e064871f23",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
     "rules/iam-wildcard.ts": "135d7217d278fef50939e605c5da32603ba35674b8c4b5c4d66a06c77903e945",
     "rules/s3-encryption.ts": "c4f9f8aa8dc382ed98c7b04e820a600590cc75335a8db2e087cbfbfe4003d09e",
@@ -40,5 +40,5 @@
     "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe"
   },
-  "composite": "f57f891aaaf8b25f11c51264e4706ed25405a8324a46071b4c01683e68e833b6"
+  "composite": "ba439338cdd841a058d4496befb469671da386616c8525554fc3df56514d4365"
 }

package/dist/live-attrs.d.ts

@@ -0,0 +1,4 @@
+import type { ExportedTemplate } from "@intentius/chant/lexicon";
+/** logical id → resolved properties (references become bare logical-id strings). */
+export declare function resolveTemplateAttrs(template: ExportedTemplate): Record<string, Record<string, unknown>>;
+//# sourceMappingURL=live-attrs.d.ts.map

package/dist/live-attrs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-attrs.d.ts","sourceRoot":"","sources":["../src/live-attrs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAgCjE,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAMxG"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.15.2",
+  "version": "0.16.0",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/meta.json

@@ -8672,6 +8672,16 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "AzureProviderConfiguration": {
+    "resourceType": "AWS::SecurityHub::Connector.AzureProviderConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "AzureScopeConfiguration": {
+    "resourceType": "AWS::SecurityHub::Connector.AzureScopeConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "B2BICapability": {
     "resourceType": "AWS::B2BI::Capability",
     "kind": "resource",
@@ -18201,6 +18211,9 @@
     "resourceType": "AWS::Config::ConformancePack",
     "kind": "resource",
     "lexicon": "aws",
+    "attrs": {
+      "ConformancePackArn": "ConformancePackArn"
+    },
     "propertyConstraints": {
       "ConformancePackName": {
         "pattern": "[a-zA-Z][-a-zA-Z0-9]*",
@@ -18235,13 +18248,23 @@
     ],
     "primaryIdentifier": [
       "ConformancePackName"
-    ]
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
   },
   "ConformancePack_ConformancePackInputParameter": {
     "resourceType": "AWS::Config::ConformancePack.ConformancePackInputParameter",
     "kind": "property",
     "lexicon": "aws"
   },
+  "ConformancePack_Tag": {
+    "resourceType": "AWS::Config::ConformancePack.Tag",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "ConnectAction": {
     "resourceType": "AWS::SES::ReceiptRule.ConnectAction",
     "kind": "property",
@@ -19800,7 +19823,10 @@
       "ConnectorStatus": "ConnectorStatus",
       "LastUpdatedAt": "LastUpdatedAt",
       "LastCheckedAt": "LastCheckedAt",
-      "CreatedAt": "CreatedAt"
+      "CreatedAt": "CreatedAt",
+      "EnablementStatus": "EnablementStatus",
+      "EnablementStatusReason": "EnablementStatusReason",
+      "Issues": "Issues"
     },
     "propertyConstraints": {
       "Name": {
@@ -19818,14 +19844,6 @@
         "minLength": 20,
         "maxLength": 2048
       },
-      "ConnectorStatus": {
-        "enum": [
-          "CONNECTED",
-          "FAILED_TO_CONNECT",
-          "PENDING_AUTHORIZATION",
-          "PENDING_CONFIGURATION"
-        ]
-      },
       "ConnectorArn": {
         "pattern": "^arn:aws\\S*:securityhub:[a-z0-9-]+:[0-9]{12}:connectorv2/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
       },
@@ -19836,7 +19854,8 @@
     "createOnly": [
       "Name",
       "KmsKeyArn",
-      "Provider/ServiceNow/InstanceName"
+      "Provider/ServiceNow/InstanceName",
+      "Provider/Azure/AWSConfigConnectorArn"
     ],
     "primaryIdentifier": [
       "ConnectorArn"
@@ -19847,6 +19866,11 @@
       "tagUpdatable": true
     }
   },
+  "ConnectorV2_HealthIssue": {
+    "resourceType": "AWS::SecurityHub::ConnectorV2.HealthIssue",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "ConnectorVpcLatticeEgressConfig": {
     "resourceType": "AWS::Transfer::Connector.ConnectorVpcLatticeEgressConfig",
     "kind": "property",
@@ -87621,6 +87645,63 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "SecurityHubConnector": {
+    "resourceType": "AWS::SecurityHub::Connector",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "ConnectorArn": "ConnectorArn",
+      "ConnectorId": "ConnectorId",
+      "ConnectorStatus": "ConnectorStatus",
+      "Message": "Message",
+      "LastCheckedAt": "LastCheckedAt",
+      "CreatedAt": "CreatedAt",
+      "LastUpdatedAt": "LastUpdatedAt",
+      "CreatedBy": "CreatedBy",
+      "EnablementStatus": "EnablementStatus",
+      "Issues": "Issues"
+    },
+    "propertyConstraints": {
+      "ConnectorArn": {
+        "pattern": "^arn:aws\\S*:securityhub:[a-z0-9-]+:[0-9]{12}:connector/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
+      },
+      "ConnectorId": {
+        "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
+      }
+    },
+    "createOnly": [
+      "Name",
+      "Provider/Azure/AWSConfigConnectorArn"
+    ],
+    "primaryIdentifier": [
+      "ConnectorArn"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
+  },
+  "SecurityHubConnector_AzureProviderConfiguration": {
+    "resourceType": "AWS::SecurityHub::Connector.AzureProviderConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "SecurityHubConnector_AzureScopeConfiguration": {
+    "resourceType": "AWS::SecurityHub::Connector.AzureScopeConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "SecurityHubConnector_HealthIssue": {
+    "resourceType": "AWS::SecurityHub::Connector.HealthIssue",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "SecurityHubConnector_Provider": {
+    "resourceType": "AWS::SecurityHub::Connector.Provider",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "SecurityHubHub": {
     "resourceType": "AWS::SecurityHub::Hub",
     "kind": "resource",
@@ -97964,6 +98045,32 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "TransitGatewayPolicyTable": {
+    "resourceType": "AWS::EC2::TransitGatewayPolicyTable",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "TransitGatewayPolicyTableId": "TransitGatewayPolicyTableId",
+      "State": "State",
+      "CreationTime": "CreationTime"
+    },
+    "createOnly": [
+      "TransitGatewayId"
+    ],
+    "primaryIdentifier": [
+      "TransitGatewayPolicyTableId"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
+  },
+  "TransitGatewayPolicyTable_Tag": {
+    "resourceType": "AWS::EC2::TransitGatewayPolicyTable.Tag",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "TransitGatewayRegistration": {
     "resourceType": "AWS::NetworkManager::TransitGatewayRegistration",
     "kind": "resource",

package/dist/op/activities/aws-apply.d.ts

@@ -0,0 +1,76 @@
+export interface AwsApplyArgs {
+    /** Path to a built CloudFormation template (JSON/YAML). */
+    templatePath: string;
+    /** CloudFormation stack name — the deploy boundary. */
+    stackName: string;
+    /** CFN endpoint override (e.g. Floci `http://localhost:4566`). Default: real CloudFormation. */
+    endpoint?: string;
+    /** Region (real CFN host + `Version` context). Default: `us-east-1`. */
+    region?: string;
+    /** Capabilities to acknowledge. Default: `["CAPABILITY_NAMED_IAM"]`. */
+    capabilities?: string[];
+    /** Stack-settle timeout in ms. Default: `300000`. */
+    timeoutMs?: number;
+    /** Poll interval in ms. Default: `3000`. */
+    intervalMs?: number;
+}
+/** Injectable CFN transport — a form POST returning the raw XML. Mirrors the az/gcp appliers so tests avoid the network. */
+export type AwsHttp = (url: string, form: Record<string, string>, signal?: AbortSignal) => Promise<{
+    status: number;
+    text: string;
+}>;
+/** The CloudFormation endpoint URL — the override, or the real regional host. */
+export declare function cfnUrl(endpoint?: string, region?: string): string;
+/** A CFN Query-protocol form body: `Action` + `Version` + params. */
+export declare function cfnForm(action: string, params: Record<string, string>): Record<string, string>;
+/** Capabilities as the CFN `Capabilities.member.N` list params. */
+export declare function capabilityParams(capabilities: string[]): Record<string, string>;
+/**
+ * First `<tag>…</tag>` text in a CFN XML response.
+ *
+ * Assumes flat scalar fields — the CloudFormation Query API returns simple
+ * `<StackStatus>…</StackStatus>` style leaves, so `[^<]*` is sufficient. It does
+ * NOT handle nested tags or XML entities in the value; if a field ever carries
+ * either, replace this with a real XML parser.
+ */
+export declare function xmlField(xml: string, tag: string): string | undefined;
+export declare const stackStatus: (xml: string) => string | undefined;
+export declare const stackId: (xml: string) => string | undefined;
+export declare const cfnErrorMessage: (xml: string) => string | undefined;
+/** A DescribeStacks error for an absent stack (drives create-vs-update). */
+export declare const isStackMissing: (xml: string) => boolean;
+/** The real-AWS UpdateStack no-op error (Floci returns 200 instead). */
+export declare const isNoUpdates: (xml: string) => boolean;
+export declare const isSuccessStatus: (status: string) => boolean;
+export declare const isFailureStatus: (status: string) => boolean;
+/** A settled stack state — success, failure, or deleted. Transient `*_IN_PROGRESS` states aren't. */
+export declare const isTerminalStatus: (status: string) => boolean;
+/** Poll DescribeStacks until the stack reaches a terminal state; returns that status. */
+export declare function waitForStackSettled(url: string, stackName: string, http: AwsHttp, opts: {
+    timeoutMs: number;
+    intervalMs: number;
+}, signal?: AbortSignal): Promise<string>;
+/**
+ * The native AWS applier — deploy a built CloudFormation template by calling the
+ * CloudFormation API directly (create-or-update + poll to a settled stack),
+ * targeting a local Floci emulator or real AWS by endpoint override. The direct
+ * twin of `azApply`/`gcpApply`: it speaks the CloudFormation Query API over HTTP
+ * rather than shelling `aws cloudformation deploy` (that CLI path is still
+ * available via `nativeApply({ target: "cloudformation" })`). The stack is the
+ * ownership boundary, so deletes ride CloudFormation itself — no separate prune.
+ * `http` is injectable for tests.
+ */
+export declare function awsApply(args: AwsApplyArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
+    stackName: string;
+    status: string;
+    action: "created" | "updated" | "unchanged";
+}>;
+/**
+ * The inverse of {@link awsApply} — DeleteStack, then poll until the stack is
+ * gone. Idempotent: an already-absent stack is a no-op. `http` is injectable.
+ */
+export declare function awsDelete(args: AwsApplyArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
+    stackName: string;
+    deleted: boolean;
+}>;
+//# sourceMappingURL=aws-apply.d.ts.map

package/dist/op/activities/aws-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/aws-apply.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4HAA4H;AAC5H,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAcrI,iFAAiF;AACjF,wBAAgB,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAEzE;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9F;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAyC,CAAC;AAC7F,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AACrF,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AAE7F,4EAA4E;AAC5E,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,OAAsC,CAAC;AACpF,wEAAwE;AACxE,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OAAsD,CAAC;AAGjG,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAqC,CAAC;AACvF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAyC,CAAC;AAC3F,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,OACkC,CAAC;AAIrF,yFAAyF;AACzF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC/C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAID;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAuC7F;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAsBlD"}

package/dist/op/activities/floci.d.ts

@@ -20,35 +20,27 @@ export interface FlociDownArgs {
     /** Container name to remove. Default: `chant-floci`. */
     name?: string;
 }
-/** `docker ps -q -f name=<name>` — non-empty stdout means the container is running. */
-export declare function flociExistsCommand(name: string): string;
-/** Build the `docker run` command that boots Floci. */
-export declare function flociRunCommand(args: FlociUpArgs): string;
-/** Build the `docker rm -f` command. */
-export declare function flociRmCommand(name: string): string;
-/** The Floci health endpoint URL for a host port. */
-export declare function flociHealthUrl(port: number): string;
-/** The AWS env vars that point the `aws` CLI / SDK at a local Floci endpoint. */
-export declare function flociEnv(port: number, region: string): Record<string, string>;
 /** True once the health body reports the required service (e.g. `"cloudformation"`). */
 export declare function isFlociReady(healthBody: string, service: string): boolean;
+/** The AWS env vars that point the `aws` CLI / SDK at a local Floci endpoint. */
+export declare function flociEnv(port: number, region: string): Record<string, string>;
+export declare const flociExistsCommand: (name: string) => string;
+export declare const flociRmCommand: (name: string) => string;
+export declare const flociHealthUrl: (port: number) => string;
+/** Build the `docker run` command that boots Floci. */
+export declare function flociRunCommand(args?: FlociUpArgs): string;
 /**
  * Boot a local Floci AWS emulator in Docker and point subsequent steps at it.
  *
  * Idempotent: reuses a running container of the same name. Waits for the health
  * endpoint to report `readyService`, then sets `AWS_ENDPOINT_URL` + test creds in
  * the process environment so a following `nativeApply`/`cfn-deploy` targets the
- * emulator. Env injection assumes the in-process **local executor**; under a
+ * emulator. Env injection assumes the in-process local executor; under a
  * distributed Temporal worker, pass the endpoint explicitly instead.
- *
- * Uses longInfra profile — 20m timeout, heartbeat every poll (the image may pull).
  */
-export declare function flociUp(args: FlociUpArgs, signal?: AbortSignal): Promise<{
+export declare function flociUp(args?: FlociUpArgs, signal?: AbortSignal): Promise<{
     endpoint: string;
 }>;
-/**
- * Stop and remove the local Floci emulator container. A no-op success when the
- * container is already gone. Uses fastIdempotent profile — 5m timeout.
- */
-export declare function flociDown(args: FlociDownArgs, signal?: AbortSignal): Promise<void>;
+/** Stop and remove the local Floci emulator container (no-op if already gone). */
+export declare function flociDown(args?: FlociDownArgs, signal?: AbortSignal): Promise<void>;
 //# sourceMappingURL=floci.d.ts.map

package/dist/op/activities/floci.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"floci.d.ts","sourceRoot":"","sources":["../../../src/op/activities/floci.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAQzD;AAED,wCAAwC;AACxC,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,qDAAqD;AACrD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO7E;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA+CpG;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOxF"}
+{"version":3,"file":"floci.d.ts","sourceRoot":"","sources":["../../../src/op/activities/floci.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO7E;AAgBD,eAAO,MAAM,kBAAkB,0BAAyB,CAAC;AACzD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AACjD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AAEjD,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,IAAI,GAAE,WAAgB,GAAG,MAAM,CAO9D;AAED;;;;;;;;GAQG;AACH,wBAAsB,OAAO,CAAC,IAAI,GAAE,WAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBzG;AAED,kFAAkF;AAClF,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F"}

package/dist/op/activities/index.d.ts

@@ -1,8 +1,12 @@
 /**
  * AWS Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `aws` lexicon. Contributes the local Floci AWS
- * emulator lifecycle (`flociUp`/`flociDown`).
+ * emulator lifecycle (`flociUp`/`flociDown`) and the native CloudFormation
+ * applier (`awsApply`), which calls the CloudFormation API directly rather than
+ * shelling `aws` — the direct twin of `azApply`/`gcpApply`.
  */
 export { flociUp, flociDown, flociRunCommand, flociRmCommand, flociExistsCommand, flociHealthUrl, flociEnv, isFlociReady, } from "./floci.js";
 export type { FlociUpArgs, FlociDownArgs } from "./floci.js";
+export { awsApply, awsDelete, waitForStackSettled, cfnUrl, cfnForm, capabilityParams, xmlField, stackStatus, stackId, cfnErrorMessage, isStackMissing, isNoUpdates, isSuccessStatus, isFailureStatus, isTerminalStatus, } from "./aws-apply.js";
+export type { AwsApplyArgs, AwsHttp } from "./aws-apply.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,QAAQ,EACR,SAAS,EACT,mBAAmB,EACnB,MAAM,EACN,OAAO,EACP,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,OAAO,EACP,eAAe,EACf,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAuF,MAAM,0BAA0B,CAAC;AAoBnJ;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,aA6pBvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAuF,MAAM,0BAA0B,CAAC;AAsBnJ;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,aAwqBvB,CAAC"}

package/dist/reference-catalog.d.ts

@@ -0,0 +1,14 @@
+import type { ReferenceCatalog } from "@intentius/chant/lexicon";
+/**
+ * AWS reference catalog (#778, epic #776 v1) — how observed AWS resources
+ * reference each other, so `chant graph --live` can reconstruct the topology.
+ *
+ * Keyed to the per-resource describe/export attribute shape (`VpcId`,
+ * `SecurityGroups[].GroupId`, `TargetGroupArn`, …), not the thin
+ * `describe-stack-resources` metadata. Enough to draw the canonical 3-tier VPC
+ * (internet → ALB → ECS service → RDS, with SG attachments). `containment`
+ * relations (subnet ∈ VPC) feed #779's boundary boxes; `reference` relations are
+ * edges.
+ */
+export declare const awsReferenceCatalog: ReferenceCatalog;
+//# sourceMappingURL=reference-catalog.d.ts.map

package/dist/reference-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference-catalog.d.ts","sourceRoot":"","sources":["../src/reference-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,EAAE,gBAoEjC,CAAC"}