@intentius/chant-lexicon-aws 0.18.12 → 0.18.13

package/dist/composites/agentcore-agent.d.ts

@@ -0,0 +1,74 @@
+import { Role, Role_Policy, Runtime, RuntimeEndpoint, Memory, BedrockAgentCoreGateway, GatewayTarget, WorkloadIdentity } from "../generated/index.js";
+export interface AgentCoreAgentProps {
+    /**
+     * Base name for the agent's resources. `toRuntimeIdentifier(name)` derives
+     * the Runtime/RuntimeEndpoint/Memory names; Gateway/GatewayTarget/
+     * WorkloadIdentity use `name` as-is (hyphens are valid there).
+     */
+    name: string;
+    /** ECR image URI the Runtime runs, e.g. `"123456789012.dkr.ecr.us-east-1.amazonaws.com/agent:latest"`. */
+    containerUri: string;
+    /** Runtime network mode. Default: "PUBLIC". */
+    networkMode?: "PUBLIC" | "VPC";
+    /** Subnets for the Runtime's ENIs. Required when `networkMode` is "VPC". */
+    vpcSubnetIds?: string[];
+    /** Security groups for the Runtime's ENIs. Required when `networkMode` is "VPC". */
+    vpcSecurityGroupIds?: string[];
+    /** Protocol the Runtime serves. Mirrors the generated `Runtime_ProtocolConfiguration` CFN enum. Default: "MCP". */
+    protocolConfiguration?: "A2A" | "AGUI" | "HTTP" | "MCP";
+    /** Environment variables passed to the Runtime container. */
+    environmentVariables?: Record<string, string>;
+    /** RuntimeEndpoint name — the alias a version-promotion capability would repoint (deferred, see #882). Default: "DEFAULT". */
+    endpointName?: string;
+    /** Memory event retention, in days. CFN bounds: 3-365. Default: 30. */
+    memoryEventExpiryDays?: number;
+    /** Gateway authorizer. Mirrors the generated `BedrockAgentCoreGateway_AuthorizerType` CFN enum. Default: "AWS_IAM". */
+    gatewayAuthorizerType?: "CUSTOM_JWT" | "AWS_IAM" | "NONE" | "AUTHENTICATE_ONLY";
+    /** Allow-listed OAuth2 return URLs for the standalone `WorkloadIdentity` resource. */
+    allowedResourceOauth2ReturnUrls?: string[];
+    /** Extra managed policy ARNs merged onto the auto-created Runtime/Memory execution role. */
+    ManagedPolicyArns?: string[];
+    /** Inline policies attached to the auto-created Runtime/Memory execution role. */
+    Policies?: InstanceType<typeof Role_Policy>[];
+    defaults?: {
+        role?: Partial<ConstructorParameters<typeof Role>[0]>;
+        gatewayRole?: Partial<ConstructorParameters<typeof Role>[0]>;
+        runtime?: Partial<ConstructorParameters<typeof Runtime>[0]>;
+        endpoint?: Partial<ConstructorParameters<typeof RuntimeEndpoint>[0]>;
+        memory?: Partial<ConstructorParameters<typeof Memory>[0]>;
+        gateway?: Partial<ConstructorParameters<typeof BedrockAgentCoreGateway>[0]>;
+        gatewayTarget?: Partial<ConstructorParameters<typeof GatewayTarget>[0]>;
+        workloadIdentity?: Partial<ConstructorParameters<typeof WorkloadIdentity>[0]>;
+    };
+}
+export type AgentCoreAgentResult = {
+    role: InstanceType<typeof Role>;
+    gatewayRole: InstanceType<typeof Role>;
+    runtime: InstanceType<typeof Runtime>;
+    endpoint: InstanceType<typeof RuntimeEndpoint>;
+    memory: InstanceType<typeof Memory>;
+    workloadIdentity: InstanceType<typeof WorkloadIdentity>;
+    gateway: InstanceType<typeof BedrockAgentCoreGateway>;
+    gatewayTarget: InstanceType<typeof GatewayTarget>;
+};
+/**
+ * A Bedrock AgentCore agent as one CloudFormation-serializable bundle — the
+ * composite/base path from #882: `Runtime` + `RuntimeEndpoint` + `Memory` +
+ * `Gateway`/`GatewayTarget` + `WorkloadIdentity` + IAM, deployable with
+ * `cfn-deploy` + `wait-for-stack` and no bespoke verb.
+ *
+ * `WorkloadIdentityDetails` on both `Runtime` and `BedrockAgentCoreGateway`
+ * is CFN `readOnly` — AWS provisions a workload identity per resource
+ * automatically, and neither accepts one as an input. The `WorkloadIdentity`
+ * resource this composite creates is therefore standalone (not cross-wired
+ * to `runtime`/`gateway`), included because #882 calls for it — it exists
+ * for workflows (e.g. a future credential-provider capability) that need an
+ * explicit workload identity of their own.
+ *
+ * The `agentcore-deploy` version-promotion capability that would repoint
+ * `endpoint`'s `TargetVersion`/`LiveVersion` is deferred (GA-gated, #882) —
+ * this composite only wires the CloudFormation shape it would eventually
+ * apply against.
+ */
+export declare const AgentCoreAgent: import("@intentius/chant").CompositeDefinition<AgentCoreAgentProps, AgentCoreAgentResult>;
+//# sourceMappingURL=agentcore-agent.d.ts.map

package/dist/composites/agentcore-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentcore-agent.d.ts","sourceRoot":"","sources":["../../src/composites/agentcore-agent.ts"],"names":[],"mappings":"AACA,OAAO,EACL,IAAI,EACJ,WAAW,EACX,OAAO,EAKP,eAAe,EACf,MAAM,EACN,uBAAuB,EACvB,aAAa,EACb,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAmBtB,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,0GAA0G;IAC1G,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC/B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,mHAAmH;IACnH,qBAAqB,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;IACxD,6DAA6D;IAC7D,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,8HAA8H;IAC9H,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uHAAuH;IACvH,qBAAqB,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,MAAM,GAAG,mBAAmB,CAAC;IAChF,sFAAsF;IACtF,+BAA+B,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3C,4FAA4F;IAC5F,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,kFAAkF;IAClF,QAAQ,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC;IAC9C,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,WAAW,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,aAAa,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,gBAAgB,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC/E,CAAC;CACH;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,WAAW,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IACvC,OAAO,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,YAAY,CAAC,OAAO,eAAe,CAAC,CAAC;IAC/C,MAAM,EAAE,YAAY,CAAC,OAAO,MAAM,CAAC,CAAC;IACpC,gBAAgB,EAAE,YAAY,CAAC,OAAO,gBAAgB,CAAC,CAAC;IACxD,OAAO,EAAE,YAAY,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACtD,aAAa,EAAE,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;CACnD,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,2FAwFP,CAAC"}

package/dist/composites/agentcore-trust-policy.d.ts

@@ -0,0 +1,11 @@
+export declare const agentCoreTrustPolicy: {
+    Version: "2012-10-17";
+    Statement: {
+        Effect: "Allow";
+        Principal: {
+            Service: string;
+        };
+        Action: string;
+    }[];
+};
+//# sourceMappingURL=agentcore-trust-policy.d.ts.map

package/dist/composites/agentcore-trust-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentcore-trust-policy.d.ts","sourceRoot":"","sources":["../../src/composites/agentcore-trust-policy.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,oBAAoB;;;;;;;;;CAShC,CAAC"}

package/dist/composites/index.d.ts

@@ -32,4 +32,8 @@ export { Ec2InstanceRole } from "./ec2-instance-role.js";
 export type { Ec2InstanceRoleProps } from "./ec2-instance-role.js";
 export { MinimalVpc } from "./minimal-vpc.js";
 export type { MinimalVpcProps } from "./minimal-vpc.js";
+export { MicrovmApp } from "./microvm-app.js";
+export type { MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps } from "./microvm-app.js";
+export { AgentCoreAgent } from "./agentcore-agent.js";
+export type { AgentCoreAgentProps, AgentCoreAgentResult } from "./agentcore-agent.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/composites/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACvG,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,WAAW,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,IAAI,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACvG,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACtE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,WAAW,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACzE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,IAAI,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/composites/microvm-app.d.ts

@@ -0,0 +1,116 @@
+/**
+ * MicrovmApp — composite-first delivery of AWS Lambda MicroVM support (#879).
+ *
+ * Emits `AWS::Lambda::MicrovmImage` (a preview CFN resource type — see the
+ * issue's "Preview-API gate") plus the least-privilege build/execution IAM
+ * roles the upstream `ran-isenberg/lambda-microvm-cdk-python` construct
+ * creates, and — only when build-time VPC egress is requested — an
+ * `AWS::Lambda::NetworkConnector`, its deny-all-egress security group, and its
+ * ENI operator role.
+ *
+ * Base path only (#879 scope): `chant build` serializes this composite to a
+ * CloudFormation template; `cfn-deploy` + `wait-for-stack` deploy it and wait
+ * for the image snapshot to build, with no bespoke verb. The
+ * `microvm-image-build` capability (build-once / promote-by-ARN) is deferred
+ * — see the issue's "Settled decisions".
+ *
+ * The IAM shapes below mirror `lambda_microvm_cdk._impl.security` (build role
+ * scoped to the exact S3 code-artifact object + the image's own log group;
+ * execution role scoped to runtime logs only; connector operator role scoped
+ * to the AWS-documented `ec2:CreateNetworkInterface`/`CreateTags` grant), and
+ * the deny-all security group reproduces `aws-cdk-lib`'s own
+ * `MATCH_NO_TRAFFIC` placeholder rule (`aws-ec2/lib/security-group.ts`) —
+ * spot-checked against both upstream sources so the shapes match what the
+ * MicroVM service actually expects, not a guess.
+ */
+import { MicrovmImage, MicrovmImage_Hooks, NetworkConnector, Role, SecurityGroup } from "../generated/index.js";
+/** Documented baseline memory tiers (MiB) — the CFN schema types it as an open int, but the service accepts only these five; vCPU auto-scales with the tier. */
+declare const VALID_MEMORY_MIB: readonly [512, 1024, 2048, 4096, 8192];
+type MicrovmMemoryMiB = (typeof VALID_MEMORY_MIB)[number];
+export interface MicrovmAppBuildConnectorProps {
+    /** VPC the connector's ENIs attach to. */
+    vpcId: string;
+    /** 1-16 subnet ids, all in `vpcId` — where Lambda provisions the connector's ENIs. */
+    subnetIds: string[];
+    /** `"IPv4"` (default) or `"DualStack"`. */
+    networkProtocol?: "IPv4" | "DualStack";
+}
+export interface MicrovmAppProps {
+    /** Unique image name (`^[a-zA-Z0-9-_]+$`, ≤64 chars). Create-only — changing it forces replacement. */
+    name: string;
+    /** Human-readable description. CFN requires the property; `""` is valid. */
+    description?: string;
+    /**
+     * The `CodeArtifact.Uri` value CloudFormation wants — e.g. the `uri` a
+     * `publish-artifact` step produced (`"@Publish.uri"`, wired in by the
+     * driver). Kept distinct from {@link codeArtifactObjectArn}: this is the
+     * value the MicroVM service resolves the artifact from, while that one is
+     * the resource ARN the build role's IAM grant is scoped to — the two only
+     * coincide by convention, not by type.
+     */
+    codeArtifactUri: string;
+    /**
+     * Exact S3 object ARN of the code artifact, for the build role's
+     * `s3:GetObject` grant. Scoped to the precise object (never `bucket/*`),
+     * matching the upstream construct's `artifact_object_arn`. Pass the
+     * caller-resolved ARN rather than have this composite parse one out of an
+     * arbitrary URI — the same "wired reference, already resolved by the
+     * driver" convention `cfn-deploy`'s `imageRef` uses.
+     */
+    codeArtifactObjectArn: string;
+    /** AWS-managed base image alias (e.g. `"al2023-1"`) or a full base-image ARN. */
+    baseImage: string;
+    /**
+     * Base image version to pin. Default: `"0"` — the fallback the upstream
+     * construct itself uses when a synth-time boto3 lookup isn't available.
+     * Chant's synth is deterministic/offline, so this composite never performs
+     * a live lookup; pin this explicitly for a specific managed version.
+     */
+    baseImageVersion?: string;
+    /** Baseline memory tier in MiB — one of the five documented tiers; vCPU auto-scales with it. Default: `2048`. */
+    memoryMiB?: MicrovmMemoryMiB;
+    /** Env vars baked into the image at build time (max 50) — snapshotted and shared by every VM booted from this image. Never put secrets here. */
+    environment?: Record<string, string>;
+    /** Opt into `"ALL"` additional OS capabilities — a documented privilege escalation. Default: none (least privilege). */
+    additionalOsCapabilities?: "ALL"[];
+    /** Disable CloudWatch build/runtime logging entirely. Default: `false` (logging enabled, pinned to `/aws/lambda/microvms/<name>`). */
+    disableLogging?: boolean;
+    /** Lifecycle hooks — all default to disabled (traffic flows immediately). */
+    hooks?: ConstructorParameters<typeof MicrovmImage_Hooks>[0];
+    /**
+     * Build-time egress: attach a `NetworkConnector` (+ its deny-all-egress
+     * security group + least-privilege ENI operator role) so the image build
+     * can reach a VPC (private mirrors, an internal registry). Omit for the
+     * default public-internet build egress. The connector's security-group
+     * rules ARE its egress policy — deny-all by default; open it via
+     * `defaults.connectorSecurityGroup`.
+     */
+    buildConnector?: MicrovmAppBuildConnectorProps;
+    /** Extra egress connector ARNs to bake in alongside the one this composite creates (e.g. an AWS-managed `INTERNET_EGRESS` alias, or a pre-existing shared connector). Max 10 total. */
+    additionalEgressConnectors?: string[];
+    defaults?: {
+        buildRole?: Partial<ConstructorParameters<typeof Role>[0]>;
+        executionRole?: Partial<ConstructorParameters<typeof Role>[0]>;
+        connectorOperatorRole?: Partial<ConstructorParameters<typeof Role>[0]>;
+        connectorSecurityGroup?: Partial<ConstructorParameters<typeof SecurityGroup>[0]>;
+        connector?: Partial<ConstructorParameters<typeof NetworkConnector>[0]>;
+        image?: Partial<ConstructorParameters<typeof MicrovmImage>[0]>;
+    };
+}
+export type MicrovmAppResult = {
+    /** Least-privilege role the MicroVM service assumes to build the image — `s3:GetObject` on the exact code-artifact object, `logs:*` on the image's own log group. */
+    buildRole: InstanceType<typeof Role>;
+    /** Least-privilege role assumed by the running MicroVM — runtime-logs only; add workload permissions (e.g. Bedrock) on top. */
+    executionRole: InstanceType<typeof Role>;
+    /** The `AWS::Lambda::MicrovmImage` resource. */
+    image: InstanceType<typeof MicrovmImage>;
+    /** The build-egress connector's deny-all security group (only when `buildConnector` is set). */
+    connectorSecurityGroup?: InstanceType<typeof SecurityGroup>;
+    /** The connector's least-privilege ENI operator role (only when `buildConnector` is set). */
+    connectorOperatorRole?: InstanceType<typeof Role>;
+    /** The `AWS::Lambda::NetworkConnector` resource (only when `buildConnector` is set). */
+    connector?: InstanceType<typeof NetworkConnector>;
+};
+export declare const MicrovmApp: import("@intentius/chant").CompositeDefinition<MicrovmAppProps, MicrovmAppResult>;
+export {};
+//# sourceMappingURL=microvm-app.d.ts.map

package/dist/composites/microvm-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microvm-app.d.ts","sourceRoot":"","sources":["../../src/composites/microvm-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EACL,YAAY,EAKZ,kBAAkB,EAGlB,gBAAgB,EAGhB,IAAI,EAEJ,aAAa,EAEd,MAAM,cAAc,CAAC;AAMtB,gKAAgK;AAChK,QAAA,MAAM,gBAAgB,wCAAyC,CAAC;AAChE,KAAK,gBAAgB,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AA8C1D,MAAM,WAAW,6BAA6B;IAC5C,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC;CACxC;AAED,MAAM,WAAW,eAAe;IAC9B,uGAAuG;IACvG,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iHAAiH;IACjH,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,gJAAgJ;IAChJ,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,wHAAwH;IACxH,wBAAwB,CAAC,EAAE,KAAK,EAAE,CAAC;IACnC,sIAAsI;IACtI,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,qBAAqB,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,uLAAuL;IACvL,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,aAAa,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,qBAAqB,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,sBAAsB,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,SAAS,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,KAAK,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAChE,CAAC;CACH;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,qKAAqK;IACrK,SAAS,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IACrC,+HAA+H;IAC/H,aAAa,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IACzC,gDAAgD;IAChD,KAAK,EAAE,YAAY,CAAC,OAAO,YAAY,CAAC,CAAC;IACzC,gGAAgG;IAChG,sBAAsB,CAAC,EAAE,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;IAC5D,6FAA6F;IAC7F,qBAAqB,CAAC,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IAClD,wFAAwF;IACxF,SAAS,CAAC,EAAE,YAAY,CAAC,OAAO,gBAAgB,CAAC,CAAC;CACnD,CAAC;AAEF,eAAO,MAAM,UAAU,mFA2PP,CAAC"}

package/dist/index.d.ts

@@ -19,8 +19,8 @@ export type { CFNSchema, SchemaProperty, SchemaDefinition } from "./spec/fetch.j
 export { parseCFNSchema, cfnShortName, cfnServiceName } from "./spec/parse.js";
 export type { SchemaParseResult, ParsedResource, ParsedProperty, ParsedAttribute, ParsedPropertyType, ParsedEnum, PropertyConstraints } from "./spec/parse.js";
 export { S3Actions, LambdaActions, DynamoDBActions, SQSActions, SNSActions, IAMActions, ECRActions, LogsActions, ECSActions } from "./actions/index.js";
-export { LambdaFunction, LambdaNode, LambdaPython, NodeLambda, PythonLambda, LambdaApi, LambdaScheduled, ScheduledLambda, LambdaSqs, LambdaEventBridge, LambdaDynamoDB, LambdaS3, LambdaSns, VpcDefault, FargateAlb, AlbShared, FargateService, RdsInstance, RdsPostgres, EfsWithAccessPoint, Ec2InstanceRole, MinimalVpc, } from "./composites/index.js";
-export type { LambdaFunctionProps, LambdaApiProps, ScheduledLambdaProps, LambdaSqsProps, LambdaEventBridgeProps, LambdaDynamoDBProps, LambdaS3Props, LambdaSnsProps, VpcDefaultProps, FargateAlbProps, AlbSharedProps, FargateServiceProps, RdsInstanceProps, RdsPostgresProps, EfsWithAccessPointProps, Ec2InstanceRoleProps, MinimalVpcProps, } from "./composites/index.js";
+export { LambdaFunction, LambdaNode, LambdaPython, NodeLambda, PythonLambda, LambdaApi, LambdaScheduled, ScheduledLambda, LambdaSqs, LambdaEventBridge, LambdaDynamoDB, LambdaS3, LambdaSns, VpcDefault, FargateAlb, AlbShared, FargateService, RdsInstance, RdsPostgres, EfsWithAccessPoint, Ec2InstanceRole, MinimalVpc, AgentCoreAgent, } from "./composites/index.js";
+export type { LambdaFunctionProps, LambdaApiProps, ScheduledLambdaProps, LambdaSqsProps, LambdaEventBridgeProps, LambdaDynamoDBProps, LambdaS3Props, LambdaSnsProps, VpcDefaultProps, FargateAlbProps, AlbSharedProps, FargateServiceProps, RdsInstanceProps, RdsPostgresProps, EfsWithAccessPointProps, Ec2InstanceRoleProps, MinimalVpcProps, AgentCoreAgentProps, AgentCoreAgentResult, } from "./composites/index.js";
 export { generate, writeGeneratedFiles } from "./codegen/generate.js";
 export { packageLexicon } from "./codegen/package.js";
 export type { PackageOptions, PackageResult } from "./codegen/package.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG5D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EACjE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAC3E,kBAAkB,EAClB,eAAe,EAAE,UAAU,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAC1F,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EACzG,uBAAuB,EACvB,oBAAoB,EAAE,eAAe,GACtC,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG5D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EACjE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAC3E,kBAAkB,EAClB,eAAe,EAAE,UAAU,EAC3B,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAC1F,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EACzG,uBAAuB,EACvB,oBAAoB,EAAE,eAAe,EACrC,mBAAmB,EAAE,oBAAoB,GAC1C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/integrity.json

@@ -1,13 +1,13 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "a2feec0cb66a2f38830a751bc5ea657204b1ff70cf95c98ce426e8c0b4c02eb3",
+    "manifest.json": "fb441c8cd1d4b2b05f98f385f376e836d6ec3843a8fb5c631ef8329760a07866",
     "meta.json": "8c8333c2cc61ac2525f3418ea240c69d263e545e5947c15b984549d5207198c2",
-    "types/index.d.ts": "023279953ee34fb6851e2b47ff1a8d816fa8fc68ac733fca50e83594b8147e20",
+    "types/index.d.ts": "f86992ba68a0ff73a294d23b55e4dca3abb1968d5474b3062b624400c4b13b75",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
     "rules/iam-wildcard.ts": "135d7217d278fef50939e605c5da32603ba35674b8c4b5c4d66a06c77903e945",
     "rules/s3-encryption.ts": "c4f9f8aa8dc382ed98c7b04e820a600590cc75335a8db2e087cbfbfe4003d09e",
-    "rules/cf-refs.ts": "e8c943d5b0b072d4850c7f46ba53478e2f90accb22a8253816dcec6dfd58ca46",
+    "rules/cf-refs.ts": "321c353669de9fc14b7f341424d3676df2615ce0e7017d89809f4631062e642b",
     "rules/cor020.ts": "915bbb4c083c7b3b84b93e8e891b5ffffe5a138fdccda32ecfdda91b8685798c",
     "rules/ext001.ts": "f8703f37a50ab23d0ecaef539c0215a71269d420fa5e09a3d0454b18b7350b34",
     "rules/waw010.ts": "41c58aaedb8f9fe266f4b40f1a076f762796427fdf9b317b8a4a50c713e45571",
@@ -37,8 +37,26 @@
     "rules/waw035.ts": "8ad485f6661e3b9cfc80e053308aaecf42d4318c13d47309cc6086cf98e81f45",
     "rules/waw036.ts": "50dee06dd9e679b0c562570a7739d5fd4ae5a5e4963c8320c476bec5a38980d5",
     "rules/waw037.ts": "cff68f8eb155347036b9ea69f58544e231110c93cb90c19461c0ba9d731f9335",
+    "rules/waw038.ts": "be1bc604b4f454c2d7d3e377c2d729738938049cd9a06cdde0ea4412959bdcf2",
+    "rules/waw039.ts": "31ba717d313bf8ca95a1e86227a82c33eced19bcaa0ac58dd06eda52a5ee431a",
+    "rules/waw040.ts": "3770dbabeb0af42df8df10f861fb98ea78588ce2cb9ba185d7b7c83ced07f86e",
+    "rules/waw041.ts": "930d4bf5df280ca5090be97b0d33366dad813b6aea8294530b9a3efb16c7637b",
+    "rules/waw042.ts": "ad3f41d0a67b527fa3e659c179f29030c0b6962e36c5988fcacad7e2afd37f04",
+    "rules/waw043.ts": "dc95d8e42d748d0971a4d5b0dac758030ef1aaf7b3645094e9fd7f659b82bb05",
+    "rules/waw044.ts": "00f9d3ed2e439157b05cc406bf710b8615969fb2ce96719f3fd66912c56ffec7",
+    "rules/waw045.ts": "3ee1ecb702fbf972192a81db48d6f5935434d9a7a81469e67b14ee9336d969dc",
+    "rules/waw046.ts": "3502fb7642abcc0789941a9154dd11146ee10158bce4538e191fca8cc8723c03",
+    "rules/waw047.ts": "12de2208cd19f8f4f71f9c0d904cad31977e9b600032f7ed8892addd04f03c5c",
+    "rules/waw048.ts": "51e96f6efcb77858eb424caedd5687310d1e078a392743d22dbcee3553176d6a",
+    "rules/waw049.ts": "16d3e9b0859292d83a95442e6332b7fab2dc358867166a8d97a4fa3efdb9e333",
+    "rules/waw050.ts": "5a7a0bd5f29ca7d6c054deb17eaa64ee834d498496e60c4f3917cf3db4208247",
+    "rules/waw051.ts": "7392e48ae4f7ee31a809ae64fcae483e3d98cbb0967cdece17a4473e74c86fd9",
+    "rules/waw052.ts": "0d84a643c8a5c3da893951837905acdc0e68a5569f4bc4af0b6871b339c53ed6",
+    "rules/waw053.ts": "0115a06c87e75cbace13832ed931953e4af15885f77a28329a6c6fee64af65ad",
+    "rules/waw054.ts": "a1a9c1d1d04aebd72e14c01340f6203231d9513add64958edd42366aaa419d42",
+    "rules/waw055.ts": "f924e6bca957da1860c7d56dd385d28d91ab57bfd0f1499077d63a9cfc5b81e5",
     "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe"
   },
-  "composite": "5a4b21a930a68222037d4e212ca8186bc66b9aebb7a471a46c00bae9ccaebf42"
+  "composite": "32a77730b75b288c841f2e9f9a09860efe7c91384f07a39bf07ca3d3f5d39602"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAQ1F,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA4BpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAQ1F,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAgDpD,CAAC"}

package/dist/lint/post-synth/cf-refs.d.ts

@@ -47,6 +47,20 @@ export declare function walkPolicyStatements(resource: CFResource): Array<Record
  * property and standalone SecurityGroupIngress resources.
  */
 export declare function getSecurityGroupIngress(resource: CFResource): Array<Record<string, unknown>>;
+/**
+ * Extract an ECS TaskDefinition's container definitions (shared by the
+ * WAW046/047/048 ECS checks).
+ */
+export declare function getContainerDefinitions(resource: CFResource): Array<Record<string, unknown>>;
+/**
+ * Whether a build's `env` (from `--env` or the project's `ownership.env`, see
+ * PostSynthContext#env and #201) should be treated as the strict "full"/
+ * production tier for tier-gated checks, vs a relaxed "light" tier acceptable
+ * for local/Floci-style stacks. Reuses the existing `ctx.env` seam — no new
+ * tier field. An undefined or unrecognized env is treated as non-strict so a
+ * project that never sets `--env`/`ownership.env` isn't unexpectedly hard-failed.
+ */
+export declare function isFullTierEnv(env: string | undefined): boolean;
 /**
  * Check if a port range [fromPort, toPort] contains any of the sensitive ports.
  */

package/dist/lint/post-synth/cf-refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cf-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cf-refs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,GAAG,IAAI,CAWvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI5D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAInD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBhC;AAiBD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAahC;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAgBT"}
+{"version":3,"file":"cf-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cf-refs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,GAAG,IAAI,CAWvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI5D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAInD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBhC;AAiBD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAahC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAK5F;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAgBT"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA+BvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA8B3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAiDvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAgD3C,CAAC"}

package/dist/lint/post-synth/waw038.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WAW038: RDS Publicly Accessible
+ *
+ * Flags RDS instances with PubliclyAccessible: true — the instance gets a
+ * public IP/DNS name reachable from the internet instead of staying inside
+ * the VPC. (DBCluster has no PubliclyAccessible property; that's set on the
+ * member DBInstance.)
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkRdsPubliclyAccessible(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw038: PostSynthCheck;
+//# sourceMappingURL=waw038.d.ts.map

package/dist/lint/post-synth/waw038.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw038.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw038.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA4BvF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw039.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WAW039: RDS Backup Retention Not Set
+ *
+ * Flags RDS instances and clusters without a positive BackupRetentionPeriod —
+ * a retention of 0 (or an unset property on a resource that otherwise pins
+ * every other property explicitly) disables automated backups entirely.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkRdsBackupRetention(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw039: PostSynthCheck;
+//# sourceMappingURL=waw039.d.ts.map

package/dist/lint/post-synth/waw039.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw039.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw039.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAK9G,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA4BpF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw040.d.ts

@@ -0,0 +1,13 @@
+/**
+ * WAW040: RDS Deletion Protection Disabled (full tier)
+ *
+ * Flags RDS instances and clusters without DeletionProtection: true. Tier-aware
+ * (#894): a relaxed "light" stack (local/Floci, or no --env/ownership.env set)
+ * only warns, since local/dev databases are routinely torn down on purpose; the
+ * strict "full"/production tier (ctx.env === "prod"/"production"/"full", the
+ * existing #201 env seam — see isFullTierEnv) fails the build.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkRdsDeletionProtection(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw040: PostSynthCheck;
+//# sourceMappingURL=waw040.d.ts.map

package/dist/lint/post-synth/waw040.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw040.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw040.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAK9G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA6BvF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw041.d.ts

@@ -0,0 +1,10 @@
+/**
+ * WAW041: RDS Proxy TLS Not Required
+ *
+ * Flags RDS Proxy resources without RequireTLS: true — without it, a client
+ * can connect to the proxy over plaintext.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkDbProxyTls(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw041: PostSynthCheck;
+//# sourceMappingURL=waw041.d.ts.map

package/dist/lint/post-synth/waw041.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw041.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw041.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA4B5E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw042.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WAW042: S3 Bucket Missing TLS-Only Policy
+ *
+ * Flags S3 buckets without a companion BucketPolicy that denies requests made
+ * over plaintext (a Deny statement keyed on `aws:SecureTransport` being
+ * false). Encryption at rest is WAW006; the public-access block is WAW018;
+ * this covers encryption in transit.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkS3TlsOnlyPolicy(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw042: PostSynthCheck;
+//# sourceMappingURL=waw042.d.ts.map

package/dist/lint/post-synth/waw042.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw042.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw042.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAyB9G,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA2CjF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw043.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WAW043: KMS Key Rotation Disabled
+ *
+ * Flags customer-managed KMS keys without EnableKeyRotation: true. Skips
+ * asymmetric/HMAC keys (a non-default KeySpec) — AWS does not support
+ * automatic rotation for those.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkKmsKeyRotation(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw043: PostSynthCheck;
+//# sourceMappingURL=waw043.d.ts.map

package/dist/lint/post-synth/waw043.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw043.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw043.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAU9G,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA6BhF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw044.d.ts

@@ -0,0 +1,18 @@
+/**
+ * WAW044: ALB HTTP Listener Not Redirecting To HTTPS (full tier)
+ *
+ * Flags load balancer Listener resources on Protocol: HTTP whose
+ * DefaultActions don't redirect to HTTPS — the listener serves plaintext
+ * traffic instead of upgrading it. Access logging is WAW024; this covers
+ * transport security on the listener itself.
+ *
+ * Tier-aware (#917), same seam as WAW040/WAW052 (#894): a relaxed "light"
+ * stack (local/Floci, or no --env/ownership.env set) only warns, since the
+ * light tier is intentionally HTTP-only with no ACM cert to redirect to; the
+ * strict "full"/production tier (ctx.env === "prod"/"production"/"full", the
+ * existing #201 env seam — see isFullTierEnv) fails the build.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkAlbHttpRedirect(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw044: PostSynthCheck;
+//# sourceMappingURL=waw044.d.ts.map

package/dist/lint/post-synth/waw044.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw044.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw044.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAe9G,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA4BjF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw045.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WAW045: ALB Weak Or Missing TLS Policy
+ *
+ * Flags HTTPS/TLS listeners without a modern SslPolicy (TLS 1.2+). The
+ * account-wide default (`ELBSecurityPolicy-2016-08`) still allows TLS 1.0, so
+ * a missing SslPolicy is flagged the same as an explicit legacy one.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkAlbTlsPolicy(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw045: PostSynthCheck;
+//# sourceMappingURL=waw045.d.ts.map

package/dist/lint/post-synth/waw045.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw045.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw045.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAU9G,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA8B9E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw046.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WAW046: ECS Secret-Looking Value In Plaintext Environment
+ *
+ * Flags ECS TaskDefinition container `Environment` entries whose name looks
+ * like a credential (password/secret/token/key/credential) — those values are
+ * visible in the task definition and console. They should be passed via
+ * `Secrets` (Secrets Manager / SSM Parameter Store) instead.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkEcsPlaintextSecrets(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw046: PostSynthCheck;
+//# sourceMappingURL=waw046.d.ts.map

package/dist/lint/post-synth/waw046.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw046.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw046.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAK9G,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAmCrF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw047.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WAW047: ECS Privileged Container
+ *
+ * Flags ECS TaskDefinition containers running with Privileged: true — the
+ * container gets elevated access to the host, equivalent to root on the EC2
+ * instance (and rejected outright on Fargate).
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkEcsPrivilegedContainer(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw047: PostSynthCheck;
+//# sourceMappingURL=waw047.d.ts.map

package/dist/lint/post-synth/waw047.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw047.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw047.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA6BxF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw048.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WAW048: ECS Missing Log Configuration
+ *
+ * Flags ECS TaskDefinition containers with no LogConfiguration — container
+ * stdout/stderr is discarded, leaving no audit trail. Mirrors WAW024 (ALB
+ * access logging): advisory, not a hard block.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkEcsLogConfiguration(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw048: PostSynthCheck;
+//# sourceMappingURL=waw048.d.ts.map

package/dist/lint/post-synth/waw048.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw048.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw048.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA0BrF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw049.d.ts

@@ -0,0 +1,21 @@
+/**
+ * WAW049: Security Group Broad Ingress (any port, except ALB:80/443)
+ *
+ * Generalizes WAW019 beyond the four named sensitive ports (SSH/RDP/MySQL/
+ * Postgres): flags 0.0.0.0/0 or ::/0 ingress on *any* port, with a carve-out
+ * for the conventional public ALB listener ports (exactly 80 or 443).
+ *
+ * Port 80 is exempt unconditionally, not just on a relaxed tier (#917): a
+ * public ALB's HTTP listener is meant to be internet-facing on every tier —
+ * on the full/production tier it still needs an SG rule open to 0.0.0.0/0 so
+ * clients can reach the listener that redirects them to HTTPS (WAW044 is the
+ * rule that enforces the redirect actually happens; this rule only judges the
+ * SG's shape). The "light" tier serves plaintext HTTP straight off that same
+ * port instead of redirecting, which doesn't change the SG's exposure at all.
+ * A genuinely over-broad rule (all ports, SSH, etc.) still errors regardless
+ * of tier.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkBroadIngress(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw049: PostSynthCheck;
+//# sourceMappingURL=waw049.d.ts.map

package/dist/lint/post-synth/waw049.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw049.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw049.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAgD9G,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAwB9E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw050.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WAW050: Cognito Advanced Security Disabled
+ *
+ * Flags Cognito UserPools without UserPoolAddOns.AdvancedSecurityMode set to
+ * AUDIT or ENFORCED — without it, Cognito does not evaluate risk (compromised
+ * credentials, adaptive auth) on sign-in/sign-up.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkCognitoAdvancedSecurity(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw050: PostSynthCheck;
+//# sourceMappingURL=waw050.d.ts.map

package/dist/lint/post-synth/waw050.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw050.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw050.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAiCzF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}