@intentius/chant-lexicon-aws 0.44.14 → 0.46.0

package/dist/lint/post-synth/waw060.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw060.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw060.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAsB9G,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA8ClF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.44.14",
+  "version": "0.46.0",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/okf/index.md

@@ -1722,3 +1722,5 @@ okf_version: '0.2'
 * [WAW056](/rules/WAW056.md) - SCP guardrail has no Deny statement — it constrains nothing
 * [WAW057](/rules/WAW057.md) - SCP guardrail is attached to no targets — it enforces nothing
 * [WAW058](/rules/WAW058.md) - Organization audit trail missing, not logging, or scoped down to a single region
+* [WAW059](/rules/WAW059.md) - Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+* [WAW060](/rules/WAW060.md) - IAM policy attached to no principal — it grants nothing

package/dist/okf/rules/WAW059.md

@@ -0,0 +1,25 @@
+---
+type: post-synth-check
+title: WAW059
+description: Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+id: WAW059
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+
+## Applies to
+
+- [Action](/types/Action.md)
+- [Bucket](/types/Bucket.md)
+- [GlobalTable](/types/GlobalTable.md)
+- [IamPolicy](/types/IamPolicy.md)
+- [InstanceProfile](/types/InstanceProfile.md)
+- [ManagedPolicy](/types/ManagedPolicy.md)
+- [Map](/types/Map.md)
+- [Queue](/types/Queue.md)
+- [Role](/types/Role.md)
+- [Table](/types/Table.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW060.md

@@ -0,0 +1,17 @@
+---
+type: post-synth-check
+title: WAW060
+description: IAM policy attached to no principal — it grants nothing
+id: WAW060
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+IAM policy attached to no principal — it grants nothing
+
+## Applies to
+
+- [IamPolicy](/types/IamPolicy.md)
+- [ManagedPolicy](/types/ManagedPolicy.md)
+- [Type](/types/Type.md)

package/dist/okf/types/Action.md

@@ -31,3 +31,4 @@ resource_type: AWS::SageMaker::Action
 ## Governed by
 
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns

package/dist/okf/types/Bucket.md

@@ -63,3 +63,4 @@ resource_type: AWS::S3::Bucket
 - [WAW006](/rules/WAW006.md): S3 Bucket Encryption
 - [WAW018](/rules/WAW018.md): S3 bucket missing public access block — all public access should be blocked
 - [WAW042](/rules/WAW042.md): S3 bucket missing a TLS-only bucket policy — deny requests over plaintext
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns

package/dist/okf/types/GlobalTable.md

@@ -37,3 +37,7 @@ resource_type: AWS::DynamoDB::GlobalTable
 - `Arn`
 - `StreamArn`
 - `TableId`
+
+## Governed by
+
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns

package/dist/okf/types/IamPolicy.md

@@ -24,3 +24,5 @@ resource_type: AWS::IAM::Policy
 ## Governed by
 
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing

package/dist/okf/types/InstanceProfile.md

@@ -18,3 +18,7 @@ resource_type: AWS::IAM::InstanceProfile
 ## Attributes
 
 - `Arn`
+
+## Governed by
+
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns

package/dist/okf/types/ManagedPolicy.md

@@ -40,3 +40,5 @@ resource_type: AWS::IAM::ManagedPolicy
 ## Governed by
 
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing

package/dist/okf/types/Map.md

@@ -34,3 +34,4 @@ resource_type: AWS::Location::Map
 - [WAW015](/rules/WAW015.md): Circular dependency between nested stacks would cause infinite build recursion
 - [WAW016](/rules/WAW016.md): Deprecated property usage — flags properties marked as deprecated in the CloudFormation Registry
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns

package/dist/okf/types/Queue.md

@@ -37,3 +37,4 @@ resource_type: AWS::SQS::Queue
 ## Governed by
 
 - [WAW026](/rules/WAW026.md): SQS queue is not encrypted — enable SqsManagedSseEnabled or set KmsMasterKeyId
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns

package/dist/okf/types/Role.md

@@ -31,3 +31,4 @@ resource_type: AWS::IAM::Role
 
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns

package/dist/okf/types/Table.md

@@ -42,3 +42,4 @@ resource_type: AWS::DynamoDB::Table
 
 - [WAW027](/rules/WAW027.md): DynamoDB table does not have point-in-time recovery enabled
 - [WAW030](/rules/WAW030.md): Missing DependsOn for known CloudFormation ordering patterns
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns

package/dist/okf/types/Type.md

@@ -73,3 +73,5 @@ resource_type: AWS::Cassandra::Type
 - [WAW056](/rules/WAW056.md): SCP guardrail has no Deny statement — it constrains nothing
 - [WAW057](/rules/WAW057.md): SCP guardrail is attached to no targets — it enforces nothing
 - [WAW058](/rules/WAW058.md): Organization audit trail missing, not logging, or scoped down to a single region
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing

package/dist/op/activities/aws-apply.d.ts

@@ -3,11 +3,18 @@ export interface AwsApplyArgs {
     templatePath: string;
     /** CloudFormation stack name — the deploy boundary. */
     stackName: string;
-    /** CFN endpoint override (e.g. Floci `http://localhost:4566`). Default: real CloudFormation. */
+    /**
+     * CFN endpoint override (e.g. Floci `http://localhost:4566`). Omitted,
+     * `AWS_ENDPOINT_URL_CLOUDFORMATION` then `AWS_ENDPOINT_URL` answer — the same
+     * rule the read client applies (#1694). With neither: real CloudFormation.
+     */
     endpoint?: string;
     /** Region (real CFN host + `Version` context). Default: `us-east-1`. */
     region?: string;
-    /** Capabilities to acknowledge. Default: `["CAPABILITY_NAMED_IAM"]`. */
+    /**
+     * Capabilities to acknowledge. Default: `CAPABILITY_NAMED_IAM`, plus
+     * `CAPABILITY_AUTO_EXPAND` when the template has a top-level `Transform` (#980).
+     */
     capabilities?: string[];
     /** Stack-settle timeout in ms. Default: `300000`. */
     timeoutMs?: number;
@@ -19,12 +26,21 @@ export type AwsHttp = (url: string, form: Record<string, string>, signal?: Abort
     status: number;
     text: string;
 }>;
-/** The CloudFormation endpoint URL — the override, or the real regional host. */
-export declare function cfnUrl(endpoint?: string, region?: string): string;
+/**
+ * The CloudFormation endpoint URL — the override, or the real regional host.
+ * `env` is what the ambient-variable fallback reads; injectable for tests.
+ */
+export declare function cfnUrl(endpoint?: string, region?: string, env?: Record<string, string | undefined>): string;
 /** A CFN Query-protocol form body: `Action` + `Version` + params. */
 export declare function cfnForm(action: string, params: Record<string, string>): Record<string, string>;
 /** Capabilities as the CFN `Capabilities.member.N` list params. */
 export declare function capabilityParams(capabilities: string[]): Record<string, string>;
+/**
+ * Stack tags as the CFN `Tags.member.N.Key/Value` list params (#1222). Sorted
+ * so the request is deterministic. Empty in, empty out — a template without an
+ * ownership marker adds no `Tags` parameter at all.
+ */
+export declare function tagParams(tags: Record<string, string>): Record<string, string>;
 /**
  * First `<tag>…</tag>` text in a CFN XML response.
  *
@@ -55,22 +71,59 @@ export declare function waitForStackSettled(url: string, stackName: string, http
  * CloudFormation API directly (create-or-update + poll to a settled stack),
  * targeting a local Floci emulator or real AWS by endpoint override. The direct
  * twin of `azApply`/`gcpApply`: it speaks the CloudFormation Query API over HTTP
- * rather than shelling `aws cloudformation deploy` (that CLI path is still
- * available via `nativeApply({ target: "cloudformation" })`). The stack is the
- * ownership boundary, so deletes ride CloudFormation itself — no separate prune.
- * `http` is injectable for tests.
+ * rather than shelling `aws cloudformation deploy` — and since chant #1449 it is
+ * also what `nativeApply({ target: "cloudformation" })` runs, so no CLI path
+ * remains. The stack is the ownership boundary, so deletes ride CloudFormation
+ * itself — no separate prune. `http` is injectable for tests.
  */
 export declare function awsApply(args: AwsApplyArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
     stackName: string;
     status: string;
     action: "created" | "updated" | "unchanged";
 }>;
+/** {@link awsDelete}'s arguments: {@link AwsApplyArgs} minus the template — a
+ * delete needs no body, so teardown (#1222) can call it with a stack name
+ * alone. Op builders that thread `templatePath` through keep working; it is
+ * simply unused here. */
+export type AwsDeleteArgs = Omit<AwsApplyArgs, "templatePath"> & {
+    templatePath?: string;
+};
 /**
  * The inverse of {@link awsApply} — DeleteStack, then poll until the stack is
  * gone. Idempotent: an already-absent stack is a no-op. `http` is injectable.
  */
-export declare function awsDelete(args: AwsApplyArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
+export declare function awsDelete(args: AwsDeleteArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
     stackName: string;
     deleted: boolean;
 }>;
+export interface RollbackStackArgs {
+    /** CloudFormation stack name to roll back. */
+    stackName: string;
+    /** CFN endpoint override — same resolution rule as {@link AwsApplyArgs.endpoint} (#1694). */
+    endpoint?: string;
+    /** Region (real CFN host). Default: `us-east-1`. */
+    region?: string;
+    /** Stack-settle timeout in ms. Default: `300000`. */
+    timeoutMs?: number;
+    /** Poll interval in ms. Default: `3000`. */
+    intervalMs?: number;
+}
+/**
+ * The saga compensation for {@link awsApply} — CloudFormation `RollbackStack`
+ * via the same Query-API client, then poll until the stack settles. Returns the
+ * stack to its last known stable state after a failed update (#1449 — this
+ * replaces the Temporal lexicon exec-ing `aws cloudformation rollback-stack`).
+ *
+ * Degrades rather than crashes in two cases where there is nothing to do:
+ * an absent stack (nothing applied, nothing to revert) and a target that does
+ * not implement the action — Floci answers `UnknownAction` (#947). Both return
+ * `rolledBack: false` with a logged warning; every other API error throws,
+ * because a compensation that silently fails leaves partial state looking
+ * reverted when it isn't. `http` is injectable for tests.
+ */
+export declare function rollbackStack(args: RollbackStackArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
+    stackName: string;
+    rolledBack: boolean;
+    status?: string;
+}>;
 //# sourceMappingURL=aws-apply.d.ts.map

package/dist/op/activities/aws-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/aws-apply.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4HAA4H;AAC5H,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAcrI,iFAAiF;AACjF,wBAAgB,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAEzE;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9F;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAyC,CAAC;AAC7F,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AACrF,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AAE7F,4EAA4E;AAC5E,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,OAAsC,CAAC;AACpF,wEAAwE;AACxE,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OAAsD,CAAC;AAGjG,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAqC,CAAC;AACvF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAyC,CAAC;AAC3F,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,OACkC,CAAC;AAIrF,yFAAyF;AACzF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC/C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAID;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAuC7F;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAsBlD"}
+{"version":3,"file":"aws-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/aws-apply.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4HAA4H;AAC5H,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAcrI;;;GAGG;AACH,wBAAgB,MAAM,CACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,SAAiB,EACvB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAGR;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9F;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAyC,CAAC;AAC7F,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AACrF,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AAE7F,4EAA4E;AAC5E,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,OAAsC,CAAC;AACpF,wEAAwE;AACxE,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OAAsD,CAAC;AAGjG,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAqC,CAAC;AACvF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAyC,CAAC;AAC3F,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,OACkC,CAAC;AAIrF,yFAAyF;AACzF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC/C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAID;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAiD7F;AAED;;;yBAGyB;AACzB,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAsBlD;AAED,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BtE"}

package/dist/op/activities/index.d.ts

@@ -2,8 +2,9 @@
  * AWS Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `aws` lexicon. Contributes the local Floci AWS
  * emulator lifecycle (`flociUp`/`flociDown`) and the native CloudFormation
- * applier (`awsApply`), which calls the CloudFormation API directly rather than
- * shelling `aws` — the direct twin of `azApply`/`gcpApply`.
+ * applier (`awsApply`, with `awsDelete` and the `rollbackStack` compensation),
+ * which calls the CloudFormation API directly rather than shelling `aws` — the
+ * direct twin of `azApply`/`gcpApply`.
  *
  * The registry keys every exported *function* here by its name, so only the
  * activities themselves belong in this barrel. `awsAgentCoreFetchTrace`'s
@@ -15,8 +16,8 @@
  */
 export { flociUp, flociDown, flociRunCommand, flociRmCommand, flociExistsCommand, flociHealthUrl, flociEnv, isFlociReady, } from "./floci.js";
 export type { FlociUpArgs, FlociDownArgs } from "./floci.js";
-export { awsApply, awsDelete, waitForStackSettled, cfnUrl, cfnForm, capabilityParams, xmlField, stackStatus, stackId, cfnErrorMessage, isStackMissing, isNoUpdates, isSuccessStatus, isFailureStatus, isTerminalStatus, } from "./aws-apply.js";
-export type { AwsApplyArgs, AwsHttp } from "./aws-apply.js";
+export { awsApply, awsDelete, rollbackStack, waitForStackSettled, cfnUrl, cfnForm, capabilityParams, xmlField, stackStatus, stackId, cfnErrorMessage, isStackMissing, isNoUpdates, isSuccessStatus, isFailureStatus, isTerminalStatus, } from "./aws-apply.js";
+export type { AwsApplyArgs, RollbackStackArgs, AwsHttp } from "./aws-apply.js";
 export { awsAgentCoreFetchTrace } from "../../agentcore/trace-fetch.js";
 export type { AgentCoreTraceSource, AwsAgentCoreFetchTraceArgs, AwsAgentCoreFetchTraceResult, } from "../../agentcore/trace-fetch.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,QAAQ,EACR,SAAS,EACT,mBAAmB,EACnB,MAAM,EACN,OAAO,EACP,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,OAAO,EACP,eAAe,EACf,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,QAAQ,EACR,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,MAAM,EACN,OAAO,EACP,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,OAAO,EACP,eAAe,EACf,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC"}

package/dist/ownership.d.ts

@@ -7,4 +7,22 @@
 import type { ChannelKeys } from "@intentius/chant/ownership";
 /** AWS tag keys for chant's ownership markers. */
 export declare const AWS_TAG_OWNERSHIP_KEYS: ChannelKeys;
+/**
+ * Template-level `Metadata` key the serializer stamps the ownership marker
+ * under (#1222). Stack-level teardown verifies ownership on the *stack's own*
+ * tags, and CloudFormation stack tags are an API parameter, not a template
+ * section — so the template carries the marker here and the apply paths
+ * (`awsApply`, the `cfn-deploy` change set) turn it into stack tags on
+ * create/update. One source: the same build that stamps resource tags decides
+ * the stack tags.
+ */
+export declare const OWNERSHIP_METADATA_KEY = "chant:ownership";
+/**
+ * The stack tags a template body asks for: the flat tag map under
+ * `Metadata["chant:ownership"]`, or nothing. Total on bad input — a body that
+ * is not JSON (a YAML template, a handwritten one) or carries no marker
+ * returns `{}`, and the stack simply stays untagged, which teardown reports
+ * as unverified rather than deleting.
+ */
+export declare function ownershipStackTagsForBody(body: string): Record<string, string>;
 //# sourceMappingURL=ownership.d.ts.map

package/dist/ownership.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,sBAAsB,EAAE,WAIpC,CAAC"}
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,sBAAsB,EAAE,WAIpC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiB9E"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAqC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAWnD,eAAO,MAAM,SAAS,EAAE,aAw6BvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAqC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aAm7BvB,CAAC"}

package/dist/properties.d.ts

@@ -16,9 +16,10 @@
  * A deep read (Cloud Control) answers this properly but is a per-resource call
  * and is not available on every endpoint. This is the cheap middle: one describe
  * per kind for the whole observation, joined back by physical id. Stack outputs
- * are kept — they were the only attributes for a long time and queries lean on
- * them — but a resource's own properties win a name collision, because they are
- * the resource's.
+ * no longer ride the resource at all — they are the stack's, and travel on the
+ * observation envelope's `stackExports`. Whatever a resource already carries is
+ * kept underneath its own properties, which win a name collision because they
+ * are the resource's.
  */
 import type { ResourceMetadata } from "@intentius/chant/lexicon";
 /**

package/dist/properties.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"properties.d.ts","sourceRoot":"","sources":["../src/properties.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAkCjE;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAUlC;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,yGAAyG;IACzG,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CAyE9B"}
+{"version":3,"file":"properties.d.ts","sourceRoot":"","sources":["../src/properties.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAkCjE;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAUlC;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB,yGAAyG;IACzG,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC3C,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CAyE9B"}

package/dist/rules/cf-refs.ts

@@ -50,6 +50,28 @@ export function findResourceRefs(value: unknown): Set<string> {
   return refs;
 }
 
+/**
+ * Build the reverse of `findResourceRefs` for a whole template: logical id →
+ * the set of logical ids whose Properties reference it via Ref/Fn::GetAtt.
+ * Lets a check walk the graph consumer-ward (who uses this role?) instead of
+ * dependency-ward. Used by WAW059.
+ */
+export function buildReverseRefIndex(template: CFTemplate): Map<string, Set<string>> {
+  const index = new Map<string, Set<string>>();
+  for (const [logicalId, resource] of Object.entries(template.Resources ?? {})) {
+    for (const target of findResourceRefs(resource.Properties)) {
+      if (target === logicalId) continue;
+      let consumers = index.get(target);
+      if (!consumers) {
+        consumers = new Set();
+        index.set(target, consumers);
+      }
+      consumers.add(logicalId);
+    }
+  }
+  return index;
+}
+
 /**
  * Check if a value is a CloudFormation intrinsic function (Ref, Fn::*, etc.)
  * that cannot be statically evaluated.