@intentius/chant-lexicon-aws 0.45.0 → 0.49.0

package/dist/lint/post-synth/waw059.d.ts

@@ -0,0 +1,36 @@
+/**
+ * WAW059: Wildcard Resource where the declared graph enumerates the touched set
+ *
+ * An identity policy that allows resource-scopable actions on `Resource: "*"`
+ * (or a service-wide ARN pattern) when every consumer of the attached role
+ * only touches resources declared in the same template. In that case the
+ * declared graph already enumerates the touched set, so the statement can be
+ * tightened to the `Fn::GetAtt` Arn list of those declared entities.
+ *
+ * Deliberately narrow (#1225). Fires only when ALL of these hold:
+ * - the statement is an `Effect: Allow` identity-policy statement (role inline
+ *   policy, IAM::Policy, IAM::ManagedPolicy) — trust policies carry a
+ *   Principal and are skipped, resource policies live on other types;
+ * - no Condition/NotAction/NotResource and no intrinsics in Action/Resource;
+ * - `Resource` is `"*"` or a service-wide ARN pattern;
+ * - every Action is in the curated resource-scopable table (s3, dynamodb,
+ *   sqs) — actions that genuinely need `"*"` (s3:ListAllMyBuckets,
+ *   dynamodb:ListTables, sqs:ListQueues) are not in the table;
+ * - the attached principal resolves to declared roles only, those roles have
+ *   consumers in the template, and no consumer carries a foreign edge (a
+ *   literal ARN of the service) or an intrinsic edge (Fn::ImportValue) that
+ *   would put resources outside the declared graph in reach.
+ *
+ * Anything the static graph cannot prove stays quiet.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+/**
+ * Curated table of actions that support resource-level permissions, per
+ * service. Lower-cased (IAM action matching is case-insensitive). An action
+ * outside this table gates the whole statement off — it may legitimately
+ * require `Resource: "*"`.
+ */
+export declare const RESOURCE_SCOPABLE_ACTIONS: Record<string, ReadonlySet<string>>;
+export declare function checkWildcardResourceEnumerable(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw059: PostSynthCheck;
+//# sourceMappingURL=waw059.d.ts.map

package/dist/lint/post-synth/waw059.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw059.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw059.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAW9G;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CA6CzE,CAAC;AA6KF,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAiF5F;AAED,eAAO,MAAM,MAAM,EAAE,cAQpB,CAAC"}

package/dist/lint/post-synth/waw060.d.ts

@@ -0,0 +1,16 @@
+/**
+ * WAW060: IAM Policy Attached to No Principal
+ *
+ * Flags AWS::IAM::Policy / AWS::IAM::ManagedPolicy resources with empty or
+ * absent Roles, Users, and Groups that no other part of the template
+ * references. A policy attached to no principal grants nothing — the same
+ * detached-guardrail shape WAW057 catches for SCPs. Any Ref/GetAtt edge to
+ * the policy (a role's ManagedPolicyArns, an attachment-style resource, a
+ * stack Output exporting it for another stack to attach) keeps it quiet;
+ * plain AWS-managed ARN strings elsewhere are not references to the
+ * template's own policy.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkPolicyUnattached(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw060: PostSynthCheck;
+//# sourceMappingURL=waw060.d.ts.map

package/dist/lint/post-synth/waw060.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw060.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw060.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAsB9G,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA8ClF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw061.d.ts

@@ -0,0 +1,19 @@
+/**
+ * WAW061: Subnet CIDR Not Contained In VPC CIDR
+ *
+ * A subnet's CidrBlock must fall entirely inside its VPC's CidrBlock.
+ * Stock CDK does not check this — CloudFormation accepts the template and
+ * only fails the `AWS::EC2::Subnet` resource at deploy time
+ * ("The CIDR ... is invalid" / "does not fall within the CIDR range of the
+ * VPC"), after the rest of the stack may have already started rolling out.
+ * This is a cheap static graph check: follow the subnet's VpcId Ref to a
+ * declared VPC in the same template and do IPv4 CIDR-range math.
+ *
+ * Stays quiet whenever the graph can't prove it: intrinsic CIDR blocks,
+ * IPv6, a VpcId that isn't a simple Ref to a declared AWS::EC2::VPC, or a
+ * VPC whose own CidrBlock isn't a literal string.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkSubnetCidrContainment(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw061: PostSynthCheck;
+//# sourceMappingURL=waw061.d.ts.map

package/dist/lint/post-synth/waw061.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw061.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw061.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAsCvF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw062.d.ts

@@ -0,0 +1,19 @@
+/**
+ * WAW062: Duplicate Name Or Export Within A Template
+ *
+ * CloudFormation requires certain names to be unique within a single
+ * template/stack: `Outputs.*.Export.Name`, and several resource-level
+ * "explicit name" properties (LaunchTemplateName, AutoScalingGroupName,
+ * GroupName, ...). Stock CDK doesn't catch a collision here — synth
+ * succeeds and the stack fails at CloudFormation deploy/changeset time.
+ * A duplicate is easy to introduce by copy-pasting a composite invocation
+ * (e.g. two EcrRepository or NlbService composites) without varying the
+ * explicit name.
+ *
+ * Only literal string values are compared — anything built from an
+ * intrinsic (Fn::Sub, Ref, ...) is statically unprovable and skipped.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkDuplicateNamesAndExports(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw062: PostSynthCheck;
+//# sourceMappingURL=waw062.d.ts.map

package/dist/lint/post-synth/waw062.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw062.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw062.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAqF9G,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAY1F;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw063.d.ts

@@ -0,0 +1,35 @@
+/**
+ * WAW063: IAM Policy Denies An Action It Also Allows
+ *
+ * IAM evaluates an explicit Deny as an absolute veto: it wins over any
+ * Allow granted to the same principal, from any attached policy, no matter
+ * how the Allow got there. When a role ends up with both an Allow and a
+ * Deny for the same action (over an overlapping resource scope) —
+ * typically because a broad guardrail policy and a feature-specific policy
+ * were attached to the same role independently — CloudFormation deploys
+ * the stack without complaint and the contradiction only surfaces as a
+ * runtime 403, the most expensive class of error to trace back to its
+ * source. This is IAM-reasoning static analysis over the declared graph:
+ * collect every Allow/Deny statement attached to each declared IAM::Role
+ * (inline, standalone IAM::Policy, and IAM::ManagedPolicy) and flag a
+ * literal action+resource collision between an Allow and a Deny.
+ *
+ * Deliberately conservative to avoid flagging the common intentional
+ * "broad Allow + narrow safety-Deny" guardrail pattern (e.g. `Allow ec2:*`
+ * plus `Deny ec2:TerminateInstances`):
+ *   - both statements' Action lists are compared string-by-string; a match
+ *     requires either the literal same action on both sides, or a
+ *     wildcarded Deny action that matches a literal (non-wildcarded) Allow
+ *     action. A wildcarded Allow paired with a literal Deny is exactly the
+ *     guardrail pattern and is never flagged;
+ *   - resources are compared the same way: `Resource: "*"` on the Deny
+ *     side always overlaps, or a literal exact match; a wildcarded Allow
+ *     resource paired with a narrower literal Deny is not flagged;
+ *   - any statement carrying a Condition, NotAction, NotResource,
+ *     Principal, or an intrinsic Action/Resource is skipped — the rule
+ *     can't prove those statically, so it stays quiet.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkDenyAllowContradiction(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw063: PostSynthCheck;
+//# sourceMappingURL=waw063.d.ts.map

package/dist/lint/post-synth/waw063.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw063.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw063.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAyG9G,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA8CxF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.45.0",
+  "version": "0.49.0",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/okf/index.md

@@ -1722,3 +1722,8 @@ okf_version: '0.2'
 * [WAW056](/rules/WAW056.md) - SCP guardrail has no Deny statement — it constrains nothing
 * [WAW057](/rules/WAW057.md) - SCP guardrail is attached to no targets — it enforces nothing
 * [WAW058](/rules/WAW058.md) - Organization audit trail missing, not logging, or scoped down to a single region
+* [WAW059](/rules/WAW059.md) - Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+* [WAW060](/rules/WAW060.md) - IAM policy attached to no principal — it grants nothing
+* [WAW061](/rules/WAW061.md) - Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+* [WAW062](/rules/WAW062.md) - Duplicate export name or explicit resource name within a template — fails at deploy time
+* [WAW063](/rules/WAW063.md) - IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/rules/WAW059.md

@@ -0,0 +1,25 @@
+---
+type: post-synth-check
+title: WAW059
+description: Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+id: WAW059
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+
+## Applies to
+
+- [Action](/types/Action.md)
+- [Bucket](/types/Bucket.md)
+- [GlobalTable](/types/GlobalTable.md)
+- [IamPolicy](/types/IamPolicy.md)
+- [InstanceProfile](/types/InstanceProfile.md)
+- [ManagedPolicy](/types/ManagedPolicy.md)
+- [Map](/types/Map.md)
+- [Queue](/types/Queue.md)
+- [Role](/types/Role.md)
+- [Table](/types/Table.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW060.md

@@ -0,0 +1,17 @@
+---
+type: post-synth-check
+title: WAW060
+description: IAM policy attached to no principal — it grants nothing
+id: WAW060
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+IAM policy attached to no principal — it grants nothing
+
+## Applies to
+
+- [IamPolicy](/types/IamPolicy.md)
+- [ManagedPolicy](/types/ManagedPolicy.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW061.md

@@ -0,0 +1,17 @@
+---
+type: post-synth-check
+title: WAW061
+description: Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+id: WAW061
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+
+## Applies to
+
+- [Subnet](/types/Subnet.md)
+- [Type](/types/Type.md)
+- [Vpc](/types/Vpc.md)

package/dist/okf/rules/WAW062.md

@@ -0,0 +1,27 @@
+---
+type: post-synth-check
+title: WAW062
+description: Duplicate export name or explicit resource name within a template — fails at deploy time
+id: WAW062
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Duplicate export name or explicit resource name within a template — fails at deploy time
+
+## Applies to
+
+- [AutoScalingGroup](/types/AutoScalingGroup.md)
+- [Bucket](/types/Bucket.md)
+- [ECRRepository](/types/ECRRepository.md)
+- [Function](/types/Function.md)
+- [LaunchTemplate](/types/LaunchTemplate.md)
+- [LoadBalancer](/types/LoadBalancer.md)
+- [ManagedPolicy](/types/ManagedPolicy.md)
+- [Map](/types/Map.md)
+- [Role](/types/Role.md)
+- [SecurityGroup](/types/SecurityGroup.md)
+- [StateMachine](/types/StateMachine.md)
+- [Table](/types/Table.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW063.md

@@ -0,0 +1,19 @@
+---
+type: post-synth-check
+title: WAW063
+description: IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403
+id: WAW063
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403
+
+## Applies to
+
+- [Action](/types/Action.md)
+- [IamPolicy](/types/IamPolicy.md)
+- [ManagedPolicy](/types/ManagedPolicy.md)
+- [Role](/types/Role.md)
+- [Type](/types/Type.md)

package/dist/okf/types/Action.md

@@ -31,3 +31,5 @@ resource_type: AWS::SageMaker::Action
 ## Governed by
 
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/AutoScalingGroup.md

@@ -57,3 +57,4 @@ resource_type: AWS::AutoScaling::AutoScalingGroup
 ## Governed by
 
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Bucket.md

@@ -63,3 +63,5 @@ resource_type: AWS::S3::Bucket
 - [WAW006](/rules/WAW006.md): S3 Bucket Encryption
 - [WAW018](/rules/WAW018.md): S3 bucket missing public access block — all public access should be blocked
 - [WAW042](/rules/WAW042.md): S3 bucket missing a TLS-only bucket policy — deny requests over plaintext
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/ECRRepository.md

@@ -31,3 +31,4 @@ resource_type: AWS::ECR::Repository
 
 - [WAW053](/rules/WAW053.md): ECR repository does not scan images on push
 - [WAW054](/rules/WAW054.md): ECR repository does not have immutable image tags
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Function.md

@@ -56,3 +56,4 @@ resource_type: AWS::Lambda::Function
 - [WAW011](/rules/WAW011.md): Deprecated Lambda runtime — flags deprecated or approaching-EOL Lambda runtimes
 - [WAW022](/rules/WAW022.md): Lambda function is not configured with a VPC — consider adding VpcConfig for network isolation
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/GlobalTable.md

@@ -37,3 +37,7 @@ resource_type: AWS::DynamoDB::GlobalTable
 - `Arn`
 - `StreamArn`
 - `TableId`
+
+## Governed by
+
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns

package/dist/okf/types/IamPolicy.md

@@ -24,3 +24,6 @@ resource_type: AWS::IAM::Policy
 ## Governed by
 
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/InstanceProfile.md

@@ -18,3 +18,7 @@ resource_type: AWS::IAM::InstanceProfile
 ## Attributes
 
 - `Arn`
+
+## Governed by
+
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns

package/dist/okf/types/LaunchTemplate.md

@@ -27,3 +27,4 @@ resource_type: AWS::EC2::LaunchTemplate
 ## Governed by
 
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/LoadBalancer.md

@@ -41,3 +41,4 @@ resource_type: AWS::ElasticLoadBalancingV2::LoadBalancer
 ## Governed by
 
 - [WAW024](/rules/WAW024.md): Application Load Balancer does not have access logging enabled
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/ManagedPolicy.md

@@ -40,3 +40,7 @@ resource_type: AWS::IAM::ManagedPolicy
 ## Governed by
 
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/Map.md

@@ -34,3 +34,5 @@ resource_type: AWS::Location::Map
 - [WAW015](/rules/WAW015.md): Circular dependency between nested stacks would cause infinite build recursion
 - [WAW016](/rules/WAW016.md): Deprecated property usage — flags properties marked as deprecated in the CloudFormation Registry
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Queue.md

@@ -37,3 +37,4 @@ resource_type: AWS::SQS::Queue
 ## Governed by
 
 - [WAW026](/rules/WAW026.md): SQS queue is not encrypted — enable SqsManagedSseEnabled or set KmsMasterKeyId
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns

package/dist/okf/types/Role.md

@@ -31,3 +31,6 @@ resource_type: AWS::IAM::Role
 
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/SecurityGroup.md

@@ -29,3 +29,4 @@ resource_type: AWS::EC2::SecurityGroup
 - [WAW019](/rules/WAW019.md): Security group allows unrestricted ingress on sensitive ports (SSH, RDP, database)
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
 - [WAW049](/rules/WAW049.md): Security group allows unrestricted ingress on a port other than ALB:80/443
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/StateMachine.md

@@ -30,3 +30,7 @@ resource_type: AWS::StepFunctions::StateMachine
 - `Arn`
 - `Name`
 - `StateMachineRevisionId`
+
+## Governed by
+
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Subnet.md

@@ -38,3 +38,7 @@ resource_type: AWS::EC2::Subnet
 - `Ipv6CidrBlocks`
 - `NetworkAclAssociationId`
 - `SubnetId`
+
+## Governed by
+
+- [WAW061](/rules/WAW061.md): Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time

package/dist/okf/types/Table.md

@@ -42,3 +42,5 @@ resource_type: AWS::DynamoDB::Table
 
 - [WAW027](/rules/WAW027.md): DynamoDB table does not have point-in-time recovery enabled
 - [WAW030](/rules/WAW030.md): Missing DependsOn for known CloudFormation ordering patterns
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Type.md

@@ -73,3 +73,8 @@ resource_type: AWS::Cassandra::Type
 - [WAW056](/rules/WAW056.md): SCP guardrail has no Deny statement — it constrains nothing
 - [WAW057](/rules/WAW057.md): SCP guardrail is attached to no targets — it enforces nothing
 - [WAW058](/rules/WAW058.md): Organization audit trail missing, not logging, or scoped down to a single region
+- [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing
+- [WAW061](/rules/WAW061.md): Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/Vpc.md

@@ -64,3 +64,4 @@ resource_type: AWS::EC2::VPC
 ## Governed by
 
 - [WAW030](/rules/WAW030.md): Missing DependsOn for known CloudFormation ordering patterns
+- [WAW061](/rules/WAW061.md): Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time

package/dist/op/activities/aws-apply.d.ts

@@ -35,6 +35,12 @@ export declare function cfnUrl(endpoint?: string, region?: string, env?: Record<
 export declare function cfnForm(action: string, params: Record<string, string>): Record<string, string>;
 /** Capabilities as the CFN `Capabilities.member.N` list params. */
 export declare function capabilityParams(capabilities: string[]): Record<string, string>;
+/**
+ * Stack tags as the CFN `Tags.member.N.Key/Value` list params (#1222). Sorted
+ * so the request is deterministic. Empty in, empty out — a template without an
+ * ownership marker adds no `Tags` parameter at all.
+ */
+export declare function tagParams(tags: Record<string, string>): Record<string, string>;
 /**
  * First `<tag>…</tag>` text in a CFN XML response.
  *
@@ -65,22 +71,59 @@ export declare function waitForStackSettled(url: string, stackName: string, http
  * CloudFormation API directly (create-or-update + poll to a settled stack),
  * targeting a local Floci emulator or real AWS by endpoint override. The direct
  * twin of `azApply`/`gcpApply`: it speaks the CloudFormation Query API over HTTP
- * rather than shelling `aws cloudformation deploy` (that CLI path is still
- * available via `nativeApply({ target: "cloudformation" })`). The stack is the
- * ownership boundary, so deletes ride CloudFormation itself — no separate prune.
- * `http` is injectable for tests.
+ * rather than shelling `aws cloudformation deploy` — and since chant #1449 it is
+ * also what `nativeApply({ target: "cloudformation" })` runs, so no CLI path
+ * remains. The stack is the ownership boundary, so deletes ride CloudFormation
+ * itself — no separate prune. `http` is injectable for tests.
  */
 export declare function awsApply(args: AwsApplyArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
     stackName: string;
     status: string;
     action: "created" | "updated" | "unchanged";
 }>;
+/** {@link awsDelete}'s arguments: {@link AwsApplyArgs} minus the template — a
+ * delete needs no body, so teardown (#1222) can call it with a stack name
+ * alone. Op builders that thread `templatePath` through keep working; it is
+ * simply unused here. */
+export type AwsDeleteArgs = Omit<AwsApplyArgs, "templatePath"> & {
+    templatePath?: string;
+};
 /**
  * The inverse of {@link awsApply} — DeleteStack, then poll until the stack is
  * gone. Idempotent: an already-absent stack is a no-op. `http` is injectable.
  */
-export declare function awsDelete(args: AwsApplyArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
+export declare function awsDelete(args: AwsDeleteArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
     stackName: string;
     deleted: boolean;
 }>;
+export interface RollbackStackArgs {
+    /** CloudFormation stack name to roll back. */
+    stackName: string;
+    /** CFN endpoint override — same resolution rule as {@link AwsApplyArgs.endpoint} (#1694). */
+    endpoint?: string;
+    /** Region (real CFN host). Default: `us-east-1`. */
+    region?: string;
+    /** Stack-settle timeout in ms. Default: `300000`. */
+    timeoutMs?: number;
+    /** Poll interval in ms. Default: `3000`. */
+    intervalMs?: number;
+}
+/**
+ * The saga compensation for {@link awsApply} — CloudFormation `RollbackStack`
+ * via the same Query-API client, then poll until the stack settles. Returns the
+ * stack to its last known stable state after a failed update (#1449 — this
+ * replaces the Temporal lexicon exec-ing `aws cloudformation rollback-stack`).
+ *
+ * Degrades rather than crashes in two cases where there is nothing to do:
+ * an absent stack (nothing applied, nothing to revert) and a target that does
+ * not implement the action — Floci answers `UnknownAction` (#947). Both return
+ * `rolledBack: false` with a logged warning; every other API error throws,
+ * because a compensation that silently fails leaves partial state looking
+ * reverted when it isn't. `http` is injectable for tests.
+ */
+export declare function rollbackStack(args: RollbackStackArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
+    stackName: string;
+    rolledBack: boolean;
+    status?: string;
+}>;
 //# sourceMappingURL=aws-apply.d.ts.map

package/dist/op/activities/aws-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/aws-apply.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4HAA4H;AAC5H,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAcrI;;;GAGG;AACH,wBAAgB,MAAM,CACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,SAAiB,EACvB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAGR;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9F;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAyC,CAAC;AAC7F,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AACrF,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AAE7F,4EAA4E;AAC5E,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,OAAsC,CAAC;AACpF,wEAAwE;AACxE,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OAAsD,CAAC;AAGjG,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAqC,CAAC;AACvF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAyC,CAAC;AAC3F,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,OACkC,CAAC;AAIrF,yFAAyF;AACzF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC/C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAID;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAuC7F;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAsBlD"}
+{"version":3,"file":"aws-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/aws-apply.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4HAA4H;AAC5H,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAcrI;;;GAGG;AACH,wBAAgB,MAAM,CACpB,QAAQ,CAAC,EAAE,MAAM,EACjB,MAAM,SAAiB,EACvB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAGR;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9F;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAyC,CAAC;AAC7F,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AACrF,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AAE7F,4EAA4E;AAC5E,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,OAAsC,CAAC;AACpF,wEAAwE;AACxE,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OAAsD,CAAC;AAGjG,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAqC,CAAC;AACvF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAyC,CAAC;AAC3F,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,OACkC,CAAC;AAIrF,yFAAyF;AACzF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC/C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAID;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAiD7F;AAED;;;yBAGyB;AACzB,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,aAAa,EACnB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAsBlD;AAED,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BtE"}

package/dist/op/activities/index.d.ts

@@ -2,8 +2,9 @@
  * AWS Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `aws` lexicon. Contributes the local Floci AWS
  * emulator lifecycle (`flociUp`/`flociDown`) and the native CloudFormation
- * applier (`awsApply`), which calls the CloudFormation API directly rather than
- * shelling `aws` — the direct twin of `azApply`/`gcpApply`.
+ * applier (`awsApply`, with `awsDelete` and the `rollbackStack` compensation),
+ * which calls the CloudFormation API directly rather than shelling `aws` — the
+ * direct twin of `azApply`/`gcpApply`.
  *
  * The registry keys every exported *function* here by its name, so only the
  * activities themselves belong in this barrel. `awsAgentCoreFetchTrace`'s
@@ -15,8 +16,14 @@
  */
 export { flociUp, flociDown, flociRunCommand, flociRmCommand, flociExistsCommand, flociHealthUrl, flociEnv, isFlociReady, } from "./floci.js";
 export type { FlociUpArgs, FlociDownArgs } from "./floci.js";
-export { awsApply, awsDelete, waitForStackSettled, cfnUrl, cfnForm, capabilityParams, xmlField, stackStatus, stackId, cfnErrorMessage, isStackMissing, isNoUpdates, isSuccessStatus, isFailureStatus, isTerminalStatus, } from "./aws-apply.js";
-export type { AwsApplyArgs, AwsHttp } from "./aws-apply.js";
+export { awsApply, awsDelete, rollbackStack, waitForStackSettled, cfnUrl, cfnForm, capabilityParams, xmlField, stackStatus, stackId, cfnErrorMessage, isStackMissing, isNoUpdates, isSuccessStatus, isFailureStatus, isTerminalStatus, } from "./aws-apply.js";
+export type { AwsApplyArgs, RollbackStackArgs, AwsHttp } from "./aws-apply.js";
+export declare const receiptRead: (args: import("@intentius/chant/op/receipt-store").ReceiptReadArgs, signal?: AbortSignal) => Promise<import("@intentius/chant/op/receipt-store").ReceiptReadResult>;
+export declare const receiptWrite: (args: import("@intentius/chant/op/receipt-store").ReceiptWriteArgs, signal?: AbortSignal) => Promise<{
+    written: true;
+    receipt: string;
+}>;
+export declare const receiptStaleness: (args: import("@intentius/chant/op/receipt-store").ReceiptStalenessArgs, signal?: AbortSignal) => Promise<import("@intentius/chant/op/receipt-store").ReceiptStalenessResult>;
 export { awsAgentCoreFetchTrace } from "../../agentcore/trace-fetch.js";
 export type { AgentCoreTraceSource, AwsAgentCoreFetchTraceArgs, AwsAgentCoreFetchTraceResult, } from "../../agentcore/trace-fetch.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,QAAQ,EACR,SAAS,EACT,mBAAmB,EACnB,MAAM,EACN,OAAO,EACP,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,OAAO,EACP,eAAe,EACf,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,QAAQ,EACR,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,MAAM,EACN,OAAO,EACP,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,OAAO,EACP,eAAe,EACf,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAa5E,eAAO,MAAM,WAAW,qKAAqC,CAAC;AAC9D,eAAO,MAAM,YAAY;;;EAAsC,CAAC;AAChE,eAAO,MAAM,gBAAgB,+KAA0C,CAAC;AAExE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC"}

package/dist/ownership.d.ts

@@ -7,4 +7,22 @@
 import type { ChannelKeys } from "@intentius/chant/ownership";
 /** AWS tag keys for chant's ownership markers. */
 export declare const AWS_TAG_OWNERSHIP_KEYS: ChannelKeys;
+/**
+ * Template-level `Metadata` key the serializer stamps the ownership marker
+ * under (#1222). Stack-level teardown verifies ownership on the *stack's own*
+ * tags, and CloudFormation stack tags are an API parameter, not a template
+ * section — so the template carries the marker here and the apply paths
+ * (`awsApply`, the `cfn-deploy` change set) turn it into stack tags on
+ * create/update. One source: the same build that stamps resource tags decides
+ * the stack tags.
+ */
+export declare const OWNERSHIP_METADATA_KEY = "chant:ownership";
+/**
+ * The stack tags a template body asks for: the flat tag map under
+ * `Metadata["chant:ownership"]`, or nothing. Total on bad input — a body that
+ * is not JSON (a YAML template, a handwritten one) or carries no marker
+ * returns `{}`, and the stack simply stays untagged, which teardown reports
+ * as unverified rather than deleting.
+ */
+export declare function ownershipStackTagsForBody(body: string): Record<string, string>;
 //# sourceMappingURL=ownership.d.ts.map

package/dist/ownership.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,sBAAsB,EAAE,WAIpC,CAAC"}
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,sBAAsB,EAAE,WAIpC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiB9E"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAqC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aAi6BvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAqC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aAk9BvB,CAAC"}