@intentius/chant-lexicon-aws 0.46.0 → 0.49.0

package/dist/composites/step-functions-workflow.d.ts

@@ -0,0 +1,36 @@
+import { type Value } from "@intentius/chant";
+import { Role, Role_Policy, LogGroup, StateMachine } from "../generated/index.js";
+export interface StepFunctionsWorkflowProps {
+    /** `Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366). */
+    name?: Value<string>;
+    /**
+     * ASL state machine definition, authored as a plain object. Passed to
+     * CloudFormation's `Definition` property rather than `DefinitionString`:
+     * CFN accepts the definition as a native JSON value (verified against
+     * Floci — both forms round-trip), so a task's `Resource` can carry a
+     * `Ref`/`Fn::GetAtt` intrinsic — e.g. `Resource: someFunc.Arn` — directly,
+     * with no `Fn::Sub` string templating needed to splice ARNs into a JSON
+     * string. Same `Value<T>`-over-string-building bias as #1366, one level up.
+     */
+    definition: Record<string, unknown>;
+    /** ARNs of the Lambda functions this workflow's tasks invoke; grants `lambda:InvokeFunction` on each. */
+    lambdaFunctionArns?: Value<string>[];
+    stateMachineType?: "STANDARD" | "EXPRESS";
+    /** CloudWatch Logs retention for the auto-created log group. Default 14. */
+    logRetentionDays?: number;
+    /** `LoggingConfiguration` level. Default `"ALL"` — set `"OFF"` to skip execution logging. */
+    loggingLevel?: "ALL" | "ERROR" | "FATAL" | "OFF";
+    ManagedPolicyArns?: string[];
+    Policies?: InstanceType<typeof Role_Policy>[];
+    defaults?: {
+        role?: Partial<ConstructorParameters<typeof Role>[0]>;
+        logGroup?: Partial<ConstructorParameters<typeof LogGroup>[0]>;
+        stateMachine?: Partial<ConstructorParameters<typeof StateMachine>[0]>;
+    };
+}
+export declare const StepFunctionsWorkflow: import("@intentius/chant").CompositeDefinition<StepFunctionsWorkflowProps, {
+    role: import("@intentius/chant").Declarable & Record<string, string>;
+    logGroup: import("@intentius/chant").Declarable & Record<string, string>;
+    stateMachine: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+//# sourceMappingURL=step-functions-workflow.d.ts.map

package/dist/composites/step-functions-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-functions-workflow.d.ts","sourceRoot":"","sources":["../../src/composites/step-functions-workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,YAAY,EAIb,MAAM,cAAc,CAAC;AAuCtB,MAAM,WAAW,0BAA0B;IACzC,2EAA2E;IAC3E,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB;;;;;;;;OAQG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,yGAAyG;IACzG,kBAAkB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACrC,gBAAgB,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC1C,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,YAAY,CAAC,EAAE,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;IACjD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC;IAC9C,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,YAAY,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvE,CAAC;CACH;AAED,eAAO,MAAM,qBAAqB;;;;EAiDP,CAAC"}

package/dist/deep-observe.d.ts

@@ -74,6 +74,51 @@ export declare const DEEP_SOURCES: Record<string, DeepSource>;
  * cannot drift apart — the shape of bug #1280 is about.
  */
 export declare const DEEP_READABLE_TYPES: ReadonlySet<string>;
+/**
+ * A child type this reader enumerates under one declared parent (#1015's
+ * out-of-band case) — the console-added SNS subscription or inline role
+ * policy that no property diff can see, because it is not a property of
+ * anything declared: it is a whole resource CloudFormation never made.
+ *
+ * Cloud Control's `ListResources` takes the parent as a `ResourceModel`
+ * scope, which is what `model` builds from the physical id the stack read
+ * already resolved. Every listed child is then sorted into declared (it is
+ * some stack resource's physical id, or some declared entity's spelled
+ * identity) or out-of-band; the out-of-band ones ride into the observation
+ * as live resources nobody declared, which the deep diff reports as
+ * undeclared entities.
+ */
+export interface DeepChildSource {
+    /** The child's CloudFormation type — what `ListResources` is asked for. */
+    childType: string;
+    /** The `ResourceModel` scoping the listing to one parent. */
+    model: (parentPhysicalId: string) => Record<string, unknown>;
+    /**
+     * Legacy declared forms of the same live child. `AWS::IAM::Policy` attached
+     * to a role creates the same inline policy `AWS::IAM::RolePolicy` lists, but
+     * under its own physical id — the policy name, which is the second part of
+     * the RolePolicy identifier. Without this leg every legacy inline policy
+     * reads as out-of-band on a stack that declared it.
+     */
+    declaredVia?: Array<{
+        type: string;
+        /** The part of the child identifier that carries that type's physical id. */
+        part: (identifier: string) => string | undefined;
+    }>;
+}
+/**
+ * Parent type → the child types worth listing under it. Scoped like
+ * {@link DEEP_SOURCES}: the high-signal cases first — the issue's own
+ * examples — and widened per type, not by wildcard. A child type Cloud
+ * Control cannot list parent-scoped does not belong here.
+ */
+export declare const DEEP_CHILD_SOURCES: Record<string, readonly DeepChildSource[]>;
+/**
+ * The name an out-of-band child reports under. There is no chant entity name
+ * to use — nobody declared it — so the name has to carry the finding on its
+ * own: what kind of thing, and which one.
+ */
+export declare function outOfBandChildName(childType: string, identifier: string): string;
 /**
  * `describe-security-groups` -> the `AWS::EC2::SecurityGroup` resource model.
  *

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAQ3B;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,GAAG,EAAE,eAAe,CAAA;CAAE,GACxB;IACE,GAAG,EAAE,KAAK,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpE,CAAC;AAEN,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAenD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AAE3F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAkBlD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBxE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAEnE,CAAC;AAWF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAU9E;AA6BD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAmEvC,CAAC;AAMF,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAmED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAI/E;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;kDAG8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAoIhC"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,mBAAmB,CAAC;AAe3B;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,GAAG,EAAE,eAAe,CAAA;CAAE,GACxB;IACE,GAAG,EAAE,KAAK,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpE,CAAC;AAEN,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAkBnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AAE3F;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,6EAA6E;QAC7E,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;KAClD,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAkBzE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAkBlD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBxE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAGnE,CAAC;AAWF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAU9E;AA6BD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBA+EvC,CAAC;AAMF,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAmED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAI/E;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;kDAG8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAoKhC"}

package/dist/deep-topology.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Deep-read sources for the EC2 topology types (#1269).
+ *
+ * chant's distinguishing answers are folds over topology: `internetFacing`
+ * resolves subnet -> route table -> internet gateway, `effectiveIngress`
+ * resolves rules across attached security groups, and the default-VPC
+ * classification (`defaults.ts`) reads the provider's own markers. The inputs
+ * to all of them are the types this file covers — with only the original four
+ * kinds readable, a deep snapshot of an EC2 estate carried almost no
+ * properties, and a snapshot-backed query could answer identity questions but
+ * not a single fold question.
+ *
+ * Two sources, chosen per type:
+ *
+ * - The container types (VPC, subnet, route table, internet gateway) read
+ *   through the EC2 describes. The fold facts live there and nowhere else:
+ *   `IsDefault`, `DefaultForAz` and a subnet's live `MapPublicIpOnLaunch` are
+ *   not part of the CloudFormation resource model, so Cloud Control cannot
+ *   report them. The describes are also bulk (one call per type for the whole
+ *   stack) and are implemented by the emulators that do not serve Cloud
+ *   Control's `GetResource`.
+ *
+ * - The join types (route, association, gateway attachment) and the two whose
+ *   describes do not fit a flat bulk join (instance rows nest inside
+ *   reservations; launch-template data lives in a separate versions call) read
+ *   through Cloud Control, which returns their model in the declared side's
+ *   own shape.
+ *
+ * Each type carries its normalization entries alongside (#1269's note: adding
+ * a type without them trades a hole for a false positive, which is worse).
+ * They are merged into the tables in `deep-observe.ts`.
+ */
+import type { DeepSource } from "./deep-observe.js";
+/**
+ * `describe-vpcs` -> the `AWS::EC2::VPC` resource model, plus `IsDefault`.
+ *
+ * `IsDefault` is the provider's own marker for the VPC nobody wrote — the fact
+ * the default classification reads — and it exists only on this surface.
+ * Carried even though the model does not name it; the diff subtracts it as a
+ * service default (`false`, gated on source silence) so a CloudFormation-made
+ * VPC does not report it as undeclared drift.
+ */
+export declare function vpcToModel(row: Record<string, unknown>): Record<string, unknown>;
+/**
+ * `describe-subnets` -> the `AWS::EC2::Subnet` resource model, plus
+ * `DefaultForAz`.
+ *
+ * `MapPublicIpOnLaunch` is half of `internetFacing`; `DefaultForAz` is the
+ * provider's default-subnet marker, off the model for the same reason as a
+ * VPC's `IsDefault` and handled the same way.
+ */
+export declare function subnetToModel(row: Record<string, unknown>): Record<string, unknown>;
+/**
+ * `describe-route-tables` -> the `AWS::EC2::RouteTable` resource model.
+ *
+ * The row also carries `Routes` and `Associations`, and this mapping drops
+ * them on purpose: a template declares each route as its own
+ * `AWS::EC2::Route` and each association as its own
+ * `AWS::EC2::SubnetRouteTableAssociation`, both covered below, so carrying
+ * them here would report every declared route twice — once as an undeclared
+ * array on the table and once through its own resource.
+ */
+export declare function routeTableToModel(row: Record<string, unknown>): Record<string, unknown>;
+/** `describe-internet-gateways` -> the `AWS::EC2::InternetGateway` model, which is tags and nothing else. */
+export declare function internetGatewayToModel(row: Record<string, unknown>): Record<string, unknown>;
+/**
+ * The topology types' entries for `DEEP_SOURCES`.
+ *
+ * The routing-chain joins are addressed by their physical id — for a
+ * registry-backed type CloudFormation's physical id *is* the Cloud Control
+ * identifier (`rtb-…|0.0.0.0/0` for a route) — so Cloud Control's
+ * one-get-per-resource shape fits them exactly and returns the declared
+ * model's own field names.
+ */
+export declare const EC2_TOPOLOGY_SOURCES: Record<string, DeepSource>;
+/**
+ * Service defaults for the topology types, merged into
+ * `AWS_SERVICE_DEFAULTS`. Subtracted on the live side only where source never
+ * declared the property — which is how the fold facts (`IsDefault`,
+ * `DefaultForAz`, a live `MapPublicIpOnLaunch`) stay in the snapshot for a
+ * query to read while never surfacing as drift on a resource CloudFormation
+ * itself created.
+ */
+export declare const EC2_TOPOLOGY_SERVICE_DEFAULTS: Record<string, Record<string, unknown>>;
+/**
+ * Values the service picks when the template does not supply one, merged into
+ * `AWS_GENERATED_NAMES`. A subnet that names no availability zone gets one
+ * assigned — a different one is real placement drift only when the template
+ * had an opinion, which is exactly the counterpart gate.
+ */
+export declare const EC2_TOPOLOGY_GENERATED_NAMES: Record<string, ReadonlySet<string>>;
+/**
+ * Declared properties a type's source cannot see (#1269).
+ *
+ * `describe-vpcs` does not return the DNS attributes — they live behind
+ * `describe-vpc-attribute` — and neither describe returns the IPAM inputs,
+ * which are consumed at creation. A declared value for one of these has
+ * nothing live to stand against, so the diff would report `value -> <absent>`
+ * on every clean apply: a blind spot rendered as drift. Pruned on the
+ * declared side, and only where the live tree is silent, so a source that
+ * does report the field (Cloud Control, some day) is still compared.
+ */
+export declare const AWS_DEEP_BLIND_SPOTS: Record<string, ReadonlySet<string>>;
+//# sourceMappingURL=deep-topology.d.ts.map

package/dist/deep-topology.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-topology.d.ts","sourceRoot":"","sources":["../src/deep-topology.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAShF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMvF;AAED,6GAA6G;AAC7G,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAK5F;AAYD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CA2C3D,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBjF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAG5E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAcpE,CAAC"}

package/dist/effect-receipt-row.d.ts

@@ -0,0 +1,92 @@
+/**
+ * The aws effect-receipt materialization row (#1835, epic #1703): an effect
+ * receipt stored as an `AWS::SSM::Parameter`, plain `String`, at
+ * `/chant-receipts/<stack>/<env>/<effect>`.
+ *
+ * Core's `EffectReceipt` factory (#1831) declares a receipt under the `chant`
+ * pseudo-lexicon, which no serializer claims — the designed shape until a
+ * lexicon materializes it. This module is that materialization for aws: the
+ * {@link EffectReceipt} factory here produces the same declaration shape but
+ * under `lexicon: "aws"`, so the build partitions it to the aws serializer,
+ * #1832's write-exclusion seam withholds it from the apply-bound entity set,
+ * and the serializer renders it for visibility through
+ * `SerializeContext.receipts` (see ./serializer.ts).
+ *
+ * Path identity (epic decision 4): the parameter name derives from the SAME
+ * ownership-block fields that stamp markers — `ownership.stack` and an
+ * explicit `ownership.env` — plus the receipt's `effect`. One derivation,
+ * {@link receiptParameterName}, shared by the serializer (the rendered row),
+ * the receipt store (../receipt-store.ts — what `receiptRead`/`receiptWrite`
+ * actually touch), and the observation leg (plan's live read). No env, no
+ * path: the callers error rather than guessing a segment.
+ *
+ * Plain store (epic decision 7, #1833's COR023): the parameter type is pinned
+ * to `String` at the source — the factory does not take a type, and the
+ * declared `props.Type` is the literal `"String"`. A receipt value is a
+ * witness (an existence marker or a `sha256:` digest), never a secret; a
+ * `SecureString` invites masking and rotation semantics that defeat the
+ * observe-and-compare loop, and the lint guard fails it.
+ */
+import { type Declarable } from "@intentius/chant/declarable";
+import { EFFECT_RECEIPT_MARKER, type EffectReceiptFlavor, type EffectReceiptOptions } from "@intentius/chant/effect-receipt";
+/** The entityType of the aws materialization row — the real resource kind the
+ * receipt is stored as, which is what lint's plain-store guard checks. */
+export declare const AWS_EFFECT_RECEIPT_ENTITY_TYPE = "AWS::SSM::Parameter";
+/** Template-level `Metadata` key the serializer renders receipt rows under.
+ * Beside `chant:ownership` (./ownership.ts) and like it deliberately outside
+ * `Resources` — the applier writes from `Resources`, and a receipt must never
+ * enter the apply-bound document (#1832; the `effect()` step is the sole
+ * writer, epic decision 3). */
+export declare const EFFECT_RECEIPTS_METADATA_KEY = "chant:effect-receipts";
+/** Every receipt parameter lives under this prefix, so read-only IAM can be
+ * scoped to `arn:…:parameter/chant-receipts/*` and nothing else. */
+export declare const RECEIPT_PATH_PREFIX = "/chant-receipts";
+/**
+ * The rendered `Value` of a hash-flavor receipt that still carries reference
+ * inputs at synthesis. References resolve at plan and at run, never at
+ * synthesis (epic decision 5) — so the row carries this note instead of a
+ * digest hashed over placeholders.
+ */
+export declare const RECEIPT_UNRESOLVED_VALUE_NOTE = "unresolved at synthesis \u2014 reference inputs; the expectation resolves at plan and at run (chant #1703, decision 5)";
+/**
+ * The SSM parameter name of one effect's receipt:
+ * `/chant-receipts/<stack>/<env>/<effect>`, from the resolved ownership
+ * marker fields (epic decision 4). The single source of the path identity —
+ * the serializer's rendered row, the receipt store's reads and writes, and
+ * the observation leg all call this.
+ */
+export declare function receiptParameterName(stack: string, env: string, effect: string): string;
+/**
+ * An aws-materialized effect receipt: core's declaration shape (so
+ * `isEffectReceipt`, `effect(...)`, lint, and the plan engine all recognize it
+ * through the marker), under the aws lexicon and the real resource kind, with
+ * the store variant pinned plain.
+ */
+export interface AwsEffectReceiptDeclaration extends Declarable {
+    readonly [EFFECT_RECEIPT_MARKER]: true;
+    readonly lexicon: "aws";
+    readonly entityType: typeof AWS_EFFECT_RECEIPT_ENTITY_TYPE;
+    /** The receipt's own name (the export-level identity of the witness). */
+    readonly name: string;
+    /** The effect this receipt witnesses — the path's final segment. */
+    readonly effect: string;
+    /** How the receipt is compared: mere presence, or a digest of the inputs. */
+    readonly flavor: EffectReceiptFlavor;
+    /** The effect's inputs as recorded at synthesis (references as placeholders). */
+    readonly inputs: Readonly<Record<string, unknown>>;
+    /** The declared parameter variant — pinned `String` at the source, which is
+     * the concrete half of #1833's plain-store guard. */
+    readonly props: {
+        readonly Type: "String";
+    };
+}
+/**
+ * Declare an aws-materialized effect receipt. Same signature and semantics as
+ * core's `EffectReceipt` (#1831) — the options are validated and frozen by the
+ * core factory — but the declaration lands in the aws partition, so the aws
+ * serializer renders the `AWS::SSM::Parameter` row and the receipt store
+ * (../receipt-store.ts) is its writer. Pass the returned const straight to the
+ * `effect(...)` op step.
+ */
+export declare function EffectReceipt(name: string, options: EffectReceiptOptions): AwsEffectReceiptDeclaration;
+//# sourceMappingURL=effect-receipt-row.d.ts.map

package/dist/effect-receipt-row.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effect-receipt-row.d.ts","sourceRoot":"","sources":["../src/effect-receipt-row.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAEL,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC;0EAC0E;AAC1E,eAAO,MAAM,8BAA8B,wBAAwB,CAAC;AAEpE;;;;+BAI+B;AAC/B,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAEpE;oEACoE;AACpE,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,2HAC2E,CAAC;AAkBtH;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvF;AAED;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,UAAU;IAC7D,QAAQ,CAAC,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,OAAO,8BAA8B,CAAC;IAC3D,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD;yDACqD;IACrD,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,2BAA2B,CA0BtG"}

package/dist/index.d.ts

@@ -3,6 +3,10 @@ export { defaultTags, isDefaultTags, DEFAULT_TAGS_MARKER } from "./default-tags.
 export type { DefaultTags, TagEntry } from "./default-tags.js";
 export { templateTransform, isTemplateTransform, TEMPLATE_TRANSFORM_MARKER } from "./template-transform.js";
 export type { TemplateTransform } from "./template-transform.js";
+export { EffectReceipt, receiptParameterName, AWS_EFFECT_RECEIPT_ENTITY_TYPE, EFFECT_RECEIPTS_METADATA_KEY, RECEIPT_PATH_PREFIX, RECEIPT_UNRESOLVED_VALUE_NOTE, } from "./effect-receipt-row.js";
+export type { AwsEffectReceiptDeclaration } from "./effect-receipt-row.js";
+export { awsReceiptStore, observeReceiptRows, ssmGetParameter, ssmPutParameter } from "./receipt-store.js";
+export type { AwsReceiptStoreOptions, ReceiptRowObservation } from "./receipt-store.js";
 export { awsSerializer } from "./serializer.js";
 export { nestedStack, isNestedStackInstance, NestedStackOutputRef, isNestedStackOutputRef, NESTED_STACK_MARKER } from "./nested-stack.js";
 export type { NestedStackOptions, NestedStackInstance } from "./nested-stack.js";
@@ -24,8 +28,8 @@ export type { CFNSchema, SchemaProperty, SchemaDefinition } from "./spec/fetch.j
 export { parseCFNSchema, cfnShortName, cfnServiceName } from "./spec/parse.js";
 export type { SchemaParseResult, ParsedResource, ParsedProperty, ParsedAttribute, ParsedPropertyType, ParsedEnum, PropertyConstraints } from "./spec/parse.js";
 export { S3Actions, LambdaActions, DynamoDBActions, SQSActions, SNSActions, IAMActions, ECRActions, LogsActions, ECSActions } from "./actions/index.js";
-export { LambdaFunction, LambdaNode, LambdaPython, NodeLambda, PythonLambda, LambdaApi, LambdaScheduled, ScheduledLambda, LambdaSqs, LambdaEventBridge, LambdaDynamoDB, LambdaS3, LambdaSns, VpcDefault, FargateAlb, AlbShared, FargateService, RdsInstance, RdsPostgres, EfsWithAccessPoint, Ec2InstanceRole, MinimalVpc, EksCluster, SolrFargateService, MicrovmApp, MICROVM_LIMITS, AgentCoreAgent, agentCoreDefaultEndpointArn, OrganizationRoot, GovernanceFoundation, RegionRestriction, OrganizationTrail, } from "./composites/index.js";
-export type { LambdaFunctionProps, LambdaApiProps, ScheduledLambdaProps, LambdaSqsProps, LambdaEventBridgeProps, LambdaDynamoDBProps, LambdaS3Props, LambdaSnsProps, VpcDefaultProps, FargateAlbProps, AlbSharedProps, FargateServiceProps, RdsInstanceProps, RdsPostgresProps, EfsWithAccessPointProps, Ec2InstanceRoleProps, MinimalVpcProps, EksClusterProps, SolrFargateServiceProps, MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps, MicrovmMemoryMiB, AgentCoreAgentProps, AgentCoreAgentResult, OrganizationRootProps, GovernanceFoundationProps, RegionRestrictionProps, OrganizationTrailProps, } from "./composites/index.js";
+export { LambdaFunction, LambdaNode, LambdaPython, NodeLambda, PythonLambda, LambdaApi, LambdaScheduled, ScheduledLambda, LambdaSqs, LambdaEventBridge, LambdaDynamoDB, DynamoDBTable, EcrRepository, LambdaS3, LambdaSns, VpcDefault, FargateAlb, AlbShared, FargateService, FARGATE_SERVICE_LIMITS, NlbService, RdsInstance, RdsPostgres, EfsWithAccessPoint, Ec2InstanceRole, Ec2InstanceBundle, MinimalVpc, EksCluster, SolrFargateService, MicrovmApp, MICROVM_LIMITS, AgentCoreAgent, agentCoreDefaultEndpointArn, AGENTCORE_LIMITS, OrganizationRoot, GovernanceFoundation, RegionRestriction, OrganizationTrail, StepFunctionsWorkflow, MonitoringStack, BucketDeployment, } from "./composites/index.js";
+export type { LambdaFunctionProps, LambdaApiProps, ScheduledLambdaProps, LambdaSqsProps, LambdaEventBridgeProps, LambdaDynamoDBProps, DynamoDBTableProps, DynamoDBKey, DynamoDBCapacity, DynamoDBGlobalSecondaryIndex, EcrRepositoryProps, EcrLifecycleRule, EcrEncryption, LambdaS3Props, LambdaSnsProps, VpcDefaultProps, FargateAlbProps, AlbSharedProps, FargateServiceProps, NlbServiceProps, RdsInstanceProps, RdsPostgresProps, EfsWithAccessPointProps, Ec2InstanceRoleProps, Ec2InstanceBundleProps, Ec2InstanceBundleIngressRule, MinimalVpcProps, EksClusterProps, SolrFargateServiceProps, MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps, MicrovmMemoryMiB, AgentCoreAgentProps, AgentCoreAgentResult, OrganizationRootProps, GovernanceFoundationProps, RegionRestrictionProps, OrganizationTrailProps, StepFunctionsWorkflowProps, MonitoringStackProps, MonitoringMetricSpec, BucketDeploymentProps, BucketDeploymentResult, } from "./composites/index.js";
 export { generate, writeGeneratedFiles } from "./codegen/generate.js";
 export { packageLexicon } from "./codegen/package.js";
 export type { PackageOptions, PackageResult } from "./codegen/package.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EACjE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAC3E,kBAAkB,EAClB,eAAe,EAAE,UAAU,EAAE,UAAU,EACvC,kBAAkB,EAClB,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,2BAA2B,EAC3C,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAC1F,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EACzG,uBAAuB,EACvB,oBAAoB,EAAE,eAAe,EAAE,eAAe,EACtD,uBAAuB,EACvB,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAClF,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,GACjG,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChI,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAK9D,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,8BAA8B,EAC9B,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxG,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGrF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAC/F,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAC/G,kBAAkB,EAClB,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAC1D,kBAAkB,EAClB,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,2BAA2B,EAAE,gBAAgB,EAC7D,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5E,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAChO,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAC1H,uBAAuB,EACvB,oBAAoB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,eAAe,EAAE,eAAe,EAC5G,uBAAuB,EACvB,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAClF,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,EAChG,0BAA0B,EAC1B,oBAAoB,EAAE,oBAAoB,EAC1C,qBAAqB,EAAE,sBAAsB,GAC9C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChI,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC"}

package/dist/integrity.json

@@ -1,13 +1,13 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "df6e137cd4b191fed64b7a1f64d9478f0ff8c0a997dcee3a52ee3156e94d8911",
+    "manifest.json": "73f13702a63ae229fbc2ca77dc23d1fb98a22f2a7a101e8ddf4ec66749527440",
     "meta.json": "2e4cae67cbc2eb2962c3dd0aa57008ae96fb725dd0118af7b04b2b44eab7722a",
     "types/index.d.ts": "6d6b37bd14a9b40fb3ff5c66e1cb49be1ae1032de47a4e167cf5f411c943b7f5",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
     "rules/iam-wildcard.ts": "135d7217d278fef50939e605c5da32603ba35674b8c4b5c4d66a06c77903e945",
     "rules/s3-encryption.ts": "c4f9f8aa8dc382ed98c7b04e820a600590cc75335a8db2e087cbfbfe4003d09e",
-    "rules/cf-refs.ts": "ec83a98348c9ff418230523bea1de1a08bb6e6c72bbb255ab9bca57191ff5fef",
+    "rules/cf-refs.ts": "3ca38a822b75db5b6370a5507f6a1c088e5419c9f8f5a3c9631468064842ba12",
     "rules/cor020.ts": "915bbb4c083c7b3b84b93e8e891b5ffffe5a138fdccda32ecfdda91b8685798c",
     "rules/ext001.ts": "f8703f37a50ab23d0ecaef539c0215a71269d420fa5e09a3d0454b18b7350b34",
     "rules/waw010.ts": "41c58aaedb8f9fe266f4b40f1a076f762796427fdf9b317b8a4a50c713e45571",
@@ -60,9 +60,12 @@
     "rules/waw058.ts": "fbcfde64bbf81abe919f4e60a7e283a1b2ff30454b2c1cec2e0e099e7ad187e6",
     "rules/waw059.ts": "abaa8b31e5e50837be8d8ebe124b6e2156e0bbb8699e93e60eb63f623db37f24",
     "rules/waw060.ts": "0fd439ba658b44ae16454bc850948d97ebf81739ff5ef0a46de69fcc0c4ac705",
+    "rules/waw061.ts": "5e25d1cd07c5ff0c918d84995cf37a8fa22294242de6b421c1eef37f4fb6521d",
+    "rules/waw062.ts": "8051ac5cbc3e53fc1e664bb8e6ffd54a75fac0b6e9e802bd0d244dfec59d82a0",
+    "rules/waw063.ts": "c64f86e7cea5363c42d6aa59c06c4343b7c6cad20aeb9fbf4fec69de5e63ee87",
     "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
-    "skills/chant-aws-carve-terraform.md": "52dc7a8a10156d236266cc8dbf75614fabb6e2fa4caf31c13cca348e167a58b5"
+    "skills/chant-aws-carve-terraform.md": "0ae4376590db47979be144d3ac6cdcfd56c9640d0536421aacf7330459d38e52"
   },
-  "composite": "6784c3bcfe687d1f0736330b975673c4a8bd900227234e864329fc7863cd521b"
+  "composite": "0863289514a6e704688b98dd03fd728b10c1763269f46a0591689f19bc8f9e24"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAQ1F,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA0DpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAQ1F,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAgEpD,CAAC"}

package/dist/lint/post-synth/cf-refs.d.ts

@@ -68,6 +68,23 @@ export declare function getContainerDefinitions(resource: CFResource): Array<Rec
  * project that never sets `--env`/`ownership.env` isn't unexpectedly hard-failed.
  */
 export declare function isFullTierEnv(env: string | undefined): boolean;
+/**
+ * Parse an IPv4 CIDR literal ("10.0.0.0/16") into its numeric base address
+ * and prefix length. Returns null for anything that isn't a plain IPv4 CIDR
+ * (IPv6, malformed octets, out-of-range prefix) — callers treat that as
+ * "can't prove statically" rather than an error.
+ */
+export declare function parseIpv4Cidr(cidr: string): {
+    base: number;
+    prefix: number;
+} | null;
+/**
+ * Whether `inner` (an IPv4 CIDR literal) falls entirely within `outer`.
+ * Returns null — not false — when either literal isn't a plain, parseable
+ * IPv4 CIDR (e.g. IPv6, or a CloudFormation intrinsic already stringified
+ * elsewhere); a null means "statically unprovable", not "violation".
+ */
+export declare function ipv4CidrContains(outer: string, inner: string): boolean | null;
 /**
  * Check if a port range [fromPort, toPort] contains any of the sensitive ports.
  */

package/dist/lint/post-synth/cf-refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cf-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cf-refs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,GAAG,IAAI,CAWvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAcnF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAInD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBhC;AAiBD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAahC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAK5F;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAgBT"}
+{"version":3,"file":"cf-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cf-refs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,GAAG,IAAI,CAWvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAcnF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAInD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBhC;AAiBD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAahC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAK5F;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASnF;AAUD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAO7E;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAgBT"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAsDvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAqD3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAyDvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAwD3C,CAAC"}

package/dist/lint/post-synth/waw061.d.ts

@@ -0,0 +1,19 @@
+/**
+ * WAW061: Subnet CIDR Not Contained In VPC CIDR
+ *
+ * A subnet's CidrBlock must fall entirely inside its VPC's CidrBlock.
+ * Stock CDK does not check this — CloudFormation accepts the template and
+ * only fails the `AWS::EC2::Subnet` resource at deploy time
+ * ("The CIDR ... is invalid" / "does not fall within the CIDR range of the
+ * VPC"), after the rest of the stack may have already started rolling out.
+ * This is a cheap static graph check: follow the subnet's VpcId Ref to a
+ * declared VPC in the same template and do IPv4 CIDR-range math.
+ *
+ * Stays quiet whenever the graph can't prove it: intrinsic CIDR blocks,
+ * IPv6, a VpcId that isn't a simple Ref to a declared AWS::EC2::VPC, or a
+ * VPC whose own CidrBlock isn't a literal string.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkSubnetCidrContainment(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw061: PostSynthCheck;
+//# sourceMappingURL=waw061.d.ts.map

package/dist/lint/post-synth/waw061.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw061.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw061.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAsCvF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw062.d.ts

@@ -0,0 +1,19 @@
+/**
+ * WAW062: Duplicate Name Or Export Within A Template
+ *
+ * CloudFormation requires certain names to be unique within a single
+ * template/stack: `Outputs.*.Export.Name`, and several resource-level
+ * "explicit name" properties (LaunchTemplateName, AutoScalingGroupName,
+ * GroupName, ...). Stock CDK doesn't catch a collision here — synth
+ * succeeds and the stack fails at CloudFormation deploy/changeset time.
+ * A duplicate is easy to introduce by copy-pasting a composite invocation
+ * (e.g. two EcrRepository or NlbService composites) without varying the
+ * explicit name.
+ *
+ * Only literal string values are compared — anything built from an
+ * intrinsic (Fn::Sub, Ref, ...) is statically unprovable and skipped.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkDuplicateNamesAndExports(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw062: PostSynthCheck;
+//# sourceMappingURL=waw062.d.ts.map

package/dist/lint/post-synth/waw062.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw062.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw062.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAqF9G,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAY1F;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw063.d.ts

@@ -0,0 +1,35 @@
+/**
+ * WAW063: IAM Policy Denies An Action It Also Allows
+ *
+ * IAM evaluates an explicit Deny as an absolute veto: it wins over any
+ * Allow granted to the same principal, from any attached policy, no matter
+ * how the Allow got there. When a role ends up with both an Allow and a
+ * Deny for the same action (over an overlapping resource scope) —
+ * typically because a broad guardrail policy and a feature-specific policy
+ * were attached to the same role independently — CloudFormation deploys
+ * the stack without complaint and the contradiction only surfaces as a
+ * runtime 403, the most expensive class of error to trace back to its
+ * source. This is IAM-reasoning static analysis over the declared graph:
+ * collect every Allow/Deny statement attached to each declared IAM::Role
+ * (inline, standalone IAM::Policy, and IAM::ManagedPolicy) and flag a
+ * literal action+resource collision between an Allow and a Deny.
+ *
+ * Deliberately conservative to avoid flagging the common intentional
+ * "broad Allow + narrow safety-Deny" guardrail pattern (e.g. `Allow ec2:*`
+ * plus `Deny ec2:TerminateInstances`):
+ *   - both statements' Action lists are compared string-by-string; a match
+ *     requires either the literal same action on both sides, or a
+ *     wildcarded Deny action that matches a literal (non-wildcarded) Allow
+ *     action. A wildcarded Allow paired with a literal Deny is exactly the
+ *     guardrail pattern and is never flagged;
+ *   - resources are compared the same way: `Resource: "*"` on the Deny
+ *     side always overlaps, or a literal exact match; a wildcarded Allow
+ *     resource paired with a narrower literal Deny is not flagged;
+ *   - any statement carrying a Condition, NotAction, NotResource,
+ *     Principal, or an intrinsic Action/Resource is skipped — the rule
+ *     can't prove those statically, so it stays quiet.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkDenyAllowContradiction(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw063: PostSynthCheck;
+//# sourceMappingURL=waw063.d.ts.map

package/dist/lint/post-synth/waw063.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw063.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw063.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAyG9G,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA8CxF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.46.0",
+  "version": "0.49.0",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/okf/index.md

@@ -1724,3 +1724,6 @@ okf_version: '0.2'
 * [WAW058](/rules/WAW058.md) - Organization audit trail missing, not logging, or scoped down to a single region
 * [WAW059](/rules/WAW059.md) - Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
 * [WAW060](/rules/WAW060.md) - IAM policy attached to no principal — it grants nothing
+* [WAW061](/rules/WAW061.md) - Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+* [WAW062](/rules/WAW062.md) - Duplicate export name or explicit resource name within a template — fails at deploy time
+* [WAW063](/rules/WAW063.md) - IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/rules/WAW061.md

@@ -0,0 +1,17 @@
+---
+type: post-synth-check
+title: WAW061
+description: Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+id: WAW061
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+
+## Applies to
+
+- [Subnet](/types/Subnet.md)
+- [Type](/types/Type.md)
+- [Vpc](/types/Vpc.md)

package/dist/okf/rules/WAW062.md

@@ -0,0 +1,27 @@
+---
+type: post-synth-check
+title: WAW062
+description: Duplicate export name or explicit resource name within a template — fails at deploy time
+id: WAW062
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Duplicate export name or explicit resource name within a template — fails at deploy time
+
+## Applies to
+
+- [AutoScalingGroup](/types/AutoScalingGroup.md)
+- [Bucket](/types/Bucket.md)
+- [ECRRepository](/types/ECRRepository.md)
+- [Function](/types/Function.md)
+- [LaunchTemplate](/types/LaunchTemplate.md)
+- [LoadBalancer](/types/LoadBalancer.md)
+- [ManagedPolicy](/types/ManagedPolicy.md)
+- [Map](/types/Map.md)
+- [Role](/types/Role.md)
+- [SecurityGroup](/types/SecurityGroup.md)
+- [StateMachine](/types/StateMachine.md)
+- [Table](/types/Table.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW063.md

@@ -0,0 +1,19 @@
+---
+type: post-synth-check
+title: WAW063
+description: IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403
+id: WAW063
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403
+
+## Applies to
+
+- [Action](/types/Action.md)
+- [IamPolicy](/types/IamPolicy.md)
+- [ManagedPolicy](/types/ManagedPolicy.md)
+- [Role](/types/Role.md)
+- [Type](/types/Type.md)

package/dist/okf/types/Action.md

@@ -32,3 +32,4 @@ resource_type: AWS::SageMaker::Action
 
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403