@intentius/chant-lexicon-aws 0.46.0 → 0.49.0

package/dist/okf/types/AutoScalingGroup.md

@@ -57,3 +57,4 @@ resource_type: AWS::AutoScaling::AutoScalingGroup
 ## Governed by
 
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Bucket.md

@@ -64,3 +64,4 @@ resource_type: AWS::S3::Bucket
 - [WAW018](/rules/WAW018.md): S3 bucket missing public access block — all public access should be blocked
 - [WAW042](/rules/WAW042.md): S3 bucket missing a TLS-only bucket policy — deny requests over plaintext
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/ECRRepository.md

@@ -31,3 +31,4 @@ resource_type: AWS::ECR::Repository
 
 - [WAW053](/rules/WAW053.md): ECR repository does not scan images on push
 - [WAW054](/rules/WAW054.md): ECR repository does not have immutable image tags
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Function.md

@@ -56,3 +56,4 @@ resource_type: AWS::Lambda::Function
 - [WAW011](/rules/WAW011.md): Deprecated Lambda runtime — flags deprecated or approaching-EOL Lambda runtimes
 - [WAW022](/rules/WAW022.md): Lambda function is not configured with a VPC — consider adding VpcConfig for network isolation
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/IamPolicy.md

@@ -26,3 +26,4 @@ resource_type: AWS::IAM::Policy
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
 - [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/LaunchTemplate.md

@@ -27,3 +27,4 @@ resource_type: AWS::EC2::LaunchTemplate
 ## Governed by
 
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/LoadBalancer.md

@@ -41,3 +41,4 @@ resource_type: AWS::ElasticLoadBalancingV2::LoadBalancer
 ## Governed by
 
 - [WAW024](/rules/WAW024.md): Application Load Balancer does not have access logging enabled
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/ManagedPolicy.md

@@ -42,3 +42,5 @@ resource_type: AWS::IAM::ManagedPolicy
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
 - [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/Map.md

@@ -35,3 +35,4 @@ resource_type: AWS::Location::Map
 - [WAW016](/rules/WAW016.md): Deprecated property usage — flags properties marked as deprecated in the CloudFormation Registry
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Role.md

@@ -32,3 +32,5 @@ resource_type: AWS::IAM::Role
 - [WAW020](/rules/WAW020.md): IAM policy uses wildcard Action — use specific actions following least privilege
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/SecurityGroup.md

@@ -29,3 +29,4 @@ resource_type: AWS::EC2::SecurityGroup
 - [WAW019](/rules/WAW019.md): Security group allows unrestricted ingress on sensitive ports (SSH, RDP, database)
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
 - [WAW049](/rules/WAW049.md): Security group allows unrestricted ingress on a port other than ALB:80/443
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/StateMachine.md

@@ -30,3 +30,7 @@ resource_type: AWS::StepFunctions::StateMachine
 - `Arn`
 - `Name`
 - `StateMachineRevisionId`
+
+## Governed by
+
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Subnet.md

@@ -38,3 +38,7 @@ resource_type: AWS::EC2::Subnet
 - `Ipv6CidrBlocks`
 - `NetworkAclAssociationId`
 - `SubnetId`
+
+## Governed by
+
+- [WAW061](/rules/WAW061.md): Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time

package/dist/okf/types/Table.md

@@ -43,3 +43,4 @@ resource_type: AWS::DynamoDB::Table
 - [WAW027](/rules/WAW027.md): DynamoDB table does not have point-in-time recovery enabled
 - [WAW030](/rules/WAW030.md): Missing DependsOn for known CloudFormation ordering patterns
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time

package/dist/okf/types/Type.md

@@ -75,3 +75,6 @@ resource_type: AWS::Cassandra::Type
 - [WAW058](/rules/WAW058.md): Organization audit trail missing, not logging, or scoped down to a single region
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
 - [WAW060](/rules/WAW060.md): IAM policy attached to no principal — it grants nothing
+- [WAW061](/rules/WAW061.md): Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+- [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time
+- [WAW063](/rules/WAW063.md): IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403

package/dist/okf/types/Vpc.md

@@ -64,3 +64,4 @@ resource_type: AWS::EC2::VPC
 ## Governed by
 
 - [WAW030](/rules/WAW030.md): Missing DependsOn for known CloudFormation ordering patterns
+- [WAW061](/rules/WAW061.md): Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time

package/dist/op/activities/index.d.ts

@@ -18,6 +18,12 @@ export { flociUp, flociDown, flociRunCommand, flociRmCommand, flociExistsCommand
 export type { FlociUpArgs, FlociDownArgs } from "./floci.js";
 export { awsApply, awsDelete, rollbackStack, waitForStackSettled, cfnUrl, cfnForm, capabilityParams, xmlField, stackStatus, stackId, cfnErrorMessage, isStackMissing, isNoUpdates, isSuccessStatus, isFailureStatus, isTerminalStatus, } from "./aws-apply.js";
 export type { AwsApplyArgs, RollbackStackArgs, AwsHttp } from "./aws-apply.js";
+export declare const receiptRead: (args: import("@intentius/chant/op/receipt-store").ReceiptReadArgs, signal?: AbortSignal) => Promise<import("@intentius/chant/op/receipt-store").ReceiptReadResult>;
+export declare const receiptWrite: (args: import("@intentius/chant/op/receipt-store").ReceiptWriteArgs, signal?: AbortSignal) => Promise<{
+    written: true;
+    receipt: string;
+}>;
+export declare const receiptStaleness: (args: import("@intentius/chant/op/receipt-store").ReceiptStalenessArgs, signal?: AbortSignal) => Promise<import("@intentius/chant/op/receipt-store").ReceiptStalenessResult>;
 export { awsAgentCoreFetchTrace } from "../../agentcore/trace-fetch.js";
 export type { AgentCoreTraceSource, AwsAgentCoreFetchTraceArgs, AwsAgentCoreFetchTraceResult, } from "../../agentcore/trace-fetch.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,QAAQ,EACR,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,MAAM,EACN,OAAO,EACP,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,OAAO,EACP,eAAe,EACf,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,QAAQ,EACR,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,MAAM,EACN,OAAO,EACP,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,OAAO,EACP,eAAe,EACf,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAa5E,eAAO,MAAM,WAAW,qKAAqC,CAAC;AAC9D,eAAO,MAAM,YAAY;;;EAAsC,CAAC;AAChE,eAAO,MAAM,gBAAgB,+KAA0C,CAAC;AAExE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAqC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aAm7BvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAqC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aAk9BvB,CAAC"}

package/dist/receipt-store.d.ts

@@ -0,0 +1,109 @@
+/**
+ * The aws `ReceiptStore` (#1835, epic #1703) — core's injectable receipt seam
+ * (#1834, `@intentius/chant/op/receipt-store`) implemented over SSM Parameter
+ * Store, plain `String`, at the path identity ./effect-receipt-row.ts derives
+ * from the ownership marker fields.
+ *
+ * The transport is the lexicon's own read/apply transport (./api/read-client,
+ * #1206), pointed at the SSM JSON API: `fetch`, SigV4 when credentials
+ * resolve, and the one endpoint-override rule (#1694) — the `endpoint`
+ * option, else `AWS_ENDPOINT_URL_SSM`, else `AWS_ENDPOINT_URL` — so a local
+ * emulator lane reads and writes receipts without any store-specific wiring.
+ *
+ * Write discipline (epic decision 3): `write` exists for the `effect()` step
+ * alone — the step's read-compare-run-write is the only path that reaches it,
+ * on success, last. `PutParameter` is `Type: "String"` always; the first
+ * write creates the parameter with the ownership tags, and a later write
+ * overwrites the value (SSM refuses `Overwrite` and `Tags` in one call, so
+ * tags ride creation only — they never change after).
+ *
+ * Identity: the parameter name needs `<stack>` and `<env>`, which the
+ * activity args deliberately do not carry (the `EffectReceiptRef` is
+ * identity-of-the-effect, not identity-of-the-deployment). The store resolves
+ * them once, lazily, at first use: an explicit option, else `CHANT_ENV` (what
+ * `chant run --env` sets) and the project's `ownership` block — the same
+ * fields that stamp markers (epic decision 4). Nothing resolving is an error,
+ * never a guessed segment.
+ */
+import type { ReceiptStore } from "@intentius/chant/op/receipt-store";
+import type { ResourceMetadata } from "@intentius/chant/lexicon";
+import type { UnobservedReason } from "@intentius/chant/observation";
+import { type AwsCredentialSource, type AwsReadClientOptions, type AwsReadHttp } from "./api/read-client.js";
+/** Options for {@link awsReceiptStore}. All optional: the default store reads
+ * its identity from the project and its endpoint from the environment. */
+export interface AwsReceiptStoreOptions {
+    /** The path's `<stack>` segment. Omitted, the project's `ownership.stack`
+     * (chant.config.ts, found upward from `cwd`) answers. */
+    stack?: string;
+    /** The path's `<env>` segment — explicit by decision 4. Omitted, `CHANT_ENV`
+     * (set by `chant run --env`) answers, then a literal `ownership.env`. */
+    environment?: string;
+    /** Where to look for chant.config.ts. Defaults to the working directory. */
+    cwd?: string;
+    /** Endpoint override; omitted, `AWS_ENDPOINT_URL[_SSM]` answers (#1694). */
+    endpoint?: string;
+    /** Region for the real-AWS host. */
+    region?: string;
+    /** Injectable HTTP, mirroring the read client's. Tests avoid the network. */
+    http?: AwsReadHttp;
+    /** Environment record the endpoint/credential/identity fallbacks read.
+     * Defaults to `process.env`; injectable for tests. */
+    env?: Record<string, string | undefined>;
+    /** What to sign with — same seam as the read client. */
+    credentials?: AwsCredentialSource;
+    /** Sign even against an endpoint override — for an override that is real AWS. */
+    signEndpointOverride?: boolean;
+}
+/** One SSM JSON call. Exported for the observation leg (plugin.ts), which
+ * reads the same parameters the store writes. */
+export declare function ssmCall(action: string, payload: Record<string, unknown>, options: AwsReadClientOptions): Promise<{
+    status: number;
+    json: Record<string, unknown>;
+}>;
+/** The API's own error code from a JSON-protocol error body — `__type`, with
+ * any `namespace#` prefix stripped. */
+export declare function ssmErrorCode(json: Record<string, unknown>): string | undefined;
+/**
+ * `GetParameter` by name. Absent (`ParameterNotFound`) is `undefined` — a real
+ * answer, distinct from a failed read, which throws.
+ */
+export declare function ssmGetParameter(name: string, options?: AwsReadClientOptions): Promise<string | undefined>;
+/**
+ * `PutParameter`, plain `String`. Creation carries `tags`; an existing
+ * parameter is overwritten (`Overwrite: true`) without them — SSM refuses
+ * `Overwrite` and `Tags` in the same call, and ownership tags never change.
+ */
+export declare function ssmPutParameter(name: string, value: string, tags: Record<string, string>, options?: AwsReadClientOptions): Promise<void>;
+/** What the observation leg learned about the declared receipt rows. */
+export interface ReceiptRowObservation {
+    resources: Record<string, ResourceMetadata>;
+    unobserved: Record<string, {
+        type: string;
+        reason: UnobservedReason;
+        detail: string;
+    }>;
+}
+/**
+ * The plan-side live read of the receipt rows (#1835's observation leg).
+ *
+ * A receipt is not a stack member — the applier never writes it (#1832) — so
+ * `describe-stack-resources` honestly reports it absent even while the
+ * parameter exists. The serializer renders each receipt's derived path into
+ * the template's `Metadata` (./serializer.ts), so this leg reads the paths
+ * back from the build output — one derivation, decision 4 — and asks SSM
+ * `GetParameter` for each. Present maps the stored value onto
+ * `attributes.value` (core's `RECEIPT_VALUE_ATTRIBUTE`); `ParameterNotFound`
+ * is a real absence and stays one; a failed read is an `unobserved` hole,
+ * never a wrong answer — a receipt nobody could read must not arrive
+ * downstream as "the effect never ran".
+ */
+export declare function observeReceiptRows(entityNames: string[], buildOutput: string, options?: AwsReadClientOptions): Promise<ReceiptRowObservation>;
+/**
+ * The `ReceiptStore` over SSM. Bind it once in the op activities barrel —
+ * `receiptActivities(awsReceiptStore())` — and the registry resolves
+ * `receiptRead`/`receiptWrite`/`receiptStaleness` by name, exactly like
+ * `ensureSecret` (#1830). Identity and endpoint resolve lazily at first use,
+ * so module load never reads the project or the environment.
+ */
+export declare function awsReceiptStore(options?: AwsReceiptStoreOptions): ReceiptStore;
+//# sourceMappingURL=receipt-store.d.ts.map

package/dist/receipt-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt-store.d.ts","sourceRoot":"","sources":["../src/receipt-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,KAAK,EAAoB,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAKL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAO3B;0EAC0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC;6DACyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;6EACyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;0DACsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,wDAAwD;IACxD,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;iDACiD;AACjD,wBAAsB,OAAO,CAC3B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAyB5D;AAED;uCACuC;AACvC,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAI9E;AAQD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CAiBf;AA4CD,wEAAwE;AACxE,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EAAE,EACrB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,qBAAqB,CAAC,CA+ChC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,YAAY,CAyBlF"}

package/dist/rules/cf-refs.ts

@@ -169,6 +169,46 @@ export function isFullTierEnv(env: string | undefined): boolean {
   return env === "prod" || env === "production" || env === "full";
 }
 
+/**
+ * Parse an IPv4 CIDR literal ("10.0.0.0/16") into its numeric base address
+ * and prefix length. Returns null for anything that isn't a plain IPv4 CIDR
+ * (IPv6, malformed octets, out-of-range prefix) — callers treat that as
+ * "can't prove statically" rather than an error.
+ */
+export function parseIpv4Cidr(cidr: string): { base: number; prefix: number } | null {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/.exec(cidr.trim());
+  if (!m) return null;
+  const octets = m.slice(1, 5).map(Number);
+  if (octets.some((o) => o < 0 || o > 255)) return null;
+  const prefix = Number(m[5]);
+  if (prefix < 0 || prefix > 32) return null;
+  const base = ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;
+  return { base, prefix };
+}
+
+/** [networkAddress, broadcastAddress] for a parsed IPv4 CIDR block. */
+function ipv4Range(cidr: { base: number; prefix: number }): [number, number] {
+  const maskBits = cidr.prefix === 0 ? 0 : (0xffffffff << (32 - cidr.prefix)) >>> 0;
+  const network = (cidr.base & maskBits) >>> 0;
+  const broadcast = (network | (~maskBits >>> 0)) >>> 0;
+  return [network, broadcast];
+}
+
+/**
+ * Whether `inner` (an IPv4 CIDR literal) falls entirely within `outer`.
+ * Returns null — not false — when either literal isn't a plain, parseable
+ * IPv4 CIDR (e.g. IPv6, or a CloudFormation intrinsic already stringified
+ * elsewhere); a null means "statically unprovable", not "violation".
+ */
+export function ipv4CidrContains(outer: string, inner: string): boolean | null {
+  const outerCidr = parseIpv4Cidr(outer);
+  const innerCidr = parseIpv4Cidr(inner);
+  if (!outerCidr || !innerCidr) return null;
+  const [oStart, oEnd] = ipv4Range(outerCidr);
+  const [iStart, iEnd] = ipv4Range(innerCidr);
+  return iStart >= oStart && iEnd <= oEnd;
+}
+
 /**
  * Check if a port range [fromPort, toPort] contains any of the sensitive ports.
  */

package/dist/rules/waw061.ts

@@ -0,0 +1,67 @@
+/**
+ * WAW061: Subnet CIDR Not Contained In VPC CIDR
+ *
+ * A subnet's CidrBlock must fall entirely inside its VPC's CidrBlock.
+ * Stock CDK does not check this — CloudFormation accepts the template and
+ * only fails the `AWS::EC2::Subnet` resource at deploy time
+ * ("The CIDR ... is invalid" / "does not fall within the CIDR range of the
+ * VPC"), after the rest of the stack may have already started rolling out.
+ * This is a cheap static graph check: follow the subnet's VpcId Ref to a
+ * declared VPC in the same template and do IPv4 CIDR-range math.
+ *
+ * Stays quiet whenever the graph can't prove it: intrinsic CIDR blocks,
+ * IPv6, a VpcId that isn't a simple Ref to a declared AWS::EC2::VPC, or a
+ * VPC whose own CidrBlock isn't a literal string.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, ipv4CidrContains } from "./cf-refs";
+
+export function checkSubnetCidrContainment(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::EC2::Subnet") continue;
+
+      const props = resource.Properties ?? {};
+      const subnetCidr = props.CidrBlock;
+      if (typeof subnetCidr !== "string") continue;
+
+      const vpcRefs = findResourceRefs(props.VpcId);
+      if (vpcRefs.size !== 1) continue;
+      const [vpcId] = vpcRefs;
+
+      const vpc = template.Resources[vpcId];
+      if (!vpc || vpc.Type !== "AWS::EC2::VPC") continue;
+
+      const vpcCidr = vpc.Properties?.CidrBlock;
+      if (typeof vpcCidr !== "string") continue;
+
+      const contained = ipv4CidrContains(vpcCidr, subnetCidr);
+      if (contained === false) {
+        diagnostics.push({
+          checkId: "WAW061",
+          severity: "error",
+          message: `Subnet "${logicalId}" CidrBlock ${subnetCidr} is not contained within VPC "${vpcId}"'s CidrBlock ${vpcCidr} — CloudFormation rejects this at deploy time`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw061: PostSynthCheck = {
+  id: "WAW061",
+  description: "Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkSubnetCidrContainment(ctx);
+  },
+};

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAkZlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAoE3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAiflG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA4E3B,CAAC"}

package/dist/skills/chant-aws-carve-terraform.md

@@ -1,6 +1,6 @@
 ---
 skill: chant-aws-carve-terraform
-description: Demo carving a resource out of Terraform into native chant — advise, emit, bridge, apply — fully offline
+description: Demo carving a resource out of Terraform into native chant — advise, emit, audit, bridge, apply — fully offline
 user-invocable: true
 ---
 
@@ -15,7 +15,7 @@ graduation.
 ## When to use
 
 - Someone asks "how does chant move things off Terraform?"
-- You want to show the advise → emit → bridge → apply loop end to end.
+- You want to show the advise → emit → audit → bridge → apply loop end to end.
 - You are evaluating whether a Terraform estate is worth carving.
 
 ## Preconditions
@@ -27,7 +27,7 @@ graduation.
 ## The fastest path: run the bundled demo
 
 The `examples/terraform-carve-out` example ships a runnable estate + state and a
-script that runs all four steps with commentary:
+script that runs all five steps with commentary:
 
 ```bash
 cd examples/terraform-carve-out
@@ -54,28 +54,30 @@ From `examples/terraform-carve-out`, with `TF=./terraform`:
      --state ./terraform/terraform.tfstate --output ./carveout
    ```
    Show `./carveout/src/assets.ts` — a real `new Bucket({ BucketName, Tags })` with
-   CloudFormation-style properties mapped from the Terraform state attributes.
-   Emit also scaffolds `./carveout` into a buildable chant project
-   (`chant.config.ts`, `package.json`), so `npm install && npm run build` works
-   there as-is. Explain: a Terraform-managed resource is not in any
-   CloudFormation stack, so the correct source of its live shape is the state
-   file, not a cloud read.
-
-3. **Lint the inherited resource — optional, offer it.**
+   CloudFormation-style properties mapped from the Terraform state attributes,
+   and the `aws_s3_bucket_versioning` sub-resource folded into
+   `VersioningConfiguration`. Emit also scaffolds `./carveout` into a buildable
+   chant project (`chant.config.ts`, `package.json`) and persists a carve
+   manifest (`*.carve.json`) — bridge and apply read the target from it, so
+   `--select` is only needed once. Explain: a Terraform-managed resource is not
+   in any CloudFormation stack, so the correct source of its live shape is the
+   state file, not a cloud read.
+
+3. **Audit the inherited resource.**
    ```bash
-   chant lint ./carveout/src --lexicon aws
+   chant build ./carveout/src --lexicon aws
    ```
-   After emit, offer to lint the carved source. chant audits the resource you
-   inherited from Terraform against the AWS lexicon's rules. Findings have a
-   severity: `error` (must fix before `chant build` will emit — e.g. an S3
-   bucket with no public-access block) and `warning`/`info` (advisory — e.g.
-   DynamoDB point-in-time recovery). This is a feature of carving: chant
-   immediately tells the person what is wrong with what they adopted. Whether to
-   fix an advisory finding is their call; errors block the build until resolved.
+   The first build fails, deliberately: the post-synth audit refuses the
+   adopted bucket because Terraform managed it without a public-access block or
+   a TLS-only policy. This is a feature of carving: chant immediately tells the
+   person what is wrong with what they adopted. Show the fix (add
+   `PublicAccessBlockConfiguration` and a companion `S3BucketPolicy` with an
+   `aws:SecureTransport = false` Deny — the tutorial page has the exact code),
+   then re-run the build and show the valid CloudFormation template.
 
 4. **Bridge — patch the surviving Terraform.**
    ```bash
-   chant carve bridge --from ./terraform --select aws_s3_bucket.assets --output ./carveout
+   chant carve bridge --from ./terraform --output ./carveout
    ```
    Show the generated `data "aws_s3_bucket" "assets"` and the rewired survivor.
    Emphasize it is dry-run: nothing in `./terraform` changed. `--apply-rewrites`
@@ -83,11 +85,12 @@ From `examples/terraform-carve-out`, with `TF=./terraform`:
 
 5. **Apply — graduation plan.**
    ```bash
-   chant carve apply --from ./terraform --select aws_s3_bucket.assets --env prod --stack assets
+   chant carve apply --from ./terraform --output ./carveout --env prod --stack assets
    ```
    Show the ownership marker (`chant:managed-by/stack/env`) and the finalized
-   runbook. Stress this makes no cloud call — the apply is the person's own
-   lifecycle; chant just plans it.
+   runbook. `--write-source` additionally stamps the marker tags into the
+   emitted source. Stress this makes no cloud call — the apply is the person's
+   own lifecycle; chant just plans it.
 
 ## Key points to land
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.46.0",
+  "version": "0.49.0",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -73,14 +73,14 @@
   },
   "dependencies": {
     "fflate": "^0.8.2",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^4.3.1"
   },
   "devDependencies": {
     "@intentius/chant": "*",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.46.0",
+    "@intentius/chant": "^0.49.0",
     "typescript": "^5.9.3"
   }
 }

package/src/api/read-client.test.ts

@@ -198,6 +198,15 @@ describe("Cloud Control", () => {
     expect(await listResources("AWS::S3::Bucket", { http })).toEqual([]);
   });
 
+  test("listResources scopes a child listing with ResourceModel, JSON-encoded as the API takes it", async () => {
+    const { http, calls } = recording(() => respond(JSON.stringify({ ResourceDescriptions: [] })));
+    await listResources("AWS::IAM::RolePolicy", { http }, { RoleName: "app-role" });
+    expect(JSON.parse(calls[0].body)).toEqual({
+      TypeName: "AWS::IAM::RolePolicy",
+      ResourceModel: JSON.stringify({ RoleName: "app-role" }),
+    });
+  });
+
   test("parseResourceDescription refuses anything that is not a model object", () => {
     expect(parseResourceDescription(null)).toBeNull();
     expect(parseResourceDescription({ Identifier: "a" })).toBeNull();

package/src/api/read-client.ts

@@ -434,17 +434,30 @@ export async function getResource(
   return parseResourceDescription(body.ResourceDescription);
 }
 
-/** `ListResources` — every live resource of one type, paginated to exhaustion. */
+/**
+ * `ListResources` — every live resource of one type, paginated to exhaustion.
+ *
+ * `resourceModel` is Cloud Control's `ResourceModel`: the scope a child-typed
+ * listing requires (`{ RoleName }` for `AWS::IAM::RolePolicy`,
+ * `{ TopicArn }` for `AWS::SNS::Subscription`). The API takes it as a JSON
+ * *string*, the same double encoding `GetResource` answers with; this takes
+ * the object and encodes it so no caller repeats that detail.
+ */
 export async function listResources(
   typeName: string,
   options: AwsReadClientOptions = {},
+  resourceModel?: Record<string, unknown>,
 ): Promise<CloudControlDescription[]> {
   const out: CloudControlDescription[] = [];
   let nextToken: string | undefined;
   do {
     const body = await cloudControl(
       "ListResources",
-      { TypeName: typeName, ...(nextToken ? { NextToken: nextToken } : {}) },
+      {
+        TypeName: typeName,
+        ...(resourceModel ? { ResourceModel: JSON.stringify(resourceModel) } : {}),
+        ...(nextToken ? { NextToken: nextToken } : {}),
+      },
       options,
     );
     const descriptions = Array.isArray(body.ResourceDescriptions) ? body.ResourceDescriptions : [];

package/src/composites/agentcore-agent.ts

@@ -45,19 +45,36 @@ export function agentCoreDefaultEndpointArn(runtime: InstanceType<typeof Runtime
 }
 
 /**
- * AgentCore's `Runtime`/`RuntimeEndpoint`/`Memory` `Name`/`AgentRuntimeName`
- * fields are all bound to the CFN registry pattern
- * `^[a-zA-Z][a-zA-Z0-9_]{0,47}$` (spot-checked against the CloudFormation
- * schema for #882 — no hyphens, unlike chant's usual kebab-case component
- * names). `Gateway`/`GatewayTarget`/`WorkloadIdentity` names accept hyphens,
- * so only the Runtime family needs sanitizing. Non-identifier characters
- * become `_`, and a leading digit/underscore gets an `A` prefix so the result
- * always starts with a letter.
+ * Bedrock AgentCore's real limits, verified against the CloudFormation
+ * registry schema for `AWS::BedrockAgentCore::{Runtime,RuntimeEndpoint,Memory}`
+ * (#882).
+ *
+ * Exported for the same reason as `MICROVM_LIMITS` (#1374, #1420): a
+ * consumer driving AgentCore through another control plane needs the same
+ * numbers, and copying them is how two sources of truth start.
+ */
+export const AGENTCORE_LIMITS = {
+  /**
+   * `Runtime`/`RuntimeEndpoint`/`Memory` `Name`/`AgentRuntimeName` fields
+   * are bound to this pattern — no hyphens, unlike chant's usual kebab-case
+   * component names. `Gateway`/`GatewayTarget`/`WorkloadIdentity` names
+   * accept hyphens, so only the Runtime family needs sanitizing.
+   */
+  runtimeNamePattern: /^[a-zA-Z][a-zA-Z0-9_]{0,47}$/,
+  maxRuntimeNameLength: 48,
+  /** `Memory` event retention bounds, in days. */
+  memoryEventExpiryDays: { min: 3, max: 365, default: 30 },
+} as const;
+
+/**
+ * Non-identifier characters become `_`, and a leading digit/underscore gets
+ * an `A` prefix so the result always starts with a letter — then truncated
+ * to {@link AGENTCORE_LIMITS}'s `maxRuntimeNameLength`.
  */
 function toRuntimeIdentifier(name: string): string {
   const cleaned = name.replace(/[^a-zA-Z0-9_]/g, "_");
   const identifier = /^[a-zA-Z]/.test(cleaned) ? cleaned : `A${cleaned}`;
-  return identifier.slice(0, 48);
+  return identifier.slice(0, AGENTCORE_LIMITS.maxRuntimeNameLength);
 }
 
 /**
@@ -117,7 +134,7 @@ export interface AgentCoreAgentProps {
    * managed one and fails on a real apply (#978, see the composite doc).
    */
   endpointName?: string;
-  /** Memory event retention, in days. CFN bounds: 3-365. Default: 30. */
+  /** Memory event retention, in days. Bounds: {@link AGENTCORE_LIMITS.memoryEventExpiryDays}. */
   memoryEventExpiryDays?: number;
   /** Gateway authorizer. Mirrors the generated `BedrockAgentCoreGateway_AuthorizerType` CFN enum. Default: "AWS_IAM". */
   gatewayAuthorizerType?: "CUSTOM_JWT" | "AWS_IAM" | "NONE" | "AUTHENTICATE_ONLY";
@@ -194,9 +211,14 @@ export const AgentCoreAgent = Composite<AgentCoreAgentProps, AgentCoreAgentResul
   if (networkMode === "VPC" && (props.vpcSubnetIds === undefined || props.vpcSecurityGroupIds === undefined)) {
     throw new Error("AgentCoreAgent requires vpcSubnetIds and vpcSecurityGroupIds when networkMode is \"VPC\"");
   }
-  const memoryEventExpiryDays = props.memoryEventExpiryDays ?? 30;
-  if (memoryEventExpiryDays < 3 || memoryEventExpiryDays > 365) {
-    throw new Error("AgentCoreAgent memoryEventExpiryDays must be between 3 and 365");
+  const memoryEventExpiryDays = props.memoryEventExpiryDays ?? AGENTCORE_LIMITS.memoryEventExpiryDays.default;
+  if (
+    memoryEventExpiryDays < AGENTCORE_LIMITS.memoryEventExpiryDays.min ||
+    memoryEventExpiryDays > AGENTCORE_LIMITS.memoryEventExpiryDays.max
+  ) {
+    throw new Error(
+      `AgentCoreAgent memoryEventExpiryDays must be between ${AGENTCORE_LIMITS.memoryEventExpiryDays.min} and ${AGENTCORE_LIMITS.memoryEventExpiryDays.max}`,
+    );
   }
 
   const runtimeName = toRuntimeIdentifier(props.name);