@intentius/chant-lexicon-aws 0.46.0 → 0.50.0

package/src/index.ts

@@ -7,6 +7,29 @@ export type { DefaultTags, TagEntry } from "./default-tags";
 export { templateTransform, isTemplateTransform, TEMPLATE_TRANSFORM_MARKER } from "./template-transform";
 export type { TemplateTransform } from "./template-transform";
 
+// Effect receipts (#1835, epic #1703): the aws materialization row
+// (`AWS::SSM::Parameter`, plain String, path derived from the ownership
+// marker) and the SSM-backed receipt store behind the `effect()` op step.
+export {
+  EffectReceipt,
+  receiptParameterName,
+  AWS_EFFECT_RECEIPT_ENTITY_TYPE,
+  EFFECT_RECEIPTS_METADATA_KEY,
+  RECEIPT_PATH_PREFIX,
+  RECEIPT_UNRESOLVED_VALUE_NOTE,
+} from "./effect-receipt-row";
+export type { AwsEffectReceiptDeclaration } from "./effect-receipt-row";
+export { awsReceiptStore, observeReceiptRows, ssmGetParameter, ssmPutParameter } from "./receipt-store";
+export type { AwsReceiptStoreOptions, ReceiptRowObservation } from "./receipt-store";
+
+// Typed Op step-builder wrappers (chant #1288 Stage 2) — awsApply/awsDelete/
+// flociUp/flociDown with authoring-time types derived from this lexicon's
+// own *Args interfaces (see ./op/builders.ts's module doc for why these live
+// here rather than in core or the temporal barrel). Opt-in:
+// `@intentius/chant-lexicon-temporal`'s same-named exports are core's
+// original untyped builders, unchanged, for cloud-agnostic authoring.
+export { awsApply, awsDelete, flociUp, flociDown } from "./op/builders";
+
 // Serializer
 export { awsSerializer } from "./serializer";
 
@@ -122,25 +145,31 @@ export {
   LambdaFunction, LambdaNode, LambdaPython, NodeLambda, PythonLambda,
   LambdaApi,
   LambdaScheduled, ScheduledLambda,
-  LambdaSqs, LambdaEventBridge, LambdaDynamoDB, LambdaS3, LambdaSns,
-  VpcDefault, FargateAlb, AlbShared, FargateService, RdsInstance, RdsPostgres,
+  LambdaSqs, LambdaEventBridge, LambdaDynamoDB, DynamoDBTable, EcrRepository, LambdaS3, LambdaSns,
+  VpcDefault, FargateAlb, AlbShared, FargateService, FARGATE_SERVICE_LIMITS, NlbService, RdsInstance, RdsPostgres,
   EfsWithAccessPoint,
-  Ec2InstanceRole, MinimalVpc, EksCluster,
+  Ec2InstanceRole, Ec2InstanceBundle, MinimalVpc, EksCluster,
   SolrFargateService,
   MicrovmApp, MICROVM_LIMITS,
-  AgentCoreAgent, agentCoreDefaultEndpointArn,
+  AgentCoreAgent, agentCoreDefaultEndpointArn, AGENTCORE_LIMITS,
   OrganizationRoot, GovernanceFoundation, RegionRestriction, OrganizationTrail,
+  StepFunctionsWorkflow,
+  MonitoringStack,
+  BucketDeployment,
 } from "./composites/index";
 export type {
   LambdaFunctionProps, LambdaApiProps, ScheduledLambdaProps,
-  LambdaSqsProps, LambdaEventBridgeProps, LambdaDynamoDBProps, LambdaS3Props, LambdaSnsProps,
-  VpcDefaultProps, FargateAlbProps, AlbSharedProps, FargateServiceProps, RdsInstanceProps, RdsPostgresProps,
+  LambdaSqsProps, LambdaEventBridgeProps, LambdaDynamoDBProps, DynamoDBTableProps, DynamoDBKey, DynamoDBCapacity, DynamoDBGlobalSecondaryIndex, EcrRepositoryProps, EcrLifecycleRule, EcrEncryption, LambdaS3Props, LambdaSnsProps,
+  VpcDefaultProps, FargateAlbProps, AlbSharedProps, FargateServiceProps, NlbServiceProps, RdsInstanceProps, RdsPostgresProps,
   EfsWithAccessPointProps,
-  Ec2InstanceRoleProps, MinimalVpcProps, EksClusterProps,
+  Ec2InstanceRoleProps, Ec2InstanceBundleProps, Ec2InstanceBundleIngressRule, MinimalVpcProps, EksClusterProps,
   SolrFargateServiceProps,
   MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps, MicrovmMemoryMiB,
   AgentCoreAgentProps, AgentCoreAgentResult,
   OrganizationRootProps, GovernanceFoundationProps, RegionRestrictionProps, OrganizationTrailProps,
+  StepFunctionsWorkflowProps,
+  MonitoringStackProps, MonitoringMetricSpec,
+  BucketDeploymentProps, BucketDeploymentResult,
 } from "./composites/index";
 
 // Code generation pipeline

package/src/lint/audit-catalog.ts

@@ -72,4 +72,20 @@ export const awsAuditCatalog: Record<string, RuleMeta> = {
   // so no authority citation (those are reserved for merge-worthy entries).
   WAW059: auditRule("WAW059", "report-only", "guidance", "Wildcard Resource where the declared graph enumerates the touched set", "Tighten Resource from \"*\" to the Fn::GetAtt Arn list of the declared resources the role's consumers touch.", { category: "security" }),
   WAW060: auditRule("WAW060", "report-only", "guidance", "IAM policy attached to no principal", "Attach the policy via Roles/Users/Groups or reference it from a principal's ManagedPolicyArns — unattached it grants nothing.", { category: "security" }),
+
+  // #1140 — error-injection benchmark family (companion to epic #1139): static
+  // catches for the deploy-time/runtime failure class stock CDK can't see pre-synth.
+  WAW061: auditRule("WAW061", "merge-worthy", "guidance", "Subnet CidrBlock not contained in its VPC's CidrBlock", "Fix the subnet's CidrBlock so it falls within the VPC's CidrBlock range.", { category: "correctness" }),
+  WAW062: auditRule("WAW062", "merge-worthy", "guidance", "Duplicate export name or explicit resource name within a template", "Give each duplicated Export/name a distinct literal value.", { category: "correctness" }),
+  WAW063: auditRule("WAW063", "merge-worthy", "guidance", "IAM policy denies an action another attached policy on the same role allows", "Remove or narrow the Deny, or move the Allow off this role — the explicit Deny always wins.", { category: "correctness" }),
+
+  // #826 — network-topology resiliency (Well-Architected Reliability Pillar):
+  // TGW route hygiene, private-subnet and NAT-gateway cross-resource joins,
+  // VPN redundancy. No live state needed — all determinable from the
+  // declared template.
+  WAW064: auditRule("WAW064", "report-only", "guidance", "Transit Gateway route table declares a Blackhole route", "Confirm the traffic drop is intentional; remove the route if it isn't.", { category: "best-practice" }),
+  WAW065: auditRule("WAW065", "report-only", "guidance", "Transit Gateway route table wiring is incomplete", "Add the missing TransitGatewayRouteTablePropagation, or wire the orphaned attachment into a route table.", { category: "best-practice" }),
+  WAW066: auditRule("WAW066", "merge-worthy", "guidance", "Private subnet's route table has no working default route", "Add a 0.0.0.0/0 route to a NAT gateway/Transit Gateway that exists in the template.", { category: "correctness" }),
+  WAW067: auditRule("WAW067", "report-only", "guidance", "Single-AZ NAT gateway serves multi-AZ private subnets", "Add one NAT gateway per Availability Zone and point each AZ's subnets at its own.", { category: "best-practice" }),
+  WAW068: auditRule("WAW068", "report-only", "guidance", "VPN Gateway or Transit Gateway has only one attached VPN Connection", "Attach a second VPNConnection (ideally to a separate Customer Gateway) for redundancy.", { category: "best-practice" }),
 };

package/src/lint/post-synth/cf-refs.ts

@@ -169,6 +169,46 @@ export function isFullTierEnv(env: string | undefined): boolean {
   return env === "prod" || env === "production" || env === "full";
 }
 
+/**
+ * Parse an IPv4 CIDR literal ("10.0.0.0/16") into its numeric base address
+ * and prefix length. Returns null for anything that isn't a plain IPv4 CIDR
+ * (IPv6, malformed octets, out-of-range prefix) — callers treat that as
+ * "can't prove statically" rather than an error.
+ */
+export function parseIpv4Cidr(cidr: string): { base: number; prefix: number } | null {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/.exec(cidr.trim());
+  if (!m) return null;
+  const octets = m.slice(1, 5).map(Number);
+  if (octets.some((o) => o < 0 || o > 255)) return null;
+  const prefix = Number(m[5]);
+  if (prefix < 0 || prefix > 32) return null;
+  const base = ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;
+  return { base, prefix };
+}
+
+/** [networkAddress, broadcastAddress] for a parsed IPv4 CIDR block. */
+function ipv4Range(cidr: { base: number; prefix: number }): [number, number] {
+  const maskBits = cidr.prefix === 0 ? 0 : (0xffffffff << (32 - cidr.prefix)) >>> 0;
+  const network = (cidr.base & maskBits) >>> 0;
+  const broadcast = (network | (~maskBits >>> 0)) >>> 0;
+  return [network, broadcast];
+}
+
+/**
+ * Whether `inner` (an IPv4 CIDR literal) falls entirely within `outer`.
+ * Returns null — not false — when either literal isn't a plain, parseable
+ * IPv4 CIDR (e.g. IPv6, or a CloudFormation intrinsic already stringified
+ * elsewhere); a null means "statically unprovable", not "violation".
+ */
+export function ipv4CidrContains(outer: string, inner: string): boolean | null {
+  const outerCidr = parseIpv4Cidr(outer);
+  const innerCidr = parseIpv4Cidr(inner);
+  if (!outerCidr || !innerCidr) return null;
+  const [oStart, oEnd] = ipv4Range(outerCidr);
+  const [iStart, iEnd] = ipv4Range(innerCidr);
+  return iStart >= oStart && iEnd <= oEnd;
+}
+
 /**
  * Check if a port range [fromPort, toPort] contains any of the sensitive ports.
  */

package/src/lint/post-synth/index.ts

@@ -52,6 +52,14 @@ import { waw057 } from "./waw057";
 import { waw058 } from "./waw058";
 import { waw059 } from "./waw059";
 import { waw060 } from "./waw060";
+import { waw061 } from "./waw061";
+import { waw062 } from "./waw062";
+import { waw063 } from "./waw063";
+import { waw064 } from "./waw064";
+import { waw065 } from "./waw065";
+import { waw066 } from "./waw066";
+import { waw067 } from "./waw067";
+import { waw068 } from "./waw068";
 
 export const postSynthChecks: PostSynthCheck[] = [
   cor020,
@@ -106,4 +114,12 @@ export const postSynthChecks: PostSynthCheck[] = [
   waw058,
   waw059,
   waw060,
+  waw061,
+  waw062,
+  waw063,
+  waw064,
+  waw065,
+  waw066,
+  waw067,
+  waw068,
 ];

package/src/lint/post-synth/waw016.test.ts

@@ -1,16 +1,26 @@
 import { describe, test, expect } from "vitest";
 import { createPostSynthContext } from "@intentius/chant-test-utils";
-import { waw016, checkDeprecatedProperties } from "./waw016";
+import { waw016, checkDeprecatedProperties, type DeprecationBasis } from "./waw016";
 
 function makeCtx(template: object) {
   return createPostSynthContext({ aws: template });
 }
 
+function basisMap(entries: Array<[string, DeprecationBasis]>): Map<string, DeprecationBasis> {
+  return new Map(entries);
+}
+
 /** Synthetic deprecated-property map — no disk dependency. */
-function fakeDeprecated(): Map<string, Set<string>> {
+function fakeDeprecated(): Map<string, Map<string, DeprecationBasis>> {
   return new Map([
-    ["AWS::S3::Bucket", new Set(["AccessControl", "ObjectLockConfiguration"])],
-    ["AWS::Lambda::Function", new Set(["Code"])],
+    [
+      "AWS::S3::Bucket",
+      basisMap([
+        ["AccessControl", "declared"],
+        ["ObjectLockConfiguration", "declared"],
+      ]),
+    ],
+    ["AWS::Lambda::Function", basisMap([["Code", "declared"]])],
   ]);
 }
 
@@ -138,4 +148,51 @@ describe("WAW016: Deprecated Property Usage", () => {
     expect(diags[0].entity).toBe("Bucket");
     expect(diags[1].entity).toBe("Func");
   });
+
+  // --- Deprecation basis (#1701) ---
+
+  test("an inferred deprecation reports at info and names its basis", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Func: {
+          Type: "AWS::Lambda::Function",
+          Properties: { Runtime: "nodejs20.x" },
+        },
+      },
+    });
+    const deprecated = new Map([
+      ["AWS::Lambda::Function", basisMap([["Runtime", "inferred"]])],
+    ]);
+    const diags = checkDeprecatedProperties(ctx, deprecated);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW016");
+    expect(diags[0].severity).toBe("info");
+    expect(diags[0].message).toContain("Runtime");
+    expect(diags[0].message).toContain("does not declare it deprecated");
+  });
+
+  test("declared and inferred deprecations on one resource keep separate severities", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyBucket: {
+          Type: "AWS::S3::Bucket",
+          Properties: { AccessControl: "Private", ObjectLockConfiguration: {} },
+        },
+      },
+    });
+    const deprecated = new Map([
+      [
+        "AWS::S3::Bucket",
+        basisMap([
+          ["AccessControl", "declared"],
+          ["ObjectLockConfiguration", "inferred"],
+        ]),
+      ],
+    ]);
+    const diags = checkDeprecatedProperties(ctx, deprecated);
+    expect(diags).toHaveLength(2);
+    const bySeverity = new Map(diags.map((d) => [d.severity, d.message]));
+    expect(bySeverity.get("warning")).toContain("AccessControl");
+    expect(bySeverity.get("info")).toContain("ObjectLockConfiguration");
+  });
 });

package/src/lint/post-synth/waw016.ts

@@ -2,7 +2,13 @@
  * WAW016: Deprecated Property Usage
  *
  * Flags properties marked as deprecated in the CloudFormation Registry.
- * Sources: explicit `deprecatedProperties` array + description text mining.
+ *
+ * Two bases feed this, and the finding says which one it stands on (#1701).
+ * A `declared` name comes from the Registry schema's own `deprecatedProperties`
+ * array. An `inferred` name comes from a regex over the property description,
+ * which also matches descriptions that mention the deprecation of a sibling
+ * property, an enum value, or the thing the property configures. Declared is a
+ * warning; inferred is reported at info and worded as a guess.
  */
 
 import { readFileSync } from "fs";
@@ -10,18 +16,23 @@ import { join } from "path";
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import { parseCFTemplate } from "./cf-refs";
 
+/** What a deprecation classification rests on. */
+export type DeprecationBasis = "declared" | "inferred";
+
 interface LexiconEntry {
   kind: string;
   resourceType: string;
   deprecatedProperties?: string[];
+  inferredDeprecations?: string[];
   [key: string]: unknown;
 }
 
 /**
- * Load deprecated properties per resource type from the lexicon JSON.
+ * Load deprecated properties per resource type from the lexicon JSON, each
+ * tagged with the basis it was classified on.
  */
-function loadDeprecatedProperties(): Map<string, Set<string>> {
-  const map = new Map<string, Set<string>>();
+function loadDeprecatedProperties(): Map<string, Map<string, DeprecationBasis>> {
+  const map = new Map<string, Map<string, DeprecationBasis>>();
   try {
     const pkgDir = join(__dirname, "..", "..", "..");
     const lexiconPath = join(pkgDir, "src", "generated", "lexicon-aws.json");
@@ -29,9 +40,15 @@ function loadDeprecatedProperties(): Map<string, Set<string>> {
     const data = JSON.parse(content) as Record<string, LexiconEntry>;
 
     for (const [_name, entry] of Object.entries(data)) {
-      if (entry.kind === "resource" && entry.resourceType && entry.deprecatedProperties && entry.deprecatedProperties.length > 0) {
-        map.set(entry.resourceType, new Set(entry.deprecatedProperties));
+      if (entry.kind !== "resource" || !entry.resourceType) continue;
+      if (!entry.deprecatedProperties?.length) continue;
+
+      const inferred = new Set(entry.inferredDeprecations ?? []);
+      const byProp = new Map<string, DeprecationBasis>();
+      for (const propName of entry.deprecatedProperties) {
+        byProp.set(propName, inferred.has(propName) ? "inferred" : "declared");
       }
+      map.set(entry.resourceType, byProp);
     }
   } catch {
     // Lexicon not available — skip
@@ -44,7 +61,7 @@ function loadDeprecatedProperties(): Map<string, Set<string>> {
  */
 export function checkDeprecatedProperties(
   ctx: PostSynthContext,
-  deprecated: Map<string, Set<string>>,
+  deprecated: Map<string, Map<string, DeprecationBasis>>,
 ): PostSynthDiagnostic[] {
   if (deprecated.size === 0) return [];
 
@@ -60,15 +77,19 @@ export function checkDeprecatedProperties(
 
       const props = resource.Properties ?? {};
       for (const propName of Object.keys(props)) {
-        if (deprProps.has(propName)) {
-          diagnostics.push({
-            checkId: "WAW016",
-            severity: "warning",
-            message: `Resource "${logicalId}" (${resource.Type}) uses deprecated property "${propName}" — consider alternatives`,
-            entity: logicalId,
-            lexicon: "aws",
-          });
-        }
+        const basis = deprProps.get(propName);
+        if (!basis) continue;
+
+        diagnostics.push({
+          checkId: "WAW016",
+          severity: basis === "declared" ? "warning" : "info",
+          message:
+            basis === "declared"
+              ? `Resource "${logicalId}" (${resource.Type}) uses deprecated property "${propName}" — consider alternatives`
+              : `Resource "${logicalId}" (${resource.Type}) uses property "${propName}", whose description reads as deprecated — the CloudFormation Registry does not declare it deprecated, so confirm before changing it`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
       }
     }
   }

package/src/lint/post-synth/waw061.test.ts

@@ -0,0 +1,99 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw061, checkSubnetCidrContainment } from "./waw061";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW061: Subnet CIDR Not Contained In VPC CIDR", () => {
+  test("check metadata", () => {
+    expect(waw061.id).toBe("WAW061");
+    expect(waw061.description).toContain("CidrBlock");
+  });
+
+  test("subnet CIDR outside the VPC's CIDR range → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyVpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+        MySubnet: {
+          Type: "AWS::EC2::Subnet",
+          Properties: { CidrBlock: "10.1.0.0/24", VpcId: { Ref: "MyVpc" } },
+        },
+      },
+    });
+    const diags = checkSubnetCidrContainment(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW061");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("MySubnet");
+    expect(diags[0].message).toContain("10.1.0.0/24");
+    expect(diags[0].message).toContain("10.0.0.0/16");
+    expect(diags[0].lexicon).toBe("aws");
+  });
+
+  test("subnet wider than its VPC → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyVpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.1.0/24" } },
+        MySubnet: {
+          Type: "AWS::EC2::Subnet",
+          Properties: { CidrBlock: "10.0.0.0/16", VpcId: { Ref: "MyVpc" } },
+        },
+      },
+    });
+    expect(checkSubnetCidrContainment(ctx)).toHaveLength(1);
+  });
+
+  test("subnet CIDR contained in the VPC's CIDR → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyVpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+        MySubnet: {
+          Type: "AWS::EC2::Subnet",
+          Properties: { CidrBlock: "10.0.1.0/24", VpcId: { Ref: "MyVpc" } },
+        },
+      },
+    });
+    expect(checkSubnetCidrContainment(ctx)).toHaveLength(0);
+  });
+
+  test("intrinsic CidrBlock → no diagnostic (unprovable)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyVpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+        MySubnet: {
+          Type: "AWS::EC2::Subnet",
+          Properties: {
+            CidrBlock: { "Fn::Select": [0, { "Fn::Cidr": [{ "Fn::GetAtt": ["MyVpc", "CidrBlock"] }, 4, 8] }] },
+            VpcId: { Ref: "MyVpc" },
+          },
+        },
+      },
+    });
+    expect(checkSubnetCidrContainment(ctx)).toHaveLength(0);
+  });
+
+  test("VpcId not resolvable to a declared VPC (imported) → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MySubnet: {
+          Type: "AWS::EC2::Subnet",
+          Properties: { CidrBlock: "10.1.0.0/24", VpcId: { "Fn::ImportValue": "shared-vpc-id" } },
+        },
+      },
+    });
+    expect(checkSubnetCidrContainment(ctx)).toHaveLength(0);
+  });
+
+  test("multiple subnets in a VPC, all contained → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyVpc: { Type: "AWS::EC2::VPC", Properties: { CidrBlock: "10.0.0.0/16" } },
+        SubnetA: { Type: "AWS::EC2::Subnet", Properties: { CidrBlock: "10.0.0.0/24", VpcId: { Ref: "MyVpc" } } },
+        SubnetB: { Type: "AWS::EC2::Subnet", Properties: { CidrBlock: "10.0.1.0/24", VpcId: { Ref: "MyVpc" } } },
+      },
+    });
+    expect(checkSubnetCidrContainment(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/waw061.ts

@@ -0,0 +1,67 @@
+/**
+ * WAW061: Subnet CIDR Not Contained In VPC CIDR
+ *
+ * A subnet's CidrBlock must fall entirely inside its VPC's CidrBlock.
+ * Stock CDK does not check this — CloudFormation accepts the template and
+ * only fails the `AWS::EC2::Subnet` resource at deploy time
+ * ("The CIDR ... is invalid" / "does not fall within the CIDR range of the
+ * VPC"), after the rest of the stack may have already started rolling out.
+ * This is a cheap static graph check: follow the subnet's VpcId Ref to a
+ * declared VPC in the same template and do IPv4 CIDR-range math.
+ *
+ * Stays quiet whenever the graph can't prove it: intrinsic CIDR blocks,
+ * IPv6, a VpcId that isn't a simple Ref to a declared AWS::EC2::VPC, or a
+ * VPC whose own CidrBlock isn't a literal string.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, ipv4CidrContains } from "./cf-refs";
+
+export function checkSubnetCidrContainment(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      if (resource.Type !== "AWS::EC2::Subnet") continue;
+
+      const props = resource.Properties ?? {};
+      const subnetCidr = props.CidrBlock;
+      if (typeof subnetCidr !== "string") continue;
+
+      const vpcRefs = findResourceRefs(props.VpcId);
+      if (vpcRefs.size !== 1) continue;
+      const [vpcId] = vpcRefs;
+
+      const vpc = template.Resources[vpcId];
+      if (!vpc || vpc.Type !== "AWS::EC2::VPC") continue;
+
+      const vpcCidr = vpc.Properties?.CidrBlock;
+      if (typeof vpcCidr !== "string") continue;
+
+      const contained = ipv4CidrContains(vpcCidr, subnetCidr);
+      if (contained === false) {
+        diagnostics.push({
+          checkId: "WAW061",
+          severity: "error",
+          message: `Subnet "${logicalId}" CidrBlock ${subnetCidr} is not contained within VPC "${vpcId}"'s CidrBlock ${vpcCidr} — CloudFormation rejects this at deploy time`,
+          entity: logicalId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw061: PostSynthCheck = {
+  id: "WAW061",
+  description: "Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkSubnetCidrContainment(ctx);
+  },
+};

package/src/lint/post-synth/waw062.test.ts

@@ -0,0 +1,109 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw062, checkDuplicateNamesAndExports } from "./waw062";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW062: Duplicate Name Or Export Within A Template", () => {
+  test("check metadata", () => {
+    expect(waw062.id).toBe("WAW062");
+    expect(waw062.description.toLowerCase()).toContain("duplicate");
+  });
+
+  test("duplicate Export Name → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        MyBucket: { Type: "AWS::S3::Bucket", Properties: {} },
+      },
+      Outputs: {
+        BucketArnA: { Value: { "Fn::GetAtt": ["MyBucket", "Arn"] }, Export: { Name: "shared-bucket-arn" } },
+        BucketArnB: { Value: { "Fn::GetAtt": ["MyBucket", "Arn"] }, Export: { Name: "shared-bucket-arn" } },
+      },
+    });
+    const diags = checkDuplicateNamesAndExports(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW062");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain("shared-bucket-arn");
+    expect(diags[0].message).toContain("BucketArnA");
+    expect(diags[0].message).toContain("BucketArnB");
+    expect(diags[0].lexicon).toBe("aws");
+  });
+
+  test("unique Export Names → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {},
+      Outputs: {
+        A: { Value: "a", Export: { Name: "export-a" } },
+        B: { Value: "b", Export: { Name: "export-b" } },
+      },
+    });
+    expect(checkDuplicateNamesAndExports(ctx)).toHaveLength(0);
+  });
+
+  test("duplicate ECR RepositoryName across two composites → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        RepoOne: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: "svc-images" } },
+        RepoTwo: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: "svc-images" } },
+      },
+    });
+    const diags = checkDuplicateNamesAndExports(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("svc-images");
+    expect(diags[0].message).toContain("RepoOne");
+    expect(diags[0].message).toContain("RepoTwo");
+  });
+
+  test("duplicate LaunchTemplateName → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        LtA: { Type: "AWS::EC2::LaunchTemplate", Properties: { LaunchTemplateName: "worker-lt" } },
+        LtB: { Type: "AWS::EC2::LaunchTemplate", Properties: { LaunchTemplateName: "worker-lt" } },
+      },
+    });
+    expect(checkDuplicateNamesAndExports(ctx)).toHaveLength(1);
+  });
+
+  test("duplicate SecurityGroup GroupName → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        SgA: { Type: "AWS::EC2::SecurityGroup", Properties: { GroupName: "web-sg", GroupDescription: "a" } },
+        SgB: { Type: "AWS::EC2::SecurityGroup", Properties: { GroupName: "web-sg", GroupDescription: "b" } },
+      },
+    });
+    expect(checkDuplicateNamesAndExports(ctx)).toHaveLength(1);
+  });
+
+  test("same literal name across different resource types → no diagnostic (not comparable)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        RepoOne: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: "shared" } },
+        TableOne: { Type: "AWS::DynamoDB::Table", Properties: { TableName: "shared" } },
+      },
+    });
+    expect(checkDuplicateNamesAndExports(ctx)).toHaveLength(0);
+  });
+
+  test("intrinsic explicit names → no diagnostic (unprovable)", () => {
+    const ctx = makeCtx({
+      Resources: {
+        RepoOne: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: { "Fn::Sub": "svc-${AWS::StackName}" } } },
+        RepoTwo: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: { "Fn::Sub": "svc-${AWS::StackName}" } } },
+      },
+    });
+    expect(checkDuplicateNamesAndExports(ctx)).toHaveLength(0);
+  });
+
+  test("distinct explicit names → no diagnostic", () => {
+    const ctx = makeCtx({
+      Resources: {
+        RepoOne: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: "svc-images-a" } },
+        RepoTwo: { Type: "AWS::ECR::Repository", Properties: { RepositoryName: "svc-images-b" } },
+      },
+    });
+    expect(checkDuplicateNamesAndExports(ctx)).toHaveLength(0);
+  });
+});