@intentius/chant-lexicon-aws 0.46.0 → 0.50.0

package/dist/composites/nlb-service.d.ts

@@ -0,0 +1,48 @@
+import { LoadBalancer, TargetGroup, Listener } from "../generated/index.js";
+export interface NlbServiceProps {
+    vpcId: string;
+    subnetIds: string[];
+    listenerPort?: number;
+    /** Port the target group forwards traffic to. Defaults to `listenerPort`. */
+    targetPort?: number;
+    /**
+     * Listener + target group protocol. `TLS` terminates TLS at the NLB and
+     * requires `certificateArn`; the other protocols pass traffic through
+     * unmodified, which is the common case for a Network Load Balancer.
+     */
+    protocol?: "TCP" | "UDP" | "TLS" | "TCP_UDP";
+    scheme?: "internet-facing" | "internal";
+    /**
+     * Target group target type. `ip` (the default) covers Fargate awsvpc tasks
+     * and any routable IP; use `instance` to register EC2 instance IDs directly,
+     * or `alb` to chain an NLB in front of an existing Application Load Balancer.
+     */
+    targetType?: "instance" | "ip" | "alb";
+    /**
+     * Static targets to register at creation time (instance IDs, IPs, or an ALB
+     * ARN depending on `targetType`). Omit when targets self-register instead —
+     * an ECS service, for instance, that references `targetGroup.TargetGroupArn`.
+     */
+    targets?: Array<{
+        id: string;
+        port?: number;
+        availabilityZone?: string;
+    }>;
+    /** ACM certificate ARN. Required when `protocol` is `TLS`. */
+    certificateArn?: string;
+    healthCheckProtocol?: "TCP" | "HTTP" | "HTTPS";
+    healthCheckPort?: string;
+    /** Only meaningful when `healthCheckProtocol` is `HTTP` or `HTTPS`. */
+    healthCheckPath?: string;
+    defaults?: {
+        nlb?: Partial<ConstructorParameters<typeof LoadBalancer>[0]>;
+        targetGroup?: Partial<ConstructorParameters<typeof TargetGroup>[0]>;
+        listener?: Partial<ConstructorParameters<typeof Listener>[0]>;
+    };
+}
+export declare const NlbService: import("@intentius/chant").CompositeDefinition<NlbServiceProps, {
+    nlb: import("@intentius/chant").Declarable & Record<string, string>;
+    targetGroup: import("@intentius/chant").Declarable & Record<string, string>;
+    listener: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+//# sourceMappingURL=nlb-service.d.ts.map

package/dist/composites/nlb-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nlb-service.d.ts","sourceRoot":"","sources":["../../src/composites/nlb-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,YAAY,EACZ,WAAW,EAEX,QAAQ,EAGT,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;IAC7C,MAAM,CAAC,EAAE,iBAAiB,GAAG,UAAU,CAAC;IACxC;;;;OAIG;IACH,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC;IACvC;;;;OAIG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1E,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,WAAW,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC/D,CAAC;CACH;AAED,eAAO,MAAM,UAAU;;;;EAoEP,CAAC"}

package/dist/composites/step-functions-workflow.d.ts

@@ -0,0 +1,36 @@
+import { type Value } from "@intentius/chant";
+import { Role, Role_Policy, LogGroup, StateMachine } from "../generated/index.js";
+export interface StepFunctionsWorkflowProps {
+    /** `Value<string>`: a name is routinely built with `Sub`/`Ref` (#1366). */
+    name?: Value<string>;
+    /**
+     * ASL state machine definition, authored as a plain object. Passed to
+     * CloudFormation's `Definition` property rather than `DefinitionString`:
+     * CFN accepts the definition as a native JSON value (verified against
+     * Floci — both forms round-trip), so a task's `Resource` can carry a
+     * `Ref`/`Fn::GetAtt` intrinsic — e.g. `Resource: someFunc.Arn` — directly,
+     * with no `Fn::Sub` string templating needed to splice ARNs into a JSON
+     * string. Same `Value<T>`-over-string-building bias as #1366, one level up.
+     */
+    definition: Record<string, unknown>;
+    /** ARNs of the Lambda functions this workflow's tasks invoke; grants `lambda:InvokeFunction` on each. */
+    lambdaFunctionArns?: Value<string>[];
+    stateMachineType?: "STANDARD" | "EXPRESS";
+    /** CloudWatch Logs retention for the auto-created log group. Default 14. */
+    logRetentionDays?: number;
+    /** `LoggingConfiguration` level. Default `"ALL"` — set `"OFF"` to skip execution logging. */
+    loggingLevel?: "ALL" | "ERROR" | "FATAL" | "OFF";
+    ManagedPolicyArns?: string[];
+    Policies?: InstanceType<typeof Role_Policy>[];
+    defaults?: {
+        role?: Partial<ConstructorParameters<typeof Role>[0]>;
+        logGroup?: Partial<ConstructorParameters<typeof LogGroup>[0]>;
+        stateMachine?: Partial<ConstructorParameters<typeof StateMachine>[0]>;
+    };
+}
+export declare const StepFunctionsWorkflow: import("@intentius/chant").CompositeDefinition<StepFunctionsWorkflowProps, {
+    role: import("@intentius/chant").Declarable & Record<string, string>;
+    logGroup: import("@intentius/chant").Declarable & Record<string, string>;
+    stateMachine: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+//# sourceMappingURL=step-functions-workflow.d.ts.map

package/dist/composites/step-functions-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-functions-workflow.d.ts","sourceRoot":"","sources":["../../src/composites/step-functions-workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,YAAY,EAIb,MAAM,cAAc,CAAC;AAuCtB,MAAM,WAAW,0BAA0B;IACzC,2EAA2E;IAC3E,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB;;;;;;;;OAQG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,yGAAyG;IACzG,kBAAkB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACrC,gBAAgB,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC1C,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,YAAY,CAAC,EAAE,KAAK,GAAG,OAAO,GAAG,OAAO,GAAG,KAAK,CAAC;IACjD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC;IAC9C,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,YAAY,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACvE,CAAC;CACH;AAED,eAAO,MAAM,qBAAqB;;;;EAiDP,CAAC"}

package/dist/deep-observe.d.ts

@@ -74,6 +74,51 @@ export declare const DEEP_SOURCES: Record<string, DeepSource>;
  * cannot drift apart — the shape of bug #1280 is about.
  */
 export declare const DEEP_READABLE_TYPES: ReadonlySet<string>;
+/**
+ * A child type this reader enumerates under one declared parent (#1015's
+ * out-of-band case) — the console-added SNS subscription or inline role
+ * policy that no property diff can see, because it is not a property of
+ * anything declared: it is a whole resource CloudFormation never made.
+ *
+ * Cloud Control's `ListResources` takes the parent as a `ResourceModel`
+ * scope, which is what `model` builds from the physical id the stack read
+ * already resolved. Every listed child is then sorted into declared (it is
+ * some stack resource's physical id, or some declared entity's spelled
+ * identity) or out-of-band; the out-of-band ones ride into the observation
+ * as live resources nobody declared, which the deep diff reports as
+ * undeclared entities.
+ */
+export interface DeepChildSource {
+    /** The child's CloudFormation type — what `ListResources` is asked for. */
+    childType: string;
+    /** The `ResourceModel` scoping the listing to one parent. */
+    model: (parentPhysicalId: string) => Record<string, unknown>;
+    /**
+     * Legacy declared forms of the same live child. `AWS::IAM::Policy` attached
+     * to a role creates the same inline policy `AWS::IAM::RolePolicy` lists, but
+     * under its own physical id — the policy name, which is the second part of
+     * the RolePolicy identifier. Without this leg every legacy inline policy
+     * reads as out-of-band on a stack that declared it.
+     */
+    declaredVia?: Array<{
+        type: string;
+        /** The part of the child identifier that carries that type's physical id. */
+        part: (identifier: string) => string | undefined;
+    }>;
+}
+/**
+ * Parent type → the child types worth listing under it. Scoped like
+ * {@link DEEP_SOURCES}: the high-signal cases first — the issue's own
+ * examples — and widened per type, not by wildcard. A child type Cloud
+ * Control cannot list parent-scoped does not belong here.
+ */
+export declare const DEEP_CHILD_SOURCES: Record<string, readonly DeepChildSource[]>;
+/**
+ * The name an out-of-band child reports under. There is no chant entity name
+ * to use — nobody declared it — so the name has to carry the finding on its
+ * own: what kind of thing, and which one.
+ */
+export declare function outOfBandChildName(childType: string, identifier: string): string;
 /**
  * `describe-security-groups` -> the `AWS::EC2::SecurityGroup` resource model.
  *

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAQ3B;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,GAAG,EAAE,eAAe,CAAA;CAAE,GACxB;IACE,GAAG,EAAE,KAAK,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpE,CAAC;AAEN,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAenD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AAE3F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAkBlD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsBxE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAEnE,CAAC;AAWF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAU9E;AA6BD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAmEvC,CAAC;AAMF,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAmED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAI/E;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;kDAG8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAoIhC"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAML,KAAK,WAAW,EAEjB,MAAM,mBAAmB,CAAC;AAe3B;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,GAAG,EAAE,eAAe,CAAA;CAAE,GACxB;IACE,GAAG,EAAE,KAAK,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpE,CAAC;AAEN,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAkBnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAsC,CAAC;AAE3F;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,KAAK,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,6EAA6E;QAC7E,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;KAClD,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAkBzE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe1F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAkBlD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBxE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAGnE,CAAC;AAWF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAU9E;AA6BD;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBA+EvC,CAAC;AAMF,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAmED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAI/E;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;kDAG8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAoKhC"}

package/dist/deep-topology.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Deep-read sources for the EC2 topology types (#1269).
+ *
+ * chant's distinguishing answers are folds over topology: `internetFacing`
+ * resolves subnet -> route table -> internet gateway, `effectiveIngress`
+ * resolves rules across attached security groups, and the default-VPC
+ * classification (`defaults.ts`) reads the provider's own markers. The inputs
+ * to all of them are the types this file covers — with only the original four
+ * kinds readable, a deep snapshot of an EC2 estate carried almost no
+ * properties, and a snapshot-backed query could answer identity questions but
+ * not a single fold question.
+ *
+ * Two sources, chosen per type:
+ *
+ * - The container types (VPC, subnet, route table, internet gateway) read
+ *   through the EC2 describes. The fold facts live there and nowhere else:
+ *   `IsDefault`, `DefaultForAz` and a subnet's live `MapPublicIpOnLaunch` are
+ *   not part of the CloudFormation resource model, so Cloud Control cannot
+ *   report them. The describes are also bulk (one call per type for the whole
+ *   stack) and are implemented by the emulators that do not serve Cloud
+ *   Control's `GetResource`.
+ *
+ * - The join types (route, association, gateway attachment) and the two whose
+ *   describes do not fit a flat bulk join (instance rows nest inside
+ *   reservations; launch-template data lives in a separate versions call) read
+ *   through Cloud Control, which returns their model in the declared side's
+ *   own shape.
+ *
+ * Each type carries its normalization entries alongside (#1269's note: adding
+ * a type without them trades a hole for a false positive, which is worse).
+ * They are merged into the tables in `deep-observe.ts`.
+ */
+import type { DeepSource } from "./deep-observe.js";
+/**
+ * `describe-vpcs` -> the `AWS::EC2::VPC` resource model, plus `IsDefault`.
+ *
+ * `IsDefault` is the provider's own marker for the VPC nobody wrote — the fact
+ * the default classification reads — and it exists only on this surface.
+ * Carried even though the model does not name it; the diff subtracts it as a
+ * service default (`false`, gated on source silence) so a CloudFormation-made
+ * VPC does not report it as undeclared drift.
+ */
+export declare function vpcToModel(row: Record<string, unknown>): Record<string, unknown>;
+/**
+ * `describe-subnets` -> the `AWS::EC2::Subnet` resource model, plus
+ * `DefaultForAz`.
+ *
+ * `MapPublicIpOnLaunch` is half of `internetFacing`; `DefaultForAz` is the
+ * provider's default-subnet marker, off the model for the same reason as a
+ * VPC's `IsDefault` and handled the same way.
+ */
+export declare function subnetToModel(row: Record<string, unknown>): Record<string, unknown>;
+/**
+ * `describe-route-tables` -> the `AWS::EC2::RouteTable` resource model.
+ *
+ * The row also carries `Routes` and `Associations`, and this mapping drops
+ * them on purpose: a template declares each route as its own
+ * `AWS::EC2::Route` and each association as its own
+ * `AWS::EC2::SubnetRouteTableAssociation`, both covered below, so carrying
+ * them here would report every declared route twice — once as an undeclared
+ * array on the table and once through its own resource.
+ */
+export declare function routeTableToModel(row: Record<string, unknown>): Record<string, unknown>;
+/** `describe-internet-gateways` -> the `AWS::EC2::InternetGateway` model, which is tags and nothing else. */
+export declare function internetGatewayToModel(row: Record<string, unknown>): Record<string, unknown>;
+/**
+ * The topology types' entries for `DEEP_SOURCES`.
+ *
+ * The routing-chain joins are addressed by their physical id — for a
+ * registry-backed type CloudFormation's physical id *is* the Cloud Control
+ * identifier (`rtb-…|0.0.0.0/0` for a route) — so Cloud Control's
+ * one-get-per-resource shape fits them exactly and returns the declared
+ * model's own field names.
+ */
+export declare const EC2_TOPOLOGY_SOURCES: Record<string, DeepSource>;
+/**
+ * Service defaults for the topology types, merged into
+ * `AWS_SERVICE_DEFAULTS`. Subtracted on the live side only where source never
+ * declared the property — which is how the fold facts (`IsDefault`,
+ * `DefaultForAz`, a live `MapPublicIpOnLaunch`) stay in the snapshot for a
+ * query to read while never surfacing as drift on a resource CloudFormation
+ * itself created.
+ */
+export declare const EC2_TOPOLOGY_SERVICE_DEFAULTS: Record<string, Record<string, unknown>>;
+/**
+ * Values the service picks when the template does not supply one, merged into
+ * `AWS_GENERATED_NAMES`. A subnet that names no availability zone gets one
+ * assigned — a different one is real placement drift only when the template
+ * had an opinion, which is exactly the counterpart gate.
+ */
+export declare const EC2_TOPOLOGY_GENERATED_NAMES: Record<string, ReadonlySet<string>>;
+/**
+ * Declared properties a type's source cannot see (#1269).
+ *
+ * `describe-vpcs` does not return the DNS attributes — they live behind
+ * `describe-vpc-attribute` — and neither describe returns the IPAM inputs,
+ * which are consumed at creation. A declared value for one of these has
+ * nothing live to stand against, so the diff would report `value -> <absent>`
+ * on every clean apply: a blind spot rendered as drift. Pruned on the
+ * declared side, and only where the live tree is silent, so a source that
+ * does report the field (Cloud Control, some day) is still compared.
+ */
+export declare const AWS_DEEP_BLIND_SPOTS: Record<string, ReadonlySet<string>>;
+//# sourceMappingURL=deep-topology.d.ts.map

package/dist/deep-topology.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-topology.d.ts","sourceRoot":"","sources":["../src/deep-topology.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAShF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMvF;AAED,6GAA6G;AAC7G,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAK5F;AAYD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CA2C3D,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmBjF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAG5E,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAcpE,CAAC"}

package/dist/effect-receipt-row.d.ts

@@ -0,0 +1,92 @@
+/**
+ * The aws effect-receipt materialization row (#1835, epic #1703): an effect
+ * receipt stored as an `AWS::SSM::Parameter`, plain `String`, at
+ * `/chant-receipts/<stack>/<env>/<effect>`.
+ *
+ * Core's `EffectReceipt` factory (#1831) declares a receipt under the `chant`
+ * pseudo-lexicon, which no serializer claims — the designed shape until a
+ * lexicon materializes it. This module is that materialization for aws: the
+ * {@link EffectReceipt} factory here produces the same declaration shape but
+ * under `lexicon: "aws"`, so the build partitions it to the aws serializer,
+ * #1832's write-exclusion seam withholds it from the apply-bound entity set,
+ * and the serializer renders it for visibility through
+ * `SerializeContext.receipts` (see ./serializer.ts).
+ *
+ * Path identity (epic decision 4): the parameter name derives from the SAME
+ * ownership-block fields that stamp markers — `ownership.stack` and an
+ * explicit `ownership.env` — plus the receipt's `effect`. One derivation,
+ * {@link receiptParameterName}, shared by the serializer (the rendered row),
+ * the receipt store (../receipt-store.ts — what `receiptRead`/`receiptWrite`
+ * actually touch), and the observation leg (plan's live read). No env, no
+ * path: the callers error rather than guessing a segment.
+ *
+ * Plain store (epic decision 7, #1833's COR023): the parameter type is pinned
+ * to `String` at the source — the factory does not take a type, and the
+ * declared `props.Type` is the literal `"String"`. A receipt value is a
+ * witness (an existence marker or a `sha256:` digest), never a secret; a
+ * `SecureString` invites masking and rotation semantics that defeat the
+ * observe-and-compare loop, and the lint guard fails it.
+ */
+import { type Declarable } from "@intentius/chant/declarable";
+import { EFFECT_RECEIPT_MARKER, type EffectReceiptFlavor, type EffectReceiptOptions } from "@intentius/chant/effect-receipt";
+/** The entityType of the aws materialization row — the real resource kind the
+ * receipt is stored as, which is what lint's plain-store guard checks. */
+export declare const AWS_EFFECT_RECEIPT_ENTITY_TYPE = "AWS::SSM::Parameter";
+/** Template-level `Metadata` key the serializer renders receipt rows under.
+ * Beside `chant:ownership` (./ownership.ts) and like it deliberately outside
+ * `Resources` — the applier writes from `Resources`, and a receipt must never
+ * enter the apply-bound document (#1832; the `effect()` step is the sole
+ * writer, epic decision 3). */
+export declare const EFFECT_RECEIPTS_METADATA_KEY = "chant:effect-receipts";
+/** Every receipt parameter lives under this prefix, so read-only IAM can be
+ * scoped to `arn:…:parameter/chant-receipts/*` and nothing else. */
+export declare const RECEIPT_PATH_PREFIX = "/chant-receipts";
+/**
+ * The rendered `Value` of a hash-flavor receipt that still carries reference
+ * inputs at synthesis. References resolve at plan and at run, never at
+ * synthesis (epic decision 5) — so the row carries this note instead of a
+ * digest hashed over placeholders.
+ */
+export declare const RECEIPT_UNRESOLVED_VALUE_NOTE = "unresolved at synthesis \u2014 reference inputs; the expectation resolves at plan and at run (chant #1703, decision 5)";
+/**
+ * The SSM parameter name of one effect's receipt:
+ * `/chant-receipts/<stack>/<env>/<effect>`, from the resolved ownership
+ * marker fields (epic decision 4). The single source of the path identity —
+ * the serializer's rendered row, the receipt store's reads and writes, and
+ * the observation leg all call this.
+ */
+export declare function receiptParameterName(stack: string, env: string, effect: string): string;
+/**
+ * An aws-materialized effect receipt: core's declaration shape (so
+ * `isEffectReceipt`, `effect(...)`, lint, and the plan engine all recognize it
+ * through the marker), under the aws lexicon and the real resource kind, with
+ * the store variant pinned plain.
+ */
+export interface AwsEffectReceiptDeclaration extends Declarable {
+    readonly [EFFECT_RECEIPT_MARKER]: true;
+    readonly lexicon: "aws";
+    readonly entityType: typeof AWS_EFFECT_RECEIPT_ENTITY_TYPE;
+    /** The receipt's own name (the export-level identity of the witness). */
+    readonly name: string;
+    /** The effect this receipt witnesses — the path's final segment. */
+    readonly effect: string;
+    /** How the receipt is compared: mere presence, or a digest of the inputs. */
+    readonly flavor: EffectReceiptFlavor;
+    /** The effect's inputs as recorded at synthesis (references as placeholders). */
+    readonly inputs: Readonly<Record<string, unknown>>;
+    /** The declared parameter variant — pinned `String` at the source, which is
+     * the concrete half of #1833's plain-store guard. */
+    readonly props: {
+        readonly Type: "String";
+    };
+}
+/**
+ * Declare an aws-materialized effect receipt. Same signature and semantics as
+ * core's `EffectReceipt` (#1831) — the options are validated and frozen by the
+ * core factory — but the declaration lands in the aws partition, so the aws
+ * serializer renders the `AWS::SSM::Parameter` row and the receipt store
+ * (../receipt-store.ts) is its writer. Pass the returned const straight to the
+ * `effect(...)` op step.
+ */
+export declare function EffectReceipt(name: string, options: EffectReceiptOptions): AwsEffectReceiptDeclaration;
+//# sourceMappingURL=effect-receipt-row.d.ts.map

package/dist/effect-receipt-row.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effect-receipt-row.d.ts","sourceRoot":"","sources":["../src/effect-receipt-row.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAEL,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC;0EAC0E;AAC1E,eAAO,MAAM,8BAA8B,wBAAwB,CAAC;AAEpE;;;;+BAI+B;AAC/B,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAEpE;oEACoE;AACpE,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,2HAC2E,CAAC;AAkBtH;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvF;AAED;;;;;GAKG;AACH,MAAM,WAAW,2BAA4B,SAAQ,UAAU;IAC7D,QAAQ,CAAC,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,OAAO,8BAA8B,CAAC;IAC3D,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD;yDACqD;IACrD,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,2BAA2B,CA0BtG"}

package/dist/index.d.ts

@@ -3,6 +3,11 @@ export { defaultTags, isDefaultTags, DEFAULT_TAGS_MARKER } from "./default-tags.
 export type { DefaultTags, TagEntry } from "./default-tags.js";
 export { templateTransform, isTemplateTransform, TEMPLATE_TRANSFORM_MARKER } from "./template-transform.js";
 export type { TemplateTransform } from "./template-transform.js";
+export { EffectReceipt, receiptParameterName, AWS_EFFECT_RECEIPT_ENTITY_TYPE, EFFECT_RECEIPTS_METADATA_KEY, RECEIPT_PATH_PREFIX, RECEIPT_UNRESOLVED_VALUE_NOTE, } from "./effect-receipt-row.js";
+export type { AwsEffectReceiptDeclaration } from "./effect-receipt-row.js";
+export { awsReceiptStore, observeReceiptRows, ssmGetParameter, ssmPutParameter } from "./receipt-store.js";
+export type { AwsReceiptStoreOptions, ReceiptRowObservation } from "./receipt-store.js";
+export { awsApply, awsDelete, flociUp, flociDown } from "./op/builders.js";
 export { awsSerializer } from "./serializer.js";
 export { nestedStack, isNestedStackInstance, NestedStackOutputRef, isNestedStackOutputRef, NESTED_STACK_MARKER } from "./nested-stack.js";
 export type { NestedStackOptions, NestedStackInstance } from "./nested-stack.js";
@@ -24,8 +29,8 @@ export type { CFNSchema, SchemaProperty, SchemaDefinition } from "./spec/fetch.j
 export { parseCFNSchema, cfnShortName, cfnServiceName } from "./spec/parse.js";
 export type { SchemaParseResult, ParsedResource, ParsedProperty, ParsedAttribute, ParsedPropertyType, ParsedEnum, PropertyConstraints } from "./spec/parse.js";
 export { S3Actions, LambdaActions, DynamoDBActions, SQSActions, SNSActions, IAMActions, ECRActions, LogsActions, ECSActions } from "./actions/index.js";
-export { LambdaFunction, LambdaNode, LambdaPython, NodeLambda, PythonLambda, LambdaApi, LambdaScheduled, ScheduledLambda, LambdaSqs, LambdaEventBridge, LambdaDynamoDB, LambdaS3, LambdaSns, VpcDefault, FargateAlb, AlbShared, FargateService, RdsInstance, RdsPostgres, EfsWithAccessPoint, Ec2InstanceRole, MinimalVpc, EksCluster, SolrFargateService, MicrovmApp, MICROVM_LIMITS, AgentCoreAgent, agentCoreDefaultEndpointArn, OrganizationRoot, GovernanceFoundation, RegionRestriction, OrganizationTrail, } from "./composites/index.js";
-export type { LambdaFunctionProps, LambdaApiProps, ScheduledLambdaProps, LambdaSqsProps, LambdaEventBridgeProps, LambdaDynamoDBProps, LambdaS3Props, LambdaSnsProps, VpcDefaultProps, FargateAlbProps, AlbSharedProps, FargateServiceProps, RdsInstanceProps, RdsPostgresProps, EfsWithAccessPointProps, Ec2InstanceRoleProps, MinimalVpcProps, EksClusterProps, SolrFargateServiceProps, MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps, MicrovmMemoryMiB, AgentCoreAgentProps, AgentCoreAgentResult, OrganizationRootProps, GovernanceFoundationProps, RegionRestrictionProps, OrganizationTrailProps, } from "./composites/index.js";
+export { LambdaFunction, LambdaNode, LambdaPython, NodeLambda, PythonLambda, LambdaApi, LambdaScheduled, ScheduledLambda, LambdaSqs, LambdaEventBridge, LambdaDynamoDB, DynamoDBTable, EcrRepository, LambdaS3, LambdaSns, VpcDefault, FargateAlb, AlbShared, FargateService, FARGATE_SERVICE_LIMITS, NlbService, RdsInstance, RdsPostgres, EfsWithAccessPoint, Ec2InstanceRole, Ec2InstanceBundle, MinimalVpc, EksCluster, SolrFargateService, MicrovmApp, MICROVM_LIMITS, AgentCoreAgent, agentCoreDefaultEndpointArn, AGENTCORE_LIMITS, OrganizationRoot, GovernanceFoundation, RegionRestriction, OrganizationTrail, StepFunctionsWorkflow, MonitoringStack, BucketDeployment, } from "./composites/index.js";
+export type { LambdaFunctionProps, LambdaApiProps, ScheduledLambdaProps, LambdaSqsProps, LambdaEventBridgeProps, LambdaDynamoDBProps, DynamoDBTableProps, DynamoDBKey, DynamoDBCapacity, DynamoDBGlobalSecondaryIndex, EcrRepositoryProps, EcrLifecycleRule, EcrEncryption, LambdaS3Props, LambdaSnsProps, VpcDefaultProps, FargateAlbProps, AlbSharedProps, FargateServiceProps, NlbServiceProps, RdsInstanceProps, RdsPostgresProps, EfsWithAccessPointProps, Ec2InstanceRoleProps, Ec2InstanceBundleProps, Ec2InstanceBundleIngressRule, MinimalVpcProps, EksClusterProps, SolrFargateServiceProps, MicrovmAppProps, MicrovmAppResult, MicrovmAppBuildConnectorProps, MicrovmMemoryMiB, AgentCoreAgentProps, AgentCoreAgentResult, OrganizationRootProps, GovernanceFoundationProps, RegionRestrictionProps, OrganizationTrailProps, StepFunctionsWorkflowProps, MonitoringStackProps, MonitoringMetricSpec, BucketDeploymentProps, BucketDeploymentResult, } from "./composites/index.js";
 export { generate, writeGeneratedFiles } from "./codegen/generate.js";
 export { packageLexicon } from "./codegen/package.js";
 export type { PackageOptions, PackageResult } from "./codegen/package.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EACjE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAC3E,kBAAkB,EAClB,eAAe,EAAE,UAAU,EAAE,UAAU,EACvC,kBAAkB,EAClB,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,2BAA2B,EAC3C,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAC1F,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EACzG,uBAAuB,EACvB,oBAAoB,EAAE,eAAe,EAAE,eAAe,EACtD,uBAAuB,EACvB,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAClF,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,GACjG,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChI,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAK9D,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,8BAA8B,EAC9B,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxG,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAQrF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGxE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAC/F,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAC/G,kBAAkB,EAClB,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAC1D,kBAAkB,EAClB,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,2BAA2B,EAAE,gBAAgB,EAC7D,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5E,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAChO,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAC1H,uBAAuB,EACvB,oBAAoB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,eAAe,EAAE,eAAe,EAC5G,uBAAuB,EACvB,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAClF,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,EAChG,0BAA0B,EAC1B,oBAAoB,EAAE,oBAAoB,EAC1C,qBAAqB,EAAE,sBAAsB,GAC9C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChI,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC"}

package/dist/integrity.json

@@ -1,13 +1,13 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "df6e137cd4b191fed64b7a1f64d9478f0ff8c0a997dcee3a52ee3156e94d8911",
-    "meta.json": "2e4cae67cbc2eb2962c3dd0aa57008ae96fb725dd0118af7b04b2b44eab7722a",
+    "manifest.json": "4ed3c883e89ff20517d344e836a3fdd6c35e52e8ea0276cb02c3157710823bba",
+    "meta.json": "e7c751a09a871dc5a16e9aeea0b0a149513a7a2a051c923e9a5acf193dc2aef8",
     "types/index.d.ts": "6d6b37bd14a9b40fb3ff5c66e1cb49be1ae1032de47a4e167cf5f411c943b7f5",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
     "rules/iam-wildcard.ts": "135d7217d278fef50939e605c5da32603ba35674b8c4b5c4d66a06c77903e945",
     "rules/s3-encryption.ts": "c4f9f8aa8dc382ed98c7b04e820a600590cc75335a8db2e087cbfbfe4003d09e",
-    "rules/cf-refs.ts": "ec83a98348c9ff418230523bea1de1a08bb6e6c72bbb255ab9bca57191ff5fef",
+    "rules/cf-refs.ts": "3ca38a822b75db5b6370a5507f6a1c088e5419c9f8f5a3c9631468064842ba12",
     "rules/cor020.ts": "915bbb4c083c7b3b84b93e8e891b5ffffe5a138fdccda32ecfdda91b8685798c",
     "rules/ext001.ts": "f8703f37a50ab23d0ecaef539c0215a71269d420fa5e09a3d0454b18b7350b34",
     "rules/waw010.ts": "41c58aaedb8f9fe266f4b40f1a076f762796427fdf9b317b8a4a50c713e45571",
@@ -15,7 +15,7 @@
     "rules/waw013.ts": "f9b37b955917415a2eb5f4aed7f28b76aff0a6abdb05228dcbb8bc77bc67672a",
     "rules/waw014.ts": "889f1b06899b50f98941d05b029954cf375ac8a130933b98c9586079096216aa",
     "rules/waw015.ts": "071c940fb6432cd8b42a44d083921e9491d5063417839109c10b2bd13dd2032e",
-    "rules/waw016.ts": "88c7bf78a6580a64169ce1218911d9ef60a69e4d6897730c46c89f0b45ec7a42",
+    "rules/waw016.ts": "5d6b614bcdf3e26d87dd6c4ec67d7c5e698b3bf05db82dc05d8e006da1e0e488",
     "rules/waw017.ts": "658554008954f71036e23b514dece7063142198fbdca125f11d09026f1d21ab2",
     "rules/waw018.ts": "a4aa83a25104f039a6c5e0f3e1f5b8b65e493b0ba162c985988190a726b90d2f",
     "rules/waw019.ts": "f14ebf024a3cce7005d54c762e4e0979537d6a854fb123344107d40d92a94b5c",
@@ -60,9 +60,17 @@
     "rules/waw058.ts": "fbcfde64bbf81abe919f4e60a7e283a1b2ff30454b2c1cec2e0e099e7ad187e6",
     "rules/waw059.ts": "abaa8b31e5e50837be8d8ebe124b6e2156e0bbb8699e93e60eb63f623db37f24",
     "rules/waw060.ts": "0fd439ba658b44ae16454bc850948d97ebf81739ff5ef0a46de69fcc0c4ac705",
+    "rules/waw061.ts": "5e25d1cd07c5ff0c918d84995cf37a8fa22294242de6b421c1eef37f4fb6521d",
+    "rules/waw062.ts": "8051ac5cbc3e53fc1e664bb8e6ffd54a75fac0b6e9e802bd0d244dfec59d82a0",
+    "rules/waw063.ts": "c64f86e7cea5363c42d6aa59c06c4343b7c6cad20aeb9fbf4fec69de5e63ee87",
+    "rules/waw064.ts": "46c0cda1b777002f3412b507fcb4715cc630deb31d5306443234bfa3b74e77d1",
+    "rules/waw065.ts": "73b4c85428880bd633442f5e1eb7b228526423313ecc3b5b8950f206f33d2057",
+    "rules/waw066.ts": "f30e4996fdeb1703f24e1152ffe0698b6a55d140a341dcd9528199206abb18c0",
+    "rules/waw067.ts": "8e66f3512569c106c4c6868786bb870af1b3b05d3542118ca6bb5c61c57314e7",
+    "rules/waw068.ts": "adbfe84e9b3cdafc072346d87a5df81a97ab07bc5171f3d4abb824c29e9a66a0",
     "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
-    "skills/chant-aws-carve-terraform.md": "52dc7a8a10156d236266cc8dbf75614fabb6e2fa4caf31c13cca348e167a58b5"
+    "skills/chant-aws-carve-terraform.md": "0ae4376590db47979be144d3ac6cdcfd56c9640d0536421aacf7330459d38e52"
   },
-  "composite": "6784c3bcfe687d1f0736330b975673c4a8bd900227234e864329fc7863cd521b"
+  "composite": "ba342596e044edf730f75709ef8b4f5bd2c614b6d2eba0e9f457c20f039bb70a"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAQ1F,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA0DpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAQ1F,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA0EpD,CAAC"}

package/dist/lint/post-synth/cf-refs.d.ts

@@ -68,6 +68,23 @@ export declare function getContainerDefinitions(resource: CFResource): Array<Rec
  * project that never sets `--env`/`ownership.env` isn't unexpectedly hard-failed.
  */
 export declare function isFullTierEnv(env: string | undefined): boolean;
+/**
+ * Parse an IPv4 CIDR literal ("10.0.0.0/16") into its numeric base address
+ * and prefix length. Returns null for anything that isn't a plain IPv4 CIDR
+ * (IPv6, malformed octets, out-of-range prefix) — callers treat that as
+ * "can't prove statically" rather than an error.
+ */
+export declare function parseIpv4Cidr(cidr: string): {
+    base: number;
+    prefix: number;
+} | null;
+/**
+ * Whether `inner` (an IPv4 CIDR literal) falls entirely within `outer`.
+ * Returns null — not false — when either literal isn't a plain, parseable
+ * IPv4 CIDR (e.g. IPv6, or a CloudFormation intrinsic already stringified
+ * elsewhere); a null means "statically unprovable", not "violation".
+ */
+export declare function ipv4CidrContains(outer: string, inner: string): boolean | null;
 /**
  * Check if a port range [fromPort, toPort] contains any of the sensitive ports.
  */

package/dist/lint/post-synth/cf-refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cf-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cf-refs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,GAAG,IAAI,CAWvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAcnF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAInD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBhC;AAiBD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAahC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAK5F;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE9D;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAgBT"}
+{"version":3,"file":"cf-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cf-refs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,GAAG,IAAI,CAWvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI5D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAcnF;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAInD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBhC;AAiBD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,UAAU,GACnB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAahC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAK5F;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASnF;AAUD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAO7E;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EACjB,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAgBT"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAsDvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAqD3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA8DvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA6D3C,CAAC"}

package/dist/lint/post-synth/waw016.d.ts

@@ -2,12 +2,20 @@
  * WAW016: Deprecated Property Usage
  *
  * Flags properties marked as deprecated in the CloudFormation Registry.
- * Sources: explicit `deprecatedProperties` array + description text mining.
+ *
+ * Two bases feed this, and the finding says which one it stands on (#1701).
+ * A `declared` name comes from the Registry schema's own `deprecatedProperties`
+ * array. An `inferred` name comes from a regex over the property description,
+ * which also matches descriptions that mention the deprecation of a sibling
+ * property, an enum value, or the thing the property configures. Declared is a
+ * warning; inferred is reported at info and worded as a guess.
  */
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+/** What a deprecation classification rests on. */
+export type DeprecationBasis = "declared" | "inferred";
 /**
  * Core detection logic — exported for direct testing with synthetic data.
  */
-export declare function checkDeprecatedProperties(ctx: PostSynthContext, deprecated: Map<string, Set<string>>): PostSynthDiagnostic[];
+export declare function checkDeprecatedProperties(ctx: PostSynthContext, deprecated: Map<string, Map<string, DeprecationBasis>>): PostSynthDiagnostic[];
 export declare const waw016: PostSynthCheck;
 //# sourceMappingURL=waw016.d.ts.map

package/dist/lint/post-synth/waw016.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"waw016.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw016.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAgC9G;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GACnC,mBAAmB,EAAE,CA6BvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}
+{"version":3,"file":"waw016.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw016.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,CAAC;AAuCvD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,GACrD,mBAAmB,EAAE,CAiCvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw061.d.ts

@@ -0,0 +1,19 @@
+/**
+ * WAW061: Subnet CIDR Not Contained In VPC CIDR
+ *
+ * A subnet's CidrBlock must fall entirely inside its VPC's CidrBlock.
+ * Stock CDK does not check this — CloudFormation accepts the template and
+ * only fails the `AWS::EC2::Subnet` resource at deploy time
+ * ("The CIDR ... is invalid" / "does not fall within the CIDR range of the
+ * VPC"), after the rest of the stack may have already started rolling out.
+ * This is a cheap static graph check: follow the subnet's VpcId Ref to a
+ * declared VPC in the same template and do IPv4 CIDR-range math.
+ *
+ * Stays quiet whenever the graph can't prove it: intrinsic CIDR blocks,
+ * IPv6, a VpcId that isn't a simple Ref to a declared AWS::EC2::VPC, or a
+ * VPC whose own CidrBlock isn't a literal string.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkSubnetCidrContainment(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw061: PostSynthCheck;
+//# sourceMappingURL=waw061.d.ts.map

package/dist/lint/post-synth/waw061.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw061.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw061.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAsCvF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw062.d.ts

@@ -0,0 +1,19 @@
+/**
+ * WAW062: Duplicate Name Or Export Within A Template
+ *
+ * CloudFormation requires certain names to be unique within a single
+ * template/stack: `Outputs.*.Export.Name`, and several resource-level
+ * "explicit name" properties (LaunchTemplateName, AutoScalingGroupName,
+ * GroupName, ...). Stock CDK doesn't catch a collision here — synth
+ * succeeds and the stack fails at CloudFormation deploy/changeset time.
+ * A duplicate is easy to introduce by copy-pasting a composite invocation
+ * (e.g. two EcrRepository or NlbService composites) without varying the
+ * explicit name.
+ *
+ * Only literal string values are compared — anything built from an
+ * intrinsic (Fn::Sub, Ref, ...) is statically unprovable and skipped.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkDuplicateNamesAndExports(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw062: PostSynthCheck;
+//# sourceMappingURL=waw062.d.ts.map

package/dist/lint/post-synth/waw062.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw062.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw062.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAqF9G,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAY1F;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}