@intentius/chant-lexicon-aws 0.46.0 → 0.50.0

package/dist/rules/waw065.ts

@@ -0,0 +1,110 @@
+/**
+ * WAW065: Transit Gateway Route Table Wiring Is Incomplete
+ *
+ * A Transit Gateway route table only does anything once two independent
+ * pieces are both wired up: an `AWS::EC2::TransitGatewayRouteTableAssociation`
+ * (which attachment's traffic is evaluated against this table) and an
+ * `AWS::EC2::TransitGatewayRouteTablePropagation` (which attachments' routes
+ * populate it). CloudFormation is happy to deploy a route table with one but
+ * not the other — the stack succeeds, and the gap only shows up as traffic
+ * that can't find a route. Two patterns, both "declared but half-wired":
+ *
+ *  - a route table has one or more associations but zero propagations — the
+ *    associated attachment's traffic is evaluated against this table, but
+ *    nothing ever populates it with routes;
+ *  - a declared attachment (VPC/VPN/peering, or the generic
+ *    TransitGatewayAttachment) is referenced by neither an association nor
+ *    a propagation anywhere in the template — it hangs off the transit
+ *    gateway with no route table wiring at all.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs } from "./cf-refs";
+
+const ATTACHMENT_TYPES = new Set([
+  "AWS::EC2::TransitGatewayAttachment",
+  "AWS::EC2::TransitGatewayVpcAttachment",
+  "AWS::EC2::TransitGatewayVpnAttachment",
+  "AWS::EC2::TransitGatewayPeeringAttachment",
+]);
+
+export function checkTgwRouteTableWiring(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    const routeTableIds = new Set<string>();
+    const attachmentIds = new Set<string>();
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      if (resource.Type === "AWS::EC2::TransitGatewayRouteTable") routeTableIds.add(logicalId);
+      if (ATTACHMENT_TYPES.has(resource.Type)) attachmentIds.add(logicalId);
+    }
+    if (routeTableIds.size === 0 && attachmentIds.size === 0) continue;
+
+    const associationsByTable = new Map<string, Set<string>>();
+    const propagationsByTable = new Map<string, Set<string>>();
+    const referencedAttachments = new Set<string>();
+
+    for (const resource of Object.values(resources)) {
+      let bucket: Map<string, Set<string>> | null = null;
+      if (resource.Type === "AWS::EC2::TransitGatewayRouteTableAssociation") bucket = associationsByTable;
+      if (resource.Type === "AWS::EC2::TransitGatewayRouteTablePropagation") bucket = propagationsByTable;
+      if (!bucket) continue;
+
+      const props = resource.Properties ?? {};
+      const attachmentRefs = findResourceRefs(props.TransitGatewayAttachmentId);
+      for (const attId of attachmentRefs) referencedAttachments.add(attId);
+
+      for (const rtId of findResourceRefs(props.TransitGatewayRouteTableId)) {
+        let attSet = bucket.get(rtId);
+        if (!attSet) {
+          attSet = new Set();
+          bucket.set(rtId, attSet);
+        }
+        for (const attId of attachmentRefs) attSet.add(attId);
+      }
+    }
+
+    // Pattern A: associated but never propagated.
+    for (const rtId of routeTableIds) {
+      const associations = associationsByTable.get(rtId);
+      const propagations = propagationsByTable.get(rtId);
+      if (associations && associations.size > 0 && (!propagations || propagations.size === 0)) {
+        diagnostics.push({
+          checkId: "WAW065",
+          severity: "warning",
+          message: `TransitGatewayRouteTable "${rtId}" has ${associations.size} association(s) but no route propagations — the associated attachment's routes never populate this table, likely incomplete wiring`,
+          entity: rtId,
+          lexicon: "aws",
+        });
+      }
+    }
+
+    // Pattern B: a declared attachment wired into no route table at all.
+    for (const attId of attachmentIds) {
+      if (!referencedAttachments.has(attId)) {
+        diagnostics.push({
+          checkId: "WAW065",
+          severity: "warning",
+          message: `Transit Gateway attachment "${attId}" is referenced by no TransitGatewayRouteTableAssociation or TransitGatewayRouteTablePropagation — it has no route table wiring, so nothing can route to or from it`,
+          entity: attId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw065: PostSynthCheck = {
+  id: "WAW065",
+  description: "Transit Gateway route table has associations but no propagations, or an attachment wired into no route table",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkTgwRouteTableWiring(ctx);
+  },
+};

package/dist/rules/waw066.ts

@@ -0,0 +1,155 @@
+/**
+ * WAW066: Private Subnet Route Table Has No Working Default Route
+ *
+ * Cross-resource join: a subnet's outbound path depends on a chain of three
+ * independently-declared resources — the `AWS::EC2::SubnetRouteTableAssociation`
+ * that pins it to a route table, the `AWS::EC2::Route` on that table for
+ * `0.0.0.0/0`, and the gateway that route names. CloudFormation validates
+ * none of this end-to-end: a subnet can be wired to a route table with no
+ * default route at all, or with a default route whose NAT gateway / Transit
+ * Gateway target was renamed or removed elsewhere in the template, and the
+ * stack still deploys clean. The subnet is black-holed — every deploy
+ * succeeds, and the only symptom is a workload with no outbound connectivity.
+ *
+ * A route table with a default route to an `AWS::EC2::InternetGateway` is
+ * treated as a public subnet and is out of scope for this check — this rule
+ * only flags the private case: no default route, or one whose target
+ * (`NatGatewayId` / `TransitGatewayId` / etc.) does not resolve to a
+ * resource declared in the same template. A route naming a target that
+ * exists in the template resolves cleanly and is never flagged, per the
+ * cross-resource contract.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFResource, type CFTemplate } from "./cf-refs";
+
+type RouteClass = "public" | "resolved" | "dangling";
+
+const OTHER_TARGET_KEYS = [
+  "NatGatewayId",
+  "TransitGatewayId",
+  "VpcPeeringConnectionId",
+  "EgressOnlyInternetGatewayId",
+  "LocalGatewayId",
+  "CarrierGatewayId",
+  "NetworkInterfaceId",
+  "InstanceId",
+] as const;
+
+/** Classify a `0.0.0.0/0` Route's target. A target Ref that exists always resolves. */
+function classifyDefaultRoute(route: CFResource, resources: Record<string, CFResource>): RouteClass {
+  const props = route.Properties ?? {};
+
+  if (props.GatewayId !== undefined) {
+    if (typeof props.GatewayId === "string") {
+      return props.GatewayId.startsWith("igw-") ? "public" : "resolved";
+    }
+    const refs = findResourceRefs(props.GatewayId);
+    if (refs.size !== 1) return "resolved"; // unprovable intrinsic — stay quiet
+    const [id] = refs;
+    if (!resources[id]) return "dangling";
+    return resources[id].Type === "AWS::EC2::InternetGateway" ? "public" : "resolved";
+  }
+
+  for (const key of OTHER_TARGET_KEYS) {
+    const value = (props as Record<string, unknown>)[key];
+    if (value === undefined) continue;
+    if (typeof value === "string") return "resolved"; // literal id from outside the template
+    const refs = findResourceRefs(value);
+    if (refs.size !== 1) return "resolved";
+    const [id] = refs;
+    return resources[id] ? "resolved" : "dangling";
+  }
+
+  return "resolved"; // no recognized target key — can't classify, stay quiet
+}
+
+function isDefaultRoute(route: CFResource): boolean {
+  return route.Properties?.DestinationCidrBlock === "0.0.0.0/0";
+}
+
+export function checkPrivateSubnetDefaultRoute(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template: CFTemplate | null = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    // subnetId -> Set<routeTableId>, from explicit associations only.
+    const subnetRouteTables = new Map<string, Set<string>>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::SubnetRouteTableAssociation") continue;
+      const props = resource.Properties ?? {};
+      const subnetRefs = findResourceRefs(props.SubnetId);
+      const rtRefs = findResourceRefs(props.RouteTableId);
+      for (const subnetId of subnetRefs) {
+        let set = subnetRouteTables.get(subnetId);
+        if (!set) {
+          set = new Set();
+          subnetRouteTables.set(subnetId, set);
+        }
+        for (const rtId of rtRefs) set.add(rtId);
+      }
+    }
+
+    // routeTableId -> Route resources targeting it.
+    const routesByTable = new Map<string, CFResource[]>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::Route") continue;
+      for (const rtId of findResourceRefs(resource.Properties?.RouteTableId)) {
+        let list = routesByTable.get(rtId);
+        if (!list) {
+          list = [];
+          routesByTable.set(rtId, list);
+        }
+        list.push(resource);
+      }
+    }
+
+    for (const [subnetId, rtIds] of subnetRouteTables) {
+      if (resources[subnetId]?.Type !== "AWS::EC2::Subnet") continue;
+
+      for (const rtId of rtIds) {
+        if (resources[rtId]?.Type !== "AWS::EC2::RouteTable") continue;
+
+        const routes = routesByTable.get(rtId) ?? [];
+        const defaultRoutes = routes.filter(isDefaultRoute);
+
+        if (defaultRoutes.length === 0) {
+          diagnostics.push({
+            checkId: "WAW066",
+            severity: "warning",
+            message: `Subnet "${subnetId}" is associated with route table "${rtId}", which has no default route (0.0.0.0/0) — outbound traffic from this subnet has no path out, black-holed by omission`,
+            entity: subnetId,
+            lexicon: "aws",
+          });
+          continue;
+        }
+
+        const classes = defaultRoutes.map((route) => classifyDefaultRoute(route, resources));
+        if (classes.includes("public")) continue; // has a real IGW default route — public subnet, out of scope
+        if (classes.every((c) => c === "dangling")) {
+          diagnostics.push({
+            checkId: "WAW066",
+            severity: "error",
+            message: `Subnet "${subnetId}"'s route table "${rtId}" has a default route (0.0.0.0/0) whose target does not exist in this template — outbound traffic from this subnet is black-holed`,
+            entity: subnetId,
+            lexicon: "aws",
+          });
+        }
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw066: PostSynthCheck = {
+  id: "WAW066",
+  description: "Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkPrivateSubnetDefaultRoute(ctx);
+  },
+};

package/dist/rules/waw067.ts

@@ -0,0 +1,114 @@
+/**
+ * WAW067: Single-AZ NAT Gateway Serves Multi-AZ Private Subnets
+ *
+ * Cross-resource join across four resource kinds: a NAT gateway lives in one
+ * subnet, which lives in one Availability Zone; a route table's default
+ * route names the NAT gateway it forwards to; a subnet is pinned to a route
+ * table by an `AWS::EC2::SubnetRouteTableAssociation`. Follow that chain and
+ * a common reliability gap falls out — private subnets in two or more AZs
+ * all defaulting to the *same* NAT gateway. CloudFormation has no opinion on
+ * this; it deploys cleanly. But a NAT gateway lives entirely inside one AZ,
+ * so if that AZ has an outage, every subnet depending on it loses egress —
+ * including the subnets in AZs that were otherwise healthy. The
+ * Well-Architected fix is one NAT gateway per AZ, each serving only its own
+ * AZ's subnets.
+ *
+ * Only fires when the Availability Zones involved are literal strings —
+ * an `Fn::GetAZs`/`Fn::Select`-derived AZ can't be compared statically, so a
+ * subnet without a literal `AvailabilityZone` is silently excluded rather
+ * than guessed at.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFTemplate } from "./cf-refs";
+
+export function checkNatGatewaySingleAz(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template: CFTemplate | null = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    // NAT gateway id -> its own subnet's literal AZ.
+    const natGatewayAz = new Map<string, string>();
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      if (resource.Type !== "AWS::EC2::NatGateway") continue;
+      const subnetRefs = findResourceRefs(resource.Properties?.SubnetId);
+      if (subnetRefs.size !== 1) continue;
+      const [subnetId] = subnetRefs;
+      const az = resources[subnetId]?.Properties?.AvailabilityZone;
+      if (typeof az === "string") natGatewayAz.set(logicalId, az);
+    }
+    if (natGatewayAz.size === 0) continue;
+
+    // route table id -> the NAT gateway its default route forwards to.
+    const routeTableNatTarget = new Map<string, string>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::Route") continue;
+      const props = resource.Properties ?? {};
+      if (props.DestinationCidrBlock !== "0.0.0.0/0") continue;
+      const natRefs = findResourceRefs(props.NatGatewayId);
+      if (natRefs.size !== 1) continue;
+      const [natId] = natRefs;
+      if (!natGatewayAz.has(natId)) continue;
+      for (const rtId of findResourceRefs(props.RouteTableId)) {
+        routeTableNatTarget.set(rtId, natId);
+      }
+    }
+
+    // subnet id -> route table id, from explicit associations only.
+    const subnetRouteTable = new Map<string, string>();
+    for (const resource of Object.values(resources)) {
+      if (resource.Type !== "AWS::EC2::SubnetRouteTableAssociation") continue;
+      const props = resource.Properties ?? {};
+      const subnetRefs = findResourceRefs(props.SubnetId);
+      const rtRefs = findResourceRefs(props.RouteTableId);
+      if (subnetRefs.size !== 1 || rtRefs.size !== 1) continue;
+      const [subnetId] = subnetRefs;
+      const [rtId] = rtRefs;
+      subnetRouteTable.set(subnetId, rtId);
+    }
+
+    // NAT gateway id -> the set of subnets that default-route through it.
+    const servedSubnets = new Map<string, Set<string>>();
+    for (const [subnetId, rtId] of subnetRouteTable) {
+      const natId = routeTableNatTarget.get(rtId);
+      if (!natId) continue;
+      let set = servedSubnets.get(natId);
+      if (!set) {
+        set = new Set();
+        servedSubnets.set(natId, set);
+      }
+      set.add(subnetId);
+    }
+
+    for (const [natId, subnetIds] of servedSubnets) {
+      const azs = new Set<string>();
+      for (const subnetId of subnetIds) {
+        const az = resources[subnetId]?.Properties?.AvailabilityZone;
+        if (typeof az === "string") azs.add(az);
+      }
+      if (azs.size > 1) {
+        diagnostics.push({
+          checkId: "WAW067",
+          severity: "warning",
+          message: `NAT Gateway "${natId}" (in ${natGatewayAz.get(natId)}) is the default-route egress for private subnets across ${azs.size} Availability Zones (${[...azs].sort().join(", ")}) — a single-AZ NAT gateway is a single point of failure for cross-AZ egress; add one NAT gateway per AZ`,
+          entity: natId,
+          lexicon: "aws",
+        });
+      }
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw067: PostSynthCheck = {
+  id: "WAW067",
+  description: "A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkNatGatewaySingleAz(ctx);
+  },
+};

package/dist/rules/waw068.ts

@@ -0,0 +1,78 @@
+/**
+ * WAW068: VPN Gateway Has A Single VPN Connection
+ *
+ * An `AWS::EC2::VPNConnection` always gets two tunnels from AWS, but that
+ * redundancy only covers the tunnel pair inside one connection — it does
+ * nothing if the connection's Customer Gateway, on-prem device, or the
+ * single site it terminates at goes down. The reliability boundary that
+ * matters is the connection itself: a `AWS::EC2::VPNGateway` (or a Transit
+ * Gateway used for VPN attachment) with only one `VPNConnection` attached
+ * has no fallback path for hybrid connectivity if that connection's
+ * Customer Gateway or on-prem side fails.
+ *
+ * Cross-resource join: group every declared `VPNConnection` by the gateway
+ * (`VpnGatewayId` or `TransitGatewayId`) it attaches to, and flag any
+ * gateway left with exactly one.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate, findResourceRefs, type CFTemplate } from "./cf-refs";
+
+export function checkVpnGatewayRedundancy(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [_lexicon, output] of ctx.outputs) {
+    const template: CFTemplate | null = parseCFTemplate(output);
+    if (!template?.Resources) continue;
+    const resources = template.Resources;
+
+    // gateway logical id -> the VPNConnection logical ids attached to it.
+    const connectionsByGateway = new Map<string, string[]>();
+
+    for (const [logicalId, resource] of Object.entries(resources)) {
+      if (resource.Type !== "AWS::EC2::VPNConnection") continue;
+      const props = resource.Properties ?? {};
+
+      const gatewayProp = props.VpnGatewayId !== undefined ? props.VpnGatewayId : props.TransitGatewayId;
+      if (gatewayProp === undefined) continue; // no declared gateway target — can't group, stay quiet
+
+      const gwRefs = findResourceRefs(gatewayProp);
+      if (gwRefs.size !== 1) continue;
+      const [gwId] = gwRefs;
+
+      const gw = resources[gwId];
+      if (!gw || (gw.Type !== "AWS::EC2::VPNGateway" && gw.Type !== "AWS::EC2::TransitGateway")) continue;
+
+      let list = connectionsByGateway.get(gwId);
+      if (!list) {
+        list = [];
+        connectionsByGateway.set(gwId, list);
+      }
+      list.push(logicalId);
+    }
+
+    for (const [gwId, connectionIds] of connectionsByGateway) {
+      if (connectionIds.length !== 1) continue;
+
+      const kind = resources[gwId].Type === "AWS::EC2::VPNGateway" ? "VPN Gateway" : "Transit Gateway";
+      diagnostics.push({
+        checkId: "WAW068",
+        severity: "warning",
+        message: `${kind} "${gwId}" has only one VPN connection ("${connectionIds[0]}") attached — no redundant path if this connection, its tunnels, or its Customer Gateway fail; attach a second VPNConnection (ideally to a separate Customer Gateway) for hybrid-connectivity redundancy`,
+        entity: gwId,
+        lexicon: "aws",
+      });
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw068: PostSynthCheck = {
+  id: "WAW068",
+  description: "VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkVpnGatewayRedundancy(ctx);
+  },
+};

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAkZlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAoE3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAiflG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA4E3B,CAAC"}

package/dist/skills/chant-aws-carve-terraform.md

@@ -1,6 +1,6 @@
 ---
 skill: chant-aws-carve-terraform
-description: Demo carving a resource out of Terraform into native chant — advise, emit, bridge, apply — fully offline
+description: Demo carving a resource out of Terraform into native chant — advise, emit, audit, bridge, apply — fully offline
 user-invocable: true
 ---
 
@@ -15,7 +15,7 @@ graduation.
 ## When to use
 
 - Someone asks "how does chant move things off Terraform?"
-- You want to show the advise → emit → bridge → apply loop end to end.
+- You want to show the advise → emit → audit → bridge → apply loop end to end.
 - You are evaluating whether a Terraform estate is worth carving.
 
 ## Preconditions
@@ -27,7 +27,7 @@ graduation.
 ## The fastest path: run the bundled demo
 
 The `examples/terraform-carve-out` example ships a runnable estate + state and a
-script that runs all four steps with commentary:
+script that runs all five steps with commentary:
 
 ```bash
 cd examples/terraform-carve-out
@@ -54,28 +54,30 @@ From `examples/terraform-carve-out`, with `TF=./terraform`:
      --state ./terraform/terraform.tfstate --output ./carveout
    ```
    Show `./carveout/src/assets.ts` — a real `new Bucket({ BucketName, Tags })` with
-   CloudFormation-style properties mapped from the Terraform state attributes.
-   Emit also scaffolds `./carveout` into a buildable chant project
-   (`chant.config.ts`, `package.json`), so `npm install && npm run build` works
-   there as-is. Explain: a Terraform-managed resource is not in any
-   CloudFormation stack, so the correct source of its live shape is the state
-   file, not a cloud read.
-
-3. **Lint the inherited resource — optional, offer it.**
+   CloudFormation-style properties mapped from the Terraform state attributes,
+   and the `aws_s3_bucket_versioning` sub-resource folded into
+   `VersioningConfiguration`. Emit also scaffolds `./carveout` into a buildable
+   chant project (`chant.config.ts`, `package.json`) and persists a carve
+   manifest (`*.carve.json`) — bridge and apply read the target from it, so
+   `--select` is only needed once. Explain: a Terraform-managed resource is not
+   in any CloudFormation stack, so the correct source of its live shape is the
+   state file, not a cloud read.
+
+3. **Audit the inherited resource.**
    ```bash
-   chant lint ./carveout/src --lexicon aws
+   chant build ./carveout/src --lexicon aws
    ```
-   After emit, offer to lint the carved source. chant audits the resource you
-   inherited from Terraform against the AWS lexicon's rules. Findings have a
-   severity: `error` (must fix before `chant build` will emit — e.g. an S3
-   bucket with no public-access block) and `warning`/`info` (advisory — e.g.
-   DynamoDB point-in-time recovery). This is a feature of carving: chant
-   immediately tells the person what is wrong with what they adopted. Whether to
-   fix an advisory finding is their call; errors block the build until resolved.
+   The first build fails, deliberately: the post-synth audit refuses the
+   adopted bucket because Terraform managed it without a public-access block or
+   a TLS-only policy. This is a feature of carving: chant immediately tells the
+   person what is wrong with what they adopted. Show the fix (add
+   `PublicAccessBlockConfiguration` and a companion `S3BucketPolicy` with an
+   `aws:SecureTransport = false` Deny — the tutorial page has the exact code),
+   then re-run the build and show the valid CloudFormation template.
 
 4. **Bridge — patch the surviving Terraform.**
    ```bash
-   chant carve bridge --from ./terraform --select aws_s3_bucket.assets --output ./carveout
+   chant carve bridge --from ./terraform --output ./carveout
    ```
    Show the generated `data "aws_s3_bucket" "assets"` and the rewired survivor.
    Emphasize it is dry-run: nothing in `./terraform` changed. `--apply-rewrites`
@@ -83,11 +85,12 @@ From `examples/terraform-carve-out`, with `TF=./terraform`:
 
 5. **Apply — graduation plan.**
    ```bash
-   chant carve apply --from ./terraform --select aws_s3_bucket.assets --env prod --stack assets
+   chant carve apply --from ./terraform --output ./carveout --env prod --stack assets
    ```
    Show the ownership marker (`chant:managed-by/stack/env`) and the finalized
-   runbook. Stress this makes no cloud call — the apply is the person's own
-   lifecycle; chant just plans it.
+   runbook. `--write-source` additionally stamps the marker tags into the
+   emitted source. Stress this makes no cloud call — the apply is the person's
+   own lifecycle; chant just plans it.
 
 ## Key points to land
 

package/dist/spec/parse.d.ts

@@ -36,6 +36,13 @@ export interface ParsedResource {
     writeOnly: string[];
     primaryIdentifier: string[];
     deprecatedProperties: string[];
+    /**
+     * The subset of `deprecatedProperties` that no upstream declaration backs.
+     * These names come from {@link DEPRECATION_RE} matching the property
+     * description, so they are an inference rather than a reading. Kept apart so
+     * a consumer can tell the two apart and calibrate what it says (#1701).
+     */
+    inferredDeprecations: string[];
     conditionalCreateOnly: string[];
     replacementStrategy?: "delete_then_create" | "create_then_delete";
     tagging?: {

package/dist/spec/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAGL,kBAAkB,IAAI,sBAAsB,EAE5C,KAAK,mBAAmB,EAIzB,MAAM,sCAAsC,CAAC;AAG9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAWhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAClE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9E;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,iBAAiB,CA6IvE;AAiBD,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AAMzD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAGL,kBAAkB,IAAI,sBAAsB,EAE5C,KAAK,mBAAmB,EAIzB,MAAM,sCAAsC,CAAC;AAG9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAkBhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAClE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9E;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,iBAAiB,CAmJvE;AAiBD,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AAMzD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.46.0",
+  "version": "0.50.0",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -73,14 +73,14 @@
   },
   "dependencies": {
     "fflate": "^0.8.2",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^4.3.1"
   },
   "devDependencies": {
     "@intentius/chant": "*",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.46.0",
+    "@intentius/chant": "^0.50.0",
     "typescript": "^5.9.3"
   }
 }

package/src/api/read-client.test.ts

@@ -198,6 +198,15 @@ describe("Cloud Control", () => {
     expect(await listResources("AWS::S3::Bucket", { http })).toEqual([]);
   });
 
+  test("listResources scopes a child listing with ResourceModel, JSON-encoded as the API takes it", async () => {
+    const { http, calls } = recording(() => respond(JSON.stringify({ ResourceDescriptions: [] })));
+    await listResources("AWS::IAM::RolePolicy", { http }, { RoleName: "app-role" });
+    expect(JSON.parse(calls[0].body)).toEqual({
+      TypeName: "AWS::IAM::RolePolicy",
+      ResourceModel: JSON.stringify({ RoleName: "app-role" }),
+    });
+  });
+
   test("parseResourceDescription refuses anything that is not a model object", () => {
     expect(parseResourceDescription(null)).toBeNull();
     expect(parseResourceDescription({ Identifier: "a" })).toBeNull();

package/src/api/read-client.ts

@@ -434,17 +434,30 @@ export async function getResource(
   return parseResourceDescription(body.ResourceDescription);
 }
 
-/** `ListResources` — every live resource of one type, paginated to exhaustion. */
+/**
+ * `ListResources` — every live resource of one type, paginated to exhaustion.
+ *
+ * `resourceModel` is Cloud Control's `ResourceModel`: the scope a child-typed
+ * listing requires (`{ RoleName }` for `AWS::IAM::RolePolicy`,
+ * `{ TopicArn }` for `AWS::SNS::Subscription`). The API takes it as a JSON
+ * *string*, the same double encoding `GetResource` answers with; this takes
+ * the object and encodes it so no caller repeats that detail.
+ */
 export async function listResources(
   typeName: string,
   options: AwsReadClientOptions = {},
+  resourceModel?: Record<string, unknown>,
 ): Promise<CloudControlDescription[]> {
   const out: CloudControlDescription[] = [];
   let nextToken: string | undefined;
   do {
     const body = await cloudControl(
       "ListResources",
-      { TypeName: typeName, ...(nextToken ? { NextToken: nextToken } : {}) },
+      {
+        TypeName: typeName,
+        ...(resourceModel ? { ResourceModel: JSON.stringify(resourceModel) } : {}),
+        ...(nextToken ? { NextToken: nextToken } : {}),
+      },
       options,
     );
     const descriptions = Array.isArray(body.ResourceDescriptions) ? body.ResourceDescriptions : [];

package/src/codegen/fallback.ts

@@ -27,6 +27,7 @@ function fallbackLogGroup(): SchemaParseResult {
       writeOnly: [],
       primaryIdentifier: [],
       deprecatedProperties: [],
+      inferredDeprecations: [],
       conditionalCreateOnly: [],
     },
     propertyTypes: [],