@intentius/chant-lexicon-aws 0.49.0 → 0.51.0

package/dist/codegen/generate-lexicon.d.ts

@@ -18,6 +18,11 @@ export interface LexiconEntry {
     writeOnly?: string[];
     primaryIdentifier?: string[];
     deprecatedProperties?: string[];
+    /**
+     * Subset of `deprecatedProperties` that only a regex over the property
+     * description supports; the rest is declared by the Registry schema (#1701).
+     */
+    inferredDeprecations?: string[];
     conditionalCreateOnly?: string[];
     replacementStrategy?: "delete_then_create" | "create_then_delete";
     tagging?: {

package/dist/codegen/generate-lexicon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-lexicon.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-lexicon.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC1D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAClE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,iBAAiB,EAAE,EAC5B,MAAM,EAAE,cAAc,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,EAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GACjD,MAAM,CA8CR;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYlE"}
+{"version":3,"file":"generate-lexicon.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-lexicon.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC1D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAClE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,iBAAiB,EAAE,EAC5B,MAAM,EAAE,cAAc,EACtB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,CAAC,EAC/C,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GACjD,MAAM,CA+CR;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYlE"}

package/dist/components/host-delivery.d.ts

@@ -54,9 +54,10 @@ export interface CodeDeployOutput {
  * Deploy a revision to a host (fleet) via AWS CodeDeploy: create the
  * deployment, then wait for a terminal status. Rollback re-invokes
  * `stopAndRollback` against the deployment id this step created (captured in
- * a closure-scoped map keyed by application/deploymentGroup, since the
- * driver's saga rollback calls `rollback(ctx, sameInput)` rather than passing
- * `run`'s output) — riding CodeDeploy's own native automatic rollback to the
+ * a closure-scoped map keyed by application/deploymentGroup; the driver now
+ * also passes `run`'s output as `rollback`'s optional third arg (#1944), but
+ * this capability's input-derived key needs neither channel to resolve
+ * identity) — riding CodeDeploy's own native automatic rollback to the
  * last known-good revision rather than a chant-scripted compensation, the
  * "auto" rollback style the Neo4j pilot's docs comment contrasts with the
  * ALB/ECS pilot's component-declared one.

package/dist/components/host-delivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-delivery.d.ts","sourceRoot":"","sources":["../../src/components/host-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAI5E,MAAM,WAAW,eAAe;IAC9B,oKAAoK;IACpK,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4HAA4H;IAC5H,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,EAAE;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IAC1G,gDAAgD;IAChD,QAAQ,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;IACrC,oLAAoL;IACpL,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAsBD;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,GAAE,aAAsC,GAC/C,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAC,CA2B/C;AAED,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAgC,CAAC;AAIhH,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,GAAE,aAAsC,GAAG,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAY1I;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAgC,CAAC;AAIhH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,GAAE,aAAsC,GAAG,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAW1I;AAED,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAgC,CAAC"}
+{"version":3,"file":"host-delivery.d.ts","sourceRoot":"","sources":["../../src/components/host-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAI5E,MAAM,WAAW,eAAe;IAC9B,oKAAoK;IACpK,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4HAA4H;IAC5H,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,EAAE;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IAC1G,gDAAgD;IAChD,QAAQ,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;IACrC,oLAAoL;IACpL,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAsBD;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,GAAE,aAAsC,GAC/C,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAC,CA2B/C;AAED,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAgC,CAAC;AAIhH,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,GAAE,aAAsC,GAAG,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAY1I;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAgC,CAAC;AAIhH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,GAAE,aAAsC,GAAG,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAW1I;AAED,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,eAAe,EAAE,gBAAgB,CAAgC,CAAC"}

package/dist/disruption.d.ts

@@ -0,0 +1,26 @@
+import type { DisruptionQuery, DisruptionVerdict } from "@intentius/chant/lexicon";
+/** The slice of a `lexicon-aws.json` entry that carries replacement semantics. */
+export interface DisruptionSpec {
+    resourceType: string;
+    kind: string;
+    /** Read-only attributes (TS key → CF attr name). An output changing is a symptom, never a cause. */
+    attrs?: Record<string, string>;
+    createOnly?: string[];
+    conditionalCreateOnly?: string[];
+    replacementStrategy?: "delete_then_create" | "create_then_delete";
+}
+/**
+ * Classify one pending update against the type's compiled schema. Pure — the
+ * spec table is passed in, so this is testable without generated artifacts.
+ */
+export declare function classifyAwsChange(query: DisruptionQuery, specs: Map<string, DisruptionSpec>): DisruptionVerdict;
+/**
+ * `LexiconPlugin.classifyDisruption` for aws. Loads the compiled registry once
+ * and answers every query from it. A registry that cannot be read leaves every
+ * change `unknown` — the honest answer, and the one the contract requires.
+ */
+export declare function awsDisruption(options: {
+    environment: string;
+    changes: DisruptionQuery[];
+}): Record<string, DisruptionVerdict>;
+//# sourceMappingURL=disruption.d.ts.map

package/dist/disruption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disruption.d.ts","sourceRoot":"","sources":["../src/disruption.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAInF,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;CACnE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GACjC,iBAAiB,CAuDnB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAOpC"}

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export { EffectReceipt, receiptParameterName, AWS_EFFECT_RECEIPT_ENTITY_TYPE, EF
 export type { AwsEffectReceiptDeclaration } from "./effect-receipt-row.js";
 export { awsReceiptStore, observeReceiptRows, ssmGetParameter, ssmPutParameter } from "./receipt-store.js";
 export type { AwsReceiptStoreOptions, ReceiptRowObservation } from "./receipt-store.js";
+export { awsApply, awsDelete, flociUp, flociDown } from "./op/builders.js";
 export { awsSerializer } from "./serializer.js";
 export { nestedStack, isNestedStackInstance, NestedStackOutputRef, isNestedStackOutputRef, NESTED_STACK_MARKER } from "./nested-stack.js";
 export type { NestedStackOptions, NestedStackInstance } from "./nested-stack.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAK9D,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,8BAA8B,EAC9B,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxG,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGrF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAC/F,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAC/G,kBAAkB,EAClB,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAC1D,kBAAkB,EAClB,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,2BAA2B,EAAE,gBAAgB,EAC7D,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5E,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAChO,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAC1H,uBAAuB,EACvB,oBAAoB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,eAAe,EAAE,eAAe,EAC5G,uBAAuB,EACvB,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAClF,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,EAChG,0BAA0B,EAC1B,oBAAoB,EAAE,oBAAoB,EAC1C,qBAAqB,EAAE,sBAAsB,GAC9C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChI,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAK9D,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,8BAA8B,EAC9B,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxG,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAQrF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGxE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAC/F,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAC/G,kBAAkB,EAClB,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAC1D,kBAAkB,EAClB,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,2BAA2B,EAAE,gBAAgB,EAC7D,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5E,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAChO,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAC1H,uBAAuB,EACvB,oBAAoB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,eAAe,EAAE,eAAe,EAC5G,uBAAuB,EACvB,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAClF,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,EAChG,0BAA0B,EAC1B,oBAAoB,EAAE,oBAAoB,EAC1C,qBAAqB,EAAE,sBAAsB,GAC9C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChI,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC"}

package/dist/integrity.json

@@ -1,8 +1,8 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "73f13702a63ae229fbc2ca77dc23d1fb98a22f2a7a101e8ddf4ec66749527440",
-    "meta.json": "2e4cae67cbc2eb2962c3dd0aa57008ae96fb725dd0118af7b04b2b44eab7722a",
+    "manifest.json": "0c488f36f907e56798a03315c3dec265068b2db4233aa839f03db166e2c17b54",
+    "meta.json": "e7c751a09a871dc5a16e9aeea0b0a149513a7a2a051c923e9a5acf193dc2aef8",
     "types/index.d.ts": "6d6b37bd14a9b40fb3ff5c66e1cb49be1ae1032de47a4e167cf5f411c943b7f5",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
     "rules/iam-wildcard.ts": "135d7217d278fef50939e605c5da32603ba35674b8c4b5c4d66a06c77903e945",
@@ -15,7 +15,7 @@
     "rules/waw013.ts": "f9b37b955917415a2eb5f4aed7f28b76aff0a6abdb05228dcbb8bc77bc67672a",
     "rules/waw014.ts": "889f1b06899b50f98941d05b029954cf375ac8a130933b98c9586079096216aa",
     "rules/waw015.ts": "071c940fb6432cd8b42a44d083921e9491d5063417839109c10b2bd13dd2032e",
-    "rules/waw016.ts": "88c7bf78a6580a64169ce1218911d9ef60a69e4d6897730c46c89f0b45ec7a42",
+    "rules/waw016.ts": "5d6b614bcdf3e26d87dd6c4ec67d7c5e698b3bf05db82dc05d8e006da1e0e488",
     "rules/waw017.ts": "658554008954f71036e23b514dece7063142198fbdca125f11d09026f1d21ab2",
     "rules/waw018.ts": "a4aa83a25104f039a6c5e0f3e1f5b8b65e493b0ba162c985988190a726b90d2f",
     "rules/waw019.ts": "f14ebf024a3cce7005d54c762e4e0979537d6a854fb123344107d40d92a94b5c",
@@ -63,9 +63,14 @@
     "rules/waw061.ts": "5e25d1cd07c5ff0c918d84995cf37a8fa22294242de6b421c1eef37f4fb6521d",
     "rules/waw062.ts": "8051ac5cbc3e53fc1e664bb8e6ffd54a75fac0b6e9e802bd0d244dfec59d82a0",
     "rules/waw063.ts": "c64f86e7cea5363c42d6aa59c06c4343b7c6cad20aeb9fbf4fec69de5e63ee87",
+    "rules/waw064.ts": "46c0cda1b777002f3412b507fcb4715cc630deb31d5306443234bfa3b74e77d1",
+    "rules/waw065.ts": "73b4c85428880bd633442f5e1eb7b228526423313ecc3b5b8950f206f33d2057",
+    "rules/waw066.ts": "f30e4996fdeb1703f24e1152ffe0698b6a55d140a341dcd9528199206abb18c0",
+    "rules/waw067.ts": "8e66f3512569c106c4c6868786bb870af1b3b05d3542118ca6bb5c61c57314e7",
+    "rules/waw068.ts": "adbfe84e9b3cdafc072346d87a5df81a97ab07bc5171f3d4abb824c29e9a66a0",
     "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "0ae4376590db47979be144d3ac6cdcfd56c9640d0536421aacf7330459d38e52"
   },
-  "composite": "0863289514a6e704688b98dd03fd728b10c1763269f46a0591689f19bc8f9e24"
+  "composite": "e03cda0c71c249a0fad0b4c921913fe533bf0f3ddcfc9c4758a0f8d66922fb2d"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAQ1F,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAgEpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAQ1F,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA0EpD,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAyDvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAwD3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA8DvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA6D3C,CAAC"}

package/dist/lint/post-synth/waw016.d.ts

@@ -2,12 +2,20 @@
  * WAW016: Deprecated Property Usage
  *
  * Flags properties marked as deprecated in the CloudFormation Registry.
- * Sources: explicit `deprecatedProperties` array + description text mining.
+ *
+ * Two bases feed this, and the finding says which one it stands on (#1701).
+ * A `declared` name comes from the Registry schema's own `deprecatedProperties`
+ * array. An `inferred` name comes from a regex over the property description,
+ * which also matches descriptions that mention the deprecation of a sibling
+ * property, an enum value, or the thing the property configures. Declared is a
+ * warning; inferred is reported at info and worded as a guess.
  */
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+/** What a deprecation classification rests on. */
+export type DeprecationBasis = "declared" | "inferred";
 /**
  * Core detection logic — exported for direct testing with synthetic data.
  */
-export declare function checkDeprecatedProperties(ctx: PostSynthContext, deprecated: Map<string, Set<string>>): PostSynthDiagnostic[];
+export declare function checkDeprecatedProperties(ctx: PostSynthContext, deprecated: Map<string, Map<string, DeprecationBasis>>): PostSynthDiagnostic[];
 export declare const waw016: PostSynthCheck;
 //# sourceMappingURL=waw016.d.ts.map

package/dist/lint/post-synth/waw016.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"waw016.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw016.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAgC9G;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GACnC,mBAAmB,EAAE,CA6BvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}
+{"version":3,"file":"waw016.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw016.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,CAAC;AAuCvD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,GACrD,mBAAmB,EAAE,CAiCvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw064.d.ts

@@ -0,0 +1,17 @@
+/**
+ * WAW064: Transit Gateway Route Table Declares A Blackhole Route
+ *
+ * `AWS::EC2::TransitGatewayRoute` with `Blackhole: true` silently drops any
+ * traffic matching its destination CIDR instead of forwarding it —
+ * CloudFormation deploys this without complaint, and the packet loss only
+ * surfaces downstream as unreachable hosts or a timeout nobody can explain
+ * from the template alone. A blackhole route is sometimes deliberate — an
+ * explicit deny for a CIDR range, or a placeholder pending real
+ * infrastructure — but it is also exactly what a copy-pasted route table or
+ * a forgotten cleanup step leaves behind. Warn so it stays a conscious
+ * choice rather than a silent accident.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkTgwBlackholeRoute(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw064: PostSynthCheck;
+//# sourceMappingURL=waw064.d.ts.map

package/dist/lint/post-synth/waw064.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw064.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw064.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAyBnF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw065.d.ts

@@ -0,0 +1,23 @@
+/**
+ * WAW065: Transit Gateway Route Table Wiring Is Incomplete
+ *
+ * A Transit Gateway route table only does anything once two independent
+ * pieces are both wired up: an `AWS::EC2::TransitGatewayRouteTableAssociation`
+ * (which attachment's traffic is evaluated against this table) and an
+ * `AWS::EC2::TransitGatewayRouteTablePropagation` (which attachments' routes
+ * populate it). CloudFormation is happy to deploy a route table with one but
+ * not the other — the stack succeeds, and the gap only shows up as traffic
+ * that can't find a route. Two patterns, both "declared but half-wired":
+ *
+ *  - a route table has one or more associations but zero propagations — the
+ *    associated attachment's traffic is evaluated against this table, but
+ *    nothing ever populates it with routes;
+ *  - a declared attachment (VPC/VPN/peering, or the generic
+ *    TransitGatewayAttachment) is referenced by neither an association nor
+ *    a propagation anywhere in the template — it hangs off the transit
+ *    gateway with no route table wiring at all.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkTgwRouteTableWiring(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw065: PostSynthCheck;
+//# sourceMappingURL=waw065.d.ts.map

package/dist/lint/post-synth/waw065.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw065.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw065.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAU9G,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAsErF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw066.d.ts

@@ -0,0 +1,25 @@
+/**
+ * WAW066: Private Subnet Route Table Has No Working Default Route
+ *
+ * Cross-resource join: a subnet's outbound path depends on a chain of three
+ * independently-declared resources — the `AWS::EC2::SubnetRouteTableAssociation`
+ * that pins it to a route table, the `AWS::EC2::Route` on that table for
+ * `0.0.0.0/0`, and the gateway that route names. CloudFormation validates
+ * none of this end-to-end: a subnet can be wired to a route table with no
+ * default route at all, or with a default route whose NAT gateway / Transit
+ * Gateway target was renamed or removed elsewhere in the template, and the
+ * stack still deploys clean. The subnet is black-holed — every deploy
+ * succeeds, and the only symptom is a workload with no outbound connectivity.
+ *
+ * A route table with a default route to an `AWS::EC2::InternetGateway` is
+ * treated as a public subnet and is out of scope for this check — this rule
+ * only flags the private case: no default route, or one whose target
+ * (`NatGatewayId` / `TransitGatewayId` / etc.) does not resolve to a
+ * resource declared in the same template. A route naming a target that
+ * exists in the template resolves cleanly and is never flagged, per the
+ * cross-resource contract.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkPrivateSubnetDefaultRoute(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw066: PostSynthCheck;
+//# sourceMappingURL=waw066.d.ts.map

package/dist/lint/post-synth/waw066.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw066.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw066.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAgD9G,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA2E3F;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw067.d.ts

@@ -0,0 +1,24 @@
+/**
+ * WAW067: Single-AZ NAT Gateway Serves Multi-AZ Private Subnets
+ *
+ * Cross-resource join across four resource kinds: a NAT gateway lives in one
+ * subnet, which lives in one Availability Zone; a route table's default
+ * route names the NAT gateway it forwards to; a subnet is pinned to a route
+ * table by an `AWS::EC2::SubnetRouteTableAssociation`. Follow that chain and
+ * a common reliability gap falls out — private subnets in two or more AZs
+ * all defaulting to the *same* NAT gateway. CloudFormation has no opinion on
+ * this; it deploys cleanly. But a NAT gateway lives entirely inside one AZ,
+ * so if that AZ has an outage, every subnet depending on it loses egress —
+ * including the subnets in AZs that were otherwise healthy. The
+ * Well-Architected fix is one NAT gateway per AZ, each serving only its own
+ * AZ's subnets.
+ *
+ * Only fires when the Availability Zones involved are literal strings —
+ * an `Fn::GetAZs`/`Fn::Select`-derived AZ can't be compared statically, so a
+ * subnet without a literal `AvailabilityZone` is silently excluded rather
+ * than guessed at.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkNatGatewaySingleAz(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw067: PostSynthCheck;
+//# sourceMappingURL=waw067.d.ts.map

package/dist/lint/post-synth/waw067.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw067.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw067.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAgFpF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw068.d.ts

@@ -0,0 +1,20 @@
+/**
+ * WAW068: VPN Gateway Has A Single VPN Connection
+ *
+ * An `AWS::EC2::VPNConnection` always gets two tunnels from AWS, but that
+ * redundancy only covers the tunnel pair inside one connection — it does
+ * nothing if the connection's Customer Gateway, on-prem device, or the
+ * single site it terminates at goes down. The reliability boundary that
+ * matters is the connection itself: a `AWS::EC2::VPNGateway` (or a Transit
+ * Gateway used for VPN attachment) with only one `VPNConnection` attached
+ * has no fallback path for hybrid connectivity if that connection's
+ * Customer Gateway or on-prem side fails.
+ *
+ * Cross-resource join: group every declared `VPNConnection` by the gateway
+ * (`VpnGatewayId` or `TransitGatewayId`) it attaches to, and flag any
+ * gateway left with exactly one.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkVpnGatewayRedundancy(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw068: PostSynthCheck;
+//# sourceMappingURL=waw068.d.ts.map

package/dist/lint/post-synth/waw068.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw068.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw068.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAgDtF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.49.0",
+  "version": "0.51.0",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/meta.json

@@ -6222,6 +6222,9 @@
     "deprecatedProperties": [
       "DeleteStorageConnectors"
     ],
+    "inferredDeprecations": [
+      "DeleteStorageConnectors"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -11669,6 +11672,9 @@
     "deprecatedProperties": [
       "AccessControl"
     ],
+    "inferredDeprecations": [
+      "AccessControl"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -14989,6 +14995,9 @@
     "deprecatedProperties": [
       "ComputeModel"
     ],
+    "inferredDeprecations": [
+      "ComputeModel"
+    ],
     "replacementStrategy": "delete_then_create",
     "tagging": {
       "taggable": true,
@@ -15385,6 +15394,9 @@
     "deprecatedProperties": [
       "ComputeModel"
     ],
+    "inferredDeprecations": [
+      "ComputeModel"
+    ],
     "conditionalCreateOnly": [
       "DbNodes"
     ],
@@ -17085,6 +17097,9 @@
     "deprecatedProperties": [
       "Deprecated"
     ],
+    "inferredDeprecations": [
+      "Deprecated"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -29032,6 +29047,9 @@
       "TdeCredentialPassword",
       "DBSecurityGroups"
     ],
+    "inferredDeprecations": [
+      "DBSecurityGroups"
+    ],
     "conditionalCreateOnly": [
       "AutoMinorVersionUpgrade",
       "AvailabilityZone",
@@ -33246,6 +33264,9 @@
     "deprecatedProperties": [
       "ImageScanningConfiguration"
     ],
+    "inferredDeprecations": [
+      "ImageScanningConfiguration"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -41749,6 +41770,9 @@
     "deprecatedProperties": [
       "Runtime"
     ],
+    "inferredDeprecations": [
+      "Runtime"
+    ],
     "conditionalCreateOnly": [
       "DurableConfig"
     ],
@@ -49621,6 +49645,10 @@
       "ElasticGpuSpecifications",
       "ElasticInferenceAccelerators"
     ],
+    "inferredDeprecations": [
+      "ElasticGpuSpecifications",
+      "ElasticInferenceAccelerators"
+    ],
     "conditionalCreateOnly": [
       "AdditionalInfo",
       "Affinity",
@@ -64878,6 +64906,9 @@
     "deprecatedProperties": [
       "DBPort"
     ],
+    "inferredDeprecations": [
+      "DBPort"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,
@@ -100101,6 +100132,9 @@
     "deprecatedProperties": [
       "State"
     ],
+    "inferredDeprecations": [
+      "State"
+    ],
     "tagging": {
       "taggable": true,
       "tagOnCreate": true,

package/dist/okf/index.md

@@ -1727,3 +1727,8 @@ okf_version: '0.2'
 * [WAW061](/rules/WAW061.md) - Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
 * [WAW062](/rules/WAW062.md) - Duplicate export name or explicit resource name within a template — fails at deploy time
 * [WAW063](/rules/WAW063.md) - IAM policy denies an action another attached policy on the same role allows — explicit Deny wins, runtime 403
+* [WAW064](/rules/WAW064.md) - Transit Gateway route table declares a Blackhole route — confirm the traffic drop is intentional, not an accident
+* [WAW065](/rules/WAW065.md) - Transit Gateway route table has associations but no propagations, or an attachment wired into no route table
+* [WAW066](/rules/WAW066.md) - Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+* [WAW067](/rules/WAW067.md) - A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress
+* [WAW068](/rules/WAW068.md) - VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity

package/dist/okf/rules/WAW064.md

@@ -0,0 +1,18 @@
+---
+type: post-synth-check
+title: WAW064
+description: Transit Gateway route table declares a Blackhole route — confirm the traffic drop is intentional, not an accident
+id: WAW064
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Transit Gateway route table declares a Blackhole route — confirm the traffic drop is intentional, not an accident
+
+## Applies to
+
+- [Table](/types/Table.md)
+- [TransitGateway](/types/TransitGateway.md)
+- [TransitGatewayRoute](/types/TransitGatewayRoute.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW065.md

@@ -0,0 +1,25 @@
+---
+type: post-synth-check
+title: WAW065
+description: Transit Gateway route table has associations but no propagations, or an attachment wired into no route table
+id: WAW065
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Transit Gateway route table has associations but no propagations, or an attachment wired into no route table
+
+## Applies to
+
+- [Map](/types/Map.md)
+- [Table](/types/Table.md)
+- [TransitGateway](/types/TransitGateway.md)
+- [TransitGatewayAttachment](/types/TransitGatewayAttachment.md)
+- [TransitGatewayPeeringAttachment](/types/TransitGatewayPeeringAttachment.md)
+- [TransitGatewayRoute](/types/TransitGatewayRoute.md)
+- [TransitGatewayRouteTable](/types/TransitGatewayRouteTable.md)
+- [TransitGatewayRouteTableAssociation](/types/TransitGatewayRouteTableAssociation.md)
+- [TransitGatewayRouteTablePropagation](/types/TransitGatewayRouteTablePropagation.md)
+- [TransitGatewayVpcAttachment](/types/TransitGatewayVpcAttachment.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW066.md

@@ -0,0 +1,22 @@
+---
+type: post-synth-check
+title: WAW066
+description: Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+id: WAW066
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+
+## Applies to
+
+- [EC2Route](/types/EC2Route.md)
+- [InternetGateway](/types/InternetGateway.md)
+- [Map](/types/Map.md)
+- [RouteTable](/types/RouteTable.md)
+- [Subnet](/types/Subnet.md)
+- [SubnetRouteTableAssociation](/types/SubnetRouteTableAssociation.md)
+- [Table](/types/Table.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW067.md

@@ -0,0 +1,20 @@
+---
+type: post-synth-check
+title: WAW067
+description: A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress
+id: WAW067
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress
+
+## Applies to
+
+- [EC2Route](/types/EC2Route.md)
+- [Map](/types/Map.md)
+- [NatGateway](/types/NatGateway.md)
+- [Subnet](/types/Subnet.md)
+- [SubnetRouteTableAssociation](/types/SubnetRouteTableAssociation.md)
+- [Type](/types/Type.md)

package/dist/okf/rules/WAW068.md

@@ -0,0 +1,19 @@
+---
+type: post-synth-check
+title: WAW068
+description: VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity
+id: WAW068
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity
+
+## Applies to
+
+- [Map](/types/Map.md)
+- [TransitGateway](/types/TransitGateway.md)
+- [Type](/types/Type.md)
+- [VPNConnection](/types/VPNConnection.md)
+- [VPNGateway](/types/VPNGateway.md)

package/dist/okf/types/EC2Route.md

@@ -35,3 +35,5 @@ resource_type: AWS::EC2::Route
 ## Governed by
 
 - [WAW030](/rules/WAW030.md): Missing DependsOn for known CloudFormation ordering patterns
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+- [WAW067](/rules/WAW067.md): A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress

package/dist/okf/types/InternetGateway.md

@@ -16,3 +16,7 @@ resource_type: AWS::EC2::InternetGateway
 ## Attributes
 
 - `InternetGatewayId`
+
+## Governed by
+
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template

package/dist/okf/types/Map.md

@@ -36,3 +36,7 @@ resource_type: AWS::Location::Map
 - [WAW036](/rules/WAW036.md): Non-ASCII characters in EC2/IAM/CW string properties — rejected at changeset time
 - [WAW059](/rules/WAW059.md): Wildcard Resource where the declared graph enumerates the touched set — tighten to the consumers' declared Arns
 - [WAW062](/rules/WAW062.md): Duplicate export name or explicit resource name within a template — fails at deploy time
+- [WAW065](/rules/WAW065.md): Transit Gateway route table has associations but no propagations, or an attachment wired into no route table
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+- [WAW067](/rules/WAW067.md): A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress
+- [WAW068](/rules/WAW068.md): VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity

package/dist/okf/types/NatGateway.md

@@ -35,3 +35,7 @@ resource_type: AWS::EC2::NatGateway
 - `EniId`
 - `NatGatewayId`
 - `RouteTableId`
+
+## Governed by
+
+- [WAW067](/rules/WAW067.md): A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress

package/dist/okf/types/RouteTable.md

@@ -17,3 +17,7 @@ resource_type: AWS::EC2::RouteTable
 ## Attributes
 
 - `RouteTableId`
+
+## Governed by
+
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template

package/dist/okf/types/Subnet.md

@@ -42,3 +42,5 @@ resource_type: AWS::EC2::Subnet
 ## Governed by
 
 - [WAW061](/rules/WAW061.md): Subnet CidrBlock falls outside its VPC's CidrBlock — fails at deploy time
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+- [WAW067](/rules/WAW067.md): A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress

package/dist/okf/types/SubnetRouteTableAssociation.md

@@ -17,3 +17,8 @@ resource_type: AWS::EC2::SubnetRouteTableAssociation
 ## Attributes
 
 - `Id`
+
+## Governed by
+
+- [WAW066](/rules/WAW066.md): Private subnet's route table has no default route, or its default route targets a gateway that does not exist in the template
+- [WAW067](/rules/WAW067.md): A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress