@intentius/chant-lexicon-aws 0.52.0 → 0.52.2

package/dist/api/read-client.d.ts

@@ -155,6 +155,18 @@ export interface StackResource {
 }
 /** `DescribeStackResources` for one stack, mapped off the Query XML. */
 export declare function describeStackResources(stackName: string, options?: AwsReadClientOptions): Promise<StackResource[]>;
+/** One stack's `DescribeStacks` answer: its outputs and its own tags. */
+export interface StackDetail {
+    outputs: Record<string, string>;
+    /** The stack's own tags, as a flat map — where the ownership marker lives (#1222). */
+    tags: Record<string, string>;
+}
+/**
+ * `DescribeStacks` for one stack, outputs and tags off the same response. The
+ * two ride together because they come from one call: reading the ownership
+ * marker on the observation path (#1998) costs no extra round trip.
+ */
+export declare function describeStackDetail(stackName: string, options?: AwsReadClientOptions): Promise<StackDetail>;
 /** `DescribeStacks` outputs for one stack, as `key → value`. */
 export declare function describeStackOutputs(stackName: string, options?: AwsReadClientOptions): Promise<Record<string, string>>;
 /** One live resource, as Cloud Control describes it. */

package/dist/api/read-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAmC,KAAK,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEpF,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAM1F,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,2EAA2E;AAC3E,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBAHtB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,gGAAgG;IACvF,IAAI,CAAC,EAAE,MAAM,YAAA;CAKzB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,kGAAkG;IAClG,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAWD,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAEpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,oBAAoB,CAGzG;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAE9F;AAqCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAexB;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOlE;AAYD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAItF;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAIrF;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,aAAa,EAAE,CAAC,CAS1B;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOjC;AAID,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAoDD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAQrF;AAWD,8DAA8D;AAC9D,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAGzC;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,EAClC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAqBpC"}
+{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAmC,KAAK,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEpF,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAM1F,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,2EAA2E;AAC3E,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBAHtB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,gGAAgG;IACvF,IAAI,CAAC,EAAE,MAAM,YAAA;CAKzB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,kGAAkG;IAClG,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAWD,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAEpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,oBAAoB,CAGzG;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAE9F;AAqCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAexB;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOlE;AAYD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAItF;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAIrF;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,aAAa,EAAE,CAAC,CAS1B;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEjC;AAID,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAoDD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAQrF;AAWD,8DAA8D;AAC9D,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAGzC;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,EAClC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAqBpC"}

package/dist/index.d.ts

@@ -19,7 +19,7 @@ export { output, isLexiconOutput } from "@intentius/chant/lexicon-output";
 export type { LexiconOutput } from "@intentius/chant/lexicon-output";
 export { awsPlugin } from "./plugin.js";
 export { observeResourcesDeepAws, awsDeepNormalizationHooks, hasOwnershipMarker, DEEP_READABLE_TYPES, AWS_READ_ONLY_NAMES, AWS_SERVICE_DEFAULTS, } from "./deep-observe.js";
-export { describeStackResources, describeStackOutputs, getResource, listResources, parseResourceDescription, resolveEndpointOverride, serviceEndpointEnvVar, AwsReadError, type AwsReadHttp, type AwsReadClientOptions, type CloudControlDescription, type StackResource, type AwsCredentials, type AwsCredentialResolver, type AwsCredentialSource, } from "./api/read-client.js";
+export { describeStackResources, describeStackOutputs, describeStackDetail, getResource, listResources, parseResourceDescription, resolveEndpointOverride, serviceEndpointEnvVar, AwsReadError, type AwsReadHttp, type AwsReadClientOptions, type CloudControlDescription, type StackResource, type StackDetail, type AwsCredentials, type AwsCredentialResolver, type AwsCredentialSource, } from "./api/read-client.js";
 export { signRequest, resolveCredentials, EMPTY_PAYLOAD_SHA256, type SigV4Request, } from "./api/sigv4.js";
 export { Sub, Ref, GetAtt, If, Join, Select, Split, Base64, GetAZs, SubIntrinsic, RefIntrinsic, GetAttIntrinsic, IfIntrinsic, JoinIntrinsic, SelectIntrinsic, SplitIntrinsic, Base64Intrinsic, GetAZsIntrinsic, } from "./intrinsics.js";
 export { AWS, StackName, Region, AccountId, StackId, URLSuffix, NoValue, NotificationARNs, Partition, } from "./pseudo.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAK9D,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,8BAA8B,EAC9B,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxG,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAQrF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGxE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAC/F,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAC/G,kBAAkB,EAClB,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAC1D,kBAAkB,EAClB,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,2BAA2B,EAAE,gBAAgB,EAC7D,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5E,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAChO,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAC1H,uBAAuB,EACvB,oBAAoB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,eAAe,EAAE,eAAe,EAC5G,uBAAuB,EACvB,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAClF,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,EAChG,0BAA0B,EAC1B,oBAAoB,EAAE,oBAAoB,EAC1C,qBAAqB,EAAE,sBAAsB,GAC9C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChI,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAK9D,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,8BAA8B,EAC9B,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxG,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAQrF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGxE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAC/F,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAC/G,kBAAkB,EAClB,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAC1D,kBAAkB,EAClB,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,2BAA2B,EAAE,gBAAgB,EAC7D,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAC5E,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAChO,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAC1H,uBAAuB,EACvB,oBAAoB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,eAAe,EAAE,eAAe,EAC5G,uBAAuB,EACvB,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAClF,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,EAChG,0BAA0B,EAC1B,oBAAoB,EAAE,oBAAoB,EAC1C,qBAAqB,EAAE,sBAAsB,GAC9C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChI,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC"}

package/dist/integrity.json

@@ -1,8 +1,8 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "779ecfda7e4a8ff34566425ad83a8f689e6506cfe63edc1d838aed6a8b027a37",
-    "meta.json": "e7c751a09a871dc5a16e9aeea0b0a149513a7a2a051c923e9a5acf193dc2aef8",
+    "manifest.json": "2bc626775d04c8e8b162da0a076ac5efab827834fc0ea83ae1871b82479cf7ec",
+    "meta.json": "49cbb2ca9b454391a7644e14ee9cfd91bcf906c6af683bf46a182aa85047ecc4",
     "types/index.d.ts": "6d6b37bd14a9b40fb3ff5c66e1cb49be1ae1032de47a4e167cf5f411c943b7f5",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
     "rules/iam-wildcard.ts": "135d7217d278fef50939e605c5da32603ba35674b8c4b5c4d66a06c77903e945",
@@ -15,7 +15,7 @@
     "rules/waw013.ts": "f9b37b955917415a2eb5f4aed7f28b76aff0a6abdb05228dcbb8bc77bc67672a",
     "rules/waw014.ts": "889f1b06899b50f98941d05b029954cf375ac8a130933b98c9586079096216aa",
     "rules/waw015.ts": "071c940fb6432cd8b42a44d083921e9491d5063417839109c10b2bd13dd2032e",
-    "rules/waw016.ts": "5d6b614bcdf3e26d87dd6c4ec67d7c5e698b3bf05db82dc05d8e006da1e0e488",
+    "rules/waw016.ts": "b9538a9c44a58b687a08f74328caecba4236ad3c24c97759e6d69a3b9ce487c0",
     "rules/waw017.ts": "658554008954f71036e23b514dece7063142198fbdca125f11d09026f1d21ab2",
     "rules/waw018.ts": "a4aa83a25104f039a6c5e0f3e1f5b8b65e493b0ba162c985988190a726b90d2f",
     "rules/waw019.ts": "f14ebf024a3cce7005d54c762e4e0979537d6a854fb123344107d40d92a94b5c",
@@ -72,5 +72,5 @@
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "0ae4376590db47979be144d3ac6cdcfd56c9640d0536421aacf7330459d38e52"
   },
-  "composite": "11e032b348578d5cacba6857e6f4d5ec5fc81ad8d4df4e69f206e5350d473f8e"
+  "composite": "d3fda61a74692e9473bb1aeeb31723128b926b4c9a0014ba2d399dfab05473bb"
 }

package/dist/lint/post-synth/waw016.d.ts

@@ -9,6 +9,10 @@
  * which also matches descriptions that mention the deprecation of a sibling
  * property, an enum value, or the thing the property configures. Declared is a
  * warning; inferred is reported at info and worded as a guess.
+ *
+ * A declared name is a flattened Registry pointer path (#1988), so most of them
+ * are nested — `Tags/TagKey`, `Source/Decryption/Url`. The template is walked
+ * along that path; matching top-level keys reached fewer than half of them.
  */
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 /** What a deprecation classification rests on. */

package/dist/lint/post-synth/waw016.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"waw016.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw016.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,CAAC;AAuCvD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,GACrD,mBAAmB,EAAE,CAiCvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}
+{"version":3,"file":"waw016.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw016.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,UAAU,CAAC;AA6DvD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,gBAAgB,EACrB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,GACrD,mBAAmB,EAAE,CAmCvB;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.52.0",
+  "version": "0.52.2",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/meta.json

@@ -13765,8 +13765,8 @@
       "Id"
     ],
     "deprecatedProperties": [
-      "DistributionConfig/properties/CustomOrigin",
-      "DistributionConfig/properties/S3Origin"
+      "DistributionConfig/CustomOrigin",
+      "DistributionConfig/S3Origin"
     ],
     "tagging": {
       "taggable": true,
@@ -21366,9 +21366,9 @@
       "Id"
     ],
     "deprecatedProperties": [
-      "/definitions/ContinuousDeploymentPolicyConfig/properties/Type",
-      "/definitions/ContinuousDeploymentPolicyConfig/properties/SingleHeaderPolicyConfig",
-      "/definitions/ContinuousDeploymentPolicyConfig/properties/SingleWeightPolicyConfig"
+      "ContinuousDeploymentPolicyConfig/Type",
+      "ContinuousDeploymentPolicyConfig/SingleHeaderPolicyConfig",
+      "ContinuousDeploymentPolicyConfig/SingleWeightPolicyConfig"
     ]
   },
   "ContinuousDeploymentPolicyConfig": {
@@ -68321,8 +68321,8 @@
       "DomainName"
     ],
     "conditionalCreateOnly": [
-      "EncryptionAtRestOptions/properties",
-      "AdvancedSecurityOptions/properties/Enabled"
+      "EncryptionAtRestOptions",
+      "AdvancedSecurityOptions/Enabled"
     ],
     "tagging": {
       "taggable": true,

package/dist/okf/rules/WAW016.md

@@ -14,3 +14,4 @@ Deprecated property usage — flags properties marked as deprecated in the Cloud
 
 - [Map](/types/Map.md)
 - [Type](/types/Type.md)
+- [Url](/types/Url.md)

package/dist/okf/types/Url.md

@@ -22,3 +22,7 @@ resource_type: AWS::Lambda::Url
 
 - `FunctionArn`
 - `FunctionUrl`
+
+## Governed by
+
+- [WAW016](/rules/WAW016.md): Deprecated property usage — flags properties marked as deprecated in the CloudFormation Registry

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAoN,MAAM,0BAA0B,CAAC;AAsChR;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aAg+BvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAoN,MAAM,0BAA0B,CAAC;AAuChR;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aAm/BvB,CAAC"}

package/dist/rules/waw016.ts

@@ -9,6 +9,10 @@
  * which also matches descriptions that mention the deprecation of a sibling
  * property, an enum value, or the thing the property configures. Declared is a
  * warning; inferred is reported at info and worded as a guess.
+ *
+ * A declared name is a flattened Registry pointer path (#1988), so most of them
+ * are nested — `Tags/TagKey`, `Source/Decryption/Url`. The template is walked
+ * along that path; matching top-level keys reached fewer than half of them.
  */
 
 import { readFileSync } from "fs";
@@ -56,6 +60,28 @@ function loadDeprecatedProperties(): Map<string, Map<string, DeprecationBasis>>
   return map;
 }
 
+/**
+ * True when `value` expresses `segments` — the flattened Registry pointer path
+ * (#1988), which is a single key for a top-level property and `/`-joined for a
+ * nested one.
+ *
+ * An array met where the pointer named a property is descended anyway: the
+ * Registry elides the wildcard in some schemas, so `Tags/TagKey` addresses a
+ * key inside the Tags array's items.
+ */
+function expressesPath(value: unknown, segments: string[]): boolean {
+  if (segments.length === 0) return true;
+  if (Array.isArray(value)) {
+    const rest = segments[0] === "*" ? segments.slice(1) : segments;
+    return value.some((item) => expressesPath(item, rest));
+  }
+  if (segments[0] === "*") return false;
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value as Record<string, unknown>;
+  if (!Object.prototype.hasOwnProperty.call(obj, segments[0])) return false;
+  return expressesPath(obj[segments[0]], segments.slice(1));
+}
+
 /**
  * Core detection logic — exported for direct testing with synthetic data.
  */
@@ -76,9 +102,11 @@ export function checkDeprecatedProperties(
       if (!deprProps) continue;
 
       const props = resource.Properties ?? {};
-      for (const propName of Object.keys(props)) {
-        const basis = deprProps.get(propName);
-        if (!basis) continue;
+      // Walk each declared path into the template, rather than matching
+      // top-level template keys: over half the declared names are nested
+      // (#1988), and a key comparison could never reach them.
+      for (const [propName, basis] of deprProps) {
+        if (!expressesPath(props, propName.split("/"))) continue;
 
         diagnostics.push({
           checkId: "WAW016",

package/dist/spec/parse.d.ts

@@ -5,6 +5,7 @@
  * resources with properties and attributes, property types from definitions,
  * and enum types from string enum definitions.
  */
+import type { CFNSchema } from "./fetch.js";
 import { constraintsIsEmpty as coreConstraintsIsEmpty, type PropertyConstraints } from "@intentius/chant/codegen/json-schema";
 export type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
 export interface ParsedProperty {
@@ -69,4 +70,19 @@ export declare function cfnShortName(typeName: string): string;
  * Extract service name: "AWS::S3::Bucket" → "S3"
  */
 export declare function cfnServiceName(typeName: string): string;
+/**
+ * Flatten a CloudFormation Registry JSON pointer to the property path a
+ * template expresses, `/`-joined.
+ *
+ * Three shapes occur upstream. `/properties/BucketName` is the plain one.
+ * A pointer can re-enter the `properties` keyword mid-path
+ * (`/properties/DistributionConfig/properties/S3Origin`), which a template
+ * never writes. And a pointer can be scoped to a shared definition
+ * (`/definitions/ContinuousDeploymentPolicyConfig/properties/Type`), which a
+ * template expresses only through whichever property carries that definition.
+ *
+ * Array positions stay as `*`. `readOnlyProperties` attribute names are
+ * generated from this output, so dropping the wildcard would rename them.
+ */
+export declare function stripPointerPath(path: string, schema?: CFNSchema): string;
 //# sourceMappingURL=parse.d.ts.map

package/dist/spec/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAGL,kBAAkB,IAAI,sBAAsB,EAE5C,KAAK,mBAAmB,EAIzB,MAAM,sCAAsC,CAAC;AAG9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAkBhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAClE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9E;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,iBAAiB,CAmJvE;AAiBD,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AAMzD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAoC,MAAM,SAAS,CAAC;AAC3E,OAAO,EAGL,kBAAkB,IAAI,sBAAsB,EAE5C,KAAK,mBAAmB,EAIzB,MAAM,sCAAsC,CAAC;AAG9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAkBhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,mBAAmB,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAClE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9E;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,iBAAiB,CAmJvE;AAiBD,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AAMzD;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvD;AAuDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,CAYzE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.52.0",
+  "version": "0.52.2",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.52.0",
+    "@intentius/chant": "^0.52.2",
     "typescript": "^5.9.3"
   }
 }

package/src/api/read-client.ts

@@ -328,17 +328,40 @@ export async function describeStackResources(
   }));
 }
 
-/** `DescribeStacks` outputs for one stack, as `key → value`. */
-export async function describeStackOutputs(
+/** One stack's `DescribeStacks` answer: its outputs and its own tags. */
+export interface StackDetail {
+  outputs: Record<string, string>;
+  /** The stack's own tags, as a flat map — where the ownership marker lives (#1222). */
+  tags: Record<string, string>;
+}
+
+/**
+ * `DescribeStacks` for one stack, outputs and tags off the same response. The
+ * two ride together because they come from one call: reading the ownership
+ * marker on the observation path (#1998) costs no extra round trip.
+ */
+export async function describeStackDetail(
   stackName: string,
   options: AwsReadClientOptions = {},
-): Promise<Record<string, string>> {
+): Promise<StackDetail> {
   const xml = await cfnQuery("DescribeStacks", { StackName: stackName }, options);
   const outputs: Record<string, string> = {};
   for (const m of xmlMembers(xml, "Outputs")) {
     if (m.OutputKey) outputs[m.OutputKey] = m.OutputValue ?? "";
   }
-  return outputs;
+  const tags: Record<string, string> = {};
+  for (const m of xmlMembers(xml, "Tags")) {
+    if (m.Key) tags[m.Key] = m.Value ?? "";
+  }
+  return { outputs, tags };
+}
+
+/** `DescribeStacks` outputs for one stack, as `key → value`. */
+export async function describeStackOutputs(
+  stackName: string,
+  options: AwsReadClientOptions = {},
+): Promise<Record<string, string>> {
+  return (await describeStackDetail(stackName, options)).outputs;
 }
 
 /* ── Cloud Control ────────────────────────────────────────────────────────── */

package/src/generated/lexicon-aws.json

@@ -13765,8 +13765,8 @@
       "Id"
     ],
     "deprecatedProperties": [
-      "DistributionConfig/properties/CustomOrigin",
-      "DistributionConfig/properties/S3Origin"
+      "DistributionConfig/CustomOrigin",
+      "DistributionConfig/S3Origin"
     ],
     "tagging": {
       "taggable": true,
@@ -21366,9 +21366,9 @@
       "Id"
     ],
     "deprecatedProperties": [
-      "/definitions/ContinuousDeploymentPolicyConfig/properties/Type",
-      "/definitions/ContinuousDeploymentPolicyConfig/properties/SingleHeaderPolicyConfig",
-      "/definitions/ContinuousDeploymentPolicyConfig/properties/SingleWeightPolicyConfig"
+      "ContinuousDeploymentPolicyConfig/Type",
+      "ContinuousDeploymentPolicyConfig/SingleHeaderPolicyConfig",
+      "ContinuousDeploymentPolicyConfig/SingleWeightPolicyConfig"
     ]
   },
   "ContinuousDeploymentPolicyConfig": {
@@ -68321,8 +68321,8 @@
       "DomainName"
     ],
     "conditionalCreateOnly": [
-      "EncryptionAtRestOptions/properties",
-      "AdvancedSecurityOptions/properties/Enabled"
+      "EncryptionAtRestOptions",
+      "AdvancedSecurityOptions/Enabled"
     ],
     "tagging": {
       "taggable": true,

package/src/index.ts

@@ -67,6 +67,7 @@ export {
 export {
   describeStackResources,
   describeStackOutputs,
+  describeStackDetail,
   getResource,
   listResources,
   parseResourceDescription,
@@ -77,6 +78,7 @@ export {
   type AwsReadClientOptions,
   type CloudControlDescription,
   type StackResource,
+  type StackDetail,
   type AwsCredentials,
   type AwsCredentialResolver,
   type AwsCredentialSource,

package/src/lifecycle-integration.test.ts

@@ -33,6 +33,7 @@ const { liveEvidenceFromChangeSet, reconcileStatus } = await import("@intentius/
 const { describeObservationConformance } = await import("@intentius/chant-test-utils");
 const { observeResources } = await import("@intentius/chant/lifecycle/observe");
 const { DECLARABLE_MARKER } = await import("@intentius/chant/declarable");
+const { assertLiveEntity, LiveAssertionError } = await import("@intentius/chant/lifecycle/assert-live");
 
 const liveTemplate = {
   AWSTemplateFormatVersion: "2010-09-09",
@@ -58,10 +59,19 @@ const stackResourcesXml = (rows: Array<{ logicalId: string; type: string; physic
     )
     .join("")}</StackResources></DescribeStackResourcesResponse>`;
 
-const stackOutputsXml = (outputs: Record<string, string> = {}) =>
+const stackOutputsXml = (outputs: Record<string, string> = {}, tags: Record<string, string> = {}) =>
   `<DescribeStacksResponse><Outputs>${Object.entries(outputs)
     .map(([k, v]) => `<member><OutputKey>${k}</OutputKey><OutputValue>${v}</OutputValue></member>`)
-    .join("")}</Outputs></DescribeStacksResponse>`;
+    .join("")}</Outputs><Tags>${Object.entries(tags)
+    .map(([k, v]) => `<member><Key>${k}</Key><Value>${v}</Value></member>`)
+    .join("")}</Tags></DescribeStacksResponse>`;
+
+/** The stack tags a chant apply stamps for one identity (#1222). */
+const ownedStackTags = (stack: string, env: string) => ({
+  "chant:managed-by": "chant",
+  "chant:stack": stack,
+  "chant:env": env,
+});
 
 const queryErrorXml = (code: string, message: string) =>
   `<ErrorResponse><Error><Code>${code}</Code><Message>${message}</Message></Error></ErrorResponse>`;
@@ -122,9 +132,10 @@ describe("aws lifecycle integration (#163)", () => {
       }),
     );
     expect(observedNow.MyBucket?.type).toBe("AWS::S3::Bucket");
-    // Ownership verdicts are total (#1089): DescribeStackResources carries no
-    // tags, so the verdict is an explicit `unknown`, not a missing field.
-    expect(observedNow.MyBucket?.ownership).toBe("unknown");
+    // Ownership verdicts are total (#1089). The stack answered and carries no
+    // chant tags, so the verdict is `foreign` — read, not merely unattempted.
+    expect(observedNow.MyBucket?.ownership).toBe("foreign");
+    expect(observedNow.MyBucket?.marker).toBeUndefined();
 
     // Declared "MyQueue" is absent from live → create; live "MyBucket" is
     // undeclared and unmarked → adopt (never delete without ownership).
@@ -371,16 +382,108 @@ describe("aws lifecycle integration (#163)", () => {
       { errors: [], warnings: [], entities, outputs: new Map([["aws", ""]]) } as never,
       { owned: true, stacks: ["prod-net", "prod-data", "prod-app", "prod-edge"] },
     );
-    const ownership = result.notes.filter((n) => n.includes("ownership filter unavailable"));
+    const ownership = result.notes.filter((n) => n.includes("ownership filter not applied"));
     expect(ownership).toHaveLength(1);
     expect(ownership[0]).toBe(
-      "[aws] ownership filter unavailable on describeResources (no tags from describe-stack-resources) — returning all, each with an explicit `unknown` verdict; use `chant import --from <env> --owned` for ownership-filtered export",
+      "[aws] ownership filter not applied on describeResources (this stack's own tags carry no chant marker, or DescribeStacks did not answer) — returning all, each with the verdict the read supports; use `chant import --from <env> --owned` for ownership-filtered export",
     );
-    expect(result.warnings.join("\n")).not.toContain("ownership filter unavailable");
+    expect(result.warnings.join("\n")).not.toContain("ownership filter not applied");
     expect(warn).not.toHaveBeenCalled();
     expect(error).not.toHaveBeenCalled();
   });
 
+  test("an owned read of a marked stack resolves the marker and carries no note", async () => {
+    stubCfn((action) =>
+      action === "DescribeStackResources"
+        ? { text: stackResourcesXml([{ logicalId: "MyBucket", type: "AWS::S3::Bucket", physicalId: "my-bucket" }]) }
+        : { text: stackOutputsXml({}, ownedStackTags("shop", "prod")) },
+    );
+    const observed = normalizeObservation(
+      await awsPlugin.describeResources!({
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["MyBucket"],
+        entities: new Map(),
+        owned: true,
+      }),
+    );
+    expect(observed.resources.MyBucket?.ownership).toBe("owned");
+    expect(observed.resources.MyBucket?.marker).toEqual({ stack: "shop", env: "prod" });
+    expect(observed.notes).toEqual([]);
+  });
+
+  // --- The ownership marker on the thin read (#1998) ---
+
+  test("a stack tagged for another environment is reported foreign, not unknown", async () => {
+    stubCfn((action) =>
+      action === "DescribeStackResources"
+        ? { text: stackResourcesXml([{ logicalId: "MyBucket", type: "AWS::S3::Bucket", physicalId: "my-bucket" }]) }
+        : { text: stackOutputsXml({}, ownedStackTags("shop", "staging")) },
+    );
+
+    const meta = normalizeObservation(
+      await awsPlugin.describeResources!({
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["MyBucket"],
+        entities: new Map(),
+      }),
+    ).resources.MyBucket;
+    // The marker is the stack's, read back verbatim — which is what makes the
+    // env mismatch visible at all. Before this the field was absent and every
+    // caller had to pass the resource through unverified.
+    expect(meta?.marker).toEqual({ stack: "shop", env: "staging" });
+
+    await expect(
+      assertLiveEntity({
+        plugin: awsPlugin,
+        name: "MyBucket",
+        entityType: "AWS::S3::Bucket",
+        props: {},
+        buildOutput: "",
+        environment: "prod",
+        marker: { stack: "shop", env: "prod" },
+      }),
+    ).rejects.toThrow(LiveAssertionError);
+  });
+
+  test("assertLive passes when the stack's marker is this deploy's", async () => {
+    stubCfn((action) =>
+      action === "DescribeStackResources"
+        ? { text: stackResourcesXml([{ logicalId: "MyBucket", type: "AWS::S3::Bucket", physicalId: "my-bucket" }]) }
+        : { text: stackOutputsXml({}, ownedStackTags("shop", "prod")) },
+    );
+    const meta = await assertLiveEntity({
+      plugin: awsPlugin,
+      name: "MyBucket",
+      entityType: "AWS::S3::Bucket",
+      props: {},
+      buildOutput: "",
+      environment: "prod",
+      marker: { stack: "shop", env: "prod" },
+    });
+    expect(meta.marker).toEqual({ stack: "shop", env: "prod" });
+    expect(meta.ownership).toBe("owned");
+  });
+
+  test("a stack whose tags could not be read stays unknown, never a guess", async () => {
+    stubCfn((action) =>
+      action === "DescribeStackResources"
+        ? { text: stackResourcesXml([{ logicalId: "MyBucket", type: "AWS::S3::Bucket", physicalId: "my-bucket" }]) }
+        : { status: 400, text: queryErrorXml("Throttling", "Rate exceeded") },
+    );
+    const meta = normalizeObservation(
+      await awsPlugin.describeResources!({
+        environment: "prod",
+        buildOutput: "",
+        entityNames: ["MyBucket"],
+        entities: new Map(),
+      }),
+    ).resources.MyBucket;
+    expect(meta?.ownership).toBe("unknown");
+    expect(meta?.marker).toBeUndefined();
+  });
+
   test("an unowned read carries no ownership note", async () => {
     stubCfn((action) =>
       action === "DescribeStackResources"
@@ -428,10 +531,10 @@ describeObservationConformance({
       },
     },
     {
-      // describe-stack-resources also carries no tags to read a stack/env
-      // identity from, so `marker` (#1222) stays absent here — stack-level
-      // handling reads the stack's own tags instead.
-      name: "a healthy stack read",
+      // describe-stack-resources carries no per-resource tags, so a stack whose
+      // own tags carry no marker leaves `marker` (#1222) absent — absent means
+      // absent, never a guess.
+      name: "a healthy read of an unmarked stack",
       declared: ["MyBucket"],
       expectPresent: ["MyBucket"],
       expectNoMarker: ["MyBucket"],
@@ -450,13 +553,54 @@ describeObservationConformance({
       },
     },
     {
-      // aws declares a marker channel on the deep read and on live export, but
-      // not here: describe-stack-resources returns no tags, so the filter has
-      // nothing to filter on. The suite holds it to that — an `owned` verdict
-      // from this path would be a claim the transport cannot support (#1348).
-      name: "an owned read on a path with no marker channel",
+      // The stack's own tags are this path's marker channel (#1998), so every
+      // member of a marked stack carries that stack's identity.
+      name: "a healthy read of a marked stack",
       declared: ["MyBucket"],
       expectPresent: ["MyBucket"],
+      expectMarker: { MyBucket: { stack: "shop", env: "prod" } },
+      run: () => {
+        stubCfn((action) =>
+          action === "DescribeStackResources"
+            ? { text: stackResourcesXml([{ logicalId: "MyBucket", type: "AWS::S3::Bucket", physicalId: "my-bucket" }]) }
+            : { text: stackOutputsXml({}, ownedStackTags("shop", "prod")) },
+        );
+        return awsPlugin.describeResources!({
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["MyBucket"],
+          entities: new Map(),
+        });
+      },
+    },
+    {
+      // aws declares a marker channel here now, so the suite holds the verdict
+      // to `owned`/`foreign` — an `unknown` would mean the declaration is a
+      // claim the transport does not support (#1348).
+      name: "an owned read of a marked stack",
+      declared: ["MyBucket"],
+      expectPresent: ["MyBucket"],
+      owned: true,
+      run: () => {
+        stubCfn((action) =>
+          action === "DescribeStackResources"
+            ? { text: stackResourcesXml([{ logicalId: "MyBucket", type: "AWS::S3::Bucket", physicalId: "my-bucket" }]) }
+            : { text: stackOutputsXml({}, ownedStackTags("shop", "prod")) },
+        );
+        return awsPlugin.describeResources!({
+          environment: "prod",
+          buildOutput: "",
+          entityNames: ["MyBucket"],
+          entities: new Map(),
+          owned: true,
+        });
+      },
+    },
+    {
+      name: "an owned read of an unmarked stack",
+      declared: ["MyBucket"],
+      expectPresent: ["MyBucket"],
+      expectNoMarker: ["MyBucket"],
       owned: true,
       run: () => {
         stubCfn((action) =>

package/src/lint/post-synth/waw016.test.ts

@@ -1,4 +1,7 @@
 import { describe, test, expect } from "vitest";
+import { existsSync, readFileSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
 import { createPostSynthContext } from "@intentius/chant-test-utils";
 import { waw016, checkDeprecatedProperties, type DeprecationBasis } from "./waw016";
 
@@ -195,4 +198,151 @@ describe("WAW016: Deprecated Property Usage", () => {
     expect(bySeverity.get("warning")).toContain("AccessControl");
     expect(bySeverity.get("info")).toContain("ObjectLockConfiguration");
   });
+
+  // --- Nested pointer paths (#1988) ---
+
+  test("a Tags/TagKey entry matches the key inside the Tags array", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Block: {
+          Type: "AWS::AppStream::AppBlock",
+          Properties: {
+            Name: "block",
+            Tags: [{ TagKey: "team", TagValue: "platform" }],
+          },
+        },
+      },
+    });
+    const deprecated = new Map([
+      ["AWS::AppStream::AppBlock", basisMap([["Tags/TagKey", "declared"], ["Tags/TagValue", "declared"]])],
+    ]);
+    const diags = checkDeprecatedProperties(ctx, deprecated);
+    expect(diags).toHaveLength(2);
+    expect(diags.map((d) => d.message).join(" ")).toContain("Tags/TagKey");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].entity).toBe("Block");
+  });
+
+  test("a Tags array carrying only the current keys is clean", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Block: {
+          Type: "AWS::AppStream::AppBlock",
+          Properties: { Tags: [{ Key: "team", Value: "platform" }] },
+        },
+      },
+    });
+    const deprecated = new Map([
+      ["AWS::AppStream::AppBlock", basisMap([["Tags/TagKey", "declared"]])],
+    ]);
+    expect(checkDeprecatedProperties(ctx, deprecated)).toHaveLength(0);
+  });
+
+  test("a nested object path matches", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Flow: {
+          Type: "AWS::MediaConnect::Flow",
+          Properties: {
+            Source: { Name: "src", Decryption: { Url: "https://example.invalid" } },
+          },
+        },
+      },
+    });
+    const deprecated = new Map([
+      ["AWS::MediaConnect::Flow", basisMap([["Source/Decryption/Url", "declared"], ["Source/SenderIpAddress", "declared"]])],
+    ]);
+    const diags = checkDeprecatedProperties(ctx, deprecated);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("Source/Decryption/Url");
+  });
+
+  test("a wildcard segment requires an array member that carries the property", () => {
+    const deprecated = new Map([
+      ["AWS::EC2::SecurityGroup", basisMap([["SecurityGroupEgress/*/SourceSecurityGroupId", "declared"]])],
+    ]);
+    const hit = makeCtx({
+      Resources: {
+        Sg: {
+          Type: "AWS::EC2::SecurityGroup",
+          Properties: {
+            SecurityGroupEgress: [{ IpProtocol: "tcp" }, { IpProtocol: "tcp", SourceSecurityGroupId: "sg-1" }],
+          },
+        },
+      },
+    });
+    expect(checkDeprecatedProperties(hit, deprecated)).toHaveLength(1);
+
+    const miss = makeCtx({
+      Resources: {
+        Sg: {
+          Type: "AWS::EC2::SecurityGroup",
+          Properties: { SecurityGroupEgress: [{ IpProtocol: "tcp" }] },
+        },
+      },
+    });
+    expect(checkDeprecatedProperties(miss, deprecated)).toHaveLength(0);
+  });
+
+  test("a nested path is not matched by a same-named top-level key", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Insight: {
+          Type: "AWS::SecurityHub::Insight",
+          Properties: { Keyword: "unused-top-level" },
+        },
+      },
+    });
+    const deprecated = new Map([
+      ["AWS::SecurityHub::Insight", basisMap([["Filters/Keyword", "declared"]])],
+    ]);
+    expect(checkDeprecatedProperties(ctx, deprecated)).toHaveLength(0);
+  });
+});
+
+/**
+ * The reachability count (#1988). Over half the declared names carry a nested
+ * pointer path, and a flattening regression makes them silently unmatchable
+ * rather than failing anything — so the count of unreachable names is pinned
+ * against the real generated data.
+ */
+describe("WAW016: declared deprecation reachability", () => {
+  const pkgDir = dirname(dirname(dirname(dirname(fileURLToPath(import.meta.url)))));
+  const lexiconPath = join(pkgDir, "src", "generated", "lexicon-aws.json");
+  const hasGenerated = existsSync(lexiconPath);
+
+  interface Entry {
+    kind?: string;
+    resourceType?: string;
+    deprecatedProperties?: string[];
+    inferredDeprecations?: string[];
+  }
+
+  /** A path a template can express: named segments and array wildcards, no JSON Schema keywords. */
+  function isTemplatePath(path: string): boolean {
+    const segments = path.split("/");
+    if (segments.length === 0 || segments[0] === "" || segments[0] === "*") return false;
+    return segments.every((s) => s === "*" || (s.length > 0 && s !== "properties" && s !== "definitions"));
+  }
+
+  test.skipIf(!hasGenerated)("every declared deprecated name is a path a template can express", () => {
+    const data = JSON.parse(readFileSync(lexiconPath, "utf-8")) as Record<string, Entry>;
+    const declared: string[] = [];
+    for (const entry of Object.values(data)) {
+      if (entry.kind !== "resource" || !entry.resourceType) continue;
+      const inferred = new Set(entry.inferredDeprecations ?? []);
+      for (const name of entry.deprecatedProperties ?? []) {
+        if (!inferred.has(name)) declared.push(`${entry.resourceType} :: ${name}`);
+      }
+    }
+
+    const nested = declared.filter((d) => d.split(" :: ")[1].includes("/"));
+    const unreachable = declared.filter((d) => !isTemplatePath(d.split(" :: ")[1]));
+
+    // The spec pin moves, so the totals are a floor rather than an exact
+    // figure; the unreachable count is the one that must stay at zero.
+    expect(declared.length).toBeGreaterThan(0);
+    expect(nested.length).toBeGreaterThan(declared.length / 2);
+    expect(unreachable).toEqual([]);
+  });
 });

package/src/lint/post-synth/waw016.ts

@@ -9,6 +9,10 @@
  * which also matches descriptions that mention the deprecation of a sibling
  * property, an enum value, or the thing the property configures. Declared is a
  * warning; inferred is reported at info and worded as a guess.
+ *
+ * A declared name is a flattened Registry pointer path (#1988), so most of them
+ * are nested — `Tags/TagKey`, `Source/Decryption/Url`. The template is walked
+ * along that path; matching top-level keys reached fewer than half of them.
  */
 
 import { readFileSync } from "fs";
@@ -56,6 +60,28 @@ function loadDeprecatedProperties(): Map<string, Map<string, DeprecationBasis>>
   return map;
 }
 
+/**
+ * True when `value` expresses `segments` — the flattened Registry pointer path
+ * (#1988), which is a single key for a top-level property and `/`-joined for a
+ * nested one.
+ *
+ * An array met where the pointer named a property is descended anyway: the
+ * Registry elides the wildcard in some schemas, so `Tags/TagKey` addresses a
+ * key inside the Tags array's items.
+ */
+function expressesPath(value: unknown, segments: string[]): boolean {
+  if (segments.length === 0) return true;
+  if (Array.isArray(value)) {
+    const rest = segments[0] === "*" ? segments.slice(1) : segments;
+    return value.some((item) => expressesPath(item, rest));
+  }
+  if (segments[0] === "*") return false;
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value as Record<string, unknown>;
+  if (!Object.prototype.hasOwnProperty.call(obj, segments[0])) return false;
+  return expressesPath(obj[segments[0]], segments.slice(1));
+}
+
 /**
  * Core detection logic — exported for direct testing with synthetic data.
  */
@@ -76,9 +102,11 @@ export function checkDeprecatedProperties(
       if (!deprProps) continue;
 
       const props = resource.Properties ?? {};
-      for (const propName of Object.keys(props)) {
-        const basis = deprProps.get(propName);
-        if (!basis) continue;
+      // Walk each declared path into the template, rather than matching
+      // top-level template keys: over half the declared names are nested
+      // (#1988), and a key comparison could never reach them.
+      for (const [propName, basis] of deprProps) {
+        if (!expressesPath(props, propName.split("/"))) continue;
 
         diagnostics.push({
           checkId: "WAW016",

package/src/plugin.ts

@@ -19,7 +19,7 @@ import { applyAwsEndpointArgv } from "./components/cloud-executor";
 import { stackDoesNotExist } from "./stack-errors";
 import {
   AwsReadError,
-  describeStackOutputs,
+  describeStackDetail,
   describeStackResources,
   type AwsReadClientOptions,
   type StackResource,
@@ -37,6 +37,7 @@ import { parseStackTemplate } from "./import/live-export";
 import { awsCompletions } from "./lsp/completions";
 import { awsHover } from "./lsp/hover";
 import { AWS_TAG_OWNERSHIP_KEYS } from "./ownership";
+import { readOwnership } from "@intentius/chant/ownership";
 
 /** Re-exported from ./stack-errors so the long-standing import path (and its
  * tests) keep working now that the deep reader shares the classifier. */
@@ -49,19 +50,24 @@ export { stackDoesNotExist } from "./stack-errors";
  * import parsing, and code generation for AWS CloudFormation.
  */
 /**
- * describe-stack-resources returns no tags, so the ownership filter cannot be
- * applied on this read path. Returned as a run-level note rather than printed
- * (#1265): core says it once per run, after the answer, however many stacks
- * were read. The text is the contract consumers grep for.
+ * The stack's own tags did not resolve a marker for this read, so `owned: true`
+ * withheld nothing. Returned as a run-level note rather than printed (#1265):
+ * core says it once per run, after the answer, however many stacks were read.
+ * The text is the contract consumers grep for.
  */
-const OWNERSHIP_UNAVAILABLE_NOTE =
-  "ownership filter unavailable on describeResources (no tags from describe-stack-resources) — returning all, each with an explicit `unknown` verdict; use `chant import --from <env> --owned` for ownership-filtered export";
+const OWNERSHIP_UNRESOLVED_NOTE =
+  "ownership filter not applied on describeResources (this stack's own tags carry no chant marker, or DescribeStacks did not answer) — returning all, each with the verdict the read supports; use `chant import --from <env> --owned` for ownership-filtered export";
 
 export const awsPlugin: LexiconPlugin = {
   name: "aws",
-  // The thin read is sourced from describe-stack-resources, which returns no
-  // tags — so `owned` on that path can only answer `unknown`, and does (#1348).
-  ownershipChannel: { keys: AWS_TAG_OWNERSHIP_KEYS, reads: ["observeResourcesDeep", "exportResources"] },
+  // The thin read's marker channel is the STACK's own tags (#1998), read off
+  // the DescribeStacks call it already makes for the outputs.
+  // describe-stack-resources carries no per-resource tags, so the stack is the
+  // granularity — the same boundary teardown verifies on (#1222).
+  ownershipChannel: {
+    keys: AWS_TAG_OWNERSHIP_KEYS,
+    reads: ["describeResources", "observeResourcesDeep", "exportResources"],
+  },
   serializer: awsSerializer,
   // Local emulator (#920): Floci + the AWS env that redirects the SDK / observe.
   emulator: FLOCI_EMULATOR,
@@ -568,14 +574,11 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
       ...(options.region ? { region: options.region } : {}),
     };
 
-    // describe-stack-resources does not return tags, so ownership cannot be
-    // determined here. Degrade to detect-only rather than silently filtering,
-    // and say so as a note on the observation. It is a property of the
-    // environment, not of each stack: a four-stack project once printed four
-    // identical copies ahead of every answer (#1265) — enough that an agent
-    // piping `graph --format ir` with `2>&1` had to skip lines to find the
-    // JSON. Core dedupes the note across stacks and prints it with the footer.
-    const notes = options.owned ? [OWNERSHIP_UNAVAILABLE_NOTE] : undefined;
+    // The note for the read paths that never reach the stack's tags at all: a
+    // missing stack, and a failed stack read. Core dedupes it across stacks and
+    // prints it once per run with the footer, rather than ahead of every answer
+    // (#1265).
+    const unresolvedNotes = options.owned ? [OWNERSHIP_UNRESOLVED_NOTE] : undefined;
 
     // Derive stack name. A multi-stack project passes the explicit CloudFormation
     // stack this observation targets (see `stacks` in ChantConfig); otherwise the
@@ -614,7 +617,7 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
           { ...resources, ...identity.resources, ...receiptObs.resources },
           receiptHoles,
           identity.queried,
-          notes,
+          unresolvedNotes,
         );
       }
       // Any other failure (credentials, throttling, a region that can't be
@@ -636,23 +639,41 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
         { ...receiptObs.resources },
         { ...stackHoles, ...receiptObs.unobserved },
         undefined,
-        notes,
+        unresolvedNotes,
       );
     }
 
     // Map logical names from build to stack resources
     const stackResourceMap = new Map(stackResources.map((r) => [r.logicalId, r]));
 
-    // Get stack outputs. A stack whose resources read fine but whose outputs do
-    // not is still a usable observation, so this failure is swallowed exactly as
-    // the non-zero exit code used to be.
+    // Get the stack's outputs and its own tags — one DescribeStacks call. A
+    // stack whose resources read fine but whose DescribeStacks does not is
+    // still a usable observation, so this failure is swallowed exactly as the
+    // non-zero exit code used to be. `undefined` tags mean the call did not
+    // answer, which is an unread channel rather than an absent marker.
     let stackOutputs: Record<string, string> = {};
+    let stackTags: Record<string, string> | undefined;
     try {
-      stackOutputs = await describeStackOutputs(stackName, client);
+      const detail = await describeStackDetail(stackName, client);
+      stackOutputs = detail.outputs;
+      stackTags = detail.tags;
     } catch {
       stackOutputs = {};
+      stackTags = undefined;
     }
 
+    // The marker channel on this path (#1998). describe-stack-resources carries
+    // no per-resource tags, but the stack's own tags carry the identity the
+    // apply paths stamped from the template's `Metadata["chant:ownership"]`
+    // block — the same channel teardown verifies on (#1222). Every member of a
+    // marked stack belongs to that stack's identity, so the verdict and the
+    // marker are the stack's, read back verbatim.
+    const stackMarker = stackTags ? readOwnership(stackTags, AWS_TAG_OWNERSHIP_KEYS) : undefined;
+    const stackOwnership: ResourceMetadata["ownership"] =
+      stackTags === undefined ? "unknown" : stackMarker ? "owned" : "foreign";
+    // `owned: true` withheld nothing, so say why whenever the marker did not resolve.
+    const notes = options.owned && stackMarker === undefined ? unresolvedNotes : undefined;
+
     // The outputs are the stack's, not any member's (#1279). They used to be
     // copied onto every resource's `attributes`, so a VPC carried the stack's
     // `expWebIp` and no `CidrBlock`. They ride the envelope once, keyed by the
@@ -672,14 +693,13 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
         physicalId: stackResource.physicalId ?? "",
         status: stackResource.status ?? "",
         lastUpdated: stackResource.timestamp ?? "",
-        // Total verdict (#1089): describe-stack-resources returns no tags, so
-        // this path cannot read the ownership marker. Say `unknown` explicitly
-        // rather than leaving the field off and letting each consumer guess —
-        // the change set never escalates `unknown` to a delete.
-        // For the same reason `marker` (#1222) stays absent here: no tags, no
-        // stack/env identity to read, and absent means absent — never a guess.
-        // aws teardown is stack-level and reads the stack's own tags instead.
-        ownership: "unknown",
+        // Total verdict (#1089), from the stack's own tags. `unknown` is kept
+        // for the one case that earns it — DescribeStacks did not answer, so
+        // the channel was never read — and the change set never escalates
+        // `unknown` to a delete. `marker` is set only where the stack really
+        // carries one: absent means absent, never a guess.
+        ownership: stackOwnership,
+        ...(stackMarker ? { marker: stackMarker } : {}),
       };
     }
 

package/src/spec/parse.test.ts

@@ -3,7 +3,9 @@ import {
   parseCFNSchema,
   cfnShortName,
   cfnServiceName,
+  stripPointerPath,
 } from "./parse";
+import type { CFNSchema } from "./fetch";
 
 // Sample Registry JSON Schema for testing
 const sampleBucketSchema = JSON.stringify({
@@ -401,6 +403,84 @@ describe("parseCFNSchema", () => {
   });
 });
 
+describe("stripPointerPath (#1988)", () => {
+  const schema = {
+    typeName: "AWS::CloudFront::ContinuousDeploymentPolicy",
+    properties: {
+      ContinuousDeploymentPolicyConfig: { $ref: "#/definitions/ContinuousDeploymentPolicyConfig" },
+      Id: { type: "string" },
+    },
+    definitions: {
+      ContinuousDeploymentPolicyConfig: {
+        type: "object",
+        properties: {
+          Enabled: { type: "boolean" },
+          TrafficConfig: { $ref: "#/definitions/TrafficConfig" },
+        },
+      },
+      TrafficConfig: {
+        type: "object",
+        properties: { Type: { type: "string" } },
+      },
+    },
+  } as unknown as CFNSchema;
+
+  test("strips the top-level prefix", () => {
+    expect(stripPointerPath("/properties/BucketName")).toBe("BucketName");
+  });
+
+  test("keeps a nested path as a template writes it", () => {
+    expect(stripPointerPath("/properties/Tags/TagKey")).toBe("Tags/TagKey");
+    expect(stripPointerPath("/properties/Source/Decryption/Url")).toBe("Source/Decryption/Url");
+  });
+
+  test("drops a mid-path properties keyword", () => {
+    expect(stripPointerPath("/properties/DistributionConfig/properties/S3Origin")).toBe(
+      "DistributionConfig/S3Origin",
+    );
+    expect(stripPointerPath("/properties/EncryptionAtRestOptions/properties")).toBe(
+      "EncryptionAtRestOptions",
+    );
+  });
+
+  test("keeps array wildcards", () => {
+    expect(stripPointerPath("/properties/SecurityGroupEgress/*/SourceSecurityGroupId")).toBe(
+      "SecurityGroupEgress/*/SourceSecurityGroupId",
+    );
+  });
+
+  test("resolves a definition-scoped pointer through the property that carries it", () => {
+    expect(stripPointerPath("/definitions/ContinuousDeploymentPolicyConfig/properties/Enabled", schema)).toBe(
+      "ContinuousDeploymentPolicyConfig/Enabled",
+    );
+    expect(stripPointerPath("/definitions/TrafficConfig/properties/Type", schema)).toBe(
+      "ContinuousDeploymentPolicyConfig/TrafficConfig/Type",
+    );
+  });
+
+  test("leaves a definition nothing declared reaches as the Registry wrote it", () => {
+    expect(stripPointerPath("/definitions/Orphan/properties/Type", schema)).toBe(
+      "/definitions/Orphan/properties/Type",
+    );
+    expect(stripPointerPath("/definitions/Orphan/properties/Type")).toBe(
+      "/definitions/Orphan/properties/Type",
+    );
+  });
+
+  test("a definition reached through an array carries the wildcard", () => {
+    const arraySchema = {
+      typeName: "AWS::Test::Thing",
+      properties: { Rules: { type: "array", items: { $ref: "#/definitions/Rule" } } },
+      definitions: { Rule: { type: "object", properties: { Legacy: { type: "string" } } } },
+    } as unknown as CFNSchema;
+    expect(stripPointerPath("/definitions/Rule/properties/Legacy", arraySchema)).toBe("Rules/*/Legacy");
+  });
+
+  test("passes a non-pointer through", () => {
+    expect(stripPointerPath("BucketName")).toBe("BucketName");
+  });
+});
+
 describe("cfnShortName", () => {
   test("extracts short name from full type", () => {
     expect(cfnShortName("AWS::S3::Bucket")).toBe("Bucket");

package/src/spec/parse.ts

@@ -119,7 +119,7 @@ export function parseCFNSchema(data: string | Buffer): SchemaParseResult {
   const attrs: ParsedAttribute[] = [];
   const seenAttrs = new Set<string>();
   for (const path of schema.readOnlyProperties ?? []) {
-    const attrName = stripPointerPath(path);
+    const attrName = stripPointerPath(path, schema);
 
     // Flatten nested paths: "Endpoint/Address" → attr name "Endpoint.Address"
     const cfnAttr = attrName.replace(/\//g, ".");
@@ -180,7 +180,7 @@ export function parseCFNSchema(data: string | Buffer): SchemaParseResult {
   // can mention the deprecation of a sibling property, of an enum value, or of
   // something the property merely configures.
   const deprecatedSet = new Set<string>(
-    stripPointerPaths(schema.deprecatedProperties ?? []),
+    stripPointerPaths(schema.deprecatedProperties ?? [], schema),
   );
   const inferredDeprecations: string[] = [];
 
@@ -226,12 +226,12 @@ export function parseCFNSchema(data: string | Buffer): SchemaParseResult {
       typeName: schema.typeName,
       properties: props,
       attributes: attrs,
-      createOnly: stripPointerPaths(schema.createOnlyProperties ?? []),
-      writeOnly: stripPointerPaths(schema.writeOnlyProperties ?? []),
-      primaryIdentifier: stripPointerPaths(schema.primaryIdentifier ?? []),
+      createOnly: stripPointerPaths(schema.createOnlyProperties ?? [], schema),
+      writeOnly: stripPointerPaths(schema.writeOnlyProperties ?? [], schema),
+      primaryIdentifier: stripPointerPaths(schema.primaryIdentifier ?? [], schema),
       deprecatedProperties: [...deprecatedSet],
       inferredDeprecations,
-      conditionalCreateOnly: stripPointerPaths(schema.conditionalCreateOnlyProperties ?? []),
+      conditionalCreateOnly: stripPointerPaths(schema.conditionalCreateOnlyProperties ?? [], schema),
       ...(replacementStrategy && { replacementStrategy }),
       ...(tagging && { tagging }),
     },
@@ -277,15 +277,88 @@ export function cfnServiceName(typeName: string): string {
   return parts.length >= 2 ? parts[1] : typeName;
 }
 
+/** Bound on the `$ref` walk that resolves a definition-scoped pointer. */
+const MAX_DEFINITION_PATH_DEPTH = 6;
+
+/** The definition a `#/definitions/Name` ref names, or undefined for anything else. */
+function refDefinitionName(ref: string | undefined): string | undefined {
+  const prefix = "#/definitions/";
+  return ref?.startsWith(prefix) ? ref.slice(prefix.length) : undefined;
+}
+
+function pushProperties(
+  queue: Array<{ path: string[]; node: SchemaProperty }>,
+  path: string[],
+  properties: Record<string, SchemaProperty>,
+): void {
+  for (const [name, prop] of Object.entries(properties)) queue.push({ path: [...path, name], node: prop });
+}
+
 /**
- * Strip JSON pointer path prefix: "/properties/BucketName" → "BucketName"
+ * The property path that reaches `defName`, searched breadth-first from the
+ * top-level properties so the shortest one wins. Undefined when nothing
+ * declared reaches the definition; the pointer is then left as the Registry
+ * wrote it rather than naming a key no template has.
  */
-function stripPointerPath(path: string): string {
-  const prefix = "/properties/";
-  return path.startsWith(prefix) ? path.slice(prefix.length) : path;
+function definitionPropertyPath(defName: string, schema: CFNSchema): string | undefined {
+  const defs = schema.definitions ?? {};
+  const expanded = new Set<string>();
+  const queue: Array<{ path: string[]; node: SchemaProperty }> = [];
+  pushProperties(queue, [], schema.properties ?? {});
+
+  while (queue.length > 0) {
+    const { path, node } = queue.shift()!;
+    if (path.length > MAX_DEFINITION_PATH_DEPTH) continue;
+
+    const ref = refDefinitionName(node.$ref);
+    if (ref === defName) return path.join("/");
+    if (ref !== undefined) {
+      // Shortest path wins, so a definition already reached needs no second visit.
+      if (expanded.has(ref)) continue;
+      expanded.add(ref);
+      const def = defs[ref];
+      if (def?.properties) pushProperties(queue, path, def.properties);
+      continue;
+    }
+
+    if (node.items) {
+      queue.push({ path: [...path, "*"], node: node.items });
+      continue;
+    }
+    if (node.properties) pushProperties(queue, path, node.properties);
+  }
+  return undefined;
+}
+
+/**
+ * Flatten a CloudFormation Registry JSON pointer to the property path a
+ * template expresses, `/`-joined.
+ *
+ * Three shapes occur upstream. `/properties/BucketName` is the plain one.
+ * A pointer can re-enter the `properties` keyword mid-path
+ * (`/properties/DistributionConfig/properties/S3Origin`), which a template
+ * never writes. And a pointer can be scoped to a shared definition
+ * (`/definitions/ContinuousDeploymentPolicyConfig/properties/Type`), which a
+ * template expresses only through whichever property carries that definition.
+ *
+ * Array positions stay as `*`. `readOnlyProperties` attribute names are
+ * generated from this output, so dropping the wildcard would rename them.
+ */
+export function stripPointerPath(path: string, schema?: CFNSchema): string {
+  if (!path.startsWith("/")) return path;
+  const segments = path.split("/").filter((s) => s.length > 0);
+
+  if (segments[0] === "definitions") {
+    const prefix = segments[1] && schema ? definitionPropertyPath(segments[1], schema) : undefined;
+    if (prefix === undefined) return path;
+    return [prefix, ...segments.slice(2).filter((s) => s !== "properties")].join("/");
+  }
+
+  if (segments[0] !== "properties") return path;
+  return segments.slice(1).filter((s) => s !== "properties").join("/");
 }
 
-function stripPointerPaths(paths: string[]): string[] {
+function stripPointerPaths(paths: string[], schema?: CFNSchema): string[] {
   if (paths.length === 0) return [];
-  return paths.map(stripPointerPath);
+  return paths.map((p) => stripPointerPath(p, schema));
 }