@intentius/chant-lexicon-aws 0.6.0 → 0.8.0

package/dist/lint/post-synth/waw021.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WAW021: RDS Storage Not Encrypted
+ *
+ * Flags RDS instances and clusters without StorageEncrypted: true.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkRdsEncryption(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw021: PostSynthCheck;
+//# sourceMappingURL=waw021.d.ts.map

package/dist/lint/post-synth/waw021.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw021.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw021.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAQ9G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA6B/E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw022.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WAW022: Lambda Not in VPC
+ *
+ * Flags Lambda functions without VpcConfig.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkLambdaVpc(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw022: PostSynthCheck;
+//# sourceMappingURL=waw022.d.ts.map

package/dist/lint/post-synth/waw022.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw022.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw022.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,cAAc,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAwB3E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw023.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WAW023: CloudFront Without WAF
+ *
+ * Flags CloudFront distributions without WebACLId.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkCloudFrontWaf(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw023: PostSynthCheck;
+//# sourceMappingURL=waw023.d.ts.map

package/dist/lint/post-synth/waw023.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw023.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw023.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA4B/E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw024.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WAW024: ALB Without Access Logging
+ *
+ * Flags Application Load Balancers without access logging enabled.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkAlbAccessLogs(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw024: PostSynthCheck;
+//# sourceMappingURL=waw024.d.ts.map

package/dist/lint/post-synth/waw024.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw024.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw024.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAmC/E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw025.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WAW025: SNS Topic Not Encrypted
+ *
+ * Flags SNS topics without KmsMasterKeyId.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkSnsEncryption(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw025: PostSynthCheck;
+//# sourceMappingURL=waw025.d.ts.map

package/dist/lint/post-synth/waw025.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw025.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw025.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAwB/E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw026.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WAW026: SQS Queue Not Encrypted
+ *
+ * Flags SQS queues without SqsManagedSseEnabled or KmsMasterKeyId.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkSqsEncryption(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw026: PostSynthCheck;
+//# sourceMappingURL=waw026.d.ts.map

package/dist/lint/post-synth/waw026.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw026.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw026.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA2B/E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw027.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WAW027: DynamoDB Missing Point-in-Time Recovery
+ *
+ * Flags DynamoDB tables without PointInTimeRecoverySpecification.PointInTimeRecoveryEnabled.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkDynamoDbPitr(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw027: PostSynthCheck;
+//# sourceMappingURL=waw027.d.ts.map

package/dist/lint/post-synth/waw027.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw027.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw027.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA+B9E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw028.d.ts

@@ -0,0 +1,9 @@
+/**
+ * WAW028: EBS Volume Not Encrypted
+ *
+ * Flags EBS volumes without Encrypted: true.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkEbsEncryption(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw028: PostSynthCheck;
+//# sourceMappingURL=waw028.d.ts.map

package/dist/lint/post-synth/waw028.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw028.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw028.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA4B/E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw029.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WAW029: Invalid DependsOn Target
+ *
+ * Detects two cases in the serialized template:
+ * - Dangling reference: DependsOn target not in template.Resources
+ * - Self-reference: Resource depends on itself
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkInvalidDependsOn(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw029: PostSynthCheck;
+//# sourceMappingURL=waw029.d.ts.map

package/dist/lint/post-synth/waw029.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw029.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw029.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAyClF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw030.d.ts

@@ -0,0 +1,19 @@
+/**
+ * WAW030: Missing DependsOn for Known Patterns
+ *
+ * Detects resources that are likely missing a required DependsOn
+ * based on well-known CloudFormation ordering requirements:
+ *
+ * - ECS Service with LoadBalancers but no DependsOn on a Listener
+ * - EC2 Route with GatewayId but no DependsOn on VPCGatewayAttachment
+ * - API Gateway Deployment with no DependsOn on any Method
+ * - API Gateway V2 Deployment with no DependsOn on any Route
+ * - DynamoDB ScalableTarget with no DependsOn on the Table
+ * - ECS ScalableTarget with no DependsOn on the ECS Service
+ * - EKS Addon with hardcoded ClusterName but no DependsOn on the Cluster or Nodegroup
+ * - EKS Nodegroup with hardcoded ClusterName but no DependsOn on the Cluster
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkMissingDependsOn(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw030: PostSynthCheck;
+//# sourceMappingURL=waw030.d.ts.map

package/dist/lint/post-synth/waw030.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw030.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw030.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA2NlF;AAuDD,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw031.d.ts

@@ -0,0 +1,17 @@
+/**
+ * WAW031: EKS Addon Missing ServiceAccountRoleArn
+ *
+ * Certain EKS addons require a ServiceAccountRoleArn (IRSA role) to function.
+ * Without one, the addon pods can't authenticate to AWS APIs and the addon
+ * hangs in CREATING status indefinitely.
+ *
+ * Known addons that require IRSA:
+ * - aws-ebs-csi-driver (needs EBS API access)
+ * - aws-efs-csi-driver (needs EFS API access)
+ * - adot (needs CloudWatch/X-Ray access)
+ * - amazon-cloudwatch-observability (needs CloudWatch access)
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkAddonMissingRole(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw031: PostSynthCheck;
+//# sourceMappingURL=waw031.d.ts.map

package/dist/lint/post-synth/waw031.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw031.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw031.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAW9G,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA+BlF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw032.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WAW032: EFS Transit Encryption Disabled
+ *
+ * Flags EFS volume configurations on Fargate task definitions where transit
+ * encryption has been explicitly disabled. FargateService defaults to ENABLED;
+ * this rule catches intentional opt-outs.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkEfsTransitEncryption(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw032: PostSynthCheck;
+//# sourceMappingURL=waw032.d.ts.map

package/dist/lint/post-synth/waw032.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw032.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw032.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG9G,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA+BtF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw033.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WAW033: Solr Heap Exceeds 50% of Container Memory
+ *
+ * When SOLR_HEAP is set on a Fargate task running a Solr image, validates that
+ * the heap does not exceed 50% of the task's allocated memory. Exceeding this
+ * leaves insufficient headroom for the OS file cache that Lucene MMap relies on,
+ * causing the OOM killer to terminate the container.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkSolrHeapRatio(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw033: PostSynthCheck;
+//# sourceMappingURL=waw033.d.ts.map

package/dist/lint/post-synth/waw033.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw033.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw033.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAiB9G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAkD/E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw034.d.ts

@@ -0,0 +1,11 @@
+/**
+ * WAW034: Solr Container Undersized
+ *
+ * Fargate tasks running a Solr image with less than 2048MB of memory will
+ * fail under any real load — the JVM alone needs headroom for the heap plus
+ * OS file cache for Lucene MMap. 4096MB is the practical production minimum.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkSolrMemoryMinimum(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw034: PostSynthCheck;
+//# sourceMappingURL=waw034.d.ts.map

package/dist/lint/post-synth/waw034.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw034.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw034.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAO9G,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAsCnF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw035.d.ts

@@ -0,0 +1,12 @@
+/**
+ * WAW035: Solr Container Missing nofile Ulimit
+ *
+ * Solr opens a file descriptor for every shard replica, index file, log, and
+ * connection. Without a raised nofile limit the process hits the default kernel
+ * limit (~1024) under moderate load, causing "Too many open files" errors that
+ * bring the node down. The production minimum is 65535.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkSolrUlimits(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw035: PostSynthCheck;
+//# sourceMappingURL=waw035.d.ts.map

package/dist/lint/post-synth/waw035.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw035.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw035.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAS9G,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA2C7E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw036.d.ts

@@ -0,0 +1,21 @@
+/**
+ * WAW036: Non-ASCII Characters in EC2/IAM String Properties
+ *
+ * EC2, IAM, CloudWatch, and other AWS services only accept ASCII 0x20–0x7E in
+ * description, name, and label fields. Non-ASCII characters (em-dashes, curly
+ * quotes, accented letters, etc.) cause the changeset to fail at EarlyValidation
+ * with an opaque "Invalid parameter" error that doesn't name the offending property.
+ *
+ * Properties checked (all must be plain ASCII strings):
+ *   - AWS::EC2::SecurityGroup           GroupDescription
+ *   - AWS::EC2::LaunchTemplate          LaunchTemplateName
+ *   - AWS::IAM::Role                    RoleName
+ *   - AWS::Lambda::Function             FunctionName
+ *   - AWS::RDS::DBSubnetGroup           DBSubnetGroupDescription
+ *   - AWS::CloudWatch::Alarm            AlarmDescription, AlarmName
+ *   - AWS::AutoScaling::AutoScalingGroup AutoScalingGroupName
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkNonAsciiProps(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw036: PostSynthCheck;
+//# sourceMappingURL=waw036.d.ts.map

package/dist/lint/post-synth/waw036.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw036.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw036.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAuB9G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAqC/E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw037.d.ts

@@ -0,0 +1,21 @@
+/**
+ * WAW037: Null Values in CloudFormation Resource Properties
+ *
+ * `resource.PropName` where PropName is not a real GetAtt attribute returns null
+ * silently in chant's AttrRef system — the TypeScript types say `string` but the
+ * runtime value is null. This produces a template with literal null values that
+ * CloudFormation rejects at changeset time with an unhelpful "Invalid template"
+ * error.
+ *
+ * Common causes:
+ *   - `resource.SomeId` instead of `Ref(resource)` (use Ref for the primary identifier)
+ *   - `resource.SomeProp` where SomeProp is not listed in AWS CloudFormation GetAtt docs
+ *   - Typo in an attribute name (e.g. `resource.GroupName` vs `resource.GroupId`)
+ *
+ * This check scans every resource's Properties for null values at any depth and
+ * reports the logical resource ID and dotted property path.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkNullProperties(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw037: PostSynthCheck;
+//# sourceMappingURL=waw037.d.ts.map

package/dist/lint/post-synth/waw037.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw037.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw037.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AA2B9G,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CA0BhF;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/rules/hardcoded-region.d.ts

@@ -0,0 +1,9 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+/**
+ * WAW001: Hardcoded AWS Region
+ *
+ * Detects hardcoded AWS region strings in code.
+ * Regions should use AWS.Region pseudo-parameter instead.
+ */
+export declare const hardcodedRegionRule: LintRule;
+//# sourceMappingURL=hardcoded-region.d.ts.map

package/dist/lint/rules/hardcoded-region.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-region.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/hardcoded-region.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAkCjC,CAAC"}

package/dist/lint/rules/iam-wildcard.d.ts

@@ -0,0 +1,9 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+/**
+ * WAW009: IAM Wildcard Resource
+ *
+ * Detects IAM policies with wildcard (*) resources.
+ * Policies should specify explicit resources for better security.
+ */
+export declare const iamWildcardRule: LintRule;
+//# sourceMappingURL=iam-wildcard.d.ts.map

package/dist/lint/rules/iam-wildcard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-wildcard.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/iam-wildcard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,QAyD7B,CAAC"}

package/dist/lint/rules/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * AWS-specific lint rules for chant projects
+ */
+export { hardcodedRegionRule } from "./hardcoded-region.js";
+export { s3EncryptionRule } from "./s3-encryption.js";
+export { iamWildcardRule } from "./iam-wildcard.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/lint/rules/s3-encryption.d.ts

@@ -0,0 +1,9 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+/**
+ * WAW006: S3 Bucket Encryption
+ *
+ * Detects S3 Bucket creation without encryption configuration.
+ * All S3 buckets should have server-side encryption enabled.
+ */
+export declare const s3EncryptionRule: LintRule;
+//# sourceMappingURL=s3-encryption.d.ts.map

package/dist/lint/rules/s3-encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-encryption.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/s3-encryption.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAGxF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,QA2D9B,CAAC"}

package/dist/lsp/completions.d.ts

@@ -0,0 +1,6 @@
+import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
+/**
+ * Provide AWS completions based on context.
+ */
+export declare function awsCompletions(ctx: CompletionContext): CompletionItem[];
+//# sourceMappingURL=completions.d.ts.map

package/dist/lsp/completions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEvE"}

package/dist/lsp/hover.d.ts

@@ -0,0 +1,6 @@
+import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
+/**
+ * Provide hover information for AWS resource types and properties.
+ */
+export declare function awsHover(ctx: HoverContext): HoverInfo | undefined;
+//# sourceMappingURL=hover.d.ts.map

package/dist/lsp/hover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAa1E;;GAEG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAEjE"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [