@thejoseki/clawform 2.3.1 → 2.4.0

package/src/lib/cfn-yaml.js

@@ -1,92 +1,92 @@
-// Shared CloudFormation-YAML helpers.
-//
-// CloudFormation templates use short-tag intrinsics (`!Ref`, `!Sub`, `!GetAtt`,
-// …) that stock js-yaml rejects. This module owns the one CFN-aware schema and
-// the small extractors built on it, so every caller parses templates the same
-// way instead of re-declaring tag tables.
-//
-// The schema is construct-only: `!Sub "x"` becomes `{ 'Fn::Sub': 'x' }`. We only
-// ever READ the parsed shape (we never dump back through it here), so the long
-// form is convenient and lossless for our purposes.
-//
-// Used by:
-//   - src/lib/lint-overrides.js   (inject / detect cfn-guard suppressions)
-//   - src/aws/exports.js          (export-lock + frozen-export pre-checks)
-
-import yaml from 'js-yaml';
-
-const CFN_TAGS = {
-  '!Ref': 'Ref', '!Sub': 'Fn::Sub', '!GetAtt': 'Fn::GetAtt',
-  '!ImportValue': 'Fn::ImportValue', '!Join': 'Fn::Join',
-  '!Select': 'Fn::Select', '!Split': 'Fn::Split',
-  '!FindInMap': 'Fn::FindInMap', '!If': 'Fn::If',
-  '!Equals': 'Fn::Equals', '!And': 'Fn::And', '!Or': 'Fn::Or',
-  '!Not': 'Fn::Not', '!Base64': 'Fn::Base64', '!Cidr': 'Fn::Cidr',
-  '!GetAZs': 'Fn::GetAZs', '!Condition': 'Condition',
-  '!Transform': 'Fn::Transform',
-};
-
-export const CFN_SCHEMA = yaml.DEFAULT_SCHEMA.extend(
-  Object.entries(CFN_TAGS).flatMap(([tag, long]) =>
-    ['scalar', 'sequence', 'mapping'].map(
-      (kind) => new yaml.Type(tag, { kind, construct: (data) => ({ [long]: data }) }),
-    ),
-  ),
-);
-
-// Best-effort parse of a CloudFormation template body. Returns the parsed doc,
-// or null on any parse error (unknown short tag, malformed YAML). Callers treat
-// null as "couldn't inspect" and fail open — the real linters / changeset still
-// run against the original file and surface the parse problem with their own
-// diagnostics. Mirrors the contract in lint-overrides.js.
-export function loadCfnTemplate(body) {
-  try {
-    const doc = yaml.load(body, { schema: CFN_SCHEMA });
-    return doc && typeof doc === 'object' ? doc : null;
-  } catch {
-    return null;
-  }
-}
-
-// Set of Output logical keys (OutputKey) that still declare an `Export.Name`.
-//
-// Why keys, not export-name values: an Output's logical key is a plain YAML map
-// key — exact string, intrinsic-free. The export *value* (`Export.Name`) is
-// frequently an intrinsic (`!Sub "${EnvName}-..."`) we can't resolve offline.
-// Live stack Outputs report both the OutputKey AND the resolved ExportName, so
-// matching live→template by OutputKey lets us detect an export removal with zero
-// false positives — see findRemovedExports() in src/aws/exports.js.
-export function extractExportingOutputKeys(doc) {
-  const keys = new Set();
-  const outputs = doc && typeof doc === 'object' ? doc.Outputs : null;
-  if (!outputs || typeof outputs !== 'object') return keys;
-  for (const [key, out] of Object.entries(outputs)) {
-    if (!out || typeof out !== 'object') continue;
-    const exp = out.Export;
-    // Export.Name truthy → this output still exports. The Name may be a string
-    // or an intrinsic object (e.g. { 'Fn::Sub': '...' }); presence is all we need.
-    if (exp && typeof exp === 'object' && exp.Name != null && exp.Name !== '') {
-      keys.add(key);
-    }
-  }
-  return keys;
-}
-
-// Set of Export.Name values that are plain string literals (intrinsics like
-// `!Sub "${EnvName}-…"` can't be resolved offline and are skipped). Two users:
-//   - export-lock pre-check: a live export whose name still appears as a literal
-//     Export.Name in the new template was merely moved to a different OutputKey,
-//     not removed — skipping it kills the false positive on OutputKey renames.
-//   - frozen-export introduction gate: a literal Export.Name matching a legacy
-//     prefix is refused before it ever goes live.
-export function extractLiteralExportNames(doc) {
-  const names = new Set();
-  const outputs = doc && typeof doc === 'object' ? doc.Outputs : null;
-  if (!outputs || typeof outputs !== 'object') return names;
-  for (const out of Object.values(outputs)) {
-    if (!out || typeof out !== 'object') continue;
-    const name = out.Export?.Name;
-    if (typeof name === 'string' && name !== '') names.add(name);
-  }
-  return names;
-}
+// Shared CloudFormation-YAML helpers.
+//
+// CloudFormation templates use short-tag intrinsics (`!Ref`, `!Sub`, `!GetAtt`,
+// …) that stock js-yaml rejects. This module owns the one CFN-aware schema and
+// the small extractors built on it, so every caller parses templates the same
+// way instead of re-declaring tag tables.
+//
+// The schema is construct-only: `!Sub "x"` becomes `{ 'Fn::Sub': 'x' }`. We only
+// ever READ the parsed shape (we never dump back through it here), so the long
+// form is convenient and lossless for our purposes.
+//
+// Used by:
+//   - src/lib/lint-overrides.js   (inject / detect cfn-guard suppressions)
+//   - src/aws/exports.js          (export-lock + frozen-export pre-checks)
+
+import yaml from 'js-yaml';
+
+const CFN_TAGS = {
+  '!Ref': 'Ref', '!Sub': 'Fn::Sub', '!GetAtt': 'Fn::GetAtt',
+  '!ImportValue': 'Fn::ImportValue', '!Join': 'Fn::Join',
+  '!Select': 'Fn::Select', '!Split': 'Fn::Split',
+  '!FindInMap': 'Fn::FindInMap', '!If': 'Fn::If',
+  '!Equals': 'Fn::Equals', '!And': 'Fn::And', '!Or': 'Fn::Or',
+  '!Not': 'Fn::Not', '!Base64': 'Fn::Base64', '!Cidr': 'Fn::Cidr',
+  '!GetAZs': 'Fn::GetAZs', '!Condition': 'Condition',
+  '!Transform': 'Fn::Transform',
+};
+
+export const CFN_SCHEMA = yaml.DEFAULT_SCHEMA.extend(
+  Object.entries(CFN_TAGS).flatMap(([tag, long]) =>
+    ['scalar', 'sequence', 'mapping'].map(
+      (kind) => new yaml.Type(tag, { kind, construct: (data) => ({ [long]: data }) }),
+    ),
+  ),
+);
+
+// Best-effort parse of a CloudFormation template body. Returns the parsed doc,
+// or null on any parse error (unknown short tag, malformed YAML). Callers treat
+// null as "couldn't inspect" and fail open — the real linters / changeset still
+// run against the original file and surface the parse problem with their own
+// diagnostics. Mirrors the contract in lint-overrides.js.
+export function loadCfnTemplate(body) {
+  try {
+    const doc = yaml.load(body, { schema: CFN_SCHEMA });
+    return doc && typeof doc === 'object' ? doc : null;
+  } catch {
+    return null;
+  }
+}
+
+// Set of Output logical keys (OutputKey) that still declare an `Export.Name`.
+//
+// Why keys, not export-name values: an Output's logical key is a plain YAML map
+// key — exact string, intrinsic-free. The export *value* (`Export.Name`) is
+// frequently an intrinsic (`!Sub "${EnvName}-..."`) we can't resolve offline.
+// Live stack Outputs report both the OutputKey AND the resolved ExportName, so
+// matching live→template by OutputKey lets us detect an export removal with zero
+// false positives — see findRemovedExports() in src/aws/exports.js.
+export function extractExportingOutputKeys(doc) {
+  const keys = new Set();
+  const outputs = doc && typeof doc === 'object' ? doc.Outputs : null;
+  if (!outputs || typeof outputs !== 'object') return keys;
+  for (const [key, out] of Object.entries(outputs)) {
+    if (!out || typeof out !== 'object') continue;
+    const exp = out.Export;
+    // Export.Name truthy → this output still exports. The Name may be a string
+    // or an intrinsic object (e.g. { 'Fn::Sub': '...' }); presence is all we need.
+    if (exp && typeof exp === 'object' && exp.Name != null && exp.Name !== '') {
+      keys.add(key);
+    }
+  }
+  return keys;
+}
+
+// Set of Export.Name values that are plain string literals (intrinsics like
+// `!Sub "${EnvName}-…"` can't be resolved offline and are skipped). Two users:
+//   - export-lock pre-check: a live export whose name still appears as a literal
+//     Export.Name in the new template was merely moved to a different OutputKey,
+//     not removed — skipping it kills the false positive on OutputKey renames.
+//   - frozen-export introduction gate: a literal Export.Name matching a legacy
+//     prefix is refused before it ever goes live.
+export function extractLiteralExportNames(doc) {
+  const names = new Set();
+  const outputs = doc && typeof doc === 'object' ? doc.Outputs : null;
+  if (!outputs || typeof outputs !== 'object') return names;
+  for (const out of Object.values(outputs)) {
+    if (!out || typeof out !== 'object') continue;
+    const name = out.Export?.Name;
+    if (typeof name === 'string' && name !== '') names.add(name);
+  }
+  return names;
+}

package/src/lib/config.js

@@ -1,76 +1,76 @@
-const ENV_KEYS = ['AWS_PROFILE', 'AWS_REGION', 'ACCOUNT_DEV', 'ACCOUNT_STG', 'ACCOUNT_PROD', 'MCP_AWS_SERVER', 'OWNER', 'COST_CENTER'];
-const REQUIRED = ['AWS_PROFILE', 'AWS_REGION'];
-
-export function loadConfig(cliOverrides = {}) {
-  const fromEnv = {};
-  for (const key of ENV_KEYS) {
-    if (process.env[key]) fromEnv[key] = process.env[key];
-  }
-
-  const merged = { ...fromEnv, ...cliOverrides };
-
-  const missing = REQUIRED.filter((k) => !merged[k]);
-  if (missing.length) {
-    throw new Error(
-      `Missing required config: ${missing.join(', ')}. ` +
-      `Set via .claude/settings.local.json "env" block (copy .claude/settings.local.json.example) ` +
-      `or shell env vars (e.g. AWS_PROFILE=acme-admin AWS_REGION=ap-northeast-1).`
-    );
-  }
-
-  return merged;
-}
-
-// Resolve the per-stack tag values. Owner / CostCenter come from a two-source
-// chain: shell env var (per-user, gitignored settings.local.json) wins over
-// clawform.config.json tags_defaults (per-project, committed). Either source
-// alone is sufficient; both unset is a hard error pointing at both options.
-//
-// Why env wins: a developer running locally with their own handle should not
-// have to edit the committed project config. tags_defaults is the team default
-// for CI / CodePipeline / any context without per-user env.
-//
-// Args:
-//   projectConfig — result of loadProjectConfig(). Reads .customer and
-//                   .tags_defaults. Pure data, no I/O.
-//   envName       — the env string ('d' | 'stg' | 'p') passed to deploy().
-//                   Used as the Environment value only.
-//
-// Returns: { Owner, CostCenter, Environment, ManagedBy, Customer }.
-// Callers map this into the stack-level Tags array; the key spelling there
-// (Env vs Environment) is the caller's choice — rules/tagging.md pins it to "Env".
-export function resolveStackTags(projectConfig, envName) {
-  const defaults = (projectConfig && projectConfig.tags_defaults) || {};
-  const envOwner = (process.env.OWNER || '').trim();
-  const envCost = (process.env.COST_CENTER || '').trim();
-  const cfgOwner = typeof defaults.Owner === 'string' ? defaults.Owner.trim() : '';
-  const cfgCost = typeof defaults.CostCenter === 'string' ? defaults.CostCenter.trim() : '';
-
-  const Owner = envOwner || cfgOwner;
-  if (!Owner) {
-    throw new Error(
-      'Owner tag is unset. Set one of:\n' +
-      '  1. OWNER env var (e.g. .claude/settings.local.json "env" block) — per-user override, wins.\n' +
-      '  2. tags_defaults.Owner in clawform.config.json — per-project team default.\n' +
-      'See docs/config-schema.md and rules/tagging.md.'
-    );
-  }
-
-  const CostCenter = envCost || cfgCost;
-  if (!CostCenter) {
-    throw new Error(
-      'CostCenter tag is unset. Set one of:\n' +
-      '  1. COST_CENTER env var (e.g. .claude/settings.local.json "env" block) — per-user override, wins.\n' +
-      '  2. tags_defaults.CostCenter in clawform.config.json — per-project team default.\n' +
-      'See docs/config-schema.md and rules/tagging.md.'
-    );
-  }
-
-  return {
-    Owner,
-    CostCenter,
-    Environment: envName,
-    ManagedBy: 'CloudFormation',
-    Customer: (projectConfig && projectConfig.customer) || '',
-  };
-}
+const ENV_KEYS = ['AWS_PROFILE', 'AWS_REGION', 'ACCOUNT_DEV', 'ACCOUNT_STG', 'ACCOUNT_PROD', 'MCP_AWS_SERVER', 'OWNER', 'COST_CENTER'];
+const REQUIRED = ['AWS_PROFILE', 'AWS_REGION'];
+
+export function loadConfig(cliOverrides = {}) {
+  const fromEnv = {};
+  for (const key of ENV_KEYS) {
+    if (process.env[key]) fromEnv[key] = process.env[key];
+  }
+
+  const merged = { ...fromEnv, ...cliOverrides };
+
+  const missing = REQUIRED.filter((k) => !merged[k]);
+  if (missing.length) {
+    throw new Error(
+      `Missing required config: ${missing.join(', ')}. ` +
+      `Set via .claude/settings.local.json "env" block (copy .claude/settings.local.json.example) ` +
+      `or shell env vars (e.g. AWS_PROFILE=acme-admin AWS_REGION=ap-northeast-1).`
+    );
+  }
+
+  return merged;
+}
+
+// Resolve the per-stack tag values. Owner / CostCenter come from a two-source
+// chain: shell env var (per-user, gitignored settings.local.json) wins over
+// clawform.config.json tags_defaults (per-project, committed). Either source
+// alone is sufficient; both unset is a hard error pointing at both options.
+//
+// Why env wins: a developer running locally with their own handle should not
+// have to edit the committed project config. tags_defaults is the team default
+// for CI / CodePipeline / any context without per-user env.
+//
+// Args:
+//   projectConfig — result of loadProjectConfig(). Reads .customer and
+//                   .tags_defaults. Pure data, no I/O.
+//   envName       — the env string ('d' | 'stg' | 'p') passed to deploy().
+//                   Used as the Environment value only.
+//
+// Returns: { Owner, CostCenter, Environment, ManagedBy, Customer }.
+// Callers map this into the stack-level Tags array; the key spelling there
+// (Env vs Environment) is the caller's choice — rules/tagging.md pins it to "Env".
+export function resolveStackTags(projectConfig, envName) {
+  const defaults = (projectConfig && projectConfig.tags_defaults) || {};
+  const envOwner = (process.env.OWNER || '').trim();
+  const envCost = (process.env.COST_CENTER || '').trim();
+  const cfgOwner = typeof defaults.Owner === 'string' ? defaults.Owner.trim() : '';
+  const cfgCost = typeof defaults.CostCenter === 'string' ? defaults.CostCenter.trim() : '';
+
+  const Owner = envOwner || cfgOwner;
+  if (!Owner) {
+    throw new Error(
+      'Owner tag is unset. Set one of:\n' +
+      '  1. OWNER env var (e.g. .claude/settings.local.json "env" block) — per-user override, wins.\n' +
+      '  2. tags_defaults.Owner in clawform.config.json — per-project team default.\n' +
+      'See docs/config-schema.md and rules/tagging.md.'
+    );
+  }
+
+  const CostCenter = envCost || cfgCost;
+  if (!CostCenter) {
+    throw new Error(
+      'CostCenter tag is unset. Set one of:\n' +
+      '  1. COST_CENTER env var (e.g. .claude/settings.local.json "env" block) — per-user override, wins.\n' +
+      '  2. tags_defaults.CostCenter in clawform.config.json — per-project team default.\n' +
+      'See docs/config-schema.md and rules/tagging.md.'
+    );
+  }
+
+  return {
+    Owner,
+    CostCenter,
+    Environment: envName,
+    ManagedBy: 'CloudFormation',
+    Customer: (projectConfig && projectConfig.customer) || '',
+  };
+}

package/src/lib/constants.js

@@ -1,85 +1,85 @@
-export const ENVS = ['d', 'stg', 'p'];
-
-// The customer token is the widest variable slot in every generated name, and
-// the tightest consumer is the 32-char cap AWS puts on load-balancer and
-// target-group names. Eight characters is what that budget leaves once the
-// longest env, the fixed infix, and a usable project shortname are accounted
-// for — see the arithmetic in templates/alb.yaml. The archetypes'
-// AllowedPattern and the init wizard both have to agree with this number, or
-// the wizard writes a config that fails at deploy time.
-export const CUSTOMER_MAX_LEN = 8;
-export const CUSTOMER_RE = new RegExp(`^[a-z0-9]{1,${CUSTOMER_MAX_LEN}}$`);
-
-// Catalog + inventory are generated from the consumer's own AWS account, so
-// they belong in the consumer's project — not in the plugin checkout, where
-// they would be shared across every project, wiped by `npm update`, and out of
-// reach of the deploy-gate hook (which resolves them relative to the project).
-// Dotted and single-rooted so a buyer gitignores one entry.
-export const CATALOG_DIR_REL = '.clawform/catalog';
-
-export const VISIBILITY_PREFIXES = ['pri', 'pub'];
-
-// When adding: update rules/cfn-standards.md service-shortname table in the same change.
-// Consumers can extend this list via `service_shortnames_extra` in clawform.config.json
-// without forking the plugin.
-export const SERVICE_SHORTNAMES = [
-  'vpc', 'snet', 'sg', 'rt', 'vpce', 'igw', 'nat', 'eip',
-  'alb', 'nlb', 'tg', 'lstn',
-  'ecsc', 'ecss', 'ecr',
-  'rds', 'aur', 'ddb', 'ecache',
-  's3', 'lmbd',
-  'sns', 'sqs', 'glue',
-  'cf', 'r53', 'acm', 'cgnp', 'wafa',
-  'sm', 'cwlg', 'cwa', 'bgt',
-  'iamr', 'kms', 'ec2',
-  'ccmt', 'cbld', 'cpl', 'cdpl',
-];
-
-// The legacy-prefix list moved out of the plugin and into the consumer's
-// clawform.config.json (`legacy_prefixes`). See src/lib/project-config.js
-// and docs/config-schema.md. A fresh consumer with no config has no legacy
-// stacks, so the built-in default is an empty list — we don't impose Acme's
-// LEGACY/OLDAPP freeze on someone else's account.
-
-// Anchored to line-start to defeat prompt-injection via "FORCE LEGACY" inside narrative content.
-export const LEGACY_OVERRIDE_PHRASE = /^\s*#\s*FORCE\s+LEGACY\b/m;
-
-// Stateful CFN resource types per CLAUDE.md hard rule #4. Replace on any of these
-// requires the data-resource gate in src/commands/deploy.js (user must retype stack name).
-//
-// IMPORTANT: list only types that actually hold data. The RDS/EFS/ElastiCache namespaces
-// each contain config types (SubnetGroup, ParameterGroup, MountTarget, OptionGroup, ...)
-// that hold no data — including them via a bare-prefix match would over-fire the safety
-// gate on harmless config Replaces and train operators to ignore the warning. Add new
-// stateful types here explicitly; don't reintroduce DATA_RESOURCE_PREFIXES.
-export const DATA_RESOURCE_EXACT = [
-  // Cognito — a user pool holds every user account; a Replace repoints the
-  // export at a brand-new EMPTY pool. Treated as data per hard rule #4.
-  'AWS::Cognito::UserPool',
-  // S3 / DynamoDB / Logs / Secrets / KMS
-  'AWS::S3::Bucket',
-  'AWS::DynamoDB::Table',
-  'AWS::DynamoDB::GlobalTable',
-  'AWS::Logs::LogGroup',
-  'AWS::SecretsManager::Secret',
-  'AWS::KMS::Key',
-  // RDS — stateful only (DBInstance/Cluster + snapshots; NOT *Group, *Subscription, DBProxy)
-  'AWS::RDS::DBInstance',
-  'AWS::RDS::DBCluster',
-  'AWS::RDS::GlobalCluster',
-  'AWS::RDS::DBClusterSnapshot',
-  'AWS::RDS::DBSnapshot',
-  // EFS — stateful only (FileSystem; NOT MountTarget, AccessPoint, FileSystemPolicy)
-  'AWS::EFS::FileSystem',
-  // ElastiCache — "when persistent" per CLAUDE.md hard rule #4
-  // (NOT SubnetGroup, ParameterGroup, SecurityGroup, User, UserGroup)
-  'AWS::ElastiCache::CacheCluster',
-  'AWS::ElastiCache::ReplicationGroup',
-  'AWS::ElastiCache::GlobalReplicationGroup',
-  'AWS::ElastiCache::ServerlessCache',
-];
-
-export function isDataResource(resourceType) {
-  if (!resourceType) return false;
-  return DATA_RESOURCE_EXACT.includes(resourceType);
-}
+export const ENVS = ['d', 'stg', 'p'];
+
+// The customer token is the widest variable slot in every generated name, and
+// the tightest consumer is the 32-char cap AWS puts on load-balancer and
+// target-group names. Eight characters is what that budget leaves once the
+// longest env, the fixed infix, and a usable project shortname are accounted
+// for — see the arithmetic in templates/alb.yaml. The archetypes'
+// AllowedPattern and the init wizard both have to agree with this number, or
+// the wizard writes a config that fails at deploy time.
+export const CUSTOMER_MAX_LEN = 8;
+export const CUSTOMER_RE = new RegExp(`^[a-z0-9]{1,${CUSTOMER_MAX_LEN}}$`);
+
+// Catalog + inventory are generated from the consumer's own AWS account, so
+// they belong in the consumer's project — not in the plugin checkout, where
+// they would be shared across every project, wiped by `npm update`, and out of
+// reach of the deploy-gate hook (which resolves them relative to the project).
+// Dotted and single-rooted so a buyer gitignores one entry.
+export const CATALOG_DIR_REL = '.clawform/catalog';
+
+export const VISIBILITY_PREFIXES = ['pri', 'pub'];
+
+// When adding: update rules/cfn-standards.md service-shortname table in the same change.
+// Consumers can extend this list via `service_shortnames_extra` in clawform.config.json
+// without forking the plugin.
+export const SERVICE_SHORTNAMES = [
+  'vpc', 'snet', 'sg', 'rt', 'vpce', 'igw', 'nat', 'eip',
+  'alb', 'nlb', 'tg', 'lstn',
+  'ecsc', 'ecss', 'ecr',
+  'rds', 'aur', 'ddb', 'ecache',
+  's3', 'lmbd',
+  'sns', 'sqs', 'glue',
+  'cf', 'r53', 'acm', 'cgnp', 'wafa',
+  'sm', 'cwlg', 'cwa', 'bgt',
+  'iamr', 'kms', 'ec2',
+  'ccmt', 'cbld', 'cpl', 'cdpl',
+];
+
+// The legacy-prefix list moved out of the plugin and into the consumer's
+// clawform.config.json (`legacy_prefixes`). See src/lib/project-config.js
+// and docs/config-schema.md. A fresh consumer with no config has no legacy
+// stacks, so the built-in default is an empty list — we don't impose Acme's
+// LEGACY/OLDAPP freeze on someone else's account.
+
+// Anchored to line-start to defeat prompt-injection via "FORCE LEGACY" inside narrative content.
+export const LEGACY_OVERRIDE_PHRASE = /^\s*#\s*FORCE\s+LEGACY\b/m;
+
+// Stateful CFN resource types per CLAUDE.md hard rule #4. Replace on any of these
+// requires the data-resource gate in src/commands/deploy.js (user must retype stack name).
+//
+// IMPORTANT: list only types that actually hold data. The RDS/EFS/ElastiCache namespaces
+// each contain config types (SubnetGroup, ParameterGroup, MountTarget, OptionGroup, ...)
+// that hold no data — including them via a bare-prefix match would over-fire the safety
+// gate on harmless config Replaces and train operators to ignore the warning. Add new
+// stateful types here explicitly; don't reintroduce DATA_RESOURCE_PREFIXES.
+export const DATA_RESOURCE_EXACT = [
+  // Cognito — a user pool holds every user account; a Replace repoints the
+  // export at a brand-new EMPTY pool. Treated as data per hard rule #4.
+  'AWS::Cognito::UserPool',
+  // S3 / DynamoDB / Logs / Secrets / KMS
+  'AWS::S3::Bucket',
+  'AWS::DynamoDB::Table',
+  'AWS::DynamoDB::GlobalTable',
+  'AWS::Logs::LogGroup',
+  'AWS::SecretsManager::Secret',
+  'AWS::KMS::Key',
+  // RDS — stateful only (DBInstance/Cluster + snapshots; NOT *Group, *Subscription, DBProxy)
+  'AWS::RDS::DBInstance',
+  'AWS::RDS::DBCluster',
+  'AWS::RDS::GlobalCluster',
+  'AWS::RDS::DBClusterSnapshot',
+  'AWS::RDS::DBSnapshot',
+  // EFS — stateful only (FileSystem; NOT MountTarget, AccessPoint, FileSystemPolicy)
+  'AWS::EFS::FileSystem',
+  // ElastiCache — "when persistent" per CLAUDE.md hard rule #4
+  // (NOT SubnetGroup, ParameterGroup, SecurityGroup, User, UserGroup)
+  'AWS::ElastiCache::CacheCluster',
+  'AWS::ElastiCache::ReplicationGroup',
+  'AWS::ElastiCache::GlobalReplicationGroup',
+  'AWS::ElastiCache::ServerlessCache',
+];
+
+export function isDataResource(resourceType) {
+  if (!resourceType) return false;
+  return DATA_RESOURCE_EXACT.includes(resourceType);
+}

package/src/lib/defaults.js

@@ -1,16 +1,16 @@
-// Built-in defaults for Clawform's consumer config. Merged FIRST (lowest precedence)
-// by src/lib/project-config.js. A fresh consumer (no clawform.config.json) sees these
-// values; the dogfood clawform.config.json in this repo overlays the Acme-specific bits.
-
-export const DEFAULT_ENVS = ['d', 'stg', 'p'];
-
-export const DEFAULT_CONFIG = {
-  customer: '',
-  envs: DEFAULT_ENVS,
-  region: '',
-  accounts: {},
-  // Empty by default — we never impose Acme's legacy list on someone else's account.
-  legacy_prefixes: [],
-  service_shortnames_extra: [],
-  tags_defaults: {},
-};
+// Built-in defaults for Clawform's consumer config. Merged FIRST (lowest precedence)
+// by src/lib/project-config.js. A fresh consumer (no clawform.config.json) sees these
+// values; the dogfood clawform.config.json in this repo overlays the Acme-specific bits.
+
+export const DEFAULT_ENVS = ['d', 'stg', 'p'];
+
+export const DEFAULT_CONFIG = {
+  customer: '',
+  envs: DEFAULT_ENVS,
+  region: '',
+  accounts: {},
+  // Empty by default — we never impose Acme's legacy list on someone else's account.
+  legacy_prefixes: [],
+  service_shortnames_extra: [],
+  tags_defaults: {},
+};

package/src/lib/install-workflow.js

@@ -1,28 +1,28 @@
-import { existsSync, mkdirSync, copyFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-// Claude Code has no "workflows" plugin component type — saved workflow
-// scripts are discovered only from a project's own .claude/workflows/ (or
-// ~/.claude/workflows/), never from a plugin's shipped files. This copies
-// the plugin-shipped workflows/audit-all-stacks.js into the CONSUMER
-// project's .claude/workflows/ so `/audit-all-stacks` (or `/workflows`)
-// actually finds it there. Idempotent: never overwrites an existing copy,
-// so a consumer's local customization survives repeated `clawform sync` runs.
-export function ensureWorkflowInstalled({
-  repoRoot,
-  projectDir,
-  exists = existsSync,
-  mkdir = mkdirSync,
-  copyFile = copyFileSync,
-} = {}) {
-  const src = join(repoRoot, 'workflows', 'audit-all-stacks.js');
-  if (!exists(src)) return { installed: false, reason: 'source-missing' };
-
-  const destDir = join(projectDir, '.claude', 'workflows');
-  const dest = join(destDir, 'audit-all-stacks.js');
-  if (exists(dest)) return { installed: false, reason: 'already-present', dest };
-
-  mkdir(destDir, { recursive: true });
-  copyFile(src, dest);
-  return { installed: true, dest };
-}
+import { existsSync, mkdirSync, copyFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+// Claude Code has no "workflows" plugin component type — saved workflow
+// scripts are discovered only from a project's own .claude/workflows/ (or
+// ~/.claude/workflows/), never from a plugin's shipped files. This copies
+// the plugin-shipped workflows/audit-all-stacks.js into the CONSUMER
+// project's .claude/workflows/ so `/audit-all-stacks` (or `/workflows`)
+// actually finds it there. Idempotent: never overwrites an existing copy,
+// so a consumer's local customization survives repeated `clawform sync` runs.
+export function ensureWorkflowInstalled({
+  repoRoot,
+  projectDir,
+  exists = existsSync,
+  mkdir = mkdirSync,
+  copyFile = copyFileSync,
+} = {}) {
+  const src = join(repoRoot, 'workflows', 'audit-all-stacks.js');
+  if (!exists(src)) return { installed: false, reason: 'source-missing' };
+
+  const destDir = join(projectDir, '.claude', 'workflows');
+  const dest = join(destDir, 'audit-all-stacks.js');
+  if (exists(dest)) return { installed: false, reason: 'already-present', dest };
+
+  mkdir(destDir, { recursive: true });
+  copyFile(src, dest);
+  return { installed: true, dest };
+}