/**
 * WAW061: Subnet CIDR Not Contained In VPC CIDR
 *
 * A subnet's CidrBlock must fall entirely inside its VPC's CidrBlock.
 * Stock CDK does not check this — CloudFormation accepts the template and
 * only fails the `AWS::EC2::Subnet` resource at deploy time
 * ("The CIDR ... is invalid" / "does not fall within the CIDR range of the
 * VPC"), after the rest of the stack may have already started rolling out.
 * This is a cheap static graph check: follow the subnet's VpcId Ref to a
 * declared VPC in the same template and do IPv4 CIDR-range math.
 *
 * Stays quiet whenever the graph can't prove it: intrinsic CIDR blocks,
 * IPv6, a VpcId that isn't a simple Ref to a declared AWS::EC2::VPC, or a
 * VPC whose own CidrBlock isn't a literal string.
 */
import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
export declare function checkSubnetCidrContainment(ctx: PostSynthContext): PostSynthDiagnostic[];
export declare const waw061: PostSynthCheck;
//# sourceMappingURL=waw061.d.ts.map