@intentius/chant-lexicon-aws 0.124.32 → 0.124.34

package/dist/health.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Runtime health for AWS (#4177): Route 53 health checks and ECS services.
+ *
+ * The stack's own resource list maps each logical id (the graph's node id) to
+ * the physical id the health APIs take. A stack that does not exist yet means
+ * nothing is deployed, so every entity is absent. Any other stack failure is a
+ * hole for every entity, never `unhealthy`.
+ *
+ * - `AWS::Route53::HealthCheck`: `GetHealthCheckStatus`, aggregated as Route 53
+ *   does: healthy when more than 18% of the checkers report healthy.
+ * - `AWS::ECS::Service`: `DescribeServices`, `runningCount` against
+ *   `desiredCount`.
+ *
+ * Both go through the read transport's endpoint rule, so `AWS_ENDPOINT_URL`
+ * (Floci) answers them.
+ */
+import type { HealthEntry, HealthReadOptions, HealthReadResult } from "@intentius/chant/lexicon";
+import { type AwsReadClientOptions } from "./api/read-client.js";
+export declare const AWS_HEALTH_TYPES: readonly ["AWS::Route53::HealthCheck", "AWS::ECS::Service"];
+/** Injectable HTTP for both calls, so tests never reach the network. */
+export type AwsHealthHttp = (method: "GET" | "POST", url: string, init: {
+    headers: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    status: number;
+    text: string;
+}>;
+export interface AwsHealthOptions extends HealthReadOptions {
+    http?: AwsHealthHttp;
+    /** Read client for the stack list and the signing decision. Tests inject `http` and `env` here. */
+    client?: AwsReadClientOptions;
+    now?: () => Date;
+}
+/** One checker's report, as `GetHealthCheckStatus` returns it. */
+export interface CheckerObservation {
+    region?: string;
+    ipAddress?: string;
+    status: string;
+    checkedTime?: string;
+}
+/** Parse `GetHealthCheckStatusResponse`'s observations. */
+export declare function parseHealthCheckStatus(xml: string): CheckerObservation[];
+/** Route 53's verdict over its checkers' observations. */
+export declare function healthCheckEntry(observations: CheckerObservation[], observedAt: string): HealthEntry;
+/** The parts of an ECS service `DescribeServices` returns that decide health. */
+export interface EcsServiceState {
+    status?: string;
+    desiredCount?: number;
+    runningCount?: number;
+    pendingCount?: number;
+    deployments?: Array<{
+        rolloutState?: string;
+        updatedAt?: number | string;
+    }>;
+}
+/** Running against desired. Scaled to zero is `unknown`: nothing is serving, by choice. */
+export declare function ecsServiceEntry(service: EcsServiceState, observedAt: string): HealthEntry;
+/** The cluster a service ARN names: `service/<cluster>/<name>`, or the default cluster for the old `service/<name>` form. */
+export declare function clusterOfServiceArn(arn: string): string;
+export declare function observeHealthAws(options: AwsHealthOptions): Promise<HealthReadResult>;
+//# sourceMappingURL=health.d.ts.map

package/dist/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AACnH,OAAO,EASL,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAI3B,eAAO,MAAM,gBAAgB,YAAI,2BAA2B,EAAE,mBAAmB,CAAU,CAAC;AAE5F,wEAAwE;AACxE,MAAM,MAAM,aAAa,GAAG,CAC1B,MAAM,EAAE,KAAK,GAAG,MAAM,EACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,mGAAmG;IACnG,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAKD,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAcxE;AAOD,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAepG;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7E;AAED,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAazF;AAED,6HAA6H;AAC7H,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD;AAkED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgF3F"}

package/dist/health.js

@@ -0,0 +1,216 @@
+/**
+ * Runtime health for AWS (#4177): Route 53 health checks and ECS services.
+ *
+ * The stack's own resource list maps each logical id (the graph's node id) to
+ * the physical id the health APIs take. A stack that does not exist yet means
+ * nothing is deployed, so every entity is absent. Any other stack failure is a
+ * hole for every entity, never `unhealthy`.
+ *
+ * - `AWS::Route53::HealthCheck`: `GetHealthCheckStatus`, aggregated as Route 53
+ *   does: healthy when more than 18% of the checkers report healthy.
+ * - `AWS::ECS::Service`: `DescribeServices`, `runningCount` against
+ *   `desiredCount`.
+ *
+ * Both go through the read transport's endpoint rule, so `AWS_ENDPOINT_URL`
+ * (Floci) answers them.
+ */
+import { AwsReadError, describeStackResources, requestHeaders, serviceUrl, withChainCredentials, withEndpointOverride, xmlError, xmlLeaves, } from "./api/read-client.js";
+import { resolveCredentials, signRequest } from "./api/sigv4.js";
+import { stackDoesNotExist } from "./stack-errors.js";
+export const AWS_HEALTH_TYPES = ["AWS::Route53::HealthCheck", "AWS::ECS::Service"];
+const defaultHttp = async (method, url, init) => {
+    const res = await fetch(url, { method, headers: init.headers, ...(init.body !== undefined ? { body: init.body } : {}) });
+    return { status: res.status, text: await res.text() };
+};
+/** Route 53 treats an endpoint as healthy when more than this share of checkers says so. */
+const ROUTE53_HEALTHY_SHARE = 0.18;
+/** Parse `GetHealthCheckStatusResponse`'s observations. */
+export function parseHealthCheckStatus(xml) {
+    const out = [];
+    for (const m of xml.matchAll(/<HealthCheckObservation>([\s\S]*?)<\/HealthCheckObservation>/g)) {
+        const body = m[1] ?? "";
+        const report = xmlLeaves(body.match(/<StatusReport>([\s\S]*?)<\/StatusReport>/)?.[1] ?? "");
+        const top = xmlLeaves(body.replace(/<StatusReport>[\s\S]*?<\/StatusReport>/, ""));
+        out.push({
+            ...(top.Region ? { region: top.Region } : {}),
+            ...(top.IPAddress ? { ipAddress: top.IPAddress } : {}),
+            status: report.Status ?? "",
+            ...(report.CheckedTime ? { checkedTime: report.CheckedTime } : {}),
+        });
+    }
+    return out;
+}
+/** A checker's status text starts with `Success` when it found the endpoint healthy. */
+function checkerHealthy(o) {
+    return /^success/i.test(o.status.trim());
+}
+/** Route 53's verdict over its checkers' observations. */
+export function healthCheckEntry(observations, observedAt) {
+    const type = "AWS::Route53::HealthCheck";
+    if (observations.length === 0) {
+        return { type, state: "unknown", detail: "no checker has reported yet", observedAt };
+    }
+    const healthy = observations.filter(checkerHealthy).length;
+    const latest = [...observations].sort((a, b) => (b.checkedTime ?? "").localeCompare(a.checkedTime ?? ""))[0];
+    const state = healthy / observations.length > ROUTE53_HEALTHY_SHARE ? "healthy" : "unhealthy";
+    return {
+        type,
+        state,
+        detail: `${healthy}/${observations.length} checkers healthy; last: ${latest.status}`,
+        observedAt,
+        ...(latest.checkedTime ? { checkedAt: latest.checkedTime } : {}),
+    };
+}
+/** Running against desired. Scaled to zero is `unknown`: nothing is serving, by choice. */
+export function ecsServiceEntry(service, observedAt) {
+    const type = "AWS::ECS::Service";
+    const desired = service.desiredCount ?? 0;
+    const running = service.runningCount ?? 0;
+    const pending = service.pendingCount ?? 0;
+    const counts = `${running}/${desired} running${pending > 0 ? `, ${pending} pending` : ""}`;
+    const rollout = service.deployments?.find((d) => d.rolloutState)?.rolloutState;
+    const detail = `${counts}${rollout ? `, rollout ${rollout}` : ""}`;
+    if (service.status && service.status !== "ACTIVE") {
+        return { type, state: "unhealthy", detail: `service is ${service.status}; ${detail}`, observedAt };
+    }
+    if (desired === 0)
+        return { type, state: "unknown", detail: `desired count is 0; ${detail}`, observedAt };
+    return { type, state: running >= desired ? "healthy" : "unhealthy", detail, observedAt };
+}
+/** The cluster a service ARN names: `service/<cluster>/<name>`, or the default cluster for the old `service/<name>` form. */
+export function clusterOfServiceArn(arn) {
+    const resource = arn.split(":").slice(5).join(":");
+    const parts = resource.split("/");
+    return parts.length >= 3 ? parts[1] : "default";
+}
+function holeFrom(type, err) {
+    const detail = err instanceof AwsReadError && err.code ? `${err.code}: ${err.message}` : err instanceof Error ? err.message : String(err);
+    const reason = /credential|token|expired|AccessDenied|not authorized|Unauthorized/i.test(detail) ? "no-credentials" : "read-failed";
+    return { type, reason, detail: detail.slice(0, 200) };
+}
+async function getHealthCheckStatus(id, client, http) {
+    const options = await withChainCredentials(withEndpointOverride("route53", client));
+    // Route 53 is global: one host, signed in us-east-1.
+    const base = (options.endpoint ?? "https://route53.amazonaws.com").replace(/\/$/, "");
+    const url = `${base}/2013-04-01/healthcheck/${encodeURIComponent(id)}/status`;
+    const env = options.env ?? process.env;
+    const credentials = resolveCredentials(options.credentials, env);
+    const signable = credentials && (!options.endpoint || options.signEndpointOverride === true);
+    const headers = signable
+        ? signRequest({ method: "GET", url, headers: {}, body: "", service: "route53", region: "us-east-1", credentials, ...(options.now ? { now: options.now } : {}) })
+        : {};
+    const res = await http("GET", url, { headers });
+    const err = xmlError(res.text);
+    if (err || res.status >= 400) {
+        throw new AwsReadError(err?.message ?? `GetHealthCheckStatus failed with HTTP ${res.status}`, res.status, err?.code);
+    }
+    return parseHealthCheckStatus(res.text);
+}
+async function describeServices(cluster, arns, client, http) {
+    const options = await withChainCredentials(withEndpointOverride("ecs", client));
+    const url = serviceUrl("ecs", options.endpoint, options.region);
+    const body = JSON.stringify({ cluster, services: arns });
+    const headers = requestHeaders("ecs", url, body, { "content-type": "application/x-amz-json-1.1", "x-amz-target": "AmazonEC2ContainerServiceV20141113.DescribeServices" }, options);
+    const res = await http("POST", url, { headers, body });
+    let parsed = {};
+    try {
+        const value = JSON.parse(res.text);
+        if (value && typeof value === "object" && !Array.isArray(value))
+            parsed = value;
+    }
+    catch {
+        throw new AwsReadError("unparseable DescribeServices response", res.status);
+    }
+    const errType = typeof parsed.__type === "string" ? parsed.__type.split("#").pop() : undefined;
+    if (errType || res.status >= 400) {
+        const message = typeof parsed.message === "string" ? parsed.message : `DescribeServices failed with HTTP ${res.status}`;
+        throw new AwsReadError(message, res.status, errType);
+    }
+    return {
+        services: Array.isArray(parsed.services) ? parsed.services : [],
+        failures: Array.isArray(parsed.failures) ? parsed.failures : [],
+    };
+}
+export async function observeHealthAws(options) {
+    const http = options.http ?? defaultHttp;
+    const observedAt = (options.now?.() ?? new Date()).toISOString();
+    const client = { ...(options.client ?? {}), ...(options.region ? { region: options.region } : {}) };
+    const entities = {};
+    const unobserved = {};
+    const absent = [];
+    if (options.entities.size === 0)
+        return { entities, unobserved, absent };
+    const stackName = options.stack ?? options.environment;
+    let physical;
+    try {
+        const resources = await describeStackResources(stackName, client);
+        physical = new Map(resources.filter((r) => r.physicalId).map((r) => [r.logicalId, r.physicalId]));
+    }
+    catch (err) {
+        if (err instanceof AwsReadError && stackDoesNotExist(err.message))
+            return { entities, unobserved, absent: [...options.entities.keys()] };
+        for (const [name, { entityType }] of options.entities) {
+            unobserved[name] = holeFrom(entityType, err);
+            unobserved[name].detail = `DescribeStackResources failed for stack "${stackName}": ${unobserved[name].detail}`;
+        }
+        return { entities, unobserved, absent };
+    }
+    const services = new Map();
+    const checks = [];
+    for (const [name, { entityType }] of options.entities) {
+        const id = physical.get(name);
+        if (!id) {
+            absent.push(name);
+            continue;
+        }
+        if (entityType === "AWS::ECS::Service") {
+            const cluster = clusterOfServiceArn(id);
+            const list = services.get(cluster) ?? [];
+            list.push({ name, arn: id });
+            services.set(cluster, list);
+        }
+        else if (entityType === "AWS::Route53::HealthCheck") {
+            checks.push({ name, id });
+        }
+    }
+    await Promise.all(checks.map(async ({ name, id }) => {
+        try {
+            entities[name] = healthCheckEntry(await getHealthCheckStatus(id, client, http), observedAt);
+        }
+        catch (err) {
+            if (err instanceof AwsReadError && err.code === "NoSuchHealthCheck")
+                absent.push(name);
+            else
+                unobserved[name] = holeFrom("AWS::Route53::HealthCheck", err);
+        }
+    }));
+    await Promise.all([...services].map(async ([cluster, members]) => {
+        // DescribeServices takes at most ten services per call.
+        for (let i = 0; i < members.length; i += 10) {
+            const batch = members.slice(i, i + 10);
+            try {
+                const { services: found, failures } = await describeServices(cluster, batch.map((m) => m.arn), client, http);
+                for (const member of batch) {
+                    const service = found.find((s) => s.serviceArn === member.arn || s.serviceArn?.endsWith(`/${member.arn.split("/").pop()}`));
+                    const failure = failures.find((f) => f.arn === member.arn);
+                    if (service)
+                        entities[member.name] = ecsServiceEntry(service, observedAt);
+                    else if (failure?.reason === "MISSING")
+                        absent.push(member.name);
+                    else {
+                        unobserved[member.name] = {
+                            type: "AWS::ECS::Service",
+                            reason: "read-failed",
+                            detail: failure?.reason ? `DescribeServices: ${failure.reason}` : "DescribeServices did not return the service",
+                        };
+                    }
+                }
+            }
+            catch (err) {
+                for (const member of batch)
+                    unobserved[member.name] = holeFrom("AWS::ECS::Service", err);
+            }
+        }
+    }));
+    return { entities, unobserved, absent };
+}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "8b5c3aa77344860ff255fdac525e40f63480383c88a4343a6b81d670be7e9621",
+    "manifest.json": "0caff76f30c615cd569668c41563a7ca22dc2c0a8faa435471c3fa8ae5b7120a",
     "meta.json": "3e18663eb9eb09920882f8014020432330a74ccd480689e7384c2022cbb10f39",
     "types/index.d.ts": "8651f9ae166668f4311eea1fe61c3fe235f345947951c1d23d1df24a4fd3384f",
     "rules/hardcoded-region.ts": "957eadcaa9f39cc17d21437565d7a94607d9b082cf28918b178fa067f07498a9",
@@ -69,9 +69,10 @@
     "rules/waw067.ts": "8e66f3512569c106c4c6868786bb870af1b3b05d3542118ca6bb5c61c57314e7",
     "rules/waw068.ts": "adbfe84e9b3cdafc072346d87a5df81a97ab07bc5171f3d4abb824c29e9a66a0",
     "rules/waw069.ts": "4792bb3943d5e08039f45cbf554f45263703288acf4ca01d88ad778083023d27",
+    "rules/waw070.ts": "35bd2281ab072a1d6138e0db9f9d6f4f0b6c5af4deacb28aa693177c654db66a",
     "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "8780b94ce60aded935938d5ef20ea667738354051da1bf9ca6d70d9886f65d21"
   },
-  "composite": "bcbf6790bd0bbc10747eba452f59e6df06b46b350f8add6932ddf6f178ee1e0b"
+  "composite": "57806890c056b83500ed7e1d32c8ccff0869c61229f566321563fb61800ace32"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAgC,MAAM,gCAAgC,CAAC;AASxG,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA2EpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAgC,MAAM,gCAAgC,CAAC;AASxG,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA4EpD,CAAC"}

package/dist/lint/audit-catalog.js

@@ -82,6 +82,7 @@ export const awsAuditCatalog = {
     WAW067: auditRule("WAW067", "report-only", "guidance", "Single-AZ NAT gateway serves multi-AZ private subnets", "Add one NAT gateway per Availability Zone and point each AZ's subnets at its own.", { category: "best-practice" }),
     WAW068: auditRule("WAW068", "report-only", "guidance", "VPN Gateway or Transit Gateway has only one attached VPN Connection", "Attach a second VPNConnection (ideally to a separate Customer Gateway) for redundancy.", { category: "best-practice" }),
     WAW069: auditRule("WAW069", "merge-worthy", "guidance", "Template references a condition it never declares", "Declare the condition in the Conditions section (new Condition(...)), or fix the referenced name.", { category: "correctness" }),
+    WAW070: auditRule("WAW070", "merge-worthy", "guidance", "Ref or Fn::GetAtt names something the template doesn't declare", "Reference a resource or parameter in this template. A value from another lexicon's resource arrives as a parameter.", { category: "correctness" }),
 };
 // Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
 applyLineage(awsAuditCatalog, awsAuditLineage);

package/dist/lint/audit-lineage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAqJrD,CAAC"}
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAyJrD,CAAC"}

package/dist/lint/audit-lineage.js

@@ -147,4 +147,8 @@ export const awsAuditLineage = {
     WAW069: [
         { tool: "cfn-lint", rule: "E8002", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E8002", relation: "equivalent" },
     ],
+    WAW070: [
+        { tool: "cfn-lint", rule: "E1012", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E1012", relation: "equivalent" },
+        { tool: "cfn-lint", rule: "E1010", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E1010", relation: "overlaps" },
+    ],
 };

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA+DvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA8D3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAgEvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA+D3C,CAAC"}

package/dist/lint/post-synth/index.js

@@ -59,6 +59,7 @@ import { waw066 } from "./waw066.js";
 import { waw067 } from "./waw067.js";
 import { waw068 } from "./waw068.js";
 import { waw069 } from "./waw069.js";
+import { waw070 } from "./waw070.js";
 export const postSynthChecks = [
     cor020,
     ext001,
@@ -121,4 +122,5 @@ export const postSynthChecks = [
     waw067,
     waw068,
     waw069,
+    waw070,
 ];

package/dist/lint/post-synth/waw070.d.ts

@@ -0,0 +1,14 @@
+/**
+ * WAW070: Ref or Fn::GetAtt names something the template doesn't declare
+ *
+ * A `Ref` must name a resource, a parameter or an `AWS::` pseudo-parameter,
+ * and a `Fn::GetAtt` must name a resource. CloudFormation rejects a template
+ * whose reference names neither (cfn-lint E1012/E1010). chant built such a
+ * template when a value read another lexicon's resource (#4180); the
+ * serializer now turns that into a parameter, and this check catches any
+ * reference still left dangling.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkDanglingRefs(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw070: PostSynthCheck;
+//# sourceMappingURL=waw070.d.ts.map

package/dist/lint/post-synth/waw070.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw070.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw070.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AA8B9G,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAsC9E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw070.js

@@ -0,0 +1,81 @@
+/**
+ * WAW070: Ref or Fn::GetAtt names something the template doesn't declare
+ *
+ * A `Ref` must name a resource, a parameter or an `AWS::` pseudo-parameter,
+ * and a `Fn::GetAtt` must name a resource. CloudFormation rejects a template
+ * whose reference names neither (cfn-lint E1012/E1010). chant built such a
+ * template when a value read another lexicon's resource (#4180); the
+ * serializer now turns that into a parameter, and this check catches any
+ * reference still left dangling.
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+function collectRefs(value, out, seen = new Set()) {
+    if (value === null || typeof value !== "object" || seen.has(value))
+        return;
+    seen.add(value);
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectRefs(item, out, seen);
+        return;
+    }
+    const obj = value;
+    if (typeof obj.Ref === "string" && Object.keys(obj).length === 1) {
+        out.push({ target: obj.Ref, via: "Ref" });
+        return;
+    }
+    const getAtt = obj["Fn::GetAtt"];
+    if (getAtt !== undefined && Object.keys(obj).length === 1) {
+        const target = Array.isArray(getAtt) ? getAtt[0] : typeof getAtt === "string" ? getAtt.split(".")[0] : undefined;
+        if (typeof target === "string")
+            out.push({ target, via: "Fn::GetAtt" });
+        if (Array.isArray(getAtt))
+            collectRefs(getAtt.slice(1), out, seen);
+        return;
+    }
+    for (const v of Object.values(obj))
+        collectRefs(v, out, seen);
+}
+export function checkDanglingRefs(ctx) {
+    const diagnostics = [];
+    for (const [lexicon, output] of ctx.outputs) {
+        if (lexicon !== "aws")
+            continue;
+        const template = parseCFTemplate(output);
+        if (!template?.Resources || typeof template.Resources !== "object")
+            continue;
+        const resources = new Set(Object.keys(template.Resources));
+        const parameters = new Set(Object.keys(template.Parameters ?? {}));
+        const report = (where, value) => {
+            const refs = [];
+            collectRefs(value, refs);
+            for (const ref of refs) {
+                const known = ref.via === "Ref"
+                    ? resources.has(ref.target) || parameters.has(ref.target) || ref.target.startsWith("AWS::")
+                    : resources.has(ref.target);
+                if (known)
+                    continue;
+                diagnostics.push({
+                    checkId: "WAW070",
+                    severity: "error",
+                    message: `${where} has ${ref.via} "${ref.target}", which is not ${ref.via === "Ref" ? "a resource, a parameter or a pseudo-parameter" : "a resource"} in this template`,
+                    entity: where.replace(/^(Resource|Output) /, "").replace(/"/g, ""),
+                    lexicon: "aws",
+                });
+            }
+        };
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            report(`Resource "${logicalId}"`, resource.Properties);
+        }
+        for (const [name, out] of Object.entries(template.Outputs ?? {})) {
+            report(`Output "${name}"`, out?.Value);
+        }
+    }
+    return diagnostics;
+}
+export const waw070 = {
+    id: "WAW070",
+    description: "Ref or Fn::GetAtt names something the template doesn't declare",
+    check(ctx) {
+        return checkDanglingRefs(ctx);
+    },
+};

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.124.32",
+  "version": "0.124.34",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/okf/index.md

@@ -1936,3 +1936,4 @@ okf_version: '0.2'
 * [WAW067](/rules/WAW067.md) - A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress
 * [WAW068](/rules/WAW068.md) - VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity
 * [WAW069](/rules/WAW069.md) - Template references a condition it never declares — resource/output Condition keys, Fn::If, and Condition references must name an entry in the Conditions sec...
+* [WAW070](/rules/WAW070.md) - Ref or Fn::GetAtt names something the template doesn't declare

package/dist/okf/rules/WAW070.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WAW070
+description: Ref or Fn::GetAtt names something the template doesn't declare
+id: WAW070
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Ref or Fn::GetAtt names something the template doesn't declare

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAqQ,MAAM,0BAA0B,CAAC;AAwCjU;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aAujCvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAqQ,MAAM,0BAA0B,CAAC;AAwCjU;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAiBnD,eAAO,MAAM,SAAS,EAAE,aA+jCvB,CAAC"}

package/dist/plugin.js

@@ -791,6 +791,12 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
     },
     /** The noise rules the deep pass applies to both the live and declared trees. */
     deepNormalizationHooks: awsDeepNormalizationHooks,
+    /** Runtime health (#4177): Route 53 health checks and ECS services. Implementation in ./health.ts. */
+    healthTypes: ["AWS::Route53::HealthCheck", "AWS::ECS::Service"],
+    async observeHealth(options) {
+        const { observeHealthAws } = await import("./health.js");
+        return observeHealthAws(options);
+    },
     async describeStackStatus(options) {
         const { getRuntime } = await import("@intentius/chant/runtime-adapter");
         const rt = getRuntime();

package/dist/rules/waw070.ts

@@ -0,0 +1,89 @@
+/**
+ * WAW070: Ref or Fn::GetAtt names something the template doesn't declare
+ *
+ * A `Ref` must name a resource, a parameter or an `AWS::` pseudo-parameter,
+ * and a `Fn::GetAtt` must name a resource. CloudFormation rejects a template
+ * whose reference names neither (cfn-lint E1012/E1010). chant built such a
+ * template when a value read another lexicon's resource (#4180); the
+ * serializer now turns that into a parameter, and this check catches any
+ * reference still left dangling.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate } from "./cf-refs";
+
+interface DanglingRef {
+  target: string;
+  via: "Ref" | "Fn::GetAtt";
+}
+
+function collectRefs(value: unknown, out: DanglingRef[], seen = new Set<unknown>()): void {
+  if (value === null || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    for (const item of value) collectRefs(item, out, seen);
+    return;
+  }
+  const obj = value as Record<string, unknown>;
+  if (typeof obj.Ref === "string" && Object.keys(obj).length === 1) {
+    out.push({ target: obj.Ref, via: "Ref" });
+    return;
+  }
+  const getAtt = obj["Fn::GetAtt"];
+  if (getAtt !== undefined && Object.keys(obj).length === 1) {
+    const target = Array.isArray(getAtt) ? getAtt[0] : typeof getAtt === "string" ? getAtt.split(".")[0] : undefined;
+    if (typeof target === "string") out.push({ target, via: "Fn::GetAtt" });
+    if (Array.isArray(getAtt)) collectRefs(getAtt.slice(1), out, seen);
+    return;
+  }
+  for (const v of Object.values(obj)) collectRefs(v, out, seen);
+}
+
+export function checkDanglingRefs(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [lexicon, output] of ctx.outputs) {
+    if (lexicon !== "aws") continue;
+    const template = parseCFTemplate(output);
+    if (!template?.Resources || typeof template.Resources !== "object") continue;
+
+    const resources = new Set(Object.keys(template.Resources));
+    const parameters = new Set(Object.keys((template.Parameters as Record<string, unknown> | undefined) ?? {}));
+
+    const report = (where: string, value: unknown) => {
+      const refs: DanglingRef[] = [];
+      collectRefs(value, refs);
+      for (const ref of refs) {
+        const known = ref.via === "Ref"
+          ? resources.has(ref.target) || parameters.has(ref.target) || ref.target.startsWith("AWS::")
+          : resources.has(ref.target);
+        if (known) continue;
+        diagnostics.push({
+          checkId: "WAW070",
+          severity: "error",
+          message: `${where} has ${ref.via} "${ref.target}", which is not ${ref.via === "Ref" ? "a resource, a parameter or a pseudo-parameter" : "a resource"} in this template`,
+          entity: where.replace(/^(Resource|Output) /, "").replace(/"/g, ""),
+          lexicon: "aws",
+        });
+      }
+    };
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      report(`Resource "${logicalId}"`, resource.Properties);
+    }
+    for (const [name, out] of Object.entries((template.Outputs as Record<string, { Value?: unknown }> | undefined) ?? {})) {
+      report(`Output "${name}"`, out?.Value);
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw070: PostSynthCheck = {
+  id: "WAW070",
+  description: "Ref or Fn::GetAtt names something the template doesn't declare",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkDanglingRefs(ctx);
+  },
+};

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAykBlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA4E3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA0nBlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAgF3B,CAAC"}