@intentius/chant-lexicon-aws 0.124.33 → 0.124.34

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "0ee5d3480fac8e9a938968dd5ddcc859a7e84cafa9bea700cedfa550dd4ef346",
+    "manifest.json": "0caff76f30c615cd569668c41563a7ca22dc2c0a8faa435471c3fa8ae5b7120a",
     "meta.json": "3e18663eb9eb09920882f8014020432330a74ccd480689e7384c2022cbb10f39",
     "types/index.d.ts": "8651f9ae166668f4311eea1fe61c3fe235f345947951c1d23d1df24a4fd3384f",
     "rules/hardcoded-region.ts": "957eadcaa9f39cc17d21437565d7a94607d9b082cf28918b178fa067f07498a9",
@@ -69,9 +69,10 @@
     "rules/waw067.ts": "8e66f3512569c106c4c6868786bb870af1b3b05d3542118ca6bb5c61c57314e7",
     "rules/waw068.ts": "adbfe84e9b3cdafc072346d87a5df81a97ab07bc5171f3d4abb824c29e9a66a0",
     "rules/waw069.ts": "4792bb3943d5e08039f45cbf554f45263703288acf4ca01d88ad778083023d27",
+    "rules/waw070.ts": "35bd2281ab072a1d6138e0db9f9d6f4f0b6c5af4deacb28aa693177c654db66a",
     "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "8780b94ce60aded935938d5ef20ea667738354051da1bf9ca6d70d9886f65d21"
   },
-  "composite": "183d8f9b49de872c352a4daa986b8710ef256e152f04bea4d3b805515c53f657"
+  "composite": "57806890c056b83500ed7e1d32c8ccff0869c61229f566321563fb61800ace32"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAgC,MAAM,gCAAgC,CAAC;AASxG,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA2EpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAgC,MAAM,gCAAgC,CAAC;AASxG,6CAA6C;AAC7C,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA4EpD,CAAC"}

package/dist/lint/audit-catalog.js

@@ -82,6 +82,7 @@ export const awsAuditCatalog = {
     WAW067: auditRule("WAW067", "report-only", "guidance", "Single-AZ NAT gateway serves multi-AZ private subnets", "Add one NAT gateway per Availability Zone and point each AZ's subnets at its own.", { category: "best-practice" }),
     WAW068: auditRule("WAW068", "report-only", "guidance", "VPN Gateway or Transit Gateway has only one attached VPN Connection", "Attach a second VPNConnection (ideally to a separate Customer Gateway) for redundancy.", { category: "best-practice" }),
     WAW069: auditRule("WAW069", "merge-worthy", "guidance", "Template references a condition it never declares", "Declare the condition in the Conditions section (new Condition(...)), or fix the referenced name.", { category: "correctness" }),
+    WAW070: auditRule("WAW070", "merge-worthy", "guidance", "Ref or Fn::GetAtt names something the template doesn't declare", "Reference a resource or parameter in this template. A value from another lexicon's resource arrives as a parameter.", { category: "correctness" }),
 };
 // Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
 applyLineage(awsAuditCatalog, awsAuditLineage);

package/dist/lint/audit-lineage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAqJrD,CAAC"}
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAyJrD,CAAC"}

package/dist/lint/audit-lineage.js

@@ -147,4 +147,8 @@ export const awsAuditLineage = {
     WAW069: [
         { tool: "cfn-lint", rule: "E8002", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E8002", relation: "equivalent" },
     ],
+    WAW070: [
+        { tool: "cfn-lint", rule: "E1012", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E1012", relation: "equivalent" },
+        { tool: "cfn-lint", rule: "E1010", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E1010", relation: "overlaps" },
+    ],
 };

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA+DvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA8D3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAgEvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA+D3C,CAAC"}

package/dist/lint/post-synth/index.js

@@ -59,6 +59,7 @@ import { waw066 } from "./waw066.js";
 import { waw067 } from "./waw067.js";
 import { waw068 } from "./waw068.js";
 import { waw069 } from "./waw069.js";
+import { waw070 } from "./waw070.js";
 export const postSynthChecks = [
     cor020,
     ext001,
@@ -121,4 +122,5 @@ export const postSynthChecks = [
     waw067,
     waw068,
     waw069,
+    waw070,
 ];

package/dist/lint/post-synth/waw070.d.ts

@@ -0,0 +1,14 @@
+/**
+ * WAW070: Ref or Fn::GetAtt names something the template doesn't declare
+ *
+ * A `Ref` must name a resource, a parameter or an `AWS::` pseudo-parameter,
+ * and a `Fn::GetAtt` must name a resource. CloudFormation rejects a template
+ * whose reference names neither (cfn-lint E1012/E1010). chant built such a
+ * template when a value read another lexicon's resource (#4180); the
+ * serializer now turns that into a parameter, and this check catches any
+ * reference still left dangling.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+export declare function checkDanglingRefs(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const waw070: PostSynthCheck;
+//# sourceMappingURL=waw070.d.ts.map

package/dist/lint/post-synth/waw070.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waw070.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/waw070.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AA8B9G,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAsC9E;AAED,eAAO,MAAM,MAAM,EAAE,cAOpB,CAAC"}

package/dist/lint/post-synth/waw070.js

@@ -0,0 +1,81 @@
+/**
+ * WAW070: Ref or Fn::GetAtt names something the template doesn't declare
+ *
+ * A `Ref` must name a resource, a parameter or an `AWS::` pseudo-parameter,
+ * and a `Fn::GetAtt` must name a resource. CloudFormation rejects a template
+ * whose reference names neither (cfn-lint E1012/E1010). chant built such a
+ * template when a value read another lexicon's resource (#4180); the
+ * serializer now turns that into a parameter, and this check catches any
+ * reference still left dangling.
+ */
+import { parseCFTemplate } from "./cf-refs.js";
+function collectRefs(value, out, seen = new Set()) {
+    if (value === null || typeof value !== "object" || seen.has(value))
+        return;
+    seen.add(value);
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectRefs(item, out, seen);
+        return;
+    }
+    const obj = value;
+    if (typeof obj.Ref === "string" && Object.keys(obj).length === 1) {
+        out.push({ target: obj.Ref, via: "Ref" });
+        return;
+    }
+    const getAtt = obj["Fn::GetAtt"];
+    if (getAtt !== undefined && Object.keys(obj).length === 1) {
+        const target = Array.isArray(getAtt) ? getAtt[0] : typeof getAtt === "string" ? getAtt.split(".")[0] : undefined;
+        if (typeof target === "string")
+            out.push({ target, via: "Fn::GetAtt" });
+        if (Array.isArray(getAtt))
+            collectRefs(getAtt.slice(1), out, seen);
+        return;
+    }
+    for (const v of Object.values(obj))
+        collectRefs(v, out, seen);
+}
+export function checkDanglingRefs(ctx) {
+    const diagnostics = [];
+    for (const [lexicon, output] of ctx.outputs) {
+        if (lexicon !== "aws")
+            continue;
+        const template = parseCFTemplate(output);
+        if (!template?.Resources || typeof template.Resources !== "object")
+            continue;
+        const resources = new Set(Object.keys(template.Resources));
+        const parameters = new Set(Object.keys(template.Parameters ?? {}));
+        const report = (where, value) => {
+            const refs = [];
+            collectRefs(value, refs);
+            for (const ref of refs) {
+                const known = ref.via === "Ref"
+                    ? resources.has(ref.target) || parameters.has(ref.target) || ref.target.startsWith("AWS::")
+                    : resources.has(ref.target);
+                if (known)
+                    continue;
+                diagnostics.push({
+                    checkId: "WAW070",
+                    severity: "error",
+                    message: `${where} has ${ref.via} "${ref.target}", which is not ${ref.via === "Ref" ? "a resource, a parameter or a pseudo-parameter" : "a resource"} in this template`,
+                    entity: where.replace(/^(Resource|Output) /, "").replace(/"/g, ""),
+                    lexicon: "aws",
+                });
+            }
+        };
+        for (const [logicalId, resource] of Object.entries(template.Resources)) {
+            report(`Resource "${logicalId}"`, resource.Properties);
+        }
+        for (const [name, out] of Object.entries(template.Outputs ?? {})) {
+            report(`Output "${name}"`, out?.Value);
+        }
+    }
+    return diagnostics;
+}
+export const waw070 = {
+    id: "WAW070",
+    description: "Ref or Fn::GetAtt names something the template doesn't declare",
+    check(ctx) {
+        return checkDanglingRefs(ctx);
+    },
+};

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.124.33",
+  "version": "0.124.34",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/okf/index.md

@@ -1936,3 +1936,4 @@ okf_version: '0.2'
 * [WAW067](/rules/WAW067.md) - A single-AZ NAT gateway serves private subnets across multiple Availability Zones — single point of failure for cross-AZ egress
 * [WAW068](/rules/WAW068.md) - VPN Gateway or Transit Gateway has only one attached VPN Connection — no redundant path for hybrid connectivity
 * [WAW069](/rules/WAW069.md) - Template references a condition it never declares — resource/output Condition keys, Fn::If, and Condition references must name an entry in the Conditions sec...
+* [WAW070](/rules/WAW070.md) - Ref or Fn::GetAtt names something the template doesn't declare

package/dist/okf/rules/WAW070.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: WAW070
+description: Ref or Fn::GetAtt names something the template doesn't declare
+id: WAW070
+severity: error
+category: post-synth
+lexicon: aws
+docs: https://intentius.io/chant/lexicons/aws/rules/
+---
+Ref or Fn::GetAtt names something the template doesn't declare

package/dist/rules/waw070.ts

@@ -0,0 +1,89 @@
+/**
+ * WAW070: Ref or Fn::GetAtt names something the template doesn't declare
+ *
+ * A `Ref` must name a resource, a parameter or an `AWS::` pseudo-parameter,
+ * and a `Fn::GetAtt` must name a resource. CloudFormation rejects a template
+ * whose reference names neither (cfn-lint E1012/E1010). chant built such a
+ * template when a value read another lexicon's resource (#4180); the
+ * serializer now turns that into a parameter, and this check catches any
+ * reference still left dangling.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate } from "./cf-refs";
+
+interface DanglingRef {
+  target: string;
+  via: "Ref" | "Fn::GetAtt";
+}
+
+function collectRefs(value: unknown, out: DanglingRef[], seen = new Set<unknown>()): void {
+  if (value === null || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    for (const item of value) collectRefs(item, out, seen);
+    return;
+  }
+  const obj = value as Record<string, unknown>;
+  if (typeof obj.Ref === "string" && Object.keys(obj).length === 1) {
+    out.push({ target: obj.Ref, via: "Ref" });
+    return;
+  }
+  const getAtt = obj["Fn::GetAtt"];
+  if (getAtt !== undefined && Object.keys(obj).length === 1) {
+    const target = Array.isArray(getAtt) ? getAtt[0] : typeof getAtt === "string" ? getAtt.split(".")[0] : undefined;
+    if (typeof target === "string") out.push({ target, via: "Fn::GetAtt" });
+    if (Array.isArray(getAtt)) collectRefs(getAtt.slice(1), out, seen);
+    return;
+  }
+  for (const v of Object.values(obj)) collectRefs(v, out, seen);
+}
+
+export function checkDanglingRefs(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [lexicon, output] of ctx.outputs) {
+    if (lexicon !== "aws") continue;
+    const template = parseCFTemplate(output);
+    if (!template?.Resources || typeof template.Resources !== "object") continue;
+
+    const resources = new Set(Object.keys(template.Resources));
+    const parameters = new Set(Object.keys((template.Parameters as Record<string, unknown> | undefined) ?? {}));
+
+    const report = (where: string, value: unknown) => {
+      const refs: DanglingRef[] = [];
+      collectRefs(value, refs);
+      for (const ref of refs) {
+        const known = ref.via === "Ref"
+          ? resources.has(ref.target) || parameters.has(ref.target) || ref.target.startsWith("AWS::")
+          : resources.has(ref.target);
+        if (known) continue;
+        diagnostics.push({
+          checkId: "WAW070",
+          severity: "error",
+          message: `${where} has ${ref.via} "${ref.target}", which is not ${ref.via === "Ref" ? "a resource, a parameter or a pseudo-parameter" : "a resource"} in this template`,
+          entity: where.replace(/^(Resource|Output) /, "").replace(/"/g, ""),
+          lexicon: "aws",
+        });
+      }
+    };
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      report(`Resource "${logicalId}"`, resource.Properties);
+    }
+    for (const [name, out] of Object.entries((template.Outputs as Record<string, { Value?: unknown }> | undefined) ?? {})) {
+      report(`Output "${name}"`, out?.Value);
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw070: PostSynthCheck = {
+  id: "WAW070",
+  description: "Ref or Fn::GetAtt names something the template doesn't declare",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkDanglingRefs(ctx);
+  },
+};

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAykBlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA4E3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA0nBlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAgF3B,CAAC"}

package/dist/serializer.js

@@ -3,6 +3,7 @@ import { ownershipEntries } from "@intentius/chant/ownership";
 import { isEffectReceipt, receiptExpectation, referenceInputPaths, } from "@intentius/chant/effect-receipt";
 import { AWS_TAG_OWNERSHIP_KEYS, OWNERSHIP_METADATA_KEY } from "./ownership.js";
 import { AWS_EFFECT_RECEIPT_ENTITY_TYPE, EFFECT_RECEIPTS_METADATA_KEY, RECEIPT_UNRESOLVED_VALUE_NOTE, receiptParameterName, } from "./effect-receipt-row.js";
+import { sanitizeLogicalId } from "@intentius/chant/lexicon-output";
 import { walkValue } from "@intentius/chant/serializer-walker";
 import { isChildProject } from "@intentius/chant/child-project";
 import { isStackOutput } from "@intentius/chant/stack-output";
@@ -31,12 +32,34 @@ const PARAMETER_CONSTRAINT_KEYS = [
     ["maxValue", "MaxValue"],
     ["noEcho", "NoEcho"],
 ];
+/** Per template (keyed by its entity map): the foreign attributes its values read, by parameter name. */
+const foreignAttrs = new WeakMap();
+const namesIn = new WeakMap();
+function holds(entityNames, name) {
+    let names = namesIn.get(entityNames);
+    if (!names) {
+        names = new Set(entityNames.values());
+        namesIn.set(entityNames, names);
+    }
+    return names.has(name);
+}
 /**
  * CloudFormation-specific visitor for the generic serializer walker.
  */
 function cfnVisitor(entityNames) {
     return {
-        attrRef: (name, attr) => ({ "Fn::GetAtt": [name, attr] }),
+        attrRef: (name, attr) => {
+            if (holds(entityNames, name))
+                return { "Fn::GetAtt": [name, attr] };
+            const param = sanitizeLogicalId(name, attr);
+            let foreign = foreignAttrs.get(entityNames);
+            if (!foreign) {
+                foreign = new Map();
+                foreignAttrs.set(entityNames, foreign);
+            }
+            foreign.set(param, { entity: name, attribute: attr });
+            return { Ref: param };
+        },
         resourceRef: (name) => ({ Ref: name }),
         propertyDeclarable: (entity, walk) => {
             if (!isResourceDeclarable(entity) || typeof entity.props !== "object" || entity.props === null) {
@@ -152,7 +175,7 @@ function renderReceiptRows(receipts, ownership) {
 /**
  * Serialize a set of entities into a CFTemplate object (without JSON.stringify).
  */
-function serializeToTemplate(entities, outputs, extraParameters, extraOutputs, ownership, receiptRows) {
+function serializeToTemplate(entities, outputs, extraParameters, extraOutputs, ownership, receiptRows, warnings = []) {
     const template = {
         AWSTemplateFormatVersion: "2010-09-09",
         Resources: {},
@@ -435,6 +458,17 @@ function serializeToTemplate(entities, outputs, extraParameters, extraOutputs, o
     if (extraOutputs && Object.keys(extraOutputs).length > 0) {
         template.Outputs = { ...template.Outputs, ...extraOutputs };
     }
+    // Values read from resources this template doesn't hold become parameters.
+    for (const [param, ref] of foreignAttrs.get(entityNames) ?? []) {
+        if (template.Resources[param] || template.Parameters?.[param])
+            continue;
+        template.Parameters = template.Parameters ?? {};
+        template.Parameters[param] = {
+            Type: "String",
+            Description: `${ref.entity}.${ref.attribute}, from another lexicon's output "${param}"`,
+        };
+        warnings.push(`aws: "${ref.entity}" is not in this template, so its ${ref.attribute} is the parameter "${param}". Deploy "${ref.entity}" first and pass its output "${param}" in.`);
+    }
     refuseImportEnvelopes(template);
     return template;
 }
@@ -483,8 +517,10 @@ export const awsSerializer = {
         }
         // No nested stacks — use the simple path
         if (!hasChildProjects) {
-            const template = serializeToTemplate(entities, outputs, undefined, undefined, ownership, receiptRows);
-            return JSON.stringify(template, null, 2);
+            const warnings = [];
+            const template = serializeToTemplate(entities, outputs, undefined, undefined, ownership, receiptRows, warnings);
+            const primary = JSON.stringify(template, null, 2);
+            return warnings.length > 0 ? { primary, warnings } : primary;
         }
         // Has child projects — produce multi-file output
         const allFiles = {};
@@ -519,11 +555,13 @@ export const awsSerializer = {
             }
         }
         // Serialize the parent template (ChildProjectInstance entities become CF::Stack resources)
-        const parentTemplate = serializeToTemplate(entities, outputs, parentParams, undefined, ownership, receiptRows);
+        const warnings = [];
+        const parentTemplate = serializeToTemplate(entities, outputs, parentParams, undefined, ownership, receiptRows, warnings);
         const primary = JSON.stringify(parentTemplate, null, 2);
         return {
             primary,
             files: allFiles,
+            ...(warnings.length > 0 ? { warnings } : {}),
         };
     },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.124.33",
+  "version": "0.124.34",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,6 +80,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.33"
+    "@intentius/chant": "^0.124.34"
   }
 }

package/src/lint/audit-catalog.ts

@@ -90,6 +90,7 @@ export const awsAuditCatalog: Record<string, RuleMeta> = {
   WAW067: auditRule("WAW067", "report-only", "guidance", "Single-AZ NAT gateway serves multi-AZ private subnets", "Add one NAT gateway per Availability Zone and point each AZ's subnets at its own.", { category: "best-practice" }),
   WAW068: auditRule("WAW068", "report-only", "guidance", "VPN Gateway or Transit Gateway has only one attached VPN Connection", "Attach a second VPNConnection (ideally to a separate Customer Gateway) for redundancy.", { category: "best-practice" }),
   WAW069: auditRule("WAW069", "merge-worthy", "guidance", "Template references a condition it never declares", "Declare the condition in the Conditions section (new Condition(...)), or fix the referenced name.", { category: "correctness" }),
+  WAW070: auditRule("WAW070", "merge-worthy", "guidance", "Ref or Fn::GetAtt names something the template doesn't declare", "Reference a resource or parameter in this template. A value from another lexicon's resource arrives as a parameter.", { category: "correctness" }),
 };
 
 // Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).

package/src/lint/audit-lineage.ts

@@ -156,4 +156,8 @@ export const awsAuditLineage: Record<string, Lineage[]> = {
   WAW069: [
     { tool: "cfn-lint", rule: "E8002", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E8002", relation: "equivalent" },
   ],
+  WAW070: [
+    { tool: "cfn-lint", rule: "E1012", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E1012", relation: "equivalent" },
+    { tool: "cfn-lint", rule: "E1010", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E1010", relation: "overlaps" },
+  ],
 };

package/src/lint/post-synth/index.ts

@@ -61,6 +61,7 @@ import { waw066 } from "./waw066";
 import { waw067 } from "./waw067";
 import { waw068 } from "./waw068";
 import { waw069 } from "./waw069";
+import { waw070 } from "./waw070";
 
 export const postSynthChecks: PostSynthCheck[] = [
   cor020,
@@ -124,4 +125,5 @@ export const postSynthChecks: PostSynthCheck[] = [
   waw067,
   waw068,
   waw069,
+  waw070,
 ];

package/src/lint/post-synth/waw070.test.ts

@@ -0,0 +1,59 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw070, checkDanglingRefs } from "./waw070";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW070: Ref or Fn::GetAtt names something the template doesn't declare", () => {
+  test("check metadata", () => {
+    expect(waw070.id).toBe("WAW070");
+  });
+
+  test("Fn::GetAtt to a resource not in the template → error", () => {
+    const diags = checkDanglingRefs(makeCtx({
+      Resources: {
+        Record: { Type: "AWS::Route53::RecordSet", Properties: { ResourceRecords: [{ "Fn::GetAtt": ["app", "id"] }] } },
+      },
+    }));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain('Fn::GetAtt "app"');
+    expect(diags[0].entity).toBe("Record");
+  });
+
+  test("Ref to something undeclared in an output → error", () => {
+    const diags = checkDanglingRefs(makeCtx({
+      Resources: { Bucket: { Type: "AWS::S3::Bucket" } },
+      Outputs: { Name: { Value: { Ref: "Missing" } } },
+    }));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('Output "Name" has Ref "Missing"');
+  });
+
+  test("resources, parameters, pseudo-parameters and the string GetAtt form are fine", () => {
+    const diags = checkDanglingRefs(makeCtx({
+      Parameters: { AppFqdn: { Type: "String" } },
+      Resources: {
+        Bucket: { Type: "AWS::S3::Bucket" },
+        Record: {
+          Type: "AWS::Route53::RecordSet",
+          Properties: {
+            ResourceRecords: [{ Ref: "AppFqdn" }],
+            Comment: { "Fn::Join": ["", [{ Ref: "AWS::Region" }, { "Fn::GetAtt": "Bucket.Arn" }, { Ref: "Bucket" }]] },
+          },
+        },
+      },
+    }));
+    expect(diags).toEqual([]);
+  });
+
+  test("Fn::GetAtt to a parameter → error", () => {
+    const diags = checkDanglingRefs(makeCtx({
+      Parameters: { P: { Type: "String" } },
+      Resources: { R: { Type: "AWS::SNS::Topic", Properties: { TopicName: { "Fn::GetAtt": ["P", "X"] } } } },
+    }));
+    expect(diags).toHaveLength(1);
+  });
+});

package/src/lint/post-synth/waw070.ts

@@ -0,0 +1,89 @@
+/**
+ * WAW070: Ref or Fn::GetAtt names something the template doesn't declare
+ *
+ * A `Ref` must name a resource, a parameter or an `AWS::` pseudo-parameter,
+ * and a `Fn::GetAtt` must name a resource. CloudFormation rejects a template
+ * whose reference names neither (cfn-lint E1012/E1010). chant built such a
+ * template when a value read another lexicon's resource (#4180); the
+ * serializer now turns that into a parameter, and this check catches any
+ * reference still left dangling.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseCFTemplate } from "./cf-refs";
+
+interface DanglingRef {
+  target: string;
+  via: "Ref" | "Fn::GetAtt";
+}
+
+function collectRefs(value: unknown, out: DanglingRef[], seen = new Set<unknown>()): void {
+  if (value === null || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    for (const item of value) collectRefs(item, out, seen);
+    return;
+  }
+  const obj = value as Record<string, unknown>;
+  if (typeof obj.Ref === "string" && Object.keys(obj).length === 1) {
+    out.push({ target: obj.Ref, via: "Ref" });
+    return;
+  }
+  const getAtt = obj["Fn::GetAtt"];
+  if (getAtt !== undefined && Object.keys(obj).length === 1) {
+    const target = Array.isArray(getAtt) ? getAtt[0] : typeof getAtt === "string" ? getAtt.split(".")[0] : undefined;
+    if (typeof target === "string") out.push({ target, via: "Fn::GetAtt" });
+    if (Array.isArray(getAtt)) collectRefs(getAtt.slice(1), out, seen);
+    return;
+  }
+  for (const v of Object.values(obj)) collectRefs(v, out, seen);
+}
+
+export function checkDanglingRefs(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const diagnostics: PostSynthDiagnostic[] = [];
+
+  for (const [lexicon, output] of ctx.outputs) {
+    if (lexicon !== "aws") continue;
+    const template = parseCFTemplate(output);
+    if (!template?.Resources || typeof template.Resources !== "object") continue;
+
+    const resources = new Set(Object.keys(template.Resources));
+    const parameters = new Set(Object.keys((template.Parameters as Record<string, unknown> | undefined) ?? {}));
+
+    const report = (where: string, value: unknown) => {
+      const refs: DanglingRef[] = [];
+      collectRefs(value, refs);
+      for (const ref of refs) {
+        const known = ref.via === "Ref"
+          ? resources.has(ref.target) || parameters.has(ref.target) || ref.target.startsWith("AWS::")
+          : resources.has(ref.target);
+        if (known) continue;
+        diagnostics.push({
+          checkId: "WAW070",
+          severity: "error",
+          message: `${where} has ${ref.via} "${ref.target}", which is not ${ref.via === "Ref" ? "a resource, a parameter or a pseudo-parameter" : "a resource"} in this template`,
+          entity: where.replace(/^(Resource|Output) /, "").replace(/"/g, ""),
+          lexicon: "aws",
+        });
+      }
+    };
+
+    for (const [logicalId, resource] of Object.entries(template.Resources)) {
+      report(`Resource "${logicalId}"`, resource.Properties);
+    }
+    for (const [name, out] of Object.entries((template.Outputs as Record<string, { Value?: unknown }> | undefined) ?? {})) {
+      report(`Output "${name}"`, out?.Value);
+    }
+  }
+
+  return diagnostics;
+}
+
+export const waw070: PostSynthCheck = {
+  id: "WAW070",
+  description: "Ref or Fn::GetAtt names something the template doesn't declare",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkDanglingRefs(ctx);
+  },
+};

package/src/serializer-foreign-attr.test.ts

@@ -0,0 +1,43 @@
+/**
+ * A value read from a resource this template doesn't hold, such as another
+ * lexicon's, is a parameter, not a dangling Fn::GetAtt (#4180).
+ */
+
+import { describe, expect, it } from "vitest";
+import { AttrRef } from "@intentius/chant";
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+import { awsSerializer } from "./serializer";
+
+function entity(lexicon: string, entityType: string, props: Record<string, unknown> = {}): any {
+  return { [DECLARABLE_MARKER]: true, lexicon, entityType, kind: "resource", props };
+}
+
+describe("aws foreign attributes", () => {
+  it("turns another lexicon's attribute into a parameter and warns", () => {
+    const app = entity("azure", "Microsoft.App/containerApps", { name: "web" });
+    const fqdn = new AttrRef(app, "configuration.ingress.fqdn");
+    fqdn._setLogicalName("app");
+    const record = entity("aws", "AWS::Route53::RecordSet", { Type: "CNAME", ResourceRecords: [fqdn] });
+
+    const result = awsSerializer.serialize(new Map([["record", record]]));
+    expect(typeof result).toBe("object");
+    const { primary, warnings } = result as { primary: string; warnings?: string[] };
+    const template = JSON.parse(primary);
+
+    expect(template.Resources.record.Properties.ResourceRecords).toEqual([{ Ref: "appConfigurationIngressFqdn" }]);
+    expect(template.Parameters.appConfigurationIngressFqdn.Type).toBe("String");
+    expect(warnings).toHaveLength(1);
+    expect(warnings![0]).toContain('"app" is not in this template');
+  });
+
+  it("keeps Fn::GetAtt for a resource in the template", () => {
+    const bucket = entity("aws", "AWS::S3::Bucket");
+    const arn = new AttrRef(bucket, "Arn");
+    arn._setLogicalName("bucket");
+    const topic = entity("aws", "AWS::SNS::Topic", { TopicName: arn });
+
+    const result = awsSerializer.serialize(new Map([["bucket", bucket], ["topic", topic]]));
+    expect(typeof result).toBe("string");
+    expect(JSON.parse(result as string).Resources.topic.Properties.TopicName).toEqual({ "Fn::GetAtt": ["bucket", "Arn"] });
+  });
+});

package/src/serializer.ts

@@ -15,7 +15,7 @@ import {
   RECEIPT_UNRESOLVED_VALUE_NOTE,
   receiptParameterName,
 } from "./effect-receipt-row";
-import type { LexiconOutput } from "@intentius/chant/lexicon-output";
+import { sanitizeLogicalId, type LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { isChildProject, type ChildProjectInstance } from "@intentius/chant/child-project";
 import { isStackOutput, type StackOutput } from "@intentius/chant/stack-output";
@@ -104,12 +104,47 @@ interface CFOutput {
   Condition?: string;
 }
 
+/**
+ * An attribute of a resource this template doesn't hold (#4180): another
+ * lexicon's, such as an Azure Container App's hostname read by a Route 53
+ * record. `Fn::GetAtt` can't name it, so the template takes the value as a
+ * parameter, named as the source lexicon's output for it is
+ * (`LexiconOutput.auto`), and whoever deploys passes that output in.
+ */
+interface ForeignAttr {
+  entity: string;
+  attribute: string;
+}
+
+/** Per template (keyed by its entity map): the foreign attributes its values read, by parameter name. */
+const foreignAttrs = new WeakMap<Map<Declarable, string>, Map<string, ForeignAttr>>();
+const namesIn = new WeakMap<Map<Declarable, string>, Set<string>>();
+
+function holds(entityNames: Map<Declarable, string>, name: string): boolean {
+  let names = namesIn.get(entityNames);
+  if (!names) {
+    names = new Set(entityNames.values());
+    namesIn.set(entityNames, names);
+  }
+  return names.has(name);
+}
+
 /**
  * CloudFormation-specific visitor for the generic serializer walker.
  */
 function cfnVisitor(entityNames: Map<Declarable, string>): SerializerVisitor {
   return {
-    attrRef: (name, attr) => ({ "Fn::GetAtt": [name, attr] }),
+    attrRef: (name, attr) => {
+      if (holds(entityNames, name)) return { "Fn::GetAtt": [name, attr] };
+      const param = sanitizeLogicalId(name, attr);
+      let foreign = foreignAttrs.get(entityNames);
+      if (!foreign) {
+        foreign = new Map();
+        foreignAttrs.set(entityNames, foreign);
+      }
+      foreign.set(param, { entity: name, attribute: attr });
+      return { Ref: param };
+    },
     resourceRef: (name) => ({ Ref: name }),
     propertyDeclarable: (entity, walk) => {
       if (!isResourceDeclarable(entity) || typeof entity.props !== "object" || entity.props === null) {
@@ -267,6 +302,7 @@ function serializeToTemplate(
   extraOutputs?: Record<string, CFOutput>,
   ownership?: OwnershipMarker,
   receiptRows?: Record<string, ReceiptRow>,
+  warnings: string[] = [],
 ): CFTemplate {
   const template: CFTemplate = {
     AWSTemplateFormatVersion: "2010-09-09",
@@ -560,6 +596,19 @@ function serializeToTemplate(
     template.Outputs = { ...template.Outputs, ...extraOutputs };
   }
 
+  // Values read from resources this template doesn't hold become parameters.
+  for (const [param, ref] of foreignAttrs.get(entityNames) ?? []) {
+    if (template.Resources[param] || template.Parameters?.[param]) continue;
+    template.Parameters = template.Parameters ?? {};
+    template.Parameters[param] = {
+      Type: "String",
+      Description: `${ref.entity}.${ref.attribute}, from another lexicon's output "${param}"`,
+    };
+    warnings.push(
+      `aws: "${ref.entity}" is not in this template, so its ${ref.attribute} is the parameter "${param}". Deploy "${ref.entity}" first and pass its output "${param}" in.`,
+    );
+  }
+
   refuseImportEnvelopes(template);
   return template;
 }
@@ -616,8 +665,10 @@ export const awsSerializer: Serializer = {
 
     // No nested stacks — use the simple path
     if (!hasChildProjects) {
-      const template = serializeToTemplate(entities, outputs, undefined, undefined, ownership, receiptRows);
-      return JSON.stringify(template, null, 2);
+      const warnings: string[] = [];
+      const template = serializeToTemplate(entities, outputs, undefined, undefined, ownership, receiptRows, warnings);
+      const primary = JSON.stringify(template, null, 2);
+      return warnings.length > 0 ? { primary, warnings } : primary;
     }
 
     // Has child projects — produce multi-file output
@@ -656,12 +707,14 @@ export const awsSerializer: Serializer = {
     }
 
     // Serialize the parent template (ChildProjectInstance entities become CF::Stack resources)
-    const parentTemplate = serializeToTemplate(entities, outputs, parentParams, undefined, ownership, receiptRows);
+    const warnings: string[] = [];
+    const parentTemplate = serializeToTemplate(entities, outputs, parentParams, undefined, ownership, receiptRows, warnings);
     const primary = JSON.stringify(parentTemplate, null, 2);
 
     return {
       primary,
       files: allFiles,
+      ...(warnings.length > 0 ? { warnings } : {}),
     };
   },
 };