@intentius/chant-lexicon-aws 0.15.2 → 0.15.3

package/dist/integrity.json

@@ -1,9 +1,9 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "ebb81ef771d7eb7cb8397a82fa80d25a60122ea6fa641b7f8444fb2bd076d134",
+    "manifest.json": "8fd217f33f9669b2aebb45d554add781b6abdaf4f32dc8e2166bf4a3fc654485",
     "meta.json": "511f57814cc8d99a30cbcef2830f21ec374f2919f1d4cffcdc40986b0bf754da",
-    "types/index.d.ts": "096157407bc4a48fe332cd67cc5b3832d513e63995a5b199b89dc34914ba348d",
+    "types/index.d.ts": "5c0d835c66a2e03885da5315b78c9ea7a8e0f36f1e23a3146f17a8b2fef436fd",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
     "rules/iam-wildcard.ts": "135d7217d278fef50939e605c5da32603ba35674b8c4b5c4d66a06c77903e945",
     "rules/s3-encryption.ts": "c4f9f8aa8dc382ed98c7b04e820a600590cc75335a8db2e087cbfbfe4003d09e",
@@ -40,5 +40,5 @@
     "skills/chant-aws.md": "4d65eb160e001f2af42eb7c622a5b498c2fd1f5afbd6c8155615c010fb265c63",
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe"
   },
-  "composite": "f57f891aaaf8b25f11c51264e4706ed25405a8324a46071b4c01683e68e833b6"
+  "composite": "7a60b028b5154a78374c0fa6fd2601f5d0b1120f44bf6d50242e6a949d710ad0"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.15.2",
+  "version": "0.15.3",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/op/activities/aws-apply.d.ts

@@ -0,0 +1,69 @@
+export interface AwsApplyArgs {
+    /** Path to a built CloudFormation template (JSON/YAML). */
+    templatePath: string;
+    /** CloudFormation stack name — the deploy boundary. */
+    stackName: string;
+    /** CFN endpoint override (e.g. Floci `http://localhost:4566`). Default: real CloudFormation. */
+    endpoint?: string;
+    /** Region (real CFN host + `Version` context). Default: `us-east-1`. */
+    region?: string;
+    /** Capabilities to acknowledge. Default: `["CAPABILITY_NAMED_IAM"]`. */
+    capabilities?: string[];
+    /** Stack-settle timeout in ms. Default: `300000`. */
+    timeoutMs?: number;
+    /** Poll interval in ms. Default: `3000`. */
+    intervalMs?: number;
+}
+/** Injectable CFN transport — a form POST returning the raw XML. Mirrors the az/gcp appliers so tests avoid the network. */
+export type AwsHttp = (url: string, form: Record<string, string>, signal?: AbortSignal) => Promise<{
+    status: number;
+    text: string;
+}>;
+/** The CloudFormation endpoint URL — the override, or the real regional host. */
+export declare function cfnUrl(endpoint?: string, region?: string): string;
+/** A CFN Query-protocol form body: `Action` + `Version` + params. */
+export declare function cfnForm(action: string, params: Record<string, string>): Record<string, string>;
+/** Capabilities as the CFN `Capabilities.member.N` list params. */
+export declare function capabilityParams(capabilities: string[]): Record<string, string>;
+/** First `<tag>…</tag>` text in a CFN XML response. */
+export declare function xmlField(xml: string, tag: string): string | undefined;
+export declare const stackStatus: (xml: string) => string | undefined;
+export declare const stackId: (xml: string) => string | undefined;
+export declare const cfnErrorMessage: (xml: string) => string | undefined;
+/** A DescribeStacks error for an absent stack (drives create-vs-update). */
+export declare const isStackMissing: (xml: string) => boolean;
+/** The real-AWS UpdateStack no-op error (Floci returns 200 instead). */
+export declare const isNoUpdates: (xml: string) => boolean;
+export declare const isSuccessStatus: (status: string) => boolean;
+export declare const isFailureStatus: (status: string) => boolean;
+/** A settled stack state — success, failure, or deleted. Transient `*_IN_PROGRESS` states aren't. */
+export declare const isTerminalStatus: (status: string) => boolean;
+/** Poll DescribeStacks until the stack reaches a terminal state; returns that status. */
+export declare function waitForStackSettled(url: string, stackName: string, http: AwsHttp, opts: {
+    timeoutMs: number;
+    intervalMs: number;
+}, signal?: AbortSignal): Promise<string>;
+/**
+ * The native AWS applier — deploy a built CloudFormation template by calling the
+ * CloudFormation API directly (create-or-update + poll to a settled stack),
+ * targeting a local Floci emulator or real AWS by endpoint override. The direct
+ * twin of `azApply`/`gcpApply`: it speaks the CloudFormation Query API over HTTP
+ * rather than shelling `aws cloudformation deploy` (that CLI path is still
+ * available via `nativeApply({ target: "cloudformation" })`). The stack is the
+ * ownership boundary, so deletes ride CloudFormation itself — no separate prune.
+ * `http` is injectable for tests.
+ */
+export declare function awsApply(args: AwsApplyArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
+    stackName: string;
+    status: string;
+    action: "created" | "updated" | "unchanged";
+}>;
+/**
+ * The inverse of {@link awsApply} — DeleteStack, then poll until the stack is
+ * gone. Idempotent: an already-absent stack is a no-op. `http` is injectable.
+ */
+export declare function awsDelete(args: AwsApplyArgs, signal?: AbortSignal, http?: AwsHttp): Promise<{
+    stackName: string;
+    deleted: boolean;
+}>;
+//# sourceMappingURL=aws-apply.d.ts.map

package/dist/op/activities/aws-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/aws-apply.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,YAAY;IAC3B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4HAA4H;AAC5H,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAcrI,iFAAiF;AACjF,wBAAgB,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAEzE;AAED,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9F;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED,uDAAuD;AACvD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAyC,CAAC;AAC7F,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AACrF,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAAqC,CAAC;AAE7F,4EAA4E;AAC5E,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,OAAsC,CAAC;AACpF,wEAAwE;AACxE,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,OAAsD,CAAC;AAGjG,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAqC,CAAC;AACvF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,OAAyC,CAAC;AAC3F,qGAAqG;AACrG,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,OACkC,CAAC;AAIrF,yFAAyF;AACzF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC/C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAWjB;AAID;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAA;CAAE,CAAC,CAuC7F;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAsBlD"}

package/dist/op/activities/index.d.ts

@@ -1,8 +1,12 @@
 /**
  * AWS Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `aws` lexicon. Contributes the local Floci AWS
- * emulator lifecycle (`flociUp`/`flociDown`).
+ * emulator lifecycle (`flociUp`/`flociDown`) and the native CloudFormation
+ * applier (`awsApply`), which calls the CloudFormation API directly rather than
+ * shelling `aws` — the direct twin of `azApply`/`gcpApply`.
  */
 export { flociUp, flociDown, flociRunCommand, flociRmCommand, flociExistsCommand, flociHealthUrl, flociEnv, isFlociReady, } from "./floci.js";
 export type { FlociUpArgs, FlociDownArgs } from "./floci.js";
+export { awsApply, awsDelete, waitForStackSettled, cfnUrl, cfnForm, capabilityParams, xmlField, stackStatus, stackId, cfnErrorMessage, isStackMissing, isNoUpdates, isSuccessStatus, isFailureStatus, isTerminalStatus, } from "./aws-apply.js";
+export type { AwsApplyArgs, AwsHttp } from "./aws-apply.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,OAAO,EACP,SAAS,EACT,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,QAAQ,EACR,SAAS,EACT,mBAAmB,EACnB,MAAM,EACN,OAAO,EACP,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,OAAO,EACP,eAAe,EACf,cAAc,EACd,WAAW,EACX,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC"}

package/dist/types/index.d.ts

@@ -39202,6 +39202,7 @@ export declare class AdvancedSecurityAdditionalFlows {
 
 export declare class AfterContactWorkConfig {
   constructor(props: {
+    AfterContactWorkMode?: ConnectUser_AfterContactWorkMode;
     AfterContactWorkTimeLimit?: number;
   });
 }
@@ -55399,6 +55400,7 @@ export declare class ConnectTestCase_Tag {
 
 export declare class ConnectUser_AfterContactWorkConfig {
   constructor(props: {
+    AfterContactWorkMode?: ConnectUser_AfterContactWorkMode;
     AfterContactWorkTimeLimit?: number;
   });
 }
@@ -126973,6 +126975,8 @@ export type ConnectorProfile_OAuth2GrantType =
 
 export type ConnectorV2_AuthStatus = "ACTIVE" | "FAILED";
 
+export type ConnectUser_AfterContactWorkMode = "OFF" | "ON" | "ON_DEMAND";
+
 export type ConnectUser_Channel = "CHAT" | "EMAIL" | "TASK" | "VOICE";
 
 export type ConnectUser_PhoneType = "DESK_PHONE" | "SOFT_PHONE";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.15.2",
+  "version": "0.15.3",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,6 +80,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.15.2"
+    "@intentius/chant": "^0.15.3"
   }
 }

package/src/generated/index.d.ts

@@ -39202,6 +39202,7 @@ export declare class AdvancedSecurityAdditionalFlows {
 
 export declare class AfterContactWorkConfig {
   constructor(props: {
+    AfterContactWorkMode?: ConnectUser_AfterContactWorkMode;
     AfterContactWorkTimeLimit?: number;
   });
 }
@@ -55399,6 +55400,7 @@ export declare class ConnectTestCase_Tag {
 
 export declare class ConnectUser_AfterContactWorkConfig {
   constructor(props: {
+    AfterContactWorkMode?: ConnectUser_AfterContactWorkMode;
     AfterContactWorkTimeLimit?: number;
   });
 }
@@ -126973,6 +126975,8 @@ export type ConnectorProfile_OAuth2GrantType =
 
 export type ConnectorV2_AuthStatus = "ACTIVE" | "FAILED";
 
+export type ConnectUser_AfterContactWorkMode = "OFF" | "ON" | "ON_DEMAND";
+
 export type ConnectUser_Channel = "CHAT" | "EMAIL" | "TASK" | "VOICE";
 
 export type ConnectUser_PhoneType = "DESK_PHONE" | "SOFT_PHONE";

package/src/op/activities/aws-apply.test.ts

@@ -0,0 +1,143 @@
+import { describe, test, expect } from "vitest";
+import { writeFileSync, unlinkSync } from "node:fs";
+import {
+  awsApply,
+  awsDelete,
+  cfnUrl,
+  cfnForm,
+  capabilityParams,
+  xmlField,
+  stackStatus,
+  stackId,
+  isStackMissing,
+  isNoUpdates,
+  isSuccessStatus,
+  isFailureStatus,
+  isTerminalStatus,
+  type AwsHttp,
+} from "./aws-apply";
+
+const CREATE_OK = "<CreateStackResponse><CreateStackResult><StackId>arn:stack/s</StackId></CreateStackResult></CreateStackResponse>";
+const UPDATE_OK = "<UpdateStackResponse><UpdateStackResult><StackId>arn:stack/s</StackId></UpdateStackResult></UpdateStackResponse>";
+const MISSING = "<ErrorResponse><Error><Code>ValidationError</Code><Message>Stack with id s does not exist</Message></Error></ErrorResponse>";
+const NO_UPDATES = "<ErrorResponse><Error><Message>No updates are to be performed.</Message></Error></ErrorResponse>";
+const describe_ = (status: string) => `<DescribeStacksResponse><Stacks><member><StackId>arn:stack/s</StackId><StackStatus>${status}</StackStatus></member></Stacks></DescribeStacksResponse>`;
+
+describe("CFN pure helpers (#awsApply)", () => {
+  test("cfnUrl: endpoint override vs real regional host", () => {
+    expect(cfnUrl("http://localhost:4566")).toBe("http://localhost:4566/");
+    expect(cfnUrl(undefined, "eu-west-1")).toBe("https://cloudformation.eu-west-1.amazonaws.com/");
+  });
+
+  test("cfnForm stamps Action + Version", () => {
+    expect(cfnForm("CreateStack", { StackName: "s" })).toEqual({ Action: "CreateStack", Version: "2010-05-15", StackName: "s" });
+  });
+
+  test("capabilityParams → Capabilities.member.N", () => {
+    expect(capabilityParams(["CAPABILITY_NAMED_IAM", "CAPABILITY_IAM"])).toEqual({
+      "Capabilities.member.1": "CAPABILITY_NAMED_IAM",
+      "Capabilities.member.2": "CAPABILITY_IAM",
+    });
+  });
+
+  test("xml parsing + status classification", () => {
+    expect(xmlField(describe_("CREATE_COMPLETE"), "StackStatus")).toBe("CREATE_COMPLETE");
+    expect(stackStatus(describe_("UPDATE_COMPLETE"))).toBe("UPDATE_COMPLETE");
+    expect(stackId(CREATE_OK)).toBe("arn:stack/s");
+    expect(isStackMissing(MISSING)).toBe(true);
+    expect(isNoUpdates(NO_UPDATES)).toBe(true);
+    expect(isSuccessStatus("CREATE_COMPLETE")).toBe(true);
+    expect(isSuccessStatus("UPDATE_COMPLETE_CLEANUP_IN_PROGRESS")).toBe(false); // transient, not settled
+    expect(isFailureStatus("ROLLBACK_COMPLETE")).toBe(true);
+    expect(isFailureStatus("CREATE_FAILED")).toBe(true);
+    expect(isTerminalStatus("CREATE_IN_PROGRESS")).toBe(false);
+    expect(isTerminalStatus("DELETE_COMPLETE")).toBe(true);
+  });
+});
+
+function tmpl(): string {
+  const p = `/tmp/chant-cfn-${process.pid}-${Math.round(performance.now())}.json`;
+  writeFileSync(p, JSON.stringify({ Resources: { B: { Type: "AWS::S3::Bucket" } } }));
+  return p;
+}
+
+describe("awsApply flow (#awsApply)", () => {
+  test("create path: absent stack → CreateStack → poll to CREATE_COMPLETE", async () => {
+    const calls: string[] = [];
+    let described = 0;
+    const http: AwsHttp = async (_url, form) => {
+      calls.push(form.Action);
+      if (form.Action === "DescribeStacks") return described++ === 0 ? { status: 400, text: MISSING } : { status: 200, text: describe_("CREATE_COMPLETE") };
+      return { status: 200, text: CREATE_OK };
+    };
+    const p = tmpl();
+    const res = await awsApply({ templatePath: p, stackName: "s", endpoint: "http://x", intervalMs: 1 }, undefined, http);
+    unlinkSync(p);
+    expect(res).toEqual({ stackName: "s", status: "CREATE_COMPLETE", action: "created" });
+    expect(calls).toEqual(["DescribeStacks", "CreateStack", "DescribeStacks"]);
+  });
+
+  test("update path: existing stack → UpdateStack → UPDATE_COMPLETE", async () => {
+    let described = 0;
+    const http: AwsHttp = async (_url, form) => {
+      if (form.Action === "DescribeStacks") return { status: 200, text: describe_(described++ === 0 ? "CREATE_COMPLETE" : "UPDATE_COMPLETE") };
+      return { status: 200, text: UPDATE_OK };
+    };
+    const p = tmpl();
+    const res = await awsApply({ templatePath: p, stackName: "s", endpoint: "http://x", intervalMs: 1 }, undefined, http);
+    unlinkSync(p);
+    expect(res.action).toBe("updated");
+    expect(res.status).toBe("UPDATE_COMPLETE");
+  });
+
+  test("no-op update (real-AWS error) → unchanged, no poll", async () => {
+    const http: AwsHttp = async (_url, form) => {
+      if (form.Action === "DescribeStacks") return { status: 200, text: describe_("CREATE_COMPLETE") };
+      return { status: 400, text: NO_UPDATES }; // UpdateStack
+    };
+    const p = tmpl();
+    const res = await awsApply({ templatePath: p, stackName: "s", endpoint: "http://x" }, undefined, http);
+    unlinkSync(p);
+    expect(res).toEqual({ stackName: "s", status: "UPDATE_COMPLETE", action: "unchanged" });
+  });
+
+  test("throws when the stack settles to a failure state", async () => {
+    let described = 0;
+    const http: AwsHttp = async (_url, form) => {
+      if (form.Action === "DescribeStacks") return described++ === 0 ? { status: 400, text: MISSING } : { status: 200, text: describe_("ROLLBACK_COMPLETE") };
+      return { status: 200, text: CREATE_OK };
+    };
+    const p = tmpl();
+    await expect(
+      awsApply({ templatePath: p, stackName: "s", endpoint: "http://x", intervalMs: 1 }, undefined, http),
+    ).rejects.toThrow(/created → ROLLBACK_COMPLETE/);
+    unlinkSync(p);
+  });
+
+  test("surfaces a CreateStack API error", async () => {
+    const http: AwsHttp = async (_url, form) =>
+      form.Action === "DescribeStacks" ? { status: 400, text: MISSING } : { status: 400, text: "<Error><Message>bad template</Message></Error>" };
+    const p = tmpl();
+    await expect(
+      awsApply({ templatePath: p, stackName: "s", endpoint: "http://x" }, undefined, http),
+    ).rejects.toThrow(/CreateStack failed \(400\): bad template/);
+    unlinkSync(p);
+  });
+});
+
+describe("awsDelete (#awsApply)", () => {
+  test("DeleteStack then polls until the stack is gone", async () => {
+    const calls: string[] = [];
+    let described = 0;
+    const http: AwsHttp = async (_url, form) => {
+      calls.push(form.Action);
+      if (form.Action === "DescribeStacks") return described++ === 0 ? { status: 200, text: describe_("DELETE_IN_PROGRESS") } : { status: 400, text: MISSING };
+      return { status: 200, text: "<DeleteStackResponse/>" };
+    };
+    const p = tmpl();
+    const res = await awsDelete({ templatePath: p, stackName: "s", endpoint: "http://x", intervalMs: 1 }, undefined, http);
+    unlinkSync(p);
+    expect(res).toEqual({ stackName: "s", deleted: true });
+    expect(calls[0]).toBe("DeleteStack");
+  });
+});

package/src/op/activities/aws-apply.ts

@@ -0,0 +1,187 @@
+import { readFileSync } from "node:fs";
+import { safeHeartbeat, sleep } from "@intentius/chant/op";
+
+const DEFAULT_REGION = "us-east-1";
+const CFN_API_VERSION = "2010-05-15";
+const DEFAULT_CAPABILITIES = ["CAPABILITY_NAMED_IAM"];
+
+export interface AwsApplyArgs {
+  /** Path to a built CloudFormation template (JSON/YAML). */
+  templatePath: string;
+  /** CloudFormation stack name — the deploy boundary. */
+  stackName: string;
+  /** CFN endpoint override (e.g. Floci `http://localhost:4566`). Default: real CloudFormation. */
+  endpoint?: string;
+  /** Region (real CFN host + `Version` context). Default: `us-east-1`. */
+  region?: string;
+  /** Capabilities to acknowledge. Default: `["CAPABILITY_NAMED_IAM"]`. */
+  capabilities?: string[];
+  /** Stack-settle timeout in ms. Default: `300000`. */
+  timeoutMs?: number;
+  /** Poll interval in ms. Default: `3000`. */
+  intervalMs?: number;
+}
+
+/** Injectable CFN transport — a form POST returning the raw XML. Mirrors the az/gcp appliers so tests avoid the network. */
+export type AwsHttp = (url: string, form: Record<string, string>, signal?: AbortSignal) => Promise<{ status: number; text: string }>;
+
+const defaultHttp: AwsHttp = async (url, form, signal) => {
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams(form).toString(),
+    signal,
+  });
+  return { status: res.status, text: await res.text() };
+};
+
+// ── Pure helpers (CFN Query protocol) ─────────────────────────────────────────
+
+/** The CloudFormation endpoint URL — the override, or the real regional host. */
+export function cfnUrl(endpoint?: string, region = DEFAULT_REGION): string {
+  return `${(endpoint ?? `https://cloudformation.${region}.amazonaws.com`).replace(/\/$/, "")}/`;
+}
+
+/** A CFN Query-protocol form body: `Action` + `Version` + params. */
+export function cfnForm(action: string, params: Record<string, string>): Record<string, string> {
+  return { Action: action, Version: CFN_API_VERSION, ...params };
+}
+
+/** Capabilities as the CFN `Capabilities.member.N` list params. */
+export function capabilityParams(capabilities: string[]): Record<string, string> {
+  const out: Record<string, string> = {};
+  capabilities.forEach((c, i) => (out[`Capabilities.member.${i + 1}`] = c));
+  return out;
+}
+
+/** First `<tag>…</tag>` text in a CFN XML response. */
+export function xmlField(xml: string, tag: string): string | undefined {
+  return xml.match(new RegExp(`<${tag}>([^<]*)</${tag}>`))?.[1];
+}
+
+export const stackStatus = (xml: string): string | undefined => xmlField(xml, "StackStatus");
+export const stackId = (xml: string): string | undefined => xmlField(xml, "StackId");
+export const cfnErrorMessage = (xml: string): string | undefined => xmlField(xml, "Message");
+
+/** A DescribeStacks error for an absent stack (drives create-vs-update). */
+export const isStackMissing = (xml: string): boolean => /does not exist/i.test(xml);
+/** The real-AWS UpdateStack no-op error (Floci returns 200 instead). */
+export const isNoUpdates = (xml: string): boolean => /No updates are to be performed/i.test(xml);
+
+const SUCCESS_STATUS = new Set(["CREATE_COMPLETE", "UPDATE_COMPLETE", "IMPORT_COMPLETE"]);
+export const isSuccessStatus = (status: string): boolean => SUCCESS_STATUS.has(status);
+export const isFailureStatus = (status: string): boolean => /FAILED|ROLLBACK/.test(status);
+/** A settled stack state — success, failure, or deleted. Transient `*_IN_PROGRESS` states aren't. */
+export const isTerminalStatus = (status: string): boolean =>
+  isSuccessStatus(status) || isFailureStatus(status) || status === "DELETE_COMPLETE";
+
+// ── Poll ──────────────────────────────────────────────────────────────────────
+
+/** Poll DescribeStacks until the stack reaches a terminal state; returns that status. */
+export async function waitForStackSettled(
+  url: string,
+  stackName: string,
+  http: AwsHttp,
+  opts: { timeoutMs: number; intervalMs: number },
+  signal?: AbortSignal,
+): Promise<string> {
+  const deadline = Date.now() + opts.timeoutMs;
+  while (Date.now() < deadline) {
+    if (signal?.aborted) throw new Error("awsApply aborted");
+    safeHeartbeat({ step: "awsApply", stack: stackName });
+    const res = await http(url, cfnForm("DescribeStacks", { StackName: stackName }), signal);
+    const status = stackStatus(res.text);
+    if (status && isTerminalStatus(status)) return status;
+    await sleep(opts.intervalMs, signal);
+  }
+  throw new Error(`CloudFormation stack ${stackName} did not settle within ${opts.timeoutMs}ms`);
+}
+
+// ── Apply / delete ──────────────────────────────────────────────────────────
+
+/**
+ * The native AWS applier — deploy a built CloudFormation template by calling the
+ * CloudFormation API directly (create-or-update + poll to a settled stack),
+ * targeting a local Floci emulator or real AWS by endpoint override. The direct
+ * twin of `azApply`/`gcpApply`: it speaks the CloudFormation Query API over HTTP
+ * rather than shelling `aws cloudformation deploy` (that CLI path is still
+ * available via `nativeApply({ target: "cloudformation" })`). The stack is the
+ * ownership boundary, so deletes ride CloudFormation itself — no separate prune.
+ * `http` is injectable for tests.
+ */
+export async function awsApply(
+  args: AwsApplyArgs,
+  signal?: AbortSignal,
+  http: AwsHttp = defaultHttp,
+): Promise<{ stackName: string; status: string; action: "created" | "updated" | "unchanged" }> {
+  const url = cfnUrl(args.endpoint, args.region);
+  const capabilities = args.capabilities ?? DEFAULT_CAPABILITIES;
+  const templateBody = readFileSync(args.templatePath, "utf8");
+  const timeoutMs = args.timeoutMs ?? 300_000;
+  const intervalMs = args.intervalMs ?? 3_000;
+
+  const desc = await http(url, cfnForm("DescribeStacks", { StackName: args.stackName }), signal);
+  if (desc.status >= 300 && !isStackMissing(desc.text)) {
+    throw new Error(`CloudFormation DescribeStacks failed (${desc.status}): ${cfnErrorMessage(desc.text) ?? desc.text}`);
+  }
+  const exists = desc.status < 300;
+
+  const params = { StackName: args.stackName, TemplateBody: templateBody, ...capabilityParams(capabilities) };
+  let action: "created" | "updated";
+  if (!exists) {
+    const res = await http(url, cfnForm("CreateStack", params), signal);
+    if (res.status >= 300) {
+      throw new Error(`CloudFormation CreateStack failed (${res.status}): ${cfnErrorMessage(res.text) ?? res.text}`);
+    }
+    action = "created";
+  } else {
+    const res = await http(url, cfnForm("UpdateStack", params), signal);
+    if (res.status >= 300) {
+      if (isNoUpdates(res.text)) {
+        console.log(`unchanged: ${args.stackName} (no updates)`);
+        return { stackName: args.stackName, status: "UPDATE_COMPLETE", action: "unchanged" };
+      }
+      throw new Error(`CloudFormation UpdateStack failed (${res.status}): ${cfnErrorMessage(res.text) ?? res.text}`);
+    }
+    action = "updated";
+  }
+
+  const status = await waitForStackSettled(url, args.stackName, http, { timeoutMs, intervalMs }, signal);
+  if (isFailureStatus(status)) {
+    throw new Error(`CloudFormation stack ${args.stackName} ${action} → ${status}`);
+  }
+  console.log(`${action}: ${args.stackName} (${status}) [${url}]`);
+  return { stackName: args.stackName, status, action };
+}
+
+/**
+ * The inverse of {@link awsApply} — DeleteStack, then poll until the stack is
+ * gone. Idempotent: an already-absent stack is a no-op. `http` is injectable.
+ */
+export async function awsDelete(
+  args: AwsApplyArgs,
+  signal?: AbortSignal,
+  http: AwsHttp = defaultHttp,
+): Promise<{ stackName: string; deleted: boolean }> {
+  const url = cfnUrl(args.endpoint, args.region);
+  const timeoutMs = args.timeoutMs ?? 300_000;
+  const intervalMs = args.intervalMs ?? 3_000;
+
+  const res = await http(url, cfnForm("DeleteStack", { StackName: args.stackName }), signal);
+  if (res.status >= 300 && !isStackMissing(res.text)) {
+    throw new Error(`CloudFormation DeleteStack failed (${res.status}): ${cfnErrorMessage(res.text) ?? res.text}`);
+  }
+
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (signal?.aborted) throw new Error("awsDelete aborted");
+    safeHeartbeat({ step: "awsDelete", stack: args.stackName });
+    const d = await http(url, cfnForm("DescribeStacks", { StackName: args.stackName }), signal);
+    if (d.status >= 300 && isStackMissing(d.text)) return { stackName: args.stackName, deleted: true };
+    const status = stackStatus(d.text);
+    if (status === "DELETE_COMPLETE") return { stackName: args.stackName, deleted: true };
+    if (status === "DELETE_FAILED") throw new Error(`CloudFormation stack ${args.stackName} delete → DELETE_FAILED`);
+    await sleep(intervalMs, signal);
+  }
+  throw new Error(`CloudFormation stack ${args.stackName} delete did not complete within ${timeoutMs}ms`);
+}

package/src/op/activities/floci.ts

@@ -115,8 +115,8 @@ export async function flociUp(args: FlociUpArgs, signal?: AbortSignal): Promise<
     if (signal?.aborted) throw new Error("flociUp aborted");
     safeHeartbeat({ step: "flociUp", container: name });
     try {
-      const { stdout } = await execAsync(`curl -fs ${url}`, { signal });
-      if (isFlociReady(stdout, service)) {
+      const res = await fetch(url, { signal });
+      if (res.ok && isFlociReady(await res.text(), service)) {
         ready = true;
         break;
       }

package/src/op/activities/index.ts

@@ -1,7 +1,9 @@
 /**
  * AWS Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `aws` lexicon. Contributes the local Floci AWS
- * emulator lifecycle (`flociUp`/`flociDown`).
+ * emulator lifecycle (`flociUp`/`flociDown`) and the native CloudFormation
+ * applier (`awsApply`), which calls the CloudFormation API directly rather than
+ * shelling `aws` — the direct twin of `azApply`/`gcpApply`.
  */
 export {
   flociUp,
@@ -14,3 +16,22 @@ export {
   isFlociReady,
 } from "./floci";
 export type { FlociUpArgs, FlociDownArgs } from "./floci";
+
+export {
+  awsApply,
+  awsDelete,
+  waitForStackSettled,
+  cfnUrl,
+  cfnForm,
+  capabilityParams,
+  xmlField,
+  stackStatus,
+  stackId,
+  cfnErrorMessage,
+  isStackMissing,
+  isNoUpdates,
+  isSuccessStatus,
+  isFailureStatus,
+  isTerminalStatus,
+} from "./aws-apply";
+export type { AwsApplyArgs, AwsHttp } from "./aws-apply";