@intentius/chant-lexicon-aws 0.18.15 → 0.18.17

package/src/import/live-export-io.test.ts

@@ -41,14 +41,24 @@ describe("aws exportResources I/O glue (#160)", () => {
     expect(ir.resources.map((r) => r.logicalId)).toEqual(["MyBucket"]);
   });
 
-  test("a non-zero exit throws with the stderr surfaced", async () => {
+  test("a not-yet-deployed stack returns empty live state (pre-first-apply), not an error", async () => {
     spawnMock.mockResolvedValue({
       stdout: "",
-      stderr: "Stack with id ghost does not exist",
+      stderr: "An error occurred (ValidationError) …: Stack with id ghost does not exist",
       exitCode: 254,
     });
-    await expect(awsPlugin.exportResources!({ environment: "ghost" })).rejects.toThrow(
-      /Failed to get template for stack "ghost".*does not exist/,
+    const ir = await awsPlugin.exportResources!({ environment: "ghost" });
+    expect(ir.resources).toEqual([]);
+  });
+
+  test("a genuine failure (not 'does not exist') still throws with the stderr surfaced", async () => {
+    spawnMock.mockResolvedValue({
+      stdout: "",
+      stderr: "An error occurred (AccessDenied) …: not authorized",
+      exitCode: 254,
+    });
+    await expect(awsPlugin.exportResources!({ environment: "prod" })).rejects.toThrow(
+      /Failed to get template for stack "prod".*AccessDenied/,
     );
   });
 

package/src/intrinsics.test.ts

@@ -116,6 +116,22 @@ describe("Join intrinsic", () => {
       "Fn::Join": ["-", [{ Ref: "Prefix" }, "bucket"]],
     });
   });
+
+  test("accepts a single list-returning intrinsic (not only an array) (#517)", () => {
+    // Fn::Join's second arg legitimately takes a list-returning intrinsic
+    // (GetAtt of a list attr, Split, Ref to a List<>) — emitted as-is, no `.map`.
+    expect(Join(",", GetAtt("Zone", "NameServers")).toJSON()).toEqual({
+      "Fn::Join": [",", { "Fn::GetAtt": ["Zone", "NameServers"] }],
+    });
+    expect(Join(",", Split(",", "a,b")).toJSON()).toEqual({
+      "Fn::Join": [",", { "Fn::Split": [",", "a,b"] }],
+    });
+  });
+
+  test("throws a clear error for a non-array, non-intrinsic value (#517)", () => {
+    // @ts-expect-error — exercising the runtime guard
+    expect(() => Join(",", "oops")).toThrow(/array or a list-returning intrinsic/);
+  });
 });
 
 describe("Select intrinsic", () => {

package/src/intrinsics.ts

@@ -1,4 +1,4 @@
-import { INTRINSIC_MARKER, resolveIntrinsicValue, type Intrinsic } from "@intentius/chant/intrinsic";
+import { INTRINSIC_MARKER, resolveIntrinsicValue, isIntrinsic, type Intrinsic } from "@intentius/chant/intrinsic";
 import { buildInterpolatedString, defaultInterpolationSerializer } from "@intentius/chant/intrinsic-interpolation";
 import { type Declarable } from "@intentius/chant/declarable";
 import { getLogicalName } from "@intentius/chant/utils";
@@ -129,22 +129,35 @@ export function If(conditionName: string, valueIfTrue: unknown, valueIfFalse: un
 export class JoinIntrinsic implements Intrinsic {
   readonly [INTRINSIC_MARKER] = true as const;
   private delimiter: string;
-  private values: unknown[];
+  private values: unknown[] | Intrinsic;
 
-  constructor(delimiter: string, values: unknown[]) {
+  constructor(delimiter: string, values: unknown[] | Intrinsic) {
     this.delimiter = delimiter;
     this.values = values;
   }
 
-  toJSON(): { "Fn::Join": [string, unknown[]] } {
-    return { "Fn::Join": [this.delimiter, this.values.map(resolveIntrinsicValue)] };
+  toJSON(): { "Fn::Join": [string, unknown] } {
+    // Fn::Join's second arg is either a literal list of values OR a single
+    // list-returning intrinsic (GetAtt of a list attr, Split, Ref to a List<>
+    // param). Only the array form gets `.map`; a lone intrinsic is emitted as-is
+    // (#517 — mapping over it dereferenced undefined and crashed the build).
+    const list = Array.isArray(this.values)
+      ? this.values.map(resolveIntrinsicValue)
+      : resolveIntrinsicValue(this.values);
+    return { "Fn::Join": [this.delimiter, list] };
   }
 }
 
 /**
- * Create a Join intrinsic
+ * Create a Join intrinsic. `values` is a literal array, or a single
+ * list-returning intrinsic (e.g. `Join(",", zone.NameServers)`).
  */
-export function Join(delimiter: string, values: unknown[]): JoinIntrinsic {
+export function Join(delimiter: string, values: unknown[] | Intrinsic): JoinIntrinsic {
+  if (!Array.isArray(values) && !isIntrinsic(values)) {
+    throw new Error(
+      "Join(delimiter, values): values must be an array or a list-returning intrinsic (GetAtt/Split/Ref to a List)",
+    );
+  }
   return new JoinIntrinsic(delimiter, values);
 }
 

package/src/plugin.test.ts

@@ -1,7 +1,19 @@
 import { describe, test, expect } from "vitest";
-import { awsPlugin } from "./plugin";
+import { awsPlugin, stackDoesNotExist } from "./plugin";
 import { isLexiconPlugin } from "@intentius/chant/lexicon";
 
+describe("stackDoesNotExist (pre-first-apply live state)", () => {
+  test("true for the CloudFormation 'does not exist' error", () => {
+    expect(stackDoesNotExist(
+      "An error occurred (ValidationError) when calling the DescribeStackResources operation: Stack with id prod does not exist",
+    )).toBe(true);
+  });
+  test("false for other failures (auth, network) — those still throw", () => {
+    expect(stackDoesNotExist("An error occurred (InvalidClientTokenId) ...")).toBe(false);
+    expect(stackDoesNotExist("Could not connect to the endpoint URL")).toBe(false);
+  });
+});
+
 describe("awsPlugin", () => {
   // -----------------------------------------------------------------------
   // Basic interface

package/src/plugin.ts

@@ -24,6 +24,13 @@ import { parseStackTemplate } from "./import/live-export";
 import { awsCompletions } from "./lsp/completions";
 import { awsHover } from "./lsp/hover";
 
+/** True when a CloudFormation CLI error means the stack simply isn't there yet
+ * (`ValidationError … does not exist`) — the pre-first-apply state, which live
+ * queries should treat as "nothing deployed", not a failure. Exported for testing. */
+export function stackDoesNotExist(stderr: string): boolean {
+  return /does not exist/i.test(stderr);
+}
+
 /**
  * AWS CloudFormation lexicon plugin.
  *
@@ -497,6 +504,13 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
     ], process.env.AWS_ENDPOINT_URL));
 
     if (listResult.exitCode !== 0) {
+      // A stack that doesn't exist yet is the pre-first-apply state: nothing is
+      // deployed for this env, so there are no live resources (every declared
+      // resource is "pending") — not an error. Returning empty lets `lifecycle
+      // diff --live` / the overlay show pending nodes instead of failing hard.
+      if (stackDoesNotExist(listResult.stderr)) {
+        return resources;
+      }
       throw new Error(`Failed to describe stack "${stackName}": ${listResult.stderr}`);
     }
 
@@ -579,6 +593,12 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
       "--output", "json",
     ], process.env.AWS_ENDPOINT_URL));
     if (result.exitCode !== 0) {
+      // Not deployed yet → no template to export (nothing live), not an error.
+      // Keeps `chant graph --live` edge enrichment and `import --from` quiet
+      // before the first apply.
+      if (stackDoesNotExist(result.stderr)) {
+        return parseStackTemplate({ Resources: {} }, options.selector, options.owned);
+      }
       throw new Error(`Failed to get template for stack "${stackName}": ${result.stderr}`);
     }
 

package/src/serializer.test.ts

@@ -3,7 +3,7 @@ import { awsSerializer } from "./serializer";
 import { AttrRef } from "@intentius/chant/attrref";
 import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
 import { LexiconOutput } from "@intentius/chant/lexicon-output";
-import { Sub } from "./intrinsics";
+import { Sub, Join } from "./intrinsics";
 import { AWS } from "./pseudo";
 import { nestedStack, NestedStackOutputRef } from "./nested-stack";
 import { stackOutput } from "@intentius/chant/stack-output";
@@ -262,6 +262,23 @@ describe("intrinsic serialization", () => {
 });
 
 describe("LexiconOutput serialization", () => {
+  test("resolves AttrRef nested in a Join output to Fn::GetAtt, not the __attrRef envelope (chant#935)", () => {
+    const s1 = new MockBucket({ BucketName: "subnet-1" });
+    const s2 = new MockBucket({ BucketName: "subnet-2" });
+    (s1.arn as Record<string, unknown>)._setLogicalName("Subnet1");
+    (s2.arn as Record<string, unknown>)._setLogicalName("Subnet2");
+    const joined = new LexiconOutput(Join(":", [s1.arn, s2.arn]), "SubnetIds");
+    joined._setSourceEntity("Subnet1");
+    const entities = new Map<string, Declarable>();
+    entities.set("Subnet1", s1);
+    entities.set("Subnet2", s2);
+    const template = JSON.parse(awsSerializer.serialize(entities, [joined]));
+    const value = JSON.stringify(template.Outputs.SubnetIds.Value);
+    expect(value).not.toContain("__attrRef");
+    expect(value).toContain("Fn::GetAtt");
+    expect(value).toContain("Fn::Join");
+  });
+
   test("generates CF Outputs section for LexiconOutputs", () => {
     const bucket = new MockBucket({ BucketName: "data-bucket" });
     const lexiconOutput = new LexiconOutput(bucket.arn, "DataBucketArn");
@@ -305,6 +322,23 @@ describe("LexiconOutput serialization", () => {
     });
   });
 
+  test("resolves an AttrRef nested in an intrinsic output → Fn::GetAtt, not __attrRef (#935)", () => {
+    const b1 = new MockBucket({ BucketName: "b1" });
+    const b2 = new MockBucket({ BucketName: "b2" });
+    const r1 = new AttrRef(b1, "Arn"); r1._setLogicalName("B1");
+    const r2 = new AttrRef(b2, "Arn"); r2._setLogicalName("B2");
+    const joined = new LexiconOutput(Join(",", [r1, r2]), "oArns");
+
+    const entities = new Map<string, Declarable>();
+    entities.set("B1", b1);
+    entities.set("B2", b2);
+
+    const template = JSON.parse(awsSerializer.serialize(entities, [joined]) as string);
+    expect(template.Outputs.oArns.Value).toEqual({
+      "Fn::Join": [",", [{ "Fn::GetAtt": ["B1", "Arn"] }, { "Fn::GetAtt": ["B2", "Arn"] }]],
+    });
+  });
+
   test("omits Outputs section when no LexiconOutputs provided", () => {
     const entities = new Map<string, Declarable>();
     entities.set("MyBucket", new MockBucket({ BucketName: "bucket" }));
@@ -364,6 +398,23 @@ describe("stackOutput serialization", () => {
       "Fn::GetAtt": ["MyBucket", "Arn"],
     });
   });
+
+  test("intrinsic-wrapped output (Join over a ref) → Fn::Join + Fn::GetAtt (#517)", () => {
+    const bucket = new MockBucket({ BucketName: "my-bucket" });
+    // Deliberately NOT pre-resolved — the serializer must set the nested ref's
+    // logical name from the entity map (resolveAttrRefs doesn't reach it here).
+    const arnRef = new AttrRef(bucket, "Arn");
+    const output = stackOutput(Join(",", arnRef));
+
+    const entities = new Map<string, Declarable>();
+    entities.set("MyBucket", bucket);
+    entities.set("MyBucketJoined", output as unknown as Declarable);
+
+    const template = JSON.parse(awsSerializer.serialize(entities) as string);
+    expect(template.Outputs.MyBucketJoined.Value).toEqual({
+      "Fn::Join": [",", { "Fn::GetAtt": ["MyBucket", "Arn"] }],
+    });
+  });
 });
 
 // ── Nested Stack Serialization ──────────────────────────

package/src/serializer.ts

@@ -7,6 +7,7 @@ import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { isChildProject, type ChildProjectInstance } from "@intentius/chant/child-project";
 import { isStackOutput, type StackOutput } from "@intentius/chant/stack-output";
+import { isAttrRefLike } from "@intentius/chant/utils";
 import { resolveDependsOn } from "@intentius/chant/resource-attributes";
 import { isDefaultTags, type TagEntry } from "./default-tags";
 import { loadTaggableResources } from "./taggable";
@@ -101,6 +102,31 @@ function toCFValue(value: unknown, entityNames: Map<Declarable, string>): unknow
   return walkValue(value, entityNames, cfnVisitor(entityNames));
 }
 
+/**
+ * Set logical names on any AttrRefs nested inside a value (e.g. inside a `Join`
+ * that a `stackOutput` exports). resolveAttrRefs only reaches entity attributes,
+ * not refs buried in an output's intrinsic — without this the walker would throw
+ * "logical name not set" for them (#517).
+ */
+function resolveNestedAttrRefs(
+  value: unknown,
+  entityNames: Map<Declarable, string>,
+  seen = new Set<unknown>(),
+): void {
+  if (value === null || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  if (isAttrRefLike(value)) {
+    if (!value.getLogicalName()) {
+      const parent = value.parent.deref();
+      const parentName = parent ? entityNames.get(parent as Declarable) : undefined;
+      if (parentName) value._setLogicalName(parentName);
+    }
+    return;
+  }
+  const children = Array.isArray(value) ? value : Object.values(value as Record<string, unknown>);
+  for (const child of children) resolveNestedAttrRefs(child, entityNames, seen);
+}
+
 /**
  * Convert entity props to CF properties
  */
@@ -289,31 +315,42 @@ function serializeToTemplate(
         template.Outputs = {};
       }
       const stackOutput = entity as StackOutput;
-      const ref = stackOutput.sourceRef;
-      const logicalName = ref.getLogicalName();
-      if (logicalName) {
+      // Typed `unknown` so `isAttrRefLike` narrows cleanly regardless of how the
+      // AttrRef type resolves across the workspace/published boundary.
+      const ref: unknown = stackOutput.sourceRef;
+      let value: unknown;
+      if (isAttrRefLike(ref)) {
+        const logicalName = ref.getLogicalName();
+        if (!logicalName) continue;
         // Use Ref for primary identifier ("Id") since not all resources
         // support Fn::GetAtt for their primary identifier (e.g. ACM Certificate).
         // Ref always returns the primary identifier for any CF resource.
-        const output: CFOutput = {
-          Value: ref.attribute === "Id"
-            ? { Ref: logicalName }
-            : { "Fn::GetAtt": [logicalName, ref.attribute] },
-        };
-        if (stackOutput.description) {
-          output.Description = stackOutput.description;
-        }
-        template.Outputs[name] = output;
+        value = ref.attribute === "Id" ? { Ref: logicalName } : { "Fn::GetAtt": [logicalName, ref.attribute] };
+      } else {
+        // An intrinsic wrapping refs (e.g. Join(",", zone.NameServers), #517):
+        // resolve the nested AttrRefs' logical names from the entity map, then
+        // serialize through the CF walker → {Fn::Join:[",",{Fn::GetAtt:[…]}]}.
+        resolveNestedAttrRefs(ref, entityNames);
+        value = toCFValue(ref, entityNames);
+      }
+      const output: CFOutput = { Value: value };
+      if (stackOutput.description) {
+        output.Description = stackOutput.description;
       }
+      template.Outputs[name] = output;
     }
   }
 
-  // Add CF Outputs for LexiconOutputs produced by this lexicon
+  // Add CF Outputs for LexiconOutputs produced by this lexicon. Run the value
+  // through the CF walker so an AttrRef nested in an intrinsic (e.g.
+  // Join(",", [subnet1.SubnetId, …])) becomes Fn::GetAtt instead of leaking the
+  // generic `{__attrRef}` envelope — the same conversion resource Properties get
+  // (#935). A bare Fn::GetAtt value walks through unchanged.
   if (outputs && outputs.length > 0) {
     template.Outputs = template.Outputs ?? {};
     for (const output of outputs) {
       template.Outputs[output.outputName] = {
-        Value: output.getOutputValue(),
+        Value: toCFValue(output.getOutputValue(), entityNames),
       };
     }
   }