@intentius/chant-lexicon-aws 0.18.16 → 0.18.18

package/dist/types/index.d.ts

@@ -2707,6 +2707,42 @@ export declare class Assessment {
   readonly CreationTime: number;
 }
 
+export declare class AssessmentFramework {
+  constructor(props: {
+    /** The control sets that are associated with the framework. */
+    ControlSets: AssessmentFramework_ControlSet[];
+    /** The name of the framework. */
+    Name: string;
+    /** The Amazon Resource Name (ARN) of the framework. */
+    Arn?: string;
+    /** The compliance type that the framework supports, such as CIS or HIPAA. */
+    ComplianceType?: string;
+    /** The time when the framework was created. */
+    CreatedAt?: string;
+    /** The user or role that created the framework. */
+    CreatedBy?: string;
+    /** The description of the framework. */
+    Description?: string;
+    /** The unique identifier for the framework. */
+    FrameworkId?: string;
+    /** The time when the framework was most recently updated. */
+    LastUpdatedAt?: string;
+    /** The user or role that most recently updated the framework. */
+    LastUpdatedBy?: string;
+    /** The tags associated with the framework. */
+    Tags?: AssessmentFramework_Tag[];
+    /** The framework type, such as a standard framework or a custom framework. */
+    Type?: "Custom" | "Standard";
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly CreatedAt: string;
+  readonly CreatedBy: string;
+  readonly FrameworkId: string;
+  readonly LastUpdatedAt: string;
+  readonly LastUpdatedBy: string;
+  readonly Type: "Custom" | "Standard";
+}
+
 export declare class AssessmentTarget {
   constructor(props: {
     Arn?: string;
@@ -5684,6 +5720,20 @@ export declare class CodeDeployApplication {
   }, attributes?: CFResourceAttributes);
 }
 
+export declare class CodeInterpreter {
+  constructor(props: {
+    /** The Amazon Resource Name (ARN) of the code interpreter. */
+    CodeInterpreterArn?: string;
+    /** The unique identifier of the code interpreter. */
+    CodeInterpreterId?: string;
+    /** The current status of the code interpreter. */
+    Status?: "CREATE_FAILED" | "CREATING" | "DELETED" | "DELETE_FAILED" | "DELETING" | "READY";
+  }, attributes?: CFResourceAttributes);
+  readonly CodeInterpreterArn: string;
+  readonly CodeInterpreterId: string;
+  readonly Status: "CREATE_FAILED" | "CREATING" | "DELETED" | "DELETE_FAILED" | "DELETING" | "READY";
+}
+
 export declare class CodeInterpreterCustom {
   constructor(props: {
     /** The name of the code interpreter. */
@@ -13747,6 +13797,27 @@ export declare class EventType {
   readonly LastUpdatedTime: string;
 }
 
+export declare class EvidentlyExperiment {
+  constructor(props: {
+    MetricGoals: EvidentlyExperiment_MetricGoalObject[];
+    Name: string;
+    OnlineAbConfig: EvidentlyExperiment_OnlineAbConfigObject;
+    Project: string;
+    Treatments: EvidentlyExperiment_TreatmentObject[];
+    Arn?: string;
+    Description?: string;
+    RandomizationSalt?: string;
+    RemoveSegment?: boolean;
+    /** Start Experiment. Default is False */
+    RunningStatus?: EvidentlyExperiment_RunningStatusObject;
+    SamplingRate?: number;
+    Segment?: string;
+    /** An array of key-value pairs to apply to this resource. */
+    Tags?: EvidentlyExperiment_Tag[];
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+}
+
 export declare class EvidentlyProject {
   constructor(props: {
     Name: string;
@@ -13828,27 +13899,6 @@ export declare class ExecutionPlan {
   readonly Id: string;
 }
 
-export declare class Experiment {
-  constructor(props: {
-    MetricGoals: Experiment_MetricGoalObject[];
-    Name: string;
-    OnlineAbConfig: Experiment_OnlineAbConfigObject;
-    Project: string;
-    Treatments: Experiment_TreatmentObject[];
-    Arn?: string;
-    Description?: string;
-    RandomizationSalt?: string;
-    RemoveSegment?: boolean;
-    /** Start Experiment. Default is False */
-    RunningStatus?: Experiment_RunningStatusObject;
-    SamplingRate?: number;
-    Segment?: string;
-    /** An array of key-value pairs to apply to this resource. */
-    Tags?: Experiment_Tag[];
-  }, attributes?: CFResourceAttributes);
-  readonly Arn: string;
-}
-
 export declare class ExperimentTemplate {
   constructor(props: {
     Description: string;
@@ -17601,14 +17651,14 @@ export declare class InstanceGroupConfig {
     JobFlowId: string;
     AutoScalingPolicy?: InstanceGroupConfig_AutoScalingPolicy;
     BidPrice?: string;
-    Configurations?: InstanceGroupConfig_Configuration[];
+    Configurations?: InstanceGroupConfig_AppConfiguration[];
     CustomAmiId?: string;
     EbsConfiguration?: InstanceGroupConfig_EbsConfiguration;
-    Id?: string;
+    InstanceGroupId?: string;
     Market?: string;
     Name?: string;
   }, attributes?: CFResourceAttributes);
-  readonly Id: string;
+  readonly InstanceGroupId: string;
 }
 
 export declare class InstanceProfile {
@@ -30766,6 +30816,28 @@ export declare class SageMakerEndpoint {
   readonly EndpointName: string;
 }
 
+export declare class SageMakerExperiment {
+  constructor(props: {
+    /** The name of the experiment. Must be unique in your AWS account and is not case-sensitive. */
+    ExperimentName: string;
+    /** The Amazon Resource Name (ARN) of the experiment. */
+    Arn?: string;
+    /** When the experiment was created. */
+    CreationTime?: string;
+    /** The description of the experiment. */
+    Description?: string;
+    /** The name of the experiment as displayed. The name does not need to be unique. */
+    DisplayName?: string;
+    /** When the experiment was last modified. */
+    LastModifiedTime?: string;
+    /** A list of tags to associate with the experiment. */
+    Tags?: Record<string, unknown>[];
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly CreationTime: string;
+  readonly LastModifiedTime: string;
+}
+
 export declare class SageMakerHub {
   constructor(props: {
     /** A description of the hub. */
@@ -41403,6 +41475,14 @@ export declare class AppConfigResourceObject {
   });
 }
 
+export declare class AppConfiguration {
+  constructor(props: {
+    Classification?: string;
+    ConfigurationProperties?: Record<string, unknown>;
+    Configurations?: InstanceGroupConfig_AppConfiguration[];
+  });
+}
+
 export declare class AppCookieStickinessPolicy {
   constructor(props: {
     /** The name of the application cookie used for stickiness. */
@@ -43713,6 +43793,31 @@ export declare class Assessment_Tag {
   });
 }
 
+export declare class AssessmentFramework_ControlSet {
+  constructor(props: {
+    /** The list of controls within the control set. */
+    Controls: AssessmentFramework_ControlSetControl[];
+    /** The name of the control set. */
+    Name: string;
+  });
+}
+
+export declare class AssessmentFramework_ControlSetControl {
+  constructor(props: {
+    /** The unique identifier of the control. */
+    Id: string;
+  });
+}
+
+export declare class AssessmentFramework_Tag {
+  constructor(props: {
+    /** The key name of the tag. */
+    Key: string;
+    /** The value for the tag. */
+    Value: string;
+  });
+}
+
 export declare class AssessmentReportsDestination {
   constructor(props: {
     Destination?: string;
@@ -56326,6 +56431,22 @@ export declare class ControlPlaneScalingConfig {
   });
 }
 
+export declare class ControlSet {
+  constructor(props: {
+    /** The list of controls within the control set. */
+    Controls: AssessmentFramework_ControlSetControl[];
+    /** The name of the control set. */
+    Name: string;
+  });
+}
+
+export declare class ControlSetControl {
+  constructor(props: {
+    /** The unique identifier of the control. */
+    Id: string;
+  });
+}
+
 export declare class CookieObject {
   constructor(props: {
     /** The specific cookies to forward to your distribution's origin. */
@@ -69802,6 +69923,65 @@ export declare class EventType_Tag {
   });
 }
 
+export declare class EvidentlyExperiment_MetricGoalObject {
+  constructor(props: {
+    DesiredChange: "DECREASE" | "INCREASE";
+    /** The JSON path to reference the entity id in the event. */
+    EntityIdKey: string;
+    MetricName: string;
+    /** The JSON path to reference the numerical metric value in the event. */
+    ValueKey: string;
+    /** Event patterns have the same structure as the events they match. Rules use event patterns to select events. An event pattern either matches an event or it doesn't. */
+    EventPattern?: string;
+    UnitLabel?: string;
+  });
+}
+
+export declare class EvidentlyExperiment_OnlineAbConfigObject {
+  constructor(props: {
+    ControlTreatmentName?: string;
+    TreatmentWeights?: EvidentlyExperiment_TreatmentToWeight[];
+  });
+}
+
+export declare class EvidentlyExperiment_RunningStatusObject {
+  constructor(props: {
+    /** Provide the analysis Completion time for an experiment */
+    AnalysisCompleteTime?: string;
+    /** Provide CANCELLED or COMPLETED desired state when stopping an experiment */
+    DesiredState?: string;
+    /** Reason is a required input for stopping the experiment */
+    Reason?: string;
+    /** Provide START or STOP action to apply on an experiment */
+    Status?: string;
+  });
+}
+
+export declare class EvidentlyExperiment_Tag {
+  constructor(props: {
+    /** The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. */
+    Key: string;
+    /** The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. */
+    Value: string;
+  });
+}
+
+export declare class EvidentlyExperiment_TreatmentObject {
+  constructor(props: {
+    Feature: string;
+    TreatmentName: string;
+    Variation: string;
+    Description?: string;
+  });
+}
+
+export declare class EvidentlyExperiment_TreatmentToWeight {
+  constructor(props: {
+    SplitWeight: number;
+    Treatment: string;
+  });
+}
+
 export declare class EvidentlyProject_AppConfigResourceObject {
   constructor(props: {
     ApplicationId: string;
@@ -69971,65 +70151,6 @@ export declare class ExecutiveSummaryOption {
   });
 }
 
-export declare class Experiment_MetricGoalObject {
-  constructor(props: {
-    DesiredChange: "DECREASE" | "INCREASE";
-    /** The JSON path to reference the entity id in the event. */
-    EntityIdKey: string;
-    MetricName: string;
-    /** The JSON path to reference the numerical metric value in the event. */
-    ValueKey: string;
-    /** Event patterns have the same structure as the events they match. Rules use event patterns to select events. An event pattern either matches an event or it doesn't. */
-    EventPattern?: string;
-    UnitLabel?: string;
-  });
-}
-
-export declare class Experiment_OnlineAbConfigObject {
-  constructor(props: {
-    ControlTreatmentName?: string;
-    TreatmentWeights?: Experiment_TreatmentToWeight[];
-  });
-}
-
-export declare class Experiment_RunningStatusObject {
-  constructor(props: {
-    /** Provide the analysis Completion time for an experiment */
-    AnalysisCompleteTime?: string;
-    /** Provide CANCELLED or COMPLETED desired state when stopping an experiment */
-    DesiredState?: string;
-    /** Reason is a required input for stopping the experiment */
-    Reason?: string;
-    /** Provide START or STOP action to apply on an experiment */
-    Status?: string;
-  });
-}
-
-export declare class Experiment_Tag {
-  constructor(props: {
-    /** The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. */
-    Key: string;
-    /** The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. */
-    Value: string;
-  });
-}
-
-export declare class Experiment_TreatmentObject {
-  constructor(props: {
-    Feature: string;
-    TreatmentName: string;
-    Variation: string;
-    Description?: string;
-  });
-}
-
-export declare class Experiment_TreatmentToWeight {
-  constructor(props: {
-    SplitWeight: number;
-    Treatment: string;
-  });
-}
-
 export declare class ExperimentConfig {
   constructor(props: {
     /** The name of an existing experiment to associate with the trial component. */
@@ -78935,24 +79056,26 @@ export declare class InstanceFleetConfig_SpotResizingSpecification {
   });
 }
 
-export declare class InstanceGroupConfig_AutoScalingPolicy {
+export declare class InstanceGroupConfig_AppConfiguration {
   constructor(props: {
-    Constraints: InstanceGroupConfig_ScalingConstraints;
-    Rules: InstanceGroupConfig_ScalingRule[];
+    Classification?: string;
+    ConfigurationProperties?: Record<string, unknown>;
+    Configurations?: InstanceGroupConfig_AppConfiguration[];
   });
 }
 
-export declare class InstanceGroupConfig_Configuration {
+export declare class InstanceGroupConfig_AutoScalingPolicy {
   constructor(props: {
-    Classification?: string;
-    ConfigurationProperties?: Record<string, unknown>;
-    Configurations?: InstanceGroupConfig_Configuration[];
+    Constraints: InstanceGroupConfig_ScalingConstraints;
+    Rules: InstanceGroupConfig_ScalingRule[];
   });
 }
 
 export declare class InstanceGroupConfig_EbsBlockDeviceConfig {
   constructor(props: {
     VolumeSpecification: InstanceGroupConfig_VolumeSpecification;
+    /** Use of this property can confuse CloudFormation drift detection. The EbsBlockDeviceConfigs read from the system may return a list with one entry per volume, replacing any entry specified in the template with a VolumesPerInstance greater than one by that many entries containing only the VolumeSpecification. Thus to avoid false drift detection, it is recommended to supply repeated entries in EbsBlockDeviceConfigs for any VolumeSpecification which is intended to be repeated and not to use this property.
+ */
     VolumesPerInstance?: number;
   });
 }
@@ -85949,10 +86072,10 @@ export declare class LogAlarm_ScheduleConfiguration {
   constructor(props: {
     /** The expression that defines when the scheduled query runs, e.g. rate(1 minute). */
     ScheduleExpression: string;
-    /** The number of seconds into the past to end the query window. */
+    /** The number of seconds into the past to start the query window. Must be a positive value and cannot exceed 2592000 seconds (30 days). */
+    StartTimeOffset: number;
+    /** The number of seconds into the past to end the query window. Must be a non-negative value and cannot exceed 2592000 seconds (30 days). */
     EndTimeOffset?: number;
-    /** The number of seconds into the past to start the query window. */
-    StartTimeOffset?: number;
   });
 }
 
@@ -85960,14 +86083,16 @@ export declare class LogAlarm_ScheduledQueryConfiguration {
   constructor(props: {
     /** The aggregation expression for the scheduled query, e.g. count(*) or avg(latency) by host. */
     AggregationExpression: string;
-    /** The log groups to query. */
-    LogGroupIdentifiers: string[];
     /** The query string to execute against the specified log groups. */
     QueryString: string;
     /** The schedule configuration. */
     ScheduleConfiguration: LogAlarm_ScheduleConfiguration;
     /** The ARN of the IAM role that grants permissions to execute the scheduled query. */
     ScheduledQueryRoleARN: string;
+    /** The log groups to query. */
+    LogGroupIdentifiers?: string[];
+    /** A list of key-value pairs to associate with the scheduled query that backs the log alarm. */
+    Tags?: LogAlarm_Tag[];
   });
 }
 
@@ -94660,7 +94785,7 @@ export declare class OnInput {
 export declare class OnlineAbConfigObject {
   constructor(props: {
     ControlTreatmentName?: string;
-    TreatmentWeights?: Experiment_TreatmentToWeight[];
+    TreatmentWeights?: EvidentlyExperiment_TreatmentToWeight[];
   });
 }
 
@@ -109455,14 +109580,16 @@ export declare class ScheduledQueryConfiguration {
   constructor(props: {
     /** The aggregation expression for the scheduled query, e.g. count(*) or avg(latency) by host. */
     AggregationExpression: string;
-    /** The log groups to query. */
-    LogGroupIdentifiers: string[];
     /** The query string to execute against the specified log groups. */
     QueryString: string;
     /** The schedule configuration. */
     ScheduleConfiguration: LogAlarm_ScheduleConfiguration;
     /** The ARN of the IAM role that grants permissions to execute the scheduled query. */
     ScheduledQueryRoleARN: string;
+    /** The log groups to query. */
+    LogGroupIdentifiers?: string[];
+    /** A list of key-value pairs to associate with the scheduled query that backs the log alarm. */
+    Tags?: LogAlarm_Tag[];
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.18.16",
+  "version": "0.18.18",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.18.16",
+    "@intentius/chant": "^0.18.18",
     "typescript": "^5.9.3"
   }
 }

package/src/components/apply.test.ts

@@ -48,6 +48,57 @@ describe("cfn-deploy (#557)", () => {
     ).rejects.toThrow(/CREATE_FAILED/);
   });
 
+  it("throws fail-closed on an undefined stack status (Floci) instead of a TypeError (#947)", async () => {
+    const base = createMockCloudExecutor({ stacks: { "search-service": {} } });
+    const executor = {
+      ...base.executor,
+      cloudformation: {
+        ...base.executor.cloudformation,
+        waitForStack: async () => ({ stackStatus: undefined as unknown as string, outputs: {} }),
+      },
+    };
+    const capability = createCfnDeployCapability(executor);
+    await expect(
+      capability.run(ctx, { stack: "search-service", template: "archive:search.template.json" }),
+    ).rejects.toThrow(/indeterminate status/);
+  });
+
+  it("rollback degrades gracefully when the target lacks RollbackStack (Floci) (#947)", async () => {
+    const base = createMockCloudExecutor({ stacks: { "search-service": {} } });
+    const executor = {
+      ...base.executor,
+      cloudformation: {
+        ...base.executor.cloudformation,
+        rollbackStack: async () => {
+          throw new Error(
+            "An error occurred (UnknownAction) when calling the RollbackStack operation: Action RollbackStack is not supported.",
+          );
+        },
+      },
+    };
+    const capability = createCfnDeployCapability(executor);
+    await expect(
+      capability.rollback!(ctx, { stack: "search-service", template: "archive:search.template.json" }),
+    ).resolves.toBeUndefined();
+  });
+
+  it("rollback rethrows a genuine failure (not an unsupported action) (#947)", async () => {
+    const base = createMockCloudExecutor({ stacks: { "search-service": {} } });
+    const executor = {
+      ...base.executor,
+      cloudformation: {
+        ...base.executor.cloudformation,
+        rollbackStack: async () => {
+          throw new Error("An error occurred (AccessDenied): not authorized to RollbackStack");
+        },
+      },
+    };
+    const capability = createCfnDeployCapability(executor);
+    await expect(
+      capability.rollback!(ctx, { stack: "search-service", template: "archive:search.template.json" }),
+    ).rejects.toThrow(/AccessDenied/);
+  });
+
   it("passes wired inputs and imageRef through as CloudFormation parameters", async () => {
     const mock = createMockCloudExecutor({ stacks: { "search-service": {} } });
     const capability = createCfnDeployCapability(mock.executor);

package/src/components/apply.ts

@@ -153,15 +153,33 @@ export function createCfnDeployCapability(
       // failed deploy as green (and hand downstream steps an empty `outputs`),
       // so throw — the same fail-closed contract the rest of the release model
       // relies on.
-      if (stackStatus.includes("ROLLBACK") || stackStatus.endsWith("_FAILED")) {
+      // A missing status is fail-closed too: Floci's describe-stacks can omit
+      // StackStatus mid-rollback, and `undefined.includes` would throw a TypeError
+      // that masks the real deploy failure (#947).
+      if (!stackStatus || stackStatus.includes("ROLLBACK") || stackStatus.endsWith("_FAILED")) {
         throw new Error(
-          `cfn-deploy "${stack}": stack reached ${stackStatus} — the deploy failed and was rolled back. Inspect the stack events for the resource that failed to create/update.`,
+          `cfn-deploy "${stack}": stack reached ${stackStatus ?? "an indeterminate status"} — the deploy failed and was rolled back. Inspect the stack events for the resource that failed to create/update.`,
         );
       }
       return { stackStatus, outputs, ...(snapshotId ? { snapshotId } : {}) };
     },
     async rollback(ctx, input) {
-      await executor.cloudformation.rollbackStack(input.stack ?? ctx.component);
+      const stack = input.stack ?? ctx.component;
+      try {
+        await executor.cloudformation.rollbackStack(stack);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        // Local emulators (Floci) don't implement RollbackStack → `UnknownAction`.
+        // The stack is already in a terminal failed state; degrade to a clear
+        // message instead of crashing the compensation phase (#947).
+        if (/UnknownAction|not supported/i.test(message)) {
+          console.error(
+            `cfn-deploy rollback "${stack}": the target doesn't support RollbackStack (a local emulator such as Floci) — skipping automated rollback. Original: ${message}`,
+          );
+          return;
+        }
+        throw err;
+      }
     },
   };
 }

package/src/components/cloud-executor.test.ts

@@ -1,5 +1,25 @@
 import { describe, test, expect } from "vitest";
-import { applyAwsEndpoint, applyAwsEndpointArgv } from "./cloud-executor";
+import { applyAwsEndpoint, applyAwsEndpointArgv, ecsDeploymentId, ecsServiceStable } from "./cloud-executor";
+
+describe("ecsDeploymentId / ecsServiceStable — tolerate Floci's missing deployments (#937)", () => {
+  test("deployment id: real AWS shape", () => {
+    expect(ecsDeploymentId({ service: { deployments: [{ id: "ecs-svc/123" }] } })).toBe("ecs-svc/123");
+  });
+  test("deployment id: Floci omits `deployments` entirely → '' (no crash)", () => {
+    expect(ecsDeploymentId({ service: {} })).toBe("");
+    expect(ecsDeploymentId({ service: { deployments: [] } })).toBe("");
+  });
+
+  test("stable: running==desired with ≤1 deployment", () => {
+    expect(ecsServiceStable({ runningCount: 2, desiredCount: 2, deployments: [{}] })).toBe(true);
+    expect(ecsServiceStable({ runningCount: 1, desiredCount: 2, deployments: [{}] })).toBe(false);
+    expect(ecsServiceStable({ runningCount: 2, desiredCount: 2, deployments: [{}, {}] })).toBe(false);
+  });
+  test("stable: Floci omits `deployments` → treated as 0, no crash", () => {
+    expect(ecsServiceStable({ runningCount: 2, desiredCount: 2 })).toBe(true);
+    expect(ecsServiceStable(undefined)).toBe(true); // 0 == 0
+  });
+});
 
 describe("applyAwsEndpoint", () => {
   const url = "http://localhost:4566";

package/src/components/cloud-executor.ts

@@ -463,6 +463,23 @@ const realCloudFormation: CloudFormationClient = {
   },
 };
 
+/** Deployment id from an ECS `update-service` response. Tolerant of Floci, whose
+ * `service` omits `deployments` entirely (real AWS always includes it) — guards
+ * the index, not just `.id` (#937). Exported for testing. */
+export function ecsDeploymentId(described: { service: { deployments?: Array<{ id: string }> } }): string {
+  return described.service.deployments?.[0]?.id ?? "";
+}
+
+/** Whether an ECS service is steady (running == desired, ≤1 active deployment).
+ * Tolerant of Floci's missing `deployments` field. Exported for testing. */
+export function ecsServiceStable(
+  svc: { runningCount?: number; desiredCount?: number; deployments?: unknown[] } | undefined,
+): boolean {
+  const running = svc?.runningCount ?? 0;
+  const desired = svc?.desiredCount ?? 0;
+  return running === desired && (svc?.deployments?.length ?? 0) <= 1;
+}
+
 const realEcs: EcsClient = {
   async updateService(args) {
     const parts = [`aws ecs update-service`, `--cluster ${q(args.cluster)}`, `--service ${q(args.service)}`];
@@ -470,20 +487,18 @@ const realEcs: EcsClient = {
     if (args.desiredCount !== undefined) parts.push(`--desired-count ${args.desiredCount}`);
     if (args.forceNewDeployment) parts.push(`--force-new-deployment`);
     const { stdout } = await run(parts.join(" "));
-    const described = JSON.parse(stdout) as { service: { deployments: Array<{ id: string }> } };
-    return { deploymentId: described.service.deployments[0]?.id ?? "" };
+    const described = JSON.parse(stdout) as { service: { deployments?: Array<{ id: string }> } };
+    return { deploymentId: ecsDeploymentId(described) };
   },
   async describeService(cluster, service) {
     const { stdout } = await run(
       `aws ecs describe-services --cluster ${q(cluster)} --services ${q(service)}`,
     );
     const described = JSON.parse(stdout) as {
-      services: Array<{ runningCount: number; desiredCount: number; deployments: unknown[] }>;
+      services: Array<{ runningCount: number; desiredCount: number; deployments?: unknown[] }>;
     };
     const svc = described.services[0];
-    const running = svc?.runningCount ?? 0;
-    const desired = svc?.desiredCount ?? 0;
-    return { runningCount: running, desiredCount: desired, stable: running === desired && (svc?.deployments.length ?? 0) <= 1 };
+    return { runningCount: svc?.runningCount ?? 0, desiredCount: svc?.desiredCount ?? 0, stable: ecsServiceStable(svc) };
   },
   async rollbackService(args) {
     await realEcs.updateService(args);

package/src/composites/agentcore-agent.test.ts

@@ -7,6 +7,7 @@ import { AttrRef } from "@intentius/chant/attrref";
 // precedent for aws-lexicon integration-style tests.
 import { resolveAttrRefs } from "../../../../packages/core/src/discovery/resolve";
 import { AgentCoreAgent } from "./agentcore-agent";
+import { Split, Ref } from "../intrinsics";
 import { awsSerializer } from "../serializer";
 
 const baseProps = {
@@ -104,6 +105,17 @@ describe("AgentCoreAgent", () => {
     );
   });
 
+  test("VPC mode accepts a cross-stack intrinsic (Fn::Split) — checks presence, not .length (#938)", () => {
+    // A cross-stack value (Split of a Parameter) is a truthy intrinsic with no
+    // `.length`; it WAS supplied, so the composite must not reject it.
+    const subnets = Split(",", Ref("SubnetIdsParam")) as unknown as string[];
+    const sgs = Split(",", Ref("SgIdsParam")) as unknown as string[];
+    const instance = AgentCoreAgent({ ...baseProps, networkMode: "VPC", vpcSubnetIds: subnets, vpcSecurityGroupIds: sgs });
+    const vpcConfigProps = ((instance.runtime as any).props.NetworkConfiguration as any).props.NetworkModeConfig.props;
+    expect(vpcConfigProps.Subnets).toBe(subnets);
+    expect(vpcConfigProps.SecurityGroups).toBe(sgs);
+  });
+
   test("throws when memoryEventExpiryDays is out of CFN bounds (3-365)", () => {
     expect(() => AgentCoreAgent({ ...baseProps, memoryEventExpiryDays: 1 })).toThrow(
       "AgentCoreAgent memoryEventExpiryDays must be between 3 and 365",