@intentius/chant-lexicon-aws 0.18.16 → 0.18.18

package/src/generated/lexicon-aws.json

@@ -5045,6 +5045,11 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "AppConfiguration": {
+    "resourceType": "AWS::EMR::InstanceGroupConfig.AppConfiguration",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "AppCookieStickinessPolicy": {
     "resourceType": "AWS::ElasticLoadBalancing::LoadBalancer.AppCookieStickinessPolicy",
     "kind": "property",
@@ -7156,6 +7161,92 @@
       "tagUpdatable": false
     }
   },
+  "AssessmentFramework": {
+    "resourceType": "AWS::AuditManager::AssessmentFramework",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Arn": "Arn",
+      "FrameworkId": "FrameworkId",
+      "Type": "Type",
+      "CreatedAt": "CreatedAt",
+      "LastUpdatedAt": "LastUpdatedAt",
+      "CreatedBy": "CreatedBy",
+      "LastUpdatedBy": "LastUpdatedBy"
+    },
+    "propertyConstraints": {
+      "Arn": {
+        "pattern": "^arn:.*:auditmanager:",
+        "minLength": 20,
+        "maxLength": 2048
+      },
+      "FrameworkId": {
+        "pattern": "^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$",
+        "minLength": 36,
+        "maxLength": 36
+      },
+      "Name": {
+        "pattern": "^[^\\\\]*$",
+        "minLength": 1,
+        "maxLength": 300
+      },
+      "Description": {
+        "pattern": "^[\\w\\W\\s\\S]*$",
+        "minLength": 1,
+        "maxLength": 1000
+      },
+      "ComplianceType": {
+        "pattern": "^[\\w\\W\\s\\S]*$",
+        "minLength": 0,
+        "maxLength": 100
+      },
+      "Type": {
+        "enum": [
+          "Standard",
+          "Custom"
+        ]
+      },
+      "CreatedAt": {
+        "format": "date-time"
+      },
+      "LastUpdatedAt": {
+        "format": "date-time"
+      },
+      "CreatedBy": {
+        "pattern": "^[a-zA-Z0-9\\s-_()\\[\\]]+$",
+        "minLength": 1,
+        "maxLength": 100
+      },
+      "LastUpdatedBy": {
+        "pattern": "^[a-zA-Z0-9\\s-_()\\[\\]]+$",
+        "minLength": 1,
+        "maxLength": 100
+      }
+    },
+    "primaryIdentifier": [
+      "Arn"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
+  },
+  "AssessmentFramework_ControlSet": {
+    "resourceType": "AWS::AuditManager::AssessmentFramework.ControlSet",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "AssessmentFramework_ControlSetControl": {
+    "resourceType": "AWS::AuditManager::AssessmentFramework.ControlSetControl",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "AssessmentFramework_Tag": {
+    "resourceType": "AWS::AuditManager::AssessmentFramework.Tag",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "AssessmentReportsDestination": {
     "resourceType": "AWS::AuditManager::Assessment.AssessmentReportsDestination",
     "kind": "property",
@@ -15857,6 +15948,37 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "CodeInterpreter": {
+    "resourceType": "AWS::BedrockAgentCore::CodeInterpreter",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "CodeInterpreterArn": "CodeInterpreterArn",
+      "CodeInterpreterId": "CodeInterpreterId",
+      "Status": "Status"
+    },
+    "propertyConstraints": {
+      "CodeInterpreterArn": {
+        "pattern": "^arn:[a-z0-9-]+:bedrock-agentcore:[a-z0-9-]+:(aws|[0-9]{12}):code-interpreter/aws\\.codeinterpreter\\.v1$"
+      },
+      "CodeInterpreterId": {
+        "pattern": "^aws\\.codeinterpreter\\.v1$"
+      },
+      "Status": {
+        "enum": [
+          "CREATING",
+          "CREATE_FAILED",
+          "READY",
+          "DELETING",
+          "DELETE_FAILED",
+          "DELETED"
+        ]
+      }
+    },
+    "primaryIdentifier": [
+      "CodeInterpreterArn"
+    ]
+  },
   "CodeInterpreterCustom": {
     "resourceType": "AWS::BedrockAgentCore::CodeInterpreterCustom",
     "kind": "resource",
@@ -20910,6 +21032,16 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "ControlSet": {
+    "resourceType": "AWS::AuditManager::AssessmentFramework.ControlSet",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "ControlSetControl": {
+    "resourceType": "AWS::AuditManager::AssessmentFramework.ControlSetControl",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "CookieObject": {
     "resourceType": "AWS::Lightsail::Distribution.CookieObject",
     "kind": "property",
@@ -37385,6 +37517,84 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "EvidentlyExperiment": {
+    "resourceType": "AWS::Evidently::Experiment",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Arn": "Arn"
+    },
+    "propertyConstraints": {
+      "Arn": {
+        "pattern": "arn:[^:]*:[^:]*:[^:]*:[^:]*:project/[-a-zA-Z0-9._]*/experiment/[-a-zA-Z0-9._]*"
+      },
+      "Name": {
+        "pattern": "[-a-zA-Z0-9._]*",
+        "minLength": 1,
+        "maxLength": 127
+      },
+      "Project": {
+        "pattern": "([-a-zA-Z0-9._]*)|(arn:[^:]*:[^:]*:[^:]*:[^:]*:project/[-a-zA-Z0-9._]*)",
+        "minLength": 0,
+        "maxLength": 2048
+      },
+      "Description": {
+        "minLength": 0,
+        "maxLength": 160
+      },
+      "RandomizationSalt": {
+        "pattern": ".*",
+        "minLength": 0,
+        "maxLength": 127
+      },
+      "SamplingRate": {
+        "minimum": 0,
+        "maximum": 100000
+      },
+      "Segment": {
+        "pattern": "([-a-zA-Z0-9._]*)|(arn:[^:]*:[^:]*:[^:]*:[^:]*:segment/[-a-zA-Z0-9._]*)",
+        "minLength": 0,
+        "maxLength": 2048
+      }
+    },
+    "createOnly": [
+      "Name",
+      "Project"
+    ],
+    "primaryIdentifier": [
+      "Arn"
+    ]
+  },
+  "EvidentlyExperiment_MetricGoalObject": {
+    "resourceType": "AWS::Evidently::Experiment.MetricGoalObject",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "EvidentlyExperiment_OnlineAbConfigObject": {
+    "resourceType": "AWS::Evidently::Experiment.OnlineAbConfigObject",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "EvidentlyExperiment_RunningStatusObject": {
+    "resourceType": "AWS::Evidently::Experiment.RunningStatusObject",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "EvidentlyExperiment_Tag": {
+    "resourceType": "AWS::Evidently::Experiment.Tag",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "EvidentlyExperiment_TreatmentObject": {
+    "resourceType": "AWS::Evidently::Experiment.TreatmentObject",
+    "kind": "property",
+    "lexicon": "aws"
+  },
+  "EvidentlyExperiment_TreatmentToWeight": {
+    "resourceType": "AWS::Evidently::Experiment.TreatmentToWeight",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "EvidentlyProject": {
     "resourceType": "AWS::Evidently::Project",
     "kind": "resource",
@@ -37548,54 +37758,6 @@
     "kind": "property",
     "lexicon": "aws"
   },
-  "Experiment": {
-    "resourceType": "AWS::Evidently::Experiment",
-    "kind": "resource",
-    "lexicon": "aws",
-    "attrs": {
-      "Arn": "Arn"
-    },
-    "propertyConstraints": {
-      "Arn": {
-        "pattern": "arn:[^:]*:[^:]*:[^:]*:[^:]*:project/[-a-zA-Z0-9._]*/experiment/[-a-zA-Z0-9._]*"
-      },
-      "Name": {
-        "pattern": "[-a-zA-Z0-9._]*",
-        "minLength": 1,
-        "maxLength": 127
-      },
-      "Project": {
-        "pattern": "([-a-zA-Z0-9._]*)|(arn:[^:]*:[^:]*:[^:]*:[^:]*:project/[-a-zA-Z0-9._]*)",
-        "minLength": 0,
-        "maxLength": 2048
-      },
-      "Description": {
-        "minLength": 0,
-        "maxLength": 160
-      },
-      "RandomizationSalt": {
-        "pattern": ".*",
-        "minLength": 0,
-        "maxLength": 127
-      },
-      "SamplingRate": {
-        "minimum": 0,
-        "maximum": 100000
-      },
-      "Segment": {
-        "pattern": "([-a-zA-Z0-9._]*)|(arn:[^:]*:[^:]*:[^:]*:[^:]*:segment/[-a-zA-Z0-9._]*)",
-        "minLength": 0,
-        "maxLength": 2048
-      }
-    },
-    "createOnly": [
-      "Name",
-      "Project"
-    ],
-    "primaryIdentifier": [
-      "Arn"
-    ]
-  },
   "ExperimentConfig": {
     "resourceType": "AWS::SageMaker::ProcessingJob.ExperimentConfig",
     "kind": "property",
@@ -37650,36 +37812,6 @@
     "kind": "property",
     "lexicon": "aws"
   },
-  "Experiment_MetricGoalObject": {
-    "resourceType": "AWS::Evidently::Experiment.MetricGoalObject",
-    "kind": "property",
-    "lexicon": "aws"
-  },
-  "Experiment_OnlineAbConfigObject": {
-    "resourceType": "AWS::Evidently::Experiment.OnlineAbConfigObject",
-    "kind": "property",
-    "lexicon": "aws"
-  },
-  "Experiment_RunningStatusObject": {
-    "resourceType": "AWS::Evidently::Experiment.RunningStatusObject",
-    "kind": "property",
-    "lexicon": "aws"
-  },
-  "Experiment_Tag": {
-    "resourceType": "AWS::Evidently::Experiment.Tag",
-    "kind": "property",
-    "lexicon": "aws"
-  },
-  "Experiment_TreatmentObject": {
-    "resourceType": "AWS::Evidently::Experiment.TreatmentObject",
-    "kind": "property",
-    "lexicon": "aws"
-  },
-  "Experiment_TreatmentToWeight": {
-    "resourceType": "AWS::Evidently::Experiment.TreatmentToWeight",
-    "kind": "property",
-    "lexicon": "aws"
-  },
   "ExpirationDataRule": {
     "resourceType": "AWS::S3Files::FileSystem.ExpirationDataRule",
     "kind": "property",
@@ -48824,7 +48956,7 @@
     "kind": "resource",
     "lexicon": "aws",
     "attrs": {
-      "Id": "Id"
+      "InstanceGroupId": "InstanceGroupId"
     },
     "createOnly": [
       "InstanceRole",
@@ -48837,17 +48969,21 @@
       "Market",
       "BidPrice"
     ],
+    "writeOnly": [
+      "EbsConfiguration/EbsBlockDeviceConfigs/*/VolumesPerInstance"
+    ],
     "primaryIdentifier": [
-      "Id"
+      "InstanceGroupId",
+      "JobFlowId"
     ]
   },
-  "InstanceGroupConfig_AutoScalingPolicy": {
-    "resourceType": "AWS::EMR::InstanceGroupConfig.AutoScalingPolicy",
+  "InstanceGroupConfig_AppConfiguration": {
+    "resourceType": "AWS::EMR::InstanceGroupConfig.AppConfiguration",
     "kind": "property",
     "lexicon": "aws"
   },
-  "InstanceGroupConfig_Configuration": {
-    "resourceType": "AWS::EMR::InstanceGroupConfig.Configuration",
+  "InstanceGroupConfig_AutoScalingPolicy": {
+    "resourceType": "AWS::EMR::InstanceGroupConfig.AutoScalingPolicy",
     "kind": "property",
     "lexicon": "aws"
   },
@@ -85478,6 +85614,53 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "SageMakerExperiment": {
+    "resourceType": "AWS::SageMaker::Experiment",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Arn": "Arn",
+      "CreationTime": "CreationTime",
+      "LastModifiedTime": "LastModifiedTime"
+    },
+    "propertyConstraints": {
+      "Arn": {
+        "pattern": "^arn:aws[a-z\\-]*:sagemaker:[a-z0-9\\-]*:[0-9]{12}:experiment/",
+        "maxLength": 256
+      },
+      "ExperimentName": {
+        "pattern": "^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,119}$",
+        "minLength": 1,
+        "maxLength": 120
+      },
+      "DisplayName": {
+        "pattern": "^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,119}$",
+        "minLength": 1,
+        "maxLength": 120
+      },
+      "Description": {
+        "minLength": 0,
+        "maxLength": 3072
+      },
+      "CreationTime": {
+        "format": "date-time"
+      },
+      "LastModifiedTime": {
+        "format": "date-time"
+      }
+    },
+    "createOnly": [
+      "ExperimentName"
+    ],
+    "primaryIdentifier": [
+      "Arn"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
+  },
   "SageMakerHub": {
     "resourceType": "AWS::SageMaker::Hub",
     "kind": "resource",

package/src/intrinsics.test.ts

@@ -116,6 +116,22 @@ describe("Join intrinsic", () => {
       "Fn::Join": ["-", [{ Ref: "Prefix" }, "bucket"]],
     });
   });
+
+  test("accepts a single list-returning intrinsic (not only an array) (#517)", () => {
+    // Fn::Join's second arg legitimately takes a list-returning intrinsic
+    // (GetAtt of a list attr, Split, Ref to a List<>) — emitted as-is, no `.map`.
+    expect(Join(",", GetAtt("Zone", "NameServers")).toJSON()).toEqual({
+      "Fn::Join": [",", { "Fn::GetAtt": ["Zone", "NameServers"] }],
+    });
+    expect(Join(",", Split(",", "a,b")).toJSON()).toEqual({
+      "Fn::Join": [",", { "Fn::Split": [",", "a,b"] }],
+    });
+  });
+
+  test("throws a clear error for a non-array, non-intrinsic value (#517)", () => {
+    // @ts-expect-error — exercising the runtime guard
+    expect(() => Join(",", "oops")).toThrow(/array or a list-returning intrinsic/);
+  });
 });
 
 describe("Select intrinsic", () => {

package/src/intrinsics.ts

@@ -1,4 +1,4 @@
-import { INTRINSIC_MARKER, resolveIntrinsicValue, type Intrinsic } from "@intentius/chant/intrinsic";
+import { INTRINSIC_MARKER, resolveIntrinsicValue, isIntrinsic, type Intrinsic } from "@intentius/chant/intrinsic";
 import { buildInterpolatedString, defaultInterpolationSerializer } from "@intentius/chant/intrinsic-interpolation";
 import { type Declarable } from "@intentius/chant/declarable";
 import { getLogicalName } from "@intentius/chant/utils";
@@ -129,22 +129,35 @@ export function If(conditionName: string, valueIfTrue: unknown, valueIfFalse: un
 export class JoinIntrinsic implements Intrinsic {
   readonly [INTRINSIC_MARKER] = true as const;
   private delimiter: string;
-  private values: unknown[];
+  private values: unknown[] | Intrinsic;
 
-  constructor(delimiter: string, values: unknown[]) {
+  constructor(delimiter: string, values: unknown[] | Intrinsic) {
     this.delimiter = delimiter;
     this.values = values;
   }
 
-  toJSON(): { "Fn::Join": [string, unknown[]] } {
-    return { "Fn::Join": [this.delimiter, this.values.map(resolveIntrinsicValue)] };
+  toJSON(): { "Fn::Join": [string, unknown] } {
+    // Fn::Join's second arg is either a literal list of values OR a single
+    // list-returning intrinsic (GetAtt of a list attr, Split, Ref to a List<>
+    // param). Only the array form gets `.map`; a lone intrinsic is emitted as-is
+    // (#517 — mapping over it dereferenced undefined and crashed the build).
+    const list = Array.isArray(this.values)
+      ? this.values.map(resolveIntrinsicValue)
+      : resolveIntrinsicValue(this.values);
+    return { "Fn::Join": [this.delimiter, list] };
   }
 }
 
 /**
- * Create a Join intrinsic
+ * Create a Join intrinsic. `values` is a literal array, or a single
+ * list-returning intrinsic (e.g. `Join(",", zone.NameServers)`).
  */
-export function Join(delimiter: string, values: unknown[]): JoinIntrinsic {
+export function Join(delimiter: string, values: unknown[] | Intrinsic): JoinIntrinsic {
+  if (!Array.isArray(values) && !isIntrinsic(values)) {
+    throw new Error(
+      "Join(delimiter, values): values must be an array or a list-returning intrinsic (GetAtt/Split/Ref to a List)",
+    );
+  }
   return new JoinIntrinsic(delimiter, values);
 }
 

package/src/serializer.test.ts

@@ -3,7 +3,7 @@ import { awsSerializer } from "./serializer";
 import { AttrRef } from "@intentius/chant/attrref";
 import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
 import { LexiconOutput } from "@intentius/chant/lexicon-output";
-import { Sub } from "./intrinsics";
+import { Sub, Join } from "./intrinsics";
 import { AWS } from "./pseudo";
 import { nestedStack, NestedStackOutputRef } from "./nested-stack";
 import { stackOutput } from "@intentius/chant/stack-output";
@@ -262,6 +262,23 @@ describe("intrinsic serialization", () => {
 });
 
 describe("LexiconOutput serialization", () => {
+  test("resolves AttrRef nested in a Join output to Fn::GetAtt, not the __attrRef envelope (chant#935)", () => {
+    const s1 = new MockBucket({ BucketName: "subnet-1" });
+    const s2 = new MockBucket({ BucketName: "subnet-2" });
+    (s1.arn as Record<string, unknown>)._setLogicalName("Subnet1");
+    (s2.arn as Record<string, unknown>)._setLogicalName("Subnet2");
+    const joined = new LexiconOutput(Join(":", [s1.arn, s2.arn]), "SubnetIds");
+    joined._setSourceEntity("Subnet1");
+    const entities = new Map<string, Declarable>();
+    entities.set("Subnet1", s1);
+    entities.set("Subnet2", s2);
+    const template = JSON.parse(awsSerializer.serialize(entities, [joined]));
+    const value = JSON.stringify(template.Outputs.SubnetIds.Value);
+    expect(value).not.toContain("__attrRef");
+    expect(value).toContain("Fn::GetAtt");
+    expect(value).toContain("Fn::Join");
+  });
+
   test("generates CF Outputs section for LexiconOutputs", () => {
     const bucket = new MockBucket({ BucketName: "data-bucket" });
     const lexiconOutput = new LexiconOutput(bucket.arn, "DataBucketArn");
@@ -305,6 +322,23 @@ describe("LexiconOutput serialization", () => {
     });
   });
 
+  test("resolves an AttrRef nested in an intrinsic output → Fn::GetAtt, not __attrRef (#935)", () => {
+    const b1 = new MockBucket({ BucketName: "b1" });
+    const b2 = new MockBucket({ BucketName: "b2" });
+    const r1 = new AttrRef(b1, "Arn"); r1._setLogicalName("B1");
+    const r2 = new AttrRef(b2, "Arn"); r2._setLogicalName("B2");
+    const joined = new LexiconOutput(Join(",", [r1, r2]), "oArns");
+
+    const entities = new Map<string, Declarable>();
+    entities.set("B1", b1);
+    entities.set("B2", b2);
+
+    const template = JSON.parse(awsSerializer.serialize(entities, [joined]) as string);
+    expect(template.Outputs.oArns.Value).toEqual({
+      "Fn::Join": [",", [{ "Fn::GetAtt": ["B1", "Arn"] }, { "Fn::GetAtt": ["B2", "Arn"] }]],
+    });
+  });
+
   test("omits Outputs section when no LexiconOutputs provided", () => {
     const entities = new Map<string, Declarable>();
     entities.set("MyBucket", new MockBucket({ BucketName: "bucket" }));
@@ -364,6 +398,23 @@ describe("stackOutput serialization", () => {
       "Fn::GetAtt": ["MyBucket", "Arn"],
     });
   });
+
+  test("intrinsic-wrapped output (Join over a ref) → Fn::Join + Fn::GetAtt (#517)", () => {
+    const bucket = new MockBucket({ BucketName: "my-bucket" });
+    // Deliberately NOT pre-resolved — the serializer must set the nested ref's
+    // logical name from the entity map (resolveAttrRefs doesn't reach it here).
+    const arnRef = new AttrRef(bucket, "Arn");
+    const output = stackOutput(Join(",", arnRef));
+
+    const entities = new Map<string, Declarable>();
+    entities.set("MyBucket", bucket);
+    entities.set("MyBucketJoined", output as unknown as Declarable);
+
+    const template = JSON.parse(awsSerializer.serialize(entities) as string);
+    expect(template.Outputs.MyBucketJoined.Value).toEqual({
+      "Fn::Join": [",", { "Fn::GetAtt": ["MyBucket", "Arn"] }],
+    });
+  });
 });
 
 // ── Nested Stack Serialization ──────────────────────────

package/src/serializer.ts

@@ -7,6 +7,7 @@ import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { isChildProject, type ChildProjectInstance } from "@intentius/chant/child-project";
 import { isStackOutput, type StackOutput } from "@intentius/chant/stack-output";
+import { isAttrRefLike } from "@intentius/chant/utils";
 import { resolveDependsOn } from "@intentius/chant/resource-attributes";
 import { isDefaultTags, type TagEntry } from "./default-tags";
 import { loadTaggableResources } from "./taggable";
@@ -101,6 +102,31 @@ function toCFValue(value: unknown, entityNames: Map<Declarable, string>): unknow
   return walkValue(value, entityNames, cfnVisitor(entityNames));
 }
 
+/**
+ * Set logical names on any AttrRefs nested inside a value (e.g. inside a `Join`
+ * that a `stackOutput` exports). resolveAttrRefs only reaches entity attributes,
+ * not refs buried in an output's intrinsic — without this the walker would throw
+ * "logical name not set" for them (#517).
+ */
+function resolveNestedAttrRefs(
+  value: unknown,
+  entityNames: Map<Declarable, string>,
+  seen = new Set<unknown>(),
+): void {
+  if (value === null || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  if (isAttrRefLike(value)) {
+    if (!value.getLogicalName()) {
+      const parent = value.parent.deref();
+      const parentName = parent ? entityNames.get(parent as Declarable) : undefined;
+      if (parentName) value._setLogicalName(parentName);
+    }
+    return;
+  }
+  const children = Array.isArray(value) ? value : Object.values(value as Record<string, unknown>);
+  for (const child of children) resolveNestedAttrRefs(child, entityNames, seen);
+}
+
 /**
  * Convert entity props to CF properties
  */
@@ -289,31 +315,42 @@ function serializeToTemplate(
         template.Outputs = {};
       }
       const stackOutput = entity as StackOutput;
-      const ref = stackOutput.sourceRef;
-      const logicalName = ref.getLogicalName();
-      if (logicalName) {
+      // Typed `unknown` so `isAttrRefLike` narrows cleanly regardless of how the
+      // AttrRef type resolves across the workspace/published boundary.
+      const ref: unknown = stackOutput.sourceRef;
+      let value: unknown;
+      if (isAttrRefLike(ref)) {
+        const logicalName = ref.getLogicalName();
+        if (!logicalName) continue;
         // Use Ref for primary identifier ("Id") since not all resources
         // support Fn::GetAtt for their primary identifier (e.g. ACM Certificate).
         // Ref always returns the primary identifier for any CF resource.
-        const output: CFOutput = {
-          Value: ref.attribute === "Id"
-            ? { Ref: logicalName }
-            : { "Fn::GetAtt": [logicalName, ref.attribute] },
-        };
-        if (stackOutput.description) {
-          output.Description = stackOutput.description;
-        }
-        template.Outputs[name] = output;
+        value = ref.attribute === "Id" ? { Ref: logicalName } : { "Fn::GetAtt": [logicalName, ref.attribute] };
+      } else {
+        // An intrinsic wrapping refs (e.g. Join(",", zone.NameServers), #517):
+        // resolve the nested AttrRefs' logical names from the entity map, then
+        // serialize through the CF walker → {Fn::Join:[",",{Fn::GetAtt:[…]}]}.
+        resolveNestedAttrRefs(ref, entityNames);
+        value = toCFValue(ref, entityNames);
+      }
+      const output: CFOutput = { Value: value };
+      if (stackOutput.description) {
+        output.Description = stackOutput.description;
       }
+      template.Outputs[name] = output;
     }
   }
 
-  // Add CF Outputs for LexiconOutputs produced by this lexicon
+  // Add CF Outputs for LexiconOutputs produced by this lexicon. Run the value
+  // through the CF walker so an AttrRef nested in an intrinsic (e.g.
+  // Join(",", [subnet1.SubnetId, …])) becomes Fn::GetAtt instead of leaking the
+  // generic `{__attrRef}` envelope — the same conversion resource Properties get
+  // (#935). A bare Fn::GetAtt value walks through unchanged.
   if (outputs && outputs.length > 0) {
     template.Outputs = template.Outputs ?? {};
     for (const output of outputs) {
       template.Outputs[output.outputName] = {
-        Value: output.getOutputValue(),
+        Value: toCFValue(output.getOutputValue(), entityNames),
       };
     }
   }