@intentius/chant-lexicon-aws 0.33.1 → 0.34.0

package/src/generated/index.d.ts

@@ -16403,6 +16403,38 @@ export declare class Harness {
   readonly Version: string;
 }
 
+export declare class HarnessEndpoint {
+  constructor(props: {
+    /** The name of the endpoint. Must start with a letter and contain only alphanumeric characters and underscores. */
+    EndpointName: string;
+    /** The ID of the harness that the endpoint belongs to. */
+    HarnessId: string;
+    /** The Amazon Resource Name (ARN) of the endpoint. */
+    Arn?: string;
+    /** The timestamp when the endpoint was created. */
+    CreatedAt?: string;
+    /** The description of the endpoint. */
+    Description?: string;
+    /** The name of the harness that the endpoint belongs to. */
+    HarnessName?: string;
+    /** The harness version that the endpoint is currently serving. */
+    LiveVersion?: string;
+    Status?: HarnessEndpoint_HarnessEndpointStatus;
+    /** Tags to apply to the harness endpoint resource. */
+    Tags?: HarnessEndpoint_Tag[];
+    /** The harness version that the endpoint points to and serves invocations from. */
+    TargetVersion?: string;
+    /** The timestamp when the endpoint was last updated. */
+    UpdatedAt?: string;
+  }, attributes?: CFResourceAttributes);
+  readonly Arn: string;
+  readonly CreatedAt: string;
+  readonly HarnessName: string;
+  readonly LiveVersion: string;
+  readonly Status: HarnessEndpoint_HarnessEndpointStatus;
+  readonly UpdatedAt: string;
+}
+
 export declare class HealthCheck {
   constructor(props: {
     /** A complex type that contains information about the health check. */
@@ -57089,7 +57121,7 @@ export declare class ContainerRecipe_EbsInstanceBlockDeviceSpecification {
     /** Use to override the device's volume size. */
     VolumeSize?: number;
     /** Use to override the device's volume type. */
-    VolumeType?: "gp2" | "gp3" | "io1" | "io2" | "sc1" | "st1" | "standard";
+    VolumeType?: "gp2" | "gp3" | "gp3a" | "io1" | "io2" | "io2a" | "sc1" | "st1" | "standard";
   });
 }
 
@@ -75141,7 +75173,7 @@ export declare class GlobalTable_ReplicaSSESpecification {
 
 export declare class GlobalTable_ReplicaStreamSpecification {
   constructor(props: {
-    ResourcePolicy?: GlobalTable_ResourcePolicy;
+    ResourcePolicy: GlobalTable_ResourcePolicy;
   });
 }
 
@@ -76693,6 +76725,13 @@ export declare class HarnessBedrockModelConfig {
   });
 }
 
+export declare class HarnessEndpoint_Tag {
+  constructor(props: {
+    Key: string;
+    Value: string;
+  });
+}
+
 export declare class HarnessEnvironmentArtifact {
   constructor(props: {
     ContainerConfiguration?: Harness_ContainerConfiguration;
@@ -78724,7 +78763,7 @@ export declare class ImageRecipe_EbsInstanceBlockDeviceSpecification {
     /** Use to override the device's volume size. */
     VolumeSize?: number;
     /** Use to override the device's volume type. */
-    VolumeType?: "gp2" | "gp3" | "io1" | "io2" | "sc1" | "st1" | "standard";
+    VolumeType?: "gp2" | "gp3" | "gp3a" | "io1" | "io2" | "io2a" | "sc1" | "st1" | "standard";
   });
 }
 
@@ -86435,7 +86474,9 @@ export declare class Listener_RedirectConfig {
 
 export declare class Listener_Tag {
   constructor(props: {
+    /** The key of the tag. */
     Key: string;
+    /** The value of the tag. */
     Value: string;
   });
 }
@@ -106283,7 +106324,7 @@ export declare class ReplicaSSESpecification {
 
 export declare class ReplicaStreamSpecification {
   constructor(props: {
-    ResourcePolicy?: GlobalTable_ResourcePolicy;
+    ResourcePolicy: GlobalTable_ResourcePolicy;
   });
 }
 
@@ -112163,6 +112204,8 @@ export declare class Scraper_Destination {
   constructor(props: {
     /** Configuration for Amazon Managed Prometheus metrics destination */
     AmpConfiguration?: Record<string, unknown>;
+    /** Configuration for CloudWatch metrics destination */
+    CloudWatchConfiguration?: Record<string, unknown>;
   });
 }
 
@@ -130350,6 +130393,15 @@ export type Harness_HarnessStatus =
   | "UPDATE_FAILED"
   | "UPDATING";
 
+export type HarnessEndpoint_HarnessEndpointStatus =
+  | "CREATE_FAILED"
+  | "CREATING"
+  | "DELETE_FAILED"
+  | "DELETING"
+  | "READY"
+  | "UPDATE_FAILED"
+  | "UPDATING";
+
 export type HealthImagingDatastore_DatastoreStatus =
   | "ACTIVE"
   | "CREATE_FAILED"

package/src/generated/index.ts

@@ -640,6 +640,7 @@ export const GuardHook = createResource("AWS::CloudFormation::GuardHook", "aws",
 export const Guardrail = createResource("AWS::Bedrock::Guardrail", "aws", {"CreatedAt":"CreatedAt","FailureRecommendations":"FailureRecommendations","GuardrailArn":"GuardrailArn","GuardrailId":"GuardrailId","Status":"Status","StatusReasons":"StatusReasons","UpdatedAt":"UpdatedAt","Version":"Version"});
 export const GuardrailVersion = createResource("AWS::Bedrock::GuardrailVersion", "aws", {"GuardrailArn":"GuardrailArn","GuardrailId":"GuardrailId","Version":"Version"});
 export const Harness = createResource("AWS::BedrockAgentCore::Harness", "aws", {"Arn":"Arn","HarnessId":"HarnessId","Status":"Status","Version":"Version","CreatedAt":"CreatedAt","UpdatedAt":"UpdatedAt","Memory_ManagedMemoryConfiguration_Arn":"Memory.ManagedMemoryConfiguration.Arn","Environment_AgentCoreRuntimeEnvironment_AgentRuntimeArn":"Environment.AgentCoreRuntimeEnvironment.AgentRuntimeArn","Environment_AgentCoreRuntimeEnvironment_AgentRuntimeName":"Environment.AgentCoreRuntimeEnvironment.AgentRuntimeName","Environment_AgentCoreRuntimeEnvironment_AgentRuntimeId":"Environment.AgentCoreRuntimeEnvironment.AgentRuntimeId"});
+export const HarnessEndpoint = createResource("AWS::BedrockAgentCore::HarnessEndpoint", "aws", {"Arn":"Arn","HarnessName":"HarnessName","Status":"Status","LiveVersion":"LiveVersion","CreatedAt":"CreatedAt","UpdatedAt":"UpdatedAt"});
 export const HealthCheck = createResource("AWS::Route53::HealthCheck", "aws", {"HealthCheckId":"HealthCheckId"});
 export const HealthImagingDatastore = createResource("AWS::HealthImaging::Datastore", "aws", {"DatastoreArn":"DatastoreArn","CreatedAt":"CreatedAt","UpdatedAt":"UpdatedAt","DatastoreId":"DatastoreId","DatastoreStatus":"DatastoreStatus"});
 export const HookDefaultVersion = createResource("AWS::CloudFormation::HookDefaultVersion", "aws", {"Arn":"Arn"});
@@ -5495,6 +5496,7 @@ export const HarnessAgentCoreGatewayConfig = createProperty("AWS::BedrockAgentCo
 export const HarnessAgentCoreMemoryConfiguration = createProperty("AWS::BedrockAgentCore::Harness.HarnessAgentCoreMemoryConfiguration", "aws");
 export const HarnessAgentCoreRuntimeEnvironment = createProperty("AWS::BedrockAgentCore::Harness.HarnessAgentCoreRuntimeEnvironment", "aws");
 export const HarnessBedrockModelConfig = createProperty("AWS::BedrockAgentCore::Harness.HarnessBedrockModelConfig", "aws");
+export const HarnessEndpoint_Tag = createProperty("AWS::BedrockAgentCore::HarnessEndpoint.Tag", "aws");
 export const HarnessEnvironmentArtifact = createProperty("AWS::BedrockAgentCore::Harness.HarnessEnvironmentArtifact", "aws");
 export const HarnessEnvironmentProvider = createProperty("AWS::BedrockAgentCore::Harness.HarnessEnvironmentProvider", "aws");
 export const HarnessGeminiModelConfig = createProperty("AWS::BedrockAgentCore::Harness.HarnessGeminiModelConfig", "aws");

package/src/generated/lexicon-aws.json

@@ -44553,6 +44553,67 @@
     "kind": "property",
     "lexicon": "aws"
   },
+  "HarnessEndpoint": {
+    "resourceType": "AWS::BedrockAgentCore::HarnessEndpoint",
+    "kind": "resource",
+    "lexicon": "aws",
+    "attrs": {
+      "Arn": "Arn",
+      "HarnessName": "HarnessName",
+      "Status": "Status",
+      "LiveVersion": "LiveVersion",
+      "CreatedAt": "CreatedAt",
+      "UpdatedAt": "UpdatedAt"
+    },
+    "propertyConstraints": {
+      "HarnessId": {
+        "pattern": "^[a-zA-Z][a-zA-Z0-9_]{0,39}-[a-zA-Z0-9]{10}$"
+      },
+      "EndpointName": {
+        "pattern": "^[a-zA-Z][a-zA-Z0-9_]{0,47}$"
+      },
+      "TargetVersion": {
+        "pattern": "^([1-9][0-9]{0,4})$",
+        "minLength": 1,
+        "maxLength": 5
+      },
+      "LiveVersion": {
+        "pattern": "^([1-9][0-9]{0,4})$",
+        "minLength": 1,
+        "maxLength": 5
+      },
+      "Description": {
+        "minLength": 1,
+        "maxLength": 256
+      },
+      "CreatedAt": {
+        "format": "date-time"
+      },
+      "UpdatedAt": {
+        "format": "date-time"
+      }
+    },
+    "createOnly": [
+      "HarnessId",
+      "EndpointName"
+    ],
+    "writeOnly": [
+      "TargetVersion"
+    ],
+    "primaryIdentifier": [
+      "Arn"
+    ],
+    "tagging": {
+      "taggable": true,
+      "tagOnCreate": true,
+      "tagUpdatable": true
+    }
+  },
+  "HarnessEndpoint_Tag": {
+    "resourceType": "AWS::BedrockAgentCore::HarnessEndpoint.Tag",
+    "kind": "property",
+    "lexicon": "aws"
+  },
   "HarnessEnvironmentArtifact": {
     "resourceType": "AWS::BedrockAgentCore::Harness.HarnessEnvironmentArtifact",
     "kind": "property",
@@ -70884,7 +70945,7 @@
         "maxLength": 256
       },
       "FunctionName": {
-        "pattern": "^(arn:(aws[a-zA-Z-]*)?:lambda:)?((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:)?(\\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\\$LATEST|[a-zA-Z0-9-_]+))?$",
+        "pattern": "^(arn:(aws[a-zA-Z-]*)?:lambda:)?((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:)?(\\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\\$LATEST(\\.PUBLISHED)?|[a-zA-Z0-9-_]+))?$",
         "minLength": 1,
         "maxLength": 140
       },

package/src/plugin.ts

@@ -1,6 +1,6 @@
 import { createRequire } from "module";
 import { detectTemplate } from "./detect";
-import type { LexiconPlugin, IntrinsicDef, ObservationResult, DeepObservationResult, ResourceMetadata, ExportedTemplate, ResourceSelector, InitTemplateSet, StackStatusObservation } from "@intentius/chant/lexicon";
+import type { LexiconPlugin, IntrinsicDef, ObservationResult, DeepObservationResult, DependencyObservation, ResourceMetadata, ExportedTemplate, ResourceSelector, InitTemplateSet, StackStatusObservation } from "@intentius/chant/lexicon";
 const require = createRequire(import.meta.url);
 import type { LintRule } from "@intentius/chant/lint/rule";
 import type { TemplateParser } from "@intentius/chant/import/parser";
@@ -19,6 +19,9 @@ import { applyAwsEndpointArgv } from "./components/cloud-executor";
 import { stackDoesNotExist } from "./stack-errors";
 import { awsDeepNormalizationHooks, observeResourcesDeepAws } from "./deep-observe";
 import { awsReferenceCatalog } from "./reference-catalog";
+import { AMBIENT_KINDS } from "./ambient";
+import { describeOwnProperties, stampRegion } from "./properties";
+import { stampProviderDefaults } from "./defaults";
 import { resolveTemplateAttrs } from "./live-attrs";
 import { CFParser } from "./import/parser";
 import { CFGenerator } from "./import/generator";
@@ -36,58 +39,8 @@ export { stackDoesNotExist } from "./stack-errors";
  * Provides serializer, lint rules, template detection,
  * import parsing, and code generation for AWS CloudFormation.
  */
-/**
- * Resolve `internetFacing` per instance LOGICAL id from LIVE route tables — a
- * subnet is internet-facing iff its route table (an explicit association, else
- * the VPC's main table) has a default route to an Internet Gateway. This covers
- * the account's default VPC, whose routing chant does not model declaratively
- * (the instance references it through a parameter). Best-effort: any failure
- * returns what it has, so search still works on the declared topology.
- */
-async function liveInternetFacing(regionArgs: string[], stackName: string): Promise<Record<string, string>> {
-  const { getRuntime } = await import("@intentius/chant/runtime-adapter");
-  const rt = getRuntime();
-  const run = (args: string[]) =>
-    rt.spawn(applyAwsEndpointArgv(["aws", ...args, ...regionArgs, "--output", "json"], process.env.AWS_ENDPOINT_URL));
-  const out: Record<string, string> = {};
-  try {
-    const res = await run(["cloudformation", "describe-stack-resources", "--stack-name", stackName]);
-    if (res.exitCode !== 0) return out;
-    const stackRes = (JSON.parse(res.stdout).StackResources ?? []) as Array<{ LogicalResourceId: string; ResourceType: string; PhysicalResourceId: string }>;
-    const instByLogical = new Map<string, string>();
-    for (const r of stackRes) if (r.ResourceType === "AWS::EC2::Instance") instByLogical.set(r.LogicalResourceId, r.PhysicalResourceId);
-    if (instByLogical.size === 0) return out;
-
-    const di = await run(["ec2", "describe-instances", "--instance-ids", ...instByLogical.values()]);
-    if (di.exitCode !== 0) return out;
-    const locByInst = new Map<string, { subnet?: string; vpc?: string }>();
-    for (const rsv of (JSON.parse(di.stdout).Reservations ?? []) as Array<{ Instances?: Array<{ InstanceId: string; SubnetId?: string; VpcId?: string }> }>)
-      for (const i of rsv.Instances ?? []) locByInst.set(i.InstanceId, { subnet: i.SubnetId, vpc: i.VpcId });
-
-    const rtRes = await run(["ec2", "describe-route-tables"]);
-    if (rtRes.exitCode !== 0) return out;
-    const subnetIgw = new Map<string, string>();
-    const vpcMainIgw = new Map<string, string>();
-    for (const t of (JSON.parse(rtRes.stdout).RouteTables ?? []) as Array<{ RouteTableId?: string; VpcId?: string; Routes?: Array<{ GatewayId?: string }>; Associations?: Array<{ SubnetId?: string; Main?: boolean }> }>) {
-      const igwRoute = (t.Routes ?? []).find((r) => typeof r.GatewayId === "string" && r.GatewayId.startsWith("igw-"));
-      if (!igwRoute) continue;
-      const ev = `${t.RouteTableId ?? "rtb"} → ${igwRoute.GatewayId}`;
-      for (const a of t.Associations ?? []) {
-        if (a.SubnetId) subnetIgw.set(a.SubnetId, ev);
-        if (a.Main && t.VpcId) vpcMainIgw.set(t.VpcId, ev);
-      }
-    }
-
-    for (const [logical, instId] of instByLogical) {
-      const loc = locByInst.get(instId);
-      const ev = loc ? ((loc.subnet && subnetIgw.get(loc.subnet)) || (loc.vpc && vpcMainIgw.get(loc.vpc))) : undefined;
-      if (ev) out[logical] = ev;
-    }
-  } catch {
-    /* best-effort */
-  }
-  return out;
-}
+/** #1265 — the ownership notice is about the environment, so it is said once. */
+let warnedOwnership = false;
 
 export const awsPlugin: LexiconPlugin = {
   name: "aws",
@@ -598,10 +551,17 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
     if (options.owned) {
       // describe-stack-resources does not return tags, so ownership cannot be
       // determined here. Degrade to detect-only rather than silently filtering.
-      // eslint-disable-next-line no-console
-      console.warn(
+      //
+      // Once per process, not once per stack (#1265). It is a property of the
+      // environment, not of each stack, and a four-stack project printed four
+      // identical copies ahead of every answer — enough that an agent piping
+      // `graph --format ir` with `2>&1` had to skip lines to find the JSON.
+      warnedOwnership ||
+        // eslint-disable-next-line no-console
+        console.warn(
         "[aws] ownership filter unavailable on describeResources (no tags from describe-stack-resources) — returning all, each with an explicit `unknown` verdict; use `chant import --from <env> --owned` for ownership-filtered export",
-      );
+        );
+      warnedOwnership = true;
     }
 
     // Derive stack name. A multi-stack project passes the explicit CloudFormation
@@ -708,10 +668,17 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
       };
     }
 
+    // Each resource's OWN properties, on top of the stack outputs above (#1279).
+    // Until this, a node's `attrs` were the stack's exports replicated onto
+    // every member, so no instance carried its own `VpcId`.
+    const withProperties = stampProviderDefaults(
+      stampRegion(await describeOwnProperties(resources, options.region), options.region),
+    );
+
     // Every entity the stack answered for was answered for: an entity the
     // template doesn't carry is genuinely not in this stack, which is an
     // absence, not a hole.
-    return observation(resources);
+    return observation(withProperties);
   },
 
   /**
@@ -719,12 +686,52 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
    * CloudFormation's view of the world, into the resource as the service
    * actually holds it. Implementation in ./deep-observe.ts.
    */
+  /**
+   * The routing this estate depends on but does not declare (#1273) — an
+   * instance in the account's default VPC routes through a table nobody wrote.
+   * Reporting the resources lets the graph fold derive `internetFacing`, rather
+   * than this lexicon computing it and injecting the conclusion.
+   */
+  async observeDependencies(options: {
+    environment: string;
+    entities: Map<string, { entityType: string; props: Record<string, unknown> }>;
+    observed: Record<string, ResourceMetadata>;
+    stack?: string;
+    region?: string;
+  }): Promise<DependencyObservation> {
+    const { observeAwsDependencies } = await import("./dependencies");
+    return observeAwsDependencies({ observed: options.observed, region: options.region });
+  },
+
+  /**
+   * Resources of a managed kind that exist without being declared or
+   * referenced (#1278) — the account's default security groups, an unattached
+   * one someone left behind. Nothing else in the observation can see them,
+   * because everything else resolves outward from what is declared.
+   */
+  /** #1278 — the kinds `observeAmbient` can enumerate, from the same source. */
+  ambientKinds(): string[] {
+    return AMBIENT_KINDS;
+  },
+
+  async observeAmbient(options: {
+    environment: string;
+    kinds: string[];
+    observed: Record<string, ResourceMetadata>;
+    stack?: string;
+    region?: string;
+  }): Promise<Record<string, ResourceMetadata>> {
+    const { observeAwsAmbient } = await import("./ambient");
+    return observeAwsAmbient({ kinds: options.kinds, observed: options.observed, region: options.region });
+  },
+
   async observeResourcesDeep(options: {
     environment: string;
     buildOutput: string;
     entityNames: string[];
     entities: Map<string, { entityType: string; props: Record<string, unknown> }>;
     stack?: string;
+    region?: string;
     owned?: boolean;
   }): Promise<DeepObservationResult> {
     return observeResourcesDeepAws({
@@ -732,6 +739,7 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
       entityNames: options.entityNames,
       entities: options.entities,
       stack: options.stack,
+      region: options.region,
       owned: options.owned,
     });
   },
@@ -827,13 +835,6 @@ aws cloudformation wait stack-update-complete --stack-name my-app-prod`,
         for (const [logicalId, v] of Object.entries(attrs)) {
           merged[multi ? `${ref.name}::${logicalId}` : logicalId] = v;
         }
-        // Resolve internetFacing from live route tables (covers the default VPC),
-        // carrying the route-table → IGW evidence so search can justify the match.
-        const facing = await liveInternetFacing(ref.region ? ["--region", ref.region] : [], ref.name);
-        for (const [logicalId, via] of Object.entries(facing)) {
-          const key = multi ? `${ref.name}::${logicalId}` : logicalId;
-          merged[key] = { ...merged[key], internetFacing: true, internetFacingVia: via };
-        }
       } catch {
         // A stack that isn't deployed yet contributes no live attrs — skip it.
       }

package/src/properties.test.ts

@@ -0,0 +1,113 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+const spawnMock = vi.fn();
+vi.mock("@intentius/chant/runtime-adapter", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@intentius/chant/runtime-adapter")>();
+  return { ...actual, getRuntime: () => ({ ...actual.getRuntime(), spawn: spawnMock }) };
+});
+
+const { describeOwnProperties, canDescribe, stampRegion } = await import("./properties");
+
+const ok = (body: unknown) => ({ stdout: JSON.stringify(body), stderr: "", exitCode: 0 });
+const fail = { stdout: "", stderr: "InvalidInstanceID.NotFound", exitCode: 255 };
+
+const instance = (id: string, vpc: string) => ({ InstanceId: id, VpcId: vpc });
+const reservations = (...rows: Array<Record<string, unknown>>) => ({
+  Reservations: [{ Instances: rows }],
+});
+
+// #1279 — `describe-stack-resources` returns identity and nothing about the
+// resource, so the observation had been filling `attributes` with the *stack's*
+// outputs, copied onto every member. No node carried its own VpcId.
+describe("describeOwnProperties (#1279)", () => {
+  beforeEach(() => spawnMock.mockReset());
+
+  const observed = {
+    web: { type: "AWS::EC2::Instance", status: "OK", physicalId: "i-1" },
+    api: { type: "AWS::EC2::Instance", status: "OK", physicalId: "i-2" },
+  };
+
+  it("joins each resource's own properties back by physical id", async () => {
+    spawnMock.mockResolvedValue(ok(reservations(instance("i-1", "vpc-a"), instance("i-2", "vpc-b"))));
+    const merged = await describeOwnProperties(observed);
+    expect(merged.web.attributes?.VpcId).toBe("vpc-a");
+    expect(merged.api.attributes?.VpcId).toBe("vpc-b");
+  });
+
+  it("reads a kind once for the whole observation, not once per resource", async () => {
+    spawnMock.mockResolvedValue(ok(reservations(instance("i-1", "vpc-a"), instance("i-2", "vpc-b"))));
+    await describeOwnProperties(observed);
+    expect(spawnMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("keeps stack outputs, and lets the resource's own property win the name", async () => {
+    const withOutputs = {
+      web: {
+        type: "AWS::EC2::Instance",
+        status: "OK",
+        physicalId: "i-1",
+        attributes: { expVpcId: "vpc-exported", VpcId: "stale" },
+      },
+    };
+    spawnMock.mockResolvedValue(ok(reservations(instance("i-1", "vpc-a"))));
+    const merged = await describeOwnProperties(withOutputs);
+    expect(merged.web.attributes?.expVpcId).toBe("vpc-exported");
+    expect(merged.web.attributes?.VpcId).toBe("vpc-a");
+  });
+
+  it("falls back to one call per id when the batch fails on a single bad id", async () => {
+    // AWS fails the whole call on one unknown id. A snapshot naming an instance
+    // that has since been terminated would otherwise take every other
+    // instance's properties down with it — and the empty result is
+    // indistinguishable from "the account has nothing to say".
+    spawnMock
+      .mockResolvedValueOnce(fail) // the batch, killed by i-2
+      .mockResolvedValueOnce(ok(reservations(instance("i-1", "vpc-a"))))
+      .mockResolvedValueOnce(fail); // i-2 really is gone
+    const merged = await describeOwnProperties(observed);
+    expect(merged.web.attributes?.VpcId).toBe("vpc-a");
+    expect(merged.api.attributes).toBeUndefined();
+  });
+
+  it("leaves the observation untouched when the kind cannot be read at all", async () => {
+    spawnMock.mockResolvedValue(fail);
+    const merged = await describeOwnProperties({ web: observed.web });
+    expect(merged.web.attributes).toBeUndefined();
+  });
+
+  it("does not call out for a kind it cannot describe", async () => {
+    const merged = await describeOwnProperties({
+      fn: { type: "AWS::Lambda::Function", status: "OK", physicalId: "fn-1" },
+    });
+    expect(spawnMock).not.toHaveBeenCalled();
+    expect(merged.fn.attributes).toBeUndefined();
+    expect(canDescribe("AWS::Lambda::Function")).toBe(false);
+  });
+});
+
+// #1279 — the observation is scoped per stack and each stack declares its
+// region, so the reader knew this and threw it away.
+describe("stampRegion (#1279)", () => {
+  const one = { web: { type: "AWS::EC2::Instance", status: "OK", physicalId: "i-1" } };
+
+  it("records the region the resource was observed in", () => {
+    expect(stampRegion(one, "us-west-2").web.attributes?.region).toBe("us-west-2");
+  });
+
+  it("keeps the properties already read", () => {
+    const withProps = { web: { ...one.web, attributes: { VpcId: "vpc-a" } } };
+    const out = stampRegion(withProps, "us-west-2").web.attributes;
+    expect(out).toMatchObject({ VpcId: "vpc-a", region: "us-west-2" });
+  });
+
+  it("falls back to the region the call would have used", () => {
+    const prev = process.env.AWS_REGION;
+    process.env.AWS_REGION = "eu-west-1";
+    try {
+      expect(stampRegion(one).web.attributes?.region).toBe("eu-west-1");
+    } finally {
+      if (prev === undefined) delete process.env.AWS_REGION;
+      else process.env.AWS_REGION = prev;
+    }
+  });
+});