@intentius/chant-lexicon-aws 0.45.0 → 0.49.0

package/src/serializer.ts

@@ -2,7 +2,19 @@ import type { Declarable, CoreParameter } from "@intentius/chant/declarable";
 import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
 import type { Serializer, SerializerResult, SerializeContext } from "@intentius/chant/serializer";
 import { ownershipEntries, type OwnershipMarker } from "@intentius/chant/ownership";
-import { AWS_TAG_OWNERSHIP_KEYS } from "./ownership";
+import {
+  isEffectReceipt,
+  receiptExpectation,
+  referenceInputPaths,
+  type EffectReceiptDeclaration,
+} from "@intentius/chant/effect-receipt";
+import { AWS_TAG_OWNERSHIP_KEYS, OWNERSHIP_METADATA_KEY } from "./ownership";
+import {
+  AWS_EFFECT_RECEIPT_ENTITY_TYPE,
+  EFFECT_RECEIPTS_METADATA_KEY,
+  RECEIPT_UNRESOLVED_VALUE_NOTE,
+  receiptParameterName,
+} from "./effect-receipt-row";
 import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { isChildProject, type ChildProjectInstance } from "@intentius/chant/child-project";
@@ -26,6 +38,7 @@ function isCoreParameter(entity: Declarable): entity is CoreParameter {
 interface CFTemplate {
   AWSTemplateFormatVersion: "2010-09-09";
   Description?: string;
+  Metadata?: Record<string, unknown>;
   Transform?: string | string[];
   Parameters?: Record<string, CFParameter>;
   Resources: Record<string, CFResource>;
@@ -153,6 +166,80 @@ function toProperties(
 }
 
 
+/** One rendered receipt row — a CFN-resource-shaped object that lives in the
+ * template's `Metadata`, never in `Resources` (#1832: the applier writes from
+ * `Resources`, and the `effect()` step is a receipt's sole writer). */
+interface ReceiptRow {
+  Type: typeof AWS_EFFECT_RECEIPT_ENTITY_TYPE;
+  Properties: {
+    Name: string;
+    Type: "String";
+    Value: string;
+    Tags: Array<{ Key: string; Value: string }>;
+  };
+}
+
+/** The rendered `Value`: the synthesis-time expectation when the receipt is
+ * fully static, a placeholder note when reference inputs resolve later —
+ * never a digest hashed over placeholders (epic #1703, decision 5). */
+function receiptRowValue(receipt: EffectReceiptDeclaration): string {
+  if (receipt.flavor === "hash" && referenceInputPaths(receipt).length > 0) {
+    return RECEIPT_UNRESOLVED_VALUE_NOTE;
+  }
+  return receiptExpectation(receipt);
+}
+
+/**
+ * Render the effect receipts (#1835) the build withheld from the apply-bound
+ * entity set (`SerializeContext.receipts`, #1832) as `AWS::SSM::Parameter`
+ * rows: plain `String`, named `/chant-receipts/<stack>/<env>/<effect>` from
+ * the resolved ownership marker (epic decision 4 — the same fields that stamp
+ * tags), carrying the ownership tags. Visibility only: the rows go under the
+ * template's `Metadata`, and the receipt store (./receipt-store.ts) is what
+ * actually writes the parameter — through the `effect()` step, on success,
+ * last.
+ *
+ * The env segment is explicit: a receipt with no resolved `ownership.env` is
+ * an error here, never a guessed path.
+ */
+function renderReceiptRows(
+  receipts: ReadonlyMap<string, Declarable>,
+  ownership: OwnershipMarker | undefined,
+): Record<string, ReceiptRow> {
+  const rows: Record<string, ReceiptRow> = {};
+  const names = [...receipts.keys()].join(", ");
+  if (!ownership) {
+    throw new Error(
+      `aws receipts (${names}): no ownership marker resolved — the receipt path is ` +
+        `/chant-receipts/<stack>/<env>/<effect>, derived from the same ownership fields that ` +
+        `stamp markers (chant #1703, decision 4). Set ownership: { stack, env } in chant.config.ts.`,
+    );
+  }
+  if (!ownership.env) {
+    throw new Error(
+      `aws receipts (${names}): ownership resolved no env — the receipt path's <env> segment is ` +
+        `explicit (chant #1703, decision 4). Set ownership.env in chant.config.ts (a literal, or ` +
+        `{ param: "env" } with --param env=<name>).`,
+    );
+  }
+  const tags = Object.entries(ownershipEntries(AWS_TAG_OWNERSHIP_KEYS, ownership)).map(
+    ([Key, Value]) => ({ Key, Value }),
+  );
+  for (const [name, entity] of receipts) {
+    if (!isEffectReceipt(entity)) continue;
+    rows[name] = {
+      Type: AWS_EFFECT_RECEIPT_ENTITY_TYPE,
+      Properties: {
+        Name: receiptParameterName(ownership.stack, ownership.env, entity.effect),
+        Type: "String",
+        Value: receiptRowValue(entity),
+        Tags: tags,
+      },
+    };
+  }
+  return rows;
+}
+
 /**
  * Serialize a set of entities into a CFTemplate object (without JSON.stringify).
  */
@@ -162,6 +249,7 @@ function serializeToTemplate(
   extraParameters?: Record<string, CFParameter>,
   extraOutputs?: Record<string, CFOutput>,
   ownership?: OwnershipMarker,
+  receiptRows?: Record<string, ReceiptRow>,
 ): CFTemplate {
   const template: CFTemplate = {
     AWSTemplateFormatVersion: "2010-09-09",
@@ -187,6 +275,21 @@ function serializeToTemplate(
     for (const [Key, Value] of Object.entries(ownershipEntries(AWS_TAG_OWNERSHIP_KEYS, ownership))) {
       defaultTagEntries.push({ Key, Value });
     }
+    // Also carry the marker at the template level (#1222): stack tags are a
+    // CreateStack/UpdateStack API parameter, not a template section, so the
+    // apply paths read this Metadata block and stamp it as the stack's own
+    // tags — what stack-level teardown verifies ownership on.
+    template.Metadata = {
+      [OWNERSHIP_METADATA_KEY]: ownershipEntries(AWS_TAG_OWNERSHIP_KEYS, ownership),
+    };
+  }
+  // Effect receipt rows (#1835) — visibility only, deliberately outside
+  // `Resources`: the applier's desired and prune sets both read `Resources`,
+  // and the `effect()` step is a receipt's sole writer (#1832, epic #1703
+  // decision 3). The observation leg (plugin.ts) reads the paths back from
+  // this block, so the identity is derived exactly once, here.
+  if (receiptRows && Object.keys(receiptRows).length > 0) {
+    template.Metadata = { ...(template.Metadata ?? {}), [EFFECT_RECEIPTS_METADATA_KEY]: receiptRows };
   }
   for (const [, entity] of entities) {
     if (isDefaultTags(entity)) {
@@ -404,6 +507,14 @@ export const awsSerializer: Serializer = {
   serialize(entities: Map<string, Declarable>, outputs?: LexiconOutput[], context?: SerializeContext): string | SerializerResult {
     const ownership = context?.ownership;
 
+    // Effect receipts (#1835): withheld from `entities` by the build (#1832),
+    // rendered here as Metadata rows — never as `Resources` an applier would
+    // write. Env-less ownership is an error, not a guessed path segment.
+    const receiptRows =
+      context?.receipts && context.receipts.size > 0
+        ? renderReceiptRows(context.receipts, ownership)
+        : undefined;
+
     // Check if any entities are child projects (nested stacks)
     const childProjects = new Map<string, ChildProjectInstance>();
     let hasChildProjects = false;
@@ -417,7 +528,7 @@ export const awsSerializer: Serializer = {
 
     // No nested stacks — use the simple path
     if (!hasChildProjects) {
-      const template = serializeToTemplate(entities, outputs, undefined, undefined, ownership);
+      const template = serializeToTemplate(entities, outputs, undefined, undefined, ownership, receiptRows);
       return JSON.stringify(template, null, 2);
     }
 
@@ -457,7 +568,7 @@ export const awsSerializer: Serializer = {
     }
 
     // Serialize the parent template (ChildProjectInstance entities become CF::Stack resources)
-    const parentTemplate = serializeToTemplate(entities, outputs, parentParams, undefined, ownership);
+    const parentTemplate = serializeToTemplate(entities, outputs, parentParams, undefined, ownership, receiptRows);
     const primary = JSON.stringify(parentTemplate, null, 2);
 
     return {

package/src/skills/chant-aws-carve-terraform.md

@@ -1,6 +1,6 @@
 ---
 skill: chant-aws-carve-terraform
-description: Demo carving a resource out of Terraform into native chant — advise, emit, bridge, apply — fully offline
+description: Demo carving a resource out of Terraform into native chant — advise, emit, audit, bridge, apply — fully offline
 user-invocable: true
 ---
 
@@ -15,7 +15,7 @@ graduation.
 ## When to use
 
 - Someone asks "how does chant move things off Terraform?"
-- You want to show the advise → emit → bridge → apply loop end to end.
+- You want to show the advise → emit → audit → bridge → apply loop end to end.
 - You are evaluating whether a Terraform estate is worth carving.
 
 ## Preconditions
@@ -27,7 +27,7 @@ graduation.
 ## The fastest path: run the bundled demo
 
 The `examples/terraform-carve-out` example ships a runnable estate + state and a
-script that runs all four steps with commentary:
+script that runs all five steps with commentary:
 
 ```bash
 cd examples/terraform-carve-out
@@ -54,28 +54,30 @@ From `examples/terraform-carve-out`, with `TF=./terraform`:
      --state ./terraform/terraform.tfstate --output ./carveout
    ```
    Show `./carveout/src/assets.ts` — a real `new Bucket({ BucketName, Tags })` with
-   CloudFormation-style properties mapped from the Terraform state attributes.
-   Emit also scaffolds `./carveout` into a buildable chant project
-   (`chant.config.ts`, `package.json`), so `npm install && npm run build` works
-   there as-is. Explain: a Terraform-managed resource is not in any
-   CloudFormation stack, so the correct source of its live shape is the state
-   file, not a cloud read.
-
-3. **Lint the inherited resource — optional, offer it.**
+   CloudFormation-style properties mapped from the Terraform state attributes,
+   and the `aws_s3_bucket_versioning` sub-resource folded into
+   `VersioningConfiguration`. Emit also scaffolds `./carveout` into a buildable
+   chant project (`chant.config.ts`, `package.json`) and persists a carve
+   manifest (`*.carve.json`) — bridge and apply read the target from it, so
+   `--select` is only needed once. Explain: a Terraform-managed resource is not
+   in any CloudFormation stack, so the correct source of its live shape is the
+   state file, not a cloud read.
+
+3. **Audit the inherited resource.**
    ```bash
-   chant lint ./carveout/src --lexicon aws
+   chant build ./carveout/src --lexicon aws
    ```
-   After emit, offer to lint the carved source. chant audits the resource you
-   inherited from Terraform against the AWS lexicon's rules. Findings have a
-   severity: `error` (must fix before `chant build` will emit — e.g. an S3
-   bucket with no public-access block) and `warning`/`info` (advisory — e.g.
-   DynamoDB point-in-time recovery). This is a feature of carving: chant
-   immediately tells the person what is wrong with what they adopted. Whether to
-   fix an advisory finding is their call; errors block the build until resolved.
+   The first build fails, deliberately: the post-synth audit refuses the
+   adopted bucket because Terraform managed it without a public-access block or
+   a TLS-only policy. This is a feature of carving: chant immediately tells the
+   person what is wrong with what they adopted. Show the fix (add
+   `PublicAccessBlockConfiguration` and a companion `S3BucketPolicy` with an
+   `aws:SecureTransport = false` Deny — the tutorial page has the exact code),
+   then re-run the build and show the valid CloudFormation template.
 
 4. **Bridge — patch the surviving Terraform.**
    ```bash
-   chant carve bridge --from ./terraform --select aws_s3_bucket.assets --output ./carveout
+   chant carve bridge --from ./terraform --output ./carveout
    ```
    Show the generated `data "aws_s3_bucket" "assets"` and the rewired survivor.
    Emphasize it is dry-run: nothing in `./terraform` changed. `--apply-rewrites`
@@ -83,11 +85,12 @@ From `examples/terraform-carve-out`, with `TF=./terraform`:
 
 5. **Apply — graduation plan.**
    ```bash
-   chant carve apply --from ./terraform --select aws_s3_bucket.assets --env prod --stack assets
+   chant carve apply --from ./terraform --output ./carveout --env prod --stack assets
    ```
    Show the ownership marker (`chant:managed-by/stack/env`) and the finalized
-   runbook. Stress this makes no cloud call — the apply is the person's own
-   lifecycle; chant just plans it.
+   runbook. `--write-source` additionally stamps the marker tags into the
+   emitted source. Stress this makes no cloud call — the apply is the person's
+   own lifecycle; chant just plans it.
 
 ## Key points to land
 

package/src/teardown.test.ts

@@ -0,0 +1,258 @@
+/**
+ * aws stack-level env teardown (#1222) — unit tests over fake Query-API
+ * transports, in the style of aws-apply.test.ts: no network, the fakes answer
+ * DescribeStacks/DeleteStack by parsing the form body.
+ */
+import { describe, test, expect } from "vitest";
+import { teardownOwned, executeTeardown, resolveTeardownStacks, STACK_TYPE } from "./teardown";
+import type { AwsReadHttp } from "./api/read-client";
+import type { AwsHttp } from "./op/activities/aws-apply";
+import type { OwnershipMarker } from "@intentius/chant/ownership";
+
+const MARKER: OwnershipMarker = { stack: "shop", env: "dev" };
+
+const MISSING =
+  "<ErrorResponse><Error><Code>ValidationError</Code><Message>Stack with id x does not exist</Message></Error></ErrorResponse>";
+
+/** A DescribeStacks response for one stack carrying the given tags. */
+function stackXml(name: string, tags: Record<string, string>, status = "CREATE_COMPLETE"): string {
+  const members = Object.entries(tags)
+    .map(([k, v]) => `<member><Key>${k}</Key><Value>${v}</Value></member>`)
+    .join("");
+  return (
+    `<DescribeStacksResponse><DescribeStacksResult><Stacks><member>` +
+    `<StackId>arn:aws:cloudformation:us-east-1:0:stack/${name}/uuid</StackId>` +
+    `<StackName>${name}</StackName><StackStatus>${status}</StackStatus>` +
+    `<Tags>${members}</Tags>` +
+    `</member></Stacks></DescribeStacksResult></DescribeStacksResponse>`
+  );
+}
+
+const OWNED_TAGS = { "chant:managed-by": "chant", "chant:stack": "shop", "chant:env": "dev" };
+const FOREIGN_ENV_TAGS = { "chant:managed-by": "chant", "chant:stack": "shop", "chant:env": "prod" };
+
+/**
+ * A fake read transport: answers DescribeStacks per stack name from `stacks`;
+ * names not present answer "does not exist".
+ */
+function fakeRead(stacks: Record<string, string>): AwsReadHttp {
+  return async (_url, init) => {
+    const form = new URLSearchParams(init.body);
+    expect(form.get("Action")).toBe("DescribeStacks");
+    const name = form.get("StackName") ?? "";
+    const xml = stacks[name];
+    return xml ? { status: 200, text: xml } : { status: 400, text: MISSING };
+  };
+}
+
+describe("resolveTeardownStacks — stacks[] else the env-named default (#932)", () => {
+  test("declared stacks win", () => {
+    expect(
+      resolveTeardownStacks({
+        environment: "dev",
+        marker: MARKER,
+        stacks: [{ name: "net" }, { name: "app", region: "eu-west-1" }],
+      }),
+    ).toEqual([{ name: "net" }, { name: "app", region: "eu-west-1" }]);
+  });
+
+  test("explicit stack option, else the stack named after the environment", () => {
+    expect(resolveTeardownStacks({ environment: "dev", marker: MARKER, stack: "s1" })).toEqual([{ name: "s1" }]);
+    expect(resolveTeardownStacks({ environment: "dev", marker: MARKER })).toEqual([{ name: "dev" }]);
+  });
+});
+
+describe("teardownOwned — marker-verified stack enumeration", () => {
+  test("a stack whose own tags carry the requested identity is a candidate", async () => {
+    const result = await teardownOwned(
+      { environment: "dev", marker: MARKER },
+      { read: { http: fakeRead({ dev: stackXml("dev", OWNED_TAGS) }) } },
+    );
+    expect(result.candidates).toEqual([
+      {
+        name: "dev",
+        type: STACK_TYPE,
+        physicalId: "arn:aws:cloudformation:us-east-1:0:stack/dev/uuid",
+        marker: { stack: "shop", env: "dev" },
+      },
+    ]);
+    expect(result.holes).toBeUndefined();
+  });
+
+  test("an untagged stack is a loud unverified-ownership hole, never a candidate", async () => {
+    const result = await teardownOwned(
+      { environment: "dev", marker: MARKER },
+      { read: { http: fakeRead({ dev: stackXml("dev", {}) }) } },
+    );
+    expect(result.candidates).toEqual([]);
+    expect(result.holes).toHaveLength(1);
+    expect(result.holes![0]).toMatchObject({ name: "dev", type: STACK_TYPE, reason: "filtered" });
+    expect(result.holes![0].detail).toMatch(/unverified-ownership/);
+  });
+
+  test("a stack verifiably carrying ANOTHER identity is out of scope — no candidate, no hole", async () => {
+    const result = await teardownOwned(
+      { environment: "dev", marker: MARKER },
+      { read: { http: fakeRead({ dev: stackXml("dev", FOREIGN_ENV_TAGS) }) } },
+    );
+    expect(result.candidates).toEqual([]);
+    expect(result.holes).toBeUndefined();
+  });
+
+  test("an absent stack is knowledge: nothing to tear down, no hole", async () => {
+    const result = await teardownOwned(
+      { environment: "dev", marker: MARKER },
+      { read: { http: fakeRead({}) } },
+    );
+    expect(result.candidates).toEqual([]);
+    expect(result.holes).toBeUndefined();
+  });
+
+  test("a failed DescribeStacks is a hole (#1089), never absence", async () => {
+    const http: AwsReadHttp = async () => ({ status: 500, text: "boom" });
+    const result = await teardownOwned({ environment: "dev", marker: MARKER }, { read: { http } });
+    expect(result.candidates).toEqual([]);
+    expect(result.holes).toHaveLength(1);
+    expect(result.holes![0]).toMatchObject({ name: "dev", type: STACK_TYPE, reason: "read-failed" });
+  });
+
+  test("multi-stack: every declared stack is checked, only verified ones are candidates", async () => {
+    const result = await teardownOwned(
+      {
+        environment: "dev",
+        marker: MARKER,
+        stacks: [{ name: "net" }, { name: "app" }, { name: "gone" }],
+      },
+      {
+        read: {
+          http: fakeRead({
+            net: stackXml("net", OWNED_TAGS),
+            app: stackXml("app", FOREIGN_ENV_TAGS),
+          }),
+        },
+      },
+    );
+    expect(result.candidates.map((c) => c.name)).toEqual(["net"]);
+    expect(result.holes).toBeUndefined();
+  });
+});
+
+describe("executeTeardown — re-verify, then DeleteStack to DELETE_COMPLETE", () => {
+  const CANDIDATE = { name: "dev", type: STACK_TYPE, marker: { stack: "shop", env: "dev" } };
+
+  /** A stateful fake pair: reads see the stack until DeleteStack lands. */
+  function fakeTarget(initialTags: Record<string, string> | undefined) {
+    const deletes: string[] = [];
+    let present = initialTags !== undefined;
+    const read: AwsReadHttp = async (_url, init) => {
+      const form = new URLSearchParams(init.body);
+      const name = form.get("StackName") ?? "";
+      if (!present) return { status: 400, text: MISSING };
+      return { status: 200, text: stackXml(name, initialTags ?? {}) };
+    };
+    const apply: AwsHttp = async (_url, form) => {
+      if (form.Action === "DeleteStack") {
+        deletes.push(form.StackName ?? "");
+        present = false;
+        return { status: 200, text: "<DeleteStackResponse/>" };
+      }
+      if (form.Action === "DescribeStacks") {
+        return present
+          ? { status: 200, text: stackXml(form.StackName ?? "", initialTags ?? {}) }
+          : { status: 400, text: MISSING };
+      }
+      throw new Error(`unexpected action ${form.Action}`);
+    };
+    return { read, apply, deletes };
+  }
+
+  test("a marker-verified stack is deleted and polled gone", async () => {
+    const target = fakeTarget(OWNED_TAGS);
+    const result = await executeTeardown(
+      { environment: "dev", marker: MARKER, candidates: [CANDIDATE] },
+      { read: { http: target.read }, applyHttp: target.apply, timeoutMs: 1000, intervalMs: 1 },
+    );
+    expect(result.outcomes).toEqual([{ name: "dev", type: STACK_TYPE, outcome: "deleted" }]);
+    expect(target.deletes).toEqual(["dev"]);
+  });
+
+  test("an identity that no longer matches is not-prunable — DeleteStack is never sent", async () => {
+    const target = fakeTarget(FOREIGN_ENV_TAGS);
+    const result = await executeTeardown(
+      { environment: "dev", marker: MARKER, candidates: [CANDIDATE] },
+      { read: { http: target.read }, applyHttp: target.apply, timeoutMs: 1000, intervalMs: 1 },
+    );
+    expect(result.outcomes[0]).toMatchObject({ name: "dev", outcome: "not-prunable" });
+    expect(result.outcomes[0].detail).toMatch(/unverified-ownership/);
+    expect(target.deletes).toEqual([]);
+  });
+
+  test("an untagged stack at execution time is not-prunable too", async () => {
+    const target = fakeTarget({});
+    const result = await executeTeardown(
+      { environment: "dev", marker: MARKER, candidates: [CANDIDATE] },
+      { read: { http: target.read }, applyHttp: target.apply, timeoutMs: 1000, intervalMs: 1 },
+    );
+    expect(result.outcomes[0]).toMatchObject({ name: "dev", outcome: "not-prunable" });
+    expect(target.deletes).toEqual([]);
+  });
+
+  test("an already-absent stack is deleted (teardown is idempotent)", async () => {
+    const target = fakeTarget(undefined);
+    const result = await executeTeardown(
+      { environment: "dev", marker: MARKER, candidates: [CANDIDATE] },
+      { read: { http: target.read }, applyHttp: target.apply, timeoutMs: 1000, intervalMs: 1 },
+    );
+    expect(result.outcomes).toEqual([
+      { name: "dev", type: STACK_TYPE, outcome: "deleted", detail: "already absent" },
+    ]);
+    expect(target.deletes).toEqual([]);
+  });
+
+  test("a failed DeleteStack is a failed outcome, never silence", async () => {
+    const target = fakeTarget(OWNED_TAGS);
+    const apply: AwsHttp = async (_url, form) => {
+      if (form.Action === "DeleteStack") return { status: 500, text: "<ErrorResponse><Error><Message>throttled</Message></Error></ErrorResponse>" };
+      return target.apply(_url, form);
+    };
+    const result = await executeTeardown(
+      { environment: "dev", marker: MARKER, candidates: [CANDIDATE] },
+      { read: { http: target.read }, applyHttp: apply, timeoutMs: 1000, intervalMs: 1 },
+    );
+    expect(result.outcomes[0]).toMatchObject({ name: "dev", outcome: "failed" });
+    expect(result.outcomes[0].detail).toMatch(/throttled/);
+  });
+
+  test("a candidate's region comes from the declared stacks", async () => {
+    // The URL is only regional when no ambient endpoint override is set.
+    const saved = {
+      all: process.env.AWS_ENDPOINT_URL,
+      cfn: process.env.AWS_ENDPOINT_URL_CLOUDFORMATION,
+    };
+    delete process.env.AWS_ENDPOINT_URL;
+    delete process.env.AWS_ENDPOINT_URL_CLOUDFORMATION;
+    const urls: string[] = [];
+    const target = fakeTarget(OWNED_TAGS);
+    const apply: AwsHttp = async (url, form) => {
+      urls.push(url);
+      return target.apply(url, form);
+    };
+    const read: AwsReadHttp = async (url, init) => {
+      urls.push(url);
+      return target.read(url, init);
+    };
+    await executeTeardown(
+      {
+        environment: "dev",
+        marker: MARKER,
+        candidates: [{ ...CANDIDATE, name: "app" }],
+        stacks: [{ name: "app", region: "eu-west-1" }],
+      },
+      { read: { http: read }, applyHttp: apply, timeoutMs: 1000, intervalMs: 1 },
+    );
+    if (saved.all !== undefined) process.env.AWS_ENDPOINT_URL = saved.all;
+    if (saved.cfn !== undefined) process.env.AWS_ENDPOINT_URL_CLOUDFORMATION = saved.cfn;
+    expect(urls.length).toBeGreaterThan(0);
+    expect(urls.every((u) => u.includes("eu-west-1"))).toBe(true);
+  });
+});