@intentius/chant-lexicon-aws 0.56.0 → 0.58.0

package/src/condition.test.ts

@@ -0,0 +1,129 @@
+import { describe, test, expect } from "vitest";
+import { Condition, isCondition, CONDITION_ENTITY_TYPE } from "./condition";
+import { Equals, And, Or, Not, If, Ref } from "./intrinsics";
+import { Parameter } from "./parameter";
+import { awsSerializer } from "./serializer";
+import { stackOutput } from "@intentius/chant/stack-output";
+import { createResource } from "@intentius/chant/runtime";
+import { resolveAttrRefs } from "@intentius/chant/discovery/resolve";
+import type { Declarable } from "@intentius/chant/declarable";
+
+const LogGroup = createResource("AWS::Logs::LogGroup", "aws", {});
+
+function serialize(entities: Map<string, Declarable>): Record<string, any> {
+  resolveAttrRefs(entities);
+  return JSON.parse(awsSerializer.serialize(entities) as string);
+}
+
+describe("Condition declarable", () => {
+  test("carries the aws lexicon and the condition entity type", () => {
+    const cond = new Condition(Equals("a", "b"));
+    expect(cond.lexicon).toBe("aws");
+    expect(cond.entityType).toBe(CONDITION_ENTITY_TYPE);
+    expect(isCondition(cond)).toBe(true);
+    expect(isCondition(new Parameter("String"))).toBe(false);
+    expect(isCondition("DoCutover")).toBe(false);
+  });
+
+  test("rejects a non-intrinsic expression", () => {
+    expect(() => new Condition("true" as never)).toThrow(/condition intrinsic/);
+  });
+});
+
+describe("condition intrinsics", () => {
+  test("Equals resolves value intrinsics", () => {
+    const param = new Parameter("String");
+    const entities = new Map<string, Declarable>([["Cutover", param]]);
+    resolveAttrRefs(entities);
+    expect(JSON.parse(JSON.stringify(Equals(Ref(param), "true")))).toEqual({
+      "Fn::Equals": [{ Ref: "Cutover" }, "true"],
+    });
+  });
+
+  test("Not over a Condition declarable emits the Condition reference form", () => {
+    const cond = new Condition(Equals("a", "b"));
+    const entities = new Map<string, Declarable>([["DoCutover", cond]]);
+    resolveAttrRefs(entities);
+    expect(JSON.parse(JSON.stringify(Not(cond)))).toEqual({
+      "Fn::Not": [{ Condition: "DoCutover" }],
+    });
+  });
+
+  test("And/Or accept names, declarables, and nested intrinsics", () => {
+    expect(JSON.parse(JSON.stringify(And("A", Equals("x", "y"))))).toEqual({
+      "Fn::And": [{ Condition: "A" }, { "Fn::Equals": ["x", "y"] }],
+    });
+    expect(JSON.parse(JSON.stringify(Or("A", Not("B"))))).toEqual({
+      "Fn::Or": [{ Condition: "A" }, { "Fn::Not": [{ Condition: "B" }] }],
+    });
+  });
+
+  test("And/Or enforce CloudFormation's 2–10 operand bounds", () => {
+    expect(() => And("A")).toThrow(/between 2 and 10/);
+    expect(() => Or("A")).toThrow(/between 2 and 10/);
+    const eleven = Array.from({ length: 11 }, (_, i) => `C${i}`);
+    expect(() => And(...eleven)).toThrow(/between 2 and 10/);
+  });
+
+  test("If accepts the Condition declarable as the condition", () => {
+    const cond = new Condition(Equals("a", "b"));
+    const entities = new Map<string, Declarable>([["DoCutover", cond]]);
+    resolveAttrRefs(entities);
+    expect(JSON.parse(JSON.stringify(If(cond, "on", "off")))).toEqual({
+      "Fn::If": ["DoCutover", "on", "off"],
+    });
+  });
+});
+
+describe("serializer Conditions section (#2068)", () => {
+  test("Condition declarables are lifted into Conditions", () => {
+    const param = new Parameter("String", { defaultValue: "false" });
+    const doCutover = new Condition(Equals(Ref(param), "true"));
+    const noCutover = new Condition(Not(doCutover));
+    const template = serialize(
+      new Map<string, Declarable>([
+        ["Cutover", param],
+        ["DoCutover", doCutover],
+        ["NoCutover", noCutover],
+      ]),
+    );
+    expect(template.Conditions).toEqual({
+      DoCutover: { "Fn::Equals": [{ Ref: "Cutover" }, "true"] },
+      NoCutover: { "Fn::Not": [{ Condition: "DoCutover" }] },
+    });
+    // Never emitted as a Resource
+    expect(template.Resources).toEqual({});
+  });
+
+  test("resource-level Condition accepts the declarable as well as a string", () => {
+    const doCutover = new Condition(Equals("a", "b"));
+    const byRef = new LogGroup({ RetentionInDays: 7 }, { Condition: doCutover });
+    const byName = new LogGroup({ RetentionInDays: 7 }, { Condition: "DoCutover" });
+    const template = serialize(
+      new Map<string, Declarable>([
+        ["DoCutover", doCutover],
+        ["ByRef", byRef],
+        ["ByName", byName],
+      ]),
+    );
+    expect(template.Resources.ByRef.Condition).toBe("DoCutover");
+    expect(template.Resources.ByName.Condition).toBe("DoCutover");
+  });
+
+  test("stackOutput condition emits the output-level Condition key", () => {
+    const doCutover = new Condition(Equals("a", "b"));
+    const group = new LogGroup({ RetentionInDays: 7 }, { Condition: doCutover });
+    const out = stackOutput(Ref(group), { condition: doCutover });
+    const outByName = stackOutput(Ref(group), { condition: "DoCutover" });
+    const template = serialize(
+      new Map<string, Declarable>([
+        ["DoCutover", doCutover],
+        ["Rule", group],
+        ["RuleName", out],
+        ["RuleNameByName", outByName],
+      ]),
+    );
+    expect(template.Outputs.RuleName).toEqual({ Value: { Ref: "Rule" }, Condition: "DoCutover" });
+    expect(template.Outputs.RuleNameByName.Condition).toBe("DoCutover");
+  });
+});

package/src/condition.ts

@@ -0,0 +1,40 @@
+/**
+ * CloudFormation template condition (#2068).
+ *
+ * A `Condition` declarable is lifted into the template's `Conditions`
+ * section by the serializer, the way `Parameter` is lifted into
+ * `Parameters`. Reference it from a resource's `Condition` attribute, an
+ * output's `condition` option, `If(...)`, or inside another condition via
+ * `And`/`Or`/`Not`.
+ */
+
+import { DECLARABLE_MARKER, isDeclarable, type Declarable } from "@intentius/chant/declarable";
+import { isIntrinsic, type Intrinsic } from "@intentius/chant/intrinsic";
+
+export const CONDITION_ENTITY_TYPE = "AWS::CloudFormation::Condition";
+
+export class Condition implements Declarable {
+  readonly [DECLARABLE_MARKER] = true as const;
+  readonly lexicon = "aws";
+  readonly entityType = CONDITION_ENTITY_TYPE;
+  /** The boolean expression: an `Equals`/`And`/`Or`/`Not` intrinsic. */
+  readonly expression: Intrinsic;
+
+  constructor(expression: Intrinsic) {
+    if (!isIntrinsic(expression)) {
+      throw new Error(
+        "new Condition(expression): expression must be a condition intrinsic (Equals, And, Or, Not)",
+      );
+    }
+    this.expression = expression;
+  }
+}
+
+/**
+ * Type guard for the `Condition` declarable. Duck-typed on `entityType`
+ * rather than `instanceof` so a lexicon built against a separate copy of
+ * `@intentius/chant` still matches (the #1137 convention).
+ */
+export function isCondition(value: unknown): value is Condition {
+  return isDeclarable(value) && value.entityType === CONDITION_ENTITY_TYPE;
+}

package/src/deep-observe.test.ts

@@ -949,12 +949,15 @@ describe("end to end: declared + mutated live + baseline (#1015)", () => {
     // all subtracted.
     expect(result.unchanged).toEqual(["AppRole"]);
 
-    // The platform team's tag is accepted, so it is reported as suppressed
-    // rather than as drift.
-    expect(result.accepted.map((e) => e.name)).toEqual(["Assets"]);
-    expect(result.accepted[0].changes.map((c) => c.path)).toEqual([
-      "Tags[#cost-center].Key",
-      "Tags[#cost-center].Value",
+    // The platform team's tag is on a path source never declared, so since
+    // #2160 the claim answers before the baseline gets a chance to: it is held
+    // elsewhere, at its live value, and it is not drift. AWS records no field
+    // manager, so the claimed-field set is the only source that can answer.
+    expect(result.accepted).toEqual([]);
+    expect(result.unclaimed.map((e) => e.name)).toEqual(["Assets"]);
+    expect(result.unclaimed[0].fields).toEqual([
+      { path: "Tags[#cost-center].Key", live: "cost-center", source: "claimed-fields", baseline: "cost-center" },
+      { path: "Tags[#cost-center].Value", live: "platform", source: "claimed-fields", baseline: "platform" },
     ]);
 
     // An unreadable deep read is a hole with a reason — never silence, never
@@ -976,7 +979,10 @@ describe("end to end: declared + mutated live + baseline (#1015)", () => {
     ]);
   });
 
-  test("without the baseline the platform tag is drift, and accepting it is what silences it", async () => {
+  test("the claim silences the platform tag with no baseline at all (#2160)", async () => {
+    // Before #2160 this tag was drift until somebody accepted it. The
+    // declaration is the table AWS cannot provide, and it answers on the first
+    // read, with nothing recorded anywhere.
     wireMocks();
     const result = await deepDiffForLexicon(awsPlugin, {
       environment: "prod",
@@ -984,15 +990,16 @@ describe("end to end: declared + mutated live + baseline (#1015)", () => {
       entities: declared,
     });
     const assets = result.drifted.find((d) => d.name === "Assets");
-    expect(assets?.changes.map((c) => c.path).sort()).toEqual([
+    expect(assets?.changes.map((c) => c.path)).toEqual(["VersioningConfiguration.Status"]);
+    expect(result.unclaimed[0].fields.map((f) => f.path)).toEqual([
       "Tags[#cost-center].Key",
       "Tags[#cost-center].Value",
-      "VersioningConfiguration.Status",
     ]);
     expect(result.accepted).toEqual([]);
   });
 
   test("an accepted value that later changes is drift again, with all three axes", async () => {
+    // The baseline's value-bound rule, on the path that is actually declared.
     wireMocks();
     const result = await deepDiffForLexicon(awsPlugin, {
       environment: "prod",
@@ -1000,18 +1007,19 @@ describe("end to end: declared + mutated live + baseline (#1015)", () => {
       entities: declared,
       baseline: {
         Assets: {
-          accepted: [{ path: "Tags[#cost-center].Value", value: "someone-elses-team" }],
+          accepted: [{ path: "VersioningConfiguration.Status", value: "Enabled" }],
         },
       },
     });
     const change = result.drifted
       .find((d) => d.name === "Assets")
-      ?.changes.find((c) => c.path === "Tags[#cost-center].Value");
+      ?.changes.find((c) => c.path === "VersioningConfiguration.Status");
     expect(change).toEqual({
-      path: "Tags[#cost-center].Value",
-      kind: "undeclared",
-      live: "platform",
-      baseline: "someone-elses-team",
+      path: "VersioningConfiguration.Status",
+      kind: "changed",
+      declared: "Enabled",
+      live: "Suspended",
+      baseline: "Enabled",
     });
   });
 

package/src/deep-topology.test.ts

@@ -360,7 +360,7 @@ describe("the fold answers (#1269)", () => {
     ]);
   });
 
-  test("an out-of-band MapPublicIpOnLaunch flip reports; the service default does not", async () => {
+  test("an out-of-band MapPublicIpOnLaunch flip reports as unclaimed; the service default does not", async () => {
     const subnetRow = (mapPublic: boolean) => ({
       Subnets: [{ SubnetId: "subnet-01", VpcId: "vpc-01", CidrBlock: "10.0.1.0/24", MapPublicIpOnLaunch: mapPublic }],
     });
@@ -381,11 +381,15 @@ describe("the fold answers (#1269)", () => {
 
     ec2Describes({ "describe-subnets": subnetRow(true) });
     const diff = diffDeepObservation(declared, await observe(), awsDeepNormalizationHooks);
-    expect(diff.drifted).toEqual([
+    // Source never set MapPublicIpOnLaunch, so the flip is somebody else's
+    // (#2160): reported with its value, not counted as drift, and never
+    // proposed for an update.
+    expect(diff.drifted).toEqual([]);
+    expect(diff.unclaimed).toEqual([
       {
         name: "PublicSubnet",
         type: "AWS::EC2::Subnet",
-        changes: [{ path: "MapPublicIpOnLaunch", kind: "undeclared", live: true }],
+        fields: [{ path: "MapPublicIpOnLaunch", live: true, source: "claimed-fields" }],
       },
     ]);
   });

package/src/generated/index.d.ts

@@ -135131,14 +135131,14 @@ export type ZonalAutoshiftConfiguration_ZonalAutoshiftStatus = "ENABLED";
 // --- Intrinsic functions ---
 
 export declare function And(conditions: unknown[]): any;
+export declare function And(...conditions: unknown[]): any;
 export declare function Base64(value: unknown): any;
 export declare function Cidr(ipBlock: unknown, count: unknown, cidrBits?: unknown): any;
-export declare function Condition(condition: string): any;
 export declare function Equals(a: unknown, b: unknown): any;
 export declare function FindInMap(mapName: string, firstKey: unknown, secondKey: unknown): any;
 export declare function GetAtt(logicalName: string, attribute: string): any;
 export declare function GetAZs(region?: string): any;
-export declare function If(condition: string, valueIfTrue: unknown, valueIfFalse: unknown): any;
+export declare function If(condition: string | Declarable, valueIfTrue: unknown, valueIfFalse: unknown): any;
 export declare function ImportValue(sharedValue: unknown): any;
 export declare function Join(delimiter: string, values: unknown[]): any;
 export declare function Not(condition: unknown): any;
@@ -135170,7 +135170,7 @@ export interface Declarable {
 
 export interface CFResourceAttributes {
   DependsOn?: Declarable | Declarable[] | string | string[];
-  Condition?: string;
+  Condition?: string | Declarable;
   DeletionPolicy?: "Delete" | "Retain" | "RetainExceptOnCreate" | "Snapshot";
   UpdateReplacePolicy?: "Delete" | "Retain" | "Snapshot";
   UpdatePolicy?: {

package/src/generated/index.ts

@@ -10765,5 +10765,5 @@ export const ZonalShiftConfig = createProperty("AWS::EKS::Cluster.ZonalShiftConf
 export const ZookeeperAccess = createProperty("AWS::MSK::Cluster.ZookeeperAccess", "aws");
 
 // Re-exports for convenience
-export { Sub, Ref, GetAtt, If, Join, Select, Split, Base64 } from "../intrinsics";
+export { Sub, Ref, GetAtt, If, Join, Select, Split, Base64, Equals, Not } from "../intrinsics";
 export { AWS, StackName, Region, AccountId, StackId, URLSuffix, NoValue, NotificationARNs } from "../pseudo";

package/src/import/generator.ts

@@ -1,6 +1,6 @@
 import { loadLexiconRegistry } from "@intentius/chant/codegen/registry";
 import { createRequire } from "module";
-import type { TemplateIR, ResourceIR, ParameterIR } from "@intentius/chant/import/parser";
+import type { TemplateIR, ResourceIR, ParameterIR, ConditionIR, OutputIR } from "@intentius/chant/import/parser";
 const require = createRequire(import.meta.url);
 import type { TypeScriptGenerator, GeneratedFile } from "@intentius/chant/import/generator";
 import { topoSort } from "@intentius/chant/codegen/topo-sort";
@@ -51,12 +51,33 @@ export class CFGenerator implements TypeScriptGenerator {
       lines.push("");
     }
 
+    // Generate conditions in dependency order ({ Condition: ... } references
+    // point at earlier declarations) — #2069
+    const conditions = ir.conditions ?? [];
+    const sortedConditions = this.sortConditions(conditions);
+    for (const condition of sortedConditions) {
+      lines.push(this.generateCondition(condition, ir, importedSymbols));
+    }
+
+    if (conditions.length > 0) {
+      lines.push("");
+    }
+
     // Generate resources in dependency order
     const sortedResources = this.sortByDependencies(ir.resources);
     for (const resource of sortedResources) {
       lines.push(this.generateResource(resource, ir, importedSymbols));
     }
 
+    // Generate outputs (#2069)
+    const outputs = ir.outputs ?? [];
+    if (outputs.length > 0) {
+      lines.push("");
+      for (const output of outputs) {
+        lines.push(this.generateOutput(output, ir, importedSymbols));
+      }
+    }
+
     return [
       {
         path: "main.ts",
@@ -71,10 +92,14 @@ export class CFGenerator implements TypeScriptGenerator {
   private collectImportedSymbols(ir: TemplateIR): Set<string> {
     const symbols = new Set<string>();
     if (ir.parameters.length > 0) symbols.add("Parameter");
-    const intrinsics = ["Sub", "Ref", "If", "Join", "Select", "Split", "Base64", "GetAZs", "GetAtt"] as const;
+    if ((ir.conditions ?? []).length > 0) symbols.add("Condition");
+    if ((ir.outputs ?? []).length > 0) symbols.add("stackOutput");
+    const intrinsics = ["Sub", "Ref", "If", "Join", "Select", "Split", "Base64", "GetAZs", "GetAtt", "Equals", "And", "Or", "Not"] as const;
     for (const name of intrinsics) {
       if (irUsesIntrinsic(ir, name)) symbols.add(name);
     }
+    // Outputs whose value is a Ref envelope render as Ref(<var>) (#2069)
+    if ((ir.outputs ?? []).some((o) => hasIntrinsicInValue(o.value, "Ref"))) symbols.add("Ref");
     if (this.needsAWSPseudo(ir)) symbols.add("AWS");
     for (const resource of ir.resources) {
       const parsed = this.parseResourceType(resource.type);
@@ -94,54 +119,14 @@ export class CFGenerator implements TypeScriptGenerator {
    * Generate import statements
    */
   private generateImports(ir: TemplateIR): string {
-    const imports: Set<string> = new Set();
-    const serviceImports: Map<string, Set<string>> = new Map();
-
-    // Collect what we need to import
-    const needsParameter = ir.parameters.length > 0;
-    if (needsParameter) {
-      imports.add("Parameter");
-    }
-
-    // Check for intrinsics
-    const intrinsics = ["Sub", "Ref", "If", "Join", "Select", "Split", "Base64", "GetAZs", "GetAtt"] as const;
-    for (const name of intrinsics) {
-      if (irUsesIntrinsic(ir, name)) imports.add(name);
-    }
-
-    // Check for AWS pseudo-parameters
-    if (this.needsAWSPseudo(ir)) {
-      imports.add("AWS");
-    }
-
-    // Collect service imports (skip unknown resource types)
-    for (const resource of ir.resources) {
-      const parsed = this.parseResourceType(resource.type);
-      if (!parsed) continue;
-      const { service, resourceClass } = parsed;
-      if (!serviceImports.has(service)) {
-        serviceImports.set(service, new Set());
-      }
-      serviceImports.get(service)!.add(resourceClass);
-    }
-
-    // Build import lines
-    const importLines: string[] = [];
-
-    // Merge service resource imports into the core imports set
-    for (const [_service, resources] of serviceImports) {
-      for (const r of resources) {
-        imports.add(r);
-      }
+    // Everything comes from the flat @intentius/chant-lexicon-aws package,
+    // and the needed symbol set is exactly what collectImportedSymbols
+    // computes for variable-name conflict detection.
+    const allImports = [...this.collectImportedSymbols(ir)];
+    if (allImports.length === 0) {
+      return "";
     }
-
-    // All imports come from the flat @intentius/chant-lexicon-aws package
-    const allImports = [...imports];
-    if (allImports.length > 0) {
-      importLines.push(`import { ${allImports.join(", ")} } from "@intentius/chant-lexicon-aws";`);
-    }
-
-    return importLines.join("\n");
+    return `import { ${allImports.join(", ")} } from "@intentius/chant-lexicon-aws";`;
   }
 
   /**
@@ -237,6 +222,76 @@ export class CFGenerator implements TypeScriptGenerator {
     );
   }
 
+  /**
+   * Sort conditions so `{ Condition: ... }` references point at earlier
+   * declarations (#2069).
+   */
+  private sortConditions(conditions: ConditionIR[]): ConditionIR[] {
+    return topoSort(
+      conditions,
+      (c) => c.name,
+      (c) => [
+        ...collectDependencies(c.expression, (obj) =>
+          obj.__intrinsic === "ConditionRef" ? (obj.name as string) : null,
+        ),
+      ],
+    );
+  }
+
+  /**
+   * Render a condition reference as the condition's variable when the
+   * template declares it, or as a literal name string when it doesn't (an
+   * undeclared reference stays visible rather than breaking generation).
+   */
+  private conditionVarRef(name: string, ir: TemplateIR, importedSymbols: Set<string>): string {
+    const declared = (ir.conditions ?? []).some((c) => c.name === name);
+    return declared ? this.safeVarName(name, importedSymbols) : JSON.stringify(name);
+  }
+
+  /**
+   * Generate a condition declaration (#2069)
+   */
+  private generateCondition(condition: ConditionIR, ir: TemplateIR, importedSymbols: Set<string>): string {
+    const varName = this.safeVarName(condition.name, importedSymbols);
+    const exprStr = this.generateValue(condition.expression, ir, importedSymbols);
+    return `export const ${varName} = new Condition(${exprStr});`;
+  }
+
+  /**
+   * Generate an output declaration as stackOutput(...) (#2069)
+   */
+  private generateOutput(output: OutputIR, ir: TemplateIR, importedSymbols: Set<string>): string {
+    const varName = this.safeVarName(output.name, importedSymbols);
+
+    // A bare Ref envelope becomes Ref(<var>) — stackOutput takes an intrinsic
+    // or attribute reference, not the resource/parameter object itself.
+    let valueStr: string;
+    const value = output.value as Record<string, unknown> | null;
+    if (value !== null && typeof value === "object" && !Array.isArray(value) && value.__intrinsic === "Ref" && !(value.name as string).startsWith("AWS::")) {
+      valueStr = `Ref(${this.safeVarName(value.name as string, importedSymbols)})`;
+    } else {
+      valueStr = this.generateValue(output.value, ir, importedSymbols);
+    }
+
+    const opts: string[] = [];
+    if (output.description) opts.push(`description: ${JSON.stringify(output.description)}`);
+    if (output.exportName !== undefined) {
+      opts.push(`exportName: ${this.generateValue(output.exportName, ir, importedSymbols)}`);
+    }
+    if (output.condition) {
+      opts.push(`condition: ${this.conditionVarRef(output.condition, ir, importedSymbols)}`);
+    }
+    // A literal output has no entity to derive its lexicon from.
+    if (typeof output.value === "string") {
+      opts.push(`lexicon: "aws"`);
+    }
+
+    if (opts.length > 0) {
+      return `export const ${varName} = stackOutput(${valueStr}, { ${opts.join(", ")} });`;
+    }
+    return `export const ${varName} = stackOutput(${valueStr});`;
+  }
+
   /**
    * Generate a parameter declaration
    */
@@ -264,6 +319,12 @@ export class CFGenerator implements TypeScriptGenerator {
     const { resourceClass } = parsed;
     const propsStr = this.generateProps(resource.properties, ir, importedSymbols);
 
+    // Resource-level Condition key → the attributes argument (#2069)
+    if (resource.condition) {
+      const condRef = this.conditionVarRef(resource.condition, ir, importedSymbols);
+      return `export const ${varName} = new ${resourceClass}(${propsStr}, { Condition: ${condRef} });`;
+    }
+
     if (propsStr === "{}") {
       return `export const ${varName} = new ${resourceClass}();`;
     }
@@ -344,9 +405,29 @@ export class CFGenerator implements TypeScriptGenerator {
 
       if (obj.__intrinsic === "If") {
         const condition = obj.condition as string;
+        const condRef = this.conditionVarRef(condition, ir, importedSymbols);
         const trueVal = this.generateValue(obj.valueIfTrue, ir, importedSymbols);
         const falseVal = this.generateValue(obj.valueIfFalse, ir, importedSymbols);
-        return `If("${condition}", ${trueVal}, ${falseVal})`;
+        return `If(${condRef}, ${trueVal}, ${falseVal})`;
+      }
+
+      if (obj.__intrinsic === "Equals") {
+        const left = this.generateValue(obj.left, ir, importedSymbols);
+        const right = this.generateValue(obj.right, ir, importedSymbols);
+        return `Equals(${left}, ${right})`;
+      }
+
+      if (obj.__intrinsic === "And" || obj.__intrinsic === "Or") {
+        const operands = (obj.conditions as unknown[]).map((c) => this.generateValue(c, ir, importedSymbols));
+        return `${obj.__intrinsic}(${operands.join(", ")})`;
+      }
+
+      if (obj.__intrinsic === "Not") {
+        return `Not(${this.generateValue(obj.condition, ir, importedSymbols)})`;
+      }
+
+      if (obj.__intrinsic === "ConditionRef") {
+        return this.conditionVarRef(obj.name as string, ir, importedSymbols);
       }
 
       if (obj.__intrinsic === "Join") {

package/src/import/parser.test.ts

@@ -198,3 +198,99 @@ describe("CFParser", () => {
     expect(vars.KEY).toBe("value");
   });
 });
+
+describe("CFParser conditions and outputs (#2069)", () => {
+  const parser = new CFParser();
+
+  const template = JSON.stringify({
+    AWSTemplateFormatVersion: "2010-09-09",
+    Parameters: { Cutover: { Type: "String", Default: "false" } },
+    Conditions: {
+      DoCutover: { "Fn::Equals": [{ Ref: "Cutover" }, "true"] },
+      NoCutover: { "Fn::Not": [{ Condition: "DoCutover" }] },
+    },
+    Resources: {
+      Rule: {
+        Type: "AWS::Logs::LogGroup",
+        Condition: "DoCutover",
+        Properties: { LogGroupName: { "Fn::If": ["DoCutover", "/on", "/off"] } },
+      },
+    },
+    Outputs: {
+      RuleName: { Condition: "DoCutover", Value: { Ref: "Rule" }, Description: "d", Export: { Name: "rule-name" } },
+      Plain: { Value: "literal" },
+    },
+  });
+
+  test("parses the Conditions section, Condition references included", () => {
+    const ir = parser.parse(template);
+    expect(ir.conditions).toHaveLength(2);
+    expect(ir.conditions![0]).toEqual({
+      name: "DoCutover",
+      expression: { __intrinsic: "Equals", left: { __intrinsic: "Ref", name: "Cutover" }, right: "true" },
+    });
+    expect(ir.conditions![1]).toEqual({
+      name: "NoCutover",
+      expression: { __intrinsic: "Not", condition: { __intrinsic: "ConditionRef", name: "DoCutover" } },
+    });
+  });
+
+  test("carries the resource-level Condition key", () => {
+    const ir = parser.parse(template);
+    expect(ir.resources[0].condition).toBe("DoCutover");
+  });
+
+  test("parses Outputs with Condition, Description, and Export", () => {
+    const ir = parser.parse(template);
+    expect(ir.outputs).toHaveLength(2);
+    expect(ir.outputs![0]).toEqual({
+      name: "RuleName",
+      value: { __intrinsic: "Ref", name: "Rule" },
+      description: "d",
+      exportName: "rule-name",
+      condition: "DoCutover",
+    });
+    expect(ir.outputs![1]).toEqual({
+      name: "Plain",
+      value: "literal",
+      description: undefined,
+      exportName: undefined,
+      condition: undefined,
+    });
+  });
+
+  test("a single-key Condition object in resource properties is NOT a condition reference", () => {
+    const ir = parser.parse(
+      JSON.stringify({
+        Resources: {
+          Role: {
+            Type: "AWS::IAM::Role",
+            Properties: {
+              Policy: { Condition: "not-a-ref" },
+            },
+          },
+        },
+      }),
+    );
+    expect(ir.resources[0].properties.Policy).toEqual({ Condition: "not-a-ref" });
+  });
+
+  test("names sections import cannot carry instead of dropping them silently", () => {
+    const ir = parser.parse(
+      JSON.stringify({
+        Resources: { R: { Type: "AWS::S3::Bucket" } },
+        Mappings: { M: {} },
+        Rules: { R1: {} },
+      }),
+    );
+    expect(ir.warnings).toEqual([
+      'Template section "Mappings" is not carried by import — it is dropped from the generated source',
+      'Template section "Rules" is not carried by import — it is dropped from the generated source',
+    ]);
+  });
+
+  test("no warnings for fully-carried templates", () => {
+    const ir = parser.parse(template);
+    expect(ir.warnings).toBeUndefined();
+  });
+});