@intentius/chant-lexicon-aws 0.56.0 → 0.58.0

package/src/lint/post-synth/waw069.test.ts

@@ -0,0 +1,94 @@
+import { describe, test, expect } from "vitest";
+import { createPostSynthContext } from "@intentius/chant-test-utils";
+import { waw069, checkUndeclaredConditions } from "./waw069";
+
+function makeCtx(template: object) {
+  return createPostSynthContext({ aws: template });
+}
+
+describe("WAW069: Template references an undeclared condition", () => {
+  test("check metadata", () => {
+    expect(waw069.id).toBe("WAW069");
+    expect(waw069.description).toContain("condition");
+  });
+
+  test("resource Condition key referencing an undeclared condition → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Rule: { Type: "AWS::Logs::LogGroup", Condition: "DoCutover", Properties: { RetentionInDays: 7 } },
+      },
+    });
+    const diags = checkUndeclaredConditions(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("WAW069");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain("DoCutover");
+    expect(diags[0].entity).toBe("Rule");
+  });
+
+  test("Fn::If nested in properties referencing an undeclared condition → error", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Rule: {
+          Type: "AWS::Logs::LogGroup",
+          Properties: { LogGroupName: { "Fn::If": ["DoCutover", "/on", "/off"] } },
+        },
+      },
+    });
+    const diags = checkUndeclaredConditions(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("Fn::If");
+  });
+
+  test("output Condition key and Condition reference inside Conditions → error", () => {
+    const ctx = makeCtx({
+      Conditions: { NoCutover: { "Fn::Not": [{ Condition: "DoCutover" }] } },
+      Resources: { Rule: { Type: "AWS::Logs::LogGroup", Properties: {} } },
+      Outputs: { RuleName: { Condition: "AlsoMissing", Value: { Ref: "Rule" } } },
+    });
+    const diags = checkUndeclaredConditions(ctx);
+    expect(diags).toHaveLength(2);
+    const names = diags.map((d) => d.message);
+    expect(names.some((m) => m.includes('"DoCutover"'))).toBe(true);
+    expect(names.some((m) => m.includes('"AlsoMissing"'))).toBe(true);
+  });
+
+  test("declared conditions are quiet", () => {
+    const ctx = makeCtx({
+      Conditions: {
+        DoCutover: { "Fn::Equals": [{ Ref: "Cutover" }, "true"] },
+        NoCutover: { "Fn::Not": [{ Condition: "DoCutover" }] },
+      },
+      Resources: {
+        Rule: {
+          Type: "AWS::Logs::LogGroup",
+          Condition: "DoCutover",
+          Properties: { LogGroupName: { "Fn::If": ["DoCutover", "/on", "/off"] } },
+        },
+      },
+      Outputs: { RuleName: { Condition: "DoCutover", Value: { Ref: "Rule" } } },
+    });
+    expect(checkUndeclaredConditions(ctx)).toHaveLength(0);
+  });
+
+  test("an IAM policy Condition block is not a condition reference", () => {
+    const ctx = makeCtx({
+      Resources: {
+        Role: {
+          Type: "AWS::IAM::Role",
+          Properties: {
+            AssumeRolePolicyDocument: {
+              Statement: [
+                {
+                  Effect: "Allow",
+                  Condition: { StringEquals: { "aws:SourceAccount": "123456789012" } },
+                },
+              ],
+            },
+          },
+        },
+      },
+    });
+    expect(checkUndeclaredConditions(ctx)).toHaveLength(0);
+  });
+});

package/src/op/activities/aws-apply.ts

@@ -1,5 +1,5 @@
 import { readFileSync } from "node:fs";
-import { safeHeartbeat, sleep } from "@intentius/chant/op";
+import { sleep } from "@intentius/chant/op";
 import { awsDeployCapabilitiesForBody } from "../../components/cloud-executor.js";
 import { resolveEndpointOverride } from "../../api/read-client.js";
 import { ownershipStackTagsForBody } from "../../ownership.js";
@@ -128,7 +128,6 @@ export async function waitForStackSettled(
   const deadline = Date.now() + opts.timeoutMs;
   while (Date.now() < deadline) {
     if (signal?.aborted) throw new Error("awsApply aborted");
-    safeHeartbeat({ step: "awsApply", stack: stackName });
     const res = await http(url, cfnForm("DescribeStacks", { StackName: stackName }), signal);
     const status = stackStatus(res.text);
     if (status && isTerminalStatus(status)) return status;
@@ -231,7 +230,6 @@ export async function awsDelete(
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     if (signal?.aborted) throw new Error("awsDelete aborted");
-    safeHeartbeat({ step: "awsDelete", stack: args.stackName });
     const d = await http(url, cfnForm("DescribeStacks", { StackName: args.stackName }), signal);
     if (d.status >= 300 && isStackMissing(d.text)) return { stackName: args.stackName, deleted: true };
     const status = stackStatus(d.text);

package/src/op/activities/floci.ts

@@ -101,8 +101,9 @@ export function flociRunCommand(args: FlociUpArgs = {}): string {
  * Idempotent: reuses a running container of the same name. Waits for the health
  * endpoint to report `readyService`, then sets `AWS_ENDPOINT_URL` + test creds in
  * the process environment so a following `nativeApply`/`cfn-deploy` targets the
- * emulator. Env injection assumes the in-process local executor; under a
- * distributed Temporal worker, pass the endpoint explicitly instead.
+ * emulator. Env injection works because the local executor runs every step of a
+ * run in this process; a step that runs anywhere else needs the endpoint passed
+ * to it explicitly.
  */
 export async function flociUp(args: FlociUpArgs = {}, signal?: AbortSignal): Promise<{ endpoint: string }> {
   const region = args.region ?? DEFAULT_REGION;

package/src/op/builders.ts

@@ -1,10 +1,10 @@
 /**
  * Typed step-builder wrappers for this lexicon's activities (chant #1288
  * Stage 2). See `lexicons/k8s/src/op/builders.ts`'s module doc for why these
- * live beside their `*Args` interfaces rather than in core or the temporal
- * barrel: core cannot import a lexicon's types (lexicons depend on core, not
- * the reverse), and wiring them into the cloud-agnostic temporal barrel
- * would make it depend on every cloud lexicon at runtime. `opts`'s type in
+ * live beside their `*Args` interfaces rather than in core: core cannot
+ * import a lexicon's types (lexicons depend on core, not the reverse), so a
+ * wrapper whose `opts` IS the activity's own `*Args` interface can only sit
+ * in the lexicon that declares that interface. `opts`'s type in
  * each wrapper below IS the activity's own `*Args` interface (via
  * `Omit`/`WithStepRefs`) — never restated. `core`'s own
  * `awsApply`/`awsDelete`/`flociUp`/`flociDown` are unchanged and produce

package/src/plugin.test.ts

@@ -48,11 +48,15 @@ describe("awsPlugin", () => {
 
   test("returns intrinsics", () => {
     const intrinsics = awsPlugin.intrinsics!();
-    expect(intrinsics.length).toBe(9);
+    expect(intrinsics.length).toBe(13);
     const names = intrinsics.map((i) => i.name);
     expect(names).toContain("Sub");
     expect(names).toContain("Ref");
     expect(names).toContain("GetAtt");
+    expect(names).toContain("Equals");
+    expect(names).toContain("And");
+    expect(names).toContain("Or");
+    expect(names).toContain("Not");
   });
 
   test("returns pseudo-parameters", () => {

package/src/plugin.ts

@@ -111,6 +111,10 @@ export const awsPlugin: LexiconPlugin = {
       { name: "Split", description: "Fn::Split — split string by delimiter", isTag: false, foldsAsCall: true },
       { name: "Base64", description: "Fn::Base64 — encode to Base64", isTag: false, foldsAsCall: true },
       { name: "GetAZs", description: "Fn::GetAZs — list Availability Zones", isTag: false, foldsAsCall: true },
+      { name: "Equals", description: "Fn::Equals — condition comparing two values", isTag: false, foldsAsCall: true },
+      { name: "And", description: "Fn::And — condition conjunction", isTag: false, foldsAsCall: true },
+      { name: "Or", description: "Fn::Or — condition disjunction", isTag: false, foldsAsCall: true },
+      { name: "Not", description: "Fn::Not — condition negation", isTag: false, foldsAsCall: true },
     ];
   },
 

package/src/serializer.ts

@@ -19,8 +19,9 @@ import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { isChildProject, type ChildProjectInstance } from "@intentius/chant/child-project";
 import { isStackOutput, type StackOutput } from "@intentius/chant/stack-output";
-import { isAttrRefLike } from "@intentius/chant/utils";
+import { isAttrRefLike, getLogicalName } from "@intentius/chant/utils";
 import { resolveDependsOn } from "@intentius/chant/resource-attributes";
+import { isCondition } from "./condition";
 import { isDefaultTags, type TagEntry } from "./default-tags";
 import { isTemplateTransform } from "./template-transform";
 import { loadTaggableResources } from "./taggable";
@@ -41,6 +42,7 @@ interface CFTemplate {
   Metadata?: Record<string, unknown>;
   Transform?: string | string[];
   Parameters?: Record<string, CFParameter>;
+  Conditions?: Record<string, unknown>;
   Resources: Record<string, CFResource>;
   Outputs?: Record<string, CFOutput>;
 }
@@ -347,6 +349,13 @@ function serializeToTemplate(
       }
 
       template.Parameters[name] = param;
+    } else if (isCondition(entity)) {
+      // Condition declarable → Conditions section (#2068), lifted the way
+      // Parameter is lifted into Parameters above.
+      if (!template.Conditions) {
+        template.Conditions = {};
+      }
+      template.Conditions[name] = toCFValue(entity.expression, entityNames);
     } else if (isChildProject(entity)) {
       // ChildProjectInstance → AWS::CloudFormation::Stack resource
       const childProject = entity as ChildProjectInstance;
@@ -396,8 +405,13 @@ function serializeToTemplate(
             resource.DependsOn = resolved.length === 1 ? resolved[0] : resolved;
           }
         }
-        // Pass-through attributes
-        if (attrs.Condition) resource.Condition = attrs.Condition as string;
+        // Pass-through attributes. Condition accepts the Condition declarable
+        // as well as a name string (#2068).
+        if (attrs.Condition) {
+          resource.Condition = isCondition(attrs.Condition)
+            ? entityNames.get(attrs.Condition) ?? getLogicalName(attrs.Condition)
+            : attrs.Condition as string;
+        }
         if (attrs.DeletionPolicy) resource.DeletionPolicy = attrs.DeletionPolicy as string;
         if (attrs.UpdateReplacePolicy) resource.UpdateReplacePolicy = attrs.UpdateReplacePolicy as string;
         if (attrs.UpdatePolicy) resource.UpdatePolicy = attrs.UpdatePolicy;
@@ -471,6 +485,13 @@ function serializeToTemplate(
       if (exportName) {
         output.Export = { Name: exportName };
       }
+      // Same defensive read: condition (#2068/#2069) postdates older cores.
+      const condition = (stackOutput as { condition?: unknown }).condition;
+      if (condition) {
+        output.Condition = isCondition(condition)
+          ? entityNames.get(condition) ?? getLogicalName(condition)
+          : condition as string;
+      }
       template.Outputs[name] = output;
     }
   }

package/src/testdata/roundtrip/with-conditions.json

@@ -0,0 +1,16 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Parameters": { "Cutover": { "Type": "String", "Default": "false", "AllowedValues": ["true", "false"] } },
+  "Conditions": {
+    "DoCutover": { "Fn::Equals": [ { "Ref": "Cutover" }, "true" ] },
+    "NoCutover": { "Fn::Not": [ { "Condition": "DoCutover" } ] }
+  },
+  "Resources": {
+    "Rule": {
+      "Type": "AWS::Logs::LogGroup",
+      "Condition": "DoCutover",
+      "Properties": { "LogGroupName": { "Fn::If": [ "DoCutover", "/cut/on", "/cut/off" ] }, "RetentionInDays": 7 }
+    }
+  },
+  "Outputs": { "RuleName": { "Condition": "DoCutover", "Value": { "Ref": "Rule" } } }
+}