fix(deployment): gate {Condition: X} named-condition reference on conditionResolver presence

The `{Condition: <name>}` named-condition reference branch in
`resolveValue` fired for every property, not just inside a condition
definition. A resource/output property whose value was exactly a
single-key `{ "Condition": "<string>" }` object was silently coerced to a
boolean via `resolveConditionReference` — and in normal property context
(no `conditionResolver`, name absent from `context.conditions`) that
returns `false`, corrupting the property.

The reference form is only reachable during `evaluateConditions`, the
sole code path that threads a `conditionResolver` hook onto the context.
Gate the branch on `context.conditionResolver` being present so a
resource property literally named `Condition` is never coerced to false;
it now falls through and resolves as an ordinary object, exactly as
before the #840 change. The single-key + `typeof string` guards remain
as defense in depth. Composite-condition behavior is unaffected (it
always runs with `conditionResolver` set).

Adds a unit test pinning that a single-key `{ Condition: "Foo" }`
property resolved in normal context stays a plain object and is not
`false` (review fix).

Author: go-to-k

src/deployment/intrinsic-function-resolver.ts

@@ -528,10 +528,20 @@ export class IntrinsicFunctionResolver {
     // `{Condition: <name>}` — a named-condition reference. Valid only inside
     // another condition's definition (`Fn::And` / `Fn::Or` / `Fn::Not`),
     // where it resolves to the referenced condition's evaluated boolean
-    // (issue #840). Guard against false positives: only treat a single-key
-    // `{Condition: "<string>"}` object as the reference, never a resource
-    // property literally named `Condition` alongside siblings.
+    // (issue #840). This form is ONLY reachable during `evaluateConditions`,
+    // which is the sole code path that threads a `conditionResolver` hook onto
+    // the context — so gate the branch on `context.conditionResolver` being
+    // present. Outside that context (a normal resource / output property), a
+    // single-key `{Condition: "<string>"}` object is a plain property literally
+    // named `Condition`, NOT an intrinsic, and must fall through to be resolved
+    // as an ordinary object — otherwise it would be silently coerced to a
+    // boolean (and to `false`, since neither the resolver hook nor the
+    // already-evaluated `conditions` map is available there), corrupting the
+    // property. The single-key + `typeof string` guards remain as defense in
+    // depth so even inside `evaluateConditions` a composite-condition object
+    // carrying sibling keys is never misread as the reference form.
     if (
+      context.conditionResolver &&
       'Condition' in obj &&
       Object.keys(obj).length === 1 &&
       typeof obj['Condition'] === 'string'

tests/unit/deployment/intrinsic-functions.test.ts

@@ -1943,4 +1943,25 @@ describe('IntrinsicFunctionResolver - evaluateConditions composite refs (#840)',
     );
     expect(result).toEqual({ Condition: 'SomeString', Other: 'pval' });
   });
+
+  it('does not coerce a single-key { Condition: "X" } resource property to a boolean in normal context', async () => {
+    // A single-key `{ Condition: '<string>' }` object IS the named-condition
+    // reference form — but only inside `evaluateConditions`, which threads a
+    // `conditionResolver` hook onto the context. In a normal resource / output
+    // property context (the public `resolve` entry, no conditionResolver) the
+    // same shape is just a plain property literally named `Condition` and MUST
+    // resolve as an ordinary object — never get coerced to `false` by
+    // resolveConditionReference (which, lacking a resolver hook AND a
+    // `conditions` map, would otherwise return false and corrupt the property).
+    const result = await resolver.resolve(
+      { Condition: 'Foo' },
+      {
+        template: { Resources: {} },
+        resources: {},
+        parameters: {},
+      }
+    );
+    expect(result).toEqual({ Condition: 'Foo' });
+    expect(result).not.toBe(false);
+  });
 });