@intentius/chant 0.0.12 → 0.0.14

package/src/cli/commands/onboard.ts

@@ -0,0 +1,313 @@
+import { readFileSync, writeFileSync, existsSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+import { formatSuccess, formatError, formatWarning } from "../format";
+
+export interface OnboardOptions {
+  name: string;
+  verbose?: boolean;
+}
+
+export interface OnboardResult {
+  success: boolean;
+  patched: string[];
+  skipped: string[];
+  error?: string;
+}
+
+/** Resolve the monorepo root (5 dirs up from packages/core/src/cli/commands/). */
+function findRepoRoot(): string {
+  const here = dirname(fileURLToPath(import.meta.url)); // commands/
+  return dirname(dirname(dirname(dirname(dirname(here))))); // -> root
+}
+
+/**
+ * Patch root package.json to add a workspace dependency for the lexicon.
+ */
+function patchRootPackageJson(root: string, name: string): { patched: boolean; reason?: string } {
+  const pkgPath = join(root, "package.json");
+  if (!existsSync(pkgPath)) return { patched: false, reason: "root package.json not found" };
+
+  const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+  const depKey = `@intentius/chant-lexicon-${name}`;
+
+  if (pkg.dependencies?.[depKey]) {
+    return { patched: false, reason: `${depKey} already in dependencies` };
+  }
+
+  pkg.dependencies = pkg.dependencies ?? {};
+  pkg.dependencies[depKey] = "workspace:*";
+
+  // Sort dependencies for consistency
+  const sorted: Record<string, string> = {};
+  for (const k of Object.keys(pkg.dependencies).sort()) {
+    sorted[k] = pkg.dependencies[k];
+  }
+  pkg.dependencies = sorted;
+
+  writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+  return { patched: true };
+}
+
+/**
+ * Insert a new prepack line after the last prepack line in each contiguous group
+ * of 2+ lines. Single standalone lines (like YAML `run:` values) are ignored.
+ * Used for multi-line `run: |` blocks in workflows and Dockerfile RUN sequences.
+ */
+function insertPrepackInContiguousGroups(lines: string[], name: string): boolean {
+  const newFragment = `lexicons/${name} prepack`;
+  if (lines.some((l) => l.includes(newFragment))) return false;
+
+  // Identify contiguous groups of prepack lines
+  const groups: { start: number; end: number }[] = [];
+  let groupStart = -1;
+  for (let i = 0; i <= lines.length; i++) {
+    const isPrepack =
+      i < lines.length &&
+      lines[i].includes("bun run --cwd lexicons/") &&
+      lines[i].includes("prepack");
+    if (isPrepack && groupStart === -1) {
+      groupStart = i;
+    } else if (!isPrepack && groupStart !== -1) {
+      groups.push({ start: groupStart, end: i - 1 });
+      groupStart = -1;
+    }
+  }
+
+  // Only insert into groups of 2+ lines (multi-line blocks, not standalone steps)
+  const insertAfter = groups.filter((g) => g.end > g.start).map((g) => g.end);
+
+  if (insertAfter.length === 0) return false;
+
+  for (const idx of insertAfter.reverse()) {
+    const newLine = lines[idx].replace(/lexicons\/[a-z0-9-]+/i, `lexicons/${name}`);
+    lines.splice(idx + 1, 0, newLine);
+  }
+
+  return true;
+}
+
+/**
+ * Insert a new prepack line after every last-in-group prepack line (groups of 1+).
+ * Used for Dockerfiles and publish.yml where all occurrences should get a new line.
+ */
+function insertPrepackAfterEach(lines: string[], name: string): boolean {
+  const newFragment = `lexicons/${name} prepack`;
+  if (lines.some((l) => l.includes(newFragment))) return false;
+
+  const insertAfter: number[] = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!lines[i].includes("bun run --cwd lexicons/") || !lines[i].includes("prepack")) continue;
+    const nextIsAlsoPrepack =
+      i + 1 < lines.length &&
+      lines[i + 1].includes("bun run --cwd lexicons/") &&
+      lines[i + 1].includes("prepack");
+    if (!nextIsAlsoPrepack) {
+      insertAfter.push(i);
+    }
+  }
+
+  if (insertAfter.length === 0) return false;
+
+  for (const idx of insertAfter.reverse()) {
+    const newLine = lines[idx].replace(/lexicons\/[a-z0-9-]+/i, `lexicons/${name}`);
+    lines.splice(idx + 1, 0, newLine);
+  }
+
+  return true;
+}
+
+/**
+ * Patch chant.yml: add prepack lines in check/test multi-line `run: |` blocks,
+ * and add a new validate step.
+ *
+ * The file has two patterns:
+ * 1. Multi-line blocks (check + test jobs): `run: |\n  bun run --cwd lexicons/aws prepack\n  ...`
+ * 2. Standalone steps (validate job): `- name: Generate and validate ...\n  run: bun run --cwd ...`
+ *
+ * We only insert into pattern 1 (contiguous groups) and separately add a new pattern 2 step.
+ */
+function patchCiWorkflow(root: string, name: string): { patched: boolean; reason?: string } {
+  const filePath = join(root, ".github/workflows/chant.yml");
+  if (!existsSync(filePath)) return { patched: false, reason: "chant.yml not found" };
+
+  const content = readFileSync(filePath, "utf-8");
+  if (content.includes(`lexicons/${name} prepack`)) {
+    return { patched: false, reason: `${name} already in chant.yml` };
+  }
+
+  const lines = content.split("\n");
+
+  // 1. Insert into multi-line `run: |` blocks only (contiguous prepack groups of 3+).
+  //    The validate job has standalone steps that are NOT contiguous, so they won't match.
+  insertPrepackInContiguousGroups(lines, name);
+
+  // 2. Add a named validate step after the last "Generate and validate" step
+  const displayName = name.charAt(0).toUpperCase() + name.slice(1);
+  const validateStepName = `Generate and validate ${displayName} lexicon`;
+
+  if (!lines.some((l) => l.includes(validateStepName))) {
+    let lastValidateRunIdx = -1;
+    for (let i = 0; i < lines.length; i++) {
+      if (lines[i].includes("Generate and validate")) {
+        if (i + 1 < lines.length && lines[i + 1].trimStart().startsWith("run:")) {
+          lastValidateRunIdx = i + 1;
+        }
+      }
+    }
+
+    if (lastValidateRunIdx > 0) {
+      const block = [
+        "",
+        `      - name: ${validateStepName}`,
+        `        run: bun run --cwd lexicons/${name} prepack`,
+      ];
+      lines.splice(lastValidateRunIdx + 1, 0, ...block);
+    }
+  }
+
+  writeFileSync(filePath, lines.join("\n"));
+  return { patched: true };
+}
+
+/**
+ * Patch publish.yml: add prepack line in test job + publish step.
+ */
+function patchPublishWorkflow(root: string, name: string): { patched: boolean; reason?: string } {
+  const filePath = join(root, ".github/workflows/publish.yml");
+  if (!existsSync(filePath)) return { patched: false, reason: "publish.yml not found" };
+
+  const content = readFileSync(filePath, "utf-8");
+  if (content.includes(`working-directory: lexicons/${name}`)) {
+    return { patched: false, reason: `publish step for ${name} already present` };
+  }
+
+  const lines = content.split("\n");
+
+  // Insert prepack line in test job
+  insertPrepackAfterEach(lines, name);
+
+  // Add publish step after the last existing publish step
+  let lastPublishRunIdx = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i].includes("bun publish --access public --tolerate-republish")) {
+      lastPublishRunIdx = i;
+    }
+  }
+
+  if (lastPublishRunIdx > 0) {
+    const block = [
+      "",
+      `      - name: Publish @intentius/chant-lexicon-${name}`,
+      `        working-directory: lexicons/${name}`,
+      "        run: bun publish --access public --tolerate-republish",
+    ];
+    lines.splice(lastPublishRunIdx + 1, 0, ...block);
+  }
+
+  writeFileSync(filePath, lines.join("\n"));
+  return { patched: true };
+}
+
+/**
+ * Patch a Dockerfile to add a prepack RUN line.
+ */
+function patchDockerfile(filePath: string, name: string): { patched: boolean; reason?: string } {
+  if (!existsSync(filePath)) return { patched: false, reason: `${filePath} not found` };
+
+  const content = readFileSync(filePath, "utf-8");
+  if (content.includes(`lexicons/${name} prepack`)) {
+    return { patched: false, reason: `prepack for ${name} already in Dockerfile` };
+  }
+
+  const lines = content.split("\n");
+  insertPrepackAfterEach(lines, name);
+  writeFileSync(filePath, lines.join("\n"));
+  return { patched: true };
+}
+
+/**
+ * Execute the onboard command — patches monorepo infrastructure for a new lexicon.
+ */
+export function onboardCommand(options: OnboardOptions): OnboardResult {
+  const root = findRepoRoot();
+  const patched: string[] = [];
+  const skipped: string[] = [];
+
+  // 1. Root package.json
+  const pkgResult = patchRootPackageJson(root, options.name);
+  if (pkgResult.patched) patched.push("package.json (root dependency)");
+  else skipped.push(`package.json: ${pkgResult.reason}`);
+
+  // 2. CI workflow
+  const ciResult = patchCiWorkflow(root, options.name);
+  if (ciResult.patched) patched.push("chant.yml (prepack + validate)");
+  else skipped.push(`chant.yml: ${ciResult.reason}`);
+
+  // 3. Publish workflow
+  const pubResult = patchPublishWorkflow(root, options.name);
+  if (pubResult.patched) patched.push("publish.yml (prepack + publish step)");
+  else skipped.push(`publish.yml: ${pubResult.reason}`);
+
+  // 4. Dockerfiles
+  const dockerBun = join(root, "test/Dockerfile.smoke");
+  const dockerNode = join(root, "test/Dockerfile.smoke-node");
+
+  const db = patchDockerfile(dockerBun, options.name);
+  if (db.patched) patched.push("Dockerfile.smoke (prepack)");
+  else skipped.push(`Dockerfile.smoke: ${db.reason}`);
+
+  const dn = patchDockerfile(dockerNode, options.name);
+  if (dn.patched) patched.push("Dockerfile.smoke-node (prepack)");
+  else skipped.push(`Dockerfile.smoke-node: ${dn.reason}`);
+
+  return { success: true, patched, skipped };
+}
+
+/**
+ * Print onboard results and remaining manual steps.
+ */
+export async function printOnboardResult(result: OnboardResult, name: string): Promise<void> {
+  if (!result.success) {
+    console.error(formatError({ message: result.error ?? "onboard failed" }));
+    return;
+  }
+
+  if (result.patched.length > 0) {
+    console.log(formatSuccess("Patched:"));
+    for (const f of result.patched) {
+      console.log(`  ${f}`);
+    }
+  }
+
+  if (result.skipped.length > 0) {
+    console.log("");
+    console.log("Skipped (already configured):");
+    for (const s of result.skipped) {
+      console.log(`  ${s}`);
+    }
+  }
+
+  console.log("");
+  console.log("Remaining manual steps:");
+  console.log(`  1. Create an example: lexicons/${name}/examples/<example-name>/`);
+  console.log(`     (must depend on @intentius/chant-lexicon-${name} for workspace resolution)`);
+  console.log(`  2. Add smoke tests to test/integration.sh`);
+  console.log(`  3. Run: bun install (to update workspace links)`);
+  console.log(`  4. First npm publish: tag with v<version> and push`);
+  console.log(`  5. Run: chant dev check-lexicon lexicons/${name} (to see completeness status)`);
+  console.log(formatWarning({
+    message: "First-time scoped packages may publish as private despite --access public",
+  }));
+  console.log(`     Check https://www.npmjs.com/org/intentius and toggle visibility if needed`);
+
+  // Run check-lexicon if the lexicon directory exists
+  const lexiconDir = join(findRepoRoot(), "lexicons", name);
+  if (existsSync(lexiconDir)) {
+    console.log("");
+    console.log("Lexicon completeness:");
+    const { checkLexicon, printCheckResult } = await import("./check-lexicon");
+    const checkResult = checkLexicon(lexiconDir);
+    printCheckResult(checkResult, false);
+  }
+}

package/src/cli/handlers/dev.ts

@@ -1,3 +1,4 @@
+import { resolve } from "node:path";
 import { formatError, formatSuccess } from "../format";
 import type { CommandContext } from "../registry";
 
@@ -21,10 +22,34 @@ export async function runDevPublish(ctx: CommandContext): Promise<number> {
   return 0;
 }
 
+export async function runDevOnboard(ctx: CommandContext): Promise<number> {
+  const name = ctx.args.extraPositional;
+  if (!name) {
+    console.error(formatError({
+      message: "Missing lexicon name",
+      hint: "Usage: chant dev onboard <name>",
+    }));
+    return 1;
+  }
+
+  const { onboardCommand, printOnboardResult } = await import("../commands/onboard");
+  const result = onboardCommand({ name, verbose: ctx.args.verbose });
+  await printOnboardResult(result, name);
+  return result.success ? 0 : 1;
+}
+
+export async function runDevCheckLexicon(ctx: CommandContext): Promise<number> {
+  const dir = ctx.args.extraPositional ?? ".";
+  const { checkLexicon, printCheckResult } = await import("../commands/check-lexicon");
+  const result = checkLexicon(resolve(dir));
+  printCheckResult(result, ctx.args.format === "json");
+  return result.tier1Pass ? 0 : 1;
+}
+
 export async function runDevUnknown(ctx: CommandContext): Promise<number> {
   console.error(formatError({
     message: `Unknown dev subcommand: ${ctx.args.path}`,
-    hint: "Available: chant dev generate, chant dev publish",
+    hint: "Available: chant dev generate, chant dev publish, chant dev onboard, chant dev check-lexicon",
   }));
   return 1;
 }

package/src/cli/main.ts

@@ -8,7 +8,7 @@ import { loadChantConfig } from "../config";
 import { initRuntime } from "../runtime-adapter";
 import { runBuild } from "./handlers/build";
 import { runLint } from "./handlers/lint";
-import { runDevGenerate, runDevPublish, runDevUnknown } from "./handlers/dev";
+import { runDevGenerate, runDevPublish, runDevOnboard, runDevCheckLexicon, runDevUnknown } from "./handlers/dev";
 import { runServeLsp, runServeMcp, runServeUnknown } from "./handlers/serve";
 import { runInit, runInitLexicon } from "./handlers/init";
 import { runList, runImport, runUpdate, runDoctor } from "./handlers/misc";
@@ -94,6 +94,8 @@ Commands:
 Lexicon development:
   dev generate          Generate lexicon artifacts (+ validate + coverage)
   dev publish           Package lexicon for distribution
+  dev onboard <name>    Patch CI, Dockerfiles, and workflows for a new lexicon
+  dev check-lexicon <dir>  Check lexicon completeness (tier 1/2/3)
 
 Servers:
   serve lsp             Start the LSP server (stdio)
@@ -172,6 +174,8 @@ const registry: CommandDef[] = [
   // Dev subcommands
   { name: "dev generate", requiresPlugins: true, handler: runDevGenerate },
   { name: "dev publish", requiresPlugins: true, handler: runDevPublish },
+  { name: "dev onboard", handler: runDevOnboard },
+  { name: "dev check-lexicon", handler: runDevCheckLexicon },
 
   // Serve subcommands
   { name: "serve lsp", requiresPlugins: true, handler: runServeLsp },

package/src/codegen/docs.ts

@@ -10,6 +10,11 @@
 import { readFileSync, readdirSync, writeFileSync, mkdirSync, rmSync } from "fs";
 import { join } from "path";
 
+/** Escape curly braces so MDX doesn't treat them as JSX expressions. */
+function escapeMdx(text: string): string {
+  return text.replace(/\{/g, "\\{").replace(/\}/g, "\\}");
+}
+
 // ── Types ──────────────────────────────────────────────────────────
 
 export interface DocsConfig {
@@ -398,7 +403,7 @@ function buildSidebar(
     items.push({ label: "Pseudo-Parameters", slug: "pseudo-parameters" });
   }
 
-  if (!suppress.has("rules") && !extraSlugs.has("rules") && result.pages.has("rules.mdx")) {
+  if (!suppress.has("rules") && !extraSlugs.has("rules") && !extraSlugs.has("lint-rules") && result.pages.has("rules.mdx")) {
     items.push({ label: "Lint Rules", slug: "rules" });
   }
 
@@ -467,7 +472,8 @@ function generateOverview(
       `- [Pseudo-Parameters](./pseudo-parameters) — ${Object.keys(manifest.pseudoParameters).length} pseudo-parameters`,
     );
   }
-  if (!suppress.has("rules") && rules.length > 0) {
+  const overviewExtraSlugs = new Set((config.extraPages ?? []).map((p) => p.slug));
+  if (!suppress.has("rules") && !overviewExtraSlugs.has("lint-rules") && rules.length > 0) {
     lines.push(`- [Lint Rules](./rules) — ${rules.length} rules`);
   }
   if (!suppress.has("serialization")) {
@@ -504,7 +510,7 @@ function generateIntrinsics(
   for (const fn of intrinsics) {
     const tag = fn.isTag ? "Yes" : "No";
     lines.push(
-      `| \`${fn.name}\` | ${fn.description ?? "—"} | \`${fn.outputKey ?? fn.name}\` | ${tag} |`,
+      `| \`${fn.name}\` | ${escapeMdx(fn.description ?? "—")} | \`${fn.outputKey ?? fn.name}\` | ${tag} |`,
     );
   }
 
@@ -561,7 +567,7 @@ function generateRules(config: DocsConfig, rules: RuleMeta[]): string {
     );
     for (const rule of lintRules.sort((a, b) => a.id.localeCompare(b.id))) {
       lines.push(
-        `| \`${rule.id}\` | ${rule.severity} | ${rule.category} | ${rule.description} |`,
+        `| \`${rule.id}\` | ${rule.severity} | ${rule.category} | ${escapeMdx(rule.description)} |`,
       );
     }
     lines.push("");
@@ -579,7 +585,7 @@ function generateRules(config: DocsConfig, rules: RuleMeta[]): string {
     for (const rule of postSynthRules.sort((a, b) =>
       a.id.localeCompare(b.id),
     )) {
-      lines.push(`| \`${rule.id}\` | ${rule.description} |`);
+      lines.push(`| \`${rule.id}\` | ${escapeMdx(rule.description)} |`);
     }
     lines.push("");
   }

package/src/codegen/generate-registry.ts

@@ -46,12 +46,13 @@ export function buildRegistry<E>(
     const tsName = naming.resolve(typeName);
     if (!tsName) continue;
 
-    // Build attrs map: name → raw name (identity mapping)
+    // Build attrs map: TS key (underscores) → CF attr name (dots)
     let attrs: Record<string, string> | undefined;
     if (r.attributes.length > 0) {
       attrs = {};
       for (const a of r.attributes) {
-        attrs[a.name] = a.name;
+        const tsKey = a.name.replace(/\./g, "_");
+        attrs[tsKey] = a.name;
       }
     }
 

package/src/codegen/typecheck.ts

@@ -6,6 +6,39 @@ import { join } from "path";
 import { tmpdir } from "os";
 import { getRuntime } from "../runtime-adapter";
 
+/**
+ * Minimal TypeScript lib stub — declares just enough built-in types for
+ * validating generated .d.ts files without needing the full standard library.
+ * This avoids transient failures from corrupted bunx TypeScript caches.
+ */
+const MINIMAL_LIB = `
+interface Array<T> { length: number; [n: number]: T; }
+interface ReadonlyArray<T> { length: number; readonly [n: number]: T; }
+interface String { length: number; }
+interface Boolean {}
+interface Number {}
+interface Function {}
+interface CallableFunction extends Function {}
+interface NewableFunction extends Function {}
+interface Object {}
+interface RegExp {}
+interface IArguments {}
+interface Symbol {}
+type Record<K extends string | number | symbol, V> = { [P in K]: V; };
+type Partial<T> = { [P in keyof T]?: T[P]; };
+type Required<T> = { [P in keyof T]-?: T[P]; };
+type Readonly<T> = { readonly [P in keyof T]: T[P]; };
+type Pick<T, K extends keyof T> = { [P in K]: T[P]; };
+type Omit<T, K extends string | number | symbol> = Pick<T, Exclude<keyof T, K>>;
+type Exclude<T, U> = T extends U ? never : T;
+type Extract<T, U> = T extends U ? T : never;
+type NonNullable<T> = T extends null | undefined ? never : T;
+type ReturnType<T extends (...args: any) => any> = T extends (...args: any) => infer R ? R : any;
+type InstanceType<T extends abstract new (...args: any) => any> = T extends abstract new (...args: any) => infer R ? R : any;
+type Promise<T> = { then<TResult>(onfulfilled?: (value: T) => TResult): Promise<TResult>; };
+interface TemplateStringsArray extends ReadonlyArray<string> { readonly raw: readonly string[]; }
+`;
+
 export interface TypeCheckResult {
   ok: boolean;
   diagnostics: string[];
@@ -25,17 +58,26 @@ export async function typecheckDTS(content: string): Promise<TypeCheckResult> {
     const dtsPath = join(dir, "index.d.ts");
     writeFileSync(dtsPath, content);
 
-    // Write a minimal tsconfig
+    // Write a minimal lib stub so tsc doesn't depend on a full TypeScript
+    // standard library installation (avoids bunx cache corruption issues).
+    writeFileSync(
+      join(dir, "lib.d.ts"),
+      MINIMAL_LIB,
+    );
+
+    // Write a minimal tsconfig — noLib: true prevents tsc from looking for
+    // standard lib files; our lib.d.ts is included via the include array.
     const tsconfig = {
       compilerOptions: {
         strict: true,
         noEmit: true,
         skipLibCheck: false,
+        noLib: true,
         target: "ES2022",
         module: "ES2022",
         moduleResolution: "bundler",
       },
-      include: ["index.d.ts"],
+      include: ["lib.d.ts", "index.d.ts"],
     };
     writeFileSync(join(dir, "tsconfig.json"), JSON.stringify(tsconfig, null, 2));
 

package/src/detectLexicon.test.ts

@@ -223,6 +223,30 @@ describe("detectLexicons", () => {
     expect(result).toEqual(["testdom"]);
   });
 
+  test("detects lexicon from multiline import", async () => {
+    const file = join(testDir, "infra.ts");
+    await writeFile(
+      file,
+      `import {\n  Namespace,\n  StatefulSet,\n  Service,\n} from "@intentius/chant-lexicon-k8s";\n\nexport const ns = new Namespace({});`
+    );
+
+    const result = await detectLexicons([file]);
+    expect(result).toEqual(["k8s"]);
+  });
+
+  test("detects multiple lexicons from multiline imports", async () => {
+    const file = join(testDir, "infra.ts");
+    await writeFile(
+      file,
+      `import {\n  Namespace,\n  Service,\n} from "@intentius/chant-lexicon-k8s";\nimport {\n  FlywayProject,\n  Environment,\n} from "@intentius/chant-lexicon-flyway";\n\nexport const ns = new Namespace({});`
+    );
+
+    const result = await detectLexicons([file]);
+    expect(result).toContain("k8s");
+    expect(result).toContain("flyway");
+    expect(result).toHaveLength(2);
+  });
+
   test("detects lexicon from export with curly braces", async () => {
     const file = join(testDir, "reexport.ts");
     await writeFile(

package/src/detectLexicon.ts

@@ -20,8 +20,10 @@ export async function detectLexicons(files: string[]): Promise<string[]> {
       continue;
     }
 
-    // Match @intentius/chant-lexicon-<name> in import/export statements
-    const regex = /(?:import|export)\s+.*\s+from\s+['"]@intentius\/chant-lexicon-([a-z][\w-]*)['"]/g;
+    // Match @intentius/chant-lexicon-<name> in import/export statements.
+    // Uses [\s\S] instead of . to handle multiline imports like:
+    //   import { Foo, Bar } from "@intentius/chant-lexicon-k8s";
+    const regex = /(?:import|export)\s+[\s\S]*?\s+from\s+['"]@intentius\/chant-lexicon-([a-z][\w-]*)['"]/g;
 
     for (const match of content.matchAll(regex)) {
       detectedLexicons.add(match[1]);

package/src/runtime.ts

@@ -31,6 +31,10 @@ export function createResource(
     Object.defineProperty(this, "props", { value: props ?? {}, enumerable: false, configurable: true });
     Object.defineProperty(this, "attributes", { value: attributes ?? {}, enumerable: false, configurable: true });
 
+    // Ref returns the resource instance itself — the serializer walker
+    // detects Declarable objects and emits { Ref: logicalName }
+    Object.defineProperty(this, "Ref", { value: this, enumerable: false });
+
     // Create AttrRef instances for each attribute
     // Must be enumerable so getAttributes() can discover them for resolveAttrRefs()
     for (const [camelName, attrName] of Object.entries(attrMap)) {

package/src/serializer-walker.test.ts

@@ -3,6 +3,7 @@ import { walkValue, type SerializerVisitor } from "./serializer-walker";
 import { DECLARABLE_MARKER, type Declarable } from "./declarable";
 import { INTRINSIC_MARKER } from "./intrinsic";
 import { AttrRef } from "./attrref";
+import { createResource } from "./runtime";
 
 function makeDeclarable(type: string, kind: "resource" | "property" = "resource", props?: Record<string, unknown>): Declarable & { props?: Record<string, unknown> } {
   const d: Declarable & { props?: Record<string, unknown> } = {
@@ -93,6 +94,13 @@ describe("walkValue", () => {
     expect(walkValue({ a: 1, b: { c: 2 } }, names, mockVisitor)).toEqual({ a: 1, b: { c: 2 } });
   });
 
+  test("resource.Ref resolves via resourceRef", () => {
+    const TestTable = createResource("Test::Table", "test", {});
+    const resource = new TestTable({}) as unknown as Declarable;
+    const names = new Map<Declarable, string>([[resource, "MyTable"]]);
+    expect(walkValue((resource as any).Ref, names, mockVisitor)).toEqual({ __ref: "MyTable" });
+  });
+
   test("complex nested structure", () => {
     const resource = makeDeclarable("Test::Role");
     const ref = new AttrRef(resource, "arn");