@intentius/chant 0.101.0 → 0.102.0

package/src/discovery/fold-import.ts

@@ -4,7 +4,7 @@ import { existsSync, statSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, basename, join, sep, isAbsolute, resolve as resolvePath } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createRequire } from "node:module";
-import { isDeclarable, type Declarable } from "../declarable";
+import { isDeclarable, isResourceDeclarable, type Declarable } from "../declarable";
 import { Composite, isCompositeInstance, type CompositeInstance, type CompositeMembers } from "../composite";
 import { isAttrRefLike } from "../utils";
 import { isIntrinsic } from "../intrinsic";
@@ -28,6 +28,13 @@ import {
 } from "../fold/fold";
 import { isChantOwnedSpecifier, isFoldableHelperName } from "../fold/foldable-helpers";
 import { lexiconModulePath, lexiconModuleRoot } from "../lexicon-module";
+import {
+  isFile,
+  packageExportsTarget,
+  probeModuleFile,
+  splitBareSpecifier,
+  tsconfigPathsMatch,
+} from "./specifier-resolve";
 import {
   briefNodeText,
   callExpressionMessage,
@@ -44,10 +51,11 @@ import { importModule } from "./import";
 import {
   collectCompositeOrigins,
   collectParamDependencies,
+  collectTagOrigins,
   type CompositeParamScope,
 } from "./param-deps";
-import { setPathProvenance } from "../provenance";
-import { intrinsicCallFoldsEagerly, type IntrinsicDef } from "../lexicon";
+import { getInterpolationFields, setPathProvenance } from "../provenance";
+import { intrinsicCallFoldsEagerly, intrinsicTagFolds, type IntrinsicDef } from "../lexicon";
 import type { BuildParamValue } from "../build-params";
 
 /**
@@ -292,7 +300,8 @@ export interface FoldSession {
   readonly executing: boolean;
   /**
    * chant #1023 — per-build memo for {@link readFactoryModule}, keyed by the
-   * resolved absolute path of a module that DEFINES a composite. A composite
+   * resolved absolute path of a module that DEFINES a composite (and, since
+   * chant#3247, the lexicon package root it was reached in, if any). A composite
    * defined once and called from a dozen sibling files is parsed, and its
    * imports resolved, exactly once per build — the same reason
    * {@link FoldSession.cache} exists for the files discovery folds directly.
@@ -454,14 +463,24 @@ function resolveModulePathMemoized(
   resolvePathCache: Map<string, string>,
 ): string {
   const isBare = !specifier.startsWith(".") && !isAbsolute(specifier);
+  // chant#3090 — a tsconfig `paths` answer depends on the importing file's
+  // directory and can name a project file that comes and goes between
+  // builds, so it is memoized per session and directory, like a relative one.
+  const key = `${dirname(fromFile)}\0${specifier}`;
   if (isBare) {
+    const sessionCached = resolvePathCache.get(key);
+    if (sessionCached !== undefined) return sessionCached;
+    const mapped = pathsMappedTarget(specifier, fromFile);
+    if (mapped !== undefined) {
+      resolvePathCache.set(key, mapped);
+      return mapped;
+    }
     const cached = bareSpecifierPathCache.get(specifier);
     if (cached !== undefined) return cached;
     const resolved = resolveModulePath(specifier, fromFile);
     bareSpecifierPathCache.set(specifier, resolved);
     return resolved;
   }
-  const key = `${dirname(fromFile)}\0${specifier}`;
   const cached = resolvePathCache.get(key);
   if (cached !== undefined) return cached;
   const resolved = resolveModulePath(specifier, fromFile);
@@ -543,10 +562,10 @@ export interface FoldExecutionCounts {
   factoryInvocations: number;
   /**
    * Of {@link factoryInvocations}, the ones whose callee came from a PROJECT
-   * FILE (a relative/absolute specifier) rather than a lexicon package or
-   * chant's own — i.e. the ones that execute project-authored code here. Text
-   * only ({@link isProjectFileSpecifier}); no resolution is performed to
-   * classify.
+   * FILE (a relative/absolute specifier, or one a tsconfig `paths` entry
+   * maps) rather than a lexicon package or chant's own — i.e. the ones that
+   * execute project-authored code here ({@link isProjectImport}); no package
+   * resolution is performed to classify.
    */
   projectFactoryInvocations: number;
   /**
@@ -927,16 +946,21 @@ function collectImports(sourceFile: ts.SourceFile): CollectedImports {
 /**
  * chant #1020 hang fix — best-effort fast path for resolving a BARE
  * specifier by walking `node_modules` directly with the same primitives
- * (`existsSync`/`readFileSync`) the relative-specifier branch below already
+ * (`statSync`/`readFileSync`) the relative-specifier branch below already
  * uses, reading `package.json`'s "exports"/"main" field by hand instead of
  * calling `createRequire(fromFile).resolve(specifier)`. Returns `undefined`
- * — never throws — for anything beyond the simple, single-target shape
- * (a string `"exports"`, or an object whose `"."` entry is a string or a
- * flat, string-valued condition map): the caller falls back to the slow,
- * authoritative `createRequire().resolve()` path whenever this returns
- * `undefined`, so a genuinely complex `package.json` (a conditions array, a
- * self-reference, a `"."` entry the fast path doesn't recognize) is still
- * resolved correctly, just not quickly.
+ * — never throws — when the package is not found, its `exports` map does not
+ * export the subpath under the `import`/`node`/`default` conditions, or a
+ * subpath of a package without `exports` has no `package.json` of its own:
+ * the caller then falls back to the slow, authoritative
+ * `createRequire().resolve()` path, so such a specifier is still resolved
+ * correctly, just not quickly.
+ *
+ * chant#3090 — subpaths (`pkg/sub/x`) and `exports` pattern keys
+ * (`"./sub/*"`) resolve here too, with condition objects read in key order
+ * as an ESM import reads them ({@link packageExportsTarget}). Before, a
+ * subpath always reached the `createRequire` fallback, whose CommonJS
+ * conditions miss an `import`-only target.
  *
  * Why this exists at all: profiling traced the hang to
  * `createRequire(fromFile).resolve(specifier)` ITSELF taking upwards of a
@@ -946,22 +970,22 @@ function collectImports(sourceFile: ts.SourceFile): CollectedImports {
  * process (session-level and even process-wide-by-specifier caching, see
  * {@link bareSpecifierPathCache}, only avoid paying that cost a SECOND
  * time). The relative-specifier branch just below, using these exact same
- * `existsSync`/`statSync` primitives, never showed this slowdown anywhere
+ * file-system primitives, never showed this slowdown anywhere
  * in the same profiling — the cost is specific to Node's own
  * `Module._resolveFilename` machinery, not to file-system access in
- * general, so replacing just that one call with plain `existsSync`/
+ * general, so replacing just that one call with plain `statSync`/
  * `readFileSync` sidesteps it entirely for the common case every
  * `@intentius/chant*` package (and most well-formed npm packages) ships.
  */
 function fastResolveBareSpecifier(specifier: string, fromFile: string): string | undefined {
+  const parts = splitBareSpecifier(specifier);
+  if (parts === undefined) return undefined;
   let dir = dirname(fromFile);
   for (;;) {
-    const packageDir = join(dir, "node_modules", specifier);
+    const packageDir = join(dir, "node_modules", parts.name);
     if (existsSync(packageDir)) {
-      const entry = fastResolvePackageEntry(packageDir);
-      if (entry === undefined) return undefined;
-      const resolved = resolvePath(packageDir, entry);
-      if (!existsSync(resolved) || !statSync(resolved).isFile()) return undefined;
+      const resolved = fastResolvePackageEntry(packageDir, parts.subpath);
+      if (resolved === undefined || !isFile(resolved)) return undefined;
       try {
         return realpathSync(resolved);
       } catch {
@@ -974,8 +998,14 @@ function fastResolveBareSpecifier(specifier: string, fromFile: string): string |
   }
 }
 
-/** Read `<packageDir>/package.json`'s "." export target — see {@link fastResolveBareSpecifier}'s doc for exactly which shapes this recognizes; anything else returns `undefined`. */
-function fastResolvePackageEntry(packageDir: string): string | undefined {
+/**
+ * The absolute file `<packageDir>/package.json` names for `subpath` (`"."` or
+ * `"./x"`), or `undefined` — see {@link fastResolveBareSpecifier}'s doc for
+ * which shapes this recognizes. With an `exports` field, that map decides.
+ * Without one, the root is `main` (or `index.js`), and a subpath is read as a
+ * nested package directory with its own `package.json`.
+ */
+function fastResolvePackageEntry(packageDir: string, subpath: string): string | undefined {
   const pkgJsonPath = join(packageDir, "package.json");
   if (!existsSync(pkgJsonPath)) return undefined;
   let pkg: unknown;
@@ -988,68 +1018,63 @@ function fastResolvePackageEntry(packageDir: string): string | undefined {
   const exportsField = (pkg as Record<string, unknown>).exports;
 
   if (exportsField !== undefined) {
-    if (typeof exportsField === "string") return exportsField;
-    if (typeof exportsField !== "object" || exportsField === null || Array.isArray(exportsField)) {
-      return undefined;
-    }
-    const exportsObj = exportsField as Record<string, unknown>;
-    // No "." key at all means the WHOLE object IS the "." export's own
-    // condition map (the shorthand form) — only when none of its OWN keys
-    // look like a subpath/condition-name ambiguity risk (a key starting
-    // with "." that isn't literally "." itself signals real subpath
-    // exports present, so bail rather than misparse).
-    const hasSubpathKeys = Object.keys(exportsObj).some((k) => k.startsWith(".") && k !== ".");
-    const target = "." in exportsObj ? exportsObj["."] : hasSubpathKeys ? undefined : exportsObj;
-    if (target === undefined) return undefined;
-    if (typeof target === "string") return target;
-    if (typeof target !== "object" || target === null || Array.isArray(target)) return undefined;
-    const conditions = target as Record<string, unknown>;
-    // Prefer "default" (present on every chant/lexicon package and the
-    // overwhelming majority of well-formed dual-mode npm packages); "node"/
-    // "import" as narrower fallbacks. Every chant package's own "default"
-    // and "development" conditions point at the identical source file, so
-    // which one Node's own algorithm would have picked never matters here.
-    for (const key of ["default", "node", "import"]) {
-      const val = conditions[key];
-      if (typeof val === "string") return val;
-    }
-    return undefined;
+    const target = packageExportsTarget(exportsField, subpath);
+    return target === undefined ? undefined : resolvePath(packageDir, target);
   }
 
+  if (subpath !== ".") return fastResolvePackageEntry(join(packageDir, subpath), ".");
   const main = (pkg as Record<string, unknown>).main;
-  if (main !== undefined) return typeof main === "string" ? main : undefined;
-  return "index.js";
+  if (main !== undefined) return typeof main === "string" ? resolvePath(packageDir, main) : undefined;
+  return resolvePath(packageDir, "index.js");
+}
+
+/**
+ * chant#3090 — the file a tsconfig `paths` entry maps a bare `specifier` to,
+ * from the nearest `tsconfig.json` above `fromFile` ({@link tsconfigPathsTarget}),
+ * or `undefined`.
+ *
+ * chant's own package specifiers ({@link isChantOwnedSpecifier}) are never
+ * mapped. They resolve through `node_modules` to the modules the CLI has
+ * already loaded, which is what {@link isTrustedExecutableBinding} relies on,
+ * and a project's `paths` cannot point them at its own files. This repository's
+ * root tsconfig maps every chant package to its source, and those entries
+ * name the same files `node_modules` does.
+ *
+ * A specifier this maps is a project import ({@link isProjectImport}): it is
+ * folded as a project file and its trust is decided on the resolved path,
+ * even when its text names an active lexicon package.
+ */
+function pathsMappedTarget(specifier: string, fromFile: string): string | undefined {
+  return pathsMatch(specifier, fromFile)?.target;
+}
+
+/** The tsconfig `paths` match behind {@link pathsMappedTarget}, including a match whose targets name no file. */
+function pathsMatch(specifier: string, fromFile: string): { key: string; target: string | undefined } | undefined {
+  if (specifier.startsWith(".") || isAbsolute(specifier) || isChantOwnedSpecifier(specifier)) return undefined;
+  return tsconfigPathsMatch(specifier, fromFile);
 }
 
 /**
  * Resolve an import specifier to an absolute module path, the way the
  * declaring file's own `import` would — without depending on a TS-aware
  * loader being active. Relative/absolute specifiers are probed against real
- * TS/JS candidate files on disk; bare package specifiers try
- * {@link fastResolveBareSpecifier} first, falling back to Node's own CJS
- * algorithm from the declaring file's location (lexicon packages ship built
- * JS, so this needs no `.ts` awareness) whenever that returns `undefined`.
+ * TS/JS candidate files on disk ({@link probeModuleFile}, which maps `./x.js`
+ * to `./x.ts` as `tsc` does); a bare specifier a tsconfig `paths` entry maps
+ * resolves to that file ({@link pathsMappedTarget}); other bare package
+ * specifiers try {@link fastResolveBareSpecifier} first, falling back to
+ * Node's own CJS algorithm from the declaring file's location whenever that
+ * returns `undefined`.
  */
 function resolveModulePath(specifier: string, fromFile: string): string {
   if (specifier.startsWith(".") || isAbsolute(specifier)) {
     const base = specifier.startsWith(".") ? resolvePath(dirname(fromFile), specifier) : specifier;
-    const candidates = [
-      base,
-      `${base}.ts`,
-      `${base}.tsx`,
-      `${base}.js`,
-      `${base}.mjs`,
-      join(base, "index.ts"),
-      join(base, "index.js"),
-    ];
-    for (const candidate of candidates) {
-      if (existsSync(candidate) && statSync(candidate).isFile()) return candidate;
-    }
     // Nothing found on disk under any probed extension — hand back the bare
     // base and let `import()` fail with its own, more specific error.
-    return base;
+    return probeModuleFile(base) ?? base;
   }
 
+  const mapped = pathsMappedTarget(specifier, fromFile);
+  if (mapped !== undefined) return mapped;
   const fast = fastResolveBareSpecifier(specifier, fromFile);
   if (fast !== undefined) return fast;
   return createRequire(fromFile).resolve(specifier);
@@ -1150,6 +1175,22 @@ function activeLexiconPackage(specifier: string, lexiconPackages: ReadonlySet<st
   return lexiconPackages.has(specifier) ? specifier : undefined;
 }
 
+/**
+ * chant#3090 — {@link activeLexiconPackage} for a specifier imported by
+ * `fromFile`: `undefined` as well when a tsconfig `paths` entry maps the
+ * specifier ({@link pathsMappedTarget}), because the import then names a
+ * project file, not the package the build loaded. Only a specifier whose text
+ * already matches pays the tsconfig lookup.
+ */
+function activeLexiconPackageImport(
+  specifier: string,
+  fromFile: string,
+  lexiconPackages: ReadonlySet<string>,
+): string | undefined {
+  if (activeLexiconPackage(specifier, lexiconPackages) === undefined) return undefined;
+  return pathsMappedTarget(specifier, fromFile) === undefined ? specifier : undefined;
+}
+
 /**
  * chant#2577 — the path-declared counterpart of {@link activeLexiconPackage}:
  * the resolved module path when a relative or absolute `specifier` reaches
@@ -1163,7 +1204,7 @@ function activeLexiconModule(
   lexiconModules: ReadonlySet<string>,
   resolvePathCache: Map<string, string>,
 ): string | undefined {
-  if (lexiconModules.size === 0 || !isProjectFileSpecifier(specifier)) return undefined;
+  if (lexiconModules.size === 0 || !isProjectImport(specifier, fromFile)) return undefined;
   let modulePath: string;
   try {
     modulePath = resolveModulePathMemoized(specifier, fromFile, resolvePathCache);
@@ -1248,7 +1289,7 @@ async function resolveActiveLexiconExport(
   session: FoldSession,
 ): Promise<{ value: unknown } | undefined> {
   let modulePath: string | undefined;
-  if (activeLexiconPackage(binding.specifier, session.lexiconPackages)) {
+  if (activeLexiconPackageImport(binding.specifier, fromFile, session.lexiconPackages)) {
     try {
       modulePath = resolveModulePathMemoized(binding.specifier, fromFile, session.resolvePathCache);
     } catch {
@@ -1276,6 +1317,27 @@ async function resolveActiveLexiconExport(
   return { value };
 }
 
+/**
+ * chant#3247 — a plain data export of a lexicon package's own module, read off
+ * the real module (see the package-root branch of {@link buildExternals}).
+ * `undefined` for a missing export, a callable one, or a module that does not
+ * import.
+ */
+async function packageDataExport(
+  modulePath: string,
+  name: string,
+  session: FoldSession,
+): Promise<{ value: unknown } | undefined> {
+  let mod: Record<string, unknown>;
+  try {
+    mod = await importModuleMemoized(modulePath, session.importCache);
+  } catch {
+    return undefined;
+  }
+  if (!(name in mod) || typeof mod[name] === "function") return undefined;
+  return { value: mod[name] };
+}
+
 // ─────────────────────────────────────────────────────────────────────────
 // Resolution: given the scan + import map, compute the REAL runtime value
 // (Declarable | CompositeInstance) each foldable export would have had if
@@ -1394,6 +1456,14 @@ interface ResolveCtx {
    * innermost factory rather than the enclosing one.
    */
   compositeParams?: CompositeParamRecorder;
+  /**
+   * chant#3247 — set only inside the body of a composite an active lexicon
+   * PACKAGE publishes: that package's directory (see
+   * {@link FactoryModuleScope.packageRoot}). It is also in this context's
+   * {@link lexiconRoots}, which is what trusts the package's relative imports;
+   * this field is what confines a nested factory lookup to the package.
+   */
+  packageRoot?: string;
 }
 
 /** chant #2161 — what {@link stampCompositeOrigins} needs at one `new Type(...)` inside a factory body. */
@@ -1677,7 +1747,10 @@ async function invokeResolvedCallee(
   // A package factory still runs here, which is what `F-Host-Admission`
   // governs. A project-file callee that a `Composite` registered is
   // INTERPRETED at step 4 and never reaches this line; only one that
-  // interpretation declined does, and for that the verdict is `run`.
+  // interpretation declined does, and for that the verdict is `run`. Since
+  // chant#3247 a package's registered composite is interpreted at step 4 too,
+  // and reaches this line only when interpretation declined; it is a
+  // package's code, so it is still invoked.
   // "Project file" is the specifier's ORIGIN, not its syntax.
   // {@link isProjectFileSpecifier} is true of any absolute path, and chant's
   // own modules are imported by absolute path throughout the tests, so the
@@ -1686,7 +1759,7 @@ async function invokeResolvedCallee(
   // means: an active lexicon package or chant-core's own tree is a package's
   // code, and everything else reached by a relative or absolute specifier is
   // the project's.
-  if (!ctx.executing && isProjectFileSpecifier(binding.specifier) && !isTrustedExecutableBinding(binding, ctx)) {
+  if (!ctx.executing && isProjectImport(binding.specifier, ctx.file) && !isTrustedExecutableBinding(binding, ctx)) {
     throw cheapError(
       `"${calleeName}" is imported from "${binding.specifier}", which is a project file; ` +
         "the default mode does not invoke project-owned code (`executing` would run it and fold what it returns)",
@@ -1730,7 +1803,10 @@ async function invokeResolvedCallee(
   }
 
   executionCounts.factoryInvocations += 1;
-  if (isProjectFileSpecifier(binding.specifier)) executionCounts.projectFactoryInvocations += 1;
+  // chant#3247 — a relative import inside a lexicon package's own composite is
+  // the package's code, not the project's.
+  const packageInternal = ctx.packageRoot !== undefined && isUnderDirectory(modulePath, ctx.packageRoot);
+  if (isProjectImport(binding.specifier, ctx.file) && !packageInternal) executionCounts.projectFactoryInvocations += 1;
 
   return (Fn as (...fnArgs: unknown[]) => unknown)(...args);
 }
@@ -1767,11 +1843,12 @@ async function invokeImportedCallee(
  * the resolved argument values — which `fold()`'s envelope already folded
  * and {@link reviveFoldedValue} has already revived by the time this runs.
  *
- * Same two arms, same order, as the top-level path: interpret a project-file
- * registered `Composite` (chant #1023) when its body qualifies, otherwise
- * import and invoke for real — which is the arm every lexicon-package
- * composite (`Checkout`, `SetupNode`, …) always takes, exactly as it does
- * today for a top-level `export const x = Checkout({...})`. An unbound
+ * Same two arms, same order, as the top-level path: interpret a registered
+ * `Composite` (chant #1023; a lexicon package's own since chant#3247) when its
+ * body qualifies, otherwise import and invoke for real — the arm a
+ * lexicon-package composite whose body leaves the subset (`Checkout`,
+ * `SetupNode`, …) takes, exactly as it does for a top-level
+ * `export const x = Checkout({...})`. An unbound
  * callee name throws the same "function call as a value" message `fold()`
  * itself would have, for a caller with no `FoldedCompositeStepCall` special
  * case to fall into.
@@ -1825,6 +1902,7 @@ async function resolveCallArguments(
   const args: unknown[] = [];
   for (const argNode of node.arguments) {
     const live = await resolveLiveValue(argNode, ctx);
+    if (live === undefined) await resolveSameFileCallReferences(argNode, ctx);
     // chant #1039 — a folded (non-live) argument may itself contain a
     // registered intrinsic tagged template; revive it into the real value
     // before the composite factory actually runs on it (see the "Intrinsic
@@ -1838,6 +1916,69 @@ async function resolveCallArguments(
   return args;
 }
 
+/**
+ * chant#3325 — a composite call's props can name a same-file `const` bound to
+ * another call (`left: notes.table`, with `export const notes =
+ * TenantTable({...})` earlier in the file). `fold()` cannot answer that name:
+ * it is synchronous, and the value is a composite instance only the live spine
+ * builds. So before the argument folds, each such name it mentions is resolved
+ * through {@link resolveMemoized}, the same promise the declarator and every
+ * other reference to it share, and the instance goes into `externals`, where
+ * `fold()`'s identifier branch reads it as it reads a pre-built `new` or tag
+ * const (#1169, #3196).
+ *
+ * Only a call `fold()` has no case for qualifies: an imported callee that is
+ * neither a registered authoring helper nor a registered intrinsic. For
+ * anything else the name is left alone and folds exactly as before. A
+ * resolution that fails, or gives anything but a Declarable or a composite
+ * instance, is left alone too, so the reference rejects with the message it
+ * always had. Inside a factory body `locals` is empty, so nothing here applies.
+ */
+async function resolveSameFileCallReferences(node: ts.Node, ctx: ResolveCtx): Promise<void> {
+  const names = new Set<string>();
+  const visit = (n: ts.Node): void => {
+    if (ts.isIdentifier(n)) {
+      if (isUnfoldableSameFileCall(n.text, ctx)) names.add(n.text);
+      return;
+    }
+    if (ts.isFunctionLike(n) || ts.isTypeNode(n)) return;
+    if (ts.isPropertyAccessExpression(n)) return visit(n.expression);
+    if (ts.isPropertyAssignment(n)) {
+      if (ts.isComputedPropertyName(n.name)) visit(n.name);
+      return visit(n.initializer);
+    }
+    ts.forEachChild(n, visit);
+  };
+  visit(node);
+  for (const name of names) {
+    let resolved: LiveResolution;
+    try {
+      resolved = await resolveMemoized(ctx.locals.get(name)!.source, ctx);
+    } catch {
+      continue;
+    }
+    if (resolved && (isDeclarable(resolved.value) || isCompositeInstance(resolved.value))) {
+      ctx.externals.set(name, resolved.value);
+    }
+  }
+}
+
+/** A same-file `const name = Callee(...)` that `fold()` would refuse as a function call used as a value. */
+function isUnfoldableSameFileCall(name: string, ctx: ResolveCtx): boolean {
+  if (ctx.externals.has(name)) return false;
+  const binding = ctx.locals.get(name);
+  if (!binding || binding.propKey !== undefined || ctx.consts.get(name) !== binding.source) return false;
+  const source = binding.source;
+  if (!ts.isCallExpression(source) || !ts.isIdentifier(source.expression)) return false;
+  const callee = source.expression.text;
+  return (
+    ctx.imports.has(callee) &&
+    !isFoldableHelperName(callee) &&
+    !ctx.intrinsics.some((i) => i.name === callee) &&
+    !isFoldableFunction(ctx.externals.get(callee))
+  );
+}
+
 // ─────────────────────────────────────────────────────────────────────────
 // Composite factory interpretation (chant #1023, epic #1019 Phase 5).
 //
@@ -1855,15 +1996,30 @@ async function resolveCallArguments(
 // factory outside the subset costs a parse and nothing else:
 //
 //  1. **The callee is bound by an `import` from a PROJECT FILE** (a
-//     relative/absolute specifier). A lexicon-package composite is
-//     deliberately NOT interpreted, for two independent reasons: an installed
-//     lexicon ships compiled JS, so whether its factory bodies were
-//     interpretable would depend on whether the package happened to ship
-//     `.ts` — fold coverage must not vary with a dependency's build shape —
-//     and a lexicon package is on {@link isTrustedExecutableBinding}'s
-//     allowlist already, so calling it is exactly as safe under `--sandbox` as
-//     the `loadPlugins` import the CLI performed before discovery began. There
-//     is nothing to buy and a build-shape dependency to lose.
+//     relative/absolute specifier, or one a tsconfig `paths` entry maps), **or
+//     from an ACTIVE LEXICON PACKAGE of this build whose module is TypeScript
+//     source** (chant#3247). The package case is matched by text first — the
+//     specifier, or its package root for a subpath, against
+//     {@link FoldSession.lexiconPackages}, exactly as
+//     {@link isTrustedExecutableBinding}'s arm 1 matches it — and only then
+//     resolved; a module that resolves to compiled JavaScript or a declaration
+//     file is not interpreted, so a package that ships only `dist` keeps
+//     invoking. Every chant lexicon routes its exports at `./src/*.ts`
+//     (check-lexicon tier 1), so in practice the source is always there.
+//     Interpreting buys provenance: the run path cannot say which parameter
+//     fed a field, and interpretation can (#2161, #3246).
+//
+//     The trust boundary does not move. A package's composite is interpreted
+//     with that PACKAGE's directory ({@link FactoryModuleScope.packageRoot})
+//     as a trusted lexicon root for the length of its body and nothing else:
+//     the package's own relative imports are trusted under `--sandbox` the way
+//     a subpath of the same package already is, and they are never folded as
+//     project files. The package was imported and run by `loadPlugins` before
+//     discovery began, and every module of it is reachable as a subpath, so
+//     reading its source adds no trust. What it may NOT do is reach outside
+//     that directory: a relative import that leaves the package root is not
+//     followed. A lexicon this build did not load stays as out of scope as
+//     any other bare specifier.
 //  2. **The defining module declares that export as `Composite(<fn>, "<name>")`**
 //     — a top-level `export const <name> = Composite(...)`, where `Composite`
 //     is bound in THAT module to an import of chant's own
@@ -1871,8 +2027,12 @@ async function resolveCallArguments(
 //     asks of an authoring helper, and the same answer). This is #1023's
 //     "recognize the callee is a registered Composite": a bare call to
 //     anything else — a project helper function, a `withDefaults(...)`
-//     wrapper, a re-exported binding — is not recognized and is not
-//     interpreted.
+//     wrapper, an `import`-then-`export` alias — is not recognized and is not
+//     interpreted. The defining module may sit behind BARREL re-exports
+//     (chant#3247): `export { X } from "./x"`, `export { Y as X } from "./x"`
+//     and `export * from "./x"` are followed, relative specifiers only, at most
+//     {@link MAX_REEXPORT_HOPS} deep, and never out of a package's root. A
+//     module that declares the name itself is answered by that declaration.
 //  3. **`<fn>` is an arrow/function expression taking at most one parameter**,
 //     bound as a plain identifier or a simple object binding pattern (no
 //     default, rest, or nested pattern).
@@ -1986,6 +2146,15 @@ class InterpretationDepthError extends FoldError {}
 interface FactoryModuleScope {
   file: string;
   sourceFile: ts.SourceFile;
+  /**
+   * chant#3247 — the directory of the active lexicon PACKAGE this module was
+   * reached in, when it was reached through one (see rule 1 of the contract).
+   * Interpreting a factory from it trusts that directory as a lexicon root —
+   * its files are not folded as project files and are on the `--sandbox`
+   * allowlist — and confines every further hop to it. `undefined` for a
+   * project file, whose imports are decided exactly as before.
+   */
+  packageRoot?: string;
   /**
    * The module's top-level `const`s, MINUS every one that resolves to a
    * `new Type(...)` resource.
@@ -2046,15 +2215,25 @@ interface InterpretableFactory {
  * module's own imports are not resolved yet — see
  * {@link FactoryModuleScope.resolved}.
  */
-function readFactoryModule(modulePath: string, session: FoldSession): Promise<FactoryModuleScope | undefined> {
-  const cached = session.factoryModules.get(modulePath);
+function readFactoryModule(
+  modulePath: string,
+  packageRoot: string | undefined,
+  session: FoldSession,
+): Promise<FactoryModuleScope | undefined> {
+  // chant#3247 — keyed by the package root as well: the same file read as a
+  // project file and as package code resolves its imports differently.
+  const key = packageRoot === undefined ? modulePath : `${packageRoot}\0${modulePath}`;
+  const cached = session.factoryModules.get(key);
   if (cached) return cached;
-  const promise = readFactoryModuleCore(modulePath);
-  session.factoryModules.set(modulePath, promise);
+  const promise = readFactoryModuleCore(modulePath, packageRoot);
+  session.factoryModules.set(key, promise);
   return promise;
 }
 
-async function readFactoryModuleCore(modulePath: string): Promise<FactoryModuleScope | undefined> {
+async function readFactoryModuleCore(
+  modulePath: string,
+  packageRoot: string | undefined,
+): Promise<FactoryModuleScope | undefined> {
   let sourceFile: ts.SourceFile;
   try {
     const source = await readFile(modulePath, "utf-8");
@@ -2074,6 +2253,7 @@ async function readFactoryModuleCore(modulePath: string): Promise<FactoryModuleS
   return {
     file: modulePath,
     sourceFile,
+    packageRoot,
     consts,
     imports: collected.named,
     namespaceImports: collected.namespaces,
@@ -2097,7 +2277,8 @@ function factoryModuleScopeResolved(
     return Promise.resolve({ externals: new Map(), failures: new Map() });
   }
   session.stack.push(scope.file);
-  scope.resolved = buildExternals(scope.file, scope.imports, scope.namespaceImports, session).finally(() => {
+  const roots = scope.packageRoot === undefined ? [] : [scope.packageRoot];
+  scope.resolved = buildExternals(scope.file, scope.imports, scope.namespaceImports, session, roots).finally(() => {
     const idx = session.stack.lastIndexOf(scope.file);
     if (idx !== -1) session.stack.splice(idx, 1);
   });
@@ -2141,7 +2322,7 @@ function findCompositeDefinition(
       // lexicon exports a `Composite`, so nothing about a chant project moves.
       const chantOwned = isChantOwnedHelperBinding(compositeBinding, { ...ctx, file: scope.file });
       const hostOwned =
-        activeLexiconPackage(compositeBinding.specifier, ctx.lexiconPackages) !== undefined ||
+        activeLexiconPackageImport(compositeBinding.specifier, scope.file, ctx.lexiconPackages) !== undefined ||
         activeLexiconModule(compositeBinding.specifier, scope.file, ctx.lexiconModules, ctx.resolvePathCache) !==
           undefined;
       if (!chantOwned && !hostOwned) return undefined;
@@ -2158,6 +2339,218 @@ function findCompositeDefinition(
   return undefined;
 }
 
+/**
+ * chant#3247 — how many barrel re-exports {@link findFactoryDefinition}
+ * follows from the imported module to the one that defines the composite. A
+ * lexicon's barrel reaches its composites in two (`src/index.ts` ->
+ * `src/composites/index.ts` -> the file), a dialect subpath in three; past
+ * this the lookup declines, and the composite is invoked as before.
+ */
+const MAX_REEXPORT_HOPS = 8;
+
+/** Where an import of a composite factory leads: the module, and the lexicon package it lies in, if any. */
+interface FactoryOrigin {
+  modulePath: string;
+  /** See {@link FactoryModuleScope.packageRoot}. */
+  packageRoot?: string;
+}
+
+/** A TypeScript source file, not compiled JavaScript and not a declaration file. */
+function isTypeScriptSource(path: string): boolean {
+  return /\.[cm]?tsx?$/.test(path) && !/\.d\.[cm]?ts$/.test(path);
+}
+
+/** Process-wide memo for {@link lexiconPackageDirectory}, keyed by package name and directory. */
+const lexiconPackageDirectoryCache = new Map<string, string | undefined>();
+
+/**
+ * chant#3247 — the directory of package `packageName` that holds the resolved
+ * `modulePath`: the nearest ancestor whose `package.json` names that package.
+ * `undefined` when none does before a `node_modules` directory or the
+ * filesystem root, which declines interpretation. Reads `package.json` files
+ * only; nothing is resolved or imported.
+ */
+function lexiconPackageDirectory(modulePath: string, packageName: string): string | undefined {
+  const start = dirname(modulePath);
+  const key = `${packageName}\0${start}`;
+  if (lexiconPackageDirectoryCache.has(key)) return lexiconPackageDirectoryCache.get(key);
+  let found: string | undefined;
+  for (let dir = start; basename(dir) !== "node_modules"; ) {
+    const pkgJson = join(dir, "package.json");
+    if (existsSync(pkgJson)) {
+      try {
+        if ((JSON.parse(readFileSync(pkgJson, "utf-8")) as { name?: unknown }).name === packageName) {
+          found = dir;
+          break;
+        }
+      } catch {
+        // An unreadable package.json is not the package's; keep walking.
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  lexiconPackageDirectoryCache.set(key, found);
+  return found;
+}
+
+/**
+ * Rule 1 of the contract: where an import of a composite leads, or `undefined`
+ * when the import is not one interpretation follows. No module is imported.
+ *
+ *  - A project import (relative, absolute, or `paths`-mapped) resolves to its
+ *    file. Inside a package composite's body ({@link ResolveCtx.packageRoot})
+ *    it must stay inside that package.
+ *  - A bare specifier naming an active lexicon package, root or subpath, by
+ *    text, resolves through `node_modules` to a TypeScript source file inside
+ *    that package.
+ *  - Anything else is not followed.
+ */
+function factoryOrigin(specifier: string, fromFile: string, ctx: ResolveCtx): FactoryOrigin | undefined {
+  if (isProjectImport(specifier, fromFile)) {
+    let modulePath: string;
+    try {
+      modulePath = resolveModulePathMemoized(specifier, fromFile, ctx.resolvePathCache);
+    } catch {
+      return undefined;
+    }
+    if (ctx.packageRoot === undefined) return { modulePath };
+    return isUnderDirectory(modulePath, ctx.packageRoot) ? { modulePath, packageRoot: ctx.packageRoot } : undefined;
+  }
+  // Text first, as {@link isTrustedExecutableBinding}'s arm 1 does: no bare
+  // specifier outside the build's own lexicons is ever resolved here.
+  const packageName =
+    activeLexiconPackage(specifier, ctx.lexiconPackages) ??
+    activeLexiconPackage(bareSpecifierPackageRoot(specifier) ?? "", ctx.lexiconPackages);
+  if (packageName === undefined) return undefined;
+  let modulePath: string;
+  try {
+    modulePath = resolveModulePathMemoized(specifier, fromFile, ctx.resolvePathCache);
+  } catch {
+    return undefined;
+  }
+  if (!isTypeScriptSource(modulePath)) return undefined;
+  const packageRoot = lexiconPackageDirectory(modulePath, packageName);
+  return packageRoot === undefined ? undefined : { modulePath, packageRoot };
+}
+
+/** One re-export {@link reExportsOf} found: where it leads, under which name, and whether it is an `export *`. */
+interface ReExport {
+  specifier: string;
+  imported: string;
+  star: boolean;
+}
+
+/**
+ * chant#3247 — the re-exports of `exportName` that `sourceFile` forwards, in the order they are worth
+ * trying. Empty when the module declares the name itself (its own
+ * declaration is the answer, interpretable or not) or forwards it from nowhere
+ * this follows. An explicit `export { ... } from` wins over `export *`, as it
+ * does in the language; a type-only re-export, an `export * as ns`, and a bare
+ * `export { X }` of an imported binding are not followed.
+ */
+function reExportsOf(sourceFile: ts.SourceFile, exportName: string): ReExport[] {
+  const stars: ReExport[] = [];
+  for (const statement of sourceFile.statements) {
+    if (ts.isExportDeclaration(statement)) {
+      if (statement.isTypeOnly) continue;
+      const spec =
+        statement.moduleSpecifier && ts.isStringLiteral(statement.moduleSpecifier)
+          ? statement.moduleSpecifier.text
+          : undefined;
+      const clause = statement.exportClause;
+      if (clause === undefined) {
+        if (spec !== undefined) stars.push({ specifier: spec, imported: exportName, star: true });
+        continue;
+      }
+      if (!ts.isNamedExports(clause)) {
+        if (clause.name.text === exportName) return [];
+        continue;
+      }
+      for (const el of clause.elements) {
+        if (el.name.text !== exportName) continue;
+        if (spec === undefined || el.isTypeOnly) return [];
+        return [{ specifier: spec, imported: (el.propertyName ?? el.name).text, star: false }];
+      }
+      continue;
+    }
+    if (!hasExportModifier(statement as { modifiers?: ts.NodeArray<ts.ModifierLike> })) continue;
+    if (ts.isVariableStatement(statement)) {
+      for (const decl of statement.declarationList.declarations) {
+        if (ts.isIdentifier(decl.name) && decl.name.text === exportName) return [];
+      }
+    } else if (
+      (ts.isFunctionDeclaration(statement) || ts.isClassDeclaration(statement) || ts.isEnumDeclaration(statement)) &&
+      statement.name?.text === exportName
+    ) {
+      return [];
+    }
+  }
+  return stars;
+}
+
+/** A text pre-check for an `export *` target: false only when the file cannot export `name`. */
+async function mayProvideExport(file: string, name: string): Promise<boolean> {
+  try {
+    const text = await readFile(file, "utf-8");
+    return text.includes(name) || /export\s*\*\s*from/.test(text);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Rule 2, through barrels: find `exportName`'s `Composite(...)` declaration
+ * starting at `origin` and following {@link reExportsOf} — relative
+ * specifiers only, confined to `origin.packageRoot` when there is one, cycle
+ * safe, and at most {@link MAX_REEXPORT_HOPS} deep. Reads and parses; imports
+ * nothing.
+ */
+async function findFactoryDefinition(
+  origin: FactoryOrigin,
+  exportName: string,
+  ctx: ResolveCtx,
+  seen: Set<string> = new Set(),
+  hops = 0,
+): Promise<
+  | { scope: FactoryModuleScope; definition: NonNullable<ReturnType<typeof findCompositeDefinition>> }
+  | undefined
+> {
+  seen.add(origin.modulePath);
+  const scope = await readFactoryModule(origin.modulePath, origin.packageRoot, ctx.session);
+  if (!scope) return undefined;
+  const definition = findCompositeDefinition(scope, exportName, ctx);
+  if (definition) return { scope, definition };
+  if (hops >= MAX_REEXPORT_HOPS) return undefined;
+
+  for (const { specifier, imported, star } of reExportsOf(scope.sourceFile, exportName)) {
+    if (!isProjectFileSpecifier(specifier)) continue;
+    let target: string;
+    try {
+      target = resolveModulePathMemoized(specifier, scope.file, ctx.resolvePathCache);
+    } catch {
+      continue;
+    }
+    if (seen.has(target) || !isTypeScriptSource(target)) continue;
+    if (origin.packageRoot !== undefined && !isUnderDirectory(target, origin.packageRoot)) continue;
+    // An `export *` target that neither names the export nor forwards a star
+    // of its own cannot provide it, so it is not parsed. That keeps a
+    // lexicon's generated barrel (megabytes, behind `export *` in most
+    // lexicons) from being parsed for every call through the package root.
+    if (star && !(await mayProvideExport(target, imported))) continue;
+    const found = await findFactoryDefinition(
+      { modulePath: target, packageRoot: origin.packageRoot },
+      imported,
+      ctx,
+      seen,
+      hops + 1,
+    );
+    if (found) return found;
+  }
+  return undefined;
+}
+
 /**
  * Decide whether `binding`'s callee is an interpretable composite — rules 1-5
  * of the contract above, in that order, with no evaluation and no import.
@@ -2167,9 +2560,10 @@ async function resolveInterpretableFactory(
   binding: ImportBinding,
   ctx: ResolveCtx,
 ): Promise<InterpretableFactory | undefined> {
-  // Rule 1 — project files only. A text check; no resolution performed for a
-  // bare specifier, so this costs nothing for the (common) lexicon case.
-  if (!isProjectFileSpecifier(binding.specifier)) return undefined;
+  // Rule 1 — a project file, or an active lexicon package's TypeScript source.
+  // A bare specifier outside the build's lexicons is refused on its text.
+  const origin = factoryOrigin(binding.specifier, ctx.file, ctx);
+  if (!origin) return undefined;
   // Not `undefined`: that answer means "not interpretable" and would invoke
   // the factory while still reporting the file folded. Giving up is a
   // different fact and falls the file back to run, naming the bound (#2370).
@@ -2183,19 +2577,10 @@ async function resolveInterpretableFactory(
     );
   }
 
-  let modulePath: string;
-  try {
-    modulePath = resolveModulePathMemoized(binding.specifier, ctx.file, ctx.resolvePathCache);
-  } catch {
-    return undefined;
-  }
-
-  const scope = await readFactoryModule(modulePath, ctx.session);
-  if (!scope) return undefined;
-
-  // Rule 2.
-  const definition = findCompositeDefinition(scope, binding.imported, ctx);
-  if (!definition) return undefined;
+  // Rule 2, following barrel re-exports to the defining module.
+  const found = await findFactoryDefinition(origin, binding.imported, ctx);
+  if (!found) return undefined;
+  const { scope, definition } = found;
 
   // Rules 3-5.
   if (findFactorySubsetViolation(definition.fn) !== undefined) return undefined;
@@ -2471,6 +2856,27 @@ function stampCompositeOrigins(entity: unknown, node: ts.NewExpression, ctx: Res
   for (const [path, origin] of Object.entries(origins)) setPathProvenance(entity, path, origin);
 }
 
+/**
+ * chant #3212 — the same record for an entity a registered tag built inside an
+ * interpreted factory body (`` table`CREATE TABLE ${props.name} ...` ``).
+ *
+ * A tag's props come from parsing its text, so no object literal says which
+ * field each `${...}` landed in. The tag says so itself through
+ * `setInterpolationFields`; a tag that does not leaves the entity's fields
+ * `unknown`, as before.
+ */
+function stampTagOrigins(entity: unknown, node: ts.TaggedTemplateExpression, ctx: ResolveCtx): void {
+  const recorder = ctx.compositeParams;
+  if (!recorder || !isDeclarable(entity) || !isResourceDeclarable(entity)) return;
+  const fields = getInterpolationFields(entity);
+  if (!fields) return;
+  const interpolations = ts.isTemplateExpression(node.template)
+    ? node.template.templateSpans.map((span) => span.expression)
+    : [];
+  const origins = collectTagOrigins(interpolations, fields, entity.props, recorder.consts, recorder.scope, recorder.composite);
+  for (const [path, origin] of Object.entries(origins)) setPathProvenance(entity, path, origin);
+}
+
 /**
  * Interpret an admissible factory's body against `args`, and assemble the
  * result through chant's own {@link Composite}.
@@ -2516,7 +2922,10 @@ async function interpretCompositeFactory(
     resolvePathCache: ctx.resolvePathCache,
     lexiconPackages: ctx.lexiconPackages,
     lexiconModules: ctx.lexiconModules,
-    lexiconRoots: ctx.lexiconRoots,
+    // chant#3247 — a package's composite trusts its own package directory for
+    // the length of its body, and nothing outside it.
+    lexiconRoots: scope.packageRoot === undefined ? ctx.lexiconRoots : [...ctx.lexiconRoots, scope.packageRoot],
+    packageRoot: scope.packageRoot,
     sandbox: ctx.sandbox,
     executing: ctx.executing,
     session: ctx.session,
@@ -2635,6 +3044,12 @@ async function interpretExpression(node: ts.Expression, ctx: ResolveCtx): Promis
 
   if (ts.isNewExpression(node)) return interpretNewExpression(node, ctx);
 
+  if (ts.isTaggedTemplateExpression(node)) {
+    const value = (await resolveDeclaratorValue(node, ctx)).value;
+    stampTagOrigins(value, node, ctx);
+    return value;
+  }
+
   if (ts.isObjectLiteralExpression(node)) {
     const obj: Record<string, unknown> = {};
     for (const prop of node.properties) {
@@ -2862,6 +3277,16 @@ async function resolveSymbolicValue(text: string, ctx: ResolveCtx): Promise<unkn
   return value;
 }
 
+/**
+ * True when {@link reviveFoldedValue} hands `value` back unchanged: a
+ * primitive, or one of the live object kinds its passthrough keeps (an
+ * `AttrRef`, a Declarable, a composite instance, an `Intrinsic`).
+ */
+function revivesAsItself(value: unknown): boolean {
+  if (value === null || typeof value !== "object") return true;
+  return isAttrRefLike(value) || isDeclarable(value) || isCompositeInstance(value) || isIntrinsic(value);
+}
+
 /**
  * Revive a folded value tree: replace any
  * `{__intrinsic}`/`{__helper}`/`{__symbol}` envelope with the real value it
@@ -2904,9 +3329,7 @@ async function reviveFoldedValue(value: FoldedValue, ctx: ResolveCtx, requireLiv
   // `Symbol.for("chant.intrinsic")` (../intrinsic.ts), a GLOBAL symbol, so it
   // holds across separately-loaded copies of chant-core the way a bare
   // `instanceof` would not.
-  if (isAttrRefLike(value) || isDeclarable(value) || isCompositeInstance(value) || isIntrinsic(value)) {
-    return value;
-  }
+  if (revivesAsItself(value)) return value;
 
   if (Array.isArray(value)) {
     const revived: unknown[] = [];
@@ -2939,7 +3362,14 @@ async function reviveFoldedValue(value: FoldedValue, ctx: ResolveCtx, requireLiv
       return (Fn as (...fnArgs: unknown[]) => unknown)(...revived);
     }
     for (const v of intrinsic.values) revived.push(await reviveFoldedValue(v, ctx, true));
-    return (Fn as (...fnArgs: unknown[]) => unknown)(intrinsic.strings, ...revived);
+    // chant #3196 — hand the tag what a real tagged call hands it: a frozen
+    // strings array carrying a frozen, non-enumerable `raw`. A tag that reads
+    // `strings.raw` (a SQL tag keeps backslashes as written) would otherwise
+    // build different text folded than run.
+    const strings = Object.freeze(
+      Object.defineProperty([...intrinsic.strings], "raw", { value: Object.freeze([...intrinsic.raw]) }),
+    );
+    return (Fn as (...fnArgs: unknown[]) => unknown)(strings, ...revived);
   }
 
   if ("__helper" in value) {
@@ -3067,7 +3497,7 @@ async function reviveHelperCall(call: FoldedHelperCall, ctx: ResolveCtx): Promis
  */
 function isChantOwnedHelperBinding(binding: ImportBinding, ctx: ResolveCtx): boolean {
   if (isChantOwnedSpecifier(binding.specifier)) return true;
-  if (!isProjectFileSpecifier(binding.specifier)) return false;
+  if (!isProjectImport(binding.specifier, ctx.file)) return false;
   let targetPath: string;
   try {
     targetPath = resolveModulePathMemoized(binding.specifier, ctx.file, ctx.resolvePathCache);
@@ -3123,17 +3553,25 @@ function isChantOwnedHelperBinding(binding: ImportBinding, ctx: ResolveCtx): boo
  * {@link FoldSession.lexiconPackages} takes for #1063.
  */
 function isTrustedExecutableBinding(binding: ImportBinding, ctx: ResolveCtx): boolean {
-  if (activeLexiconPackage(binding.specifier, ctx.lexiconPackages) !== undefined) return true;
+  // chant#3090 — a specifier a tsconfig `paths` entry maps names a project
+  // file whatever its text says, so neither text arm applies to it: it is
+  // resolved and decided on the path below, like a relative specifier.
+  const pathsMapped = pathsMappedTarget(binding.specifier, ctx.file) !== undefined;
+  if (!pathsMapped && activeLexiconPackage(binding.specifier, ctx.lexiconPackages) !== undefined) return true;
   // chant #1995 — arm 1's subpath case: same allowlist, matched against the
   // specifier's package ROOT (text only, see bareSpecifierPackageRoot) rather
   // than the specifier itself, so `<activeLexiconPkg>/generated/index` is
   // trusted exactly like the bare package import already is.
   const subpathRoot = bareSpecifierPackageRoot(binding.specifier);
-  if (subpathRoot !== undefined && activeLexiconPackage(subpathRoot, ctx.lexiconPackages) !== undefined) return true;
+  if (!pathsMapped && subpathRoot !== undefined && activeLexiconPackage(subpathRoot, ctx.lexiconPackages) !== undefined) {
+    return true;
+  }
   // Only a chant-shaped or project-relative specifier is worth resolving; any
   // other bare specifier is untrusted by definition, and resolving it to find
   // that out would cost the pathological cold `require.resolve` (chant#1020).
-  if (!isProjectFileSpecifier(binding.specifier) && !isChantOwnedSpecifier(binding.specifier)) return false;
+  if (!pathsMapped && !isProjectFileSpecifier(binding.specifier) && !isChantOwnedSpecifier(binding.specifier)) {
+    return false;
+  }
   let targetPath: string;
   try {
     targetPath = resolveModulePathMemoized(binding.specifier, ctx.file, ctx.resolvePathCache);
@@ -3415,6 +3853,28 @@ function stampParamDependencies(entity: unknown, node: ts.NewExpression, ctx: Re
 async function preresolveResourceConsts(ctx: ResolveCtx): Promise<Map<ts.Expression, unknown>> {
   const built = new Map<ts.Expression, unknown>();
   for (const [name, initializer] of ctx.consts) {
+    // chant #3196 — a same-file `const x = tag\`...\`` for a registered tag
+    // is built once here too, so the export and every reference to `x` share
+    // the one value running the module gives them. That matters when the tag
+    // returns an entity (a SQL `table\`...\``): a second call would build a
+    // second entity discovery never registers.
+    if (
+      ts.isTaggedTemplateExpression(initializer) &&
+      ts.isIdentifier(initializer.tag) &&
+      ctx.intrinsics.some((i) => i.name === (initializer.tag as ts.Identifier).text && intrinsicTagFolds(i))
+    ) {
+      try {
+        const value = await reviveFoldedValue(fold(initializer, ctx.consts, ctx.intrinsics, ctx.externals), ctx, false);
+        built.set(initializer, value);
+        // Only a value `reviveFoldedValue` passes through unchanged is safe to
+        // hand a reference. Any other object would be walked into a plain
+        // copy, so a reference to one keeps re-folding the initializer.
+        if (revivesAsItself(value)) ctx.externals.set(name, value);
+      } catch (err) {
+        ctx.prebuildFailures?.set(name, describeFoldFailure(err, ctx));
+      }
+      continue;
+    }
     if (!ts.isNewExpression(initializer) || !ts.isIdentifier(initializer.expression)) continue;
     try {
       const spec = foldResource(initializer, ctx.consts, ctx.intrinsics, ctx.externals);
@@ -3593,6 +4053,15 @@ function isProjectFileSpecifier(specifier: string): boolean {
   return specifier.startsWith(".") || isAbsolute(specifier);
 }
 
+/**
+ * chant#3090 — {@link isProjectFileSpecifier} for an import in `fromFile`,
+ * counting a bare specifier that a tsconfig `paths` entry maps to a file
+ * ({@link pathsMappedTarget}) as the project file it names.
+ */
+function isProjectImport(specifier: string, fromFile: string): boolean {
+  return isProjectFileSpecifier(specifier) || pathsMappedTarget(specifier, fromFile) !== undefined;
+}
+
 /**
  * Eagerly resolve every project-file import binding of `file`'s to its real
  * cross-file value (see this section's own doc above). A binding that isn't
@@ -3609,7 +4078,16 @@ async function buildExternals(
   imports: Map<string, ImportBinding>,
   namespaceImports: Map<string, NamespaceImportBinding>,
   session: FoldSession,
+  /**
+   * chant#3247 — trusted lexicon directories beyond the session's own
+   * {@link FoldSession.lexiconRoots}: the package root of a lexicon-package
+   * composite whose defining module this is. Files under one are treated as
+   * a path lexicon's are, never folded as project files.
+   */
+  extraLexiconRoots: readonly string[] = [],
 ): Promise<{ externals: Map<string, unknown>; failures: Map<string, string>; liveSources: Set<string> }> {
+  const lexiconRoots =
+    extraLexiconRoots.length === 0 ? session.lexiconRoots : [...session.lexiconRoots, ...extraLexiconRoots];
   const externals = new Map<string, unknown>();
   const failures = new Map<string, string>();
   // chant #1044 — see `FoldFileResult.liveSources`.
@@ -3652,7 +4130,7 @@ async function buildExternals(
         externals.set(localName, session.buildParams);
         continue;
       }
-      if (isProjectFileSpecifier(binding.specifier)) {
+      if (isProjectImport(binding.specifier, file)) {
         try {
           const targetPath = resolveModulePathMemoized(binding.specifier, file, session.resolvePathCache);
           if (targetPath === paramsModulePath()) {
@@ -3666,7 +4144,7 @@ async function buildExternals(
       }
     }
 
-    if (!isProjectFileSpecifier(binding.specifier)) {
+    if (!isProjectImport(binding.specifier, file)) {
       // chant #1063 — a bare specifier naming one of THIS BUILD's active
       // lexicon packages resolves to that package's real export, so a plain
       // data export a lexicon publishes (`Azure`/`GCP`'s pseudo-parameter
@@ -3697,6 +4175,20 @@ async function buildExternals(
       // it resolves lazily, through the pre-existing `importModule`
       // mechanism, only once a constructor/composite-factory/intrinsic tag
       // actually consumes it.
+      //
+      // chant#3090 — except that a tsconfig `paths` entry which matches the
+      // specifier but names no file is recorded, so the reason says which
+      // import failed and why.
+      const unmatched = pathsMatch(binding.specifier, file);
+      if (unmatched) {
+        failures.set(
+          localName,
+          locatedMessage(
+            binding.specifierNode,
+            `tsconfig paths entry "${unmatched.key}" matches "${binding.specifier}" but names no file`,
+          ),
+        );
+      }
       continue;
     }
     let targetPath: string;
@@ -3718,7 +4210,20 @@ async function buildExternals(
     // subpath (see the bare-specifier branch above) its data exports are not
     // read as values. A constructor or composite from it resolves through the
     // import path, where `isTrustedExecutableBinding` admits it.
-    if (inPathLexiconRoot(targetPath, session.lexiconRoots)) continue;
+    //
+    // chant#3247 — a file of the lexicon PACKAGE whose composite is being
+    // interpreted is that package's own module, which `loadPlugins` already
+    // imported through the package's barrel. Its plain data exports (an
+    // action table, a policy constant) are read off the real module, so the
+    // value is the run path's own object, identity included. Callables stay
+    // out, as {@link resolveActiveLexiconExport} keeps them out: a
+    // constructor or composite resolves through the import path.
+    if (inPathLexiconRoot(targetPath, extraLexiconRoots)) {
+      const value = await packageDataExport(targetPath, binding.imported, session);
+      if (value) externals.set(localName, value.value);
+      continue;
+    }
+    if (inPathLexiconRoot(targetPath, lexiconRoots)) continue;
     const result = await foldFileMemoized(targetPath, session);
     if (!result.ok) {
       failures.set(localName, locatedMessage(binding.specifierNode, result.reason));
@@ -3737,7 +4242,7 @@ async function buildExternals(
   }
 
   for (const [localName, binding] of namespaceImports) {
-    if (!isProjectFileSpecifier(binding.specifier)) continue;
+    if (!isProjectImport(binding.specifier, file)) continue;
     let targetPath: string;
     try {
       targetPath = resolveModulePathMemoized(binding.specifier, file, session.resolvePathCache);
@@ -3746,7 +4251,7 @@ async function buildExternals(
     }
     // chant#2577 — a namespace import of a lexicon is left alone, as the
     // bare-specifier check above leaves a package's alone.
-    if (session.lexiconModules.has(targetPath) || inPathLexiconRoot(targetPath, session.lexiconRoots)) continue;
+    if (session.lexiconModules.has(targetPath) || inPathLexiconRoot(targetPath, lexiconRoots)) continue;
     const result = await foldFileMemoized(targetPath, session);
     if (!result.ok) {
       failures.set(localName, locatedMessage(binding.specifierNode, result.reason));
@@ -3799,7 +4304,9 @@ function hasObjectIdentity(value: unknown): boolean {
  * back to run, exactly as before #1020.
  */
 async function resolveDeclaratorValue(node: ts.Expression, ctx: ResolveCtx): Promise<{ value: unknown }> {
-  const live = await resolveLiveValue(node, ctx);
+  // chant#3325 — memoized, so an exported `const x = Composite(...)` and a
+  // reference to `x` elsewhere in the file hold the one instance.
+  const live = await resolveMemoized(node, ctx);
   if (live !== undefined) return live;
   const folded = fold(node, ctx.consts, ctx.intrinsics, ctx.externals);
   return { value: await reviveFoldedValue(folded, ctx, false) };
@@ -3915,6 +4422,11 @@ async function tryFoldFileCore(file: string, session: FoldSession): Promise<Fold
           applyResolvedValue(decl.name, marker, entities, exportedValues);
           continue;
         }
+        // chant #3196 — a registered tagged template the pre-pass built.
+        if (prebuiltResources.has(decl.node)) {
+          applyResolvedValue(decl.name, prebuiltResources.get(decl.node), entities, exportedValues);
+          continue;
+        }
         let value: unknown;
         try {
           value = (await resolveDeclaratorValue(decl.node, ctx)).value;
@@ -4137,7 +4649,7 @@ export async function buildProjectImportEdges(files: readonly string[]): Promise
   for (const file of files) {
     const targets = new Set<string>();
     const addTarget = (specifier: string): void => {
-      if (!isProjectFileSpecifier(specifier)) return; // package import, not a sibling source file
+      if (!isProjectImport(specifier, file)) return; // package import, not a sibling source file
       let resolved: string;
       try {
         resolved = resolveModulePath(specifier, file);