@intentius/chant 0.109.0 → 0.111.0

package/src/discovery/fold-project-provenance.test.ts

@@ -530,3 +530,55 @@ describe("a member destructured from a called chant composite is unknown (chant#
     expectAllUnknown(built.foldProvenance, ["namespace", "resourceQuota", "sharedNamespace", "sharedResourceQuota"]);
   });
 });
+
+describe("a value host code produced is unknown, never direct (typescript-as-data#248)", () => {
+  let testDir: string;
+  let srcDir: string;
+  let file: string;
+
+  beforeAll(async () => {
+    const dir = join(repoRoot, ".cache", `chant-tsad-248-${process.pid}`);
+    await rm(dir, { recursive: true, force: true });
+    await mkdir(join(dir, "src"), { recursive: true });
+    testDir = await realpath(dir);
+    srcDir = join(testDir, "src");
+    file = join(srcDir, "main.ts");
+    await writeFile(
+      file,
+      `
+  import { Bucket, AWS } from ${JSON.stringify(LEXICON)};
+  const upper = "logs".toUpperCase();
+  export const bucket = new Bucket({
+    BucketName: "x".toUpperCase(),
+    Tags: [{ Key: "n", Value: [1, 2].join("-") }],
+    ObjectLockEnabled: true,
+  });
+  export const logs = new Bucket({ BucketName: upper, AccelerateConfiguration: { AccelerationStatus: AWS.Region } });
+`,
+    );
+  });
+
+  afterAll(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  test("a host call and a host value report unknown with the reference's reasons, as build() does", async () => {
+    const verdict = (await foldProject([file], [], { lexicons: [LEXICON_NAME] })).get(file)!;
+    expect(verdict.verdict).toBe("fold");
+    const fromFold = verdict.foldProvenance!;
+    expect(fromFold.bucket.fields).toEqual({
+      BucketName: { kind: "unknown", reason: "host-call" },
+      ObjectLockEnabled: { kind: "direct" },
+      Tags: { kind: "unknown", reason: "host-call" },
+    });
+    expect(fromFold.logs.fields).toEqual({
+      "AccelerateConfiguration.AccelerationStatus": { kind: "unknown", reason: "host-value" },
+      BucketName: { kind: "unknown", reason: "host-call" },
+    });
+
+    const built = await build(srcDir, [namesSerializer], undefined, { fold: true, lexicons: [LEXICON_NAME] });
+    expect(built.errors).toEqual([]);
+    expect(built.foldProvenance.bucket).toEqual(fromFold.bucket);
+    expect(built.foldProvenance.logs).toEqual(fromFold.logs);
+  });
+});

package/src/discovery/param-deps.test.ts

@@ -7,6 +7,7 @@ import {
   collectParamDependencies,
   collectTagOrigins,
   type CompositeCallSite,
+  type HostBindings,
 } from "./param-deps";
 import type { PathOrigin } from "../provenance";
 
@@ -14,7 +15,7 @@ import type { PathOrigin } from "../provenance";
  * Collect dependencies for the props of the file's single
  * `export const x = new Type({...})`, which is the shape every case here uses.
  */
-function depsOf(source: string, paramLocals = ["params"]): Record<string, PathOrigin> {
+function depsOf(source: string, paramLocals = ["params"], host?: HostBindings): Record<string, PathOrigin> {
   const file = ts.createSourceFile("fixture.ts", source, ts.ScriptTarget.Latest, true);
   const consts = collectConsts(file);
   let props: ts.ObjectLiteralExpression | undefined;
@@ -32,7 +33,7 @@ function depsOf(source: string, paramLocals = ["params"]): Record<string, PathOr
     }
   }
   if (!props) throw new Error("fixture has no `const x = new Type({...})`");
-  return collectParamDependencies(props, consts, new Set(paramLocals));
+  return collectParamDependencies(props, consts, new Set(paramLocals), host);
 }
 
 const param = (...names: string[]): PathOrigin => ({ kind: "build-param", params: names });
@@ -411,3 +412,43 @@ describe("argumentLocation (#3597)", () => {
     });
   });
 });
+
+describe("collectParamDependencies with host bindings (typescript-as-data#248)", () => {
+  const host: HostBindings = { values: new Set(["AWS"]), eagerCalls: new Set(["matrix"]) };
+  const hostCall: PathOrigin = { kind: "host", reason: "host-call" };
+  const hostValue: PathOrigin = { kind: "host", reason: "host-value" };
+
+  test("a method call on a receiver is a host call, at its own path", () => {
+    const source = `export const x = new Thing({ name: "x".toUpperCase(), spec: { tag: [1, 2].join("-") }, fixed: "k" });`;
+    expect(depsOf(source, [], host)).toEqual({ name: hostCall, "spec.tag": hostCall });
+  });
+
+  test("an eager lexicon helper is a host call, and a project function is not", () => {
+    const source = `export const x = new Thing({ a: matrix("os"), b: helper("os") });`;
+    expect(depsOf(source, [], host)).toEqual({ a: hostCall });
+  });
+
+  test("a lexicon export is a host value, through a const and an operator", () => {
+    const source = [`const region = AWS.Region;`, "export const x = new Thing({ a: `${region}-x`, b: AWS });"].join("\n");
+    expect(depsOf(source, [], host)).toEqual({ a: hostValue, b: hostValue });
+  });
+
+  test("a host read outranks a build parameter the same expression reads", () => {
+    const source = `export const x = new Thing({ name: params.name.toUpperCase(), size: params.size });`;
+    expect(depsOf(source, ["params"], host)).toEqual({ name: hostCall, size: param("size") });
+  });
+
+  test("a sibling resource, a member name and a property key are not host reads", () => {
+    const source = [
+      `const logs = new Bucket({ name: "x".toUpperCase() });`,
+      `const AWS2 = 1;`,
+      `export const x = new Thing({ a: logs.Arn, b: { AWS: 1 }, c: thing.AWS });`,
+    ].join("\n");
+    expect(depsOf(source, [], host)).toEqual({});
+  });
+
+  test("a tag is not read, its interpolations are", () => {
+    const source = "export const x = new Thing({ a: Sub`${AWS.Region}`, b: Sub`plain` });";
+    expect(depsOf(source, [], { values: new Set(["AWS", "Sub"]), eagerCalls: new Set() })).toEqual({ a: hostValue });
+  });
+});

package/src/discovery/param-deps.ts

@@ -1,5 +1,5 @@
 import * as ts from "typescript";
-import type { ArgumentLocation, PathOrigin, SourceLocation } from "../provenance";
+import type { ArgumentLocation, HostOriginReason, PathOrigin, SourceLocation } from "../provenance";
 
 /**
  * Which build parameters an authored props expression READS, per path (chant
@@ -117,6 +117,94 @@ function readParams(
   visit(expr);
 }
 
+/**
+ * What a file binds to host code, for {@link hostReadOf} (INTENTIUS/typescript-as-data#248).
+ */
+export interface HostBindings {
+  /** Local names bound to a value a lexicon package exports. */
+  values: ReadonlySet<string>;
+  /** Local names of eager lexicon helpers: a call to one is evaluated by host code at fold time. */
+  eagerCalls: ReadonlySet<string>;
+}
+
+/**
+ * The first host read in `expr`, following this file's own top-level consts,
+ * or `undefined` when it reads none (INTENTIUS/typescript-as-data#248).
+ *
+ * A method called on a receiver is `host-call` whatever the receiver is, since
+ * fold calls the real method on it; so is a call to an eager lexicon helper. An
+ * identifier bound to a lexicon export is `host-value`. A call fold reduces to
+ * an envelope (an authoring helper, a call-form intrinsic) or evaluates itself
+ * (a project function) is not host code, and only its arguments are read.
+ *
+ * Syntactic, like {@link readParams}, so it over-reports in one place: both
+ * arms of a conditional are read although only one is taken. That errs toward
+ * `unknown`, which never licenses an edit `direct` would not.
+ */
+export function hostReadOf(
+  expr: ts.Expression,
+  consts: ReadonlyMap<string, ts.Expression>,
+  paramLocals: ReadonlySet<string>,
+  host: HostBindings,
+): HostOriginReason | undefined {
+  const followed = new Set<string>();
+  let found: HostOriginReason | undefined;
+
+  const visit = (node: ts.Node): void => {
+    if (found) return;
+    if (ts.isCallExpression(node)) {
+      const callee = unwrap(node.expression);
+      if (ts.isPropertyAccessExpression(callee) || ts.isElementAccessExpression(callee)) {
+        found = "host-call";
+        return;
+      }
+      if (ts.isIdentifier(callee) && !consts.has(callee.text) && host.eagerCalls.has(callee.text)) {
+        found = "host-call";
+        return;
+      }
+      for (const argument of node.arguments) visit(argument);
+      return;
+    }
+
+    if (ts.isPropertyAccessExpression(node)) {
+      // The member name is not a reference.
+      visit(node.expression);
+      return;
+    }
+
+    if (ts.isIdentifier(node)) {
+      if (paramLocals.has(node.text)) return;
+      const initializer = consts.get(node.text);
+      if (initializer) {
+        // A sibling resource is a reference to it, not a read of its props.
+        if (ts.isNewExpression(unwrap(initializer)) || followed.has(node.text)) return;
+        followed.add(node.text);
+        visit(initializer);
+        return;
+      }
+      if (host.values.has(node.text)) found = "host-value";
+      return;
+    }
+
+    if (ts.isPropertyAssignment(node)) {
+      visit(node.initializer);
+      return;
+    }
+
+    // A tag is an intrinsic the lexicon registered, and only its
+    // interpolations are read.
+    if (ts.isTaggedTemplateExpression(node)) {
+      visit(node.template);
+      return;
+    }
+
+    ts.forEachChild(node, visit);
+  };
+
+  visit(expr);
+  return found;
+}
+
 /**
  * Path → build-parameter origin for one resource's props object literal.
  *
@@ -129,16 +217,27 @@ function readParams(
  * A spread is attributed to the object it spreads INTO, at that object's own
  * path (the entity root for a top-level spread), since which keys it
  * contributes is not knowable here.
+ *
+ * With `host`, a path whose expression reads host code ({@link hostReadOf})
+ * is recorded `host` instead, and that outranks a build parameter it also
+ * reads: the value is what host code returned, whatever the parameter was.
  */
 export function collectParamDependencies(
   props: ts.ObjectLiteralExpression,
   consts: ReadonlyMap<string, ts.Expression>,
   paramLocals: ReadonlySet<string>,
+  host?: HostBindings,
 ): Record<string, PathOrigin> {
   const out: Record<string, PathOrigin> = {};
-  if (paramLocals.size === 0) return out;
+  if (paramLocals.size === 0 && !host) return out;
 
   const record = (path: string, expr: ts.Expression): void => {
+    if (out[path]?.kind === "host") return;
+    const reason = host ? hostReadOf(expr, consts, paramLocals, host) : undefined;
+    if (reason) {
+      out[path] = { kind: "host", reason };
+      return;
+    }
     const found = new Set<string>();
     readParams(expr, consts, paramLocals, found);
     if (found.size === 0) return;

package/src/fold/subset.ts

@@ -179,7 +179,7 @@ import { intrinsicCallFolds, intrinsicCallFoldsEagerly, type IntrinsicDef } from
  * `spec/VERSION` in the specification repository carries the same string, and
  * the conformance adapter reads this one to fill its `specVersion` field.
  *
- * ## Why 2.2, and what each version since 1.0 asked for (chant#2445)
+ * ## Why 2.3, and what each version since 1.0 asked for (chant#2445)
  *
  * Raising this is the last step of adopting a rule set, so each version was
  * checked against what chant does rather than against whether the suite is
@@ -228,6 +228,13 @@ import { intrinsicCallFolds, intrinsicCallFoldsEagerly, type IntrinsicDef } from
  *   chant already did: a call-bound local exported by name (`export { x }`)
  *   resolves by F-Call as the single declarator does, and a same-file call's
  *   result read inside an F-Call argument resolves once per file (#3329).
+ * - **2.3** says a value host code produced, written at an export or into a
+ *   field, has an unknown origin and never a direct one. chant reports
+ *   `host-call` and `host-value` for resource fields since
+ *   typescript-as-data#248. 2.3 also lets `F-Host-Composite` interpret a
+ *   composite an active package publishes as TypeScript source, which chant
+ *   has done since #3247, and adds fixtures for a call result read inside an
+ *   argument, which chant passes since #3610.
  *
  * `scripts/check-docs-citations.ts` refuses to run when this constant and the
  * rules it loads disagree, so this and the `@intentius/tsad-conformance`
@@ -239,7 +246,7 @@ import { intrinsicCallFolds, intrinsicCallFoldsEagerly, type IntrinsicDef } from
  * Until chant#2470 the rules came from a commit `docs-check.yml` checked out;
  * now they come from the published package, so bumping it is what moves this.
  */
-export const SPEC_VERSION = "2.2";
+export const SPEC_VERSION = "2.3";
 
 /** The two EVL rule ids a shape violation can be attributed to. */
 export type SubsetRuleId = "EVL001" | "EVL003";

package/src/fold-provenance.test.ts

@@ -103,6 +103,17 @@ describe("classifyFieldOrigin", () => {
     });
   });
 
+  test("a host origin is unknown with that reason, never a direct declaration (typescript-as-data#248)", () => {
+    expect(classifyFieldOrigin({ kind: "host", reason: "host-call" }, authored)).toEqual({
+      kind: "unknown",
+      reason: "host-call",
+    });
+    expect(classifyFieldOrigin({ kind: "host", reason: "host-value" }, authored)).toEqual({
+      kind: "unknown",
+      reason: "host-value",
+    });
+  });
+
   test("no origin on an entity no composite expanded is a direct declaration", () => {
     expect(classifyFieldOrigin(undefined, authored)).toEqual({ kind: "direct" });
   });

package/src/fold-provenance.ts

@@ -80,7 +80,11 @@ import {
 } from "./provenance";
 import type { DeepEntityDrift, PropertyDrift } from "./lifecycle/deep-diff";
 
-/** Why a field's origin could not be determined. Both are facts about the BUILD, not about the field. */
+/**
+ * Why a field's origin could not be determined. The first two are facts about
+ * the BUILD; the host reasons are facts about the expression, and match the
+ * strings the specification's reference implementation reports.
+ */
 export type UnknownOriginReason =
   /**
    * A composite expanded the entity and this build did not interpret its body,
@@ -94,7 +98,15 @@ export type UnknownOriginReason =
    * composite make it" is answerable. A sandboxed child's entities arrive this
    * way: `discovery/entity-wire-codec.ts` drops build metadata over the wire.
    */
-  | "no-provenance";
+  | "no-provenance"
+  /**
+   * INTENTIUS/typescript-as-data#248: host code computed the value, by a method
+   * called on a real receiver (`"x".toUpperCase()`, `[1, 2].join("-")`) or an
+   * eager lexicon helper. The file wrote the call, not the value.
+   */
+  | "host-call"
+  /** A value a lexicon package exports, bound by an import (`AWS.Region`, `S3Actions.GetObject`). */
+  | "host-value";
 
 /**
  * What produced one emitted property path.
@@ -231,6 +243,10 @@ export function classifyFieldOrigin(
       return provenance.composite
         ? { kind: "unknown", reason: "composite-not-interpreted" }
         : { kind: "direct" };
+    case "host":
+      // INTENTIUS/typescript-as-data#248 — host code produced the value, so
+      // editing the declaration edits a call, not the value it returned.
+      return { kind: "unknown", reason: origin.reason };
     case "build-param":
       // A build parameter governs the expression the AUTHOR wrote in their own
       // source, so the declaration is still theirs to edit.
@@ -307,6 +323,10 @@ export function unknownOriginText(reason: UnknownOriginReason): string {
       return "expanded by a composite whose factory this build did not interpret";
     case "no-provenance":
       return "this build recorded no provenance for the entity";
+    case "host-call":
+      return "the value is what a host call returned";
+    case "host-value":
+      return "the value is one a host package exports";
   }
 }
 

package/src/import/ir-utils.ts

@@ -36,10 +36,15 @@ export function hasIntrinsicInValue(value: unknown, name: string): boolean {
  */
 export function irUsesIntrinsic(ir: TemplateIR, name: string): boolean {
   for (const resource of ir.resources) {
-    if (hasIntrinsicInValue(resource.properties, name)) {
+    if (
+      hasIntrinsicInValue(resource.properties, name) ||
+      hasIntrinsicInValue(resource.metadata, name) ||
+      hasIntrinsicInValue(resource.attributes, name)
+    ) {
       return true;
     }
   }
+  if (hasIntrinsicInValue(ir.metadata, name)) return true;
   for (const condition of ir.conditions ?? []) {
     if (hasIntrinsicInValue(condition.expression, name)) {
       return true;

package/src/import/parser.ts

@@ -9,6 +9,9 @@ export interface ParameterIR {
   readonly description?: string;
   readonly defaultValue?: unknown;
   readonly required?: boolean;
+  /** What the value is checked against, under the source format's own keys
+   * and as written (CloudFormation `AllowedValues`, `MinLength`, `NoEcho`). */
+  readonly constraints?: Readonly<Record<string, unknown>>;
 }
 
 /**
@@ -22,6 +25,11 @@ export interface ResourceIR {
   /** Name of the condition gating this resource (CloudFormation `Condition`
    * key, or equivalent), when the source template declares one (#2069). */
   readonly condition?: string;
+  /** Resource-level attributes other than the condition, under the source
+   * format's own keys (CloudFormation `DependsOn`, `DeletionPolicy`,
+   * `UpdateReplacePolicy`, `UpdatePolicy`, `CreationPolicy`). Values are
+   * parsed value trees, like {@link properties}. */
+  readonly attributes?: Readonly<Record<string, unknown>>;
 }
 
 /**

package/src/op/activities/factory.ts

@@ -22,6 +22,7 @@ import { spawn } from "node:child_process";
 import { mkdirSync, realpathSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import type { FactoryClaim, FactoryContext, FactoryItem } from "../../workspace/factory-rules";
+import { liveRunEnv } from "../run-live";
 
 /** The run's work lease, as `workLeaseOutput()` hands it to a step. */
 export interface FactoryLease {
@@ -263,7 +264,8 @@ interface Ran {
 /** Run argv in cwd, without a shell, asynchronously. */
 function run(argv: readonly string[], cwd: string, env: NodeJS.ProcessEnv): Promise<Ran> {
   return new Promise((settle) => {
-    const child = spawn(argv[0], argv.slice(1), { cwd, env: { ...process.env, ...env }, stdio: ["ignore", "pipe", "pipe"] });
+    // The run's activity file, as a shell step gets it, so a builder's lines reach its in-flight record (#3637).
+    const child = spawn(argv[0], argv.slice(1), { cwd, env: { ...process.env, ...liveRunEnv(), ...env }, stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     child.stdout.on("data", (b: Buffer) => (stdout += b.toString("utf8")));

package/src/op/factory.e2e.test.ts

@@ -184,7 +184,7 @@ describe("the factory Op's seams for an orchestrator (studio#382)", () => {
       // A builder that reports a run and a check that reports per criterion.
       writeFileSync(join(dir, "hooks", "builder2.cjs"), `${BUILDER}\nconsole.log(JSON.stringify({ ok: true, run: { id: "run-7" }, agent: "builder-small", chantAgent: "factory", records: ["contract:C-1"] }));\n`);
       writeFileSync(join(dir, "hooks", "check2.cjs"), `console.log(JSON.stringify({ criteria: { "AC-1": "pass", "AC-2": "fail" }, built: JSON.parse(process.env.FACTORY_BUILD).agent }));`);
-      writeFileSync(join(dir, "hooks", "after.cjs"), `require("node:fs").writeFileSync(require("node:path").join(process.env.FACTORY_FAIL_DIR, "after.json"), JSON.stringify({ outcome: process.env.FACTORY_OUTCOME, commit: process.env.FACTORY_COMMIT, reason: process.env.FACTORY_REASON, check: JSON.parse(process.env.FACTORY_CHECK) }));`);
+      writeFileSync(join(dir, "hooks", "after.cjs"), `require("node:fs").writeFileSync(require("node:path").join(process.env.FACTORY_FAIL_DIR, "after.json"), JSON.stringify({ outcome: process.env.FACTORY_OUTCOME, commit: process.env.FACTORY_COMMIT, reason: process.env.FACTORY_REASON, check: JSON.parse(process.env.FACTORY_CHECK), activity: process.env.CHANT_RUN_ACTIVITY ?? null }));`);
       // The prepare hook writes W-110 in the checkout and leaves it uncommitted; the others are taken out of the way.
       writeFileSync(
         join(dir, "hooks", "prepare.cjs"),
@@ -204,6 +204,8 @@ describe("the factory Op's seams for an orchestrator (studio#382)", () => {
       expect(result.workLease).toMatchObject({ item: "W-110", outcome: "not_done" });
       const after = JSON.parse(readFileSync(join(dir, "after.json"), "utf-8"));
       expect(after).toMatchObject({ outcome: "not_done", reason: "criteria AC-2 have no passing evidence", check: { built: "builder-small" } });
+      // A hook gets the run's activity file, as a shell step does (#3637).
+      expect(after.activity).toMatch(/\.activity\.jsonl$/);
       // The attempt was committed with why, and the run kept that commit.
       expect(after.commit).toMatch(/^[0-9a-f]{40}$/);
       // The kept attempt holds the carried item with AC-1 ticked and AC-2 failed.

package/src/provenance.ts

@@ -87,6 +87,12 @@ export interface EntityProvenance {
  *   expression for this path reads no parameter at all. The composite fixes
  *   this field, and no argument at the call site moves it.
  *
+ * - `host` — the authored expression for this path reads a value host code
+ *   produced (INTENTIUS/typescript-as-data#248): a method called on a real
+ *   receiver or an eager lexicon helper (`host-call`), or a value a lexicon
+ *   package exports (`host-value`). The author wrote the call, not the value,
+ *   so ./fold-provenance.ts answers `unknown` rather than `direct`.
+ *
  * The coarse `composite` and the two fine kinds are not alternatives. A build
  * records `composite` when it expanded a composite without interpreting its
  * body (the run path, an inadmissible factory), and that is why
@@ -108,7 +114,11 @@ export type PathOrigin =
        */
       arguments?: ArgumentLocation[];
     }
-  | { kind: "composite-literal"; composite: string };
+  | { kind: "composite-literal"; composite: string }
+  | { kind: "host"; reason: HostOriginReason };
+
+/** Which host code produced a value: a call it ran, or a value its package exports. */
+export type HostOriginReason = "host-call" | "host-value";
 
 /**
  * A place in a source file. `file` is absolute, as
@@ -270,6 +280,8 @@ export function describePathOrigin(origin: PathOrigin): string {
       return `composite ${origin.composite} parameter ${origin.parameters.join(", ")}`;
     case "composite-literal":
       return `composite ${origin.composite} literal`;
+    case "host":
+      return origin.reason;
   }
 }
 

package/src/serializer-walker.test.ts

@@ -118,6 +118,16 @@ describe("walkValue", () => {
     });
   });
 
+  test("an __attrRef envelope naming a property reads the attribute that property's AttrRef carries", () => {
+    // A fold writes `db.Endpoint_Address` as the property name; the attribute
+    // is `Endpoint.Address`.
+    const TestDb = createResource("Test::Db", "test", { Endpoint_Address: "Endpoint.Address" });
+    const db = new TestDb({}) as unknown as Declarable;
+    const names = new Map<Declarable, string>([[db, "MyDB"]]);
+    const value = { __attrRef: { entity: "MyDB", attribute: "Endpoint_Address" } };
+    expect(walkValue(value, names, mockVisitor)).toEqual({ __getAtt: ["MyDB", "Endpoint.Address"] });
+  });
+
   test("resolves standalone __attrRef envelope in plain object", () => {
     const names = new Map<Declarable, string>();
     const value = { __attrRef: { entity: "MyBucket", attribute: "DomainName" } };

package/src/serializer-walker.ts

@@ -21,6 +21,22 @@ export interface SerializerVisitor {
   propertyDeclarable(entity: Declarable, walk: (v: unknown) => unknown): unknown;
 }
 
+/**
+ * The attribute an `{__attrRef}` envelope names. A fold writes the envelope
+ * with the property it read (`db.Endpoint_Address`), and the property's own
+ * AttrRef carries the attribute (`Endpoint.Address`); they differ when the
+ * attribute has a dot. The envelope's name is kept when the entity or
+ * property is not found.
+ */
+function envelopeAttribute(entityName: string, property: string, entityNames: Map<Declarable, string>): string {
+  for (const [entity, name] of entityNames) {
+    if (name !== entityName) continue;
+    const held = (entity as unknown as Record<string, unknown>)[property];
+    return isAttrRefLike(held) ? held.attribute : property;
+  }
+  return property;
+}
+
 /**
  * Recursively walk a value, converting AttrRefs, Intrinsics, Declarables,
  * arrays, and objects using the provided visitor.
@@ -100,7 +116,7 @@ export function walkValue(
   // Handle serialized AttrRef envelopes (produced by AttrRef.toJSON() inside intrinsics)
   if (typeof value === "object" && "__attrRef" in value) {
     const ref = (value as { __attrRef: { entity: string; attribute: string } }).__attrRef;
-    return visitor.attrRef(ref.entity, ref.attribute);
+    return visitor.attrRef(ref.entity, envelopeAttribute(ref.entity, ref.attribute, entityNames));
   }
 
   // Handle objects

package/src/stack-output.ts

@@ -37,6 +37,10 @@ export interface StackOutput extends Declarable {
    * `Output.Condition`) — a condition name, or the condition Declarable
    * itself, resolved to its logical name at serialization (#2068/#2069). */
   readonly condition?: string | Declarable;
+  /** The output's key in the template, when it is not the export name. A
+   * template may use one key for an output and a parameter or resource; a
+   * module cannot export both under that name (#3604). */
+  readonly name?: string;
 }
 
 /** What a wrapping intrinsic's lexicon gets derived from: either a nested
@@ -112,7 +116,7 @@ export function isStackOutput(value: unknown): value is StackOutput {
  */
 export function stackOutput(
   ref: AttrRef | Intrinsic | string,
-  options?: { description?: string; exportName?: string; lexicon?: string; condition?: string | Declarable },
+  options?: { description?: string; exportName?: string; lexicon?: string; condition?: string | Declarable; name?: string },
 ): StackOutput {
   // Duck-type, not `instanceof` (chant #1137): AttrRef also implements
   // Intrinsic (a global-symbol marker), so `isIntrinsic(ref)` alone already
@@ -152,6 +156,7 @@ export function stackOutput(
     description: options?.description,
     exportName: options?.exportName,
     condition: options?.condition,
+    ...(options?.name !== undefined ? { name: options.name } : {}),
   };
 
   return output;

package/src/workspace/box-cli.ts

@@ -2,8 +2,9 @@
  * `chant workspace box`: a member's box block. Two verbs:
  *
  * - `box listing set <member>` (#3308) changes the box's listing
- *   (`box-listing.ts`). A box's other configuration is changed by editing the
- *   declaration in a reviewed change.
+ *   (`box-listing.ts`), and `box factory set <member>` (#3600) its factory,
+ *   such as where it publishes (`box-factory-write.ts`). A box's other
+ *   configuration is changed by editing the declaration in a reviewed change.
  * - `box publish <member> <item> | --records` (#3165, ws-088) runs the
  *   publisher the box block names and checks what it did (`box-publish.ts`).
  */
@@ -12,12 +13,14 @@ import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { formatError } from "../cli/format";
 import type { CommandContext } from "../cli/registry";
+import { BOX_FACTORY_CONTRACT_VERSION, BOX_FACTORY_WRITE_SCHEMA_ID, boxFactorySet, type BoxFactoryWriteDocument } from "./box-factory-write";
 import { BOX_LISTING_CONTRACT_VERSION, BOX_LISTING_WRITE_SCHEMA_ID, boxListingSet, type BoxListingWriteDocument } from "./box-listing";
 import { BOX_PUBLISH_CONTRACT_VERSION, BOX_PUBLISH_SCHEMA_ID, boxPublish, type BoxPublishDocument } from "./box-publish";
 import { readerVersion } from "./declaration";
 import { AGENT_ENV } from "./write-scope";
 
 const USAGE = "chant workspace box listing set <member> [--from <file|->] [--cover <image> [--cover-path <path>]] [--by <principal>] [--dry-run] [--json]";
+const FACTORY_USAGE = "chant workspace box factory set <member> --from <file|-> [--by <principal>] [--dry-run] [--json]";
 const PUBLISH_USAGE = "chant workspace box publish <member> (<item> | --records) [--by <principal>] [--head <owner/name>] [--dry-run] [--json]";
 
 export async function runWorkspaceBox(ctx: CommandContext): Promise<number> {
@@ -27,11 +30,13 @@ export async function runWorkspaceBox(ctx: CommandContext): Promise<number> {
   const [, noun, verb, member, ...extra] = args.positionals ?? [];
   // For publish, the third positional is the member and the fourth the item.
   if (noun === "publish") return runPublish(ctx, verb, member === undefined ? [] : [member, ...extra]);
+  if (noun === "factory" && verb === "set") return runFactorySet(ctx, member, extra);
   if (noun !== "listing" || verb !== "set") {
+    const verbs = "listing set <member>, factory set <member> or publish <member>";
     console.error(
       formatError({
-        message: noun === undefined ? "chant workspace box takes listing set <member> or publish <member>" : `chant workspace box takes listing set <member> or publish <member>, not ${[noun, verb].filter(Boolean).join(" ")}`,
-        hint: `${USAGE}\n${PUBLISH_USAGE}`,
+        message: noun === undefined ? `chant workspace box takes ${verbs}` : `chant workspace box takes ${verbs}, not ${[noun, verb].filter(Boolean).join(" ")}`,
+        hint: `${USAGE}\n${FACTORY_USAGE}\n${PUBLISH_USAGE}`,
       }),
     );
     return 1;
@@ -75,6 +80,32 @@ export async function runWorkspaceBox(ctx: CommandContext): Promise<number> {
   );
 }
 
+/** `box factory set <member> --from <file|->` (#3600). */
+function runFactorySet(ctx: CommandContext, member: string | undefined, extra: string[]): number {
+  const { args } = ctx;
+  const cwd = process.cwd();
+  const print = (doc: BoxFactoryWriteDocument): number => {
+    console.log(JSON.stringify(doc, null, 2));
+    return "error" in doc ? 1 : 0;
+  };
+  const fail = (code: "write-usage-invalid" | "write-input-invalid", message: string) =>
+    print({ $schema: BOX_FACTORY_WRITE_SCHEMA_ID, contract: BOX_FACTORY_CONTRACT_VERSION, chant: readerVersion(), member: member ?? null, error: { code, message } });
+  if (member === undefined) return fail("write-usage-invalid", `box factory set needs the member whose box builds; ${FACTORY_USAGE}`);
+  if (extra.length > 0) return fail("write-usage-invalid", `box factory set takes one member, and was also given ${extra.join(" ")}`);
+  for (const [flag, v] of [["--set", args.set], ["--kind", args.kind], ["--at", args.at], ["--cover", args.cover]] as const) {
+    if (v !== undefined) return fail("write-usage-invalid", `box factory set takes its fields with --from, not ${flag}`);
+  }
+  let fields: string | undefined;
+  if (args.migrateFrom !== undefined) {
+    try {
+      fields = readFileSync(args.migrateFrom === "-" ? 0 : resolve(cwd, args.migrateFrom), "utf-8");
+    } catch (err) {
+      return fail("write-input-invalid", `--from ${args.migrateFrom} could not be read: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  return print(boxFactorySet({ cwd, member, fields, by: args.by, agent: process.env[AGENT_ENV] || undefined, dryRun: args.dryRun === true }));
+}
+
 /** `box publish <member> <item>` or `box publish <member> --records`. */
 function runPublish(ctx: CommandContext, member: string | undefined, rest: string[]): number {
   const { args } = ctx;