@intentius/chant 0.124.31 → 0.124.32

package/src/discovery/fold-host-method.test.ts

@@ -0,0 +1,87 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { foldProject } from "../index";
+
+/**
+ * chant#4011 — a method call reached `Function`, so a file reporting
+ * `[fold:fold]` could put the clock, `process.env` or `Math.random()` in its
+ * output. The issue's repro and its variants now get a `run` verdict, and a
+ * file of listed host methods folds to the same bytes whatever the
+ * environment says.
+ */
+describe("a folded file cannot reach host behaviour through a method call (chant#4011)", () => {
+  let root: string;
+  const saved = { HOME: process.env.HOME, TZ: process.env.TZ };
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "chant-4011-"));
+  });
+
+  afterEach(() => {
+    process.env.HOME = saved.HOME;
+    if (saved.TZ === undefined) delete process.env.TZ;
+    else process.env.TZ = saved.TZ;
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  async function verdictOf(source: string) {
+    const file = join(root, "c.ts");
+    writeFileSync(file, source);
+    return (await foldProject([file], [], {})).get(file)!;
+  }
+
+  const cases: Record<string, string> = {
+    "the issue's repro": [
+      "export const cfg = {",
+      '  stamp: [].constructor.constructor("return String(Date.now())").call(),',
+      '  home: `${[].constructor.constructor("return process.env.HOME").call()}`,',
+      "};",
+    ].join("\n"),
+    "Math.random": 'export const cfg = { r: [].constructor.constructor("return Math.random()").call() };',
+    "process.env": 'export const cfg = { h: [].constructor.constructor("return process.env.HOME").call() };',
+    "new Date(...).toString()":
+      'export const cfg = { d: [].constructor.constructor("return new Date(0).toString()").call() };',
+    toLocaleString: "export const cfg = { n: (1234567.891).toLocaleString() };",
+    "Function through a prototype chain":
+      'export const cfg = { p: "".__proto__.constructor.constructor("return String(Date.now())").call() };',
+    "Function under an unlisted name":
+      'const o = { f: [].constructor.constructor };\nexport const cfg = { q: o.f("return 1") };',
+  };
+
+  for (const [name, source] of Object.entries(cases)) {
+    test(`${name}: run, not fold`, async () => {
+      const verdict = await verdictOf(source);
+      expect(verdict.verdict).toBe("run");
+      expect(verdict.reason).toBeDefined();
+    });
+  }
+
+  test("listed host methods fold to identical output under a different HOME and TZ", async () => {
+    const source = [
+      "const parts = ['a', 'b', 'c'];",
+      "export const cfg = {",
+      "  name: parts.join('-'),",
+      "  tail: 'x.y.z'.split('.').slice(1).join('/'),",
+      "  pi: (3.14159).toFixed(2),",
+      "  upper: 'chant'.toUpperCase(),",
+      "};",
+    ].join("\n");
+
+    process.env.HOME = "/tmp/h1";
+    process.env.TZ = "UTC";
+    const first = await verdictOf(source);
+    process.env.HOME = "/tmp/h2";
+    process.env.TZ = "Asia/Kolkata";
+    const second = await verdictOf(source);
+
+    expect(first.verdict).toBe("fold");
+    expect(second.verdict).toBe("fold");
+    const bytes = (v: typeof first) => JSON.stringify(Object.fromEntries(v.exports!));
+    expect(bytes(first)).toBe(bytes(second));
+    expect(JSON.parse(bytes(first))).toEqual({
+      cfg: { name: "a-b-c", tail: "y/z", pi: "3.14", upper: "CHANT" },
+    });
+  });
+});

package/src/discovery/fold-import.ts

@@ -28,6 +28,7 @@ import {
 } from "../fold/fold";
 import { isChantOwnedSpecifier, isFoldableHelperName } from "../fold/foldable-helpers";
 import { lexiconModulePath, lexiconModuleRoot } from "../lexicon-module";
+import { compiledModuleSource } from "../module-source";
 import {
   isFile,
   packageExportsTarget,
@@ -2050,10 +2051,11 @@ function isUnfoldableSameFileCall(name: string, ctx: ResolveCtx): boolean {
 //     specifier, or its package root for a subpath, against
 //     {@link FoldSession.lexiconPackages}, exactly as
 //     {@link isTrustedExecutableBinding}'s arm 1 matches it — and only then
-//     resolved; a module that resolves to compiled JavaScript or a declaration
-//     file is not interpreted, so a package that ships only `dist` keeps
-//     invoking. Every chant lexicon routes its exports at `./src/*.ts`
-//     (check-lexicon tier 1), so in practice the source is always there.
+//     resolved; a module that resolves to a declaration file, or to compiled
+//     JavaScript with no `src/` source beside its `dist/`, is not interpreted,
+//     so a package that ships only `dist` keeps invoking. Every chant lexicon
+//     publishes `src/` beside the `dist/*.js` its exports name (#3981), and
+//     a compiled module is read from that source.
 //     Interpreting buys provenance: the run path cannot say which parameter
 //     fed a field, and interpretation can (#2161, #3246).
 //
@@ -2478,7 +2480,15 @@ function factoryOrigin(specifier: string, fromFile: string, ctx: ResolveCtx): Fa
   } catch {
     return undefined;
   }
-  if (!isTypeScriptSource(modulePath)) return undefined;
+  if (!isTypeScriptSource(modulePath)) {
+    // #3981 — a lexicon's exports resolve to the compiled dist/*.js it
+    // publishes, beside the src/ it was built from. The source is what is
+    // read; an import the body makes still loads the compiled module, since
+    // the compiled CLI points a lexicon's src/*.ts at its dist/*.js.
+    const source = compiledModuleSource(modulePath);
+    if (source === undefined || !isFile(source)) return undefined;
+    modulePath = source;
+  }
   const packageRoot = lexiconPackageDirectory(modulePath, packageName);
   return packageRoot === undefined ? undefined : { modulePath, packageRoot };
 }

package/src/discovery/fold-package-composite.test.ts

@@ -238,6 +238,33 @@ describe("lexicon-package and re-exported composites are interpreted (chant#3247
     expect(foldExecutionCounts().factoryInterpretations).toBe(0);
   });
 
+  test("a package whose exports name compiled JavaScript is interpreted from the src/ it ships beside dist/ (#3981)", async () => {
+    // As a chant lexicon publishes: exports on dist/*.js, the source under src/.
+    await installFakeLexicon(
+      "fakedist3981",
+      {
+        "dist/index.js": `export * from "./composites/index.js";\n`,
+        "dist/composites/index.js": `export * from "./web.js";\n`,
+        "dist/composites/web.js": `throw new Error("the compiled module is not read");\n`,
+        "src/index.ts": `export * from "./composites/index";\n`,
+        "src/composites/index.ts": `export * from "./web";\n`,
+        "src/composites/web.ts": WEBAPP_DEFINITION,
+      },
+      "./dist/index.js",
+    );
+    await writeFile(
+      join(srcDir, "main.ts"),
+      `import { WebApp } from "@intentius/chant-lexicon-fakedist3981";\nexport const web = WebApp({ name: "data" });\n`,
+    );
+
+    const result = await discover(srcDir, { fold: true, lexicons: ["aws", "fakedist3981"] });
+
+    expect(result.errors).toEqual([]);
+    expect(moduleRan(), "the defining module was read, never imported").toBeUndefined();
+    expect(foldExecutionCounts()).toMatchObject({ factoryInterpretations: 1, factoryInvocations: 0 });
+    expect([...result.entities.keys()]).toEqual(["webBucket"]);
+  });
+
   test("a package re-export that leaves the package's directory is not followed", async () => {
     await mkdir(join(testDir, "shared"), { recursive: true });
     await writeFile(join(testDir, "shared", "web.ts"), WEBAPP_DEFINITION);

package/src/discovery/fold-specifiers.test.ts

@@ -188,4 +188,12 @@ describe("packageExportsTarget (chant#3090)", () => {
     expect(packageExportsTarget("./index.js", "./sub")).toBeUndefined();
     expect(packageExportsTarget({ import: "./index.js" }, "./sub")).toBeUndefined();
   });
+  test("from source, a lexicon's development export wins over the dist/*.js its default names (#3981)", () => {
+    const lexicon = {
+      ".": { development: "./src/index.ts", types: "./dist/index.d.ts", default: "./dist/index.js" },
+      "./*": { development: "./src/*.ts", types: "./dist/*.d.ts", default: "./dist/*.js" },
+    };
+    expect(packageExportsTarget(lexicon, ".")).toBe("./src/index.ts");
+    expect(packageExportsTarget(lexicon, "./generated/index")).toBe("./src/generated/index.ts");
+  });
 });

package/src/discovery/sandbox/bundle.ts

@@ -3,6 +3,7 @@ import { existsSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync,
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve as resolvePath } from "node:path";
+import { SOURCE_EXPORT_CONDITIONS } from "../../module-source";
 
 /**
  * chant #1045 Phase 2 — bundles the generated sandbox driver (`./driver.ts`)
@@ -219,6 +220,11 @@ export async function bundleDriver(driverSource: string): Promise<BundleResult>
       format: "esm",
       absWorkingDir: bundleDir,
       logLevel: "silent",
+      // #3981 — from source, a lexicon bundles from its src/*.ts, as the
+      // unsandboxed build imports it; compiled, from the dist/*.js it ships.
+      // Setting `conditions` replaces esbuild's default ["module"], so it is
+      // kept, and compiled the option is left out as before.
+      ...(SOURCE_EXPORT_CONDITIONS.length > 0 ? { conditions: ["module", ...SOURCE_EXPORT_CONDITIONS] } : {}),
       plugins: [plugin],
     });
   } catch (err) {

package/src/discovery/specifier-resolve.ts

@@ -24,6 +24,7 @@
 import * as ts from "typescript";
 import { readFileSync, statSync } from "node:fs";
 import { dirname, extname, isAbsolute, join, resolve as resolvePath } from "node:path";
+import { SOURCE_EXPORT_CONDITIONS } from "../module-source";
 
 /** True when `path` is an existing regular file. */
 export function isFile(path: string): boolean {
@@ -89,8 +90,13 @@ export function splitBareSpecifier(specifier: string): { name: string; subpath:
   return { name, subpath: rest === "" ? "." : `./${rest}` };
 }
 
-/** The conditions an ESM import in Node matches, which is what the run path does. */
-const EXPORT_CONDITIONS: ReadonlySet<string> = new Set(["import", "node", "default"]);
+/**
+ * The conditions an ESM import in Node matches, which is what the run path
+ * does. From source, `development` too (#3981): the run path there resolves a
+ * chant package to its `src/*.ts`, not to the compiled `dist/*.js` its
+ * `default` names.
+ */
+const EXPORT_CONDITIONS: ReadonlySet<string> = new Set(["import", "node", "default", ...SOURCE_EXPORT_CONDITIONS]);
 
 /**
  * The target an `exports` value selects, with `star` substituted for each `*`

package/src/fold/fold.test.ts

@@ -1375,3 +1375,75 @@ describe("fold — same-file functions without externals (chant#2436)", () => {
     expect(() => fold(consts.get("x")!, consts, [], new Map())).toThrow(FoldError);
   });
 });
+
+// chant#4011 — since #1966 a method call folded whenever the receiver was real
+// and the property was a function, so `.constructor.constructor` reached
+// `Function` and a folded file could read the clock, the environment or a
+// random number. Each case below folded to a value before the fix.
+describe("fold — a method call cannot reach Function or other host behaviour (#4011)", () => {
+  const refuses = (src: string) => expect(() => foldConst(src, "x")).toThrow(FoldError);
+
+  test("Date.now() through [].constructor.constructor", () => {
+    refuses(`const x = [].constructor.constructor("return String(Date.now())").call();`);
+  });
+
+  test("process.env through [].constructor.constructor", () => {
+    refuses("const x = `${[].constructor.constructor(\"return process.env.HOME\").call()}`;");
+  });
+
+  test("Math.random() through [].constructor.constructor", () => {
+    refuses(`const x = [].constructor.constructor("return Math.random()").call();`);
+  });
+
+  test("Function reached through a prototype chain on a string", () => {
+    refuses(`const x = "".__proto__.constructor.constructor("return Date.now()").call();`);
+  });
+
+  test("Function stored under a name the table does not list", () => {
+    // No refused name appears in the call: `f` is a plain property whose value
+    // is Function, read by property access. The host-method table catches it.
+    refuses(`const o = { f: [].constructor.constructor }; const x = o.f("return 1");`);
+  });
+
+  test("Function stored under a listed name is still refused: the table checks identity", () => {
+    refuses(`const o = { toString: [].constructor.constructor }; const x = o.toString("return 1");`);
+  });
+
+  test("a static method on a host constructor has no row", () => {
+    refuses(`const A = [].constructor; const x = A.of(1, 2);`);
+  });
+
+  test("a function passed to a listed host method is refused", () => {
+    refuses(`const x = "abc".replace("b", [].constructor);`);
+  });
+
+  test("toLocaleString follows the host locale and is refused", () => {
+    refuses(`const x = (1234567.891).toLocaleString();`);
+  });
+
+  test("the error names the refused method", () => {
+    expect(() => foldConst(`const x = [].constructor.constructor("return 1");`, "x")).toThrow(
+      /`\.constructor\(\.\.\.\)` is not foldable/,
+    );
+  });
+
+  test("listed host methods still fold", () => {
+    expect(foldConst(`const x = ["a", "b"].join(",");`, "x")).toBe("a,b");
+    expect(foldConst(`const x = "a.b.c".split(".").slice(1).join("-");`, "x")).toBe("b-c");
+    expect(foldConst(`const x = (3.14159).toFixed(2);`, "x")).toBe("3.14");
+    expect(foldConst(`const x = "Abc".toUpperCase();`, "x")).toBe("ABC");
+    expect(foldConst(`const x = true.toString();`, "x")).toBe("true");
+  });
+
+  test("a method written in package code is not a host method and still folds", () => {
+    // The github lexicon's `Expression.prototype.toString` is this shape.
+    class Expr {
+      toString(): string {
+        return "${{ github.actor }}";
+      }
+    }
+    const consts = parseConsts(`const x = actor.toString();`);
+    const externals = new Map<string, unknown>([["actor", new Expr()]]);
+    expect(fold(consts.get("x") as ts.Expression, consts, [], externals)).toBe("${{ github.actor }}");
+  });
+});

package/src/fold/fold.ts

@@ -6,12 +6,15 @@ import {
   SUPPORTED_UNARY_OPERATORS,
   UNSUPPORTED_OBJECT_MEMBER_MESSAGE,
   UNSUPPORTED_UNARY_MESSAGE,
+  FOLDABLE_HOST_METHODS,
+  REFUSED_METHOD_NAMES,
   briefNodeText,
   callExpressionMessage,
   computedPropertyNameMessage,
   dynamicElementAccessMessage,
   isLiteralElementKey,
   isLiteralPropertyName,
+  refusedMethodMessage,
   unsupportedBinaryMessage,
   unsupportedExpressionMessage,
   type SubsetRuleId,
@@ -1700,8 +1703,15 @@ export function fold(
     // named property on it is actually a function. Calling it with the folded
     // arguments is then no different from what running the file would do:
     // the receiver is the same real object either way.
+    //
+    // chant#4011 — "never checked by name" let `[].constructor.constructor`
+    // reach `Function`, so a folded file could run any code. A name in
+    // REFUSED_METHOD_NAMES is refused on every receiver, before the receiver
+    // is folded, exactly as EVL001 refuses it; a host (native) method must be
+    // in FOLDABLE_HOST_METHODS for its receiver's type ({@link hostMethodRefusal}).
     if (ts.isPropertyAccessExpression(node.expression)) {
       const methodName = node.expression.name.text;
+      if (REFUSED_METHOD_NAMES.has(methodName)) throw foldError(node, refusedMethodMessage(methodName));
       const receiver = fold(node.expression.expression, consts, intrinsics, externals);
       // chant #2328 — a call is a link of an optional chain like any other:
       // `a?.b()` and `a?.b.c()` on a nullish `a` are `undefined` in
@@ -1722,7 +1732,22 @@ export function fold(
       if (typeof method !== "function") {
         throw foldError(node, `"${methodName}" is not a callable method on the folded value — falls back to run`);
       }
+      // The arguments fold first, so `list.map((n) => …)` keeps refusing on
+      // its callback, the reason the docs give for it.
       const args = node.arguments.map((arg) => fold(arg, consts, intrinsics, externals));
+      if (isNativeFunction(method)) {
+        const refusal = hostMethodRefusal(receiver, methodName, method);
+        if (refusal) throw foldError(node, refusal);
+        // A host method handed a function calls it (`"x".replace("x", fn)`),
+        // and the only functions a fold produces as values are host ones read
+        // by property access (`[].constructor`), so none is passed in.
+        if (args.some((arg) => typeof arg === "function")) {
+          throw foldError(
+            node,
+            `a function passed to the host method \`.${methodName}(...)\` is not foldable — falls back to run`,
+          );
+        }
+      }
       return (method as (...methodArgs: unknown[]) => unknown).apply(receiver, args) as FoldedValue;
     }
 
@@ -1732,6 +1757,52 @@ export function fold(
   throw foldError(node, unsupportedExpressionMessage(node));
 }
 
+/**
+ * chant#4011 — true when `fn` is provided by the JavaScript engine rather than
+ * written in JavaScript. A lexicon's own method (`Expression.prototype.toString`)
+ * is JavaScript source; `Function`, `Date.now` and `Array.prototype.join` are
+ * not. `Function.prototype.toString` prints a native function's body as
+ * `[native code]` (ECMA-262, NativeFunction), and is read off the prototype so
+ * a receiver cannot override it.
+ */
+function isNativeFunction(fn: unknown): boolean {
+  return typeof fn === "function" && /\{\s*\[native code\]\s*\}\s*$/.test(Function.prototype.toString.call(fn));
+}
+
+const HOST_PROTOTYPES = {
+  string: String.prototype,
+  number: Number.prototype,
+  boolean: Boolean.prototype,
+  array: Array.prototype,
+  object: Object.prototype,
+} as const;
+
+/**
+ * chant#4011 — why a host method `method`, read as `receiver[methodName]`,
+ * does not fold, or `undefined` when it does. It folds only when the
+ * receiver's type has a row in {@link FOLDABLE_HOST_METHODS} listing the name
+ * and `method` is the function that type's prototype carries under it. A
+ * function receiver (`[].constructor.from(...)`) has no row; neither does a
+ * host object such as a `Date`, which has its own prototype.
+ */
+function hostMethodRefusal(receiver: unknown, methodName: string, method: unknown): string | undefined {
+  let kind: keyof typeof HOST_PROTOTYPES | undefined;
+  if (typeof receiver === "string") kind = "string";
+  else if (typeof receiver === "number") kind = "number";
+  else if (typeof receiver === "boolean") kind = "boolean";
+  else if (Array.isArray(receiver)) kind = "array";
+  else if (typeof receiver === "object" && receiver !== null) kind = "object";
+  const listed =
+    kind !== undefined &&
+    FOLDABLE_HOST_METHODS[kind].has(methodName) &&
+    (HOST_PROTOTYPES[kind] as unknown as Record<string, unknown>)[methodName] === method;
+  if (listed) return undefined;
+  return (
+    `the host method \`.${methodName}(...)\` is not in the foldable table for a ${kind ?? typeof receiver} ` +
+    "receiver (chant#4011) — falls back to run"
+  );
+}
+
 /**
  * Fold a resource constructor call to its spec.
  *

package/src/fold/subset.test.ts

@@ -691,3 +691,34 @@ describe("findSubsetViolation — project-local calls (chant#2435)", () => {
     expect(() => findSubsetViolation(synthetic)).toThrow(/Cannot read|undefined|getSourceFile|getText/i);
   });
 });
+
+// chant#4011 — a refused method name is decidable from syntax, so EVL001 and
+// fold() refuse it together. Before the fix both accepted every case here.
+describe("subset — method names that reach Function or the host locale (#4011)", () => {
+  const cases = [
+    `[].constructor.constructor("return Date.now()").call()`,
+    `[].constructor.constructor("return process.env.HOME").call()`,
+    `"".__proto__.constructor.constructor("return Math.random()").call()`,
+    `(1234.5).toLocaleString()`,
+  ];
+  for (const expr of cases) {
+    test(expr, () => {
+      const source = `const bad = new Thing({ x: ${expr} });`;
+      const sourceFile = ts.createSourceFile("t.ts", source, ts.ScriptTarget.Latest, true);
+      const consts = collectConsts(sourceFile);
+      expect(() => foldResource(consts.get("bad") as ts.NewExpression, consts, [])).toThrow(FoldError);
+
+      const context: LintContext = { sourceFile, entities: [], filePath: "t.ts", lexicon: undefined };
+      expect(evl001NonLiteralExpressionRule.check(context)).toHaveLength(1);
+      const violation = findSubsetViolation((consts.get("bad") as ts.NewExpression).arguments![0]);
+      expect(violation?.message).toContain("chant#4011");
+    });
+  }
+
+  test("a listed method keeps passing EVL001", () => {
+    const source = `const ok = new Thing({ x: ["a", "b"].join(",") });`;
+    const sourceFile = ts.createSourceFile("t.ts", source, ts.ScriptTarget.Latest, true);
+    const context: LintContext = { sourceFile, entities: [], filePath: "t.ts", lexicon: undefined };
+    expect(evl001NonLiteralExpressionRule.check(context)).toHaveLength(0);
+  });
+});

package/src/fold/subset.ts

@@ -461,6 +461,98 @@ export function unsupportedExpressionMessage(node: ts.Node): string {
   return `unsupported expression: ${ts.SyntaxKind[node.kind]}`;
 }
 
+/**
+ * chant#4011 — S-CallMethod's closed table of HOST methods, by receiver type.
+ * PROVISIONAL until typescript-as-data narrows F-Eval-CallMethod to the same
+ * table (INTENTIUS/typescript-as-data#264; see the module doc's provisional path).
+ *
+ * Since #1966 `fold()` called any function-valued property on a real
+ * receiver, so `[].constructor.constructor("return Date.now()")` reached
+ * `Function` and a `[fold:fold]` file could put the clock, `process.env` or
+ * `Math.random()` in its output. A method the JavaScript engine provides
+ * (a native function) now folds only when it is listed here for the
+ * receiver's type AND is the very function that type's prototype carries, so
+ * an own property cannot shadow a listed name. Every entry is deterministic
+ * given its receiver and arguments: no callbacks (`map`, `filter`), no
+ * mutation (`push`, `sort`), and no `toLocale*` or `localeCompare`, whose
+ * answer follows the host's locale and time zone.
+ *
+ * A method defined by a lexicon package's own code (the github lexicon's
+ * `Expression.prototype.toString`) is not a host method and is not looked up
+ * here; it is the same class of package code as an eager intrinsic call.
+ */
+export const FOLDABLE_HOST_METHODS: {
+  readonly string: ReadonlySet<string>;
+  readonly number: ReadonlySet<string>;
+  readonly boolean: ReadonlySet<string>;
+  readonly array: ReadonlySet<string>;
+  readonly object: ReadonlySet<string>;
+} = {
+  string: new Set([
+    "at",
+    "charAt",
+    "charCodeAt",
+    "codePointAt",
+    "concat",
+    "endsWith",
+    "includes",
+    "indexOf",
+    "lastIndexOf",
+    "padEnd",
+    "padStart",
+    "repeat",
+    "replace",
+    "replaceAll",
+    "slice",
+    "split",
+    "startsWith",
+    "substring",
+    "toLowerCase",
+    "toString",
+    "toUpperCase",
+    "trim",
+    "trimEnd",
+    "trimStart",
+    "valueOf",
+  ]),
+  number: new Set(["toExponential", "toFixed", "toPrecision", "toString", "valueOf"]),
+  boolean: new Set(["toString", "valueOf"]),
+  array: new Set(["at", "concat", "flat", "includes", "indexOf", "join", "lastIndexOf", "slice", "toString"]),
+  object: new Set(["hasOwnProperty", "toString", "valueOf"]),
+};
+
+/**
+ * chant#4011 — method names `fold()` refuses on every receiver, lexicon
+ * objects included. These are the names that reach `Function` (`constructor`,
+ * and `call`/`apply`/`bind` on whatever it returns) or read the host locale.
+ * Unlike {@link FOLDABLE_HOST_METHODS}, which needs the receiver's runtime
+ * type, a name in this set is decidable from syntax, so EVL001 refuses it too.
+ */
+export const REFUSED_METHOD_NAMES: ReadonlySet<string> = new Set([
+  "constructor",
+  "call",
+  "apply",
+  "bind",
+  "toLocaleString",
+  "toLocaleDateString",
+  "toLocaleTimeString",
+  "toLocaleUpperCase",
+  "toLocaleLowerCase",
+  "localeCompare",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__",
+]);
+
+/** The refusal for a method name in {@link REFUSED_METHOD_NAMES}, shared by `fold()` and EVL001. */
+export function refusedMethodMessage(methodName: string): string {
+  return (
+    `method call \`.${methodName}(...)\` is not foldable: it reaches \`Function\` or the host locale, ` +
+    "so its result is not determined by the source (chant#4011) — falls back to run"
+  );
+}
+
 /**
  * Classify one object-literal member (`{ a: 1 }`'s `a: 1`, `{ ...x }`'s
  * `...x`, or a shorthand `{ a }`). Checks the key's shape before the
@@ -720,7 +812,14 @@ export function findSubsetViolation(
     // a same-file `new` used as a value (#1169). Accepted here regardless of
     // the intrinsics registry, unlike the two cases just above: nothing about
     // whether a method call folds depends on a lexicon's registration.
+    //
+    // chant#4011 — except a name `fold()` refuses on every receiver, which is
+    // decidable here. The per-type host table needs the receiver's value, so
+    // it stays on `fold()`'s side, in the direction F-Direction allows.
     if (ts.isPropertyAccessExpression(node.expression)) {
+      if (REFUSED_METHOD_NAMES.has(node.expression.name.text)) {
+        return violation(node, refusedMethodMessage(node.expression.name.text));
+      }
       const v = findSubsetViolation(node.expression.expression, intrinsics);
       if (v) return v;
       for (const arg of node.arguments) {