@intentius/chant 0.20.0 → 0.22.0

package/src/discovery/fold-import.test.ts

@@ -7,6 +7,7 @@ import { tryFoldFile, createFoldSession } from "./fold-import";
 import { isDeclarable } from "../declarable";
 import { isCompositeInstance } from "../composite";
 import { isAttrRefLike } from "../utils";
+import { isIntrinsic } from "../intrinsic";
 import { params as sharedParams } from "../params";
 import type { AttrRef } from "../attrref";
 import type { IntrinsicDef } from "../lexicon";
@@ -165,7 +166,28 @@ describe("tryFoldFile", () => {
 
     expect(result.ok).toBe(false);
     if (result.ok) return;
-    expect(result.reason).toContain("LocalStack");
+    // chant #1054 — locks in the ONE wording for "a call used as a value,
+    // not foldable" (../fold/subset.ts's `callExpressionMessage`), which
+    // `resolveCallExpression` now reuses instead of its own hand-written
+    // "call expression as a value" copy.
+    expect(result.reason).toBe('"stack" is not foldable: function call as a value is not foldable: LocalStack(...)');
+  });
+
+  test("falls back when a top-level export's callee isn't a plain identifier (chant #1054: same wording as any other call-as-a-value rejection)", async () => {
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        const builder = { build: (props: { name: string }) => ({ name: props.name }) };
+        export const stack = builder.build({ name: "x" });
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toBe('"stack" is not foldable: function call as a value is not foldable: builder.build(...)');
   });
 
   test("falls back when a prop value is not foldable", async () => {
@@ -286,6 +308,77 @@ describe("tryFoldFile", () => {
       DependsOn: "otherResource",
     });
   });
+
+  // chant #1054 — a destructured composite export's fallback reason used to
+  // embed `decl.node.getText()`: the ENTIRE call expression, which for a
+  // real multi-prop composite call is many lines, burying the real error
+  // after all of it. These lock in the fix: the reason names the binding(s)
+  // and the callee briefly instead, and stays on one line.
+  test("a destructured composite export whose source fails to resolve reports a brief, single-line reason naming the binding names and the callee", async () => {
+    await writeFile(
+      join(testDir, "composites.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        import { Composite } from ${JSON.stringify(compositePath)};
+        const Cluster = createResource("Test::Cluster", "gcp", {});
+        const NodePool = createResource("Test::NodePool", "gcp", {});
+        export const GkeCluster = Composite<{ name: string; location: string }>((props) => {
+          const cluster = new Cluster({ name: props.name });
+          const nodePool = new NodePool({ location: props.location });
+          return { cluster, nodePool };
+        }, "GkeCluster");
+      `,
+    );
+    const file = join(testDir, "cluster.ts");
+    await writeFile(
+      file,
+      `
+        import { GkeCluster } from "./composites";
+        export const { cluster, nodePool } = GkeCluster({
+          name: config.clusterName,
+          location: config.region,
+        });
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).not.toContain("\n");
+    expect(result.reason).toContain('"cluster, nodePool" (destructured from GkeCluster(...))');
+    expect(result.reason).toContain("unresolved identifier: config");
+    // The whole multi-line source is gone — the reason never reproduces the
+    // call's own argument list verbatim.
+    expect(result.reason).not.toContain("clusterName");
+  });
+
+  test("a destructured export whose source resolves but isn't an object still reports a brief, single-line reason", async () => {
+    await writeFile(
+      join(testDir, "factory.ts"),
+      `
+        export function StringFactory(props: { text: string }): string {
+          return props.text;
+        }
+      `,
+    );
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { StringFactory } from "./factory";
+        export const { length } = StringFactory({ text: "hello" });
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toBe(
+      '"length" (destructured from StringFactory(...)) is not foldable: not a composite call or object',
+    );
+  });
 });
 
 // chant #1020 (epic #1019) — cross-file resolution: an imported binding now
@@ -1024,3 +1117,809 @@ describe("tryFoldFile — build-time parameters (chant #1064)", () => {
     setBuildParams({});
   });
 });
+
+/**
+ * chant #1082 — registered authoring helpers, and constructor argument
+ * positions.
+ *
+ * Fixtures import chant-core's REAL helpers by absolute path (the convention
+ * every other suite in this file uses), which is also the second arm of the
+ * provenance check: a specifier that resolves inside chant-core's own tree
+ * counts as chant's own, exactly like the `@intentius/chant*` package
+ * specifier a real project writes.
+ */
+describe("tryFoldFile — registered authoring helpers (#1082)", () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-fold-import-helpers-test-${Date.now()}-${Math.random()}`);
+    await mkdir(testDir, { recursive: true });
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  /** Absolute path to the real component-authoring helpers (`phase`, `gate`, `stackOutput`). */
+  const componentPath = resolve(thisDir, "../components/component");
+  /** Absolute path to the real `output()` / `LexiconOutput`. */
+  const lexiconOutputPath = resolve(thisDir, "../lexicon-output");
+
+  test("a component authored with phase()/gate()/stackOutput() folds to the real plain data — zero module execution", async () => {
+    const file = join(testDir, "web.component.ts");
+    await writeFile(
+      file,
+      `
+        import { phase, gate, stackOutput } from ${JSON.stringify(componentPath)};
+        throw new Error("must never execute — sentinel for #1082 fold verification");
+        export const web = {
+          name: "web",
+          dependsOn: ["shared-foundation"],
+          deploy: [
+            phase("Apply", [
+              { kind: "cfn-deploy", stack: "web", inputs: { pVpcId: stackOutput("shared-foundation", "oVpcId") } },
+              gate("approve", { timeout: "24h" }),
+            ], { parallel: true }),
+          ],
+        };
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    // The revived value is what the real helpers return, not an envelope:
+    // `phase()`'s `{ phase, steps, parallel }`, `gate()`'s `{ kind: "gate", … }`,
+    // `stackOutput()`'s `{ stackOutput: { stack, name } }`.
+    expect(result.exportedValues.get("web")).toEqual({
+      name: "web",
+      dependsOn: ["shared-foundation"],
+      deploy: [
+        {
+          phase: "Apply",
+          parallel: true,
+          steps: [
+            {
+              kind: "cfn-deploy",
+              stack: "web",
+              inputs: { pVpcId: { stackOutput: { stack: "shared-foundation", name: "oVpcId" } } },
+            },
+            { kind: "gate", signalName: "approve", timeout: "24h" },
+          ],
+        },
+      ],
+    });
+  });
+
+  test("a nested (fan-out) phase folds — helper envelopes revive bottom-up", async () => {
+    const file = join(testDir, "fanout.component.ts");
+    await writeFile(
+      file,
+      `
+        import { phase } from ${JSON.stringify(componentPath)};
+        export const fanout = { deploy: [phase("Outer", [phase("Inner", [{ kind: "noop" }])])] };
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.exportedValues.get("fanout")).toEqual({
+      deploy: [{ phase: "Outer", steps: [{ phase: "Inner", steps: [{ kind: "noop" }] }] }],
+    });
+  });
+
+  test("a registered NAME imported from the project's own code does NOT fold — the allowlist is chant's, not the name's", async () => {
+    await writeFile(
+      join(testDir, "helpers.ts"),
+      `export function phase(name, steps) { return { phase: name, steps, mine: true }; }`,
+    );
+    const file = join(testDir, "web.component.ts");
+    await writeFile(
+      file,
+      `
+        import { phase } from "./helpers";
+        export const web = { deploy: [phase("Apply", [])] };
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain("./helpers");
+    expect(result.reason).toContain("not chant's own");
+  });
+
+  test("a registered name declared in the file itself does NOT fold — it is not an import at all", async () => {
+    const file = join(testDir, "local.component.ts");
+    await writeFile(
+      file,
+      `
+        function phase(name, steps) { return { phase: name, steps }; }
+        export const web = { deploy: [phase("Apply", [])] };
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain("is not a resolvable import");
+  });
+
+  test("an UNREGISTERED chant import called as a value still falls back — registration is per-helper, not per-module", async () => {
+    const file = join(testDir, "unregistered.component.ts");
+    await writeFile(
+      file,
+      `
+        import { inferArchetype } from ${JSON.stringify(componentPath)};
+        export const web = { archetype: inferArchetype({ deploy: [] }) };
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain("inferArchetype(...)");
+  });
+
+  test("output() folds against a REAL cross-file AttrRef, producing a genuine LexiconOutput", async () => {
+    await writeFile(
+      join(testDir, "defs.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        export const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });
+      `,
+    );
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { Bucket } from "./defs";
+        export const bucket = new Bucket({ name: "my-bucket" });
+      `,
+    );
+    const file = join(testDir, "outputs.ts");
+    await writeFile(
+      file,
+      `
+        import { output } from ${JSON.stringify(lexiconOutputPath)};
+        import { bucket } from "./resources";
+        export const oArn = bucket ? output(bucket.arn, "oArn") : undefined;
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    const oArn = result.exportedValues.get("oArn") as { outputName: string; sourceLexicon: string };
+    // A genuine LexiconOutput built from the real AttrRef — it read the ref's
+    // parent through its WeakRef to learn the lexicon, which is only possible
+    // with a live reference, never with a `{ __attrRef }` envelope.
+    expect(oArn.outputName).toBe("oArn");
+    expect(oArn.sourceLexicon).toBe("aws");
+  });
+
+  test("output() over a SAME-FILE resource reference falls back rather than wrapping a symbolic envelope", async () => {
+    await writeFile(
+      join(testDir, "defs.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        export const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });
+      `,
+    );
+    const file = join(testDir, "same-file-outputs.ts");
+    await writeFile(
+      file,
+      `
+        import { Bucket } from "./defs";
+        import { output } from ${JSON.stringify(lexiconOutputPath)};
+        const enabled = true;
+        export const bucket = new Bucket({ name: "my-bucket" });
+        export const oArn = enabled ? output(bucket.arn, "oArn") : undefined;
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    // `bucket.arn` folds to a `{ __attrRef }` envelope, and `LexiconOutput`'s
+    // constructor needs a real `AttrRef` (it derefs the parent to learn the
+    // lexicon). Constructing it from the envelope would silently produce a
+    // wrong output, so the whole file falls back to run instead.
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain("same-file resource reference");
+  });
+});
+
+describe("tryFoldFile — constructor argument positions (#1082)", () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-fold-import-ctorargs-test-${Date.now()}-${Math.random()}`);
+    await mkdir(testDir, { recursive: true });
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  /** A `(type, props)` constructor, structurally identical to the real AWS deploy-time `Parameter` (lexicons/aws/src/parameter.ts). */
+  async function writeParameterDef(): Promise<void> {
+    await writeFile(
+      join(testDir, "parameter.ts"),
+      `
+        import { DECLARABLE_MARKER } from ${JSON.stringify(resolve(thisDir, "../declarable"))};
+
+        export class Parameter {
+          constructor(type, options) {
+            this[DECLARABLE_MARKER] = true;
+            this.lexicon = "aws";
+            this.entityType = "AWS::CloudFormation::Parameter";
+            this.parameterType = type;
+            this.description = options?.description;
+            this.defaultValue = options?.defaultValue;
+          }
+        }
+      `,
+    );
+  }
+
+  test("`new Parameter(\"String\", {...})` folds — the props object need not be the first argument", async () => {
+    await writeParameterDef();
+    const file = join(testDir, "params.ts");
+    await writeFile(
+      file,
+      `
+        import { Parameter } from "./parameter";
+        throw new Error("must never execute — sentinel for #1082 fold verification");
+        export const pVpcId = new Parameter("AWS::EC2::VPC::Id", { description: "vpc id" });
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.entities).toHaveLength(1);
+    const [name, entity] = result.entities[0];
+    expect(name).toBe("pVpcId");
+    if (!isDeclarable(entity)) throw new Error("expected a Declarable");
+    // Both arguments reached the real constructor, in the right positions.
+    expect((entity as unknown as { parameterType: string }).parameterType).toBe("AWS::EC2::VPC::Id");
+    expect((entity as unknown as { description: string }).description).toBe("vpc id");
+  });
+
+  test("a constructor called with only a non-object argument folds too — no props object is invented", async () => {
+    await writeParameterDef();
+    const file = join(testDir, "params.ts");
+    await writeFile(
+      file,
+      `
+        import { Parameter } from "./parameter";
+        export const pName = new Parameter("String");
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    const [, entity] = result.entities[0];
+    expect((entity as unknown as { parameterType: string }).parameterType).toBe("String");
+    expect((entity as unknown as { description?: string }).description).toBeUndefined();
+  });
+
+  test("a non-foldable argument in any position still falls the file back to run", async () => {
+    await writeParameterDef();
+    const file = join(testDir, "params.ts");
+    await writeFile(
+      file,
+      `
+        import { Parameter } from "./parameter";
+        export const pName = new Parameter(computeType(), { description: "x" });
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain("computeType(...)");
+  });
+});
+
+/**
+ * chant #1044 — registered lexicon intrinsics in PLAIN-CALL form, end to end.
+ *
+ * The unit tests in ../fold/fold.test.ts cover the reducer's half (a call
+ * reduces to a `{__intrinsic, args}` envelope, executing nothing). These
+ * cover the other half: the envelope is revived by resolving the name
+ * through THIS FILE'S OWN imports and invoking the real function, so what
+ * lands in a resource's props is a genuine live intrinsic instance — the
+ * same object the run path would have built.
+ */
+describe("tryFoldFile — registered call-form intrinsics (#1044)", () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-fold-import-callintrinsic-test-${Date.now()}-${Math.random()}`);
+    await mkdir(testDir, { recursive: true });
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  const REF: IntrinsicDef = { name: "Ref", isTag: false, foldsAsCall: true, outputKey: "Test::Ref" };
+  const NOT_OPTED_IN: IntrinsicDef = { name: "Ref", isTag: false };
+
+  /** A plain-call intrinsic shaped exactly like aws's real `Ref`: a factory returning a class that implements the `Intrinsic` contract and resolves its target at `toJSON()` time. */
+  async function writeCallIntrinsicDefs(): Promise<void> {
+    await writeFile(
+      join(testDir, "intrinsics.ts"),
+      `
+        import { INTRINSIC_MARKER } from ${JSON.stringify(intrinsicPath)};
+
+        export class RefIntrinsic {
+          constructor(target) {
+            this[INTRINSIC_MARKER] = true;
+            this.target = target;
+          }
+          toJSON() {
+            return { "Test::Ref": typeof this.target === "string" ? this.target : this.target.logicalHint };
+          }
+        }
+
+        export function Ref(target) {
+          return new RefIntrinsic(target);
+        }
+
+        export const NS = { Region: "NS::Region" };
+      `,
+    );
+  }
+
+  test("an opted-in call folds end-to-end to the real intrinsic instance — zero module execution", async () => {
+    await writeCallIntrinsicDefs();
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        export const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });
+      `,
+    );
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { Bucket } from "./resources";
+        import { Ref } from "./intrinsics";
+        throw new Error("must never execute — sentinel for #1044 fold verification");
+        export const bucket = new Bucket({ name: Ref("environment") });
+      `,
+    );
+
+    const result = await tryFoldFile(file, [REF]);
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    const [, entity] = result.entities[0];
+    if (!isDeclarable(entity)) throw new Error("expected a Declarable");
+    const name = (entity as unknown as { props: { name: unknown } }).props.name;
+    // A genuine live instance built by the file's own `Ref`, not the
+    // `{ __intrinsic, args }` envelope the reducer produced internally.
+    expect((name as { toJSON(): unknown }).toJSON()).toEqual({ "Test::Ref": "environment" });
+  });
+
+  test("a call-form intrinsic folds inside a registered tag's interpolation, and a symbolic argument resolves through the file's own import", async () => {
+    await writeFile(
+      join(testDir, "intrinsics.ts"),
+      `
+        import { INTRINSIC_MARKER } from ${JSON.stringify(intrinsicPath)};
+        export class RefIntrinsic {
+          constructor(target) { this[INTRINSIC_MARKER] = true; this.target = target; }
+          toJSON() { return { "Test::Ref": this.target }; }
+        }
+        export function Ref(target) { return new RefIntrinsic(target); }
+        export class SubIntrinsic {
+          constructor(strings, values) { this[INTRINSIC_MARKER] = true; this.strings = strings; this.values = values; }
+          toJSON() {
+            let out = "";
+            for (let i = 0; i < this.strings.length; i++) {
+              out += this.strings[i];
+              if (i < this.values.length) out += JSON.stringify(this.values[i].toJSON ? this.values[i].toJSON() : this.values[i]);
+            }
+            return { "Test::Sub": out };
+          }
+        }
+        export function Sub(strings, ...values) { return new SubIntrinsic(strings, values); }
+        export const NS = { Region: "NS::Region" };
+      `,
+    );
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        export const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });
+      `,
+    );
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { Bucket } from "./resources";
+        import { Sub, Ref, NS } from "./intrinsics";
+        export const bucket = new Bucket({ name: Sub\`\${Ref(NS.Region)}-fn\` });
+      `,
+    );
+
+    const result = await tryFoldFile(file, [REF, { name: "Sub", isTag: true }]);
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    const [, entity] = result.entities[0];
+    if (!isDeclarable(entity)) throw new Error("expected a Declarable");
+    const name = (entity as unknown as { props: { name: unknown } }).props.name;
+    expect((name as { toJSON(): unknown }).toJSON()).toEqual({
+      "Test::Sub": `{"Test::Ref":"NS::Region"}-fn`,
+    });
+  });
+
+  test("a cross-file resource passed to an intrinsic call arrives as the SHARED live instance, not a re-imported copy", async () => {
+    await writeCallIntrinsicDefs();
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        export const Param = createResource("Test::Param", "aws", {});
+      `,
+    );
+    await writeFile(
+      join(testDir, "params.ts"),
+      `
+        import { Param } from "./resources";
+        export const environment = new Param({ logicalHint: "EnvParam" });
+      `,
+    );
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { Param } from "./resources";
+        import { environment } from "./params";
+        import { Ref } from "./intrinsics";
+        export const other = new Param({ name: Ref(environment) });
+      `,
+    );
+
+    const session = createFoldSession([REF]);
+    const paramsResult = await tryFoldFile(join(testDir, "params.ts"), [REF], session);
+    const result = await tryFoldFile(file, [REF], session);
+
+    expect(result.ok).toBe(true);
+    if (!result.ok || !paramsResult.ok) return;
+    const [, entity] = result.entities[0];
+    if (!isDeclarable(entity)) throw new Error("expected a Declarable");
+    const ref = (entity as unknown as { props: { name: { target: unknown } } }).props.name;
+    // Identity, not equality: the SAME object params.ts's own fold produced
+    // and discovery will collect. A second instance would serialize with no
+    // logical name at all (see planFoldTaint's doc).
+    expect(ref.target).toBe(paramsResult.exportedValues.get("environment"));
+  });
+
+  test("a REGISTERED intrinsic with no opt-in still falls the file back to run", async () => {
+    await writeCallIntrinsicDefs();
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        export const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });
+      `,
+    );
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { Bucket } from "./resources";
+        import { Ref } from "./intrinsics";
+        export const bucket = new Bucket({ name: Ref("environment") });
+      `,
+    );
+
+    const result = await tryFoldFile(file, [NOT_OPTED_IN]);
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain("function call as a value is not foldable: Ref(...)");
+  });
+
+  test("an opted-in NAME that this file never imported falls back — the registry is not permission to invoke a name", async () => {
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        export const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });
+      `,
+    );
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { Bucket } from "./resources";
+        export const bucket = new Bucket({ name: Ref("environment") });
+      `,
+    );
+
+    const result = await tryFoldFile(file, [REF]);
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain(`"Ref" is not a resolvable import`);
+  });
+
+  test("a same-file resource reference passed to an intrinsic call falls back rather than folding to the wrong value", async () => {
+    await writeCallIntrinsicDefs();
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        export const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });
+      `,
+    );
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { Bucket } from "./resources";
+        import { Ref } from "./intrinsics";
+        export const source = new Bucket({ name: "src" });
+        export const bucket = new Bucket({ name: Ref(source.arn) });
+      `,
+    );
+
+    const result = await tryFoldFile(file, [REF]);
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain("same-file resource reference");
+  });
+});
+
+/**
+ * chant #1063 — cross-file references into an ACTIVE LEXICON PACKAGE's
+ * exports.
+ *
+ * #1020 taught fold to follow an identifier into another module, but only
+ * through a relative/absolute specifier — a bare package specifier was
+ * skipped outright, so `Azure`, `GCP`, `S3Actions` and gitlab's `CI` all
+ * failed as "unresolved identifier" even though every one of them is a plain
+ * `as const` object the folder already handles. These tests install a real
+ * package into the fixture tree's own `node_modules` and drive the identical
+ * resolution a real `@intentius/chant-lexicon-azure` import takes: a genuine
+ * bare specifier, resolved by {@link fastResolveBareSpecifier} walking up to
+ * `<testDir>/node_modules`, then really imported.
+ *
+ * Every fixture package gets a UNIQUE name. `bareSpecifierPathCache` is
+ * process-wide and keyed by specifier alone (deliberately — see its doc), so
+ * two tests reusing one name would have the second silently resolve to the
+ * first's already-deleted directory.
+ */
+describe("tryFoldFile — active lexicon package exports (#1063)", () => {
+  let testDir: string;
+  let seq = 0;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-fold-import-lexpkg-test-${Date.now()}-${Math.random()}`);
+    await mkdir(testDir, { recursive: true });
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  /**
+   * Install a package into `<testDir>/node_modules/<name>` and return its
+   * bare specifier. `lexiconName` is what a build would list in
+   * `chant.config.ts`'s `lexicons`; the package name follows chant's one
+   * naming convention (`@intentius/chant-lexicon-<name>`), same as
+   * `loadPlugin()` uses.
+   */
+  async function installLexiconPackage(source: string): Promise<{ lexicon: string; specifier: string }> {
+    const lexicon = `fold1063x${seq++}${Date.now().toString(36)}`;
+    const specifier = `@intentius/chant-lexicon-${lexicon}`;
+    const dir = join(testDir, "node_modules", specifier);
+    await mkdir(dir, { recursive: true });
+    await writeFile(
+      join(dir, "package.json"),
+      JSON.stringify({ name: specifier, version: "0.0.0", type: "module", exports: { ".": "./index.js" } }),
+    );
+    await writeFile(join(dir, "index.js"), source);
+    return { lexicon, specifier };
+  }
+
+  /** A pseudo-parameter namespace shaped exactly like `lexicons/azure/src/pseudo.ts`'s `Azure`, plus a plain-data constants object and a callable export. */
+  const LEXICON_SOURCE = `
+    const INTRINSIC_MARKER = Symbol.for("chant.intrinsic");
+    class ArmPseudoParameter {
+      constructor(expression) {
+        this[INTRINSIC_MARKER] = true;
+        this.expression = expression;
+      }
+      toJSON() { return this.expression; }
+    }
+    export const ResourceGroupLocation = new ArmPseudoParameter("[resourceGroup().location]");
+    export const Azure = { ResourceGroupLocation };
+    export const CI = { CommitBranch: "$CI_COMMIT_BRANCH", DefaultBranch: "$CI_DEFAULT_BRANCH" };
+    export const S3Actions = { ReadOnly: ["s3:GetObject", "s3:ListBucket"] };
+    export function defaultTags(tags) { return tags; }
+  `;
+
+  test("a lexicon package's plain-data export resolves and folds when referenced as a value", async () => {
+    const { lexicon, specifier } = await installLexiconPackage(LEXICON_SOURCE);
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { CI, S3Actions } from ${JSON.stringify(specifier)};
+        throw new Error("must never execute — sentinel for #1063 fold verification");
+        export const branch = CI.CommitBranch;
+        export const rule = \`\${CI.CommitBranch} == \${CI.DefaultBranch}\`;
+        export const actions = S3Actions.ReadOnly;
+      `,
+    );
+
+    const result = await tryFoldFile(file, [], createFoldSession([], undefined, [lexicon]));
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.exportedValues.get("branch")).toBe("$CI_COMMIT_BRANCH");
+    // A template literal is the real test that the VALUE arrived, not a
+    // symbolic envelope: an envelope would stringify to "[object Object]".
+    expect(result.exportedValues.get("rule")).toBe("$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH");
+    expect(result.exportedValues.get("actions")).toEqual(["s3:GetObject", "s3:ListBucket"]);
+  });
+
+  test("a pseudo-parameter reached through the namespace stays the REAL live Intrinsic instance, prototype intact", async () => {
+    const { lexicon, specifier } = await installLexiconPackage(LEXICON_SOURCE);
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        export const Group = createResource("Test::Group", "azure", {});
+      `,
+    );
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { Azure } from ${JSON.stringify(specifier)};
+        import { Group } from "./resources";
+        export const group = new Group({ location: Azure.ResourceGroupLocation });
+      `,
+    );
+
+    const result = await tryFoldFile(file, [], createFoldSession([], undefined, [lexicon]));
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    const [, entity] = result.entities[0];
+    const location = (entity as unknown as { props: { location: unknown } }).props.location;
+    // Not a plain-object copy: the generic revive walk would have rebuilt it
+    // as `{ expression: … }` and dropped `toJSON`, which is what actually
+    // reaches the serializer.
+    expect(isIntrinsic(location)).toBe(true);
+    expect((location as { toJSON(): unknown }).toJSON()).toBe("[resourceGroup().location]");
+    // Identity: the very object the module exports, not a reconstruction —
+    // the same one a run-path import of this package would hand the file.
+    const mod = (await import(join(testDir, "node_modules", specifier, "index.js"))) as {
+      Azure: { ResourceGroupLocation: unknown };
+    };
+    expect(location).toBe(mod.Azure.ResourceGroupLocation);
+  });
+
+  test("a lexicon package NOT active for this build is not resolved", async () => {
+    const { specifier } = await installLexiconPackage(LEXICON_SOURCE);
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { CI } from ${JSON.stringify(specifier)};
+        export const branch = CI.CommitBranch;
+      `,
+    );
+
+    // The package is installed and importable — the ONLY thing missing is
+    // this build having loaded it as a lexicon.
+    const result = await tryFoldFile(file, [], createFoldSession([], undefined, ["aws"]));
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain("unresolved identifier: CI");
+  });
+
+  test("with no active lexicons at all, a bare specifier is skipped exactly as before", async () => {
+    const { specifier } = await installLexiconPackage(LEXICON_SOURCE);
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { CI } from ${JSON.stringify(specifier)};
+        export const branch = CI.CommitBranch;
+      `,
+    );
+
+    const result = await tryFoldFile(file);
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain("unresolved identifier: CI");
+  });
+
+  test("a non-lexicon package is never followed, even when it is installed right next to one that is", async () => {
+    const { lexicon } = await installLexiconPackage(LEXICON_SOURCE);
+    const vendorDir = join(testDir, "node_modules", "some-vendor-pkg");
+    await mkdir(vendorDir, { recursive: true });
+    await writeFile(
+      join(vendorDir, "package.json"),
+      JSON.stringify({ name: "some-vendor-pkg", version: "0.0.0", type: "module", exports: { ".": "./index.js" } }),
+    );
+    await writeFile(join(vendorDir, "index.js"), `export const SETTINGS = { region: "us-east-1" };`);
+
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { SETTINGS } from "some-vendor-pkg";
+        export const region = SETTINGS.region;
+      `,
+    );
+
+    const result = await tryFoldFile(file, [], createFoldSession([], undefined, [lexicon]));
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain("unresolved identifier: SETTINGS");
+  });
+
+  test("a lexicon package's CALLABLE export is not bound as an identifier value", async () => {
+    const { lexicon, specifier } = await installLexiconPackage(LEXICON_SOURCE);
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { defaultTags } from ${JSON.stringify(specifier)};
+        export const tags = defaultTags;
+      `,
+    );
+
+    const result = await tryFoldFile(file, [], createFoldSession([], undefined, [lexicon]));
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain("unresolved identifier: defaultTags");
+  });
+
+  test("process.env still rejects, with the build-parameter guidance, even with an active lexicon package in scope", async () => {
+    const { lexicon, specifier } = await installLexiconPackage(LEXICON_SOURCE);
+    const file = join(testDir, "main.ts");
+    await writeFile(
+      file,
+      `
+        import { CI } from ${JSON.stringify(specifier)};
+        export const branch = CI.CommitBranch;
+        export const region = process.env.AWS_REGION;
+      `,
+    );
+
+    const result = await tryFoldFile(file, [], createFoldSession([], undefined, [lexicon]));
+
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.reason).toContain(`ambient "process" read is not foldable`);
+  });
+});