@intentius/chant 0.21.0 → 0.23.0

package/dist/lint/rule.d.ts

@@ -1,4 +1,5 @@
 import type * as ts from "typescript";
+import type { IntrinsicDef } from "../lexicon.js";
 /**
  * Severity level for lint diagnostics
  */
@@ -55,6 +56,19 @@ export interface LintContext {
     filePath: string;
     /** Optional lexicon context (undefined for core rules) */
     lexicon?: string;
+    /**
+     * chant #1106 — the active lexicons' registered intrinsics (`Ref`,
+     * `GetAtt`, ...), threaded down from `runLint` (../lint/engine.ts) so a
+     * rule built on the shared `../fold/subset.ts` predicate
+     * (`findSubsetViolation`/`checkObjectMember`, used by EVL001) gets the
+     * SAME answer `fold()` does for a registered, opted-in call. Mirrors how
+     * `discover()` has threaded `IntrinsicDef[]` into the fold path since
+     * #1039/#1105. Undefined when the caller hasn't resolved a project's
+     * lexicons (a bare unit test constructing a `LintContext` directly, for
+     * instance) — subset.ts then falls back to its pre-#1044 answer: every
+     * call is a violation.
+     */
+    intrinsics?: readonly IntrinsicDef[];
 }
 /**
  * Configuration value for a rule: either a severity string or a [severity, options] tuple

package/dist/lint/rule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rule.d.ts","sourceRoot":"","sources":["../../src/lint/rule.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,OAAO,GAAG,aAAa,GAAG,UAAU,CAAC;AAE5E;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,gDAAgD;IAChD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,SAAS,GAAG,eAAe,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,CAAC;IAC9E,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,CAAC,QAAQ,GAAG,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,QAAQ,EAAE,QAAQ,CAAC;IACnB,4BAA4B;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc,EAAE,CAAC;IACjF,gDAAgD;IAChD,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,EAAE,CAAC;CACvC"}
+{"version":3,"file":"rule.d.ts","sourceRoot":"","sources":["../../src/lint/rule.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,OAAO,GAAG,aAAa,GAAG,UAAU,CAAC;AAE5E;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,gDAAgD;IAChD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,SAAS,GAAG,eAAe,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,CAAC;IAC9E,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,CAAC,QAAQ,GAAG,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,QAAQ,EAAE,QAAQ,CAAC;IACnB,4BAA4B;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc,EAAE,CAAC;IACjF,gDAAgD;IAChD,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,EAAE,CAAC;CACvC"}

package/dist/serializer-walker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer-walker.d.ts","sourceRoot":"","sources":["../src/serializer-walker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM/C,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IACzD,mEAAmE;IACnE,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1C,+DAA+D;IAC/D,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC;CAChF;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,EACpC,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAyDT"}
+{"version":3,"file":"serializer-walker.d.ts","sourceRoot":"","sources":["../src/serializer-walker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM/C,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IACzD,mEAAmE;IACnE,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1C,+DAA+D;IAC/D,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC;CAChF;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,OAAO,EACd,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,EACpC,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAuET"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/build.ts

@@ -170,6 +170,14 @@ export interface BuildOptions {
    */
   intrinsics?: IntrinsicDef[];
 
+  /**
+   * chant #1063 — the lexicon names loaded for this build. Passed straight
+   * through to {@link DiscoveryOptions.lexicons} in `./discovery/index`;
+   * ignored unless {@link fold} is set. The CLI populates this from
+   * `options.plugins.map(p => p.name)`.
+   */
+  lexicons?: readonly string[];
+
   /**
    * chant #1045 Phase 2 — opt-in: run-fallback files (or, when {@link fold}
    * isn't set, every file) execute together, isolated, in one sandboxed
@@ -513,6 +521,7 @@ export async function build(
   const discoveryResult = await discover(path, {
     fold: options?.fold,
     intrinsics: options?.intrinsics,
+    lexicons: options?.lexicons,
     sandbox: options?.sandbox,
     buildParams: options?.buildParams,
   });

package/src/cli/build-params-cli.test.ts

@@ -0,0 +1,139 @@
+/**
+ * Tests for the CLI-layer build-time-parameter helpers factored out by chant
+ * #1108 (`parseParamFlags`/`resolveCliBuildParams`) — the exact sequence
+ * `chant build` (`./commands/build.ts`'s `buildCommand`) runs, now shared with
+ * the component deploy driver (`./handlers/run.ts`, `./handlers/build.ts`'s
+ * generate mode) so both resolve `--param`/`--params-file`/a declared `env`
+ * mapping/`chant.config.ts`'s `buildParams` defaults identically. Precedence
+ * itself is `../build-params.ts`'s `resolveBuildParams`'s responsibility
+ * (see `../build-params.test.ts`) — these tests cover the CLI-specific glue:
+ * flag parsing, `--params-file` reading, error formatting, and logging.
+ */
+import { describe, test, expect, vi } from "vitest";
+import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { parseParamFlags, resolveCliBuildParams } from "./build-params-cli";
+import type { BuildParamsConfig } from "../build-params";
+
+describe("parseParamFlags", () => {
+  test("undefined/empty input yields undefined (matches resolveBuildParams's 'no cli input' shape)", () => {
+    expect(parseParamFlags(undefined)).toBeUndefined();
+    expect(parseParamFlags([])).toBeUndefined();
+  });
+
+  test("parses repeated name=value flags into a flat record", () => {
+    expect(parseParamFlags(["tier=production", "replicas=3"])).toEqual({
+      tier: "production",
+      replicas: "3",
+    });
+  });
+
+  test("a value containing '=' keeps everything after the first '=' (only the first splits)", () => {
+    expect(parseParamFlags(["url=https://example.com?a=b"])).toEqual({
+      url: "https://example.com?a=b",
+    });
+  });
+
+  test("a flag with no '=' becomes an empty-string value", () => {
+    expect(parseParamFlags(["flag-only"])).toEqual({ "flag-only": "" });
+  });
+});
+
+describe("resolveCliBuildParams", () => {
+  test("cli beats params-file beats a declared env mapping beats the default — the exact chant build precedence", () => {
+    const defs: BuildParamsConfig = { tier: { type: "string", default: "light", env: "TIER_ENV" } };
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    try {
+      const result = resolveCliBuildParams(defs, { cli: { tier: "production" } });
+      expect(result).toEqual({
+        success: true,
+        provenance: [{ name: "tier", value: "production", source: "cli" }],
+        errors: [],
+      });
+    } finally {
+      errorSpy.mockRestore();
+    }
+  });
+
+  test("logs every resolved parameter as '[param] name = value (source)'", () => {
+    const defs: BuildParamsConfig = { tier: { type: "string", default: "light" } };
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    try {
+      resolveCliBuildParams(defs, {});
+      const logged = errorSpy.mock.calls.map((call) => String(call[0]));
+      expect(logged.some((line) => line.includes("[param] tier") && line.includes("light") && line.includes("default"))).toBe(true);
+    } finally {
+      errorSpy.mockRestore();
+    }
+  });
+
+  test("no declared params → success with empty provenance and no logging", () => {
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    try {
+      const result = resolveCliBuildParams(undefined, {});
+      expect(result).toEqual({ success: true, provenance: [], errors: [] });
+      expect(errorSpy).not.toHaveBeenCalled();
+    } finally {
+      errorSpy.mockRestore();
+    }
+  });
+
+  test("an unresolved required parameter is a formatted error, not a thrown exception", () => {
+    const defs: BuildParamsConfig = { tier: { type: "string" } };
+    const result = resolveCliBuildParams(defs, {});
+    expect(result.success).toBe(false);
+    expect(result.provenance).toEqual([]);
+    expect(result.errors.some((e) => e.includes('"tier"') && e.includes("--param"))).toBe(true);
+  });
+
+  test("an enum violation is a formatted error naming the parameter and the offending value", () => {
+    const defs: BuildParamsConfig = { tier: { type: "string", enum: ["light", "production"] } };
+    const result = resolveCliBuildParams(defs, { cli: { tier: "bogus" } });
+    expect(result.success).toBe(false);
+    expect(result.errors.some((e) => e.includes('"tier"') && e.includes("bogus"))).toBe(true);
+  });
+
+  test("an unknown --param name is a formatted error", () => {
+    const defs: BuildParamsConfig = { tier: { type: "string", default: "light" } };
+    const result = resolveCliBuildParams(defs, { cli: { nonexistent: "x" } });
+    expect(result.success).toBe(false);
+    expect(result.errors.some((e) => e.includes("nonexistent") && e.includes("--param"))).toBe(true);
+  });
+
+  describe("--params-file", () => {
+    let dir: string;
+
+    test("reads and resolves values from a JSON file (second precedence, after --param)", () => {
+      dir = mkdtempSync(join(tmpdir(), "chant-build-params-cli-test-"));
+      try {
+        const file = join(dir, "params.json");
+        writeFileSync(file, JSON.stringify({ tier: "from-file", env: "from-file-env" }));
+        const defs: BuildParamsConfig = {
+          tier: { type: "string", default: "light" },
+          env: { type: "string", default: "dev" },
+        };
+
+        const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+        try {
+          const result = resolveCliBuildParams(defs, { cli: { tier: "from-cli" }, paramsFile: file });
+          expect(result.success).toBe(true);
+          const byName = new Map(result.provenance.map((p) => [p.name, p]));
+          expect(byName.get("tier")).toEqual({ name: "tier", value: "from-cli", source: "cli" });
+          expect(byName.get("env")).toEqual({ name: "env", value: "from-file-env", source: "params-file" });
+        } finally {
+          errorSpy.mockRestore();
+        }
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+
+    test("an unreadable/unparsable --params-file is a formatted error naming the path, not a thrown exception", () => {
+      const defs: BuildParamsConfig = { tier: { type: "string", default: "light" } };
+      const result = resolveCliBuildParams(defs, { paramsFile: "/nonexistent/path/params.json" });
+      expect(result.success).toBe(false);
+      expect(result.errors.some((e) => e.includes("--params-file") && e.includes("/nonexistent/path/params.json"))).toBe(true);
+    });
+  });
+});

package/src/cli/build-params-cli.ts

@@ -0,0 +1,107 @@
+import { readFileSync } from "fs";
+import { resolve } from "path";
+import { resolveBuildParams, type BuildParamsConfig } from "../build-params";
+import type { BuildParamProvenance } from "../provenance";
+import { formatError, formatInfo } from "./format";
+
+/**
+ * Shared CLI-layer wiring for chant #1064's build-time parameters, factored
+ * out (chant #1108) so every command that discovers project source before
+ * running it resolves `chant.config.ts`'s declared `buildParams` the exact
+ * same way: `chant build` (`../commands/build.ts`'s `buildCommand`), the
+ * component deploy driver (`./handlers/run.ts`'s `chant run --components`
+ * local + `--temporal` paths), and generate mode (`./handlers/build.ts`'s
+ * `chant build --components --generate <lexicon>`).
+ *
+ * Before #1108, only `buildCommand` ran this sequence — `chant run
+ * --components` never resolved `--param`/`--params-file`/a declared `env`
+ * mapping at all, so a `*.component.ts` file reading `params.<name>`
+ * (`@intentius/chant/params`) always saw `{}`, no matter what a CI job
+ * exported into the environment. See ../build-params.ts's module doc for the
+ * full precedence rules this wraps.
+ */
+
+/** Parse repeated `--param name=value` flags into a flat `{ name: value }` record — the raw (unvalidated) strings {@link resolveCliBuildParams} resolves against a project's declared `buildParams`. `undefined` when no `--param` flag was given, matching `resolveBuildParams`'s "no cli input" shape. */
+export function parseParamFlags(entries?: string[]): Record<string, string> | undefined {
+  if (!entries?.length) return undefined;
+  return Object.fromEntries(
+    entries.map((entry) => {
+      const eq = entry.indexOf("=");
+      return eq === -1 ? [entry, ""] : [entry.slice(0, eq), entry.slice(eq + 1)];
+    }),
+  );
+}
+
+/** Inputs {@link resolveCliBuildParams} needs from a parsed CLI invocation — the `--param`/`--params-file` half of {@link resolveBuildParams}'s `BuildParamsInput` (the `env` half is always `process.env`, resolved internally). */
+export interface CliBuildParamsArgs {
+  /** Already-parsed `--param name=value` flags (see {@link parseParamFlags}), or the CLI's already-typed `Record<string,string>` (`chant build`'s own flag parsing does this itself — see `./handlers/build.ts`). */
+  cli?: Record<string, string>;
+  /** `--params-file <path>` — a JSON file of `{ "name": value }` values, read and parsed here. */
+  paramsFile?: string;
+}
+
+export interface CliBuildParamsResolution {
+  success: boolean;
+  /** Every successfully resolved parameter. Empty when the project declares none, or when `success` is `false`. */
+  provenance: BuildParamProvenance[];
+  /** `formatError`-wrapped messages, ready to print as-is. Empty when `success` is `true`. */
+  errors: string[];
+}
+
+/**
+ * Resolve this invocation's declared build-time parameters (`chant.config.ts`'s
+ * `buildParams`) against `args`/the process environment, and log each
+ * resolved value — the identical resolution + logging sequence `chant build`
+ * runs (`../commands/build.ts`'s `buildCommand`), factored out so every other
+ * command that discovers project source runs it too (chant #1108).
+ *
+ * A resolution failure (an unknown `--param`/`--params-file` name, a missing
+ * required value, a type/enum mismatch, or an unreadable `--params-file`) is
+ * returned as `{ success: false, errors }` — never thrown — so the caller can
+ * print each message and exit non-zero exactly like a build error, matching
+ * chant #1064's acceptance criterion that this never surfaces as a thrown
+ * error from inside user source.
+ *
+ * On success, every resolved parameter is logged via `console.error` as
+ * `[param] <name> = <value> (<source>)` — unconditional, not gated on
+ * `--verbose`, so a build's environment-varying inputs are always visible,
+ * the same way #1022's fold decisions are.
+ */
+export function resolveCliBuildParams(
+  buildParamsConfig: BuildParamsConfig | undefined,
+  args: CliBuildParamsArgs,
+): CliBuildParamsResolution {
+  const errors: string[] = [];
+
+  let fromFile: Record<string, unknown> | undefined;
+  if (args.paramsFile) {
+    try {
+      fromFile = JSON.parse(readFileSync(resolve(args.paramsFile), "utf-8"));
+    } catch (err) {
+      errors.push(
+        formatError({
+          message: `Failed to read/parse --params-file "${args.paramsFile}": ${err instanceof Error ? err.message : String(err)}`,
+        }),
+      );
+    }
+  }
+
+  const resolution = resolveBuildParams(buildParamsConfig, {
+    cli: args.cli,
+    fromFile,
+    env: process.env,
+  });
+  for (const message of resolution.errors) {
+    errors.push(formatError({ message }));
+  }
+
+  if (errors.length > 0) {
+    return { success: false, provenance: [], errors };
+  }
+
+  for (const p of resolution.provenance) {
+    console.error(formatInfo(`[param] ${p.name} = ${JSON.stringify(p.value)} (${p.source})`));
+  }
+
+  return { success: true, provenance: resolution.provenance, errors: [] };
+}

package/src/cli/commands/build.ts

@@ -1,13 +1,13 @@
 import { build } from "../../build";
 import { loadChantConfig, resolveOwnershipMarker, resolveFoldEnabled, resolveSandboxEnabled } from "../../config";
-import { resolveBuildParams } from "../../build-params";
+import { resolveCliBuildParams } from "../build-params-cli";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
 import { runPostSynthChecks } from "../../lint/post-synth";
 import { loadPolicyChecks } from "../../lint/policy";
 import { sortedJsonReplacer } from "../../utils";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format";
-import { writeFileSync, mkdirSync, readFileSync } from "fs";
+import { writeFileSync, mkdirSync } from "fs";
 import { resolve, dirname, join, relative } from "path";
 import { watchDirectory, formatTimestamp, formatChangedFiles } from "../watch";
 
@@ -155,44 +155,24 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // as fold, resolved independently.
   const sandbox = resolveSandboxEnabled(config, options.sandbox);
 
-  // #1064 — resolve declared build-time parameters (chant.config.ts's
-  // buildParams) against this invocation's --param/--params-file/declared
-  // env mapping, BEFORE calling build() — a resolution failure (an unknown
-  // name, a missing required value, a type/enum mismatch) is reported as a
-  // chant build error naming the parameter, never a thrown error from inside
-  // user source (which is what loomster's hand-rolled `tierFromEnv()`-style
-  // validators did before migrating to this mechanism).
-  let paramsFileContent: Record<string, unknown> | undefined;
-  if (options.paramsFile) {
-    try {
-      paramsFileContent = JSON.parse(readFileSync(resolve(options.paramsFile), "utf-8"));
-    } catch (err) {
-      errors.push(
-        formatError({
-          message: `Failed to read/parse --params-file "${options.paramsFile}": ${err instanceof Error ? err.message : String(err)}`,
-        }),
-      );
-    }
-  }
-  const paramsResolution = resolveBuildParams(config.buildParams, {
+  // #1064 (factored into ../build-params-cli.ts's resolveCliBuildParams by
+  // #1108, so the component deploy driver runs the identical sequence) —
+  // resolve declared build-time parameters (chant.config.ts's buildParams)
+  // against this invocation's --param/--params-file/declared env mapping,
+  // BEFORE calling build() — a resolution failure (an unknown name, a
+  // missing required value, a type/enum mismatch) is reported as a chant
+  // build error naming the parameter, never a thrown error from inside user
+  // source (which is what loomster's hand-rolled `tierFromEnv()`-style
+  // validators did before migrating to this mechanism). Also logs every
+  // resolved value (`[param] name = value (source)`) on success.
+  const paramsResolution = resolveCliBuildParams(config.buildParams, {
     cli: options.params,
-    fromFile: paramsFileContent,
-    env: process.env,
+    paramsFile: options.paramsFile,
   });
-  for (const message of paramsResolution.errors) {
-    errors.push(formatError({ message }));
-  }
-  if (errors.length > 0) {
+  if (!paramsResolution.success) {
+    errors.push(...paramsResolution.errors);
     return { success: false, resourceCount: 0, fileCount: 0, errors, warnings };
   }
-  // #1064 — build-provenance visibility: report every resolved build-time
-  // parameter (name, value, and which source won it) the same
-  // unconditional-log-not-gated-on---verbose way #1022's fold decisions are
-  // reported just below, so a build's environment-varying inputs are as
-  // visible as its fold-vs-run choices.
-  for (const p of paramsResolution.provenance) {
-    console.error(formatInfo(`[param] ${p.name} = ${JSON.stringify(p.value)} (${p.source})`));
-  }
 
   // #1039 — thread each loaded plugin's registered intrinsics (e.g. AWS's
   // `Sub`) through to the fold path, so a file using a registered intrinsic
@@ -201,6 +181,14 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // any), hence the guard.
   const intrinsics = options.plugins?.flatMap((plugin) => plugin.intrinsics?.() ?? []) ?? [];
 
+  // #1063 — the same loaded plugins, by NAME, are this build's allowlist for
+  // following a bare import specifier into a lexicon package (so `Azure`,
+  // `GCP`, `S3Actions`, `CI` fold as values). A plugin's `name` is the
+  // lexicon name `loadPlugin()` was called with, which is exactly what
+  // `@intentius/chant-lexicon-<name>` was imported from — see
+  // ../plugins.ts and fold-import.ts's `lexiconPackageName`.
+  const lexicons = options.plugins?.map((plugin) => plugin.name) ?? [];
+
   // Run the build
   const result = await build(infraPath, options.serializers, undefined, {
     ownership,
@@ -208,6 +196,7 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
     fold,
     sandbox,
     intrinsics,
+    lexicons,
     buildParams: paramsResolution.provenance,
   });
 

package/src/cli/commands/check-lexicon-examples.ts

@@ -32,6 +32,7 @@ import { join } from "path";
 import { build } from "../../build";
 import { findInfraFiles } from "../../discovery/files";
 import { detectLexicons } from "../../detectLexicon";
+import { loadChantConfig } from "../../config";
 import { loadPlugins } from "../plugins";
 
 export interface ExampleBuildResult {
@@ -64,7 +65,21 @@ export async function checkExamplesBuild(lexiconDir: string): Promise<ExampleBui
       const files = await findInfraFiles(srcDir);
       if (files.length === 0) continue;
 
-      const lexiconNames = await detectLexicons(files);
+      // An example's own chant.config.{ts,json} (living beside src/, not in
+      // it) can declare `lexicons` explicitly — the same precedence real
+      // `chant build` gives it via resolveProjectLexicons() in ../plugins.ts.
+      // Needed for examples like helm's HelmRender ones, whose composite
+      // legitimately produces entities tagged with a lexicon (e.g. "k8s")
+      // that no source-file import mentions — detection from imports alone
+      // can never see it, so the example built with only its "own" lexicon's
+      // plugin and silently dropped every entity of the other, undetectable
+      // one. Detection from source-file imports (unchanged) remains the
+      // fallback for the many examples with no declared `lexicons` list.
+      const { config: exampleConfig } = await loadChantConfig(join(examplesDir, entry.name));
+      const lexiconNames =
+        exampleConfig.lexicons && exampleConfig.lexicons.length > 0
+          ? exampleConfig.lexicons
+          : await detectLexicons(files);
       if (lexiconNames.length === 0) {
         results.push({
           example: entry.name,

package/src/cli/commands/lint.test.ts

@@ -332,6 +332,80 @@ describe("plugin integration", () => {
   });
 });
 
+/**
+ * chant #1106 — `runLint`'s EVL rules now receive the active lexicons'
+ * registered intrinsics (threaded from `loadAllPluginRules`'s
+ * `plugin.intrinsics?.()`, mirroring how `../commands/build.ts` gathers the
+ * same set for the fold path). Before this, `chant lint` flagged
+ * `Ref(...)` — a registered, opted-in call-form intrinsic (aws's
+ * `lexicons/aws/src/plugin.ts`) that `chant build --fold` folds cleanly —
+ * as EVL001, purely because EVL001's shared `../../fold/subset.ts`
+ * predicate never saw the registry. These use the real aws lexicon plugin
+ * (already a workspace dependency) rather than a mock, so the registration
+ * this asserts against is the one that actually ships.
+ */
+describe("lintCommand — EVL/intrinsic registry convergence (#1106)", () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-lint-intrinsics-test-${Date.now()}-${Math.random()}`);
+    await mkdir(testDir, { recursive: true });
+    process.env.NO_COLOR = "1";
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+    delete process.env.NO_COLOR;
+  });
+
+  test("a registered, opted-in intrinsic call (aws's Ref) is not flagged as EVL001", async () => {
+    await writeFile(join(testDir, "chant.config.json"), JSON.stringify({ lexicons: ["aws"] }));
+    await writeFile(
+      join(testDir, "index.ts"),
+      `
+import { Ref } from "@intentius/chant-lexicon-aws";
+
+class Queue {
+  constructor(_props: Record<string, unknown>) {}
+}
+
+export const environment = "prod";
+export const queue = new Queue({ name: Ref(environment) });
+      `,
+    );
+
+    const result = await lintCommand({ path: testDir, format: "stylish" });
+
+    expect(result.diagnostics.filter((d) => d.ruleId === "EVL001")).toHaveLength(0);
+  });
+
+  test("an unregistered call is still flagged as EVL001 in the same project", async () => {
+    await writeFile(join(testDir, "chant.config.json"), JSON.stringify({ lexicons: ["aws"] }));
+    await writeFile(
+      join(testDir, "index.ts"),
+      `
+import { Ref } from "@intentius/chant-lexicon-aws";
+
+class Queue {
+  constructor(_props: Record<string, unknown>) {}
+}
+
+function makeName(): string {
+  return "generated";
+}
+
+export const queue = new Queue({ name: makeName() });
+      `,
+    );
+
+    const result = await lintCommand({ path: testDir, format: "stylish" });
+
+    const evl001 = result.diagnostics.filter((d) => d.ruleId === "EVL001");
+    expect(evl001).toHaveLength(1);
+    expect(evl001[0].message).toContain("statically evaluable");
+  });
+});
+
 describe("lintCommand — project-root config resolution (scoped lint)", () => {
   let testDir: string;
 

package/src/cli/commands/lint.ts

@@ -3,6 +3,7 @@ import { readFileSync, writeFileSync, readdirSync, statSync } from "fs";
 import { execFileSync } from "child_process";
 import { runLint, parseDisableComments } from "../../lint/engine";
 import type { LintRule, LintDiagnostic, LintFix } from "../../lint/rule";
+import type { IntrinsicDef } from "../../lexicon";
 import { loadPlugins, resolveProjectLexicons } from "../plugins";
 import { formatStylish, formatJson, formatSarif } from "../reporters/stylish";
 import { loadLocalRules } from "../../lint/rule-loader";
@@ -86,8 +87,17 @@ export async function loadPluginRules(
 
 /**
  * Load all lint rules: core COR/EVL rules, then lexicon plugin rules.
+ *
+ * Also returns the active lexicons' registered intrinsics (chant #1106) —
+ * gathered here because this is where the project's lexicon plugins are
+ * already resolved and loaded (`loadPlugins`), the same set `../commands/
+ * build.ts` reads `plugin.intrinsics?.()` off of for the fold path. Handed
+ * back alongside `rules` so `lintCommand` can thread it into every
+ * `runLint` call without loading plugins a second time.
  */
-async function loadAllPluginRules(projectPath: string): Promise<Map<string, LintRule>> {
+async function loadAllPluginRules(
+  projectPath: string,
+): Promise<{ rules: Map<string, LintRule>; intrinsics: IntrinsicDef[] }> {
   const rules = new Map<string, LintRule>();
 
   // Load core COR/EVL rules directly
@@ -106,6 +116,13 @@ async function loadAllPluginRules(projectPath: string): Promise<Map<string, Lint
   // Load only project lexicon plugins (no "chant" injection)
   const plugins = await loadPlugins(lexiconNames);
 
+  // chant #1106 — the same plugins' registered intrinsics (`Ref`, `GetAtt`,
+  // ...), so EVL001 can answer "does this call fold?" exactly like fold()
+  // does instead of flagging every call as a violation. A plugin's
+  // `intrinsics` is an optional extension (not every lexicon defines any),
+  // hence the guard.
+  const intrinsics = plugins.flatMap((plugin) => plugin.intrinsics?.() ?? []);
+
   for (const plugin of plugins) {
     if (plugin.lintRules) {
       for (const r of plugin.lintRules()) {
@@ -127,7 +144,7 @@ async function loadAllPluginRules(projectPath: string): Promise<Map<string, Lint
     rules.set(r.id, r);
   }
 
-  return rules;
+  return { rules, intrinsics };
 }
 
 /**
@@ -428,7 +445,14 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
   const hasOverrides = config.overrides && config.overrides.length > 0;
 
   // Load all rules from lexicon plugins (core "chant" + lexicon-specific)
-  let allRules = await loadAllPluginRules(projectRoot);
+  const loaded = await loadAllPluginRules(projectRoot);
+  let allRules = loaded.rules;
+  // chant #1106 — the active lexicons' registered intrinsics, threaded into
+  // every runLint() call below so EVL001 answers exactly like fold() does
+  // for a registered, opted-in call (`Ref(...)`, `GetAtt(...)`) instead of
+  // flagging it. Computed once here regardless of which branch below runs,
+  // same as `allRules`.
+  const intrinsics = loaded.intrinsics;
 
   // Merge in any config-level plugin rules (custom .ts rule files)
   if (config.plugins && config.plugins.length > 0) {
@@ -443,7 +467,7 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
   let diagnostics: LintDiagnostic[];
   let suppressed: Array<LintDiagnostic & { reason?: string }> = [];
   if (options.rules) {
-    const result = await runLint(files, options.rules, undefined);
+    const result = await runLint(files, options.rules, undefined, intrinsics);
     diagnostics = result.diagnostics;
     suppressed = result.suppressed;
   } else if (hasOverrides) {
@@ -451,13 +475,13 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
     for (const file of files) {
       const relativePath = relative(projectRoot, file);
       const { rules: fileRules, ruleOptions } = getDefaultRules(projectRoot, relativePath, allRules);
-      const result = await runLint([file], fileRules, ruleOptions);
+      const result = await runLint([file], fileRules, ruleOptions, intrinsics);
       diagnostics.push(...result.diagnostics);
       suppressed.push(...result.suppressed);
     }
   } else {
     const { rules, ruleOptions } = getDefaultRules(projectRoot, undefined, allRules);
-    const result = await runLint(files, rules, ruleOptions);
+    const result = await runLint(files, rules, ruleOptions, intrinsics);
     diagnostics = result.diagnostics;
     suppressed = result.suppressed;
   }
@@ -491,7 +515,7 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
 
     // Re-lint after fixes to get updated diagnostics
     if (options.rules) {
-      const postResult = await runLint(files, options.rules, undefined);
+      const postResult = await runLint(files, options.rules, undefined, intrinsics);
       diagnostics = postResult.diagnostics;
       suppressed = postResult.suppressed;
     } else if (hasOverrides) {
@@ -500,13 +524,13 @@ export async function lintCommand(options: LintOptions): Promise<LintResult> {
       for (const file of files) {
         const relativePath = relative(projectRoot, file);
         const { rules: fileRules, ruleOptions } = getDefaultRules(projectRoot, relativePath, allRules);
-        const postResult = await runLint([file], fileRules, ruleOptions);
+        const postResult = await runLint([file], fileRules, ruleOptions, intrinsics);
         diagnostics.push(...postResult.diagnostics);
         suppressed.push(...postResult.suppressed);
       }
     } else {
       const { rules, ruleOptions } = getDefaultRules(projectRoot, undefined, allRules);
-      const postResult = await runLint(files, rules, ruleOptions);
+      const postResult = await runLint(files, rules, ruleOptions, intrinsics);
       diagnostics = postResult.diagnostics;
       suppressed = postResult.suppressed;
     }