@intentius/chant 0.21.0 → 0.23.0

package/src/discovery/fold-import.ts

@@ -7,6 +7,7 @@ import { createRequire } from "node:module";
 import { isDeclarable, type Declarable } from "../declarable";
 import { isCompositeInstance, type CompositeInstance } from "../composite";
 import { isAttrRefLike } from "../utils";
+import { isIntrinsic } from "../intrinsic";
 import {
   collectConsts,
   foldResource,
@@ -19,7 +20,8 @@ import {
   type FoldedHelperCall,
   type SymbolicValue,
 } from "../fold/fold";
-import { isChantOwnedSpecifier } from "../fold/foldable-helpers";
+import { isChantOwnedSpecifier, isFoldableHelperName } from "../fold/foldable-helpers";
+import { briefNodeText, callExpressionMessage } from "../fold/subset";
 import { importModule } from "./import";
 import type { IntrinsicDef } from "../lexicon";
 import type { BuildParamValue } from "../build-params";
@@ -72,16 +74,29 @@ export type FoldedEntity = [name: string, entity: Declarable | CompositeInstance
 export type FoldFileResult =
   | {
       ok: true;
+      /**
+       * The `Declarable`/`CompositeInstance` subset of {@link
+       * FoldFileResult.exportedValues} — how many resources this file
+       * contributed, for the `[fold:fold] x.ts — N resource(s)` decision
+       * line. chant #1112: NOT what discovery collects from. Collection
+       * reads `exportedValues`, so that `./collect.ts` stays the single
+       * owner of which exports become entities — see {@link
+       * applyResolvedValue}.
+       */
       entities: FoldedEntity[];
       /**
        * chant #1020 — EVERY exported name's fully-resolved value, not just
-       * the `Declarable`/`CompositeInstance` ones already in `entities`: a
-       * plain value folds too (a string, a number, a plain object), it just
-       * contributes nothing to `entities` (see {@link applyResolvedValue}).
-       * This is the table another file's cross-file reference resolves
-       * against — see `buildExternals` below and the module doc on
-       * `planFoldTaint` for why a resource/composite value here MUST be the
-       * exact same object every referencing file sees.
+       * the `Declarable`/`CompositeInstance` ones also listed in `entities`:
+       * a plain value folds too (a string, a number, a plain object). A
+       * successful fold means `scanExports` recognized every export the file
+       * has (anything else disqualifies the whole file), so this IS the
+       * file's complete export namespace — the same table the run path gets
+       * from actually importing it. Two consumers: `discover()` passes it
+       * straight to `collectEntities` (chant #1112), and another file's
+       * cross-file reference resolves against it — see `buildExternals`
+       * below and the module doc on `planFoldTaint` for why a
+       * resource/composite value here MUST be the exact same object every
+       * referencing file sees.
        */
       exportedValues: Map<string, unknown>;
       /**
@@ -171,14 +186,77 @@ export interface FoldSession {
    * doesn't use build-time parameters pays nothing extra here.
    */
   readonly buildParams?: Readonly<Record<string, BuildParamValue>>;
+  /**
+   * chant #1063 — the exact package specifiers of the lexicons LOADED for
+   * this build (`@intentius/chant-lexicon-aws`, …), derived from the lexicon
+   * names the build already resolved (`resolveProjectLexicons` ->
+   * `loadPlugins`, see ../cli/plugins.ts). This is the entire allowlist
+   * {@link buildExternals} will follow a bare import specifier into — see
+   * {@link activeLexiconPackage} for why the set is matched by TEXT and
+   * built from names the build already knows, rather than by resolving
+   * specifiers to find out what they are.
+   *
+   * Empty when the caller supplied no lexicon list, which disables
+   * lexicon-package resolution entirely rather than falling back to
+   * something more permissive: "an active lexicon of this build" is the
+   * boundary, and a build that can't say what its lexicons are hasn't
+   * established one.
+   */
+  readonly lexiconPackages: ReadonlySet<string>;
+  /**
+   * chant #1093 — this build asked for the #1045 sandbox
+   * (`DiscoveryOptions.sandbox`, `chant build --sandbox`), so fold must not
+   * import or invoke a module the CLI process isn't already trusted to
+   * execute. See {@link isTrustedExecutableBinding} for what that allowlist
+   * is and {@link sandboxedExecutionRefusal} for what happens at each site
+   * that would otherwise execute one.
+   *
+   * `false` (the default, plain `--fold`) leaves every resolution path
+   * exactly as it was: fold already trusts the code enough to fall back to
+   * an in-process `importModule` when it can't fold something, so gating
+   * only the fold half would buy nothing there.
+   */
+  readonly sandbox: boolean;
+}
+
+/**
+ * chant #1063 — the package specifier a lexicon NAME (`"aws"`, `"gitlab"`)
+ * is installed under. The one naming convention the whole CLI already
+ * depends on: `loadPlugin(name)` imports exactly this
+ * (../cli/plugins.ts), `detectLexicons` scans source for exactly this
+ * (../detectLexicon.ts), and `chant init` writes exactly this into
+ * package.json.
+ */
+export function lexiconPackageName(lexiconName: string): string {
+  return `@intentius/chant-lexicon-${lexiconName}`;
 }
 
-/** Create a fresh, empty {@link FoldSession}. */
+/**
+ * Create a fresh, empty {@link FoldSession}.
+ *
+ * @param lexicons - chant #1063: the lexicon NAMES active for this build
+ *   (`["aws", "k8s"]`). Converted to package specifiers via
+ *   {@link lexiconPackageName}; see {@link FoldSession.lexiconPackages}.
+ * @param sandbox - chant #1093: this build asked for the #1045 sandbox, so
+ *   fold may not import or invoke anything outside the trusted allowlist —
+ *   see {@link FoldSession.sandbox}.
+ */
 export function createFoldSession(
   intrinsics: readonly IntrinsicDef[] = [],
   buildParams?: Readonly<Record<string, BuildParamValue>>,
+  lexicons: readonly string[] = [],
+  sandbox = false,
 ): FoldSession {
-  return { intrinsics, cache: new Map(), stack: [], importCache: new Map(), resolvePathCache: new Map(), buildParams };
+  return {
+    intrinsics,
+    cache: new Map(),
+    stack: [],
+    importCache: new Map(),
+    resolvePathCache: new Map(),
+    buildParams,
+    lexiconPackages: new Set(lexicons.map(lexiconPackageName)),
+    sandbox,
+  };
 }
 
 /**
@@ -805,6 +883,100 @@ function paramsModulePath(): string | null {
   return paramsModulePathMemo;
 }
 
+/**
+ * chant #1063 — is `specifier` a bare import of a package that is an ACTIVE
+ * LEXICON of this build? Returns the specifier itself when so, `undefined`
+ * otherwise.
+ *
+ * Three deliberate restrictions, each of which is the point rather than an
+ * omission:
+ *
+ *  - **Text only, no resolution.** The answer is a `Set.has` on a set built
+ *    from the lexicon names the build ALREADY resolved before discovery ran
+ *    (`resolveProjectLexicons` -> `loadPlugins`). Nothing is probed, read, or
+ *    resolved to decide whether a specifier is in scope — so an import of
+ *    some unrelated package costs a string comparison and is then left alone,
+ *    never resolved "just to find out what it is". That matters here more
+ *    than anywhere: `resolveModulePath`'s bare branch can fall through to
+ *    `createRequire(fromFile).resolve(specifier)`, measured at up to ~361s
+ *    for the first resolution of a genuinely new bare specifier in a process
+ *    (see {@link bareSpecifierPathCache}/{@link fastResolveBareSpecifier} —
+ *    this exact class of cost regressed twice during chant#1020).
+ *
+ *  - **Exact package specifier, no subpaths.** `@intentius/chant-lexicon-aws`
+ *    matches; `@intentius/chant-lexicon-aws/actions` does not. Every lexicon
+ *    re-exports its whole public surface from its barrel and every example
+ *    imports it that way, so subpaths buy nothing — and they would cost
+ *    something real: {@link fastResolveBareSpecifier} only recognizes a
+ *    package ROOT (it looks for `<node_modules>/<specifier>/package.json`),
+ *    so a subpath specifier falls through to exactly the slow
+ *    `createRequire().resolve()` path this restriction exists to avoid.
+ *
+ *  - **Lexicons of THIS build only.** Not "any `@intentius/chant-lexicon-*`
+ *    package on disk", and emphatically not "any bare specifier". A lexicon
+ *    the build did not load is as out of scope as `node:fs`.
+ */
+function activeLexiconPackage(specifier: string, lexiconPackages: ReadonlySet<string>): string | undefined {
+  return lexiconPackages.has(specifier) ? specifier : undefined;
+}
+
+/**
+ * chant #1063 — resolve one named import binding against an active lexicon
+ * package's REAL exports, for {@link buildExternals}.
+ *
+ * The lexicon module is imported (through the session-wide
+ * {@link FoldSession.importCache}, so at most one real `import()` per package
+ * per build) and the requested export read straight off it. That is the same
+ * module object the run path gets — `importModule` is a plain dynamic
+ * `import()` with no cache-busting — so what fold captures here is not a
+ * reconstruction of the lexicon's data but the identical value, down to
+ * object identity for `Azure.ResourceGroupLocation`-style singletons. It is
+ * also the same two-step (resolve path, then import) that
+ * `resolveImportedExport` has always used to reach a lexicon's constructors
+ * and intrinsic functions; the only thing new is that a plain DATA export is
+ * now reachable too.
+ *
+ * Callable exports are deliberately excluded. A lexicon's functions — its
+ * resource classes, composite factories, intrinsic implementations — already
+ * have dedicated resolution paths that know how to INVOKE them
+ * (`resolveResourceEntity`, `resolveCallExpression`, `reviveFoldedValue`), and
+ * binding them as plain identifier values here would widen what folds in ways
+ * this issue neither needs nor measured: none of the references #1063 exists
+ * to unblock (`Azure`, `GCP`, `S3Actions`, gitlab's `CI`) is a function.
+ *
+ * Returns `undefined` — never throws — for a package that isn't an active
+ * lexicon, an export the package doesn't have, a callable export, or an
+ * import that fails. The binding is then simply absent from `externals`,
+ * exactly as before, and `fold()`'s ordinary "unresolved identifier" failure
+ * still fires if the name is actually referenced.
+ */
+async function resolveActiveLexiconExport(
+  binding: ImportBinding,
+  fromFile: string,
+  session: FoldSession,
+): Promise<{ value: unknown } | undefined> {
+  if (!activeLexiconPackage(binding.specifier, session.lexiconPackages)) return undefined;
+
+  let modulePath: string;
+  try {
+    modulePath = resolveModulePathMemoized(binding.specifier, fromFile, session.resolvePathCache);
+  } catch {
+    return undefined;
+  }
+
+  let mod: Record<string, unknown>;
+  try {
+    mod = await importModuleMemoized(modulePath, session.importCache);
+  } catch {
+    return undefined;
+  }
+
+  if (!(binding.imported in mod)) return undefined;
+  const value = mod[binding.imported];
+  if (typeof value === "function") return undefined;
+  return { value };
+}
+
 // ─────────────────────────────────────────────────────────────────────────
 // Resolution: given the scan + import map, compute the REAL runtime value
 // (Declarable | CompositeInstance) each foldable export would have had if
@@ -867,6 +1039,16 @@ interface ResolveCtx {
    * {@link resolveModulePathMemoized} with this map.
    */
   resolvePathCache: Map<string, string>;
+  /**
+   * chant #1063 — this build's active lexicon PACKAGE specifiers (see
+   * {@link FoldSession.lexiconPackages}). Threaded down here, not just used
+   * in `buildExternals`, because chant #1093's trust check
+   * ({@link isTrustedExecutableBinding}) needs the same allowlist at every
+   * site that imports and executes a module.
+   */
+  lexiconPackages: ReadonlySet<string>;
+  /** chant #1093 — see {@link FoldSession.sandbox}. */
+  sandbox: boolean;
 }
 
 /** `{ value }` when `node`'s shape was recognized and resolved (value may itself be `undefined`/`null` — e.g. an optional composite member that wasn't created); `undefined` when the shape isn't one the live resolver understands (a plain literal, etc.) — callers fall back to the original, unchanged handling for that shape. */
@@ -962,15 +1144,28 @@ async function resolveLiveValue(node: ts.Expression, ctx: ResolveCtx): Promise<L
  * `isDeclarable`/`isCompositeInstance` value for a top-level export).
  */
 async function resolveCallExpression(node: ts.CallExpression, ctx: ResolveCtx): Promise<unknown> {
+  // chant #1054 — reuses ../fold/subset's `callExpressionMessage` (the SAME
+  // builder `fold()` throws with for a call used as a prop value) rather
+  // than a hand-written "call expression as a value" copy: the two used to
+  // say different things for the identical rejection, which silently broke
+  // any tooling grouping fallback reasons by text.
   if (!ts.isIdentifier(node.expression)) {
-    throw cheapError(`call expression as a value is not foldable: ${node.expression.getText()}(...)`);
+    throw cheapError(callExpressionMessage(node));
   }
   const calleeName = node.expression.text;
   const binding = ctx.imports.get(calleeName);
   if (!binding) {
-    throw cheapError(`call expression as a value is not foldable: ${calleeName}(...)`);
+    throw cheapError(callExpressionMessage(node));
   }
 
+  // chant #1093 — THE gap this check exists for. Invoking the callee runs
+  // project code (the factory body, and its whole module's top level) in the
+  // CLI's own process; under --sandbox that has to happen in the child
+  // instead, so refuse here and let the file fall back to the sandboxed run
+  // path. See {@link sandboxedExecutionRefusal}.
+  const refusal = sandboxedExecutionRefusal(binding, ctx, calleeName, "composite factory");
+  if (refusal) throw cheapError(refusal);
+
   let modulePath: string;
   try {
     modulePath = resolveModulePathMemoized(binding.specifier, ctx.file, ctx.resolvePathCache);
@@ -1007,6 +1202,22 @@ async function resolveCallExpression(node: ts.CallExpression, ctx: ResolveCtx):
     throw cheapError(`"${binding.imported}" from "${binding.specifier}" is not a function`);
   }
 
+  // chant #1112 — ONE rule for a registered authoring helper's arguments,
+  // applied at BOTH sites that can invoke one. `reviveHelperCall` (the
+  // nested-value site, #1082) already revives a helper's arguments with
+  // `requireLiveRefs`, because a helper reads THROUGH its ref (`output()`
+  // derefs the `WeakRef` parent) and a look-alike `{__attrRef}` envelope
+  // makes it produce a wrong result rather than none. This site — a
+  // top-level `export const oArn = output(bucket.Arn, "oArn")` — took the
+  // composite-factory rule (`false`) instead, which is right for a factory
+  // (its props keep the envelope, and the serializer's own walker resolves
+  // it) and wrong for a helper. It went unnoticed while the resulting
+  // `LexiconOutput` was being discarded anyway; with the export namespace
+  // now collected in full, a same-file `output(...)` would reach the
+  // serializer holding an inert envelope where the run path has a real
+  // reference. Rejected here instead, which falls the file back to run —
+  // absent output, never a wrong one.
+  const helperArgs = isFoldableHelperName(calleeName);
   const args: unknown[] = [];
   for (const argNode of node.arguments) {
     const live = await resolveLiveValue(argNode, ctx);
@@ -1017,7 +1228,7 @@ async function resolveCallExpression(node: ts.CallExpression, ctx: ResolveCtx):
     args.push(
       live !== undefined
         ? live.value
-        : await reviveFoldedValue(fold(argNode, ctx.consts, ctx.intrinsics, ctx.externals), ctx, false),
+        : await reviveFoldedValue(fold(argNode, ctx.consts, ctx.intrinsics, ctx.externals), ctx, helperArgs),
     );
   }
 
@@ -1025,17 +1236,23 @@ async function resolveCallExpression(node: ts.CallExpression, ctx: ResolveCtx):
 }
 
 /**
- * Record one exported name's fully-resolved value: into `entities` when
- * it's a real `Declarable`/`CompositeInstance` (`collectEntities`, and
- * therefore serialization, only cares about these), and — chant #1020 —
- * unconditionally into `exportedValues` too, so a plain value (a string, a
- * number, a plain object, `undefined`/`null`) is still available for
- * ANOTHER file's cross-file reference to this export, exactly as it would
- * be if this file were actually imported and its real `exports` object read
- * directly. A plain value contributing nothing to `entities` isn't a
- * failure: the run path's real `exports` object would contain it too, and
- * `collectEntities` already silently ignores a non-Declarable/array/
- * CompositeInstance export the same way (see enumerateEntries, ../collect.ts).
+ * Record one exported name's fully-resolved value: unconditionally into
+ * `exportedValues` (chant #1020) — the file's export namespace, which is
+ * what discovery hands to `collectEntities` and what another file's
+ * cross-file reference resolves against — and, additionally, into `entities`
+ * when the value is a real `Declarable`/`CompositeInstance`.
+ *
+ * chant #1112 — `entities` is a REPORTING subset, not a filter. It used to
+ * be the only thing discovery passed on, which made this function a second
+ * owner of the "which export becomes an entity" decision; it had one fewer
+ * case than the real owner (`enumerateEntries`, ../collect.ts), so a
+ * `LexiconOutput` export folded fine and was then thrown away, and the
+ * template silently lost its `Outputs` section. Discovery now passes
+ * `exportedValues` — the whole namespace, exactly like the run path's real
+ * `exports` object — and `collectEntities` filters it, so nothing here can
+ * fall behind what collection understands. What `entities` still answers is
+ * "how many resources did this file contribute", for the `[fold:fold] x.ts —
+ * N resource(s)` decision line.
  */
 function applyResolvedValue(
   name: string,
@@ -1089,6 +1306,14 @@ async function resolveImportedExport(name: string, ctx: ResolveCtx): Promise<unk
     throw cheapError(`"${name}" is not a resolvable import`);
   }
 
+  // chant #1093 — reached for an intrinsic tag and for a symbolic chain's root
+  // (`AWS.StackName`), both of which are resolved BY NAME out of the file's own
+  // imports: nothing guarantees the module behind that name is a lexicon's.
+  // `reviveHelperCall` checks chant-ownership before it gets here; this covers
+  // the paths that don't.
+  const refusal = sandboxedExecutionRefusal(binding, ctx, name, "import");
+  if (refusal) throw cheapError(refusal);
+
   let modulePath: string;
   try {
     modulePath = resolveModulePathMemoized(binding.specifier, ctx.file, ctx.resolvePathCache);
@@ -1161,7 +1386,17 @@ async function reviveFoldedValue(value: FoldedValue, ctx: ResolveCtx, requireLiv
   // destroying the very identity #1020 exists to preserve. Passed through
   // completely unchanged, exactly like `resolveCallExpression`'s own
   // `live.value` passthrough for a composite-call argument.
-  if (isAttrRefLike(value) || isDeclarable(value) || isCompositeInstance(value)) {
+  // chant #1063 adds the third kind of real object cross-file resolution can
+  // now put here: a live `Intrinsic` instance read off an active lexicon
+  // package (`Azure.ResourceGroupLocation`, `GCP.ProjectId` — see
+  // `resolveActiveLexiconExport`). Same hazard, same fix: the generic walk
+  // below would rebuild it as a plain `{}` copy, dropping the prototype that
+  // carries `toJSON()` and so serializing `{}` where the run path emits
+  // `[resourceGroup().location]`. `isIntrinsic` keys off
+  // `Symbol.for("chant.intrinsic")` (../intrinsic.ts), a GLOBAL symbol, so it
+  // holds across separately-loaded copies of chant-core the way a bare
+  // `instanceof` would not.
+  if (isAttrRefLike(value) || isDeclarable(value) || isCompositeInstance(value) || isIntrinsic(value)) {
     return value;
   }
 
@@ -1279,6 +1514,15 @@ async function reviveHelperCall(call: FoldedHelperCall, ctx: ResolveCtx): Promis
  * pathological cold-resolution cost chant#1020 measured (see
  * {@link fastResolveBareSpecifier}), and a bare specifier chant publishes is
  * already covered by the text arm.
+ *
+ * Not the same question as chant#1093's {@link isTrustedExecutableBinding}
+ * below, and deliberately not shared with it: this one asks "may this NAME be
+ * invoked as one of chant's registered authoring helpers", and a text match
+ * is the right answer for it — a project that shadows `@intentius/chant` in
+ * its own `node_modules` gets its own copy of `output()` invoked either way,
+ * fold or run, so fold cannot diverge from run by trusting the text here.
+ * #1093's question is "may this module execute in the CLI's process at all",
+ * where a specifier the project controls the text of proves nothing.
  */
 function isChantOwnedHelperBinding(binding: ImportBinding, ctx: ResolveCtx): boolean {
   if (isChantOwnedSpecifier(binding.specifier)) return true;
@@ -1293,6 +1537,89 @@ function isChantOwnedHelperBinding(binding: ImportBinding, ctx: ResolveCtx): boo
   return targetPath === root || targetPath.startsWith(root + sep);
 }
 
+/**
+ * chant #1093 — the closed allowlist of modules fold may import AND EXECUTE
+ * in the CLI's own process when the #1045 sandbox is active. Exactly two
+ * arms, and neither of them trusts text the project controls:
+ *
+ *  1. **An ACTIVE lexicon package of this build** — matched against
+ *     {@link FoldSession.lexiconPackages}, a closed set built from the
+ *     lexicon names the BUILD resolved and `loadPlugins` already imported
+ *     (../cli/plugins.ts), not from anything the file under fold says.
+ *  2. **chant-core's own executing tree** — the specifier is RESOLVED and the
+ *     resulting path checked against {@link chantCoreRoot}. A text match is
+ *     not enough here: `@intentius/chant` and `@intentius/chant-lexicon-evil`
+ *     are both strings an untrusted repo can write into its own source and
+ *     back with its own `node_modules` directory, and
+ *     {@link isChantOwnedSpecifier} would accept either. Resolution happens
+ *     before the decision rather than after, so an allowed binding pays
+ *     exactly the resolution it was about to pay anyway (the memoized one —
+ *     see {@link resolveModulePathMemoized}); a bare specifier that isn't
+ *     even chant-shaped is rejected on text alone, so no arbitrary bare
+ *     specifier is ever resolved here (chant#1020's cold-resolution cost).
+ *
+ * This is deliberately the boundary chant #1045 drew: "the boundary is around
+ * executing PROJECT SOURCE, which is the untrusted input" — not around chant
+ * itself or the lexicon packages, which the CLI has already imported and
+ * executed in its own process before discovery starts, to get the serializers
+ * and lint rules it cannot run without. Fold reaching the same already-loaded
+ * module (the identical un-cache-busted `import()` of the identical resolved
+ * path) adds no execution the process wasn't already performing.
+ *
+ * Everything else is out: a sibling project file, a project-local helper
+ * module, an arbitrary npm dependency, a lexicon this build didn't load. A
+ * build that supplied no lexicon list keeps only arm 2, rather than falling
+ * back to something more permissive — the same stance
+ * {@link FoldSession.lexiconPackages} takes for #1063.
+ */
+function isTrustedExecutableBinding(binding: ImportBinding, ctx: ResolveCtx): boolean {
+  if (activeLexiconPackage(binding.specifier, ctx.lexiconPackages) !== undefined) return true;
+  // Only a chant-shaped or project-relative specifier is worth resolving; any
+  // other bare specifier is untrusted by definition, and resolving it to find
+  // that out would cost the pathological cold `require.resolve` (chant#1020).
+  if (!isProjectFileSpecifier(binding.specifier) && !isChantOwnedSpecifier(binding.specifier)) return false;
+  let targetPath: string;
+  try {
+    targetPath = resolveModulePathMemoized(binding.specifier, ctx.file, ctx.resolvePathCache);
+  } catch {
+    return false;
+  }
+  const root = chantCoreRoot();
+  return targetPath === root || targetPath.startsWith(root + sep);
+}
+
+/**
+ * chant #1093 — the one-line fold-fallback reason for a resolution that would
+ * import and execute an untrusted module in the CLI's own process, or
+ * `undefined` when the import may proceed (the sandbox wasn't asked for, or
+ * the module is on {@link isTrustedExecutableBinding}'s allowlist).
+ *
+ * A refusal is not a failure to fold something folder-shaped — the shape is
+ * perfectly foldable and folds fine under plain `--fold`. It is a deliberate
+ * demotion: the file falls back to the run path, and under `--sandbox` the
+ * run path is the sandboxed child (`./index.ts` queues every run-fallback
+ * file for `./sandbox/run.ts`). So the factory/constructor/intrinsic still
+ * executes, with the same arguments, in the same module graph as the rest of
+ * that file — just behind Node's Permission Model and a scrubbed environment
+ * instead of inside the CLI. Coverage drops; the boundary holds.
+ *
+ * @param what - What the binding is being resolved AS, for the message
+ *   ("composite factory", "constructor", …).
+ */
+function sandboxedExecutionRefusal(
+  binding: ImportBinding,
+  ctx: ResolveCtx,
+  name: string,
+  what: string,
+): string | undefined {
+  if (!ctx.sandbox) return undefined;
+  if (isTrustedExecutableBinding(binding, ctx)) return undefined;
+  return (
+    `${what} "${name}" is imported from "${binding.specifier}", which is neither chant's own nor an active lexicon — ` +
+    `under --sandbox it is executed in the sandboxed child, not in this process`
+  );
+}
+
 /**
  * chant-core's own module root — `packages/core/src` in this repo,
  * `<pkg>/dist` in a published install — derived from THIS module's location.
@@ -1378,6 +1705,14 @@ async function resolveResourceEntity(
     return { ok: false, reason: `constructor "${typeName}" for "${name}" is not a resolvable import` };
   }
 
+  // chant #1093 — a resource class is a lexicon export in every corpus entry
+  // today, but nothing forces that: `new Thing(...)` where `Thing` comes from
+  // a project file (or an arbitrary dependency) would import and run that
+  // module here, in the CLI's process. Same refusal as the composite-factory
+  // path above.
+  const refusal = sandboxedExecutionRefusal(binding, ctx, typeName, "constructor");
+  if (refusal) return { ok: false, reason: refusal };
+
   let modulePath: string;
   try {
     modulePath = resolveModulePathMemoized(binding.specifier, ctx.file, ctx.resolvePathCache);
@@ -1443,6 +1778,18 @@ function describeFoldFailure(err: unknown, ctx: ResolveCtx): string {
   return err.message;
 }
 
+/**
+ * chant #1054 — a short, single-line label for a destructured export's
+ * source expression, for a fold fallback reason: the callee plus `(...)`
+ * for the common composite-call source (`GkeCluster(...)`), or a brief,
+ * bounded rendering of whatever else it is otherwise. Never the source's own
+ * `getText()` — for a real composite call that's the entire multi-line
+ * argument list.
+ */
+function describeDestructureSource(node: ts.Expression): string {
+  return ts.isCallExpression(node) ? `${briefNodeText(node.expression)}(...)` : briefNodeText(node);
+}
+
 /** Build a located `FoldError`'s formatted "line:col - message" string anchored at `node` — for a cross-file failure detected here in fold-import.ts (an import cycle, a name genuinely absent from the target module's exports) rather than inside `fold()` itself. */
 function locatedMessage(node: ts.Node, message: string): string {
   const { line, column } = locate(node);
@@ -1585,10 +1932,36 @@ async function buildExternals(
     }
 
     if (!isProjectFileSpecifier(binding.specifier)) {
-      // Every other bare specifier (a lexicon/vendor package) is left alone
-      // here, exactly as before #1064: it resolves lazily, through the
-      // pre-existing `importModule` mechanism, only once a constructor/
-      // composite-factory/intrinsic tag actually consumes it.
+      // chant #1063 — a bare specifier naming one of THIS BUILD's active
+      // lexicon packages resolves to that package's real export, so a plain
+      // data export a lexicon publishes (`Azure`/`GCP`'s pseudo-parameter
+      // namespaces, AWS's `S3Actions`, gitlab's `CI`) is an ordinary
+      // identifier value here rather than fold's most common remaining
+      // "unresolved identifier" failure. See
+      // {@link resolveActiveLexiconExport} for the allowlist, the no-cold-
+      // resolution rule, and why callable exports stay out.
+      //
+      // No `liveSources` edge is recorded for what comes back, unlike the
+      // project-file case just below. `liveSources` (chant #1044) exists so
+      // that a folded file which captured ANOTHER FILE's objects is
+      // invalidated when that file is forced back to run — a fold/run
+      // disagreement about identity. A lexicon package has no such duality:
+      // it is not a discovered source file, `planFoldTaint` never considers
+      // it (it filters to the discovered `files` set), it never falls back to
+      // run, and both paths reach it through the identical un-cache-busted
+      // `import()` of the identical resolved path — so the object fold
+      // captures IS the object the run path holds. There is nothing for the
+      // two sides to disagree about, hence nothing to taint.
+      const lexiconExport = await resolveActiveLexiconExport(binding, file, session);
+      if (lexiconExport) {
+        externals.set(localName, lexiconExport.value);
+        continue;
+      }
+      // Every other bare specifier (a non-lexicon vendor package, a lexicon
+      // this build didn't load) is left alone here, exactly as before #1064:
+      // it resolves lazily, through the pre-existing `importModule`
+      // mechanism, only once a constructor/composite-factory/intrinsic tag
+      // actually consumes it.
       continue;
     }
     let targetPath: string;
@@ -1710,6 +2083,8 @@ async function tryFoldFileCore(file: string, session: FoldSession): Promise<Fold
       crossFileFailures: failures,
       importCache: session.importCache,
       resolvePathCache: session.resolvePathCache,
+      lexiconPackages: session.lexiconPackages,
+      sandbox: session.sandbox,
     };
 
     const entities: FoldedEntity[] = [];
@@ -1736,18 +2111,26 @@ async function tryFoldFileCore(file: string, session: FoldSession): Promise<Fold
 
       if (decl.kind === "destructure") {
         let value: unknown;
+        // chant #1054 — identify the destructured export by its BINDING
+        // NAMES and the source's callee (`"cluster, nodePool" (destructured
+        // from GkeCluster(...))`), never `decl.node.getText()`: for a real
+        // composite call that's the entire multi-line source, which buries
+        // the actual error after it and breaks any line-oriented consumer of
+        // `[fold:run]` output.
+        const boundNames = decl.elements.map((el) => el.bindingName).join(", ");
+        const source = describeDestructureSource(decl.node);
         try {
           value = (await resolveDeclaratorValue(decl.node, ctx)).value;
         } catch (err) {
           return {
             ok: false,
-            reason: `destructured export from "${decl.node.getText()}" is not foldable: ${describeFoldFailure(err, ctx)}`,
+            reason: `"${boundNames}" (destructured from ${source}) is not foldable: ${describeFoldFailure(err, ctx)}`,
           };
         }
         if (!isIndexableObject(value)) {
           return {
             ok: false,
-            reason: `destructured export from "${decl.node.getText()}" is not foldable (not a composite call or object)`,
+            reason: `"${boundNames}" (destructured from ${source}) is not foldable: not a composite call or object`,
           };
         }
         for (const { propKey, bindingName } of decl.elements) {