@intentius/chant 0.22.0 → 0.23.0

package/src/discovery/index.test.ts

@@ -277,6 +277,8 @@ describe("discover — fold mode (#1022, epic #1019)", () => {
   const thisDir = dirname(fileURLToPath(import.meta.url));
   const runtimePath = resolve(thisDir, "../runtime");
   const compositePath = resolve(thisDir, "../composite");
+  const lexiconOutputPath = resolve(thisDir, "../lexicon-output");
+  const stackOutputPath = resolve(thisDir, "../stack-output");
 
   beforeEach(async () => {
     testDir = join(tmpdir(), `chant-discover-fold-test-${Date.now()}-${Math.random()}`);
@@ -385,6 +387,135 @@ describe("discover — fold mode (#1022, epic #1019)", () => {
     expect(stackDecision?.resourceCount).toBe(1);
   });
 
+  // chant #1112 — a folded file's `output(...)` used to be resolved and then
+  // thrown away: the fold path handed discovery only the Declarable/
+  // CompositeInstance exports it had picked out itself, and a `LexiconOutput`
+  // is neither. `build()` never saw it, and the template lost its whole
+  // Outputs section with no warning and exit 0. Discovery now hands
+  // `collectEntities` the file's WHOLE folded export namespace, so both paths
+  // filter exports through the same code.
+  test("a folded file's output(...) export reaches the entities map, exactly as running it does", async () => {
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        export const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });
+      `,
+    );
+    await writeFile(
+      join(testDir, "main.ts"),
+      `
+        import { Bucket } from "./resources";
+        export const bucket = new Bucket({ name: "my-bucket" });
+      `,
+    );
+    // Cross-file, which is what real projects do (a dedicated outputs.ts) and
+    // what makes the ref resolve to a genuine live AttrRef, so the file folds.
+    await writeFile(
+      join(testDir, "outputs.ts"),
+      `
+        import { output } from ${JSON.stringify(lexiconOutputPath)};
+        import { bucket } from "./main";
+        export const bucketArn = output(bucket.arn, "BucketArn");
+      `,
+    );
+
+    const withoutFold = await discover(testDir);
+    const withFold = await discover(testDir, { fold: true });
+
+    expect(withFold.errors).toEqual([]);
+    expect(withFold.foldDecisions.every((d) => d.mode === "fold")).toBe(true);
+    expect([...withFold.entities.keys()].sort()).toEqual([...withoutFold.entities.keys()].sort());
+    expect(withFold.entities.has("bucketArn")).toBe(true);
+
+    const folded = withFold.entities.get("bucketArn")! as unknown as { outputName: string };
+    const run = withoutFold.entities.get("bucketArn")! as unknown as { outputName: string };
+    expect(folded.outputName).toBe("BucketArn");
+    expect(folded.outputName).toBe(run.outputName);
+
+    // An output is not a resource — the fold decision line still counts only
+    // what this file contributed to Resources.
+    const outputsDecision = withFold.foldDecisions.find((d) => d.file.endsWith("outputs.ts"));
+    expect(outputsDecision?.resourceCount).toBe(0);
+  });
+
+  // The sibling primitive, checked in the same shape so a future change can't
+  // fix one and regress the other. `stackOutput()` returns a real Declarable,
+  // so it was never dropped — this pins that.
+  test("a folded file's stackOutput(...) export reaches the entities map too", async () => {
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        export const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });
+      `,
+    );
+    await writeFile(
+      join(testDir, "main.ts"),
+      `
+        import { Bucket } from "./resources";
+        export const bucket = new Bucket({ name: "my-bucket" });
+      `,
+    );
+    await writeFile(
+      join(testDir, "outputs.ts"),
+      `
+        import { stackOutput } from ${JSON.stringify(stackOutputPath)};
+        import { bucket } from "./main";
+        export const bucketArn = stackOutput(bucket.arn);
+      `,
+    );
+
+    const withoutFold = await discover(testDir);
+    const withFold = await discover(testDir, { fold: true });
+
+    expect(withFold.errors).toEqual([]);
+    expect(withFold.foldDecisions.every((d) => d.mode === "fold")).toBe(true);
+    expect([...withFold.entities.keys()].sort()).toEqual([...withoutFold.entities.keys()].sort());
+    expect(withFold.entities.has("bucketArn")).toBe(true);
+    expect((withFold.entities.get("bucketArn")! as unknown as { kind: string }).kind).toBe("output");
+  });
+
+  // chant #1112 — the other half. An authoring helper reads THROUGH its ref
+  // (`output()` derefs the WeakRef parent), so handing it fold's symbolic
+  // `{__attrRef}` envelope for a SAME-FILE resource would build a
+  // `LexiconOutput` wrapping an inert object — output that is wrong rather
+  // than absent, which is worse. `reviveHelperCall` already refused this for a
+  // helper nested in a value; a top-level `export const x = output(...)` goes
+  // through the composite-factory spine instead and did not. Both now apply
+  // the same rule, and the file falls back to run.
+  test("a same-file resource reference passed to output(...) falls back to run rather than folding a wrong output", async () => {
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        export const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });
+      `,
+    );
+    await writeFile(
+      join(testDir, "stack.ts"),
+      `
+        import { Bucket } from "./resources";
+        import { output } from ${JSON.stringify(lexiconOutputPath)};
+        export const bucket = new Bucket({ name: "my-bucket" });
+        export const bucketArn = output(bucket.arn, "BucketArn");
+      `,
+    );
+
+    const withoutFold = await discover(testDir);
+    const withFold = await discover(testDir, { fold: true });
+
+    const decision = withFold.foldDecisions.find((d) => d.file.endsWith("stack.ts"));
+    expect(decision?.mode).toBe("run");
+    expect(decision?.reason).toContain("same-file resource reference");
+
+    // Falling back is not a loss of output — the run path produces exactly
+    // what it always did.
+    expect(withFold.errors).toEqual([]);
+    expect([...withFold.entities.keys()].sort()).toEqual([...withoutFold.entities.keys()].sort());
+    expect(withFold.entities.has("bucketArn")).toBe(true);
+  });
+
   test("a composite factory defined locally (not resolvable via import) still falls back to run; output is unchanged", async () => {
     await writeFile(
       join(testDir, "stack.ts"),

package/src/discovery/index.ts

@@ -74,10 +74,21 @@ export interface DiscoveryOptions {
    * in-process `importModule` step (every file, when {@link fold} isn't set;
    * only the per-file run-fallback remainder, when it is) instead runs
    * together, isolated, in one sandboxed child process — see
-   * `./sandbox/run.ts`. Folded files are unaffected: fold already executes
-   * zero of a file's own top-level code, so it stays in this process exactly
-   * as it does today. Default `false` — behavior, including performance
-   * (no bundling, no child process, no IPC), is unchanged unless requested.
+   * `./sandbox/run.ts`.
+   *
+   * chant #1093 — this ALSO tightens what fold itself may do in this process.
+   * Fold executes none of a file's own top-level code, but it does import and
+   * invoke the module behind a composite factory / resource constructor /
+   * intrinsic tag; when that module is project-owned, a file reported as
+   * "folded" still ran project code here. With `sandbox` set, fold refuses
+   * any import outside chant's own packages and this build's active lexicons,
+   * and the file demotes to the (sandboxed) run path instead — so the
+   * security property is uniform: under `sandbox`, project source executes
+   * only inside the child, folded or not. Fold COVERAGE is therefore lower
+   * under `sandbox` than under plain `fold` — deliberately.
+   *
+   * Default `false` — behavior, including performance (no bundling, no child
+   * process, no IPC) and fold coverage, is unchanged unless requested.
    */
   sandbox?: boolean;
 
@@ -169,8 +180,16 @@ export async function discover(path: string, options?: DiscoveryOptions): Promis
   // a project file imported by several others is folded exactly once, so
   // every referrer shares the identical constructed Declarable/
   // CompositeInstance objects rather than each building its own copy.
+  // chant #1093 — `sandbox` is threaded into the fold session, not just used
+  // for the run-fallback set below: fold itself resolves a composite factory /
+  // resource constructor / intrinsic tag by IMPORTING the module that defines
+  // it and invoking it, which for a project-owned one means executing project
+  // code in this process even though the file is reported as "folded". Under
+  // `sandbox` the session refuses those imports and the file demotes to the
+  // run path — which, under `sandbox`, is the isolated child. See
+  // fold-import.ts's `sandboxedExecutionRefusal`.
   const foldSession = options?.fold
-    ? createFoldSession(options.intrinsics, buildParamValuesMap, options.lexicons)
+    ? createFoldSession(options.intrinsics, buildParamValuesMap, options.lexicons, options.sandbox === true)
     : undefined;
   if (options?.fold) {
     for (const file of files) {
@@ -197,9 +216,20 @@ export async function discover(path: string, options?: DiscoveryOptions): Promis
     if (options?.fold) {
       const folded = foldAttempts.get(file)!;
       if (folded.ok && !taintedFiles.has(file)) {
-        const exportsObj: Record<string, unknown> = {};
-        for (const [name, value] of folded.entities) exportsObj[name] = value;
-        modules.push({ file, exports: exportsObj });
+        // chant #1112 — hand `collectEntities` the file's WHOLE folded export
+        // namespace, exactly as the run path hands it the real module
+        // namespace object `importModule` returns. It used to get only the
+        // `Declarable`/`CompositeInstance` subset fold had already picked
+        // out, which quietly made fold-import a SECOND owner of the "which
+        // export becomes an entity" decision — and it had one fewer case than
+        // the real owner (`./collect.ts`'s `enumerateEntries`): a
+        // `LexiconOutput` (`export const oArn = output(bucket.Arn, "oArn")`)
+        // was resolved, dropped, and the template lost its whole `Outputs`
+        // section with no warning and exit 0. Fold now decides nothing here;
+        // `collectEntities` filters both paths' exports the same way, so a
+        // shape it learns about (today: outputs and arrays of declarables)
+        // cannot reach one path and not the other.
+        modules.push({ file, exports: Object.fromEntries(folded.exportedValues) });
         foldDecisions.push({ file, mode: "fold", resourceCount: folded.entities.length });
         continue;
       }

package/src/discovery/sandbox/fold-boundary.test.ts

@@ -0,0 +1,254 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdir, writeFile, rm, realpath } from "node:fs/promises";
+import { join, dirname, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { discover } from "../index";
+
+/**
+ * chant #1093 — the security property `--sandbox` is supposed to buy, tested
+ * where it was actually broken.
+ *
+ * chant #1045 isolates the run-fallback set, and `../sandbox/run.test.ts`
+ * proves THAT boundary holds (no reads outside the project, no writes, no
+ * spawning, no ambient env). It says nothing about the FOLD half, which is
+ * where the hole was: fold executes none of a file's own top-level code, but
+ * it resolves a composite factory / resource constructor / intrinsic tag by
+ * importing the module that defines it and invoking it. When that module is a
+ * sibling project file, a file reported as `mode: "fold"` had nonetheless run
+ * project code — its module top level AND the factory body — inside the CLI's
+ * own process, with the CLI's filesystem, network, environment and
+ * process-spawning access.
+ *
+ * These tests observe execution DIRECTLY rather than inferring it: the fixture
+ * sets a `globalThis` marker at module top level and another inside the
+ * factory body. A marker set inside the sandboxed child cannot reach this
+ * process — it is a different process — so "marker present" is precisely
+ * "this ran in the CLI process". The plain-`--fold` case is asserted first in
+ * every pair, so the probe is proven to be capable of firing before the
+ * `--sandbox` case asserts that it doesn't.
+ *
+ * Fixtures are written to a fresh tmpdir per test (never into the source
+ * tree), which also keeps each test's module paths unique — no module-cache
+ * bleed between the two halves of a pair.
+ */
+
+const thisDir = dirname(fileURLToPath(import.meta.url));
+/** Absolute paths to chant-core's real modules, imported by the fixtures the way a lexicon package would be. */
+const runtimePath = resolve(thisDir, "../../runtime");
+const compositePath = resolve(thisDir, "../../composite");
+
+const MODULE_MARKER = "__chant1093ModuleEvaluated";
+const FACTORY_MARKER = "__chant1093FactoryInvoked";
+
+type MarkerHost = Record<string, boolean | undefined>;
+
+function marker(name: string): boolean | undefined {
+  return (globalThis as unknown as MarkerHost)[name];
+}
+
+function clearMarkers(): void {
+  delete (globalThis as unknown as MarkerHost)[MODULE_MARKER];
+  delete (globalThis as unknown as MarkerHost)[FACTORY_MARKER];
+}
+
+describe("fold under --sandbox never executes project code in the CLI process (chant #1093)", () => {
+  let testDir: string;
+  let seq = 0;
+
+  beforeEach(async () => {
+    const dir = join(tmpdir(), `chant-1093-fold-boundary-${Date.now()}-${Math.random()}`);
+    await mkdir(dir, { recursive: true });
+    testDir = await realpath(dir);
+    clearMarkers();
+  });
+
+  afterEach(async () => {
+    clearMarkers();
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  /**
+   * A project-owned composite factory: the shape chant#1022/#1023 folds by
+   * importing `./composites` and calling `WebApp(...)` for real.
+   */
+  async function writeCompositeFixture(): Promise<void> {
+    await writeFile(
+      join(testDir, "composites.ts"),
+      `
+        import { Composite } from ${JSON.stringify(compositePath)};
+        import { createResource } from ${JSON.stringify(runtimePath)};
+
+        globalThis[${JSON.stringify(MODULE_MARKER)}] = true;
+
+        const Bucket = createResource("Test::Bucket", "test", { arn: "Arn" });
+        const Role = createResource("Test::Role", "test", {});
+
+        export const WebApp = Composite((props) => {
+          globalThis[${JSON.stringify(FACTORY_MARKER)}] = true;
+          const bucket = new Bucket({ bucketName: props.name });
+          const role = new Role({ resource: bucket.arn });
+          return { bucket, role };
+        }, "WebApp");
+      `,
+    );
+    await writeFile(
+      join(testDir, "main.ts"),
+      `
+        import { WebApp } from "./composites";
+        export const web = WebApp({ name: "data" });
+      `,
+    );
+  }
+
+  test("plain --fold DOES invoke a project-owned composite factory in-process (the probe fires)", async () => {
+    await writeCompositeFixture();
+
+    const result = await discover(testDir, { fold: true });
+
+    // The file folds today — and folding it ran project code right here.
+    const main = result.foldDecisions.find((d) => d.file.endsWith("main.ts"));
+    expect(main?.mode).toBe("fold");
+    expect(marker(MODULE_MARKER), "composites.ts's module top level ran in this process").toBe(true);
+    expect(marker(FACTORY_MARKER), "the factory body ran in this process").toBe(true);
+    expect([...result.entities.keys()].sort()).toEqual(["webBucket", "webRole"]);
+  });
+
+  test("--sandbox invokes it in the child instead: no marker here, same entities", async () => {
+    await writeCompositeFixture();
+
+    const result = await discover(testDir, { fold: true, sandbox: true });
+
+    expect(result.errors).toEqual([]);
+    // Same entities, produced by the same factory with the same arguments —
+    // just on the other side of the boundary.
+    expect([...result.entities.keys()].sort()).toEqual(["webBucket", "webRole"]);
+    expect(marker(MODULE_MARKER), "project module top level must NOT run in the CLI process").toBeUndefined();
+    expect(marker(FACTORY_MARKER), "the factory body must NOT run in the CLI process").toBeUndefined();
+
+    // The demotion is reported, with a reason that names the cause.
+    const main = result.foldDecisions.find((d) => d.file.endsWith("main.ts"));
+    expect(main?.mode).toBe("run");
+    expect(main?.reason).toContain("--sandbox");
+    expect(main?.reason).toContain("./composites");
+  });
+
+  test("the cross-file AttrRef still resolves through the boundary", async () => {
+    await writeCompositeFixture();
+
+    const result = await discover(testDir, { fold: true, sandbox: true });
+
+    // `role.props.resource` is `bucket.arn`, an AttrRef whose logical name is
+    // assigned by naming INSIDE the child (chant#1045's design) — the same
+    // value the in-process fold produces, reached without executing anything
+    // here.
+    const role = result.entities.get("webRole") as unknown as { props: { resource: unknown } };
+    const ref = role.props.resource as { getLogicalName?: () => string | undefined; attribute?: string };
+    expect(ref.getLogicalName?.()).toBe("webBucket");
+    expect(ref.attribute).toBe("Arn");
+  });
+
+  /**
+   * The same hole, reached through `new Type(...)` rather than a factory call:
+   * a resource class is a lexicon export in every corpus entry today, but
+   * nothing in the language or the folder requires that.
+   */
+  async function writeConstructorFixture(): Promise<void> {
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        globalThis[${JSON.stringify(MODULE_MARKER)}] = true;
+        export const Bucket = createResource("Test::Bucket", "test", { arn: "Arn" });
+      `,
+    );
+    await writeFile(
+      join(testDir, "main.ts"),
+      `
+        import { Bucket } from "./resources";
+        export const dataBucket = new Bucket({ bucketName: "data" });
+      `,
+    );
+  }
+
+  test("plain --fold DOES evaluate a project-owned constructor module in-process", async () => {
+    await writeConstructorFixture();
+
+    const result = await discover(testDir, { fold: true });
+
+    expect(result.foldDecisions.find((d) => d.file.endsWith("main.ts"))?.mode).toBe("fold");
+    expect(marker(MODULE_MARKER)).toBe(true);
+    expect([...result.entities.keys()]).toEqual(["dataBucket"]);
+  });
+
+  test("--sandbox demotes a project-owned constructor too", async () => {
+    await writeConstructorFixture();
+
+    const result = await discover(testDir, { fold: true, sandbox: true });
+
+    expect(result.errors).toEqual([]);
+    expect([...result.entities.keys()]).toEqual(["dataBucket"]);
+    expect(marker(MODULE_MARKER)).toBeUndefined();
+    const main = result.foldDecisions.find((d) => d.file.endsWith("main.ts"));
+    expect(main?.mode).toBe("run");
+    expect(main?.reason).toContain("--sandbox");
+  });
+
+  /**
+   * The allowlist is a boundary, not a blanket ban: a factory owned by one of
+   * THIS build's active lexicon packages still folds in-process under
+   * `--sandbox`. That is deliberate and is exactly chant#1045's stated scope
+   * ("sandboxing chant itself, or the lexicon packages" is a non-goal) — the
+   * CLI has already imported and executed every active lexicon package
+   * (`loadPlugins`) before discovery starts.
+   *
+   * Same fixture, same specifier, in both halves below — the ONLY difference
+   * is whether the build declared that lexicon as active.
+   */
+  async function installLexiconPackage(): Promise<{ lexicon: string; specifier: string }> {
+    const lexicon = `fold1093x${seq++}${Date.now().toString(36)}`;
+    const specifier = `@intentius/chant-lexicon-${lexicon}`;
+    const dir = join(testDir, "node_modules", specifier);
+    await mkdir(dir, { recursive: true });
+    await writeFile(
+      join(dir, "package.json"),
+      JSON.stringify({ name: specifier, version: "0.0.0", type: "module", exports: { ".": "./index.js" } }),
+    );
+    await writeFile(
+      join(dir, "index.js"),
+      `
+        const DECLARABLE_MARKER = Symbol.for("chant.declarable");
+        export function Widget(props) {
+          return { [DECLARABLE_MARKER]: true, lexicon: "test", entityType: "Test::Widget", kind: "resource", props };
+        }
+      `,
+    );
+    await writeFile(
+      join(testDir, "main.ts"),
+      `
+        import { Widget } from ${JSON.stringify(specifier)};
+        export const widget = Widget({ size: "large" });
+      `,
+    );
+    return { lexicon, specifier };
+  }
+
+  test("a factory from an ACTIVE lexicon package still folds under --sandbox", async () => {
+    const { lexicon } = await installLexiconPackage();
+
+    const result = await discover(testDir, { fold: true, sandbox: true, lexicons: [lexicon] });
+
+    expect(result.foldDecisions.find((d) => d.file.endsWith("main.ts"))?.mode).toBe("fold");
+    expect([...result.entities.keys()]).toEqual(["widget"]);
+  });
+
+  test("the same factory from a lexicon this build did NOT load is refused", async () => {
+    await installLexiconPackage();
+
+    const result = await discover(testDir, { fold: true, sandbox: true, lexicons: ["aws"] });
+
+    const main = result.foldDecisions.find((d) => d.file.endsWith("main.ts"));
+    expect(main?.mode).toBe("run");
+    expect(main?.reason).toContain("--sandbox");
+  });
+});

package/src/fold/subset.test.ts

@@ -280,12 +280,15 @@ describe("documented divergences — NOT unified by design (see subset.ts module
 /**
  * chant #1044 — the shared predicate's optional intrinsic registry.
  *
- * `findSubsetViolation` answers "is this shape foldable?" for two kinds of
- * caller: `fold()`'s own EVL twin, which has no registry, and a tool that
- * does (a control plane deciding whether a repository needs a sandboxed
- * child process). The parameter is what lets the second kind get fold()'s
- * real answer without running fold, while the first keeps the answer it
- * always had.
+ * `findSubsetViolation` answers "is this shape foldable?" for a caller that
+ * has a registry and one that doesn't: with it, the answer for a call is
+ * exact (fold()'s own); without it, every call is a violation, the
+ * pre-#1044 answer. EVL001 (`chant lint`) is the first kind as of #1106 —
+ * `runLint` threads the active lexicons' intrinsics onto
+ * `LintContext.intrinsics`, which EVL001 forwards here — and the second
+ * kind whenever a caller hasn't resolved a project's lexicons (a bare unit
+ * test, a tool asking "would this fold?" with no lexicon context of its
+ * own).
  */
 describe("findSubsetViolation — optional intrinsic registry (#1044)", () => {
   const REF: IntrinsicDef[] = [{ name: "Ref", isTag: false, foldsAsCall: true }];
@@ -331,14 +334,15 @@ describe("findSubsetViolation — optional intrinsic registry (#1044)", () => {
     expect(v?.message).toContain("getName(...)");
   });
 
-  test("registry-less EVL is now STRICTER than fold on an opted-in call — a known divergence, not a hole", () => {
-    // chant #1044 — EVL001 has no registry (see subset.ts module doc, point
-    // 2c), so it still flags `Ref(...)` in a resource's props exactly as it
-    // did before this change, while fold() — which is always given one —
-    // folds it. Recorded here so the divergence is a tracked property with a
-    // test rather than a surprise; closing it means handing the lint engine
-    // the active lexicons' intrinsics, which is a change to lint's own
-    // surface and deliberately not part of #1044.
+  test("EVL converges with fold on an opted-in call once it carries the registry (chant #1106)", () => {
+    // chant #1044 left EVL001 with no registry (see subset.ts module doc,
+    // point 2c), so it flagged `Ref(...)` in a resource's props even though
+    // fold() — which is always given one — folded it cleanly. #1106 closes
+    // that by threading `runLint`'s intrinsics parameter onto
+    // `LintContext.intrinsics`, which EVL001 passes straight through to this
+    // same `findSubsetViolation`/`checkObjectMember` predicate. A
+    // `LintContext` built WITH the registry (what `chant lint` now
+    // constructs for a real project) no longer flags what fold() accepts.
     const source = `const bad = new Thing({ x: Ref(env) });`;
     const sourceFile = ts.createSourceFile("t.ts", source, ts.ScriptTarget.Latest, true);
     const consts = collectConsts(sourceFile);
@@ -346,6 +350,16 @@ describe("findSubsetViolation — optional intrinsic registry (#1044)", () => {
 
     expect(() => foldResource(badInit, consts, REF)).not.toThrow();
 
+    const context: LintContext = { sourceFile, entities: [], filePath: "t.ts", lexicon: undefined, intrinsics: REF };
+    expect(evl001NonLiteralExpressionRule.check(context)).toHaveLength(0);
+  });
+
+  test("without the registry, EVL001 keeps the pre-#1044 conservative answer", () => {
+    // A `LintContext` built without `intrinsics` (a caller that hasn't
+    // resolved a project's lexicons) still flags the call — the safe
+    // default subset.ts's module doc describes, unchanged by #1106.
+    const source = `const bad = new Thing({ x: Ref(env) });`;
+    const sourceFile = ts.createSourceFile("t.ts", source, ts.ScriptTarget.Latest, true);
     const context: LintContext = { sourceFile, entities: [], filePath: "t.ts", lexicon: undefined };
     expect(evl001NonLiteralExpressionRule.check(context).length).toBeGreaterThan(0);
   });

package/src/fold/subset.ts

@@ -69,8 +69,22 @@ import { intrinsicCallFolds, type IntrinsicDef } from "../lexicon";
  *      the flow-sensitivity note below — the single divergence in the other
  *      direction, and the one this module treats as a wart). A caller with
  *      no registry degrades to "assume it runs", which is safe and cheap to
- *      reason about; EVL is exactly such a caller and its behavior on calls
- *      is unchanged by #1044.
+ *      reason about.
+ *
+ *      chant #1106 — EVL is no longer such a caller by default. `runLint`
+ *      (../lint/engine.ts) takes the active lexicons' `IntrinsicDef[]` as a
+ *      parameter and puts it on `LintContext.intrinsics`
+ *      (../lint/rule.ts), and EVL001 (evl001-non-literal-expression.ts)
+ *      passes it straight through to `checkObjectMember`. `chant lint`'s
+ *      three CLI entry points (the `lint` command's initial pass, its
+ *      `--fix` re-lint, and the LSP's per-file diagnostics) all resolve the
+ *      project's lexicons and thread their intrinsics through, mirroring
+ *      how `discover()` has done it for the fold path since #1039/#1105 —
+ *      so `chant lint` on a real project no longer flags `Ref(...)` that
+ *      `fold()` accepts. A `LintContext` built without that plumbing (a
+ *      unit test constructing one directly, a consumer that hasn't
+ *      resolved lexicons) still gets the pre-#1044 conservative answer —
+ *      that path was never wrong, only stricter than it had to be.
  *   3. Runtime *type* of a folded value — e.g. spreading `const n = 5`
  *      (`{...n}`) is shape-valid (`n` is a plain identifier) but `fold()`
  *      rejects it once it discovers `n` folds to a number, not an object.

package/src/lint/engine.ts

@@ -1,4 +1,5 @@
 import type { LintRule, LintDiagnostic, LintContext } from "./rule";
+import type { IntrinsicDef } from "../lexicon";
 import { parseFile } from "./parser";
 import { readFileSync } from "fs";
 
@@ -193,12 +194,22 @@ function isDiagnosticDisabled(
  * @param files - Array of file paths to lint
  * @param rules - Array of lint rules to execute
  * @param ruleOptions - Optional map of rule ID to options object
+ * @param intrinsics - chant #1106 — the active lexicons' registered
+ *   intrinsics (e.g. AWS's `Ref`, `GetAtt`), put on every file's
+ *   `LintContext.intrinsics` so a rule built on `../fold/subset.ts`'s
+ *   shared predicate (EVL001) answers exactly like `fold()` does for a
+ *   registered, opted-in call, instead of degrading to "every call is a
+ *   violation". Mirrors how `discover()` has threaded the same
+ *   `IntrinsicDef[]` into the fold path since #1039/#1105. Optional and
+ *   defaulting to none, so a caller that hasn't resolved a project's
+ *   lexicons (a unit test, `bench.test.ts`) is unaffected.
  * @returns LintRunResult with diagnostics and suppressed items
  */
 export async function runLint(
   files: string[],
   rules: LintRule[],
   ruleOptions?: Map<string, Record<string, unknown>>,
+  intrinsics?: readonly IntrinsicDef[],
 ): Promise<LintRunResult> {
   const allDiagnostics: LintDiagnostic[] = [];
   const allSuppressed: Array<LintDiagnostic & { reason?: string }> = [];
@@ -219,6 +230,7 @@ export async function runLint(
         entities: [],
         filePath,
         lexicon: undefined,
+        intrinsics,
       };
 
       // Execute each rule

package/src/lint/rule.ts

@@ -1,4 +1,5 @@
 import type * as ts from "typescript";
+import type { IntrinsicDef } from "../lexicon";
 
 /**
  * Severity level for lint diagnostics
@@ -60,6 +61,19 @@ export interface LintContext {
   filePath: string;
   /** Optional lexicon context (undefined for core rules) */
   lexicon?: string;
+  /**
+   * chant #1106 — the active lexicons' registered intrinsics (`Ref`,
+   * `GetAtt`, ...), threaded down from `runLint` (../lint/engine.ts) so a
+   * rule built on the shared `../fold/subset.ts` predicate
+   * (`findSubsetViolation`/`checkObjectMember`, used by EVL001) gets the
+   * SAME answer `fold()` does for a registered, opted-in call. Mirrors how
+   * `discover()` has threaded `IntrinsicDef[]` into the fold path since
+   * #1039/#1105. Undefined when the caller hasn't resolved a project's
+   * lexicons (a bare unit test constructing a `LintContext` directly, for
+   * instance) — subset.ts then falls back to its pre-#1044 answer: every
+   * call is a violation.
+   */
+  intrinsics?: readonly IntrinsicDef[];
 }
 
 /**