@intentius/chant 0.22.0 → 0.24.0

package/dist/lint/rule.d.ts

@@ -1,4 +1,5 @@
 import type * as ts from "typescript";
+import type { IntrinsicDef } from "../lexicon.js";
 /**
  * Severity level for lint diagnostics
  */
@@ -55,6 +56,19 @@ export interface LintContext {
     filePath: string;
     /** Optional lexicon context (undefined for core rules) */
     lexicon?: string;
+    /**
+     * chant #1106 — the active lexicons' registered intrinsics (`Ref`,
+     * `GetAtt`, ...), threaded down from `runLint` (../lint/engine.ts) so a
+     * rule built on the shared `../fold/subset.ts` predicate
+     * (`findSubsetViolation`/`checkObjectMember`, used by EVL001) gets the
+     * SAME answer `fold()` does for a registered, opted-in call. Mirrors how
+     * `discover()` has threaded `IntrinsicDef[]` into the fold path since
+     * #1039/#1105. Undefined when the caller hasn't resolved a project's
+     * lexicons (a bare unit test constructing a `LintContext` directly, for
+     * instance) — subset.ts then falls back to its pre-#1044 answer: every
+     * call is a violation.
+     */
+    intrinsics?: readonly IntrinsicDef[];
 }
 /**
  * Configuration value for a rule: either a severity string or a [severity, options] tuple

package/dist/lint/rule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rule.d.ts","sourceRoot":"","sources":["../../src/lint/rule.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,OAAO,GAAG,aAAa,GAAG,UAAU,CAAC;AAE5E;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,gDAAgD;IAChD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,SAAS,GAAG,eAAe,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,CAAC;IAC9E,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,CAAC,QAAQ,GAAG,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,QAAQ,EAAE,QAAQ,CAAC;IACnB,4BAA4B;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc,EAAE,CAAC;IACjF,gDAAgD;IAChD,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,EAAE,CAAC;CACvC"}
+{"version":3,"file":"rule.d.ts","sourceRoot":"","sources":["../../src/lint/rule.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG,OAAO,GAAG,aAAa,GAAG,UAAU,CAAC;AAE5E;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,gDAAgD;IAChD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,SAAS,GAAG,eAAe,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,CAAC;IAC9E,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,CAAC,QAAQ,GAAG,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,oDAAoD;IACpD,QAAQ,EAAE,QAAQ,CAAC;IACnB,4BAA4B;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc,EAAE,CAAC;IACjF,gDAAgD;IAChD,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,EAAE,CAAC;CACvC"}

package/dist/project-root.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Shared upward config-discovery walk (chant #1117).
+ *
+ * Before this, `chant build <subdir>` and `lint.policies`
+ * (`./lint/policy.ts`'s `evaluateProjectPolicies`) each searched only the
+ * build directory and its immediate parent for `chant.config.ts`/`.json`,
+ * while `chant lint`/`chant graph` (`./lint/config.ts`'s old, file-local
+ * `findProjectRoot`) already walked all the way up. A project with a deeper
+ * `src/<stack>` layout — `chant build src/<stack>` two or more levels below
+ * the project root — silently never found the root config: `buildParams`'
+ * declared `env:` mappings went inert, `ownership`/`lint.policies`/etc quietly
+ * fell back to defaults, and nothing warned (loomster#162: `LOOM_TIER`/
+ * `LOOM_ENV` inert under every `npm run synth:*` for two releases).
+ *
+ * `findProjectConfig` is the one walk every config-discovery call site now
+ * shares. It stops at the first of:
+ *
+ * 1. A directory holding `chant.config.ts` or `chant.config.json` — found.
+ * 2. A directory holding `.git` or `package.json` with no chant config of its
+ *    own — the project boundary. Discovery must never wander past the actual
+ *    project into an unrelated ancestor directory just because this project
+ *    happens not to declare a config (a stray `chant.config.ts` two levels
+ *    above an unrelated git repo must never be picked up).
+ * 3. `startDir` itself, unchanged, if the walk reaches the filesystem root
+ *    without ever finding a config OR a boundary marker. This is not just a
+ *    "give up gracefully" nicety — several callers (`resolveProjectLexicons`
+ *    -> `findInfraFiles`) scope a real directory walk off this function's
+ *    result; if a rootless/marker-less start dir (a bare tmpdir, as chant's
+ *    own test suites use) resolved all the way to `/`, that downstream walk
+ *    would scan the entire filesystem instead of failing fast. Falling back
+ *    to `startDir` keeps every caller's blast radius local no matter how far
+ *    up the walk had to look.
+ */
+export interface ProjectConfigSearch {
+    /** The resolved project root: the config's directory, the boundary directory, or the (resolved) `startDir` when neither was found. */
+    dir: string;
+    /** Absolute path to the discovered `chant.config.ts`/`.json`, if any. */
+    configPath?: string;
+}
+/** Walk up from `startDir` (inclusive) to the nearest chant config or project boundary. See {@link ProjectConfigSearch}. */
+export declare function findProjectConfig(startDir: string): ProjectConfigSearch;
+/**
+ * Walk up from `startDir` to the nearest ancestor holding a chant project
+ * config (`chant.config.ts` or `chant.config.json`), the `.git`/`package.json`
+ * project boundary, or `startDir` itself when neither is found. Thin wrapper
+ * over {@link findProjectConfig} for callers that only need the directory
+ * (e.g. `chant lint`'s rule/plugin resolution, which just needs *a* stable
+ * root to resolve relative paths against).
+ */
+export declare function findProjectRoot(startDir: string): string;
+//# sourceMappingURL=project-root.d.ts.map

package/dist/project-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-root.d.ts","sourceRoot":"","sources":["../src/project-root.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,WAAW,mBAAmB;IAClC,sIAAsI;IACtI,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4HAA4H;AAC5H,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,CAqBvE;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/build-params-cli.test.ts

@@ -0,0 +1,139 @@
+/**
+ * Tests for the CLI-layer build-time-parameter helpers factored out by chant
+ * #1108 (`parseParamFlags`/`resolveCliBuildParams`) — the exact sequence
+ * `chant build` (`./commands/build.ts`'s `buildCommand`) runs, now shared with
+ * the component deploy driver (`./handlers/run.ts`, `./handlers/build.ts`'s
+ * generate mode) so both resolve `--param`/`--params-file`/a declared `env`
+ * mapping/`chant.config.ts`'s `buildParams` defaults identically. Precedence
+ * itself is `../build-params.ts`'s `resolveBuildParams`'s responsibility
+ * (see `../build-params.test.ts`) — these tests cover the CLI-specific glue:
+ * flag parsing, `--params-file` reading, error formatting, and logging.
+ */
+import { describe, test, expect, vi } from "vitest";
+import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { parseParamFlags, resolveCliBuildParams } from "./build-params-cli";
+import type { BuildParamsConfig } from "../build-params";
+
+describe("parseParamFlags", () => {
+  test("undefined/empty input yields undefined (matches resolveBuildParams's 'no cli input' shape)", () => {
+    expect(parseParamFlags(undefined)).toBeUndefined();
+    expect(parseParamFlags([])).toBeUndefined();
+  });
+
+  test("parses repeated name=value flags into a flat record", () => {
+    expect(parseParamFlags(["tier=production", "replicas=3"])).toEqual({
+      tier: "production",
+      replicas: "3",
+    });
+  });
+
+  test("a value containing '=' keeps everything after the first '=' (only the first splits)", () => {
+    expect(parseParamFlags(["url=https://example.com?a=b"])).toEqual({
+      url: "https://example.com?a=b",
+    });
+  });
+
+  test("a flag with no '=' becomes an empty-string value", () => {
+    expect(parseParamFlags(["flag-only"])).toEqual({ "flag-only": "" });
+  });
+});
+
+describe("resolveCliBuildParams", () => {
+  test("cli beats params-file beats a declared env mapping beats the default — the exact chant build precedence", () => {
+    const defs: BuildParamsConfig = { tier: { type: "string", default: "light", env: "TIER_ENV" } };
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    try {
+      const result = resolveCliBuildParams(defs, { cli: { tier: "production" } });
+      expect(result).toEqual({
+        success: true,
+        provenance: [{ name: "tier", value: "production", source: "cli" }],
+        errors: [],
+      });
+    } finally {
+      errorSpy.mockRestore();
+    }
+  });
+
+  test("logs every resolved parameter as '[param] name = value (source)'", () => {
+    const defs: BuildParamsConfig = { tier: { type: "string", default: "light" } };
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    try {
+      resolveCliBuildParams(defs, {});
+      const logged = errorSpy.mock.calls.map((call) => String(call[0]));
+      expect(logged.some((line) => line.includes("[param] tier") && line.includes("light") && line.includes("default"))).toBe(true);
+    } finally {
+      errorSpy.mockRestore();
+    }
+  });
+
+  test("no declared params → success with empty provenance and no logging", () => {
+    const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    try {
+      const result = resolveCliBuildParams(undefined, {});
+      expect(result).toEqual({ success: true, provenance: [], errors: [] });
+      expect(errorSpy).not.toHaveBeenCalled();
+    } finally {
+      errorSpy.mockRestore();
+    }
+  });
+
+  test("an unresolved required parameter is a formatted error, not a thrown exception", () => {
+    const defs: BuildParamsConfig = { tier: { type: "string" } };
+    const result = resolveCliBuildParams(defs, {});
+    expect(result.success).toBe(false);
+    expect(result.provenance).toEqual([]);
+    expect(result.errors.some((e) => e.includes('"tier"') && e.includes("--param"))).toBe(true);
+  });
+
+  test("an enum violation is a formatted error naming the parameter and the offending value", () => {
+    const defs: BuildParamsConfig = { tier: { type: "string", enum: ["light", "production"] } };
+    const result = resolveCliBuildParams(defs, { cli: { tier: "bogus" } });
+    expect(result.success).toBe(false);
+    expect(result.errors.some((e) => e.includes('"tier"') && e.includes("bogus"))).toBe(true);
+  });
+
+  test("an unknown --param name is a formatted error", () => {
+    const defs: BuildParamsConfig = { tier: { type: "string", default: "light" } };
+    const result = resolveCliBuildParams(defs, { cli: { nonexistent: "x" } });
+    expect(result.success).toBe(false);
+    expect(result.errors.some((e) => e.includes("nonexistent") && e.includes("--param"))).toBe(true);
+  });
+
+  describe("--params-file", () => {
+    let dir: string;
+
+    test("reads and resolves values from a JSON file (second precedence, after --param)", () => {
+      dir = mkdtempSync(join(tmpdir(), "chant-build-params-cli-test-"));
+      try {
+        const file = join(dir, "params.json");
+        writeFileSync(file, JSON.stringify({ tier: "from-file", env: "from-file-env" }));
+        const defs: BuildParamsConfig = {
+          tier: { type: "string", default: "light" },
+          env: { type: "string", default: "dev" },
+        };
+
+        const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+        try {
+          const result = resolveCliBuildParams(defs, { cli: { tier: "from-cli" }, paramsFile: file });
+          expect(result.success).toBe(true);
+          const byName = new Map(result.provenance.map((p) => [p.name, p]));
+          expect(byName.get("tier")).toEqual({ name: "tier", value: "from-cli", source: "cli" });
+          expect(byName.get("env")).toEqual({ name: "env", value: "from-file-env", source: "params-file" });
+        } finally {
+          errorSpy.mockRestore();
+        }
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    });
+
+    test("an unreadable/unparsable --params-file is a formatted error naming the path, not a thrown exception", () => {
+      const defs: BuildParamsConfig = { tier: { type: "string", default: "light" } };
+      const result = resolveCliBuildParams(defs, { paramsFile: "/nonexistent/path/params.json" });
+      expect(result.success).toBe(false);
+      expect(result.errors.some((e) => e.includes("--params-file") && e.includes("/nonexistent/path/params.json"))).toBe(true);
+    });
+  });
+});

package/src/cli/build-params-cli.ts

@@ -0,0 +1,107 @@
+import { readFileSync } from "fs";
+import { resolve } from "path";
+import { resolveBuildParams, type BuildParamsConfig } from "../build-params";
+import type { BuildParamProvenance } from "../provenance";
+import { formatError, formatInfo } from "./format";
+
+/**
+ * Shared CLI-layer wiring for chant #1064's build-time parameters, factored
+ * out (chant #1108) so every command that discovers project source before
+ * running it resolves `chant.config.ts`'s declared `buildParams` the exact
+ * same way: `chant build` (`../commands/build.ts`'s `buildCommand`), the
+ * component deploy driver (`./handlers/run.ts`'s `chant run --components`
+ * local + `--temporal` paths), and generate mode (`./handlers/build.ts`'s
+ * `chant build --components --generate <lexicon>`).
+ *
+ * Before #1108, only `buildCommand` ran this sequence — `chant run
+ * --components` never resolved `--param`/`--params-file`/a declared `env`
+ * mapping at all, so a `*.component.ts` file reading `params.<name>`
+ * (`@intentius/chant/params`) always saw `{}`, no matter what a CI job
+ * exported into the environment. See ../build-params.ts's module doc for the
+ * full precedence rules this wraps.
+ */
+
+/** Parse repeated `--param name=value` flags into a flat `{ name: value }` record — the raw (unvalidated) strings {@link resolveCliBuildParams} resolves against a project's declared `buildParams`. `undefined` when no `--param` flag was given, matching `resolveBuildParams`'s "no cli input" shape. */
+export function parseParamFlags(entries?: string[]): Record<string, string> | undefined {
+  if (!entries?.length) return undefined;
+  return Object.fromEntries(
+    entries.map((entry) => {
+      const eq = entry.indexOf("=");
+      return eq === -1 ? [entry, ""] : [entry.slice(0, eq), entry.slice(eq + 1)];
+    }),
+  );
+}
+
+/** Inputs {@link resolveCliBuildParams} needs from a parsed CLI invocation — the `--param`/`--params-file` half of {@link resolveBuildParams}'s `BuildParamsInput` (the `env` half is always `process.env`, resolved internally). */
+export interface CliBuildParamsArgs {
+  /** Already-parsed `--param name=value` flags (see {@link parseParamFlags}), or the CLI's already-typed `Record<string,string>` (`chant build`'s own flag parsing does this itself — see `./handlers/build.ts`). */
+  cli?: Record<string, string>;
+  /** `--params-file <path>` — a JSON file of `{ "name": value }` values, read and parsed here. */
+  paramsFile?: string;
+}
+
+export interface CliBuildParamsResolution {
+  success: boolean;
+  /** Every successfully resolved parameter. Empty when the project declares none, or when `success` is `false`. */
+  provenance: BuildParamProvenance[];
+  /** `formatError`-wrapped messages, ready to print as-is. Empty when `success` is `true`. */
+  errors: string[];
+}
+
+/**
+ * Resolve this invocation's declared build-time parameters (`chant.config.ts`'s
+ * `buildParams`) against `args`/the process environment, and log each
+ * resolved value — the identical resolution + logging sequence `chant build`
+ * runs (`../commands/build.ts`'s `buildCommand`), factored out so every other
+ * command that discovers project source runs it too (chant #1108).
+ *
+ * A resolution failure (an unknown `--param`/`--params-file` name, a missing
+ * required value, a type/enum mismatch, or an unreadable `--params-file`) is
+ * returned as `{ success: false, errors }` — never thrown — so the caller can
+ * print each message and exit non-zero exactly like a build error, matching
+ * chant #1064's acceptance criterion that this never surfaces as a thrown
+ * error from inside user source.
+ *
+ * On success, every resolved parameter is logged via `console.error` as
+ * `[param] <name> = <value> (<source>)` — unconditional, not gated on
+ * `--verbose`, so a build's environment-varying inputs are always visible,
+ * the same way #1022's fold decisions are.
+ */
+export function resolveCliBuildParams(
+  buildParamsConfig: BuildParamsConfig | undefined,
+  args: CliBuildParamsArgs,
+): CliBuildParamsResolution {
+  const errors: string[] = [];
+
+  let fromFile: Record<string, unknown> | undefined;
+  if (args.paramsFile) {
+    try {
+      fromFile = JSON.parse(readFileSync(resolve(args.paramsFile), "utf-8"));
+    } catch (err) {
+      errors.push(
+        formatError({
+          message: `Failed to read/parse --params-file "${args.paramsFile}": ${err instanceof Error ? err.message : String(err)}`,
+        }),
+      );
+    }
+  }
+
+  const resolution = resolveBuildParams(buildParamsConfig, {
+    cli: args.cli,
+    fromFile,
+    env: process.env,
+  });
+  for (const message of resolution.errors) {
+    errors.push(formatError({ message }));
+  }
+
+  if (errors.length > 0) {
+    return { success: false, provenance: [], errors };
+  }
+
+  for (const p of resolution.provenance) {
+    console.error(formatInfo(`[param] ${p.name} = ${JSON.stringify(p.value)} (${p.source})`));
+  }
+
+  return { success: true, provenance: resolution.provenance, errors: [] };
+}

package/src/cli/commands/build.ts

@@ -1,13 +1,13 @@
 import { build } from "../../build";
-import { loadChantConfig, resolveOwnershipMarker, resolveFoldEnabled, resolveSandboxEnabled } from "../../config";
-import { resolveBuildParams } from "../../build-params";
+import { loadChantConfigUpward, resolveOwnershipMarker, resolveFoldEnabled, resolveSandboxEnabled } from "../../config";
+import { resolveCliBuildParams } from "../build-params-cli";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
 import { runPostSynthChecks } from "../../lint/post-synth";
 import { loadPolicyChecks } from "../../lint/policy";
 import { sortedJsonReplacer } from "../../utils";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format";
-import { writeFileSync, mkdirSync, readFileSync } from "fs";
+import { writeFileSync, mkdirSync } from "fs";
 import { resolve, dirname, join, relative } from "path";
 import { watchDirectory, formatTimestamp, formatChangedFiles } from "../watch";
 
@@ -128,11 +128,14 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // Resolve the path
   const infraPath = resolve(options.path);
 
-  // Resolve opt-in ownership marking from project config (search the infra dir
-  // and its parent, where chant.config.* usually lives).
-  const loaded = await loadChantConfig(infraPath).then((r) =>
-    r.configPath ? r : loadChantConfig(dirname(infraPath)),
-  );
+  // Resolve opt-in ownership marking from project config. chant #1117 — walks
+  // up from the infra dir to the project root (`loadChantConfigUpward`), not
+  // just the infra dir's immediate parent: a project whose stacks live two or
+  // more levels below `chant.config.ts` (loomster's `src/<stack>` layout)
+  // otherwise never finds the root config at all, and every declared
+  // `buildParams`/`ownership`/`lint.policies` setting silently falls back to
+  // its default.
+  const loaded = await loadChantConfigUpward(infraPath);
   const config = loaded.config;
   const ownership = resolveOwnershipMarker(config);
 
@@ -155,43 +158,43 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // as fold, resolved independently.
   const sandbox = resolveSandboxEnabled(config, options.sandbox);
 
-  // #1064 — resolve declared build-time parameters (chant.config.ts's
-  // buildParams) against this invocation's --param/--params-file/declared
-  // env mapping, BEFORE calling build() — a resolution failure (an unknown
-  // name, a missing required value, a type/enum mismatch) is reported as a
-  // chant build error naming the parameter, never a thrown error from inside
-  // user source (which is what loomster's hand-rolled `tierFromEnv()`-style
-  // validators did before migrating to this mechanism).
-  let paramsFileContent: Record<string, unknown> | undefined;
-  if (options.paramsFile) {
-    try {
-      paramsFileContent = JSON.parse(readFileSync(resolve(options.paramsFile), "utf-8"));
-    } catch (err) {
-      errors.push(
-        formatError({
-          message: `Failed to read/parse --params-file "${options.paramsFile}": ${err instanceof Error ? err.message : String(err)}`,
-        }),
-      );
-    }
-  }
-  const paramsResolution = resolveBuildParams(config.buildParams, {
+  // #1064 (factored into ../build-params-cli.ts's resolveCliBuildParams by
+  // #1108, so the component deploy driver runs the identical sequence) —
+  // resolve declared build-time parameters (chant.config.ts's buildParams)
+  // against this invocation's --param/--params-file/declared env mapping,
+  // BEFORE calling build() — a resolution failure (an unknown name, a
+  // missing required value, a type/enum mismatch) is reported as a chant
+  // build error naming the parameter, never a thrown error from inside user
+  // source (which is what loomster's hand-rolled `tierFromEnv()`-style
+  // validators did before migrating to this mechanism). Also logs every
+  // resolved value (`[param] name = value (source)`) on success.
+  const paramsResolution = resolveCliBuildParams(config.buildParams, {
     cli: options.params,
-    fromFile: paramsFileContent,
-    env: process.env,
+    paramsFile: options.paramsFile,
   });
-  for (const message of paramsResolution.errors) {
-    errors.push(formatError({ message }));
-  }
-  if (errors.length > 0) {
+  if (!paramsResolution.success) {
+    errors.push(...paramsResolution.errors);
     return { success: false, resourceCount: 0, fileCount: 0, errors, warnings };
   }
-  // #1064 — build-provenance visibility: report every resolved build-time
-  // parameter (name, value, and which source won it) the same
-  // unconditional-log-not-gated-on---verbose way #1022's fold decisions are
-  // reported just below, so a build's environment-varying inputs are as
-  // visible as its fold-vs-run choices.
-  for (const p of paramsResolution.provenance) {
-    console.error(formatInfo(`[param] ${p.name} = ${JSON.stringify(p.value)} (${p.source})`));
+
+  // chant #1117 — a project that declares buildParams but resolves NONE of
+  // them for this build is the exact shape that let loomster#162 live for two
+  // releases: the discovered config wasn't the one the project author
+  // expected (a stale --path, a workspace boundary that stopped the walk
+  // short), or every declared parameter's `env:` var went unset, and either
+  // way every `params.<name>` read silently falls back to `undefined` — with
+  // no error (an all-`required: false` declaration resolves successfully to
+  // an empty set). Warn, naming the config path this build actually
+  // discovered, so a mismatch is visible instead of silent.
+  if (
+    Object.keys(config.buildParams ?? {}).length > 0 &&
+    paramsResolution.provenance.length === 0
+  ) {
+    warnings.push(
+      formatWarning({
+        message: `chant.config.ts declares buildParams${loaded.configPath ? ` (${loaded.configPath})` : ""}, but none resolved for this build — every params.<name> read will be undefined. Pass --param/--params-file, or check that this is the config you expect.`,
+      }),
+    );
   }
 
   // #1039 — thread each loaded plugin's registered intrinsics (e.g. AWS's

package/src/cli/commands/lint.test.ts

@@ -332,6 +332,80 @@ describe("plugin integration", () => {
   });
 });
 
+/**
+ * chant #1106 — `runLint`'s EVL rules now receive the active lexicons'
+ * registered intrinsics (threaded from `loadAllPluginRules`'s
+ * `plugin.intrinsics?.()`, mirroring how `../commands/build.ts` gathers the
+ * same set for the fold path). Before this, `chant lint` flagged
+ * `Ref(...)` — a registered, opted-in call-form intrinsic (aws's
+ * `lexicons/aws/src/plugin.ts`) that `chant build --fold` folds cleanly —
+ * as EVL001, purely because EVL001's shared `../../fold/subset.ts`
+ * predicate never saw the registry. These use the real aws lexicon plugin
+ * (already a workspace dependency) rather than a mock, so the registration
+ * this asserts against is the one that actually ships.
+ */
+describe("lintCommand — EVL/intrinsic registry convergence (#1106)", () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-lint-intrinsics-test-${Date.now()}-${Math.random()}`);
+    await mkdir(testDir, { recursive: true });
+    process.env.NO_COLOR = "1";
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+    delete process.env.NO_COLOR;
+  });
+
+  test("a registered, opted-in intrinsic call (aws's Ref) is not flagged as EVL001", async () => {
+    await writeFile(join(testDir, "chant.config.json"), JSON.stringify({ lexicons: ["aws"] }));
+    await writeFile(
+      join(testDir, "index.ts"),
+      `
+import { Ref } from "@intentius/chant-lexicon-aws";
+
+class Queue {
+  constructor(_props: Record<string, unknown>) {}
+}
+
+export const environment = "prod";
+export const queue = new Queue({ name: Ref(environment) });
+      `,
+    );
+
+    const result = await lintCommand({ path: testDir, format: "stylish" });
+
+    expect(result.diagnostics.filter((d) => d.ruleId === "EVL001")).toHaveLength(0);
+  });
+
+  test("an unregistered call is still flagged as EVL001 in the same project", async () => {
+    await writeFile(join(testDir, "chant.config.json"), JSON.stringify({ lexicons: ["aws"] }));
+    await writeFile(
+      join(testDir, "index.ts"),
+      `
+import { Ref } from "@intentius/chant-lexicon-aws";
+
+class Queue {
+  constructor(_props: Record<string, unknown>) {}
+}
+
+function makeName(): string {
+  return "generated";
+}
+
+export const queue = new Queue({ name: makeName() });
+      `,
+    );
+
+    const result = await lintCommand({ path: testDir, format: "stylish" });
+
+    const evl001 = result.diagnostics.filter((d) => d.ruleId === "EVL001");
+    expect(evl001).toHaveLength(1);
+    expect(evl001[0].message).toContain("statically evaluable");
+  });
+});
+
 describe("lintCommand — project-root config resolution (scoped lint)", () => {
   let testDir: string;