@intentius/chant 0.22.0 → 0.24.0

package/src/discovery/index.ts

@@ -74,10 +74,21 @@ export interface DiscoveryOptions {
    * in-process `importModule` step (every file, when {@link fold} isn't set;
    * only the per-file run-fallback remainder, when it is) instead runs
    * together, isolated, in one sandboxed child process — see
-   * `./sandbox/run.ts`. Folded files are unaffected: fold already executes
-   * zero of a file's own top-level code, so it stays in this process exactly
-   * as it does today. Default `false` — behavior, including performance
-   * (no bundling, no child process, no IPC), is unchanged unless requested.
+   * `./sandbox/run.ts`.
+   *
+   * chant #1093 — this ALSO tightens what fold itself may do in this process.
+   * Fold executes none of a file's own top-level code, but it does import and
+   * invoke the module behind a composite factory / resource constructor /
+   * intrinsic tag; when that module is project-owned, a file reported as
+   * "folded" still ran project code here. With `sandbox` set, fold refuses
+   * any import outside chant's own packages and this build's active lexicons,
+   * and the file demotes to the (sandboxed) run path instead — so the
+   * security property is uniform: under `sandbox`, project source executes
+   * only inside the child, folded or not. Fold COVERAGE is therefore lower
+   * under `sandbox` than under plain `fold` — deliberately.
+   *
+   * Default `false` — behavior, including performance (no bundling, no child
+   * process, no IPC) and fold coverage, is unchanged unless requested.
    */
   sandbox?: boolean;
 
@@ -169,8 +180,16 @@ export async function discover(path: string, options?: DiscoveryOptions): Promis
   // a project file imported by several others is folded exactly once, so
   // every referrer shares the identical constructed Declarable/
   // CompositeInstance objects rather than each building its own copy.
+  // chant #1093 — `sandbox` is threaded into the fold session, not just used
+  // for the run-fallback set below: fold itself resolves a composite factory /
+  // resource constructor / intrinsic tag by IMPORTING the module that defines
+  // it and invoking it, which for a project-owned one means executing project
+  // code in this process even though the file is reported as "folded". Under
+  // `sandbox` the session refuses those imports and the file demotes to the
+  // run path — which, under `sandbox`, is the isolated child. See
+  // fold-import.ts's `sandboxedExecutionRefusal`.
   const foldSession = options?.fold
-    ? createFoldSession(options.intrinsics, buildParamValuesMap, options.lexicons)
+    ? createFoldSession(options.intrinsics, buildParamValuesMap, options.lexicons, options.sandbox === true)
     : undefined;
   if (options?.fold) {
     for (const file of files) {
@@ -197,9 +216,20 @@ export async function discover(path: string, options?: DiscoveryOptions): Promis
     if (options?.fold) {
       const folded = foldAttempts.get(file)!;
       if (folded.ok && !taintedFiles.has(file)) {
-        const exportsObj: Record<string, unknown> = {};
-        for (const [name, value] of folded.entities) exportsObj[name] = value;
-        modules.push({ file, exports: exportsObj });
+        // chant #1112 — hand `collectEntities` the file's WHOLE folded export
+        // namespace, exactly as the run path hands it the real module
+        // namespace object `importModule` returns. It used to get only the
+        // `Declarable`/`CompositeInstance` subset fold had already picked
+        // out, which quietly made fold-import a SECOND owner of the "which
+        // export becomes an entity" decision — and it had one fewer case than
+        // the real owner (`./collect.ts`'s `enumerateEntries`): a
+        // `LexiconOutput` (`export const oArn = output(bucket.Arn, "oArn")`)
+        // was resolved, dropped, and the template lost its whole `Outputs`
+        // section with no warning and exit 0. Fold now decides nothing here;
+        // `collectEntities` filters both paths' exports the same way, so a
+        // shape it learns about (today: outputs and arrays of declarables)
+        // cannot reach one path and not the other.
+        modules.push({ file, exports: Object.fromEntries(folded.exportedValues) });
         foldDecisions.push({ file, mode: "fold", resourceCount: folded.entities.length });
         continue;
       }

package/src/discovery/sandbox/fold-boundary.test.ts

@@ -0,0 +1,254 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdir, writeFile, rm, realpath } from "node:fs/promises";
+import { join, dirname, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { discover } from "../index";
+
+/**
+ * chant #1093 — the security property `--sandbox` is supposed to buy, tested
+ * where it was actually broken.
+ *
+ * chant #1045 isolates the run-fallback set, and `../sandbox/run.test.ts`
+ * proves THAT boundary holds (no reads outside the project, no writes, no
+ * spawning, no ambient env). It says nothing about the FOLD half, which is
+ * where the hole was: fold executes none of a file's own top-level code, but
+ * it resolves a composite factory / resource constructor / intrinsic tag by
+ * importing the module that defines it and invoking it. When that module is a
+ * sibling project file, a file reported as `mode: "fold"` had nonetheless run
+ * project code — its module top level AND the factory body — inside the CLI's
+ * own process, with the CLI's filesystem, network, environment and
+ * process-spawning access.
+ *
+ * These tests observe execution DIRECTLY rather than inferring it: the fixture
+ * sets a `globalThis` marker at module top level and another inside the
+ * factory body. A marker set inside the sandboxed child cannot reach this
+ * process — it is a different process — so "marker present" is precisely
+ * "this ran in the CLI process". The plain-`--fold` case is asserted first in
+ * every pair, so the probe is proven to be capable of firing before the
+ * `--sandbox` case asserts that it doesn't.
+ *
+ * Fixtures are written to a fresh tmpdir per test (never into the source
+ * tree), which also keeps each test's module paths unique — no module-cache
+ * bleed between the two halves of a pair.
+ */
+
+const thisDir = dirname(fileURLToPath(import.meta.url));
+/** Absolute paths to chant-core's real modules, imported by the fixtures the way a lexicon package would be. */
+const runtimePath = resolve(thisDir, "../../runtime");
+const compositePath = resolve(thisDir, "../../composite");
+
+const MODULE_MARKER = "__chant1093ModuleEvaluated";
+const FACTORY_MARKER = "__chant1093FactoryInvoked";
+
+type MarkerHost = Record<string, boolean | undefined>;
+
+function marker(name: string): boolean | undefined {
+  return (globalThis as unknown as MarkerHost)[name];
+}
+
+function clearMarkers(): void {
+  delete (globalThis as unknown as MarkerHost)[MODULE_MARKER];
+  delete (globalThis as unknown as MarkerHost)[FACTORY_MARKER];
+}
+
+describe("fold under --sandbox never executes project code in the CLI process (chant #1093)", () => {
+  let testDir: string;
+  let seq = 0;
+
+  beforeEach(async () => {
+    const dir = join(tmpdir(), `chant-1093-fold-boundary-${Date.now()}-${Math.random()}`);
+    await mkdir(dir, { recursive: true });
+    testDir = await realpath(dir);
+    clearMarkers();
+  });
+
+  afterEach(async () => {
+    clearMarkers();
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  /**
+   * A project-owned composite factory: the shape chant#1022/#1023 folds by
+   * importing `./composites` and calling `WebApp(...)` for real.
+   */
+  async function writeCompositeFixture(): Promise<void> {
+    await writeFile(
+      join(testDir, "composites.ts"),
+      `
+        import { Composite } from ${JSON.stringify(compositePath)};
+        import { createResource } from ${JSON.stringify(runtimePath)};
+
+        globalThis[${JSON.stringify(MODULE_MARKER)}] = true;
+
+        const Bucket = createResource("Test::Bucket", "test", { arn: "Arn" });
+        const Role = createResource("Test::Role", "test", {});
+
+        export const WebApp = Composite((props) => {
+          globalThis[${JSON.stringify(FACTORY_MARKER)}] = true;
+          const bucket = new Bucket({ bucketName: props.name });
+          const role = new Role({ resource: bucket.arn });
+          return { bucket, role };
+        }, "WebApp");
+      `,
+    );
+    await writeFile(
+      join(testDir, "main.ts"),
+      `
+        import { WebApp } from "./composites";
+        export const web = WebApp({ name: "data" });
+      `,
+    );
+  }
+
+  test("plain --fold DOES invoke a project-owned composite factory in-process (the probe fires)", async () => {
+    await writeCompositeFixture();
+
+    const result = await discover(testDir, { fold: true });
+
+    // The file folds today — and folding it ran project code right here.
+    const main = result.foldDecisions.find((d) => d.file.endsWith("main.ts"));
+    expect(main?.mode).toBe("fold");
+    expect(marker(MODULE_MARKER), "composites.ts's module top level ran in this process").toBe(true);
+    expect(marker(FACTORY_MARKER), "the factory body ran in this process").toBe(true);
+    expect([...result.entities.keys()].sort()).toEqual(["webBucket", "webRole"]);
+  });
+
+  test("--sandbox invokes it in the child instead: no marker here, same entities", async () => {
+    await writeCompositeFixture();
+
+    const result = await discover(testDir, { fold: true, sandbox: true });
+
+    expect(result.errors).toEqual([]);
+    // Same entities, produced by the same factory with the same arguments —
+    // just on the other side of the boundary.
+    expect([...result.entities.keys()].sort()).toEqual(["webBucket", "webRole"]);
+    expect(marker(MODULE_MARKER), "project module top level must NOT run in the CLI process").toBeUndefined();
+    expect(marker(FACTORY_MARKER), "the factory body must NOT run in the CLI process").toBeUndefined();
+
+    // The demotion is reported, with a reason that names the cause.
+    const main = result.foldDecisions.find((d) => d.file.endsWith("main.ts"));
+    expect(main?.mode).toBe("run");
+    expect(main?.reason).toContain("--sandbox");
+    expect(main?.reason).toContain("./composites");
+  });
+
+  test("the cross-file AttrRef still resolves through the boundary", async () => {
+    await writeCompositeFixture();
+
+    const result = await discover(testDir, { fold: true, sandbox: true });
+
+    // `role.props.resource` is `bucket.arn`, an AttrRef whose logical name is
+    // assigned by naming INSIDE the child (chant#1045's design) — the same
+    // value the in-process fold produces, reached without executing anything
+    // here.
+    const role = result.entities.get("webRole") as unknown as { props: { resource: unknown } };
+    const ref = role.props.resource as { getLogicalName?: () => string | undefined; attribute?: string };
+    expect(ref.getLogicalName?.()).toBe("webBucket");
+    expect(ref.attribute).toBe("Arn");
+  });
+
+  /**
+   * The same hole, reached through `new Type(...)` rather than a factory call:
+   * a resource class is a lexicon export in every corpus entry today, but
+   * nothing in the language or the folder requires that.
+   */
+  async function writeConstructorFixture(): Promise<void> {
+    await writeFile(
+      join(testDir, "resources.ts"),
+      `
+        import { createResource } from ${JSON.stringify(runtimePath)};
+        globalThis[${JSON.stringify(MODULE_MARKER)}] = true;
+        export const Bucket = createResource("Test::Bucket", "test", { arn: "Arn" });
+      `,
+    );
+    await writeFile(
+      join(testDir, "main.ts"),
+      `
+        import { Bucket } from "./resources";
+        export const dataBucket = new Bucket({ bucketName: "data" });
+      `,
+    );
+  }
+
+  test("plain --fold DOES evaluate a project-owned constructor module in-process", async () => {
+    await writeConstructorFixture();
+
+    const result = await discover(testDir, { fold: true });
+
+    expect(result.foldDecisions.find((d) => d.file.endsWith("main.ts"))?.mode).toBe("fold");
+    expect(marker(MODULE_MARKER)).toBe(true);
+    expect([...result.entities.keys()]).toEqual(["dataBucket"]);
+  });
+
+  test("--sandbox demotes a project-owned constructor too", async () => {
+    await writeConstructorFixture();
+
+    const result = await discover(testDir, { fold: true, sandbox: true });
+
+    expect(result.errors).toEqual([]);
+    expect([...result.entities.keys()]).toEqual(["dataBucket"]);
+    expect(marker(MODULE_MARKER)).toBeUndefined();
+    const main = result.foldDecisions.find((d) => d.file.endsWith("main.ts"));
+    expect(main?.mode).toBe("run");
+    expect(main?.reason).toContain("--sandbox");
+  });
+
+  /**
+   * The allowlist is a boundary, not a blanket ban: a factory owned by one of
+   * THIS build's active lexicon packages still folds in-process under
+   * `--sandbox`. That is deliberate and is exactly chant#1045's stated scope
+   * ("sandboxing chant itself, or the lexicon packages" is a non-goal) — the
+   * CLI has already imported and executed every active lexicon package
+   * (`loadPlugins`) before discovery starts.
+   *
+   * Same fixture, same specifier, in both halves below — the ONLY difference
+   * is whether the build declared that lexicon as active.
+   */
+  async function installLexiconPackage(): Promise<{ lexicon: string; specifier: string }> {
+    const lexicon = `fold1093x${seq++}${Date.now().toString(36)}`;
+    const specifier = `@intentius/chant-lexicon-${lexicon}`;
+    const dir = join(testDir, "node_modules", specifier);
+    await mkdir(dir, { recursive: true });
+    await writeFile(
+      join(dir, "package.json"),
+      JSON.stringify({ name: specifier, version: "0.0.0", type: "module", exports: { ".": "./index.js" } }),
+    );
+    await writeFile(
+      join(dir, "index.js"),
+      `
+        const DECLARABLE_MARKER = Symbol.for("chant.declarable");
+        export function Widget(props) {
+          return { [DECLARABLE_MARKER]: true, lexicon: "test", entityType: "Test::Widget", kind: "resource", props };
+        }
+      `,
+    );
+    await writeFile(
+      join(testDir, "main.ts"),
+      `
+        import { Widget } from ${JSON.stringify(specifier)};
+        export const widget = Widget({ size: "large" });
+      `,
+    );
+    return { lexicon, specifier };
+  }
+
+  test("a factory from an ACTIVE lexicon package still folds under --sandbox", async () => {
+    const { lexicon } = await installLexiconPackage();
+
+    const result = await discover(testDir, { fold: true, sandbox: true, lexicons: [lexicon] });
+
+    expect(result.foldDecisions.find((d) => d.file.endsWith("main.ts"))?.mode).toBe("fold");
+    expect([...result.entities.keys()]).toEqual(["widget"]);
+  });
+
+  test("the same factory from a lexicon this build did NOT load is refused", async () => {
+    await installLexiconPackage();
+
+    const result = await discover(testDir, { fold: true, sandbox: true, lexicons: ["aws"] });
+
+    const main = result.foldDecisions.find((d) => d.file.endsWith("main.ts"));
+    expect(main?.mode).toBe("run");
+    expect(main?.reason).toContain("--sandbox");
+  });
+});

package/src/fold/subset.test.ts

@@ -280,12 +280,15 @@ describe("documented divergences — NOT unified by design (see subset.ts module
 /**
  * chant #1044 — the shared predicate's optional intrinsic registry.
  *
- * `findSubsetViolation` answers "is this shape foldable?" for two kinds of
- * caller: `fold()`'s own EVL twin, which has no registry, and a tool that
- * does (a control plane deciding whether a repository needs a sandboxed
- * child process). The parameter is what lets the second kind get fold()'s
- * real answer without running fold, while the first keeps the answer it
- * always had.
+ * `findSubsetViolation` answers "is this shape foldable?" for a caller that
+ * has a registry and one that doesn't: with it, the answer for a call is
+ * exact (fold()'s own); without it, every call is a violation, the
+ * pre-#1044 answer. EVL001 (`chant lint`) is the first kind as of #1106 —
+ * `runLint` threads the active lexicons' intrinsics onto
+ * `LintContext.intrinsics`, which EVL001 forwards here — and the second
+ * kind whenever a caller hasn't resolved a project's lexicons (a bare unit
+ * test, a tool asking "would this fold?" with no lexicon context of its
+ * own).
  */
 describe("findSubsetViolation — optional intrinsic registry (#1044)", () => {
   const REF: IntrinsicDef[] = [{ name: "Ref", isTag: false, foldsAsCall: true }];
@@ -331,14 +334,15 @@ describe("findSubsetViolation — optional intrinsic registry (#1044)", () => {
     expect(v?.message).toContain("getName(...)");
   });
 
-  test("registry-less EVL is now STRICTER than fold on an opted-in call — a known divergence, not a hole", () => {
-    // chant #1044 — EVL001 has no registry (see subset.ts module doc, point
-    // 2c), so it still flags `Ref(...)` in a resource's props exactly as it
-    // did before this change, while fold() — which is always given one —
-    // folds it. Recorded here so the divergence is a tracked property with a
-    // test rather than a surprise; closing it means handing the lint engine
-    // the active lexicons' intrinsics, which is a change to lint's own
-    // surface and deliberately not part of #1044.
+  test("EVL converges with fold on an opted-in call once it carries the registry (chant #1106)", () => {
+    // chant #1044 left EVL001 with no registry (see subset.ts module doc,
+    // point 2c), so it flagged `Ref(...)` in a resource's props even though
+    // fold() — which is always given one — folded it cleanly. #1106 closes
+    // that by threading `runLint`'s intrinsics parameter onto
+    // `LintContext.intrinsics`, which EVL001 passes straight through to this
+    // same `findSubsetViolation`/`checkObjectMember` predicate. A
+    // `LintContext` built WITH the registry (what `chant lint` now
+    // constructs for a real project) no longer flags what fold() accepts.
     const source = `const bad = new Thing({ x: Ref(env) });`;
     const sourceFile = ts.createSourceFile("t.ts", source, ts.ScriptTarget.Latest, true);
     const consts = collectConsts(sourceFile);
@@ -346,6 +350,16 @@ describe("findSubsetViolation — optional intrinsic registry (#1044)", () => {
 
     expect(() => foldResource(badInit, consts, REF)).not.toThrow();
 
+    const context: LintContext = { sourceFile, entities: [], filePath: "t.ts", lexicon: undefined, intrinsics: REF };
+    expect(evl001NonLiteralExpressionRule.check(context)).toHaveLength(0);
+  });
+
+  test("without the registry, EVL001 keeps the pre-#1044 conservative answer", () => {
+    // A `LintContext` built without `intrinsics` (a caller that hasn't
+    // resolved a project's lexicons) still flags the call — the safe
+    // default subset.ts's module doc describes, unchanged by #1106.
+    const source = `const bad = new Thing({ x: Ref(env) });`;
+    const sourceFile = ts.createSourceFile("t.ts", source, ts.ScriptTarget.Latest, true);
     const context: LintContext = { sourceFile, entities: [], filePath: "t.ts", lexicon: undefined };
     expect(evl001NonLiteralExpressionRule.check(context).length).toBeGreaterThan(0);
   });

package/src/fold/subset.ts

@@ -69,8 +69,22 @@ import { intrinsicCallFolds, type IntrinsicDef } from "../lexicon";
  *      the flow-sensitivity note below — the single divergence in the other
  *      direction, and the one this module treats as a wart). A caller with
  *      no registry degrades to "assume it runs", which is safe and cheap to
- *      reason about; EVL is exactly such a caller and its behavior on calls
- *      is unchanged by #1044.
+ *      reason about.
+ *
+ *      chant #1106 — EVL is no longer such a caller by default. `runLint`
+ *      (../lint/engine.ts) takes the active lexicons' `IntrinsicDef[]` as a
+ *      parameter and puts it on `LintContext.intrinsics`
+ *      (../lint/rule.ts), and EVL001 (evl001-non-literal-expression.ts)
+ *      passes it straight through to `checkObjectMember`. `chant lint`'s
+ *      three CLI entry points (the `lint` command's initial pass, its
+ *      `--fix` re-lint, and the LSP's per-file diagnostics) all resolve the
+ *      project's lexicons and thread their intrinsics through, mirroring
+ *      how `discover()` has done it for the fold path since #1039/#1105 —
+ *      so `chant lint` on a real project no longer flags `Ref(...)` that
+ *      `fold()` accepts. A `LintContext` built without that plumbing (a
+ *      unit test constructing one directly, a consumer that hasn't
+ *      resolved lexicons) still gets the pre-#1044 conservative answer —
+ *      that path was never wrong, only stricter than it had to be.
  *   3. Runtime *type* of a folded value — e.g. spreading `const n = 5`
  *      (`{...n}`) is shape-valid (`n` is a plain identifier) but `fold()`
  *      rejects it once it discovers `n` folds to a number, not an object.

package/src/lint/config.test.ts

@@ -1,7 +1,7 @@
 import { describe, test, expect, beforeEach, afterEach } from "vitest";
 import { loadConfig, DEFAULT_CONFIG, findProjectRoot } from "./config";
 import { writeFileSync, mkdirSync, rmSync } from "fs";
-import { join } from "path";
+import { join, resolve } from "path";
 
 const TEST_DIR = join(import.meta.dirname, "__test_config__");
 
@@ -705,10 +705,15 @@ describe("findProjectRoot", () => {
     expect(findProjectRoot(sub)).toBe(TEST_DIR);
   });
 
-  test("falls back to the start dir when no config is found", () => {
+  test("stops at the nearest .git/package.json boundary when no config is found (#1117)", () => {
     const sub = join(TEST_DIR, "nowhere");
     mkdirSync(sub, { recursive: true });
-    // No chant.config anywhere under TEST_DIR — returns the (resolved) start dir.
-    expect(findProjectRoot(sub)).toBe(sub);
+    // No chant.config anywhere under TEST_DIR — walking up from this real
+    // repo location reaches `packages/core`'s own package.json before the
+    // filesystem root, so that's the returned boundary, not `sub` itself
+    // (chant #1117 — discovery must never wander past the project just
+    // because it declares no config).
+    const packageRoot = resolve(import.meta.dirname, "..", "..");
+    expect(findProjectRoot(sub)).toBe(packageRoot);
   });
 });

package/src/lint/config.ts

@@ -6,6 +6,13 @@ import type { Severity, RuleConfig } from "./rule";
 import { moduleDir, getRuntime } from "../runtime-adapter";
 import strictPreset from "./presets/strict.json";
 
+// chant #1117 — the upward config-discovery walk moved to a shared module
+// (`../project-root`) so `chant build`/`lint.policies` use the identical walk
+// `chant lint`/`chant graph` already did. Re-exported here since this is
+// still where every existing call site (`./config.test.ts`, `../cli/commands/lint.ts`)
+// imports it from.
+export { findProjectRoot } from "../project-root";
+
 /** Mapping of built-in preset names to their file paths */
 const BUILTIN_PRESETS: Record<string, string> = {
   "@intentius/chant/lint/presets/strict": resolve(moduleDir(import.meta.url), "presets/strict.json"),
@@ -323,29 +330,6 @@ function loadConfigFile(configPath: string, visited: Set<string> = new Set()): L
   return mergedConfig;
 }
 
-/**
- * Walk up from `startDir` to the nearest ancestor holding a chant project
- * config (`chant.config.ts` or `chant.config.json`). Returns that directory, or
- * `startDir` unchanged when none is found before the filesystem root.
- *
- * Linting a subpath (`chant graph src --format ir`, `chant lint src/lib`) must
- * still see the project-root config: its `lint.overrides` globs are written
- * project-root-relative (`src/lib/**`), and a rule set scoped only to the lint
- * arg would silently drop them. Config discovery therefore anchors on the
- * project root, not the path being linted.
- */
-export function findProjectRoot(startDir: string): string {
-  let dir = resolve(startDir);
-  for (;;) {
-    if (existsSync(join(dir, "chant.config.ts")) || existsSync(join(dir, "chant.config.json"))) {
-      return dir;
-    }
-    const parent = dirname(dir);
-    if (parent === dir) return resolve(startDir);
-    dir = parent;
-  }
-}
-
 /**
  * Load lint configuration from a directory.
  *

package/src/lint/engine.ts

@@ -1,4 +1,5 @@
 import type { LintRule, LintDiagnostic, LintContext } from "./rule";
+import type { IntrinsicDef } from "../lexicon";
 import { parseFile } from "./parser";
 import { readFileSync } from "fs";
 
@@ -193,12 +194,22 @@ function isDiagnosticDisabled(
  * @param files - Array of file paths to lint
  * @param rules - Array of lint rules to execute
  * @param ruleOptions - Optional map of rule ID to options object
+ * @param intrinsics - chant #1106 — the active lexicons' registered
+ *   intrinsics (e.g. AWS's `Ref`, `GetAtt`), put on every file's
+ *   `LintContext.intrinsics` so a rule built on `../fold/subset.ts`'s
+ *   shared predicate (EVL001) answers exactly like `fold()` does for a
+ *   registered, opted-in call, instead of degrading to "every call is a
+ *   violation". Mirrors how `discover()` has threaded the same
+ *   `IntrinsicDef[]` into the fold path since #1039/#1105. Optional and
+ *   defaulting to none, so a caller that hasn't resolved a project's
+ *   lexicons (a unit test, `bench.test.ts`) is unaffected.
  * @returns LintRunResult with diagnostics and suppressed items
  */
 export async function runLint(
   files: string[],
   rules: LintRule[],
   ruleOptions?: Map<string, Record<string, unknown>>,
+  intrinsics?: readonly IntrinsicDef[],
 ): Promise<LintRunResult> {
   const allDiagnostics: LintDiagnostic[] = [];
   const allSuppressed: Array<LintDiagnostic & { reason?: string }> = [];
@@ -219,6 +230,7 @@ export async function runLint(
         entities: [],
         filePath,
         lexicon: undefined,
+        intrinsics,
       };
 
       // Execute each rule

package/src/lint/policy.ts

@@ -4,7 +4,7 @@
  * `policyGate` Op step runs this to gate an apply on the same checks.
  */
 import { resolve, dirname } from "node:path";
-import { loadChantConfig } from "../config";
+import { loadChantConfigUpward } from "../config";
 import { resolveProjectLexicons, loadPlugins } from "../cli/plugins";
 import { build } from "../build";
 import { runPostSynthChecks, isPostSynthCheck } from "./post-synth";
@@ -55,10 +55,10 @@ export async function evaluateProjectPolicies(opts: {
   const plugins = await loadPlugins(lexiconNames);
   const serializers = plugins.map((p) => p.serializer);
 
-  // Config can live in the build dir or its parent (the project root).
-  const loaded = await loadChantConfig(buildPath).then((r) =>
-    r.configPath ? r : loadChantConfig(dirname(buildPath)),
-  );
+  // chant #1117 — walks up from the build dir to the project root, same as
+  // `chant build` (`../cli/commands/build.ts`'s `loadChantConfigUpward`), not
+  // just the build dir's immediate parent.
+  const loaded = await loadChantConfigUpward(buildPath);
   const config = loaded.config;
   const configDir = loaded.configPath ? dirname(loaded.configPath) : buildPath;
   const env = opts.env ?? config.ownership?.env;

package/src/lint/rule.ts

@@ -1,4 +1,5 @@
 import type * as ts from "typescript";
+import type { IntrinsicDef } from "../lexicon";
 
 /**
  * Severity level for lint diagnostics
@@ -60,6 +61,19 @@ export interface LintContext {
   filePath: string;
   /** Optional lexicon context (undefined for core rules) */
   lexicon?: string;
+  /**
+   * chant #1106 — the active lexicons' registered intrinsics (`Ref`,
+   * `GetAtt`, ...), threaded down from `runLint` (../lint/engine.ts) so a
+   * rule built on the shared `../fold/subset.ts` predicate
+   * (`findSubsetViolation`/`checkObjectMember`, used by EVL001) gets the
+   * SAME answer `fold()` does for a registered, opted-in call. Mirrors how
+   * `discover()` has threaded `IntrinsicDef[]` into the fold path since
+   * #1039/#1105. Undefined when the caller hasn't resolved a project's
+   * lexicons (a bare unit test constructing a `LintContext` directly, for
+   * instance) — subset.ts then falls back to its pre-#1044 answer: every
+   * call is a violation.
+   */
+  intrinsics?: readonly IntrinsicDef[];
 }
 
 /**

package/src/lint/rules/evl001-non-literal-expression.test.ts

@@ -2,6 +2,7 @@ import { describe, test, expect } from "vitest";
 import * as ts from "typescript";
 import { evl001NonLiteralExpressionRule } from "./evl001-non-literal-expression";
 import type { LintContext } from "../rule";
+import type { IntrinsicDef } from "../../lexicon";
 
 function createContext(code: string, filePath = "test.ts"): LintContext {
   const sourceFile = ts.createSourceFile(filePath, code, ts.ScriptTarget.Latest, true);
@@ -155,4 +156,42 @@ describe("EVL001: non-literal-expression", () => {
     expect(diags).toHaveLength(1);
     expect(diags[0].ruleId).toBe("EVL001");
   });
+
+  /**
+   * chant #1106 — `LintContext.intrinsics`, threaded from `runLint`, is what
+   * lets this rule answer a registered call-form intrinsic exactly like
+   * `fold()` does instead of flagging every call. See ../../fold/subset.ts
+   * and ../../fold/subset.test.ts for the shared predicate this rule calls.
+   */
+  describe("context.intrinsics (#1106)", () => {
+    const REF: IntrinsicDef[] = [{ name: "Ref", isTag: false, foldsAsCall: true }];
+
+    test("flags a call to a registered, opted-in intrinsic when the context carries no registry", () => {
+      const ctx = createContext(`new Bucket({ name: Ref(env) });`);
+      const diags = evl001NonLiteralExpressionRule.check(ctx);
+      expect(diags).toHaveLength(1);
+      expect(diags[0].ruleId).toBe("EVL001");
+    });
+
+    test("does not flag that same call once the context carries the registry", () => {
+      const ctx: LintContext = { ...createContext(`new Bucket({ name: Ref(env) });`), intrinsics: REF };
+      expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+    });
+
+    test("a registered name WITHOUT the call opt-in still flags, even with the registry present", () => {
+      const notOptedIn: IntrinsicDef[] = [{ name: "Reference", isTag: false }];
+      const ctx: LintContext = {
+        ...createContext(`new Bucket({ name: Reference(env) });`),
+        intrinsics: notOptedIn,
+      };
+      const diags = evl001NonLiteralExpressionRule.check(ctx);
+      expect(diags).toHaveLength(1);
+    });
+
+    test("an unregistered call still flags with the registry present", () => {
+      const ctx: LintContext = { ...createContext(`new Bucket({ name: makeName() });`), intrinsics: REF };
+      const diags = evl001NonLiteralExpressionRule.check(ctx);
+      expect(diags).toHaveLength(1);
+    });
+  });
 });

package/src/lint/rules/evl001-non-literal-expression.ts

@@ -31,7 +31,7 @@ function checkNode(node: ts.Node, context: LintContext, diagnostics: LintDiagnos
       const firstArg = node.arguments[0];
       if (ts.isObjectLiteralExpression(firstArg)) {
         for (const prop of firstArg.properties) {
-          const violation = checkObjectMember(prop);
+          const violation = checkObjectMember(prop, context.intrinsics);
           if (violation) {
             const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(
               violation.node.getStart(context.sourceFile),