@intentius/chant 0.24.0 → 0.26.0

package/src/discovery/sandbox/run.ts

@@ -1,4 +1,3 @@
-import { fork } from "node:child_process";
 import { realpathSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
 import type { Declarable } from "../../declarable";
@@ -7,6 +6,7 @@ import { decodeEntitySet, type EntitySetWire } from "../entity-wire-codec";
 import { bundleDriver } from "./bundle";
 import { classifyChildError } from "./child-errors";
 import { generateDriverSource } from "./driver";
+import { forkSandboxed } from "./fork";
 
 /**
  * chant #1045 Phase 2 — runs every run-fallback file for a build TOGETHER, as
@@ -14,26 +14,16 @@ import { generateDriverSource } from "./driver";
  * the same shape `discover()`'s own in-process run path would have produced:
  * a named, ref-resolved entities map plus any errors.
  *
- * Isolation mechanics (verified on Node v24.13.1 — see the chant#1045 PR
- * description for the full write-up):
- *  - `--permission --allow-fs-read=<bundle dir>,<project dir>[,<trusted
- *    external package dirs>]` — no filesystem write, no child-process, no
- *    worker-thread access. Bundling with esbuild first (not a packaging
- *    change — see `./bundle.ts`) means the child needs NO TypeScript loader
- *    (no `tsx`, so no `--allow-worker` and no writable temp dir either),
- *    unlike the plain `tsx`-based run path. The "trusted external package
- *    dirs" allowance is narrow and specific: `./bundle.ts` deliberately
- *    leaves a couple of chant/lexicon-internal dependencies (`typescript`)
- *    unbundled and resolves them to their real, fixed location instead —
- *    project source never controls what's installed there.
- *  - The env is a spawn-time scrub (`env: {}` below, plus `PATH` — see the
- *    option below), not `--permission`: Node's Permission Model does not gate
- *    `process.env` at all (confirmed: every key stays readable even under
- *    `--permission`).
- *  - Network egress is NOT addressed here — Node has no flag for it. See the
- *    chant#1045 PR description / docs for the residual-risk statement and
- *    deployment guidance (a container with no egress, a network namespace).
- *    This function does not claim to close that gap.
+ * Isolation mechanics live in `./fork.ts` — the one function that spawns a
+ * sandboxed child, shared with chant #1113's config evaluation
+ * (`./config-run.ts`) so the two cannot drift apart. In short:
+ * `--permission --allow-fs-read=<bundle dir>,<project dir>[,<trusted external
+ * package dirs>]`, a spawn-time environment scrub, no writes, no spawning, no
+ * worker threads, and no network guarantee. The "trusted external package
+ * dirs" allowance is narrow and specific: `./bundle.ts` deliberately leaves a
+ * couple of chant/lexicon-internal dependencies (`typescript`) unbundled and
+ * resolves them to their real, fixed location instead — project source never
+ * controls what's installed there.
  *
  * What does NOT run inside the child: fold (`tryFoldFile`, `../fold-import`)
  * stays exactly where it is today, in the parent, unsandboxed — fold already
@@ -108,7 +98,23 @@ export async function runFallbackFilesSandboxed(
       projectRealpath = resolve(buildRoot);
     }
 
-    const response = await runChildProcess(bundlePath, bundleDir, projectRealpath, externalReadPaths);
+    const response = await forkSandboxed(
+      {
+        bundlePath,
+        bundleDir,
+        projectRealpath,
+        externalReadPaths,
+        // chant #1045 Phase 2 — Node's Permission Model does not gate
+        // `process.env`; scrubbing it at spawn is the only way to keep the
+        // ambient environment out of untrusted project source's reach. `PATH`
+        // is kept only because some platforms' module resolution/dynamic
+        // linking consults it; it carries no project secrets.
+        env: { PATH: process.env.PATH ?? "" },
+        timeoutMs: CHILD_TIMEOUT_MS,
+        label: "sandboxed run",
+      },
+      isChildResponse,
+    );
 
     const errors = (response.errors ?? []).map(
       (e) => new DiscoveryError(e.file, e.message, e.type),
@@ -131,66 +137,3 @@ export async function runFallbackFilesSandboxed(
     rmSync(bundleDir, { recursive: true, force: true });
   }
 }
-
-/** Fork the bundle under `--permission`, with a scrubbed environment, and resolve with its one IPC message (or reject on crash/timeout/fork error). */
-function runChildProcess(
-  bundlePath: string,
-  bundleDir: string,
-  projectRealpath: string,
-  externalReadPaths: readonly string[],
-): Promise<ChildResponse> {
-  return new Promise((resolvePromise, reject) => {
-    const readAllowances = [bundleDir, projectRealpath, ...externalReadPaths].map(
-      (p) => `--allow-fs-read=${p}`,
-    );
-    const child = fork(bundlePath, [], {
-      execArgv: ["--permission", ...readAllowances],
-      // chant #1045 Phase 2 — Node's Permission Model does not gate
-      // `process.env`; scrubbing it here is the only way to keep the ambient
-      // environment out of untrusted project source's reach. `PATH` is kept
-      // only because some platforms' module resolution/dynamic linking
-      // consults it; it carries no project secrets.
-      env: { PATH: process.env.PATH ?? "" },
-      stdio: ["ignore", "pipe", "pipe", "ipc"],
-    });
-
-    let settled = false;
-    let stderrBuf = "";
-
-    const timeout = setTimeout(() => {
-      if (settled) return;
-      settled = true;
-      child.kill();
-      reject(new Error(`sandboxed run timed out after ${CHILD_TIMEOUT_MS}ms`));
-    }, CHILD_TIMEOUT_MS);
-
-    child.stderr?.on("data", (chunk: Buffer) => {
-      stderrBuf += chunk.toString();
-    });
-
-    child.on("message", (msg: unknown) => {
-      if (settled || !isChildResponse(msg)) return;
-      settled = true;
-      clearTimeout(timeout);
-      resolvePromise(msg);
-    });
-
-    child.on("error", (err) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timeout);
-      reject(err);
-    });
-
-    child.on("exit", (code, signal) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timeout);
-      reject(
-        new Error(
-          `sandboxed child exited before reporting results (code ${code}, signal ${signal})${stderrBuf.trim() ? `: ${stderrBuf.trim()}` : ""}`,
-        ),
-      );
-    });
-  });
-}

package/src/intrinsic-interpolation.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "vitest";
+import { describe, expect, test, vi } from "vitest";
 import { buildInterpolatedString, defaultInterpolationSerializer } from "./intrinsic-interpolation";
 import { AttrRef } from "./attrref";
 import { INTRINSIC_MARKER } from "./intrinsic";
@@ -54,6 +54,32 @@ describe("defaultInterpolationSerializer", () => {
     expect(() => serialize(ref)).toThrow("logical name not set");
   });
 
+  // chant #1137 — this dispatch used to check `value instanceof AttrRef`,
+  // which returns false for an AttrRef built by a SEPARATELY-LOADED copy of
+  // `./attrref` (the same dual-npm-copy hazard #1122 fixed for
+  // `LexiconOutput`). Because AttrRef also implements Intrinsic, the miss
+  // was not loud: a foreign AttrRef fell into the generic Intrinsic branch
+  // below instead, whose `toJSON()` returns the `{__attrRef}` wire envelope
+  // (not a `Ref`), silently stringified to `[object Object]` in the
+  // interpolated output. `vi.resetModules()` + a fresh dynamic import
+  // reproduces the split module graph exactly.
+  test("serializes an AttrRef built by a second, separately-loaded copy of AttrRef", async () => {
+    vi.resetModules();
+    const secondCopy = await import("./attrref");
+    expect(secondCopy.AttrRef).not.toBe(AttrRef);
+
+    const parent = {};
+    const foreignRef = new secondCopy.AttrRef(parent, "Arn");
+    foreignRef._setLogicalName("MyBucket");
+
+    // The historic bug: instanceof fails across separately-loaded copies of
+    // chant-core, even though the two classes are structurally identical.
+    expect(foreignRef instanceof AttrRef).toBe(false);
+
+    expect(serialize(foreignRef)).toBe("${MyBucket.Arn}");
+    vi.resetModules();
+  });
+
   test("serializes Intrinsic with Ref toJSON", () => {
     const intrinsic = {
       [INTRINSIC_MARKER]: true as const,

package/src/intrinsic-interpolation.ts

@@ -9,6 +9,7 @@
 import { AttrRef } from "./attrref";
 import { INTRINSIC_MARKER } from "./intrinsic";
 import { DECLARABLE_MARKER } from "./declarable";
+import { isAttrRefLike } from "./utils";
 
 export type InterpolationValueSerializer = (value: unknown) => string;
 
@@ -26,8 +27,15 @@ export function defaultInterpolationSerializer(
   serializeRef: (refName: string) => string,
 ): InterpolationValueSerializer {
   return (value: unknown): string => {
-    // Handle AttrRef
-    if (value instanceof AttrRef) {
+    // Handle AttrRef. Duck-type, not `instanceof` (chant #1137): a lexicon
+    // built against a separate copy of `@intentius/chant` produces AttrRefs
+    // that fail `instanceof AttrRef` here but carry the same shape — and
+    // since AttrRef also implements Intrinsic, missing this branch does not
+    // fail loud. The value instead falls into the generic Intrinsic branch
+    // below, which calls `toJSON()` (returning the `{__attrRef}` wire
+    // envelope, not a `Ref`) and silently stringifies it to `[object
+    // Object]` in the interpolated output.
+    if (isAttrRefLike(value)) {
       const logicalName = value.getLogicalName();
       if (!logicalName) {
         throw new Error(

package/src/lexicon-output.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "vitest";
+import { describe, test, expect, vi } from "vitest";
 import { LexiconOutput, output, isLexiconOutput } from "./lexicon-output";
 import { AttrRef } from "./attrref";
 import { INTRINSIC_MARKER } from "./intrinsic";
@@ -87,11 +87,101 @@ describe("LexiconOutput", () => {
     expect(lo.getOutputValue()).toEqual({ "Fn::GetAtt": ["myBucket", "Arn"] });
   });
 
+  // chant #1137 — the constructor used to check `ref instanceof AttrRef`,
+  // which returns false for an AttrRef built by a SEPARATELY-LOADED copy of
+  // `./attrref` (the same dual-npm-copy hazard #1122 fixed for
+  // `isLexiconOutput` itself). Because AttrRef also implements Intrinsic,
+  // the miss was not loud: a foreign AttrRef fell into the `isIntrinsic(ref)`
+  // branch instead, stored as `_intrinsic` rather than recognized as an
+  // AttrRef-sourced output — so `getOutputValue()` called the foreign
+  // AttrRef's own `toJSON()` (the `{__attrRef}` wire envelope) instead of
+  // emitting `Fn::GetAtt`, a broken Output with no error at synth time.
+  // `vi.resetModules()` + a fresh dynamic import reproduces the split
+  // module graph exactly.
+  test("recognizes an AttrRef built by a second, separately-loaded copy of AttrRef", async () => {
+    const bucket = new MockResource();
+
+    vi.resetModules();
+    const secondCopy = await import("./attrref");
+    expect(secondCopy.AttrRef).not.toBe(AttrRef);
+
+    const foreignRef = new secondCopy.AttrRef(bucket, "Arn");
+
+    // The historic bug: instanceof fails across separately-loaded copies of
+    // chant-core, even though the two classes are structurally identical.
+    expect(foreignRef instanceof AttrRef).toBe(false);
+
+    const lo = new LexiconOutput(foreignRef, "BucketArn");
+    lo._setSourceEntity("myBucket");
+
+    // The fix: recognized as AttrRef-sourced, not misfiled as a generic
+    // Intrinsic — sourceAttribute is set and getOutputValue() emits a real
+    // Fn::GetAtt, not the foreign AttrRef's own wire-envelope toJSON().
+    expect(lo.sourceLexicon).toBe("testdom");
+    expect(lo.sourceAttribute).toBe("Arn");
+    expect(lo.getOutputValue()).toEqual({ "Fn::GetAtt": ["myBucket", "Arn"] });
+    vi.resetModules();
+  });
+
   test("getOutputValue() returns intrinsic toJSON for Intrinsic-based output", () => {
     const mockIntrinsic = { [INTRINSIC_MARKER]: true as const, toJSON: () => ({ "Fn::Sub": "http://${Param}/path" }) };
     const lo = new LexiconOutput(mockIntrinsic, "MyUrl");
     expect(lo.getOutputValue()).toEqual({ "Fn::Sub": "http://${Param}/path" });
   });
+
+  // chant #1121 — an already-resolved plain value (not a reference to
+  // anything) must be emitted verbatim as the Output's Value, never coerced
+  // into a bogus Fn::GetAtt pointing at the output's own logical id.
+  describe("literal-valued output (chant #1121)", () => {
+    test("accepts a string literal and sets no source entity/attribute", () => {
+      const lo = new LexiconOutput("us-east-1", "Region");
+      expect(lo.sourceLexicon).toBe("");
+      expect(lo.sourceEntity).toBe("");
+      expect(lo.sourceAttribute).toBeNull();
+      expect(lo.outputName).toBe("Region");
+    });
+
+    test("getOutputValue() returns a string literal verbatim", () => {
+      const lo = new LexiconOutput("fold-output-repro", "oParamName");
+      expect(lo.getOutputValue()).toBe("fold-output-repro");
+    });
+
+    test("getOutputValue() returns a number literal verbatim", () => {
+      const lo = new LexiconOutput(42, "oCount");
+      expect(lo.getOutputValue()).toBe(42);
+    });
+
+    test("getOutputValue() returns a boolean literal verbatim (including false)", () => {
+      expect(new LexiconOutput(true, "oEnabled").getOutputValue()).toBe(true);
+      expect(new LexiconOutput(false, "oDisabled").getOutputValue()).toBe(false);
+    });
+
+    test("getOutputValue() returns 0 and empty string verbatim (falsy but valid)", () => {
+      expect(new LexiconOutput(0, "oZero").getOutputValue()).toBe(0);
+      expect(new LexiconOutput("", "oEmpty").getOutputValue()).toBe("");
+    });
+
+    test("_setSourceEntity has no effect on getOutputValue() for a literal", () => {
+      const lo = new LexiconOutput("v1", "oVersion");
+      lo._setSourceEntity("someUnrelatedEntity");
+      expect(lo.getOutputValue()).toBe("v1");
+    });
+
+    test("throws for a ref that is neither an AttrRef, an Intrinsic, nor a string/number/boolean literal", () => {
+      // Mirrors what a resource member access that resolves to `undefined`
+      // looks like at runtime (e.g. a typo, or a non-attribute field a
+      // generated resource class never echoes onto the instance).
+      expect(() => new LexiconOutput(undefined as unknown as string, "oBroken")).toThrow(
+        /must be an AttrRef, an Intrinsic, or an already-resolved string\/number\/boolean/,
+      );
+    });
+
+    test("throws for null", () => {
+      expect(() => new LexiconOutput(null as unknown as string, "oBroken")).toThrow(
+        /must be an AttrRef, an Intrinsic, or an already-resolved string\/number\/boolean/,
+      );
+    });
+  });
 });
 
 describe("LexiconOutput.auto", () => {
@@ -164,6 +254,20 @@ describe("output() helper", () => {
     expect(result.sourceAttribute).toBe("Arn");
     expect(result.outputName).toBe("DataBucketArn");
   });
+
+  // chant #1121
+  test.each([
+    ["string", "v1"],
+    ["number", 42],
+    ["boolean", true],
+  ] as const)("creates a literal-valued LexiconOutput from a %s and emits it verbatim", (_kind, value) => {
+    const result = output(value, "oLiteral");
+
+    expect(result).toBeInstanceOf(LexiconOutput);
+    expect(result.sourceEntity).toBe("");
+    expect(result.sourceAttribute).toBeNull();
+    expect(result.getOutputValue()).toBe(value);
+  });
 });
 
 describe("isLexiconOutput", () => {
@@ -188,6 +292,41 @@ describe("isLexiconOutput", () => {
 
     expect(isLexiconOutput(ref)).toBe(false);
   });
+
+  // chant #1122 — the guard used to be `value instanceof LexiconOutput`,
+  // which returns false when the value was built by a SEPARATELY-LOADED
+  // copy of this module (a plain npm-dedupe outcome: a lexicon pinned to a
+  // chant range that doesn't overlap the project's own gets its own nested
+  // `node_modules/@intentius/chant`). `vi.resetModules()` + a fresh dynamic
+  // import reproduces that split module graph exactly, without needing an
+  // actual second install on disk — the resulting instance is structurally
+  // and behaviorally identical to a real LexiconOutput, just built from a
+  // distinct `LexiconOutput` class object.
+  test("recognizes a LexiconOutput built by a second, separately-loaded copy of this module", async () => {
+    vi.resetModules();
+    const secondCopy = await import("./lexicon-output");
+
+    // Sanity check that this really is a distinct module instance — the
+    // premise the rest of the test depends on.
+    expect(secondCopy.LexiconOutput).not.toBe(LexiconOutput);
+
+    const second = new secondCopy.LexiconOutput("v2", "oFromSecondCopy");
+
+    // The historic bug: instanceof fails across separately-loaded copies of
+    // chant-core, even though the two classes are structurally identical.
+    expect(second instanceof LexiconOutput).toBe(false);
+
+    // The fix: a Symbol.for global marker holds across copies the way
+    // DECLARABLE_MARKER/INTRINSIC_MARKER/STACK_OUTPUT_MARKER already do —
+    // isLexiconOutput (from EITHER copy) recognizes the other copy's output.
+    expect(isLexiconOutput(second)).toBe(true);
+    expect(secondCopy.isLexiconOutput(second)).toBe(true);
+
+    // And the callers that gate on this guard only ever read own-prototype
+    // members that survive the cross-copy split.
+    expect(second.getOutputValue()).toBe("v2");
+    vi.resetModules();
+  });
 });
 
 describe("collectLexiconOutputs", () => {
@@ -231,4 +370,37 @@ describe("collectLexiconOutputs", () => {
     expect(collected).toHaveLength(1);
     expect(collected[0].outputName).toBe("BucketArn");
   });
+
+  // chant #1121 — a literal-valued output has no source entity. Before this
+  // fix, a top-level `export const x = output("literal", "x")` fell back to
+  // naming the output's OWN map key as its "source entity" (there being no
+  // `_sourceParent` to resolve), which `getOutputValue()`'s `Fn::GetAtt`
+  // fallback then read back out as a self-referencing, invalid reference.
+  test("does NOT fall back to the output's own key as sourceEntity for a literal-valued output", () => {
+    const literalOutput = output("fold-output-repro", "oParamName");
+
+    const entities = new Map<string, Declarable>();
+    entities.set("oParamName", literalOutput as unknown as Declarable);
+
+    const collected = collectLexiconOutputs(entities);
+
+    expect(collected).toHaveLength(1);
+    expect(collected[0].sourceEntity).toBe("");
+    expect(collected[0].getOutputValue()).toBe("fold-output-repro");
+  });
+
+  test("does NOT fall back to the containing entity's name for a literal-valued output nested in props", () => {
+    const bucket = new MockResource();
+    const literalOutput = output(123, "oNested");
+    bucket.props.nested = literalOutput;
+
+    const entities = new Map<string, Declarable>();
+    entities.set("dataBucket", bucket as unknown as Declarable);
+
+    const collected = collectLexiconOutputs(entities);
+
+    expect(collected).toHaveLength(1);
+    expect(collected[0].sourceEntity).toBe("");
+    expect(collected[0].getOutputValue()).toBe(123);
+  });
 });

package/src/lexicon-output.ts

@@ -1,5 +1,32 @@
-import { INTRINSIC_MARKER, type Intrinsic } from "./intrinsic";
+import { INTRINSIC_MARKER, isIntrinsic, type Intrinsic } from "./intrinsic";
 import { AttrRef } from "./attrref";
+import { isAttrRefLike } from "./utils";
+
+/** A value `output()` accepts that is already fully resolved — not a
+ * reference to anything, just data the author computed (a literal, a prop,
+ * a template string). See chant #1121. */
+export type LexiconOutputLiteral = string | number | boolean;
+
+/**
+ * Marker symbol for LexiconOutput identification (chant #1122).
+ *
+ * A GLOBAL symbol (via `Symbol.for`), like every other chant-core brand
+ * check — `DECLARABLE_MARKER`, `STACK_OUTPUT_MARKER`, `INTRINSIC_MARKER` —
+ * holds across separately-loaded copies of chant-core the way `instanceof`
+ * does not. Two copies in one process is a plain npm-dedupe outcome: a
+ * lexicon pinned to a chant range that does not overlap the project's own
+ * gets a nested `node_modules/@intentius/chant`, and a project file
+ * importing `output` from that lexicon then holds a different `LexiconOutput`
+ * class than the CLI does. `instanceof LexiconOutput` returns false for a
+ * real output built by the other copy, and every `Outputs` entry vanishes
+ * silently.
+ *
+ * Installed non-enumerably in the constructor (not as a public class field)
+ * so a shallow spread/clone of a real instance — which would already lack
+ * its prototype methods (`getOutputValue()`, `_setSourceEntity()`, …) — does
+ * not silently pick up the marker and pass this guard too.
+ */
+export const LEXICON_OUTPUT_MARKER = Symbol.for("chant.lexiconOutput");
 
 /**
  * Sanitize auto-generated Output name parts into a valid CloudFormation
@@ -34,11 +61,17 @@ export function sanitizeLogicalId(...parts: string[]): string {
  *
  * Implements Intrinsic so it can be used as Value<string> anywhere.
  *
- * Accepts either an AttrRef (resource attribute reference) or any Intrinsic
- * (e.g. Sub, Join) for computed output values like constructed URLs.
+ * Accepts an AttrRef (resource attribute reference), any Intrinsic (e.g. Sub,
+ * Join) for computed output values like constructed URLs, or an already-
+ * resolved literal (string/number/boolean) — a constant the author's code
+ * computed rather than a reference to anything (chant #1121).
  */
 export class LexiconOutput implements Intrinsic {
   readonly [INTRINSIC_MARKER] = true as const;
+  /** @internal Brand marker — see {@link LEXICON_OUTPUT_MARKER}. Declared
+   * here only for type purposes; the real, non-enumerable property is
+   * installed by the constructor. */
+  readonly [LEXICON_OUTPUT_MARKER]!: true;
   readonly sourceLexicon: string;
   readonly sourceEntity: string;
   readonly sourceAttribute: string | null;
@@ -52,9 +85,32 @@ export class LexiconOutput implements Intrinsic {
    * checking on every field it reads (#1047).
    */
   readonly _intrinsic: Intrinsic | null;
+  /**
+   * @internal The already-resolved literal (string/number/boolean) when
+   * constructed from neither an AttrRef nor an Intrinsic — non-null exactly
+   * when `_intrinsic` is null AND `sourceAttribute` is null. There is no
+   * source entity or attribute to reference, so `getOutputValue()` returns
+   * this value verbatim rather than fabricating a `Fn::GetAtt` out of an
+   * unset attribute (chant #1121). Readable outside the class for the same
+   * reason as `_intrinsic`/`_sourceParent` above.
+   */
+  readonly _literalValue: LexiconOutputLiteral | null;
 
-  constructor(ref: AttrRef | Intrinsic | string, name: string) {
-    if (ref instanceof AttrRef) {
+  constructor(ref: AttrRef | Intrinsic | LexiconOutputLiteral, name: string) {
+    Object.defineProperty(this, LEXICON_OUTPUT_MARKER, {
+      value: true,
+      enumerable: false,
+    });
+    // Duck-type, not `instanceof` (chant #1137): a lexicon built against a
+    // separate copy of `@intentius/chant` produces AttrRefs that fail
+    // `instanceof AttrRef` here but carry the same shape — and since AttrRef
+    // also implements Intrinsic, missing this branch does not fail loud.
+    // The value instead falls into the `isIntrinsic(ref)` branch below,
+    // stored as `_intrinsic` rather than an AttrRef-sourced output, so
+    // `getOutputValue()` later calls the foreign AttrRef's own `toJSON()`
+    // (the `{__attrRef}` wire envelope) instead of emitting `Fn::GetAtt` —
+    // a broken Output emitted with no error at synth time.
+    if (isAttrRefLike(ref)) {
       const parent = ref.parent.deref();
       if (!parent) {
         throw new Error("Cannot create LexiconOutput: parent entity has been garbage collected");
@@ -70,16 +126,45 @@ export class LexiconOutput implements Intrinsic {
       this.outputName = name;
       this._sourceParent = ref.parent;
       this._intrinsic = null;
-    } else {
-      // Intrinsic (Sub, Join, Ref, etc.) — no parent entity tracking needed
-      // Note: `string` in the union is for attribute accessors typed as string at the
-      // TypeScript level (they are AttrRef at runtime, caught by instanceof above).
+      this._literalValue = null;
+    } else if (isIntrinsic(ref)) {
+      // Intrinsic (Sub, Join, Ref, etc.) — no parent entity tracking needed.
       this.sourceLexicon = "";
       this.sourceEntity = "";
       this.sourceAttribute = null;
       this.outputName = name;
       this._sourceParent = null;
-      this._intrinsic = typeof ref !== "string" ? ref : null;
+      this._intrinsic = ref;
+      this._literalValue = null;
+    } else if (typeof ref === "string" || typeof ref === "number" || typeof ref === "boolean") {
+      // An already-resolved literal — a real string/number/boolean the
+      // caller computed (a prop, a template string, a plain constant), not
+      // a reference to anything. The `string` arm of the exported type
+      // exists for a documented reason: a generated resource's attribute
+      // accessor is typed `string` at the TypeScript level but is a real
+      // `AttrRef` at runtime, caught by the `isAttrRefLike` check above — so
+      // anything that reaches this branch genuinely has no source entity
+      // or attribute, and is recorded to be emitted as a plain `Value`
+      // rather than a fabricated `Fn::GetAtt` (chant #1121).
+      this.sourceLexicon = "";
+      this.sourceEntity = "";
+      this.sourceAttribute = null;
+      this.outputName = name;
+      this._sourceParent = null;
+      this._intrinsic = null;
+      this._literalValue = ref;
+    } else {
+      // Neither a reference NOR a resolved value — most commonly `undefined`
+      // from accessing a resource member that looks like an attribute but
+      // isn't one (a typo, or a genuine prop that was never wired onto the
+      // instance as either an AttrRef or an echoed literal). Silently
+      // treating this as a literal would trade one invalid Output (a
+      // fabricated `Fn::GetAtt`) for another (a `Value` that is missing or
+      // `null`) — fail loudly instead, the same call `stackOutput()` already
+      // makes for a ref it cannot anchor (chant #1121).
+      throw new Error(
+        `output(ref, "${name}"): ref must be an AttrRef, an Intrinsic, or an already-resolved string/number/boolean — got ${ref === null ? "null" : typeof ref} instead. If this came from a resource member access (e.g. "resource.SomeField"), that member is neither a generated attribute nor a real value here — check for a typo or a property that CloudFormation does not expose via Fn::GetAtt.`,
+      );
     }
   }
 
@@ -94,10 +179,14 @@ export class LexiconOutput implements Intrinsic {
 
   /**
    * Returns the CloudFormation Output Value for this output.
+   * For a literal output: the resolved value itself, verbatim.
    * For AttrRef-based outputs: emits Fn::GetAtt.
    * For Intrinsic-based outputs: delegates to the intrinsic's toJSON().
    */
   getOutputValue(): unknown {
+    if (this._literalValue !== null) {
+      return this._literalValue;
+    }
     if (this._intrinsic) {
       return this._intrinsic.toJSON();
     }
@@ -130,7 +219,8 @@ export class LexiconOutput implements Intrinsic {
 }
 
 /**
- * Create a LexiconOutput from an AttrRef or Intrinsic and a user-provided output name.
+ * Create a LexiconOutput from an AttrRef, an Intrinsic, or an already-
+ * resolved literal, and a user-provided output name.
  *
  * Usage with AttrRef:
  * ```ts
@@ -141,14 +231,33 @@ export class LexiconOutput implements Intrinsic {
  * ```ts
  * const solrUrl = output(Sub`http://${Ref(albDnsName)}/solr`, "solrUrl");
  * ```
+ *
+ * Usage with a literal (chant #1121) — a real value the caller already
+ * computed, not a reference:
+ * ```ts
+ * const apiVersion = output("v1", "ApiVersion");
+ * ```
  */
-export function output(ref: AttrRef | Intrinsic | string, name: string): LexiconOutput {
+export function output(ref: AttrRef | Intrinsic | LexiconOutputLiteral, name: string): LexiconOutput {
   return new LexiconOutput(ref, name);
 }
 
 /**
- * Type guard to check if a value is a LexiconOutput
+ * Type guard to check if a value is a LexiconOutput.
+ *
+ * Structural, not `instanceof` (chant #1122) — keys off {@link
+ * LEXICON_OUTPUT_MARKER}, a global symbol, so it holds across separately-
+ * loaded copies of chant-core the way `instanceof` does not. Every caller
+ * (`collect.ts`, `build.ts`, `graph-ir.ts`, `entity-wire-codec.ts`) reads
+ * only own-prototype members off the result (`outputName`, `_sourceParent`,
+ * `_setSourceEntity()`, `getOutputValue()`), all of which work identically
+ * on a cross-copy instance.
  */
 export function isLexiconOutput(value: unknown): value is LexiconOutput {
-  return value instanceof LexiconOutput;
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    LEXICON_OUTPUT_MARKER in value &&
+    (value as Record<symbol, unknown>)[LEXICON_OUTPUT_MARKER] === true
+  );
 }

package/src/lint/config.ts

@@ -1,7 +1,7 @@
 import { readFileSync, existsSync } from "fs";
 import { join, dirname, resolve } from "path";
-import { createRequire } from "module";
 import { z } from "zod";
+import { evaluateProjectConfigSync } from "../config-sandbox";
 import type { Severity, RuleConfig } from "./rule";
 import { moduleDir, getRuntime } from "../runtime-adapter";
 import strictPreset from "./presets/strict.json";
@@ -337,6 +337,12 @@ function loadConfigFile(configPath: string, visited: Set<string> = new Set()): L
  * then falls back to `chant.config.json` (legacy LintConfig format).
  * Returns default configuration if neither exists.
  *
+ * chant #1113 — the `chant.config.ts` branch executes project-authored code,
+ * so it goes through `../config-sandbox.ts` like every other config load
+ * rather than `require`-ing the file itself. Unarmed (which is every `chant
+ * lint` invocation today — `lint` has no `--sandbox` flag) that is the
+ * identical `createRequire` path this used before, moved one module over.
+ *
  * @param dir - Directory path to search for config file
  * @returns Loaded and merged configuration, or default config if not found
  */
@@ -345,9 +351,7 @@ export function loadConfig(dir: string): LintConfig {
   const tsConfigPath = join(dir, "chant.config.ts");
   if (existsSync(tsConfigPath)) {
     try {
-      const _require = createRequire(join(dir, "package.json"));
-      const mod = _require(tsConfigPath);
-      const config = mod.default ?? mod.config ?? mod;
+      const config = evaluateProjectConfigSync(tsConfigPath, dir);
       if (typeof config === "object" && config !== null) {
         // ChantConfig format: extract lint property
         if ("lint" in config && typeof config.lint === "object") {