@intentius/chant 0.23.0 → 0.25.0

package/dist/lint/config.d.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import type { Severity, RuleConfig } from "./rule.js";
+export { findProjectRoot } from "../project-root.js";
 export declare const LintConfigSchema: z.ZodObject<{
     rules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
         error: "error";
@@ -75,18 +76,6 @@ export declare function parseRuleConfig(value: RuleConfig): ParsedRuleConfig;
  * Default configuration with all rules enabled at strict preset severities
  */
 export declare const DEFAULT_CONFIG: LintConfig;
-/**
- * Walk up from `startDir` to the nearest ancestor holding a chant project
- * config (`chant.config.ts` or `chant.config.json`). Returns that directory, or
- * `startDir` unchanged when none is found before the filesystem root.
- *
- * Linting a subpath (`chant graph src --format ir`, `chant lint src/lib`) must
- * still see the project-root config: its `lint.overrides` globs are written
- * project-root-relative (`src/lib/**`), and a rule set scoped only to the lint
- * arg would silently drop them. Config discovery therefore anchors on the
- * project root, not the path being linted.
- */
-export declare function findProjectRoot(startDir: string): string;
 /**
  * Load lint configuration from a directory.
  *
@@ -94,6 +83,12 @@ export declare function findProjectRoot(startDir: string): string;
  * then falls back to `chant.config.json` (legacy LintConfig format).
  * Returns default configuration if neither exists.
  *
+ * chant #1113 — the `chant.config.ts` branch executes project-authored code,
+ * so it goes through `../config-sandbox.ts` like every other config load
+ * rather than `require`-ing the file itself. Unarmed (which is every `chant
+ * lint` invocation today — `lint` has no `--sandbox` flag) that is the
+ * identical `createRequire` path this used before, moved one module over.
+ *
  * @param dir - Directory path to search for config file
  * @returns Loaded and merged configuration, or default config if not found
  */

package/dist/lint/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lint/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAmBnD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAC;AAkGH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAsBnE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAG5B,CAAC;AA0HF;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUxD;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAoClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAkBpG"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lint/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AASnD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAiBlD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAC;AAkGH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAsBnE;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAG5B,CAAC;AA0HF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAkClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAkBpG"}

package/dist/project-root.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Shared upward config-discovery walk (chant #1117).
+ *
+ * Before this, `chant build <subdir>` and `lint.policies`
+ * (`./lint/policy.ts`'s `evaluateProjectPolicies`) each searched only the
+ * build directory and its immediate parent for `chant.config.ts`/`.json`,
+ * while `chant lint`/`chant graph` (`./lint/config.ts`'s old, file-local
+ * `findProjectRoot`) already walked all the way up. A project with a deeper
+ * `src/<stack>` layout — `chant build src/<stack>` two or more levels below
+ * the project root — silently never found the root config: `buildParams`'
+ * declared `env:` mappings went inert, `ownership`/`lint.policies`/etc quietly
+ * fell back to defaults, and nothing warned (loomster#162: `LOOM_TIER`/
+ * `LOOM_ENV` inert under every `npm run synth:*` for two releases).
+ *
+ * `findProjectConfig` is the one walk every config-discovery call site now
+ * shares. It stops at the first of:
+ *
+ * 1. A directory holding `chant.config.ts` or `chant.config.json` — found.
+ * 2. A directory holding `.git` or `package.json` with no chant config of its
+ *    own — the project boundary. Discovery must never wander past the actual
+ *    project into an unrelated ancestor directory just because this project
+ *    happens not to declare a config (a stray `chant.config.ts` two levels
+ *    above an unrelated git repo must never be picked up).
+ * 3. `startDir` itself, unchanged, if the walk reaches the filesystem root
+ *    without ever finding a config OR a boundary marker. This is not just a
+ *    "give up gracefully" nicety — several callers (`resolveProjectLexicons`
+ *    -> `findInfraFiles`) scope a real directory walk off this function's
+ *    result; if a rootless/marker-less start dir (a bare tmpdir, as chant's
+ *    own test suites use) resolved all the way to `/`, that downstream walk
+ *    would scan the entire filesystem instead of failing fast. Falling back
+ *    to `startDir` keeps every caller's blast radius local no matter how far
+ *    up the walk had to look.
+ */
+export interface ProjectConfigSearch {
+    /** The resolved project root: the config's directory, the boundary directory, or the (resolved) `startDir` when neither was found. */
+    dir: string;
+    /** Absolute path to the discovered `chant.config.ts`/`.json`, if any. */
+    configPath?: string;
+}
+/** Walk up from `startDir` (inclusive) to the nearest chant config or project boundary. See {@link ProjectConfigSearch}. */
+export declare function findProjectConfig(startDir: string): ProjectConfigSearch;
+/**
+ * Walk up from `startDir` to the nearest ancestor holding a chant project
+ * config (`chant.config.ts` or `chant.config.json`), the `.git`/`package.json`
+ * project boundary, or `startDir` itself when neither is found. Thin wrapper
+ * over {@link findProjectConfig} for callers that only need the directory
+ * (e.g. `chant lint`'s rule/plugin resolution, which just needs *a* stable
+ * root to resolve relative paths against).
+ */
+export declare function findProjectRoot(startDir: string): string;
+//# sourceMappingURL=project-root.d.ts.map

package/dist/project-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-root.d.ts","sourceRoot":"","sources":["../src/project-root.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,WAAW,mBAAmB;IAClC,sIAAsI;IACtI,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,4HAA4H;AAC5H,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,CAqBvE;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/build.test.ts

@@ -467,6 +467,25 @@ describe("detectCrossLexiconRefs", () => {
     expect(collected[0].getOutputValue()).toEqual({ "Fn::Sub": "http://example.com/path" });
   });
 
+  // chant #1121 — `output(<already-resolved value>, name)`, exactly the
+  // shape of a top-level `export const oParamName = output(data.Name,
+  // "oParamName")`, must reach the serializer as a plain `Value`, never a
+  // `Fn::GetAtt` pointing at the output's own logical id.
+  test("literal-valued output() emits its value verbatim, not a self-referencing Fn::GetAtt", () => {
+    const literalOutput = output("fold-output-repro", "oParamName");
+
+    const entities = new Map<string, Declarable>([
+      ["oParamName", literalOutput as unknown as Declarable],
+    ]);
+
+    const collected = collectLexiconOutputs(entities);
+    expect(collected).toHaveLength(1);
+    expect(collected[0].outputName).toBe("oParamName");
+    expect(collected[0].sourceEntity).toBe("");
+    expect(collected[0].sourceAttribute).toBeNull();
+    expect(collected[0].getOutputValue()).toBe("fold-output-repro");
+  });
+
   test("deduplicates when same cross-lexicon ref appears in multiple entities", () => {
     const alphaBucket = {
       lexicon: "alpha",

package/src/build.ts

@@ -296,18 +296,28 @@ export function collectLexiconOutputs(
   for (const [name, entity] of entities) {
     if (isLexiconOutput(entity as unknown)) {
       const lexiconOutput = entity as unknown as LexiconOutput;
-      // Resolve source entity name from the WeakRef parent identity
-      const parent = lexiconOutput._sourceParent?.deref();
-      let sourceName = name;
-      if (parent) {
-        for (const [entityName, e] of entities) {
-          if (e === parent) {
-            sourceName = entityName;
-            break;
+      // A literal-valued output (chant #1121) has no source entity at all —
+      // it isn't a reference to anything, so it must not fall back to the
+      // output's OWN map key the way an AttrRef whose parent didn't resolve
+      // would. Leaving `sourceEntity` empty keeps `getOutputValue()`'s
+      // (never-reached, for a literal) `Fn::GetAtt` fallback from ever being
+      // handed a bogus source, and keeps consumers that read `sourceEntity`
+      // directly (e.g. `graph-ir.ts`'s cross-stack export, the build
+      // manifest) from reporting the output as its own source.
+      if (lexiconOutput._literalValue === null) {
+        // Resolve source entity name from the WeakRef parent identity
+        const parent = lexiconOutput._sourceParent?.deref();
+        let sourceName = name;
+        if (parent) {
+          for (const [entityName, e] of entities) {
+            if (e === parent) {
+              sourceName = entityName;
+              break;
+            }
           }
         }
+        lexiconOutput._setSourceEntity(sourceName);
       }
-      lexiconOutput._setSourceEntity(sourceName);
       outputs.push(lexiconOutput);
       continue;
     }
@@ -317,7 +327,8 @@ export function collectLexiconOutputs(
       const prevLength = outputs.length;
       walk(entity.props);
       for (let i = prevLength; i < outputs.length; i++) {
-        if (!outputs[i].sourceEntity) {
+        // Same #1121 guard as above — a literal has no source entity to name.
+        if (!outputs[i].sourceEntity && outputs[i]._literalValue === null) {
           outputs[i]._setSourceEntity(name);
         }
       }

package/src/cli/commands/build.ts

@@ -1,5 +1,5 @@
 import { build } from "../../build";
-import { loadChantConfig, resolveOwnershipMarker, resolveFoldEnabled, resolveSandboxEnabled } from "../../config";
+import { loadChantConfigUpward, resolveOwnershipMarker, resolveFoldEnabled, resolveSandboxEnabled } from "../../config";
 import { resolveCliBuildParams } from "../build-params-cli";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
@@ -128,11 +128,14 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // Resolve the path
   const infraPath = resolve(options.path);
 
-  // Resolve opt-in ownership marking from project config (search the infra dir
-  // and its parent, where chant.config.* usually lives).
-  const loaded = await loadChantConfig(infraPath).then((r) =>
-    r.configPath ? r : loadChantConfig(dirname(infraPath)),
-  );
+  // Resolve opt-in ownership marking from project config. chant #1117 — walks
+  // up from the infra dir to the project root (`loadChantConfigUpward`), not
+  // just the infra dir's immediate parent: a project whose stacks live two or
+  // more levels below `chant.config.ts` (loomster's `src/<stack>` layout)
+  // otherwise never finds the root config at all, and every declared
+  // `buildParams`/`ownership`/`lint.policies` setting silently falls back to
+  // its default.
+  const loaded = await loadChantConfigUpward(infraPath);
   const config = loaded.config;
   const ownership = resolveOwnershipMarker(config);
 
@@ -155,6 +158,19 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // as fold, resolved independently.
   const sandbox = resolveSandboxEnabled(config, options.sandbox);
 
+  // #1113 — the bootstrap limit, surfaced rather than left implicit. Reading
+  // `build.sandbox` out of `chant.config.ts` requires evaluating that file, so
+  // a config-only opt-in cannot have covered its own evaluation; only the CLI
+  // flag, known before any config is touched, arms `../config-sandbox.ts`.
+  // Say so instead of letting two different boundaries share one word.
+  if (sandbox && !options.sandbox && loaded.configPath?.endsWith(".ts")) {
+    warnings.push(
+      formatWarning({
+        message: `build.sandbox is enabled by ${loaded.configPath}, but that file was itself evaluated in this process — reading the setting requires running the config. Pass --sandbox on the command line to evaluate chant.config.ts inside the boundary too.`,
+      }),
+    );
+  }
+
   // #1064 (factored into ../build-params-cli.ts's resolveCliBuildParams by
   // #1108, so the component deploy driver runs the identical sequence) —
   // resolve declared build-time parameters (chant.config.ts's buildParams)
@@ -174,6 +190,26 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
     return { success: false, resourceCount: 0, fileCount: 0, errors, warnings };
   }
 
+  // chant #1117 — a project that declares buildParams but resolves NONE of
+  // them for this build is the exact shape that let loomster#162 live for two
+  // releases: the discovered config wasn't the one the project author
+  // expected (a stale --path, a workspace boundary that stopped the walk
+  // short), or every declared parameter's `env:` var went unset, and either
+  // way every `params.<name>` read silently falls back to `undefined` — with
+  // no error (an all-`required: false` declaration resolves successfully to
+  // an empty set). Warn, naming the config path this build actually
+  // discovered, so a mismatch is visible instead of silent.
+  if (
+    Object.keys(config.buildParams ?? {}).length > 0 &&
+    paramsResolution.provenance.length === 0
+  ) {
+    warnings.push(
+      formatWarning({
+        message: `chant.config.ts declares buildParams${loaded.configPath ? ` (${loaded.configPath})` : ""}, but none resolved for this build — every params.<name> read will be undefined. Pass --param/--params-file, or check that this is the config you expect.`,
+      }),
+    );
+  }
+
   // #1039 — thread each loaded plugin's registered intrinsics (e.g. AWS's
   // `Sub`) through to the fold path, so a file using a registered intrinsic
   // tagged template folds instead of unconditionally falling back to run.

package/src/cli/handlers/build.test.ts

@@ -8,8 +8,10 @@
  * run --components` (see ../handlers/run.test.ts's "build-time parameters"
  * describe block for the equivalent local/`--temporal` coverage).
  *
- * Mocks `generateComponentsPipeline` and `loadChantConfig` and exercises the
- * public `runBuild` dispatcher (`runGenerateComponents` itself isn't
+ * Mocks `generateComponentsPipeline` and `loadChantConfigUpward` (chant
+ * #1117 — `runGenerateComponents` walks up to the project root now, same as
+ * `chant build` proper, instead of reading `args.path` alone) and exercises
+ * the public `runBuild` dispatcher (`runGenerateComponents` itself isn't
  * exported), mirroring `run.test.ts`'s style of driving the handler through
  * its `CommandContext` entrypoint rather than reaching into private helpers.
  */
@@ -17,14 +19,14 @@ import { describe, test, expect, vi, beforeEach } from "vitest";
 import type { ParsedArgs } from "../registry";
 
 const generateComponentsPipelineMock = vi.fn();
-const loadChantConfigMock = vi.fn();
+const loadChantConfigUpwardMock = vi.fn();
 
 vi.mock("../../components/cli-support", () => ({
   generateComponentsPipeline: (...args: unknown[]) => generateComponentsPipelineMock(...args),
 }));
 vi.mock("../../config", async () => {
   const actual = await vi.importActual<typeof import("../../config")>("../../config");
-  return { ...actual, loadChantConfig: (...args: unknown[]) => loadChantConfigMock(...args) };
+  return { ...actual, loadChantConfigUpward: (...args: unknown[]) => loadChantConfigUpwardMock(...args) };
 });
 
 const { runBuild } = await import("./build");
@@ -54,7 +56,7 @@ function makeStderrSpy() {
 describe("runBuild --components --generate (chant #1108 build-time parameters)", () => {
   beforeEach(() => {
     generateComponentsPipelineMock.mockReset();
-    loadChantConfigMock.mockReset().mockResolvedValue({ config: {} });
+    loadChantConfigUpwardMock.mockReset().mockResolvedValue({ config: {} });
   });
 
   test("no declared buildParams → generateComponentsPipeline is called with an empty provenance array", async () => {
@@ -69,7 +71,7 @@ describe("runBuild --components --generate (chant #1108 build-time parameters)",
   });
 
   test("chant.config.ts's declared buildParams resolve, log, and are forwarded to generateComponentsPipeline", async () => {
-    loadChantConfigMock.mockResolvedValue({
+    loadChantConfigUpwardMock.mockResolvedValue({
       config: { buildParams: { tier: { type: "string", default: "light" } } },
     });
     generateComponentsPipelineMock.mockResolvedValue({ success: true, yaml: "stages: []", stages: [], jobs: [] });
@@ -91,7 +93,7 @@ describe("runBuild --components --generate (chant #1108 build-time parameters)",
   });
 
   test("--param overrides a declared default", async () => {
-    loadChantConfigMock.mockResolvedValue({
+    loadChantConfigUpwardMock.mockResolvedValue({
       config: { buildParams: { tier: { type: "string", default: "light" } } },
     });
     generateComponentsPipelineMock.mockResolvedValue({ success: true, yaml: "stages: []", stages: [], jobs: [] });
@@ -115,7 +117,7 @@ describe("runBuild --components --generate (chant #1108 build-time parameters)",
   });
 
   test("an unresolved required build-time parameter → exit 1, never reaches generateComponentsPipeline", async () => {
-    loadChantConfigMock.mockResolvedValue({
+    loadChantConfigUpwardMock.mockResolvedValue({
       config: { buildParams: { tier: { type: "string" } } },
     });
     const stderr = makeStderrSpy();
@@ -128,7 +130,7 @@ describe("runBuild --components --generate (chant #1108 build-time parameters)",
   });
 
   test("an enum violation on --param → exit 1, never reaches generateComponentsPipeline", async () => {
-    loadChantConfigMock.mockResolvedValue({
+    loadChantConfigUpwardMock.mockResolvedValue({
       config: { buildParams: { tier: { type: "string", enum: ["light", "production"] } } },
     });
     const stderr = makeStderrSpy();

package/src/cli/handlers/build.ts

@@ -4,7 +4,7 @@ import { buildCommand, buildCommandWatch, printErrors, printWarnings, resolveBui
 import { formatError, formatInfo, formatSuccess, formatBold } from "../format";
 import type { CommandContext } from "../registry";
 import { generateComponentsPipeline } from "../../components/cli-support";
-import { loadChantConfig, type ChantConfig } from "../../config";
+import { loadChantConfigUpward, type ChantConfig } from "../../config";
 import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli";
 
 /**
@@ -23,12 +23,17 @@ import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli";
  * Before this, `params.*` (`@intentius/chant/params`) was always `{}` under
  * this command too — generate mode shares `discoverComponents` with `chant
  * run --components`, so it had the identical gap.
+ *
+ * chant #1117 — loads config by walking up from `args.path` to the project
+ * root (`loadChantConfigUpward`), same as `chant build` proper, instead of
+ * `args.path` alone: a components-only project built from a subdirectory
+ * otherwise never sees the root `chant.config.ts`'s `buildParams` either.
  */
 async function runGenerateComponents(ctx: CommandContext): Promise<number> {
   const { args } = ctx;
   const lexicon = args.generate as string;
 
-  const { config } = await loadChantConfig(resolve(args.path)).catch(() => ({ config: {} as ChantConfig }));
+  const { config } = await loadChantConfigUpward(resolve(args.path)).catch(() => ({ config: {} as ChantConfig }));
   const paramsResolution = resolveCliBuildParams(config.buildParams, {
     cli: parseParamFlags(args.param),
     paramsFile: args.paramsFile,

package/src/cli/handlers/run.test.ts

@@ -882,6 +882,37 @@ describe("runOp dispatcher: --components routes to runOpComponents", () => {
     expect(discoverOpsMock).not.toHaveBeenCalled();
     vi.restoreAllMocks();
   });
+
+  // chant #1116 — --report is Op/Temporal-only (reads a past workflow run);
+  // the component driver never checked it, so it was silently ignored and the
+  // command fell through to a real dispatch. Hard-error instead, before
+  // runComponents is ever reached.
+  test("--report combined with --components → exit 1 before any dispatch, no fall-through (#1116)", async () => {
+    discoverOpsMock.mockReset();
+    const stderr = makeStderrSpy();
+
+    const exit = await runOp({ args: makeArgs({ path: "svc", components: true, report: true, temporal: false }), plugins: [], serializers: [] });
+
+    expect(exit).toBe(1);
+    expect(stderr.join("\n")).toContain("not supported with --components");
+    expect(stderr.join("\n")).toContain("#1116");
+    expect(discoverOpsMock).not.toHaveBeenCalled();
+    expect(runComponentsMock).not.toHaveBeenCalled();
+  });
+
+  // Plain --components (no --report) must be unaffected: it still reaches a
+  // real dispatch through runComponents — mocked here, never a real cloud call.
+  test("plain --components (no --report) still dispatches to runComponents (#1116 regression guard)", async () => {
+    discoverOpsMock.mockReset();
+    runComponentsMock.mockResolvedValue({ success: true, selected: ["svc"], run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true } });
+    vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+
+    const exit = await runOp({ args: makeArgs({ path: "svc", components: true, report: false, temporal: false }), plugins: [], serializers: [] });
+
+    expect(exit).toBe(0);
+    expect(runComponentsMock).toHaveBeenCalled();
+    vi.restoreAllMocks();
+  });
 });
 
 describe("runOpComponents", () => {

package/src/cli/handlers/run.ts

@@ -548,8 +548,23 @@ function renderProgress(opName: string, history: WorkflowHistoryRaw): void {
  * (`../../components/driver.ts`) rather than a `*.op.ts` Op. Checked first,
  * mirroring `runGraph`'s `if (ctx.args.components) return
  * runComponentGraph(ctx)` branch (../handlers/graph.ts).
+ *
+ * chant #1116 — `--report` with `--components` is checked and hard-errored
+ * before that dispatch. There is no preview/dry-run mode for the component
+ * driver: unlike the Op path (where `--report` reads a past Temporal run),
+ * `runOpComponents` has never read `ctx.args.report` at all, so the flag was
+ * silently ignored and the command fell through to a real dispatch — observed
+ * live reaching an actual cloud shell-out. Erroring here is the safe minimum
+ * called out on the issue; a real preview is future work.
  */
 export async function runOp(ctx: CommandContext): Promise<number> {
+  if (ctx.args.components && ctx.args.report) {
+    console.error(formatError({
+      message: "--report is not supported with --components",
+      hint: "No preview/dry-run mode exists yet for the component driver (see chant#1116). Omit --report.",
+    }));
+    return 1;
+  }
   if (ctx.args.components) return runOpComponents(ctx);
   if (ctx.args.local && ctx.args.temporal) {
     console.error(formatError({

package/src/cli/main.test.ts

@@ -270,6 +270,29 @@ describe("parseArgs", () => {
     const result = parseArgs(["build", "src", "--params-file", "./params.json"]);
     expect(result.paramsFile).toBe("./params.json");
   });
+
+  // ── --param=name=value hard error (chant #1118) ──────────────────────────
+  // The joined `--flag=value` form is not supported anywhere in this parser
+  // (see "ignores unknown flags" above) — a dropped --param can silently
+  // change what a build measures/deploys, so this form is rejected loudly
+  // instead of silently accepted as a no-op.
+
+  test("--param=name=value throws instead of silently dropping", () => {
+    expect(() => parseArgs(["build", "src", "--param=tier=production"])).toThrow(/--param=tier=production/);
+  });
+
+  test("--param=name=value error names the working form", () => {
+    expect(() => parseArgs(["build", "src", "--param=tier=production"])).toThrow(/--param name=value/);
+  });
+
+  test("--param= (empty value) also throws", () => {
+    expect(() => parseArgs(["build", "src", "--param="])).toThrow(/--param=/);
+  });
+
+  test("plain --param name=value is unaffected", () => {
+    const result = parseArgs(["build", "src", "--param", "tier=production"]);
+    expect(result.param).toEqual(["tier=production"]);
+  });
 });
 
 // ── resolveCommand tests ──────────────────────────────────────────

package/src/cli/main.ts

@@ -5,7 +5,8 @@ import { isEntryPoint } from "./is-entry-point";
 import { formatSuccess, formatError } from "./format";
 import { loadPlugins, resolveProjectLexicons } from "./plugins";
 import { resolveCommand, type CommandDef, type ParsedArgs } from "./registry";
-import { loadChantConfig } from "../config";
+import { loadChantConfigUpward } from "../config";
+import { armSandboxConfigEvaluation } from "../config-sandbox";
 import { ENV_VAR, unknownEnvError } from "../env";
 import { initRuntime } from "../runtime-adapter";
 import { runBuild } from "./handlers/build";
@@ -224,6 +225,16 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.sandbox = true;
     } else if (arg === "--param") {
       (result.param ??= []).push(args[++i]);
+    } else if (arg.startsWith("--param=")) {
+      // chant #1118 — this parser never supports an `--flag=value` joined
+      // form for any value-taking flag (every branch above is an exact `===`
+      // match, so a joined token falls through unrecognized and is silently
+      // dropped — see the "ignores unknown flags" case below). `--param
+      // name=value` (space-separated) is the only accepted form. Rather than
+      // teach the parser joined forms generally, `--param=name=value` is
+      // called out as a hard error instead of a silent no-op: a dropped
+      // `--param` can silently change what a build measures/deploys.
+      throw new Error(`${arg} is not supported. Use --param name=value (space-separated) instead.`);
     } else if (arg === "--params-file") {
       result.paramsFile = args[++i];
     } else if (!arg.startsWith("-")) {
@@ -588,11 +599,24 @@ async function main(): Promise<void> {
   // chant.config itself may branch on the env. (#505)
   if (args.env) process.env[ENV_VAR] = args.env;
 
-  // Initialize runtime adapter early — before plugins or commands run
+  // chant #1113 — `--sandbox` is a property of the whole invocation, and it
+  // has to be known BEFORE the first config load, because `chant.config.ts` is
+  // itself project-authored code. Arming here, straight off the parsed flag,
+  // is the only ordering that works: the project's own `build.sandbox: true`
+  // cannot cover its own evaluation (reading it means running it), so the
+  // command-line flag is what puts the config inside the boundary. See
+  // `../config-sandbox.ts`.
+  if (args.sandbox) armSandboxConfigEvaluation();
+
+  // Initialize runtime adapter early — before plugins or commands run.
+  // chant #1117 — walks up from `args.path` to the project root: for a
+  // subdirectory build/command (`chant build src/<stack> --env prod`) the
+  // declared `environments` almost always live in the root `chant.config.ts`,
+  // not `args.path` itself.
   const projectPath0 = resolve(args.path === "." ? "." : args.path);
   let loadedConfig;
   try {
-    loadedConfig = await loadChantConfig(projectPath0);
+    loadedConfig = await loadChantConfigUpward(projectPath0);
     initRuntime();
   } catch {
     // Config may not exist yet (e.g. `chant init`)

package/src/cli/plugins.ts

@@ -1,5 +1,5 @@
 import { isLexiconPlugin, type LexiconPlugin } from "../lexicon";
-import { loadChantConfig } from "../config";
+import { loadChantConfigUpward } from "../config";
 import { findInfraFiles, detectLexicons } from "../index";
 import { checkConflicts } from "./conflict-check";
 
@@ -96,9 +96,17 @@ export async function loadPlugins(lexiconNames: string[]): Promise<LexiconPlugin
  * that never needed live module exports to begin with. This is strictly
  * better than routing the detection through the sandbox: it removes the
  * execution entirely rather than containing it, at no bundling/spawn cost.
+ *
+ * chant #1117 — walks up from `projectPath` to the project root
+ * (`loadChantConfigUpward`) rather than reading `projectPath` alone: `chant
+ * build src/<stack>` calls this with the stack's own subdirectory, and a
+ * project that declares `lexicons` only in its root `chant.config.ts` (never
+ * detectable by `detectLexicons()`'s import scan alone, e.g. a lexicon that's
+ * loaded but never imported by name in that particular stack's files) would
+ * otherwise silently miss it.
  */
 export async function resolveProjectLexicons(projectPath: string): Promise<string[]> {
-  const { config } = await loadChantConfig(projectPath);
+  const { config } = await loadChantConfigUpward(projectPath);
 
   if (config.lexicons && config.lexicons.length > 0) {
     return config.lexicons;

package/src/config-import.ts

@@ -0,0 +1,43 @@
+import { createRequire } from "node:module";
+import { join } from "node:path";
+
+/**
+ * The single place chant evaluates a project's `chant.config.ts` **in the CLI's
+ * own process**.
+ *
+ * This is the config-side analogue of `./discovery/import.ts`'s `importModule`
+ * — one narrow module whose only job is "execute project-authored code here",
+ * so that the question "did any project code run in this process?" has one
+ * place to look and one place to instrument (see
+ * `examples/sandbox-execution-boundary.test.ts`, which spies on both).
+ *
+ * Callers must not `import()` a config file directly. `./config-sandbox.ts`
+ * decides whether a given load is allowed to come through here at all: under
+ * `chant build --sandbox` it routes the evaluation into the sandboxed child
+ * instead (chant #1113), and these functions are never reached.
+ *
+ * `chant.config.json` is pure data and is parsed, not executed — it never goes
+ * through this module.
+ */
+
+/** The shape a config module evaluates to, before `default`/`config`/namespace selection. */
+export type ConfigModuleNamespace = Record<string, unknown>;
+
+/**
+ * Import a `chant.config.ts` into THIS process and return its module namespace.
+ * Node's ESM registry caches it, so repeated loads within one CLI invocation
+ * evaluate the file once — the behavior `loadChantConfig` has always had.
+ */
+export async function importConfigModule(configPath: string): Promise<ConfigModuleNamespace> {
+  return (await import(configPath)) as ConfigModuleNamespace;
+}
+
+/**
+ * `require()` a `chant.config.ts` into THIS process from `dir`'s resolution
+ * context — the synchronous path `./lint/config.ts`'s `loadConfig` has used
+ * since before the async loader existed (`chant lint` is a sync pipeline).
+ */
+export function requireConfigModule(configPath: string, dir: string): ConfigModuleNamespace {
+  const req = createRequire(join(dir, "package.json"));
+  return req(configPath) as ConfigModuleNamespace;
+}