@intentius/chant 0.23.0 → 0.25.0

package/src/lexicon-output.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "vitest";
+import { describe, test, expect, vi } from "vitest";
 import { LexiconOutput, output, isLexiconOutput } from "./lexicon-output";
 import { AttrRef } from "./attrref";
 import { INTRINSIC_MARKER } from "./intrinsic";
@@ -92,6 +92,60 @@ describe("LexiconOutput", () => {
     const lo = new LexiconOutput(mockIntrinsic, "MyUrl");
     expect(lo.getOutputValue()).toEqual({ "Fn::Sub": "http://${Param}/path" });
   });
+
+  // chant #1121 — an already-resolved plain value (not a reference to
+  // anything) must be emitted verbatim as the Output's Value, never coerced
+  // into a bogus Fn::GetAtt pointing at the output's own logical id.
+  describe("literal-valued output (chant #1121)", () => {
+    test("accepts a string literal and sets no source entity/attribute", () => {
+      const lo = new LexiconOutput("us-east-1", "Region");
+      expect(lo.sourceLexicon).toBe("");
+      expect(lo.sourceEntity).toBe("");
+      expect(lo.sourceAttribute).toBeNull();
+      expect(lo.outputName).toBe("Region");
+    });
+
+    test("getOutputValue() returns a string literal verbatim", () => {
+      const lo = new LexiconOutput("fold-output-repro", "oParamName");
+      expect(lo.getOutputValue()).toBe("fold-output-repro");
+    });
+
+    test("getOutputValue() returns a number literal verbatim", () => {
+      const lo = new LexiconOutput(42, "oCount");
+      expect(lo.getOutputValue()).toBe(42);
+    });
+
+    test("getOutputValue() returns a boolean literal verbatim (including false)", () => {
+      expect(new LexiconOutput(true, "oEnabled").getOutputValue()).toBe(true);
+      expect(new LexiconOutput(false, "oDisabled").getOutputValue()).toBe(false);
+    });
+
+    test("getOutputValue() returns 0 and empty string verbatim (falsy but valid)", () => {
+      expect(new LexiconOutput(0, "oZero").getOutputValue()).toBe(0);
+      expect(new LexiconOutput("", "oEmpty").getOutputValue()).toBe("");
+    });
+
+    test("_setSourceEntity has no effect on getOutputValue() for a literal", () => {
+      const lo = new LexiconOutput("v1", "oVersion");
+      lo._setSourceEntity("someUnrelatedEntity");
+      expect(lo.getOutputValue()).toBe("v1");
+    });
+
+    test("throws for a ref that is neither an AttrRef, an Intrinsic, nor a string/number/boolean literal", () => {
+      // Mirrors what a resource member access that resolves to `undefined`
+      // looks like at runtime (e.g. a typo, or a non-attribute field a
+      // generated resource class never echoes onto the instance).
+      expect(() => new LexiconOutput(undefined as unknown as string, "oBroken")).toThrow(
+        /must be an AttrRef, an Intrinsic, or an already-resolved string\/number\/boolean/,
+      );
+    });
+
+    test("throws for null", () => {
+      expect(() => new LexiconOutput(null as unknown as string, "oBroken")).toThrow(
+        /must be an AttrRef, an Intrinsic, or an already-resolved string\/number\/boolean/,
+      );
+    });
+  });
 });
 
 describe("LexiconOutput.auto", () => {
@@ -164,6 +218,20 @@ describe("output() helper", () => {
     expect(result.sourceAttribute).toBe("Arn");
     expect(result.outputName).toBe("DataBucketArn");
   });
+
+  // chant #1121
+  test.each([
+    ["string", "v1"],
+    ["number", 42],
+    ["boolean", true],
+  ] as const)("creates a literal-valued LexiconOutput from a %s and emits it verbatim", (_kind, value) => {
+    const result = output(value, "oLiteral");
+
+    expect(result).toBeInstanceOf(LexiconOutput);
+    expect(result.sourceEntity).toBe("");
+    expect(result.sourceAttribute).toBeNull();
+    expect(result.getOutputValue()).toBe(value);
+  });
 });
 
 describe("isLexiconOutput", () => {
@@ -188,6 +256,41 @@ describe("isLexiconOutput", () => {
 
     expect(isLexiconOutput(ref)).toBe(false);
   });
+
+  // chant #1122 — the guard used to be `value instanceof LexiconOutput`,
+  // which returns false when the value was built by a SEPARATELY-LOADED
+  // copy of this module (a plain npm-dedupe outcome: a lexicon pinned to a
+  // chant range that doesn't overlap the project's own gets its own nested
+  // `node_modules/@intentius/chant`). `vi.resetModules()` + a fresh dynamic
+  // import reproduces that split module graph exactly, without needing an
+  // actual second install on disk — the resulting instance is structurally
+  // and behaviorally identical to a real LexiconOutput, just built from a
+  // distinct `LexiconOutput` class object.
+  test("recognizes a LexiconOutput built by a second, separately-loaded copy of this module", async () => {
+    vi.resetModules();
+    const secondCopy = await import("./lexicon-output");
+
+    // Sanity check that this really is a distinct module instance — the
+    // premise the rest of the test depends on.
+    expect(secondCopy.LexiconOutput).not.toBe(LexiconOutput);
+
+    const second = new secondCopy.LexiconOutput("v2", "oFromSecondCopy");
+
+    // The historic bug: instanceof fails across separately-loaded copies of
+    // chant-core, even though the two classes are structurally identical.
+    expect(second instanceof LexiconOutput).toBe(false);
+
+    // The fix: a Symbol.for global marker holds across copies the way
+    // DECLARABLE_MARKER/INTRINSIC_MARKER/STACK_OUTPUT_MARKER already do —
+    // isLexiconOutput (from EITHER copy) recognizes the other copy's output.
+    expect(isLexiconOutput(second)).toBe(true);
+    expect(secondCopy.isLexiconOutput(second)).toBe(true);
+
+    // And the callers that gate on this guard only ever read own-prototype
+    // members that survive the cross-copy split.
+    expect(second.getOutputValue()).toBe("v2");
+    vi.resetModules();
+  });
 });
 
 describe("collectLexiconOutputs", () => {
@@ -231,4 +334,37 @@ describe("collectLexiconOutputs", () => {
     expect(collected).toHaveLength(1);
     expect(collected[0].outputName).toBe("BucketArn");
   });
+
+  // chant #1121 — a literal-valued output has no source entity. Before this
+  // fix, a top-level `export const x = output("literal", "x")` fell back to
+  // naming the output's OWN map key as its "source entity" (there being no
+  // `_sourceParent` to resolve), which `getOutputValue()`'s `Fn::GetAtt`
+  // fallback then read back out as a self-referencing, invalid reference.
+  test("does NOT fall back to the output's own key as sourceEntity for a literal-valued output", () => {
+    const literalOutput = output("fold-output-repro", "oParamName");
+
+    const entities = new Map<string, Declarable>();
+    entities.set("oParamName", literalOutput as unknown as Declarable);
+
+    const collected = collectLexiconOutputs(entities);
+
+    expect(collected).toHaveLength(1);
+    expect(collected[0].sourceEntity).toBe("");
+    expect(collected[0].getOutputValue()).toBe("fold-output-repro");
+  });
+
+  test("does NOT fall back to the containing entity's name for a literal-valued output nested in props", () => {
+    const bucket = new MockResource();
+    const literalOutput = output(123, "oNested");
+    bucket.props.nested = literalOutput;
+
+    const entities = new Map<string, Declarable>();
+    entities.set("dataBucket", bucket as unknown as Declarable);
+
+    const collected = collectLexiconOutputs(entities);
+
+    expect(collected).toHaveLength(1);
+    expect(collected[0].sourceEntity).toBe("");
+    expect(collected[0].getOutputValue()).toBe(123);
+  });
 });

package/src/lexicon-output.ts

@@ -1,6 +1,32 @@
-import { INTRINSIC_MARKER, type Intrinsic } from "./intrinsic";
+import { INTRINSIC_MARKER, isIntrinsic, type Intrinsic } from "./intrinsic";
 import { AttrRef } from "./attrref";
 
+/** A value `output()` accepts that is already fully resolved — not a
+ * reference to anything, just data the author computed (a literal, a prop,
+ * a template string). See chant #1121. */
+export type LexiconOutputLiteral = string | number | boolean;
+
+/**
+ * Marker symbol for LexiconOutput identification (chant #1122).
+ *
+ * A GLOBAL symbol (via `Symbol.for`), like every other chant-core brand
+ * check — `DECLARABLE_MARKER`, `STACK_OUTPUT_MARKER`, `INTRINSIC_MARKER` —
+ * holds across separately-loaded copies of chant-core the way `instanceof`
+ * does not. Two copies in one process is a plain npm-dedupe outcome: a
+ * lexicon pinned to a chant range that does not overlap the project's own
+ * gets a nested `node_modules/@intentius/chant`, and a project file
+ * importing `output` from that lexicon then holds a different `LexiconOutput`
+ * class than the CLI does. `instanceof LexiconOutput` returns false for a
+ * real output built by the other copy, and every `Outputs` entry vanishes
+ * silently.
+ *
+ * Installed non-enumerably in the constructor (not as a public class field)
+ * so a shallow spread/clone of a real instance — which would already lack
+ * its prototype methods (`getOutputValue()`, `_setSourceEntity()`, …) — does
+ * not silently pick up the marker and pass this guard too.
+ */
+export const LEXICON_OUTPUT_MARKER = Symbol.for("chant.lexiconOutput");
+
 /**
  * Sanitize auto-generated Output name parts into a valid CloudFormation
  * logical id. Real CloudFormation logical ids (including `Outputs` keys)
@@ -34,11 +60,17 @@ export function sanitizeLogicalId(...parts: string[]): string {
  *
  * Implements Intrinsic so it can be used as Value<string> anywhere.
  *
- * Accepts either an AttrRef (resource attribute reference) or any Intrinsic
- * (e.g. Sub, Join) for computed output values like constructed URLs.
+ * Accepts an AttrRef (resource attribute reference), any Intrinsic (e.g. Sub,
+ * Join) for computed output values like constructed URLs, or an already-
+ * resolved literal (string/number/boolean) — a constant the author's code
+ * computed rather than a reference to anything (chant #1121).
  */
 export class LexiconOutput implements Intrinsic {
   readonly [INTRINSIC_MARKER] = true as const;
+  /** @internal Brand marker — see {@link LEXICON_OUTPUT_MARKER}. Declared
+   * here only for type purposes; the real, non-enumerable property is
+   * installed by the constructor. */
+  readonly [LEXICON_OUTPUT_MARKER]!: true;
   readonly sourceLexicon: string;
   readonly sourceEntity: string;
   readonly sourceAttribute: string | null;
@@ -52,8 +84,22 @@ export class LexiconOutput implements Intrinsic {
    * checking on every field it reads (#1047).
    */
   readonly _intrinsic: Intrinsic | null;
+  /**
+   * @internal The already-resolved literal (string/number/boolean) when
+   * constructed from neither an AttrRef nor an Intrinsic — non-null exactly
+   * when `_intrinsic` is null AND `sourceAttribute` is null. There is no
+   * source entity or attribute to reference, so `getOutputValue()` returns
+   * this value verbatim rather than fabricating a `Fn::GetAtt` out of an
+   * unset attribute (chant #1121). Readable outside the class for the same
+   * reason as `_intrinsic`/`_sourceParent` above.
+   */
+  readonly _literalValue: LexiconOutputLiteral | null;
 
-  constructor(ref: AttrRef | Intrinsic | string, name: string) {
+  constructor(ref: AttrRef | Intrinsic | LexiconOutputLiteral, name: string) {
+    Object.defineProperty(this, LEXICON_OUTPUT_MARKER, {
+      value: true,
+      enumerable: false,
+    });
     if (ref instanceof AttrRef) {
       const parent = ref.parent.deref();
       if (!parent) {
@@ -70,16 +116,45 @@ export class LexiconOutput implements Intrinsic {
       this.outputName = name;
       this._sourceParent = ref.parent;
       this._intrinsic = null;
-    } else {
-      // Intrinsic (Sub, Join, Ref, etc.) — no parent entity tracking needed
-      // Note: `string` in the union is for attribute accessors typed as string at the
-      // TypeScript level (they are AttrRef at runtime, caught by instanceof above).
+      this._literalValue = null;
+    } else if (isIntrinsic(ref)) {
+      // Intrinsic (Sub, Join, Ref, etc.) — no parent entity tracking needed.
       this.sourceLexicon = "";
       this.sourceEntity = "";
       this.sourceAttribute = null;
       this.outputName = name;
       this._sourceParent = null;
-      this._intrinsic = typeof ref !== "string" ? ref : null;
+      this._intrinsic = ref;
+      this._literalValue = null;
+    } else if (typeof ref === "string" || typeof ref === "number" || typeof ref === "boolean") {
+      // An already-resolved literal — a real string/number/boolean the
+      // caller computed (a prop, a template string, a plain constant), not
+      // a reference to anything. The `string` arm of the exported type
+      // exists for a documented reason: a generated resource's attribute
+      // accessor is typed `string` at the TypeScript level but is a real
+      // `AttrRef` at runtime, caught by `instanceof AttrRef` above — so
+      // anything that reaches this branch genuinely has no source entity
+      // or attribute, and is recorded to be emitted as a plain `Value`
+      // rather than a fabricated `Fn::GetAtt` (chant #1121).
+      this.sourceLexicon = "";
+      this.sourceEntity = "";
+      this.sourceAttribute = null;
+      this.outputName = name;
+      this._sourceParent = null;
+      this._intrinsic = null;
+      this._literalValue = ref;
+    } else {
+      // Neither a reference NOR a resolved value — most commonly `undefined`
+      // from accessing a resource member that looks like an attribute but
+      // isn't one (a typo, or a genuine prop that was never wired onto the
+      // instance as either an AttrRef or an echoed literal). Silently
+      // treating this as a literal would trade one invalid Output (a
+      // fabricated `Fn::GetAtt`) for another (a `Value` that is missing or
+      // `null`) — fail loudly instead, the same call `stackOutput()` already
+      // makes for a ref it cannot anchor (chant #1121).
+      throw new Error(
+        `output(ref, "${name}"): ref must be an AttrRef, an Intrinsic, or an already-resolved string/number/boolean — got ${ref === null ? "null" : typeof ref} instead. If this came from a resource member access (e.g. "resource.SomeField"), that member is neither a generated attribute nor a real value here — check for a typo or a property that CloudFormation does not expose via Fn::GetAtt.`,
+      );
     }
   }
 
@@ -94,10 +169,14 @@ export class LexiconOutput implements Intrinsic {
 
   /**
    * Returns the CloudFormation Output Value for this output.
+   * For a literal output: the resolved value itself, verbatim.
    * For AttrRef-based outputs: emits Fn::GetAtt.
    * For Intrinsic-based outputs: delegates to the intrinsic's toJSON().
    */
   getOutputValue(): unknown {
+    if (this._literalValue !== null) {
+      return this._literalValue;
+    }
     if (this._intrinsic) {
       return this._intrinsic.toJSON();
     }
@@ -130,7 +209,8 @@ export class LexiconOutput implements Intrinsic {
 }
 
 /**
- * Create a LexiconOutput from an AttrRef or Intrinsic and a user-provided output name.
+ * Create a LexiconOutput from an AttrRef, an Intrinsic, or an already-
+ * resolved literal, and a user-provided output name.
  *
  * Usage with AttrRef:
  * ```ts
@@ -141,14 +221,33 @@ export class LexiconOutput implements Intrinsic {
  * ```ts
  * const solrUrl = output(Sub`http://${Ref(albDnsName)}/solr`, "solrUrl");
  * ```
+ *
+ * Usage with a literal (chant #1121) — a real value the caller already
+ * computed, not a reference:
+ * ```ts
+ * const apiVersion = output("v1", "ApiVersion");
+ * ```
  */
-export function output(ref: AttrRef | Intrinsic | string, name: string): LexiconOutput {
+export function output(ref: AttrRef | Intrinsic | LexiconOutputLiteral, name: string): LexiconOutput {
   return new LexiconOutput(ref, name);
 }
 
 /**
- * Type guard to check if a value is a LexiconOutput
+ * Type guard to check if a value is a LexiconOutput.
+ *
+ * Structural, not `instanceof` (chant #1122) — keys off {@link
+ * LEXICON_OUTPUT_MARKER}, a global symbol, so it holds across separately-
+ * loaded copies of chant-core the way `instanceof` does not. Every caller
+ * (`collect.ts`, `build.ts`, `graph-ir.ts`, `entity-wire-codec.ts`) reads
+ * only own-prototype members off the result (`outputName`, `_sourceParent`,
+ * `_setSourceEntity()`, `getOutputValue()`), all of which work identically
+ * on a cross-copy instance.
  */
 export function isLexiconOutput(value: unknown): value is LexiconOutput {
-  return value instanceof LexiconOutput;
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    LEXICON_OUTPUT_MARKER in value &&
+    (value as Record<symbol, unknown>)[LEXICON_OUTPUT_MARKER] === true
+  );
 }

package/src/lint/config.test.ts

@@ -1,7 +1,7 @@
 import { describe, test, expect, beforeEach, afterEach } from "vitest";
 import { loadConfig, DEFAULT_CONFIG, findProjectRoot } from "./config";
 import { writeFileSync, mkdirSync, rmSync } from "fs";
-import { join } from "path";
+import { join, resolve } from "path";
 
 const TEST_DIR = join(import.meta.dirname, "__test_config__");
 
@@ -705,10 +705,15 @@ describe("findProjectRoot", () => {
     expect(findProjectRoot(sub)).toBe(TEST_DIR);
   });
 
-  test("falls back to the start dir when no config is found", () => {
+  test("stops at the nearest .git/package.json boundary when no config is found (#1117)", () => {
     const sub = join(TEST_DIR, "nowhere");
     mkdirSync(sub, { recursive: true });
-    // No chant.config anywhere under TEST_DIR — returns the (resolved) start dir.
-    expect(findProjectRoot(sub)).toBe(sub);
+    // No chant.config anywhere under TEST_DIR — walking up from this real
+    // repo location reaches `packages/core`'s own package.json before the
+    // filesystem root, so that's the returned boundary, not `sub` itself
+    // (chant #1117 — discovery must never wander past the project just
+    // because it declares no config).
+    const packageRoot = resolve(import.meta.dirname, "..", "..");
+    expect(findProjectRoot(sub)).toBe(packageRoot);
   });
 });

package/src/lint/config.ts

@@ -1,11 +1,18 @@
 import { readFileSync, existsSync } from "fs";
 import { join, dirname, resolve } from "path";
-import { createRequire } from "module";
 import { z } from "zod";
+import { evaluateProjectConfigSync } from "../config-sandbox";
 import type { Severity, RuleConfig } from "./rule";
 import { moduleDir, getRuntime } from "../runtime-adapter";
 import strictPreset from "./presets/strict.json";
 
+// chant #1117 — the upward config-discovery walk moved to a shared module
+// (`../project-root`) so `chant build`/`lint.policies` use the identical walk
+// `chant lint`/`chant graph` already did. Re-exported here since this is
+// still where every existing call site (`./config.test.ts`, `../cli/commands/lint.ts`)
+// imports it from.
+export { findProjectRoot } from "../project-root";
+
 /** Mapping of built-in preset names to their file paths */
 const BUILTIN_PRESETS: Record<string, string> = {
   "@intentius/chant/lint/presets/strict": resolve(moduleDir(import.meta.url), "presets/strict.json"),
@@ -323,29 +330,6 @@ function loadConfigFile(configPath: string, visited: Set<string> = new Set()): L
   return mergedConfig;
 }
 
-/**
- * Walk up from `startDir` to the nearest ancestor holding a chant project
- * config (`chant.config.ts` or `chant.config.json`). Returns that directory, or
- * `startDir` unchanged when none is found before the filesystem root.
- *
- * Linting a subpath (`chant graph src --format ir`, `chant lint src/lib`) must
- * still see the project-root config: its `lint.overrides` globs are written
- * project-root-relative (`src/lib/**`), and a rule set scoped only to the lint
- * arg would silently drop them. Config discovery therefore anchors on the
- * project root, not the path being linted.
- */
-export function findProjectRoot(startDir: string): string {
-  let dir = resolve(startDir);
-  for (;;) {
-    if (existsSync(join(dir, "chant.config.ts")) || existsSync(join(dir, "chant.config.json"))) {
-      return dir;
-    }
-    const parent = dirname(dir);
-    if (parent === dir) return resolve(startDir);
-    dir = parent;
-  }
-}
-
 /**
  * Load lint configuration from a directory.
  *
@@ -353,6 +337,12 @@ export function findProjectRoot(startDir: string): string {
  * then falls back to `chant.config.json` (legacy LintConfig format).
  * Returns default configuration if neither exists.
  *
+ * chant #1113 — the `chant.config.ts` branch executes project-authored code,
+ * so it goes through `../config-sandbox.ts` like every other config load
+ * rather than `require`-ing the file itself. Unarmed (which is every `chant
+ * lint` invocation today — `lint` has no `--sandbox` flag) that is the
+ * identical `createRequire` path this used before, moved one module over.
+ *
  * @param dir - Directory path to search for config file
  * @returns Loaded and merged configuration, or default config if not found
  */
@@ -361,9 +351,7 @@ export function loadConfig(dir: string): LintConfig {
   const tsConfigPath = join(dir, "chant.config.ts");
   if (existsSync(tsConfigPath)) {
     try {
-      const _require = createRequire(join(dir, "package.json"));
-      const mod = _require(tsConfigPath);
-      const config = mod.default ?? mod.config ?? mod;
+      const config = evaluateProjectConfigSync(tsConfigPath, dir);
       if (typeof config === "object" && config !== null) {
         // ChantConfig format: extract lint property
         if ("lint" in config && typeof config.lint === "object") {

package/src/lint/policy.ts

@@ -4,7 +4,7 @@
  * `policyGate` Op step runs this to gate an apply on the same checks.
  */
 import { resolve, dirname } from "node:path";
-import { loadChantConfig } from "../config";
+import { loadChantConfigUpward } from "../config";
 import { resolveProjectLexicons, loadPlugins } from "../cli/plugins";
 import { build } from "../build";
 import { runPostSynthChecks, isPostSynthCheck } from "./post-synth";
@@ -55,10 +55,10 @@ export async function evaluateProjectPolicies(opts: {
   const plugins = await loadPlugins(lexiconNames);
   const serializers = plugins.map((p) => p.serializer);
 
-  // Config can live in the build dir or its parent (the project root).
-  const loaded = await loadChantConfig(buildPath).then((r) =>
-    r.configPath ? r : loadChantConfig(dirname(buildPath)),
-  );
+  // chant #1117 — walks up from the build dir to the project root, same as
+  // `chant build` (`../cli/commands/build.ts`'s `loadChantConfigUpward`), not
+  // just the build dir's immediate parent.
+  const loaded = await loadChantConfigUpward(buildPath);
   const config = loaded.config;
   const configDir = loaded.configPath ? dirname(loaded.configPath) : buildPath;
   const env = opts.env ?? config.ownership?.env;

package/src/project-root.test.ts

@@ -0,0 +1,105 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
+import { findProjectConfig, findProjectRoot } from "./project-root";
+
+// Every test builds its own isolated directory tree under a fresh tmpdir —
+// never reused across tests, and never anywhere near the real repo's own
+// .git/package.json — so the boundary-stop behavior is exercised
+// deterministically instead of depending on where this file happens to sit
+// in the real chant checkout.
+let root: string;
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), "chant-project-root-"));
+});
+
+afterEach(() => {
+  rmSync(root, { recursive: true, force: true });
+});
+
+describe("findProjectConfig / findProjectRoot (chant #1117)", () => {
+  test("found at root — chant.config.ts in the start dir itself", () => {
+    writeFileSync(join(root, "chant.config.ts"), "export default {};");
+
+    const result = findProjectConfig(root);
+
+    expect(result.dir).toBe(root);
+    expect(result.configPath).toBe(join(root, "chant.config.ts"));
+    expect(findProjectRoot(root)).toBe(root);
+  });
+
+  test("found at an intermediate ancestor — several levels below the config", () => {
+    writeFileSync(join(root, "chant.config.json"), "{}");
+    const stackDir = join(root, "src", "stacks", "shared-foundation");
+    mkdirSync(stackDir, { recursive: true });
+
+    const result = findProjectConfig(stackDir);
+
+    expect(result.dir).toBe(root);
+    expect(result.configPath).toBe(join(root, "chant.config.json"));
+    expect(findProjectRoot(stackDir)).toBe(root);
+  });
+
+  test("not found — no chant.config, no .git, no package.json anywhere above start dir: falls back to start dir, not the filesystem root", () => {
+    const deep = join(root, "a", "b", "c");
+    mkdirSync(deep, { recursive: true });
+
+    const result = findProjectConfig(deep);
+
+    // Nothing between `deep` and the real filesystem root declares a chant
+    // config or a boundary marker (this mkdtemp tree carries none). Rather
+    // than adopting "/" as the project root — which would make a downstream
+    // caller that scopes a directory walk off this result (e.g.
+    // `resolveProjectLexicons` -> `findInfraFiles`) scan the entire disk —
+    // the walk gives up and returns `deep` itself unchanged.
+    expect(result.configPath).toBeUndefined();
+    expect(result.dir).toBe(deep);
+    expect(findProjectRoot(deep)).toBe(deep);
+  });
+
+  test("boundary stop — a .git/package.json ancestor halts the walk before an outer chant.config.ts", () => {
+    // An unrelated chant.config.ts two levels above this project's own git
+    // root must never be picked up — the boundary marker (.git here) stops
+    // the walk at the project's own root first.
+    writeFileSync(join(root, "chant.config.ts"), "export default { unrelated: true };");
+    const projectRoot = join(root, "project");
+    mkdirSync(join(projectRoot, ".git"), { recursive: true });
+    const stackDir = join(projectRoot, "src", "stack");
+    mkdirSync(stackDir, { recursive: true });
+
+    const result = findProjectConfig(stackDir);
+
+    expect(result.dir).toBe(projectRoot);
+    expect(result.configPath).toBeUndefined();
+    expect(findProjectRoot(stackDir)).toBe(projectRoot);
+  });
+
+  test("boundary stop — package.json (no .git) halts the walk the same way", () => {
+    writeFileSync(join(root, "chant.config.json"), "{}");
+    const projectRoot = join(root, "project");
+    mkdirSync(projectRoot, { recursive: true });
+    writeFileSync(join(projectRoot, "package.json"), "{}");
+    const stackDir = join(projectRoot, "src", "stack");
+    mkdirSync(stackDir, { recursive: true });
+
+    const result = findProjectConfig(stackDir);
+
+    expect(result.dir).toBe(projectRoot);
+    expect(result.configPath).toBeUndefined();
+  });
+
+  test("a config living exactly at the boundary dir is still found — boundary check never wins over a real config", () => {
+    const projectRoot = join(root, "project");
+    mkdirSync(join(projectRoot, ".git"), { recursive: true });
+    writeFileSync(join(projectRoot, "chant.config.ts"), "export default {};");
+    const stackDir = join(projectRoot, "src", "stack");
+    mkdirSync(stackDir, { recursive: true });
+
+    const result = findProjectConfig(stackDir);
+
+    expect(result.dir).toBe(projectRoot);
+    expect(result.configPath).toBe(join(projectRoot, "chant.config.ts"));
+  });
+});

package/src/project-root.ts

@@ -0,0 +1,78 @@
+import { existsSync } from "fs";
+import { dirname, join, resolve } from "path";
+
+/**
+ * Shared upward config-discovery walk (chant #1117).
+ *
+ * Before this, `chant build <subdir>` and `lint.policies`
+ * (`./lint/policy.ts`'s `evaluateProjectPolicies`) each searched only the
+ * build directory and its immediate parent for `chant.config.ts`/`.json`,
+ * while `chant lint`/`chant graph` (`./lint/config.ts`'s old, file-local
+ * `findProjectRoot`) already walked all the way up. A project with a deeper
+ * `src/<stack>` layout — `chant build src/<stack>` two or more levels below
+ * the project root — silently never found the root config: `buildParams`'
+ * declared `env:` mappings went inert, `ownership`/`lint.policies`/etc quietly
+ * fell back to defaults, and nothing warned (loomster#162: `LOOM_TIER`/
+ * `LOOM_ENV` inert under every `npm run synth:*` for two releases).
+ *
+ * `findProjectConfig` is the one walk every config-discovery call site now
+ * shares. It stops at the first of:
+ *
+ * 1. A directory holding `chant.config.ts` or `chant.config.json` — found.
+ * 2. A directory holding `.git` or `package.json` with no chant config of its
+ *    own — the project boundary. Discovery must never wander past the actual
+ *    project into an unrelated ancestor directory just because this project
+ *    happens not to declare a config (a stray `chant.config.ts` two levels
+ *    above an unrelated git repo must never be picked up).
+ * 3. `startDir` itself, unchanged, if the walk reaches the filesystem root
+ *    without ever finding a config OR a boundary marker. This is not just a
+ *    "give up gracefully" nicety — several callers (`resolveProjectLexicons`
+ *    -> `findInfraFiles`) scope a real directory walk off this function's
+ *    result; if a rootless/marker-less start dir (a bare tmpdir, as chant's
+ *    own test suites use) resolved all the way to `/`, that downstream walk
+ *    would scan the entire filesystem instead of failing fast. Falling back
+ *    to `startDir` keeps every caller's blast radius local no matter how far
+ *    up the walk had to look.
+ */
+export interface ProjectConfigSearch {
+  /** The resolved project root: the config's directory, the boundary directory, or the (resolved) `startDir` when neither was found. */
+  dir: string;
+  /** Absolute path to the discovered `chant.config.ts`/`.json`, if any. */
+  configPath?: string;
+}
+
+/** Walk up from `startDir` (inclusive) to the nearest chant config or project boundary. See {@link ProjectConfigSearch}. */
+export function findProjectConfig(startDir: string): ProjectConfigSearch {
+  const resolvedStart = resolve(startDir);
+  let dir = resolvedStart;
+  for (;;) {
+    const tsPath = join(dir, "chant.config.ts");
+    if (existsSync(tsPath)) return { dir, configPath: tsPath };
+    const jsonPath = join(dir, "chant.config.json");
+    if (existsSync(jsonPath)) return { dir, configPath: jsonPath };
+
+    if (existsSync(join(dir, ".git")) || existsSync(join(dir, "package.json"))) {
+      return { dir };
+    }
+
+    const parent = dirname(dir);
+    if (parent === dir) {
+      // Filesystem root, no config, no boundary ever seen — give up rather
+      // than adopting "/" as the project root (see the module doc above).
+      return { dir: resolvedStart };
+    }
+    dir = parent;
+  }
+}
+
+/**
+ * Walk up from `startDir` to the nearest ancestor holding a chant project
+ * config (`chant.config.ts` or `chant.config.json`), the `.git`/`package.json`
+ * project boundary, or `startDir` itself when neither is found. Thin wrapper
+ * over {@link findProjectConfig} for callers that only need the directory
+ * (e.g. `chant lint`'s rule/plugin resolution, which just needs *a* stable
+ * root to resolve relative paths against).
+ */
+export function findProjectRoot(startDir: string): string {
+  return findProjectConfig(startDir).dir;
+}