@intentius/chant 0.25.0 → 0.26.0

package/dist/stack-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack-output.d.ts","sourceRoot":"","sources":["../src/stack-output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;mDAC+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAgBD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,GAAG,SAAS,EACxB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,WAAW,CAuBb"}
+{"version":3,"file":"stack-output.d.ts","sourceRoot":"","sources":["../src/stack-output.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAG1D;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkC,CAAC;AAEnE;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC;IACrC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;mDAC+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAqBD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAOlE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,GAAG,SAAS,EACxB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,WAAW,CAiCb"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/build.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
 import { build, partitionByLexicon, detectCrossLexiconRefs, collectLexiconOutputs, computeStackGraph } from "./build";
 import { output } from "./lexicon-output";
 import { AttrRef } from "./attrref";
@@ -599,6 +599,58 @@ describe("detectCrossLexiconRefs", () => {
     const detected = detectCrossLexiconRefs(entities);
     expect(detected).toHaveLength(0);
   });
+
+  // chant #1137 — `detectCrossLexiconRefs`'s walk used to check
+  // `value instanceof AttrRef`, which returns false for an AttrRef built by
+  // a SEPARATELY-LOADED copy of `./attrref` (the same dual-npm-copy hazard
+  // #1122 fixed for `LexiconOutput`: a lexicon pinned to a chant range that
+  // doesn't overlap the project's own gets its own nested
+  // `node_modules/@intentius/chant`). `vi.resetModules()` + a fresh dynamic
+  // import reproduces that split module graph exactly. Before the fix, a
+  // foreign AttrRef here falls through to the generic object walk instead
+  // of being recognized, and the auto-detected `Outputs` entry vanishes
+  // silently — no error, just a missing cross-lexicon output.
+  test("detects a cross-lexicon ref built by a second, separately-loaded copy of AttrRef", async () => {
+    const alphaBucket = {
+      lexicon: "alpha",
+      entityType: "Alpha::Storage::Bucket",
+      [DECLARABLE_MARKER]: true,
+    } as Declarable;
+
+    vi.resetModules();
+    const secondCopy = await import("./attrref");
+
+    // Sanity check that this really is a distinct module instance — the
+    // premise the rest of the test depends on.
+    expect(secondCopy.AttrRef).not.toBe(AttrRef);
+
+    const foreignRef = new secondCopy.AttrRef(alphaBucket, "Endpoint");
+
+    // The historic bug: instanceof fails across separately-loaded copies of
+    // chant-core, even though the two classes are structurally identical.
+    expect(foreignRef instanceof AttrRef).toBe(false);
+
+    const ghAction = {
+      lexicon: "github",
+      entityType: "Action",
+      [DECLARABLE_MARKER]: true,
+      props: { url: foreignRef },
+    } as unknown as Declarable;
+
+    const entities = new Map<string, Declarable>([
+      ["dataBucket", alphaBucket],
+      ["deployAction", ghAction],
+    ]);
+
+    // The fix: `isAttrRefLike` duck-types on shape, so a foreign-copy
+    // AttrRef is still recognized and auto-detected as a cross-lexicon output.
+    const detected = detectCrossLexiconRefs(entities);
+    expect(detected).toHaveLength(1);
+    expect(detected[0].sourceLexicon).toBe("alpha");
+    expect(detected[0].sourceEntity).toBe("dataBucket");
+    expect(detected[0].sourceAttribute).toBe("Endpoint");
+    vi.resetModules();
+  });
 });
 
 describe("computeStackGraph (#200 — cross-stack apply ordering)", () => {
@@ -646,4 +698,28 @@ describe("computeStackGraph (#200 — cross-stack apply ordering)", () => {
     );
     expect(g.waves).toEqual([["base"], ["left", "right"], ["top"]]);
   });
+
+  // chant #1137 — same dual-npm-copy hazard as detectCrossLexiconRefs above,
+  // this time for the cross-stack apply-ordering graph: a foreign-copy
+  // AttrRef that fails `instanceof` here used to fall through to the
+  // generic object walk instead of producing an edge, silently dropping a
+  // real cross-stack dependency (which can misorder — or fail to detect a
+  // cycle in — the apply order this graph exists to compute).
+  test("infers a consumer→producer edge from an AttrRef built by a second, separately-loaded copy", async () => {
+    const vpc = ent("aws");
+
+    vi.resetModules();
+    const secondCopy = await import("./attrref");
+    expect(secondCopy.AttrRef).not.toBe(AttrRef);
+
+    const foreignRef = new secondCopy.AttrRef(vpc, "id");
+    expect(foreignRef instanceof AttrRef).toBe(false); // the historic bug
+
+    const svc = ent("k8s", { vpcId: foreignRef });
+    const g = computeStackGraph(new Map([["vpc", vpc], ["svc", svc]]), ["aws", "k8s"]);
+
+    expect(g.edges).toEqual([{ from: "k8s", to: "aws" }]);
+    expect(g.order).toEqual(["aws", "k8s"]);
+    vi.resetModules();
+  });
 });

package/src/build.ts

@@ -7,6 +7,7 @@ import type { BuildParamProvenance } from "./provenance";
 import { DiscoveryError, BuildError as BuildErrorClass } from "./errors";
 import { LexiconOutput, isLexiconOutput } from "./lexicon-output";
 import { AttrRef } from "./attrref";
+import { isAttrRefLike } from "./utils";
 import { isChildProject, type ChildProjectInstance } from "./child-project";
 import { discover, type DiscoveryResult, type FoldDecision } from "./discovery/index";
 import { decodeEntitySet, type DiscoveredEntitiesJson } from "./discovery/entity-wire";
@@ -77,7 +78,13 @@ export function computeStackGraph(
     if (value === null || value === undefined || typeof value !== "object") return;
     if (visited.has(value)) return;
     visited.add(value);
-    if (value instanceof AttrRef) {
+    // Duck-type, not `instanceof` (chant #1137): a lexicon built against a
+    // separate copy of `@intentius/chant` produces AttrRefs that fail
+    // `instanceof AttrRef` here but carry the same shape. Without this, a
+    // real cross-stack dependency silently falls through to the generic
+    // object walk below instead of producing an edge, which can misorder —
+    // or entirely drop — the apply order this graph exists to compute.
+    if (isAttrRefLike(value)) {
       const parent = value.parent.deref();
       const producer = parent ? (parent as Record<string, unknown>).lexicon : undefined;
       if (typeof producer === "string" && producer !== consumer) addEdge(consumer, producer);
@@ -370,7 +377,13 @@ export function detectCrossLexiconRefs(
     if (visited.has(value)) return;
     visited.add(value);
 
-    if (value instanceof AttrRef) {
+    // Duck-type, not `instanceof` (chant #1137): a lexicon built against a
+    // separate copy of `@intentius/chant` produces AttrRefs that fail
+    // `instanceof AttrRef` here but carry the same shape. Without this, a
+    // real cross-lexicon reference silently falls through to the generic
+    // object walk below instead of auto-creating a `LexiconOutput`, and the
+    // whole `Outputs` entry for it vanishes (same failure shape as #1122).
+    if (isAttrRefLike(value)) {
       const parent = value.parent.deref();
       if (!parent) return;
 

package/src/cli/commands/build.ts

@@ -5,6 +5,7 @@ import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
 import { runPostSynthChecks } from "../../lint/post-synth";
 import { loadPolicyChecks } from "../../lint/policy";
+import { armSandboxPolicyExecution, runProjectPolicies } from "../../lint/policy-sandbox";
 import { sortedJsonReplacer } from "../../utils";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format";
 import { writeFileSync, mkdirSync } from "fs";
@@ -144,9 +145,7 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // Project-authored organizational policy checks (lint.policies), run over the
   // resolved resources during build. Resolve paths relative to the config dir.
   const configDir = loaded.configPath ? dirname(loaded.configPath) : infraPath;
-  const policyChecks = config.lint?.policies?.length
-    ? await loadPolicyChecks(config.lint.policies, configDir)
-    : [];
+  const policies = config.lint?.policies ?? [];
 
   // #1022 — opt-in fold path: the CLI flag wins over `chant.config.ts`'s
   // `build.fold`, which wins over the (unchanged) default of running every
@@ -158,6 +157,22 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // as fold, resolved independently.
   const sandbox = resolveSandboxEnabled(config, options.sandbox);
 
+  // #1131 — arm sandboxed policy execution from the RESOLVED value, before any
+  // policy module could be loaded. Resolved, not `options.sandbox`, because
+  // policies have none of the config's bootstrap limit: they are loaded long
+  // after `build.sandbox` is known, so a config-only opt-in sandboxes them just
+  // as the CLI flag does. Arming (rather than threading a flag to each caller)
+  // makes `loadPolicyChecks` refuse process-wide — a call site that forgot to
+  // ask gets a loud error instead of quietly running project code here.
+  if (sandbox) armSandboxPolicyExecution();
+
+  // Unsandboxed, the policy pack is still loaded HERE, before the build — a
+  // policy path that doesn't resolve has always failed the command up front,
+  // including when the build itself then fails, and #1131 does not change that.
+  // Sandboxed, there is nothing to load in this process at all.
+  const preloadedPolicyChecks =
+    !sandbox && policies.length > 0 ? await loadPolicyChecks([...policies], configDir) : undefined;
+
   // #1113 — the bootstrap limit, surfaced rather than left implicit. Reading
   // `build.sandbox` out of `chant.config.ts` requires evaluating that file, so
   // a config-only opt-in cannot have covered its own evaluation; only the CLI
@@ -298,8 +313,21 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
 
     // Project-authored organizational policy — cross-cutting, so it sees every
     // lexicon's output at once (not scoped per-plugin), with the current env.
-    if (policyChecks.length > 0) {
-      const policyDiags = runPostSynthChecks(policyChecks, result, env);
+    //
+    // #1131 — under `--sandbox` this is where the LAST piece of project-
+    // authored code the CLI used to execute in its own process moves behind
+    // the boundary: `runProjectPolicies` hands the merged, serialized build
+    // result to a post-merge sandboxed child, which imports the policy modules
+    // and runs their checks there, and only plain `PostSynthDiagnostic`s come
+    // back. Unsandboxed, it is the same in-process load-and-run as before.
+    if (policies.length > 0) {
+      const policyDiags = await runProjectPolicies({
+        policies,
+        configDir,
+        buildResult: result,
+        env,
+        preloaded: preloadedPolicyChecks,
+      });
       for (const diag of policyDiags) {
         const prefix = diag.entity ? `[${diag.entity}] ` : "";
         const where = diag.lexicon ? ` (${diag.lexicon})` : "";

package/src/cli/main.test.ts

@@ -130,10 +130,23 @@ describe("parseArgs", () => {
     expect(result.help).toBe(false);
   });
 
-  test("ignores unknown flags", () => {
-    const result = parseArgs(["build", "--unknown", "value"]);
+  test("throws on an unknown bare flag instead of silently ignoring it (chant #1127)", () => {
+    // Was "ignores unknown flags" — pinned the old silent-drop as intended
+    // behavior. #1127 flips it: an unrecognized `--flag` is a hard error.
+    expect(() => parseArgs(["build", "--unknown", "value"])).toThrow(/Unknown flag: --unknown/);
+  });
+
+  test("unknown flag error points at --help", () => {
+    expect(() => parseArgs(["build", "--unknown"])).toThrow(/--help/);
+  });
+
+  test("throws on an unknown joined flag (--unknown=value)", () => {
+    expect(() => parseArgs(["build", "--unknown=value"])).toThrow(/Unknown flag: --unknown/);
+  });
+
+  test("unknown short flags are still silently ignored (unchanged; out of #1127 scope)", () => {
+    const result = parseArgs(["build", "-x", "value"]);
     expect(result.command).toBe("build");
-    // Unknown flags are silently ignored
   });
 
   test("parses --watch flag", () => {
@@ -271,27 +284,90 @@ describe("parseArgs", () => {
     expect(result.paramsFile).toBe("./params.json");
   });
 
-  // ── --param=name=value hard error (chant #1118) ──────────────────────────
-  // The joined `--flag=value` form is not supported anywhere in this parser
-  // (see "ignores unknown flags" above) — a dropped --param can silently
-  // change what a build measures/deploys, so this form is rejected loudly
-  // instead of silently accepted as a no-op.
+  test("plain --param name=value is unaffected", () => {
+    const result = parseArgs(["build", "src", "--param", "tier=production"]);
+    expect(result.param).toEqual(["tier=production"]);
+  });
+
+  // ── generic --flag=value joined form (chant #1127) ────────────────────────
+  // #1118 taught this parser to hard-error `--param=name=value` specifically,
+  // because it was the one flag known (from #1118's investigation) to sit
+  // behind a silent drop. #1127's audit found the drop was general — every
+  // value-taking flag shares it — so the fix is general too: split any
+  // `--flag=value` token at its first `=` and re-dispatch as `--flag` +
+  // `value`, the exact shape every branch below already handles. This
+  // supersedes #1118's `--param=` hard error entirely: the joined form is now
+  // just as valid as the space-separated one, for every flag, not a rejected
+  // special case for one flag.
 
-  test("--param=name=value throws instead of silently dropping", () => {
-    expect(() => parseArgs(["build", "src", "--param=tier=production"])).toThrow(/--param=tier=production/);
+  test("--param=name=value now works instead of throwing — joined form matches the space-separated form", () => {
+    const result = parseArgs(["build", "src", "--param=tier=production"]);
+    expect(result.param).toEqual(["tier=production"]);
   });
 
-  test("--param=name=value error names the working form", () => {
-    expect(() => parseArgs(["build", "src", "--param=tier=production"])).toThrow(/--param name=value/);
+  test("--env=value joined form works", () => {
+    const result = parseArgs(["build", "src", "--env=staging"]);
+    expect(result.env).toBe("staging");
   });
 
-  test("--param= (empty value) also throws", () => {
-    expect(() => parseArgs(["build", "src", "--param="])).toThrow(/--param=/);
+  test("--format=value joined form works", () => {
+    const result = parseArgs(["build", "src", "--format=yaml"]);
+    expect(result.format).toBe("yaml");
   });
 
-  test("plain --param name=value is unaffected", () => {
-    const result = parseArgs(["build", "src", "--param", "tier=production"]);
-    expect(result.param).toEqual(["tier=production"]);
+  test("--lexicon=value joined form works", () => {
+    const result = parseArgs(["build", "src", "--lexicon=aws"]);
+    expect(result.lexicon).toBe("aws");
+  });
+
+  test("repeated --param=name=value (joined) accumulates in order, same as space-separated", () => {
+    const result = parseArgs(["build", "src", "--param=tier=production", "--param=env=staging"]);
+    expect(result.param).toEqual(["tier=production", "env=staging"]);
+  });
+
+  test("joined form only splits on the FIRST '=' — a value containing '=' is preserved whole", () => {
+    // --param's own value shape is `name=value`, so `--param=tier=production`
+    // must split into flag `--param` + value `tier=production`, not further
+    // fragment on the second `=`.
+    const result = parseArgs(["build", "src", "--param=tier=production=east"]);
+    expect(result.param).toEqual(["tier=production=east"]);
+  });
+
+  test("joined form works mixed with space-separated flags in the same invocation", () => {
+    const result = parseArgs(["build", "src", "--env=prod", "--format", "json", "--lexicon=k8s"]);
+    expect(result.env).toBe("prod");
+    expect(result.format).toBe("json");
+    expect(result.lexicon).toBe("k8s");
+  });
+
+  // ── boolean-only flag given a joined value (chant #1127) ──────────────────
+  // Decision: reject it. A boolean flag (--fold, --watch, --json, ...) has no
+  // value slot — its branch just sets a field to `true` and never consumes a
+  // following token. Silently coercing "true"/"false" would need to invent
+  // parsing rules (what about "1", "yes", mixed case?) for a form none of
+  // this CLI's flags need; silently dropping the value and reinterpreting it
+  // as the next positional (a path, a component name, ...) is exactly the
+  // silent misparse #1127 closes. So it errors, naming the flag as boolean.
+
+  test("a boolean flag given a joined value throws, naming the flag as boolean", () => {
+    expect(() => parseArgs(["build", "src", "--fold=true"])).toThrow(/--fold is a boolean flag/);
+  });
+
+  test("boolean-with-value error does not silently reinterpret the value as a positional", () => {
+    expect(() => parseArgs(["build", "src", "--watch=false"])).toThrow(/--watch is a boolean flag/);
+  });
+
+  test("--json=1 (another boolean flag) also throws", () => {
+    expect(() => parseArgs(["run", "myop", "--json=1"])).toThrow(/--json is a boolean flag/);
+  });
+
+  test("--report keeps its context-sensitive bare-vs-value behavior when joined", () => {
+    // --report is deliberately not in the boolean-reject set: bare --report is
+    // a boolean (`run`), but --report <path> is a SARIF destination (migrate).
+    // The joined form should resolve the same way the space-separated one does.
+    const result = parseArgs(["migrate", "wf.yml", "--report=out.sarif"]);
+    expect(result.reportFile).toBe("out.sarif");
+    expect(result.report).toBeUndefined();
   });
 });
 

package/src/cli/main.ts

@@ -7,6 +7,7 @@ import { loadPlugins, resolveProjectLexicons } from "./plugins";
 import { resolveCommand, type CommandDef, type ParsedArgs } from "./registry";
 import { loadChantConfigUpward } from "../config";
 import { armSandboxConfigEvaluation } from "../config-sandbox";
+import { armSandboxPolicyExecution } from "../lint/policy-import";
 import { ENV_VAR, unknownEnvError } from "../env";
 import { initRuntime } from "../runtime-adapter";
 import { runBuild } from "./handlers/build";
@@ -27,10 +28,60 @@ import { runGraph } from "./handlers/graph";
 import { runOp, runOpList, runOpStatus, runOpSignal, runOpCancel, runOpLog } from "./handlers/run";
 import { runEmulator } from "./handlers/emulator";
 
+/**
+ * Long-form flags that are pure booleans in {@link parseArgs} — their branch
+ * below sets a field to `true` and never consumes a following array element.
+ * Used only to reject a joined `--flag=value` form for these (chant #1127):
+ * a boolean has no value to assign, and silently reinterpreting the joined
+ * value as the next positional argument (path, component name, ...) would be
+ * exactly the kind of silent misparse this issue exists to close. `--report`
+ * is deliberately excluded — it's context-sensitive (bare boolean vs a SARIF
+ * path, decided by lookahead), so a joined value for it is legitimate and
+ * already handled correctly once split.
+ */
+const BOOLEAN_FLAGS = new Set([
+  "--help",
+  "--force",
+  "--fix",
+  "--watch",
+  "--verbose",
+  "--live",
+  "--overlay",
+  "--owned",
+  "--verbatim",
+  "--apply-rewrites",
+  "--write",
+  "--strict",
+  "--validate",
+  "--use-composites",
+  "--stacks",
+  "--components",
+  "--up",
+  "--down",
+  "--include-dependents",
+  "--local",
+  "--temporal",
+  "--json",
+  "--progress-json",
+  "--update-snapshot",
+  "--run-examples",
+  "--check",
+  "--bump",
+  "--no-release-record",
+  "--fold",
+  "--sandbox",
+]);
+
 /**
  * Parse command line arguments
  */
 export function parseArgs(args: string[]): ParsedArgs {
+  // Local mutable copy — chant #1127's joined-`--flag=value` splitting below
+  // rewrites the array in place (one token becomes two), so this must not
+  // mutate whatever array the caller passed in (e.g. `process.argv.slice(2)`
+  // is already a fresh copy, but callers shouldn't have to know that).
+  args = args.slice();
+
   const result: ParsedArgs = {
     command: "",
     path: ".",
@@ -67,7 +118,29 @@ export function parseArgs(args: string[]): ParsedArgs {
 
   let i = 0;
   while (i < args.length) {
-    const arg = args[i];
+    let arg = args[i];
+
+    // chant #1127 — generic joined `--flag=value` support. Every value-taking
+    // flag below is matched by an exact `arg === "--flag"` check and then
+    // consumes the *next* array element (`args[++i]`) as its value; a joined
+    // token like `--env=prod` never matches any of those, doesn't match the
+    // trailing positional branch either (it starts with `-`), and used to
+    // vanish with no error. Splitting the token at its FIRST `=` and
+    // re-dispatching as two array elements makes every flag below see the
+    // exact shape it already handles — including a flag like `--param`
+    // whose own value legitimately contains `=` (`--param=tier=production`
+    // splits to flag `--param`, value `tier=production`, not further split
+    // on the second `=`).
+    if (arg.startsWith("--") && arg.includes("=")) {
+      const eq = arg.indexOf("=");
+      const flag = arg.slice(0, eq);
+      const value = arg.slice(eq + 1);
+      if (BOOLEAN_FLAGS.has(flag)) {
+        throw new Error(`${arg} — ${flag} is a boolean flag and does not take a value. Pass ${flag} on its own.`);
+      }
+      args.splice(i, 1, flag, value);
+      arg = args[i];
+    }
 
     if (arg === "--help" || arg === "-h") {
       result.help = true;
@@ -224,19 +297,28 @@ export function parseArgs(args: string[]): ParsedArgs {
     } else if (arg === "--sandbox") {
       result.sandbox = true;
     } else if (arg === "--param") {
+      // chant #1118/#1127 — `--param name=value` (space-separated) and
+      // `--param=name=value` (joined, split above at its first `=` into flag
+      // `--param` + value `name=value`) both land here and behave
+      // identically; there is no separate joined-form error anymore (the
+      // #1118 hard error this superseded only existed because the parser
+      // didn't support joined forms at all — now that it does, the joined
+      // form is just as valid as the space-separated one).
       (result.param ??= []).push(args[++i]);
-    } else if (arg.startsWith("--param=")) {
-      // chant #1118 — this parser never supports an `--flag=value` joined
-      // form for any value-taking flag (every branch above is an exact `===`
-      // match, so a joined token falls through unrecognized and is silently
-      // dropped — see the "ignores unknown flags" case below). `--param
-      // name=value` (space-separated) is the only accepted form. Rather than
-      // teach the parser joined forms generally, `--param=name=value` is
-      // called out as a hard error instead of a silent no-op: a dropped
-      // `--param` can silently change what a build measures/deploys.
-      throw new Error(`${arg} is not supported. Use --param name=value (space-separated) instead.`);
     } else if (arg === "--params-file") {
       result.paramsFile = args[++i];
+    } else if (arg.startsWith("--")) {
+      // chant #1127 — every recognized flag is matched above; anything left
+      // starting with `--` is unrecognized, whether it arrived bare
+      // (`--bogus`) or joined (`--bogus=value`, already split into
+      // `--bogus` + `value` above). This used to fall through silently (the
+      // "ignores unknown flags" case) — a typo'd or misremembered flag would
+      // vanish with no diagnostic, exactly like the silent-drop this issue
+      // closes for joined values. Point at --help rather than enumerating
+      // every flag here: this parser's flag set is one flat list shared by
+      // every command, not scoped per-command, so "the command's known
+      // flags" isn't something this loop can name in isolation.
+      throw new Error(`Unknown flag: ${arg}\nRun "chant --help" to see supported flags.`);
     } else if (!arg.startsWith("-")) {
       if (!result.command) {
         result.command = arg;
@@ -608,6 +690,14 @@ async function main(): Promise<void> {
   // `../config-sandbox.ts`.
   if (args.sandbox) armSandboxConfigEvaluation();
 
+  // chant #1131 — the same for `lint.policies`. Armed from the flag here so
+  // the mode is set for the whole invocation, not just `chant build`; the build
+  // command arms it again from the RESOLVED value (a project's own
+  // `build.sandbox: true` also sandboxes its policies — unlike the config,
+  // policies have no bootstrap limit, since they load long after the config is
+  // known). See `../lint/policy-sandbox.ts`.
+  if (args.sandbox) armSandboxPolicyExecution();
+
   // Initialize runtime adapter early — before plugins or commands run.
   // chant #1117 — walks up from `args.path` to the project root: for a
   // subdirectory build/command (`chant build src/<stack> --env prod`) the

package/src/discovery/entity-wire-codec.ts

@@ -23,20 +23,25 @@
  * value) becomes a name-keyed marker instead. {@link decodeEntitySet} is the
  * inverse — it rebuilds a live `Map<string, Declarable>` whose entities are
  * BEHAVIORALLY indistinguishable from what `discover()` would have produced
- * in-process: real `AttrRef` instances (several call sites downstream key off
- * `instanceof AttrRef`, not just duck typing — `intrinsic-interpolation.ts`'s
+ * in-process: real `AttrRef` instances, not a duck-typed `{__attrRef}`
+ * envelope alone. `new AttrRef(...)` here is plain, direct construction from
+ * this module's own class — this codec runs inside the same module graph as
+ * every downstream reader (`intrinsic-interpolation.ts`'s
  * `defaultInterpolationSerializer`, `discovery/graph.ts`'s
  * `buildDependencyGraph`, `build.ts`'s `detectCrossLexiconRefs`/
- * `computeStackGraph` — so a plain `{__attrRef}` envelope alone is not
- * enough), and whole-entity embeds restored to the SAME object reference
- * (not a structurally-equal clone), so `entityNames.get(decl)` keeps working
- * by identity exactly as it does today.
+ * `computeStackGraph`, all converted to `isAttrRefLike` duck-typing by chant
+ * #1137 for the OTHER hazard, a separately-loaded lexicon copy) — so there is
+ * no dual-package boundary to duck-type across here, and building the real
+ * class is simply less code than hand-assembling a shape-alike stand-in with
+ * matching methods, and whole-entity embeds restored to the SAME object
+ * reference (not a structurally-equal clone), so `entityNames.get(decl)`
+ * keeps working by identity exactly as it does today.
  *
  * `serializer-walker.ts`'s `walkValue` needs NO changes for this: it already
  * falls back to reading a plain `{__attrRef}` envelope (added for intrinsics
  * whose own `toJSON()` embeds one). `decodeEntitySet` goes further and
- * reconstructs the real class so every OTHER `instanceof AttrRef` call site
- * keeps working too, not just the walker.
+ * reconstructs the real class, both simpler here and a belt-and-suspenders
+ * match for any call site that still checks `instanceof AttrRef` directly.
  *
  * Naming happens exactly once, inside the boundary — `resolveAttrRefs`
  * (./resolve.ts) runs as part of `discover()`, before `encodeEntitySet` is
@@ -85,7 +90,7 @@ import { isChildProject } from "../child-project";
  *   form. `refs` additionally captures any `AttrRef`/whole-entity reference
  *   found while walking the intrinsic's OWN fields (not through `toJSON()`)
  *   — `buildDependencyGraph` and `detectCrossLexiconRefs`/`computeStackGraph`
- *   walk raw entity property trees looking for `instanceof AttrRef`/a
+ *   walk raw entity property trees looking for an `AttrRef`-like value/a
  *   tracked `Declarable`, not through `toJSON()`, so a ref nested inside e.g.
  *   a `Sub` template needs to still be discoverable post-decode for
  *   cross-lexicon output auto-detection and dependency ordering to keep

package/src/discovery/graph.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "vitest";
+import { describe, test, expect, vi } from "vitest";
 import { buildDependencyGraph } from "./graph";
 import { DECLARABLE_MARKER, type Declarable } from "../declarable";
 import { AttrRef } from "../attrref";
@@ -513,4 +513,43 @@ describe("buildDependencyGraph", () => {
     expect(graph.get("Entity3")?.has("Entity2")).toBe(true);
     expect(graph.get("Entity3")?.size).toBe(1);
   });
+
+  // chant #1137 — `findDependencies` used to check `value instanceof
+  // AttrRef`, which returns false for an AttrRef built by a SEPARATELY-
+  // LOADED copy of `../attrref` (the same dual-npm-copy hazard #1122 fixed
+  // for `LexiconOutput`). `vi.resetModules()` + a fresh dynamic import
+  // reproduces that split module graph exactly. Before the fix, a foreign
+  // AttrRef here recurses into the object's own (unhelpful) fields instead
+  // of being recorded as a dependency, silently dropping the edge — which
+  // can misorder the file-discovery build order this graph exists to compute.
+  test("detects dependency from an AttrRef built by a second, separately-loaded copy", async () => {
+    const parent: Declarable = {
+      lexicon: "test",
+      entityType: "parent",
+      [DECLARABLE_MARKER]: true,
+    };
+
+    vi.resetModules();
+    const secondCopy = await import("../attrref");
+    expect(secondCopy.AttrRef).not.toBe(AttrRef);
+
+    const foreignRef = new secondCopy.AttrRef(parent, "someAttr");
+    expect(foreignRef instanceof AttrRef).toBe(false); // the historic bug
+
+    const child: Declarable & { ref: AttrRef } = {
+      lexicon: "test",
+      entityType: "child",
+      [DECLARABLE_MARKER]: true,
+      ref: foreignRef,
+    };
+
+    const entities = new Map([
+      ["Parent", parent],
+      ["Child", child],
+    ]);
+    const graph = buildDependencyGraph(entities);
+
+    expect(graph.get("Child")?.has("Parent")).toBe(true);
+    vi.resetModules();
+  });
 });

package/src/discovery/graph.ts

@@ -1,6 +1,7 @@
 import type { Declarable } from "../declarable";
 import { isDeclarable } from "../declarable";
 import { AttrRef } from "../attrref";
+import { isAttrRefLike } from "../utils";
 
 /**
  * Builds a dependency graph from a collection of entities
@@ -95,8 +96,13 @@ function findDependencies(
     return;
   }
 
-  // Check if this is an AttrRef
-  if (value instanceof AttrRef) {
+  // Check if this is an AttrRef. Duck-type, not `instanceof` (chant #1137):
+  // a lexicon built against a separate copy of `@intentius/chant` produces
+  // AttrRefs that fail `instanceof AttrRef` here but carry the same shape.
+  // Without this, the dependency edge is silently dropped instead of
+  // recorded, which can misorder — or fail to detect a cycle in — the
+  // file-discovery build order this graph exists to compute.
+  if (isAttrRefLike(value)) {
     if (visited.has(value)) {
       return;
     }