@intentius/chant 0.54.1 → 0.54.3

package/dist/audit/secrets.d.ts

@@ -86,10 +86,7 @@ export declare const ENTROPY_RULE_ID = "SEC010";
  * trigger it.
  */
 export declare function looksLikeIdentifierSlug(value: string): boolean;
-/**
- * Scan a set of files for likely secrets/credentials. Pure with respect to
- * the filesystem and network. Findings never carry the matched value —
- * only its rule id, kind, file/line, and a redaction-safe fingerprint.
- */
+/** Is this a dependency lockfile the secrets scan should skip? */
+export declare function isLockfilePath(path: string): boolean;
 export declare function scanForSecrets(files: ScannableFile[], opts?: SecretsScanOptions): AuditFinding[];
 //# sourceMappingURL=secrets.d.ts.map

package/dist/audit/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/audit/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAG3C,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC;CAC3B;AAOD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvD;AAkDD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAuBtE;AA2GD,2FAA2F;AAC3F,eAAO,MAAM,eAAe,WAAW,CAAC;AAIxC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK9D;AAsCD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,GAAE,kBAAuB,GAAG,YAAY,EAAE,CAkEpG"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/audit/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAG3C,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC;CAC3B;AAOD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvD;AAkDD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,CAuBtE;AA2GD,2FAA2F;AAC3F,eAAO,MAAM,eAAe,WAAW,CAAC;AAIxC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK9D;AAqED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,GAAE,kBAAuB,GAAG,YAAY,EAAE,CAmEpG"}

package/dist/lifecycle/status.d.ts

@@ -275,8 +275,22 @@ export interface CrossEnvComparison {
     envB: string;
     digestA?: string;
     digestB?: string;
-    /** True only when both envs have a recorded digest and they match. */
+    /**
+     * True only when both envs have a recorded digest and their *comparable*
+     * identities match. For a record carrying `inputDigest` (a pinned helm
+     * deploy, chant#1242/#1243), that field is the comparable identity —
+     * `ReleaseRecord.inputDigest`'s own contract: profiles are per cluster, two
+     * environments legitimately render to different bytes, so cross-environment
+     * "is prod running what staging tested" joins on the input side while
+     * `digest` proves the exact bytes each cluster got. Records without it
+     * compare on `digest` exactly as before.
+     */
     same: boolean;
+    /** The identities `same` was decided on (`inputDigest ?? digest` per side), when both sides had one and they differ from the digests shown. */
+    comparedOn?: {
+        a: string;
+        b: string;
+    };
 }
 /** Compare the latest recorded digest for `component` between two environments' release records. */
 export declare function compareAcrossEnvironments(component: string, envA: {

package/dist/lifecycle/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/lifecycle/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE7E,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,+IAA+I;IAC/I,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,gDAAgD;IAChD,cAAc,EAAE,YAAY,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9E,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D;;;;;OAKG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CACjE;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,4GAA4G;IAC5G,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,4FAA4F;IAC5F,IAAI,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,8HAA8H;IAC9H,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C;oFACgF;IAChF,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChE;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,EACpD,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAC7C,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAsBpC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAEhE,4HAA4H;AAC5H,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,MAAM,EAAE,CAGvF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;CACpB;AAgDD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,SAAS,EACb,WAAW,CAAC,EAAE,eAAe,GAC5B,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAiDpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,aAAa,EAAE,EACxB,IAAI,CAAC,EAAE;IACL,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAClD,2DAA2D;IAC3D,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/C,+MAA+M;IAC/M,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACxD,6KAA6K;IAC7K,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,GACA,kBAAkB,EAAE,CA2EtB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,IAAI,EAAE,OAAO,CAAC;CACf;AAED,oGAAoG;AACpG,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,EAChD,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,GAC/C,kBAAkB,CAWpB"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/lifecycle/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE7E,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,+IAA+I;IAC/I,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,gDAAgD;IAChD,cAAc,EAAE,YAAY,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC9E,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D;;;;;OAKG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAC;IACpC;;;;;OAKG;IACH,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CACjE;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,4GAA4G;IAC5G,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,4FAA4F;IAC5F,IAAI,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,8HAA8H;IAC9H,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qCAAqC;IACrC,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C;oFACgF;IAChF,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChE;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,EACpD,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAC7C,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAsBpC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAEhE,4HAA4H;AAC5H,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,MAAM,EAAE,CAGvF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;CACpB;AAgDD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,SAAS,EACb,WAAW,CAAC,EAAE,eAAe,GAC5B,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAiDpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,aAAa,EAAE,EACxB,IAAI,CAAC,EAAE;IACL,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAClD,2DAA2D;IAC3D,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC/C,+MAA+M;IAC/M,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACxD,6KAA6K;IAC7K,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,GACA,kBAAkB,EAAE,CA2EtB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,+IAA+I;IAC/I,UAAU,CAAC,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC;AAED,oGAAoG;AACpG,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,EAChD,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,GAC/C,kBAAkB,CAepB"}

package/dist/op/discover.d.ts

@@ -8,7 +8,10 @@ export interface OpDiscoveryResult {
     errors: string[];
 }
 /**
- * Discover all Op definitions from *.op.ts files under the git root.
+ * Discover all Op definitions from `*.op.ts` files under the nearest chant
+ * project root (the directory holding `chant.config.ts`/`.json`, walking up
+ * from `cwd`), or under the git root when no config exists — see
+ * {@link findDiscoveryRoot} (#2058).
  */
 export declare function discoverOps(opts?: {
     cwd?: string;

package/dist/op/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/op/discover.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAiCD;;GAEG;AACH,wBAAsB,WAAW,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuCrF"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/op/discover.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AA0DD;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuCrF"}

package/dist/terraform/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/terraform/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,EAAE,WAAW,CAAC;IACtB,gCAAgC;IAChC,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;QAC3B;;;;;;WAMG;QACH,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CACb,MAAM,EACN;YACE,8EAA8E;YAC9E,MAAM,EAAE,MAAM,CAAC;YACf,mEAAmE;YACnE,QAAQ,EAAE,MAAM,CAAC;YACjB,kCAAkC;YAClC,KAAK,EAAE,MAAM,EAAE,CAAC;YAChB,2CAA2C;YAC3C,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;SACrC,CACF,CAAC;QACF,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,kCAAkC;IAClC,MAAM,CAAC,EAAE;QACP,6FAA6F;QAC7F,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,cAAc,EAAE,OAAO,CAAC;QACxB,2IAA2I;QAC3I,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,yEAAyE;QACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,iCAAiC;IACjC,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,eAAe,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,4IAA4I;QAC5I,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;CACH;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAmCD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,CAKlF;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAUpE;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAsBtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC,GAC5E,MAAM,GAAG,SAAS,CAOpB"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/terraform/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,EAAE,WAAW,CAAC;IACtB,gCAAgC;IAChC,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;QAC3B;;;;;;WAMG;QACH,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CACb,MAAM,EACN;YACE,8EAA8E;YAC9E,MAAM,EAAE,MAAM,CAAC;YACf,mEAAmE;YACnE,QAAQ,EAAE,MAAM,CAAC;YACjB,kCAAkC;YAClC,KAAK,EAAE,MAAM,EAAE,CAAC;YAChB,2CAA2C;YAC3C,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;SACrC,CACF,CAAC;QACF,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,kCAAkC;IAClC,MAAM,CAAC,EAAE;QACP,6FAA6F;QAC7F,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,cAAc,EAAE,OAAO,CAAC;QACxB,2IAA2I;QAC3I,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,yEAAyE;QACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,iCAAiC;IACjC,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,eAAe,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,4IAA4I;QAC5I,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;CACH;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAuCD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAM9E;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,CAKlF;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAUpE;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAsBtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC,GAC5E,MAAM,GAAG,SAAS,CAOpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.54.1",
+  "version": "0.54.3",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/audit/secrets.test.ts

@@ -300,4 +300,19 @@ describe("scanForSecrets — file handling", () => {
     expect(findings[0].severity).toBe("error");
     expect(findings[0].lexicon).toBe("secrets");
   });
+
+  test("dependency lockfiles are skipped entirely — integrity hashes are not secrets", () => {
+    // The exact false-positive class that failed the first dogfooding repo:
+    // one lockfile's sha512 integrity fields read as hundreds of SEC010s.
+    const integrity = `"integrity": "sha512-${"a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8s9T0u1V2w3X4y5Z6".repeat(2)}"`;
+    for (const path of ["package-lock.json", "web/package-lock.json", "yarn.lock", "pnpm-lock.yaml", "Cargo.lock", "go.sum"]) {
+      expect(scanForSecrets([{ path, content: `${integrity}\n` }]), path).toEqual([]);
+    }
+    // Even a real credential shape stays silent there — the file is skipped,
+    // not entropy-tuned; a credential does not live in a machine-written
+    // lockfile, and per-file skipping is what keeps the rule explainable.
+    expect(scanForSecrets([{ path: "package-lock.json", content: `${FAKE_AWS_KEY}\n` }])).toEqual([]);
+    // A non-lockfile with the same content still fires.
+    expect(scanForSecrets([{ path: "config.json", content: `${integrity}\n` }]).length).toBeGreaterThan(0);
+  });
 });

package/src/audit/secrets.ts

@@ -337,6 +337,38 @@ function lineNumberFor(starts: number[], index: number): number {
  * the filesystem and network. Findings never carry the matched value —
  * only its rule id, kind, file/line, and a redaction-safe fingerprint.
  */
+/**
+ * Machine-generated dependency lockfiles. Skipped entirely: they are wall-to-
+ * wall content-integrity hashes (`sha512-…` and friends), which the entropy
+ * heuristic reads as hundreds of "possible secrets" per file — a single
+ * `package-lock.json` produced 438 merge-worthy SEC010 findings on the first
+ * repo that dogfooded this at `--fail-on merge-worthy`. Integrity hashes are
+ * public by construction, a credential does not live in a lockfile, and no
+ * other scanner reads them.
+ */
+const LOCKFILE_NAMES = new Set([
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "bun.lock",
+  "deno.lock",
+  "Cargo.lock",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile.lock",
+  "composer.lock",
+  "Gemfile.lock",
+  "go.sum",
+  "flake.lock",
+]);
+
+/** Is this a dependency lockfile the secrets scan should skip? */
+export function isLockfilePath(path: string): boolean {
+  const name = path.split("/").pop() ?? path;
+  return LOCKFILE_NAMES.has(name);
+}
+
 export function scanForSecrets(files: ScannableFile[], opts: SecretsScanOptions = {}): AuditFinding[] {
   const entropyThreshold = opts.entropyThreshold ?? DEFAULT_ENTROPY_THRESHOLD;
   const entropyMinLength = opts.entropyMinLength ?? DEFAULT_ENTROPY_MIN_LENGTH;
@@ -347,6 +379,7 @@ export function scanForSecrets(files: ScannableFile[], opts: SecretsScanOptions
 
   for (const file of files) {
     if (!file.content) continue;
+    if (isLockfilePath(file.path)) continue;
     const lines = file.content.split("\n");
     const starts = lineStarts(file.content);
     const claimed: Array<[number, number]> = [];

package/src/cli/commands/carve-apply.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { mkdtempSync, writeFileSync, rmSync, readFileSync, existsSync } from "fs";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, readFileSync, existsSync } from "fs";
 import { tmpdir } from "os";
 import { join } from "path";
 import { carveApply, formatCarveApply } from "./carve-apply";
@@ -108,6 +108,36 @@ describe("carveApply", () => {
     });
   });
 
+  test("a RELATIVE --output still records stampedFiles relative to the manifest's directory, not the cwd (#2059)", async () => {
+    if (!parserAvailable) return;
+    await withEstate(async (dir) => {
+      // The behold carve-demo shape: run FROM the project dir with
+      // `--output carveout`. The bug: resolveManifestFilePath joined against
+      // the relative outDir, producing a cwd-relative path ("carveout/…")
+      // that normalize-on-write passed through — two spellings in one manifest.
+      const out = join(dir, "carveout");
+      const manifest = manifestFor("aws_s3_bucket.assets", dir);
+      manifest.emit = { source: "tfstate", files: [join("src", "assets.ts")], at: "t" };
+      writeCarveManifest(out, manifest);
+      mkdirSync(join(out, "src"), { recursive: true });
+      writeFileSync(join(out, "src", "assets.ts"), 'export const assets = new Bucket({\n  BucketName: "b",\n});\n');
+
+      const prevCwd = process.cwd();
+      process.chdir(dir);
+      try {
+        const res = await carveApply({ from: ".", output: "carveout", env: "prod", stack: "assets", writeSource: true });
+        expect(res.ok).toBe(true);
+        const m = readCarveManifest(res.manifestPath!)!;
+        // One spelling: manifest-dir-relative, same as emit.files — never
+        // "carveout/src/assets.ts" (relative to wherever the command ran).
+        expect(m.apply!.stampedFiles).toEqual([join("src", "assets.ts")]);
+        expect(m.emit!.files).toEqual([join("src", "assets.ts")]);
+      } finally {
+        process.chdir(prevCwd);
+      }
+    });
+  });
+
   test("--write-source without an emit record in the manifest is a clear error", async () => {
     if (!parserAvailable) return;
     await withEstate(async (dir) => {

package/src/lifecycle/status.test.ts

@@ -413,6 +413,44 @@ describe("status", () => {
       expect(result.digestB).toBe("sha256:abc");
       expect(result.same).toBe(false);
     });
+
+    test("pinned helm records compare on inputDigest — per-cluster bytes legitimately differ (ReleaseRecord.inputDigest's own contract)", () => {
+      // Same chart+values rendered against two clusters' capability profiles:
+      // contentDigests (recorded as `digest`) differ, inputDigests match —
+      // prod IS running what staging tested.
+      const result = compareAcrossEnvironments(
+        "web",
+        { name: "staging", records: [record({ component: "web", env: "staging", digest: "sha256:staging-bytes", inputDigest: "sha256:inputs" })] },
+        { name: "prod", records: [record({ component: "web", env: "prod", digest: "sha256:prod-bytes", inputDigest: "sha256:inputs" })] },
+      );
+      expect(result.same).toBe(true);
+      expect(result.comparedOn).toEqual({ a: "sha256:inputs", b: "sha256:inputs" });
+      // The exact bytes each cluster got stay visible.
+      expect(result.digestA).toBe("sha256:staging-bytes");
+      expect(result.digestB).toBe("sha256:prod-bytes");
+    });
+
+    test("differing inputDigests are a real difference, whatever the bytes say", () => {
+      const result = compareAcrossEnvironments(
+        "web",
+        { name: "staging", records: [record({ component: "web", env: "staging", digest: "sha256:same-bytes", inputDigest: "sha256:inputs-v2" })] },
+        { name: "prod", records: [record({ component: "web", env: "prod", digest: "sha256:same-bytes", inputDigest: "sha256:inputs-v1" })] },
+      );
+      expect(result.same).toBe(false);
+    });
+
+    test("one side input-identified, the other content-identified: compared honestly on what each carries", () => {
+      // Mixed deploys (a pinned helm release in prod, an unpinned one in
+      // staging where the record's digest IS the input digest): staging's
+      // digest against prod's inputDigest is the only meaningful join.
+      const result = compareAcrossEnvironments(
+        "web",
+        { name: "staging", records: [record({ component: "web", env: "staging", digest: "sha256:inputs" })] },
+        { name: "prod", records: [record({ component: "web", env: "prod", digest: "sha256:prod-bytes", inputDigest: "sha256:inputs" })] },
+      );
+      expect(result.same).toBe(true);
+      expect(result.comparedOn).toEqual({ a: "sha256:inputs", b: "sha256:inputs" });
+    });
   });
 
   describe("mergeLiveEvidence (#57 — per-component stack presence overlay)", () => {

package/src/lifecycle/status.ts

@@ -478,8 +478,19 @@ export interface CrossEnvComparison {
   envB: string;
   digestA?: string;
   digestB?: string;
-  /** True only when both envs have a recorded digest and they match. */
+  /**
+   * True only when both envs have a recorded digest and their *comparable*
+   * identities match. For a record carrying `inputDigest` (a pinned helm
+   * deploy, chant#1242/#1243), that field is the comparable identity —
+   * `ReleaseRecord.inputDigest`'s own contract: profiles are per cluster, two
+   * environments legitimately render to different bytes, so cross-environment
+   * "is prod running what staging tested" joins on the input side while
+   * `digest` proves the exact bytes each cluster got. Records without it
+   * compare on `digest` exactly as before.
+   */
   same: boolean;
+  /** The identities `same` was decided on (`inputDigest ?? digest` per side), when both sides had one and they differ from the digests shown. */
+  comparedOn?: { a: string; b: string };
 }
 
 /** Compare the latest recorded digest for `component` between two environments' release records. */
@@ -490,12 +501,16 @@ export function compareAcrossEnvironments(
 ): CrossEnvComparison {
   const latestA = latestPerComponent(envA.records).get(component);
   const latestB = latestPerComponent(envB.records).get(component);
+  const idA = latestA ? latestA.inputDigest ?? latestA.digest : undefined;
+  const idB = latestB ? latestB.inputDigest ?? latestB.digest : undefined;
+  const comparedOnInputs = (latestA?.inputDigest ?? latestB?.inputDigest) !== undefined;
   return {
     component,
     envA: envA.name,
     envB: envB.name,
     digestA: latestA?.digest,
     digestB: latestB?.digest,
-    same: !!latestA && !!latestB && latestA.digest === latestB.digest,
+    same: !!idA && !!idB && idA === idB,
+    ...(comparedOnInputs && idA && idB ? { comparedOn: { a: idA, b: idB } } : {}),
   };
 }

package/src/op/discover-root.test.ts

@@ -0,0 +1,68 @@
+import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, realpathSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { discoverOps } from "./discover";
+
+/**
+ * #2058 — Op discovery scoped to the project root, the way entity discovery
+ * is. The repro: a chant project nested in a larger checkout (behold's
+ * committed `example-carve/app` beside `example-writes`, `example-k8s`)
+ * discovered every sibling project's `*.op.ts` as its own, because the scan
+ * root was the git root unconditionally.
+ *
+ * The fake git root is a temp tree; the runtime mock answers `git rev-parse`
+ * with whatever the current test set (`realpath`ed, since macOS's tmpdir is a
+ * symlink and the walk compares resolved paths).
+ */
+let fakeGitRoot = "";
+vi.mock("../runtime-adapter", () => ({
+  getRuntime: () => ({
+    spawn: async (cmd: string[]) =>
+      cmd[0] === "git" && cmd[1] === "rev-parse"
+        ? { stdout: fakeGitRoot, stderr: "", exitCode: 0 }
+        : { stdout: "", stderr: "", exitCode: 0 },
+  }),
+}));
+
+/** A minimal default export shaped the way discovery validates (entity.props = OpConfig). */
+const OP_FILE = (name: string): string =>
+  `export default { props: { name: ${JSON.stringify(name)}, overview: "t", phases: [{ name: "Run", steps: [] }] } };\n`;
+
+describe("discoverOps — the scan root is the project, not the checkout (#2058)", () => {
+  let checkout: string;
+  beforeEach(() => {
+    checkout = realpathSync(mkdtempSync(join(tmpdir(), "chant-op-root-")));
+    fakeGitRoot = checkout;
+    // The monorepo shape from the issue: two sibling chant projects, each
+    // with its own config and ops, nested in one git checkout.
+    mkdirSync(join(checkout, "app", "ops"), { recursive: true });
+    writeFileSync(join(checkout, "app", "chant.config.json"), JSON.stringify({ lexicons: ["aws"] }));
+    writeFileSync(join(checkout, "app", "ops", "mine.op.ts"), OP_FILE("mine"));
+    mkdirSync(join(checkout, "sibling", "ops"), { recursive: true });
+    writeFileSync(join(checkout, "sibling", "chant.config.json"), JSON.stringify({ lexicons: ["aws"] }));
+    writeFileSync(join(checkout, "sibling", "ops", "theirs.op.ts"), OP_FILE("theirs"));
+    // A configless dir at the checkout root, with an op of its own.
+    mkdirSync(join(checkout, "ops"), { recursive: true });
+    writeFileSync(join(checkout, "ops", "root.op.ts"), OP_FILE("root"));
+  });
+  afterEach(() => rmSync(checkout, { recursive: true, force: true }));
+
+  test("from inside a project, only that project's Ops are discovered — never a sibling's", async () => {
+    const { ops, errors } = await discoverOps({ cwd: join(checkout, "app") });
+    expect(errors).toEqual([]);
+    expect([...ops.keys()]).toEqual(["mine"]);
+  });
+
+  test("the walk finds the config from a subdirectory of the project too (ops/ beside src/, #1675)", async () => {
+    const { ops } = await discoverOps({ cwd: join(checkout, "app", "ops") });
+    expect([...ops.keys()]).toEqual(["mine"]);
+  });
+
+  test("with no chant config anywhere up to the git root, the git root stands — #1675's original scope", async () => {
+    rmSync(join(checkout, "app", "chant.config.json"));
+    rmSync(join(checkout, "sibling", "chant.config.json"));
+    const { ops } = await discoverOps({ cwd: join(checkout, "app") });
+    expect([...ops.keys()].sort()).toEqual(["mine", "root", "theirs"]);
+  });
+});

package/src/op/discover.ts

@@ -1,6 +1,7 @@
 import { getRuntime } from "../runtime-adapter";
 import { readdir } from "node:fs/promises";
-import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 import type { OpConfig } from "./types";
 
 export interface DiscoveredOp {
@@ -20,6 +21,31 @@ async function findGitRoot(cwd?: string): Promise<string> {
   return result.stdout.trim();
 }
 
+/**
+ * The root the `*.op.ts` scan starts from (#2058): the nearest chant project
+ * root — the directory holding `chant.config.ts`/`chant.config.json`, walking
+ * up from `cwd` and never past the git root. #1675's convention keeps Op
+ * files OUTSIDE `sourceDir` (`ops/` beside `src/`), which is why discovery
+ * walks up at all — but "up" used to mean the git root unconditionally, so a
+ * chant project nested in a larger checkout (a monorepo, behold's committed
+ * examples) discovered every SIBLING project's Ops as its own. The config
+ * file is the project boundary, the same one entity discovery respects.
+ * With no config anywhere up to the git root, the git root stands —
+ * #1675's original scope, kept for configless layouts.
+ */
+async function findDiscoveryRoot(cwd?: string): Promise<string> {
+  const gitRoot = resolve(await findGitRoot(cwd));
+  let dir = resolve(cwd ?? process.cwd());
+  for (;;) {
+    if (existsSync(join(dir, "chant.config.ts")) || existsSync(join(dir, "chant.config.json"))) return dir;
+    if (dir === gitRoot) break;
+    const parent = dirname(dir);
+    if (parent === dir) break; // filesystem root — cwd was outside the git root
+    dir = parent;
+  }
+  return gitRoot;
+}
+
 async function collectOpFiles(dir: string): Promise<string[]> {
   const files: string[] = [];
   let entries;
@@ -45,14 +71,17 @@ async function collectOpFiles(dir: string): Promise<string[]> {
 }
 
 /**
- * Discover all Op definitions from *.op.ts files under the git root.
+ * Discover all Op definitions from `*.op.ts` files under the nearest chant
+ * project root (the directory holding `chant.config.ts`/`.json`, walking up
+ * from `cwd`), or under the git root when no config exists — see
+ * {@link findDiscoveryRoot} (#2058).
  */
 export async function discoverOps(opts?: { cwd?: string }): Promise<OpDiscoveryResult> {
   const errors: string[] = [];
   const ops = new Map<string, DiscoveredOp>();
 
-  const gitRoot = await findGitRoot(opts?.cwd);
-  const files = await collectOpFiles(gitRoot);
+  const root = await findDiscoveryRoot(opts?.cwd);
+  const files = await collectOpFiles(root);
 
   const nameToFile = new Map<string, string>();
 

package/src/terraform/manifest.ts

@@ -9,7 +9,7 @@
  */
 
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "fs";
-import { isAbsolute, join, relative } from "path";
+import { isAbsolute, join, relative, resolve } from "path";
 import type { CarveReport } from "./carve";
 import type { OwnershipMarker } from "../ownership";
 
@@ -100,10 +100,14 @@ export function carveManifestPath(outDir: string, target: string): string {
 /**
  * Relative-to-`outDir` spelling of a recorded file path. Absolute entries
  * (the run-time spelling every step naturally produces, and every version-1
- * manifest on disk) are rewritten; already-relative entries pass through.
+ * manifest on disk) are rewritten against the RESOLVED outDir — a caller's
+ * relative `--output` must not change what "relative to the manifest's
+ * directory" means (#2059). Already-relative entries pass through: they can
+ * only have come from a reader honouring the contract, and re-basing them
+ * against an unknowable original cwd would corrupt, not normalize.
  */
 function relativizePath(outDir: string, p: string): string {
-  return isAbsolute(p) ? relative(outDir, p) : p;
+  return isAbsolute(p) ? relative(resolve(outDir), p) : p;
 }
 
 /**
@@ -136,7 +140,11 @@ function normalizeManifest(outDir: string, manifest: CarveManifest): CarveManife
  * on-disk spellings read the same.
  */
 export function resolveManifestFilePath(manifestDir: string, p: string): string {
-  return isAbsolute(p) ? p : join(manifestDir, p);
+  // Always ABSOLUTE (#2059): `join` with a relative manifestDir produced a
+  // cwd-relative path, which `relativizePath` then passed through untouched —
+  // so `carve apply --output carveout` recorded `stampedFiles` relative to
+  // wherever the command happened to run, two spellings in one manifest.
+  return isAbsolute(p) ? p : resolve(manifestDir, p);
 }
 
 /** Write (or overwrite) a manifest into the output dir. Returns the path. */