@intentius/chant 0.124.13 → 0.124.14

package/src/cli/compiled-cli.e2e.test.ts

@@ -0,0 +1,165 @@
+/**
+ * The installed CLI runs compiled JS with plain node (#3878). This packs core
+ * (its prepack builds dist/) and the render lexicon the way a release does,
+ * installs both into a scratch project with npm, and runs the package's own
+ * `bin/chant`.
+ *
+ * Each run is traced through a load hook that NODE_OPTIONS hands to the CLI's
+ * node, so the test can say what loaded: none of chant's TypeScript source,
+ * ever, and tsx only for a command that imports TypeScript (here the
+ * lexicon and the project source).
+ *
+ * End to end because it packs, installs from the registry and spawns the CLI.
+ */
+
+import { execFileSync, spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+
+const coreRoot = resolve(import.meta.dirname, "..", "..");
+const renderRoot = resolve(coreRoot, "..", "..", "lexicons", "render");
+const version = (JSON.parse(readFileSync(join(coreRoot, "package.json"), "utf-8")) as { version: string }).version;
+
+let scratch: string;
+let project: string;
+let waves: string;
+let chant: string;
+let tracer: string;
+
+const TRACER = `
+import { registerHooks } from "node:module";
+import { appendFileSync } from "node:fs";
+const out = process.env.CHANT_TRACE_OUT;
+const seen = { chantSrc: 0, chantDist: 0, tsx: 0 };
+registerHooks({
+  load(url, context, next) {
+    if (url.includes("/@intentius/chant/src/")) seen.chantSrc++;
+    else if (url.includes("/@intentius/chant/dist/")) seen.chantDist++;
+    else if (url.includes("/node_modules/tsx/")) seen.tsx++;
+    return next(url, context);
+  },
+});
+process.on("exit", () => { if (out) appendFileSync(out, JSON.stringify(seen) + "\\n"); });
+`;
+
+function pack(dir: string, ignoreScripts = false): string {
+  const args = ["pack", "--json", "--pack-destination", scratch, ...(ignoreScripts ? ["--ignore-scripts"] : [])];
+  const packed = JSON.parse(execFileSync("npm", args, { cwd: dir, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] })) as { filename: string }[];
+  return join(scratch, packed[0].filename);
+}
+
+interface Run {
+  status: number | null;
+  stdout: string;
+  stderr: string;
+  loaded: { chantSrc: number; chantDist: number; tsx: number };
+}
+
+function run(cwd: string, args: string[]): Run {
+  const traceOut = join(scratch, `trace-${Math.random().toString(36).slice(2)}.jsonl`);
+  const env: NodeJS.ProcessEnv = { ...process.env, NODE_OPTIONS: `--import ${tracer}`, CHANT_TRACE_OUT: traceOut };
+  delete env.CHANT_ENV;
+  const result = spawnSync(chant, args, { cwd, env, encoding: "utf-8" });
+  const lines = readFileSync(traceOut, "utf-8").trim().split("\n");
+  return { status: result.status, stdout: result.stdout, stderr: result.stderr, loaded: JSON.parse(lines[0]!) as Run["loaded"] };
+}
+
+beforeAll(() => {
+  scratch = mkdtempSync(join(tmpdir(), "chant-compiled-cli-"));
+  tracer = join(scratch, "trace.mjs");
+  writeFileSync(tracer, TRACER);
+  const core = pack(coreRoot);
+  // The lexicon's prepack regenerates it from upstream specs; the checkout's
+  // generated source and dist are what this test needs, so pack them as they are.
+  const render = pack(renderRoot, true);
+
+  project = join(scratch, "project");
+  mkdirSync(join(project, "src"), { recursive: true });
+  writeFileSync(join(project, "package.json"), JSON.stringify({ name: "compiled-cli-e2e", private: true, type: "module" }));
+  execFileSync("npm", ["install", "--no-audit", "--no-fund", "--prefer-offline", core, render], { cwd: project, stdio: "ignore" });
+  writeFileSync(join(project, "chant.config.ts"), `import type { ChantConfig } from "@intentius/chant";\nexport default { lexicons: ["render"] } satisfies ChantConfig;\n`);
+  writeFileSync(
+    join(project, "src", "infra.ts"),
+    `import { Postgres, Render } from "@intentius/chant-lexicon-render";\n` +
+      `export const db = new Postgres({ name: "e2e-db", plan: "free", version: "16", region: Render.Region });\n`,
+  );
+  chant = join(project, "node_modules", ".bin", "chant");
+
+  // A waves spec whose plan writes a fixed digest and whose apply does nothing,
+  // in a repository with the history `run wave` reads its gate policy from.
+  waves = join(scratch, "waves");
+  mkdirSync(waves);
+  writeFileSync(join(waves, "plan.mjs"), `import { writeFileSync } from "node:fs";\nwriteFileSync(process.argv[3], JSON.stringify({ planDigest: "sha256:" + "a".repeat(64) }));\n`);
+  writeFileSync(
+    join(waves, "waves.json"),
+    JSON.stringify({
+      name: "smoke",
+      op: "smoke",
+      plan: ["node", "plan.mjs", "{target}", "{plan}"],
+      apply: ["node", "-e", "0", "{target}", "{plan}"],
+      waves: [{ name: "dev", runs: [{ target: "dev" }], gate: "never" }],
+    }),
+  );
+  const git = (...args: string[]) => execFileSync("git", ["-c", "user.email=e2e@chant", "-c", "user.name=e2e", ...args], { cwd: waves, stdio: "ignore" });
+  git("init", "-q", "-b", "main");
+  git("add", "-A");
+  git("commit", "-qm", "spec");
+  writeFileSync(join(waves, ".gitignore"), ".chant/\n");
+  git("add", "-A");
+  git("commit", "-qm", "ignore");
+}, 600_000);
+
+afterAll(() => {
+  if (scratch) rmSync(scratch, { recursive: true, force: true });
+});
+
+describe("the installed chant CLI (#3878)", () => {
+  test("--version runs compiled JS and loads no TypeScript loader", () => {
+    const r = run(project, ["--version"]);
+    expect(r.status, r.stderr).toBe(0);
+    expect(r.stdout.trim()).toBe(version);
+    expect(r.loaded.chantDist).toBeGreaterThan(0);
+    expect(r.loaded).toMatchObject({ chantSrc: 0, tsx: 0 });
+  });
+
+  test("run wave plans and applies a wave without loading tsx", () => {
+    const r = run(waves, ["run", "wave", "--spec", "waves.json", "--wave", "1", "--json"]);
+    expect(r.status, r.stderr).toBe(0);
+    expect(JSON.parse(r.stdout)).toMatchObject({ exitCode: 0 });
+    expect(r.loaded).toMatchObject({ chantSrc: 0, tsx: 0 });
+  });
+
+  test("build loads the TypeScript lexicon and project through tsx, against the one compiled core", () => {
+    const r = run(project, ["build", "src", "-o", "out/render.json"]);
+    expect(r.status, r.stderr).toBe(0);
+    const built = JSON.parse(readFileSync(join(project, "out", "render.json"), "utf-8")) as Record<string, { body?: { name?: string } }>;
+    expect(built.db?.body?.name).toBe("e2e-db");
+    expect(r.loaded.tsx).toBeGreaterThan(0);
+    expect(r.loaded.chantSrc).toBe(0);
+  });
+
+  test("lint passes on the project", () => {
+    const r = run(project, ["lint", "src"]);
+    expect(r.status, r.stdout + r.stderr).toBe(0);
+    expect(r.loaded.chantSrc).toBe(0);
+  });
+
+  test("build --sandbox bundles chant's source for the sandboxed child", () => {
+    writeFileSync(
+      join(project, "src", "made.ts"),
+      `import { Postgres, Render } from "@intentius/chant-lexicon-render";\n` +
+        `function make(name: string) { const n = [1, 2].map((i) => i * 2).length; return new Postgres({ name: name + n, plan: "free", version: "16", region: Render.Region }); }\n` +
+        `export const made = make("made");\n`,
+    );
+    try {
+      const r = run(project, ["build", "src", "--sandbox", "-o", "out/sandbox.json"]);
+      expect(r.status, r.stderr).toBe(0);
+      const built = JSON.parse(readFileSync(join(project, "out", "sandbox.json"), "utf-8")) as Record<string, { body?: { name?: string } }>;
+      expect(built.made?.body?.name).toBe("made2");
+    } finally {
+      rmSync(join(project, "src", "made.ts"));
+    }
+  });
+});

package/src/cli/main.ts

@@ -3,7 +3,6 @@
 import { resolve } from "node:path";
 import { isEntryPoint } from "./is-entry-point";
 import { formatSuccess, formatError } from "./format";
-import { loadPlugins, resolveProjectLexicons } from "./plugins";
 import { resolveCommand, type CommandDef, type ParsedArgs } from "./registry";
 import { loadChantConfigUpward } from "../config";
 import { findProjectRoot, findWorkspaceRoot } from "../project-root";
@@ -14,34 +13,118 @@ import { armSandboxConfigEvaluation } from "../config-sandbox";
 import { armSandboxPolicyExecution } from "../lint/policy-import";
 import { ENV_VAR, unknownEnvError } from "../env";
 import { initRuntime } from "../runtime-adapter";
-import { runBuild } from "./handlers/build";
-import { runLint } from "./handlers/lint";
-import { runDevGenerate, runDevPublish, runDevOnboard, runDevCheckLexicon, runDevSurfaceDiff, runDevPinnedUpgrade, runDevRollingUpgrade, runDevUnknown } from "./handlers/dev";
-import { runServeLsp, runServeMcp, runServeUnknown } from "./handlers/serve";
-import { runInit, runInitLexicon } from "./handlers/init";
-import { runList, runDescribe, runImport, runAudit, runUpdate, runDoctor } from "./handlers/misc";
-import { runVendor } from "./handlers/vendor";
-import { runMigrate } from "./handlers/migrate";
-import { runCarveAdvise, runCarveUnknown } from "./handlers/carve";
-import { runCarveEmit } from "./handlers/carve-emit";
-import { runCarveBridge } from "./handlers/carve-bridge";
-import { runCarveApply } from "./handlers/carve-apply";
-import { runCarveStatus } from "./handlers/carve-status";
-import { runLifecycleSnapshot, runLifecycleShow, runLifecycleDiff, runLifecycleRollback, runLifecyclePlan, runLifecycleAffected, runLifecycleLog, runLifecycleTeardown, runLifecycleWhoami, runLifecycleUnknown } from "./handlers/lifecycle";
-import { runComponentsStatus, runComponentsReleaseRecord, runComponentsExport, runComponentsUnknown } from "./handlers/components";
-import { runComponentsFanOut } from "./handlers/fan-out";
-import { runComponentsPromote, runComponentsRollback, runComponentsRedeploy } from "./handlers/promote";
-import { runScenarioCheck, runScenarioUnknown } from "./handlers/scenario";
-import { runGraph } from "./handlers/graph";
-import { runExplain } from "./handlers/explain";
-import { runSearch } from "./handlers/search";
-import { runOp, runOpList, runOpStatus, runOpApprove, runOpSignalRenamed, runOpCancel, runOpLog } from "./handlers/run";
-import { runOpWaveCommand } from "./handlers/run-wave";
-import { runOperator, runOperatorStatus, runOperatorLog, runApprove } from "./handlers/operator";
-import { runEmulator, formatEmulatorHelp } from "./handlers/emulator";
+import { installCompiledCli } from "../ts-loader";
 import { splitJoinedFlags, dispatchCommandGroup, collectCommandGroups, formatCommandGroupsHelp, type CommandGroup } from "./command-group";
 import type { LexiconPlugin } from "../lexicon";
 
+/**
+ * #3878 — each command's handler module loads when that command runs, not on
+ * every start: together they pull in most of chant (the TypeScript compiler
+ * among it), and `chant --version` or `chant run wave` need almost none of it.
+ */
+type Handler = CommandDef["handler"];
+const handlerModules = new Map<Handler, () => Promise<unknown>>();
+function lazyHandler<M>(load: () => Promise<M>, pick: (module: M) => Handler): Handler {
+  const handler: Handler = async (ctx) => pick(await load())(ctx);
+  handlerModules.set(handler, load);
+  return handler;
+}
+const buildHandlers = () => import("./handlers/build");
+const runBuild = lazyHandler(buildHandlers, (m) => m.runBuild);
+const lintHandlers = () => import("./handlers/lint");
+const runLint = lazyHandler(lintHandlers, (m) => m.runLint);
+const devHandlers = () => import("./handlers/dev");
+const runDevGenerate = lazyHandler(devHandlers, (m) => m.runDevGenerate);
+const runDevPublish = lazyHandler(devHandlers, (m) => m.runDevPublish);
+const runDevOnboard = lazyHandler(devHandlers, (m) => m.runDevOnboard);
+const runDevCheckLexicon = lazyHandler(devHandlers, (m) => m.runDevCheckLexicon);
+const runDevSurfaceDiff = lazyHandler(devHandlers, (m) => m.runDevSurfaceDiff);
+const runDevPinnedUpgrade = lazyHandler(devHandlers, (m) => m.runDevPinnedUpgrade);
+const runDevRollingUpgrade = lazyHandler(devHandlers, (m) => m.runDevRollingUpgrade);
+const runDevUnknown = lazyHandler(devHandlers, (m) => m.runDevUnknown);
+const serveHandlers = () => import("./handlers/serve");
+const runServeLsp = lazyHandler(serveHandlers, (m) => m.runServeLsp);
+const runServeMcp = lazyHandler(serveHandlers, (m) => m.runServeMcp);
+const runServeUnknown = lazyHandler(serveHandlers, (m) => m.runServeUnknown);
+const initHandlers = () => import("./handlers/init");
+const runInit = lazyHandler(initHandlers, (m) => m.runInit);
+const runInitLexicon = lazyHandler(initHandlers, (m) => m.runInitLexicon);
+const miscHandlers = () => import("./handlers/misc");
+const runList = lazyHandler(miscHandlers, (m) => m.runList);
+const runDescribe = lazyHandler(miscHandlers, (m) => m.runDescribe);
+const runImport = lazyHandler(miscHandlers, (m) => m.runImport);
+const runAudit = lazyHandler(miscHandlers, (m) => m.runAudit);
+const runUpdate = lazyHandler(miscHandlers, (m) => m.runUpdate);
+const runDoctor = lazyHandler(miscHandlers, (m) => m.runDoctor);
+const vendorHandlers = () => import("./handlers/vendor");
+const runVendor = lazyHandler(vendorHandlers, (m) => m.runVendor);
+const migrateHandlers = () => import("./handlers/migrate");
+const runMigrate = lazyHandler(migrateHandlers, (m) => m.runMigrate);
+const carveHandlers = () => import("./handlers/carve");
+const runCarveAdvise = lazyHandler(carveHandlers, (m) => m.runCarveAdvise);
+const runCarveUnknown = lazyHandler(carveHandlers, (m) => m.runCarveUnknown);
+const carveEmitHandlers = () => import("./handlers/carve-emit");
+const runCarveEmit = lazyHandler(carveEmitHandlers, (m) => m.runCarveEmit);
+const carveBridgeHandlers = () => import("./handlers/carve-bridge");
+const runCarveBridge = lazyHandler(carveBridgeHandlers, (m) => m.runCarveBridge);
+const carveApplyHandlers = () => import("./handlers/carve-apply");
+const runCarveApply = lazyHandler(carveApplyHandlers, (m) => m.runCarveApply);
+const carveStatusHandlers = () => import("./handlers/carve-status");
+const runCarveStatus = lazyHandler(carveStatusHandlers, (m) => m.runCarveStatus);
+const lifecycleHandlers = () => import("./handlers/lifecycle");
+const runLifecycleSnapshot = lazyHandler(lifecycleHandlers, (m) => m.runLifecycleSnapshot);
+const runLifecycleShow = lazyHandler(lifecycleHandlers, (m) => m.runLifecycleShow);
+const runLifecycleDiff = lazyHandler(lifecycleHandlers, (m) => m.runLifecycleDiff);
+const runLifecycleRollback = lazyHandler(lifecycleHandlers, (m) => m.runLifecycleRollback);
+const runLifecyclePlan = lazyHandler(lifecycleHandlers, (m) => m.runLifecyclePlan);
+const runLifecycleAffected = lazyHandler(lifecycleHandlers, (m) => m.runLifecycleAffected);
+const runLifecycleLog = lazyHandler(lifecycleHandlers, (m) => m.runLifecycleLog);
+const runLifecycleTeardown = lazyHandler(lifecycleHandlers, (m) => m.runLifecycleTeardown);
+const runLifecycleWhoami = lazyHandler(lifecycleHandlers, (m) => m.runLifecycleWhoami);
+const runLifecycleUnknown = lazyHandler(lifecycleHandlers, (m) => m.runLifecycleUnknown);
+const componentsHandlers = () => import("./handlers/components");
+const runComponentsStatus = lazyHandler(componentsHandlers, (m) => m.runComponentsStatus);
+const runComponentsReleaseRecord = lazyHandler(componentsHandlers, (m) => m.runComponentsReleaseRecord);
+const runComponentsExport = lazyHandler(componentsHandlers, (m) => m.runComponentsExport);
+const runComponentsUnknown = lazyHandler(componentsHandlers, (m) => m.runComponentsUnknown);
+const fanOutHandlers = () => import("./handlers/fan-out");
+const runComponentsFanOut = lazyHandler(fanOutHandlers, (m) => m.runComponentsFanOut);
+const promoteHandlers = () => import("./handlers/promote");
+const runComponentsPromote = lazyHandler(promoteHandlers, (m) => m.runComponentsPromote);
+const runComponentsRollback = lazyHandler(promoteHandlers, (m) => m.runComponentsRollback);
+const runComponentsRedeploy = lazyHandler(promoteHandlers, (m) => m.runComponentsRedeploy);
+const scenarioHandlers = () => import("./handlers/scenario");
+const runScenarioCheck = lazyHandler(scenarioHandlers, (m) => m.runScenarioCheck);
+const runScenarioUnknown = lazyHandler(scenarioHandlers, (m) => m.runScenarioUnknown);
+const graphHandlers = () => import("./handlers/graph");
+const runGraph = lazyHandler(graphHandlers, (m) => m.runGraph);
+const explainHandlers = () => import("./handlers/explain");
+const runExplain = lazyHandler(explainHandlers, (m) => m.runExplain);
+const searchHandlers = () => import("./handlers/search");
+const runSearch = lazyHandler(searchHandlers, (m) => m.runSearch);
+const runHandlers = () => import("./handlers/run");
+const runOp = lazyHandler(runHandlers, (m) => m.runOp);
+const runOpList = lazyHandler(runHandlers, (m) => m.runOpList);
+const runOpStatus = lazyHandler(runHandlers, (m) => m.runOpStatus);
+const runOpApprove = lazyHandler(runHandlers, (m) => m.runOpApprove);
+const runOpSignalRenamed = lazyHandler(runHandlers, (m) => m.runOpSignalRenamed);
+const runOpCancel = lazyHandler(runHandlers, (m) => m.runOpCancel);
+const runOpLog = lazyHandler(runHandlers, (m) => m.runOpLog);
+const runWaveHandlers = () => import("./handlers/run-wave");
+const runOpWaveCommand = lazyHandler(runWaveHandlers, (m) => m.runOpWaveCommand);
+const operatorHandlers = () => import("./handlers/operator");
+const runOperator = lazyHandler(operatorHandlers, (m) => m.runOperator);
+const runOperatorStatus = lazyHandler(operatorHandlers, (m) => m.runOperatorStatus);
+const runOperatorLog = lazyHandler(operatorHandlers, (m) => m.runOperatorLog);
+const runApprove = lazyHandler(operatorHandlers, (m) => m.runApprove);
+const emulatorHandlers = () => import("./handlers/emulator");
+const runEmulator = lazyHandler(emulatorHandlers, (m) => m.runEmulator);
+
+/** The lexicon plugin loader, which imports the lint, fold and build machinery: loaded when a command needs plugins (#3878). */
+const loadPlugins: typeof import("./plugins").loadPlugins = async (...a) => (await import("./plugins")).loadPlugins(...a);
+const resolveProjectLexicons: typeof import("./plugins").resolveProjectLexicons = async (...a) =>
+  (await import("./plugins")).resolveProjectLexicons(...a);
+
 /**
  * Long-form flags that are pure booleans in {@link parseArgs} — their branch
  * below sets a field to `true` and never consumes a following array element.
@@ -2002,6 +2085,9 @@ export const commandRegistry: CommandDef[] = [
  * Main entry point
  */
 async function main(): Promise<void> {
+  // #3878 — run from dist/ with plain node, TypeScript loads only when
+  // something imports it. A no-op from source.
+  installCompiledCli();
   const rawArgv = process.argv.slice(2);
 
   let args: ParsedArgs;
@@ -2035,7 +2121,7 @@ async function main(): Promise<void> {
   // ports and sign-in each configured lexicon's emulator uses, not the
   // global command list it used to print.
   if (args.help && args.command === "emulator") {
-    console.log(formatEmulatorHelp(await loadPluginsBestEffort().catch(() => [])));
+    console.log((await emulatorHandlers()).formatEmulatorHelp(await loadPluginsBestEffort().catch(() => [])));
     await flushAndExit(0);
     return;
   }
@@ -2080,6 +2166,14 @@ async function main(): Promise<void> {
   // command gets no `--env` check against the declared environments either.
   const earlyMatch = resolveCommand(args, commandRegistry);
   const runsNoConfig = earlyMatch != null && commandRunsNoConfig(earlyMatch.def, args);
+  // #3878 — load the command's own modules (and the plugin loader, when it
+  // needs plugins) before anything imports TypeScript: once a chant.config.ts
+  // has registered tsx, every module after it is resolved and loaded through
+  // tsx's hooks, which costs far more than plain node.
+  await Promise.all([
+    earlyMatch ? handlerModules.get(earlyMatch.def.handler)?.() : undefined,
+    earlyMatch?.def.requiresPlugins ? import("./plugins") : undefined,
+  ]);
   const projectPath0 = resolve(args.path === "." ? "." : args.path);
   let loadedConfig;
   try {

package/src/cli/mcp/workspace-tools.ts

@@ -51,7 +51,7 @@ const AGENT_ENV = "CHANT_AGENT";
 export type ChantCommand = string[];
 
 /**
- * The chant this process runs as: node with the same flags (the tsx loader
+ * The chant this process runs as: node with the same flags (from source, the tsx loader
  * `bin/chant` registers) and the same entry script.
  */
 export function ownChantCommand(): ChantCommand {

package/src/codegen/pinned-upgrade.ts

@@ -29,6 +29,7 @@ import { regenLexicon, type RegenResult } from "./lexicon-regen";
 import { fetchWithRetry } from "./fetch";
 import { isLexiconPlugin, type UpstreamPin } from "../lexicon";
 import { importLexiconPackage } from "../lexicon-module";
+import { ensureTypeScriptLoader } from "../ts-loader";
 
 // ── Public types ──────────────────────────────────────────────────────
 
@@ -251,6 +252,7 @@ export async function loadUpstreamPins(lexicon: LexiconId, lexiconDir?: string):
   const entry = lexiconDir ? lexiconEntry(lexiconDir) : null;
   if (entry) {
     try {
+      ensureTypeScriptLoader();
       const pins = pinsOf((await import(pathToFileURL(entry).href)) as Record<string, unknown>);
       if (pins.length > 0) return pins;
     } catch {

package/src/components/discover.ts

@@ -50,6 +50,7 @@ import { setBuildParams } from "../params";
 import { hasDiscoveryMarkerSync } from "../discovery/files";
 import { resolveDiscoveryGlobs } from "../config";
 import { walkDiscovery, workspaceMemberDirs } from "../discovery/walk";
+import { ensureTypeScriptLoader } from "../ts-loader";
 
 /** One discovered component, paired with the file it was exported from. */
 export interface DiscoveredComponent {
@@ -212,6 +213,7 @@ async function importAndCollectComponents(
       // `filePath` (e.g. from `chant build --components --generate`, which passes
       // a bare "." path) would otherwise be treated by `import()` as a bare
       // package specifier and fail with "Cannot find package 'x.component.ts'".
+      ensureTypeScriptLoader();
       const exports = await import(pathToFileURL(resolve(filePath)).href);
       modules.push({ file: filePath, exports });
     } catch (err) {

package/src/components/sandbox/driver.ts

@@ -1,6 +1,7 @@
 import { join, resolve } from "node:path";
 import { params as currentBuildParams } from "../../params";
 import { sendFunctionSource } from "../../discovery/sandbox/driver";
+import { chantSourceDir } from "../../ts-loader";
 
 /**
  * chant #1051 — generates the source of the "driver" module that runs INSIDE
@@ -25,7 +26,8 @@ import { sendFunctionSource } from "../../discovery/sandbox/driver";
  * for the full identity-correctness argument).
  */
 
-const HERE = import.meta.dirname;
+// #3878: the TypeScript source, also when this module runs compiled from dist/.
+const HERE = chantSourceDir(import.meta.url);
 const COMPONENTS_DIR = join(HERE, "..");
 
 /** Absolute paths to chant's OWN trusted modules the generated driver imports — resolved relative to THIS file's own location on disk, exactly like `../../discovery/sandbox/driver.ts` does for the entity path (works whether chant runs from the monorepo or a consumer's `node_modules`). */

package/src/config-import.ts

@@ -1,5 +1,6 @@
 import { createRequire } from "node:module";
 import { join } from "node:path";
+import { ensureTypeScriptLoader } from "./ts-loader";
 
 /**
  * The single place chant evaluates a project's `chant.config.ts` **in the CLI's
@@ -29,6 +30,7 @@ export type ConfigModuleNamespace = Record<string, unknown>;
  * evaluate the file once — the behavior `loadChantConfig` has always had.
  */
 export async function importConfigModule(configPath: string): Promise<ConfigModuleNamespace> {
+  ensureTypeScriptLoader();
   return (await import(configPath)) as ConfigModuleNamespace;
 }
 
@@ -39,5 +41,6 @@ export async function importConfigModule(configPath: string): Promise<ConfigModu
  */
 export function requireConfigModule(configPath: string, dir: string): ConfigModuleNamespace {
   const req = createRequire(join(dir, "package.json"));
+  ensureTypeScriptLoader();
   return req(configPath) as ConfigModuleNamespace;
 }

package/src/discovery/fold-import.ts

@@ -3620,8 +3620,7 @@ function isChantOwnedHelperBinding(binding: ImportBinding, ctx: ResolveCtx): boo
   } catch {
     return false;
   }
-  const root = chantCoreRoot();
-  return targetPath === root || targetPath.startsWith(root + sep);
+  return isChantCorePath(targetPath);
 }
 
 /**
@@ -3643,7 +3642,7 @@ function isChantOwnedHelperBinding(binding: ImportBinding, ctx: ResolveCtx): boo
  *     modules by subpath instead of through the barrel names code the process
  *     already trusts, not code the project controls.
  *  2. **chant-core's own executing tree** — the specifier is RESOLVED and the
- *     resulting path checked against {@link chantCoreRoot}. A text match is
+ *     resulting path checked against {@link chantCoreRoots}. A text match is
  *     not enough here: `@intentius/chant` and `@intentius/chant-lexicon-evil`
  *     are both strings an untrusted repo can write into its own source and
  *     back with its own `node_modules` directory, and
@@ -3700,8 +3699,7 @@ function isTrustedExecutableBinding(binding: ImportBinding, ctx: ResolveCtx): bo
   // chant#2590 — the subpath case of the same arm: another file of a
   // multi-file path lexicon, under its trusted directory.
   if (inPathLexiconRoot(targetPath, ctx.lexiconRoots)) return true;
-  const root = chantCoreRoot();
-  return targetPath === root || targetPath.startsWith(root + sep);
+  return isChantCorePath(targetPath);
 }
 
 /**
@@ -3737,17 +3735,29 @@ function sandboxedExecutionRefusal(
 }
 
 /**
- * chant-core's own module root — `packages/core/src` in this repo,
- * `<pkg>/dist` in a published install — derived from THIS module's location.
+ * chant-core's own module roots, derived from THIS module's location:
+ * `packages/core/src` in this repo, and in a published install both
+ * `<pkg>/src` (where `@intentius/chant/*` specifiers resolve, through the
+ * package exports) and `<pkg>/dist` (where the compiled CLI runs from, #3878).
  * Pure string arithmetic on `import.meta.url`, no filesystem access at all, so
  * it is safe in the #1045 sandbox child (which locks reads to an allowlist);
  * lazy and memoized purely to avoid doing it per call.
  */
-let chantCoreRootMemo: string | undefined;
-function chantCoreRoot(): string {
-  // .../<root>/discovery/fold-import.ts -> .../<root>
-  chantCoreRootMemo ??= dirname(dirname(fileURLToPath(import.meta.url)));
-  return chantCoreRootMemo;
+let chantCoreRootsMemo: readonly string[] | undefined;
+function chantCoreRoots(): readonly string[] {
+  if (!chantCoreRootsMemo) {
+    // .../<root>/discovery/fold-import.{ts,js} -> .../<root>
+    const root = dirname(dirname(fileURLToPath(import.meta.url)));
+    const name = basename(root);
+    const sibling = name === "dist" ? join(dirname(root), "src") : name === "src" ? join(dirname(root), "dist") : undefined;
+    chantCoreRootsMemo = sibling ? [root, sibling] : [root];
+  }
+  return chantCoreRootsMemo;
+}
+
+/** Whether `path` is one of chant-core's own modules (see {@link chantCoreRoots}). */
+function isChantCorePath(path: string): boolean {
+  return chantCoreRoots().some((root) => path === root || path.startsWith(root + sep));
 }
 
 /** Revive every value in a folded props/attributes object (see {@link reviveFoldedValue}). */
@@ -4467,8 +4477,7 @@ async function tryFoldFileCore(file: string, session: FoldSession): Promise<Fold
   // exclusion has to be explicit, or a fixture/in-repo import by path would
   // walk fold into chant's own tree and fold `params` to an empty object.
   {
-    const root = chantCoreRoot();
-    if (file === root || file.startsWith(root + sep)) {
+    if (isChantCorePath(file)) {
       return { ok: false, reason: "chant's own module is not project source" };
     }
   }

package/src/discovery/import.ts

@@ -1,4 +1,5 @@
 import { DiscoveryError } from "../errors";
+import { ensureTypeScriptLoader } from "../ts-loader";
 
 /**
  * Modules whose evaluation threw, and the error each threw with (#2368).
@@ -57,6 +58,7 @@ export async function importModule(
   if (failed) throw failed;
 
   try {
+    ensureTypeScriptLoader();
     return await import(path);
   } catch (error) {
     const message =

package/src/discovery/sandbox/driver.ts

@@ -1,5 +1,6 @@
 import { dirname, join } from "node:path";
 import { params as currentBuildParams } from "../../params";
+import { chantSourceDir } from "../../ts-loader";
 
 /**
  * chant #1045 Phase 2 — generates the source of the "driver" module that runs
@@ -30,7 +31,8 @@ import { params as currentBuildParams } from "../../params";
  * boundary at all.
  */
 
-const HERE = import.meta.dirname;
+// #3878: the TypeScript source, also when this module runs compiled from dist/.
+const HERE = chantSourceDir(import.meta.url);
 const DISCOVERY_DIR = join(HERE, "..");
 
 /** Absolute paths to chant's OWN trusted modules the generated driver imports — always resolved relative to THIS file's own location on disk, so this works whether chant is running from the monorepo or from a consumer's `node_modules` (both route runtime resolution at `src/*.ts` — see `packages/core/package.json`'s `development`/`default` export conditions). */

package/src/lexicon-module.ts

@@ -27,6 +27,7 @@
 import { createRequire } from "node:module";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
+import { ensureTypeScriptLoader } from "./ts-loader";
 
 /**
  * One `lexicons` entry: a package-backed name, or a name plus the module that
@@ -179,6 +180,7 @@ export async function importLexiconModule(name: string): Promise<Record<string,
   const path = modulePaths.get(name);
   if (path === undefined) return undefined;
   try {
+    ensureTypeScriptLoader();
     return (await import(path)) as Record<string, unknown>;
   } catch (err) {
     throw new Error(
@@ -259,6 +261,7 @@ export function resolveFromProject(spec: string, fromDir: string = process.cwd()
  */
 export async function importLexiconPackage(spec: string, fromDir: string = process.cwd()): Promise<Record<string, unknown>> {
   try {
+    ensureTypeScriptLoader();
     return (await import(spec)) as Record<string, unknown>;
   } catch (err) {
     const pkg = packageNameOf(spec);

package/src/lint/config.ts

@@ -6,7 +6,7 @@ import type { Severity, RuleConfig } from "./rule";
 import type { PostSynthDiagnostic } from "./post-synth";
 import { moduleDir, getRuntime } from "../runtime-adapter";
 import { canonicalRuleId, type RuleMeta } from "../audit/catalog";
-import strictPreset from "./presets/strict.json";
+import strictPreset from "./presets/strict.json" with { type: "json" };
 
 // chant #1117 — the upward config-discovery walk moved to a shared module
 // (`../project-root`) so `chant build`/`lint.policies` use the identical walk

package/src/lint/discover.ts

@@ -10,17 +10,35 @@ import { join } from "path";
 import { createRequire } from "module";
 import type { LintRule } from "./rule";
 import type { PostSynthCheck } from "./post-synth";
+import { ensureTypeScriptLoader } from "../ts-loader";
 
-// Register tsx so createRequire can load TypeScript files in Node.js ESM context.
-// This is a no-op if tsx is not available or already registered.
-try {
-  const _req = createRequire(import.meta.url);
-  const { register } = _req("tsx/cjs/api") as { register: () => void };
-  register();
-} catch {
-  // tsx not available; only pre-compiled .js files can be require()'d
+let cjsTypeScript = false;
+
+/**
+ * Register tsx so createRequire can load TypeScript files in Node.js ESM
+ * context. Does nothing when tsx is not available; then only pre-compiled .js
+ * files can be require()'d.
+ *
+ * From source this runs when the module loads, as it always has: vitest and
+ * the source CLI rely on tsx's CommonJS hook being in place from then on. The
+ * compiled CLI imports this module on every start and most commands read no
+ * rule directory, so there it waits for the first one (#3878).
+ */
+function registerTypeScriptRequire(): void {
+  if (cjsTypeScript) return;
+  cjsTypeScript = true;
+  if (ensureTypeScriptLoader()) return;
+  try {
+    const _req = createRequire(import.meta.url);
+    const { register } = _req("tsx/cjs/api") as { register: () => void };
+    register();
+  } catch {
+    // tsx not available; only pre-compiled .js files can be require()'d
+  }
 }
 
+if (!import.meta.url.endsWith(".js")) registerTypeScriptRequire();
+
 /**
  * Discover lint rules from a directory.
  *
@@ -32,6 +50,7 @@ try {
  * @param importMetaUrl - The caller's import.meta.url (for createRequire)
  */
 export function discoverLintRules(dir: string, importMetaUrl: string): LintRule[] {
+  registerTypeScriptRequire();
   const require = createRequire(importMetaUrl);
   const rules: LintRule[] = [];
 
@@ -62,6 +81,7 @@ export function discoverLintRules(dir: string, importMetaUrl: string): LintRule[
  * @param importMetaUrl - The caller's import.meta.url (for createRequire)
  */
 export function discoverPostSynthChecks(dir: string, importMetaUrl: string): PostSynthCheck[] {
+  registerTypeScriptRequire();
   const require = createRequire(importMetaUrl);
   const checks: PostSynthCheck[] = [];