@intentius/chant 0.124.16 → 0.124.17

package/dist/workspace/lineage-migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lineage-migrations.d.ts","sourceRoot":"","sources":["../../src/workspace/lineage-migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAA6F,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG5I,mFAAmF;AACnF,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAUlD,4EAA4E;AAC5E,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;0BAWd,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEvD,mEAAmE;AACnE,QAAA,MAAM,UAAU;;;;;;;;;;;;;;6BAKd,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAUxD,QAAA,MAAM,eAAe;;IAEnB,qEAAqE;;;;QAInE,iGAAiG;;QAEjG,yCAAyC;;;IAG3C,0DAA0D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAW1D,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,qBAAa,cAAe,SAAQ,SAAS;IAClC,IAAI,SAAoB;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IAAE,UAAU,EAAE,eAAe,EAAE,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAsCvJ;AAID,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IACrB,EAAE,EAAE,OAAO,GAAG,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,aAAa,CA4D9I;AAID,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,+EAA+E;IAC/E,SAAS,EAAE,OAAO,CAAC;IACnB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7C;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI,CAOpF;AAED,qFAAqF;AACrF,wBAAsB,YAAY,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B/F"}
+{"version":3,"file":"lineage-migrations.d.ts","sourceRoot":"","sources":["../../src/workspace/lineage-migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAA6F,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAI5I,mFAAmF;AACnF,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAUlD,4EAA4E;AAC5E,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;0BAWd,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEvD,mEAAmE;AACnE,QAAA,MAAM,UAAU;;;;;;;;;;;;;;6BAKd,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAUxD,QAAA,MAAM,eAAe;;IAEnB,qEAAqE;;;;QAInE,iGAAiG;;QAEjG,yCAAyC;;;IAG3C,0DAA0D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAW1D,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,qBAAa,cAAe,SAAQ,SAAS;IAClC,IAAI,SAAoB;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IAAE,UAAU,EAAE,eAAe,EAAE,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAsCvJ;AAID,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IACrB,EAAE,EAAE,OAAO,GAAG,IAAI,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,aAAa,CA4D9I;AAID,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,+EAA+E;IAC/E,SAAS,EAAE,OAAO,CAAC;IACnB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7C;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI,CAOpF;AAED,qFAAqF;AACrF,wBAAsB,YAAY,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B/F"}

package/dist/workspace/lineage-migrations.js

@@ -25,6 +25,7 @@ import { z } from "zod";
 import { LockError } from "./lineage-lock.js";
 import { compareVersions, formatVersion, parseVersion, satisfies, validateRange, VersionRangeError } from "./lineage-version.js";
 import { ensureTypeScriptLoader } from "../ts-loader.js";
+import { esModuleNamespace } from "../module-interop.js";
 /** Where a template keeps its migrations, relative to the template's directory. */
 export const MIGRATIONS_DIR = ".chant/migrations";
 const RelPath = z
@@ -232,7 +233,7 @@ export async function runMigration(m, opts) {
             writeFileSync(abs, data);
         }
         ensureTypeScriptLoader();
-        const mod = (await import(pathToFileURL(file).href));
+        const mod = esModuleNamespace((await import(pathToFileURL(file).href)));
         if (typeof mod.default !== "function")
             throw new MigrationError(`${migration.id}: ${body.module} has no default export function`);
         await mod.default({ dir: opts.dir });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.124.16",
+  "version": "0.124.17",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/commands/check-lexicon-plugin.ts

@@ -24,6 +24,7 @@ import { isAbsolute, join, resolve } from "path";
 import { pathToFileURL } from "url";
 import { isLexiconPlugin, type LexiconPlugin } from "../../lexicon";
 import { ensureTypeScriptLoader } from "../../ts-loader";
+import { esModuleNamespace } from "../../module-interop";
 
 export interface LoadedLexicon {
   /** The plugin, when the package exported one. */
@@ -78,7 +79,7 @@ export async function loadLexiconFromDir(dir: string): Promise<LoadedLexicon> {
   let mod: Record<string, unknown>;
   try {
     ensureTypeScriptLoader();
-    mod = (await import(pathToFileURL(entry).href)) as Record<string, unknown>;
+    mod = esModuleNamespace((await import(pathToFileURL(entry).href)) as Record<string, unknown>);
   } catch (error) {
     return { entry, error: `import failed: ${error instanceof Error ? error.message : String(error)}` };
   }

package/src/cli/commands/lint.ts

@@ -34,6 +34,7 @@ import { getProvenance } from "../../provenance";
 import { runLexiconPostSynthChecks } from "./build";
 import { armSandboxPolicyExecution, runProjectPolicies } from "../../lint/policy-sandbox";
 import { ensureTypeScriptLoader } from "../../ts-loader";
+import { esModuleNamespace } from "../../module-interop";
 
 // Import config loader
 import { loadConfig, resolveRulesForFile, resolveConfiguredSeverity, findProjectRoot } from "../../lint/config";
@@ -92,7 +93,7 @@ export async function loadPluginRules(
     let mod: Record<string, unknown>;
     try {
       ensureTypeScriptLoader();
-      mod = await import(resolved);
+      mod = esModuleNamespace(await import(resolved));
     } catch (err) {
       throw new Error(
         `Failed to load plugin "${pluginPath}": ${err instanceof Error ? err.message : String(err)}`,
@@ -595,7 +596,7 @@ async function runOpCheckDiagnostics(
   for (const filePath of opFiles) {
     try {
       ensureTypeScriptLoader();
-      const mod: unknown = await import(filePath);
+      const mod: unknown = esModuleNamespace(await import(filePath));
       const entity = (mod as { default?: unknown }).default;
       if (!entity || typeof entity !== "object") continue;
       const opConfig = (entity as { props?: unknown }).props as { name?: unknown; phases?: unknown } | undefined;

package/src/cli/compiled-cli.e2e.test.ts

@@ -13,7 +13,7 @@
  */
 
 import { execFileSync, spawnSync } from "node:child_process";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { afterAll, beforeAll, describe, expect, test } from "vitest";
@@ -24,6 +24,7 @@ const version = (JSON.parse(readFileSync(join(coreRoot, "package.json"), "utf-8"
 
 let scratch: string;
 let project: string;
+let cjsProject: string;
 let waves: string;
 let chant: string;
 let tracer: string;
@@ -87,6 +88,22 @@ beforeAll(() => {
   );
   chant = join(project, "node_modules", ".bin", "chant");
 
+  // The same project with no package.json at all, so nothing above the config
+  // says "type": "module" and tsx compiles chant.config.ts as CommonJS (#3897).
+  cjsProject = join(scratch, "cjs-project");
+  mkdirSync(join(cjsProject, "src"), { recursive: true });
+  symlinkSync(join(project, "node_modules"), join(cjsProject, "node_modules"), "dir");
+  writeFileSync(join(cjsProject, "chant.config.ts"), readFileSync(join(project, "chant.config.ts"), "utf-8"));
+  // The source reaches the lexicon through a module outside src/, so the
+  // fallback scan of src/ imports finds no lexicon: only the config names it.
+  mkdirSync(join(cjsProject, "lib"));
+  writeFileSync(join(cjsProject, "lib", "render.ts"), `export * from "@intentius/chant-lexicon-render";\n`);
+  writeFileSync(
+    join(cjsProject, "src", "infra.ts"),
+    `import { Postgres, Render } from "../lib/render";\n` +
+      `export const db = new Postgres({ name: "e2e-db", plan: "free", version: "16", region: Render.Region });\n`,
+  );
+
   // A waves spec whose plan writes a fixed digest and whose apply does nothing,
   // in a repository with the history `run wave` reads its gate policy from.
   waves = join(scratch, "waves");
@@ -162,4 +179,28 @@ describe("the installed chant CLI (#3878)", () => {
       rmSync(join(project, "src", "made.ts"));
     }
   });
+
+  describe("a chant.config.ts tsx compiles as CommonJS (#3897)", () => {
+    test("build reads the config's lexicons", () => {
+      const r = run(cjsProject, ["build", "src", "-o", "out/render.json"]);
+      expect(r.status, r.stderr).toBe(0);
+      const built = JSON.parse(readFileSync(join(cjsProject, "out", "render.json"), "utf-8")) as Record<string, { body?: { name?: string } }>;
+      expect(built.db?.body?.name).toBe("e2e-db");
+    });
+
+    test("build --sandbox reads the config's lexicons in the child", () => {
+      const r = run(cjsProject, ["build", "src", "--sandbox", "-o", "out/sandbox.json"]);
+      expect(r.status, r.stderr).toBe(0);
+      const built = JSON.parse(readFileSync(join(cjsProject, "out", "sandbox.json"), "utf-8")) as Record<string, { body?: { name?: string } }>;
+      expect(built.db?.body?.name).toBe("e2e-db");
+    });
+
+    test("graph --format ir finds the lexicon's entities", () => {
+      const r = run(cjsProject, ["graph", "src", "--format", "ir"]);
+      expect(r.status, r.stderr).toBe(0);
+      expect(r.stderr).not.toMatch(/could not load the project's lexicons/);
+      const ir = JSON.parse(r.stdout) as { nodes: Array<Record<string, unknown>> };
+      expect(ir.nodes.length).toBeGreaterThan(0);
+    });
+  });
 });

package/src/components/discover.ts

@@ -51,6 +51,7 @@ import { hasDiscoveryMarkerSync } from "../discovery/files";
 import { resolveDiscoveryGlobs } from "../config";
 import { walkDiscovery, workspaceMemberDirs } from "../discovery/walk";
 import { ensureTypeScriptLoader } from "../ts-loader";
+import { esModuleNamespace } from "../module-interop";
 
 /** One discovered component, paired with the file it was exported from. */
 export interface DiscoveredComponent {
@@ -214,7 +215,7 @@ async function importAndCollectComponents(
       // a bare "." path) would otherwise be treated by `import()` as a bare
       // package specifier and fail with "Cannot find package 'x.component.ts'".
       ensureTypeScriptLoader();
-      const exports = await import(pathToFileURL(resolve(filePath)).href);
+      const exports = esModuleNamespace(await import(pathToFileURL(resolve(filePath)).href));
       modules.push({ file: filePath, exports });
     } catch (err) {
       importErrors.push(new DiscoveryError(filePath, err instanceof Error ? err.message : String(err), "import"));

package/src/config-sandbox.ts

@@ -1,5 +1,6 @@
 import { dirname } from "node:path";
 import { importConfigModule, requireConfigModule, type ConfigModuleNamespace } from "./config-import";
+import { esModuleNamespace } from "./module-interop";
 
 /**
  * chant #1113 — decides WHERE a project's `chant.config.ts` is evaluated.
@@ -84,7 +85,10 @@ export function resetSandboxConfigEvaluationForTests(): void {
  * evaluated, never how its result is read.
  */
 export function selectConfigExport(namespace: ConfigModuleNamespace): unknown {
-  return namespace.default ?? namespace.config ?? namespace;
+  // A config tsx compiled as CommonJS arrives as `{ default: module.exports }`
+  // under a native import (#3897); read the module's own namespace instead.
+  const ns = esModuleNamespace(namespace);
+  return ns.default ?? ns.config ?? ns;
 }
 
 /**

package/src/discovery/import.ts

@@ -1,5 +1,6 @@
 import { DiscoveryError } from "../errors";
 import { ensureTypeScriptLoader } from "../ts-loader";
+import { esModuleNamespace } from "../module-interop";
 
 /**
  * Modules whose evaluation threw, and the error each threw with (#2368).
@@ -59,7 +60,7 @@ export async function importModule(
 
   try {
     ensureTypeScriptLoader();
-    return await import(path);
+    return esModuleNamespace(await import(path));
   } catch (error) {
     const message =
       error instanceof Error ? error.message : "Unknown import error";

package/src/discovery/sandbox/driver.ts

@@ -59,6 +59,8 @@ const POST_SYNTH_MODULE = join(dirname(DISCOVERY_DIR), "lint", "post-synth.ts");
 // file, so the driver's `setBuildParams` call below mutates the one object
 // every bundled import observes.
 const PARAMS_MODULE = join(dirname(DISCOVERY_DIR), "params.ts");
+// #3897: a project file tsx compiled as CommonJS reads as its own namespace.
+const INTEROP_MODULE = join(dirname(DISCOVERY_DIR), "module-interop.ts");
 
 export interface GenerateDriverOptions {
   /** Absolute paths to the run-fallback files this build decided NOT to fold — see `discover()`'s fold/taint loop in `../index.ts`. */
@@ -130,6 +132,7 @@ export function generateDriverSource(options: GenerateDriverOptions): string {
     `import { classifyChildError } from ${lit(CHILD_ERRORS_MODULE)};`,
     `import { getProvenance } from ${lit(PROVENANCE_MODULE)};`,
     `import { setBuildParams } from ${lit(PARAMS_MODULE)};`,
+    `import { esModuleNamespace } from ${lit(INTEROP_MODULE)};`,
     `import { writeSync } from "node:fs";`,
     ``,
     `const BUILD_ROOT = ${lit(buildRoot)};`,
@@ -181,7 +184,7 @@ export function generateDriverSource(options: GenerateDriverOptions): string {
     lines.push(
       `  importing = ${lit(file)};`,
       `  try {`,
-      `    const mod = await import(${lit(file)});`,
+      `    const mod = esModuleNamespace(await import(${lit(file)}));`,
       `    modules.push({ file: ${lit(file)}, exports: mod });`,
       `  } catch (err) {`,
       `    errors.push(classifyChildError(${lit(file)}, err).toJSON());`,
@@ -261,6 +264,7 @@ export function generateConfigDriverSource(configPath: string): string {
   return [
     `import { classifyChildError } from ${lit(CHILD_ERRORS_MODULE)};`,
     `import { scanConfigWireSafety } from ${lit(CONFIG_WIRE_MODULE)};`,
+    `import { esModuleNamespace } from ${lit(INTEROP_MODULE)};`,
     `import { writeSync } from "node:fs";`,
     ``,
     ...sendFunctionSource(),
@@ -268,7 +272,7 @@ export function generateConfigDriverSource(configPath: string): string {
     `async function main() {`,
     `  let namespace;`,
     `  try {`,
-    `    namespace = await import(${lit(configPath)});`,
+    `    namespace = esModuleNamespace(await import(${lit(configPath)}));`,
     `  } catch (err) {`,
     `    await send({ kind: "chant-config", ok: false, error: classifyChildError(${lit(configPath)}, err).toJSON() });`,
     `    return;`,
@@ -337,6 +341,7 @@ export function generatePolicyDriverSource(policyPaths: readonly string[]): stri
     `import { classifyChildError } from ${lit(CHILD_ERRORS_MODULE)};`,
     `import { decodePolicyBuildResult, scanPolicyDiagnostics, PolicyWireError } from ${lit(POLICY_WIRE_MODULE)};`,
     `import { runPostSynthChecks, isPostSynthCheck } from ${lit(POST_SYNTH_MODULE)};`,
+    `import { esModuleNamespace } from ${lit(INTEROP_MODULE)};`,
     `import { writeSync } from "node:fs";`,
     ``,
     ...sendFunctionSource(),
@@ -382,7 +387,7 @@ export function generatePolicyDriverSource(policyPaths: readonly string[]): stri
   for (const policyPath of policyPaths) {
     lines.push(
       `  try {`,
-      `    const mod = await import(${lit(policyPath)});`,
+      `    const mod = esModuleNamespace(await import(${lit(policyPath)}));`,
       `    for (const value of Object.values(mod)) {`,
       `      if (isPostSynthCheck(value)) checks.push(guard(value, ${lit(policyPath)}));`,
       `    }`,

package/src/lexicon-module.ts

@@ -28,6 +28,7 @@ import { createRequire } from "node:module";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
 import { ensureTypeScriptLoader } from "./ts-loader";
+import { esModuleNamespace } from "./module-interop";
 
 /**
  * One `lexicons` entry: a package-backed name, or a name plus the module that
@@ -181,7 +182,7 @@ export async function importLexiconModule(name: string): Promise<Record<string,
   if (path === undefined) return undefined;
   try {
     ensureTypeScriptLoader();
-    return (await import(path)) as Record<string, unknown>;
+    return esModuleNamespace((await import(path)) as Record<string, unknown>);
   } catch (err) {
     throw new Error(
       `lexicon "${name}" is declared with module ${path}, which could not be loaded: ` +
@@ -262,12 +263,12 @@ export function resolveFromProject(spec: string, fromDir: string = process.cwd()
 export async function importLexiconPackage(spec: string, fromDir: string = process.cwd()): Promise<Record<string, unknown>> {
   try {
     ensureTypeScriptLoader();
-    return (await import(spec)) as Record<string, unknown>;
+    return esModuleNamespace((await import(spec)) as Record<string, unknown>);
   } catch (err) {
     const pkg = packageNameOf(spec);
     if (pkg === undefined || !isPackageNotFound(err, pkg)) throw err;
     const resolved = resolveFromProject(spec, fromDir);
     if (resolved === undefined) throw err;
-    return (await import(pathToFileURL(resolved).href)) as Record<string, unknown>;
+    return esModuleNamespace((await import(pathToFileURL(resolved).href)) as Record<string, unknown>);
   }
 }

package/src/lint/policy-import.ts

@@ -24,6 +24,7 @@
  */
 
 import { ensureTypeScriptLoader } from "../ts-loader";
+import { esModuleNamespace } from "../module-interop";
 
 /** Whether this process must run project policy modules inside the sandbox boundary instead of here. */
 let armed = false;
@@ -69,5 +70,5 @@ export async function importPolicyModule(policyPath: string): Promise<PolicyModu
     );
   }
   ensureTypeScriptLoader();
-  return (await import(policyPath)) as PolicyModuleNamespace;
+  return esModuleNamespace((await import(policyPath)) as PolicyModuleNamespace);
 }

package/src/lint/rule-loader.ts

@@ -2,6 +2,7 @@ import { readdirSync, existsSync } from "fs";
 import { dirname, join, resolve } from "path";
 import type { LintRule } from "./rule";
 import { ensureTypeScriptLoader } from "../ts-loader";
+import { esModuleNamespace } from "../module-interop";
 
 /**
  * Type guard to check if a value conforms to the LintRule interface.
@@ -84,7 +85,7 @@ export async function loadLocalRules(projectDir: string): Promise<LintRule[]> {
     let mod: Record<string, unknown>;
     try {
       ensureTypeScriptLoader();
-      mod = await import(filePath);
+      mod = esModuleNamespace(await import(filePath));
     } catch (err) {
       throw new Error(
         `Failed to load rule file "${file}": ${err instanceof Error ? err.message : String(err)}`,

package/src/module-interop.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from "vitest";
+import { selectConfigExport } from "./config-sandbox";
+import { esModuleNamespace } from "./module-interop";
+
+/** What node's native import() hands back for a CommonJS module tsx compiled from `export default`. */
+function commonJsNamespace(exports: Record<string, unknown>): Record<string, unknown> {
+  const moduleExports: Record<string, unknown> = { ...exports };
+  Object.defineProperty(moduleExports, "__esModule", { value: true });
+  return { ...exports, default: moduleExports };
+}
+
+describe("esModuleNamespace (#3897)", () => {
+  test("a CommonJS __esModule namespace reads as the module's own exports", () => {
+    const config = { lexicons: ["terraform"] };
+    const helper = () => 1;
+    const ns = esModuleNamespace(commonJsNamespace({ default: config, helper }));
+    expect(ns.default).toBe(config);
+    expect(ns.helper).toBe(helper);
+    expect(Object.keys(ns)).not.toContain("__esModule");
+  });
+
+  test("a CommonJS module with no default export has none after unwrapping", () => {
+    const ns = esModuleNamespace(commonJsNamespace({ config: { lexicons: ["aws"] } }));
+    expect(ns.default).toBeUndefined();
+    expect(ns.config).toEqual({ lexicons: ["aws"] });
+  });
+
+  test("an enumerable __esModule marker is left out too", () => {
+    const ns = esModuleNamespace({ default: { __esModule: true, default: 1 } });
+    expect(ns).toEqual({ default: 1 });
+  });
+
+  test("an ES module whose default export has a default key is unchanged", () => {
+    const namespace = { default: { default: { lexicons: ["aws"] } } };
+    expect(esModuleNamespace(namespace)).toBe(namespace);
+  });
+
+  test("a default without the marker set to true is unchanged", () => {
+    const namespace = { default: { __esModule: "yes", default: 1 } };
+    expect(esModuleNamespace(namespace)).toBe(namespace);
+    const primitive = { default: 3 };
+    expect(esModuleNamespace(primitive)).toBe(primitive);
+    const empty = {};
+    expect(esModuleNamespace(empty)).toBe(empty);
+  });
+});
+
+describe("selectConfigExport (#3897)", () => {
+  test("a config tsx compiled as CommonJS selects the config object, not {default: config}", () => {
+    const config = { lexicons: ["terraform"], terraform: { roots: { estate: { dir: "estate" } } } };
+    expect(selectConfigExport(commonJsNamespace({ default: config }))).toBe(config);
+  });
+
+  test("an ES module config that legitimately has a default key keeps it", () => {
+    const config = { default: { lexicons: ["aws"] }, lexicons: ["aws"] };
+    expect(selectConfigExport({ default: config })).toBe(config);
+  });
+
+  test("a require()d CommonJS config still selects its default", () => {
+    const config = { lexicons: ["aws"] };
+    const moduleExports: Record<string, unknown> = { default: config };
+    Object.defineProperty(moduleExports, "__esModule", { value: true });
+    expect(selectConfigExport(moduleExports)).toBe(config);
+  });
+});

package/src/module-interop.ts

@@ -0,0 +1,39 @@
+/**
+ * The namespace a project module was authored with, whichever module format
+ * tsx compiled it to (#3897).
+ *
+ * A `.ts` file with no `"type": "module"` `package.json` above it is compiled
+ * by tsx as CommonJS: `exports.default = ...` plus a non-enumerable
+ * `__esModule: true` marker. The compiled CLI loads project files with a
+ * native `import()`, and Node hands a CommonJS module back as a namespace
+ * whose `default` is the whole `module.exports`. So `export default x` arrives
+ * as `namespace.default.default`. Under the source CLI tsx's ESM loader sits
+ * in front of the `import()` and does this interop itself, which is why the
+ * nesting only showed up once the CLI ran compiled (#3879).
+ *
+ * When `namespace.default` carries the `__esModule` marker, the module's real
+ * namespace is that exports object: this returns a copy of it with the marker
+ * left out. Anything else, including an ES module whose default export is an
+ * object that happens to have a `default` key, is returned unchanged.
+ */
+export function esModuleNamespace<T extends Record<string, unknown>>(namespace: T): T {
+  // `in` before the read: a vitest factory mock throws on reading an export
+  // it does not define, and most modules have no `default` at all.
+  if (namespace === null || typeof namespace !== "object" || !("default" in namespace)) return namespace;
+  const exported = namespace.default;
+  if (!isCommonJsEsModule(exported)) return namespace;
+  const unwrapped: Record<string, unknown> = {};
+  for (const key of Object.keys(exported)) {
+    if (key !== "__esModule") unwrapped[key] = exported[key];
+  }
+  return unwrapped as T;
+}
+
+/** A CommonJS `module.exports` that a compiler marked as an ES module. */
+function isCommonJsEsModule(value: unknown): value is Record<string, unknown> {
+  return (
+    value !== null &&
+    (typeof value === "object" || typeof value === "function") &&
+    (value as { __esModule?: unknown }).__esModule === true
+  );
+}

package/src/op/discover.ts

@@ -7,6 +7,7 @@ import { hasDiscoveryMarkerSync } from "../discovery/files";
 import { resolveDiscoveryGlobs } from "../config";
 import { isStewardDeclaration, type StewardDeclaration } from "./steward";
 import { ensureTypeScriptLoader } from "../ts-loader";
+import { esModuleNamespace } from "../module-interop";
 
 export interface DiscoveredOp {
   config: OpConfig;
@@ -152,7 +153,7 @@ export async function discoverOps(opts?: { cwd?: string }): Promise<OpDiscoveryR
   for (const filePath of files) {
     try {
       ensureTypeScriptLoader();
-      const mod = (await import(filePath)) as Record<string, unknown>;
+      const mod = esModuleNamespace((await import(filePath)) as Record<string, unknown>);
       const exported = opsExportedBy(mod);
 
       // A file may hold a steward and no Op (#2731): the steward sits beside
@@ -223,7 +224,7 @@ export async function discoverStewards(opts?: { cwd?: string }): Promise<Steward
     let mod: Record<string, unknown>;
     try {
       ensureTypeScriptLoader();
-      mod = (await import(filePath)) as Record<string, unknown>;
+      mod = esModuleNamespace((await import(filePath)) as Record<string, unknown>);
     } catch (err) {
       errors.push(`${filePath}: ${err instanceof Error ? err.message : String(err)}`);
       continue;

package/src/workspace/lineage-migrations.ts

@@ -26,6 +26,7 @@ import { z } from "zod";
 import { LockError, type Lineage } from "./lineage-lock";
 import { compareVersions, formatVersion, parseVersion, satisfies, validateRange, VersionRangeError, type Version } from "./lineage-version";
 import { ensureTypeScriptLoader } from "../ts-loader";
+import { esModuleNamespace } from "../module-interop";
 
 /** Where a template keeps its migrations, relative to the template's directory. */
 export const MIGRATIONS_DIR = ".chant/migrations";
@@ -283,7 +284,7 @@ export async function runMigration(m: LoadedMigration, opts: RunMigrationOptions
       writeFileSync(abs, data);
     }
     ensureTypeScriptLoader();
-    const mod = (await import(pathToFileURL(file).href)) as { default?: unknown };
+    const mod = esModuleNamespace((await import(pathToFileURL(file).href)) as { default?: unknown });
     if (typeof mod.default !== "function") throw new MigrationError(`${migration.id}: ${body.module} has no default export function`);
     await (mod.default as (ctx: { dir: string }) => unknown)({ dir: opts.dir });
   } else {