@intentius/chant 0.124.16 → 0.124.18

package/src/components/fan-out-run.ts

@@ -31,9 +31,10 @@
  * ## Or one approval per wave
  *
  * `waveGate` (#3049) is the other mode. Each wave is planned once the waves
- * before it applied, and its gate binds that wave's set digest. Gate names,
- * the digest and the gate decision come from the wave engine
- * (`../wave-engine.ts`, #3766), which `chant run wave` uses too. See
+ * before it applied, and its gate binds that wave's set digest. The loop,
+ * gate names, the digest and the gate decision come from the wave engine
+ * (`../wave-engine.ts`, #3766), which `chant run wave` uses too; this module
+ * hands it the steps a fan-out plans, decides and applies a wave with. See
  * {@link runGatedWaves}.
  */
 
@@ -46,13 +47,13 @@ import {
 } from "./driver";
 import type { ReleaseIdentity } from "../telemetry-attribution";
 import { downstreamWithin, remainingFanOut, type FanOutPlan, type FanOutProgress, type FanOutSkip } from "./fan-out";
-import { evaluateGate, gitGateLedgerPort, type GateLedgerPort } from "../op/gate";
+import { evaluateGate, gitGateLedgerPort, type GateCheck, type GateLedgerPort } from "../op/gate";
 import type { RunProgressEvent } from "./run-progress";
 import type { CapabilityRegistry } from "./capability";
 import type { PendingGateRecord } from "../lifecycle/gate-ledger";
 import type { DeployContext } from "./capability";
 import { planWaveComponent, type WaveComponentPlan } from "./wave-plan";
-import { decideWaveGate, waveGateName, waveSetDigest, type WaveMember, type WaveRecord } from "../wave-engine";
+import { decideWaveGate, runWaveLoop, waveGateName, waveSetDigest, type WaveMember, type WaveRecord } from "../wave-engine";
 
 /**
  * One gate per wave (#3049), each bound to its wave's set digest. The other
@@ -392,137 +393,164 @@ async function runGatedWaves(
 
   options.onProgress?.({ type: "run-start", waves: plan.waves });
 
-  for (const [waveIndex, wave] of plan.waves.entries()) {
-    const waveNum = waveIndex + 1;
-    const runnable = wave.filter((name) => left.has(name) && !blockedBy.has(name));
-    if (waveGate.only !== undefined && waveNum < waveGate.only) {
-      if (runnable.length > 0) throw new EarlierWaveNotAppliedError(waveGate.only, waveNum, runnable);
-      continue;
-    }
-    if (waveGate.only !== undefined && waveNum > waveGate.only) break;
-    if (runnable.length === 0) continue;
-
-    const gateName = waveGateName(waveGate.gate, waveNum);
-    const contexts = new Map(runnable.map((name) => [name, fanOutContext(options, name)]));
-    const planned = await Promise.all(
-      runnable.map((name) => planComponent(byName.get(name)!, contexts.get(name)!, componentOutputs)),
-    );
-
-    const members: WaveMember[] = [];
-    const plansFor = new Map<string, Record<string, unknown>>();
-    const waveFailures: Array<{ component: string; error?: string }> = [];
-    for (const p of planned) {
-      if ("error" in p) {
-        waveFailures.push({ component: p.component, error: p.error });
-        continue;
+  /** What planning one wave gave. */
+  interface Planned {
+    runnable: string[];
+    gateName: string;
+    contexts: Map<string, DeployContext>;
+    members: WaveMember[];
+    plansFor: Map<string, Record<string, unknown>>;
+    waveFailures: Array<{ component: string; error?: string }>;
+  }
+  /** `next`: go on to the next wave. `stop`: the run ends here. */
+  type Outcome = "next" | "stop";
+
+  await runWaveLoop<Planned, { check: Extract<GateCheck, { satisfied: true }>; record: WaveRecord; toRun: string[] }, Outcome>({
+    first: 1,
+    onward: (_k, outcome) => outcome === "next",
+
+    async plan({ k: waveNum }) {
+      const wave = plan.waves[waveNum - 1];
+      if (!wave) return { end: "stop" };
+      const runnable = wave.filter((name) => left.has(name) && !blockedBy.has(name));
+      if (waveGate.only !== undefined && waveNum < waveGate.only) {
+        if (runnable.length > 0) throw new EarlierWaveNotAppliedError(waveGate.only, waveNum, runnable);
+        return { end: "next" };
       }
-      members.push(...p.members);
-      plansFor.set(p.component, p.plans);
-    }
-
-    let digest: string;
-    try {
-      // A wave where nothing planned has no set, and so no digest.
-      digest = members.length > 0 ? waveSetDigest(members) : "";
-    } catch (err) {
-      // Two components planning the same root: there is no one plan for it.
-      const error = err instanceof Error ? err.message : String(err);
-      for (const name of plansFor.keys()) waveFailures.push({ component: name, error });
-      plansFor.clear();
-      digest = "";
-    }
-    for (const f of waveFailures) {
-      failed.push(f.component);
-      results.push(planFailure(f.component, f.error ?? "plan failed"));
-      markBlocked(f.component);
-    }
+      if (waveGate.only !== undefined && waveNum > waveGate.only) return { end: "stop" };
+      if (runnable.length === 0) return { end: "next" };
+
+      const gateName = waveGateName(waveGate.gate, waveNum);
+      const contexts = new Map(runnable.map((name) => [name, fanOutContext(options, name)]));
+      const planned = await Promise.all(
+        runnable.map((name) => planComponent(byName.get(name)!, contexts.get(name)!, componentOutputs)),
+      );
+
+      const members: WaveMember[] = [];
+      const plansFor = new Map<string, Record<string, unknown>>();
+      const waveFailures: Array<{ component: string; error?: string }> = [];
+      for (const p of planned) {
+        if ("error" in p) {
+          waveFailures.push({ component: p.component, error: p.error });
+          continue;
+        }
+        members.push(...p.members);
+        plansFor.set(p.component, p.plans);
+      }
+      return { go: { runnable, gateName, contexts, members, plansFor, waveFailures } };
+    },
+
+    digest(_at, { members, plansFor, waveFailures }) {
+      try {
+        // A wave where nothing planned has no set, and so no digest.
+        return members.length > 0 ? waveSetDigest(members) : "";
+      } catch (err) {
+        // Two components planning the same root: there is no one plan for it.
+        const error = err instanceof Error ? err.message : String(err);
+        for (const name of plansFor.keys()) waveFailures.push({ component: name, error });
+        plansFor.clear();
+        return "";
+      }
+    },
 
-    const toRun = runnable.filter((name) => plansFor.has(name));
-    const record: WaveRecord = {
-      wave: waveNum,
-      op: waveGate.op,
-      gate: gateName,
-      components: [...runnable].sort(),
-      digest,
-      members: [...members].sort((a, b) => a.member.localeCompare(b.member)),
-      status: "failed",
-      ...(waveFailures.length > 0 ? { failed: waveFailures } : {}),
-    };
-    if (toRun.length === 0) {
-      waves.push(record);
-      options.onWaveSettled?.(record);
-      continue;
-    }
+    async decide({ k: waveNum }, { runnable, gateName, members, plansFor, waveFailures }, digest) {
+      for (const f of waveFailures) {
+        failed.push(f.component);
+        results.push(planFailure(f.component, f.error ?? "plan failed"));
+        markBlocked(f.component);
+      }
 
-    const check = await decideWaveGate(gates.port, {
-      op: waveGate.op,
-      gate: gateName,
-      digest,
-      description: waveGate.description ?? `wave ${waveNum} of ${plan.waves.length}: ${toRun.join(", ")}`,
-      ...(waveGate.timeout ? { timeout: waveGate.timeout } : {}),
-      ...(options.now ? { now: options.now } : {}),
-    });
-    if (!check.satisfied) {
-      // Nothing in this wave ran, and no later wave is planned: its plan
-      // would read outputs this wave has not written.
-      const stopped: WaveRecord = {
-        ...record,
-        status: "gated",
-        ...(check.mismatch?.approved ? { approved: check.mismatch.approved } : {}),
+      const toRun = runnable.filter((name) => plansFor.has(name));
+      const record: WaveRecord = {
+        wave: waveNum,
+        op: waveGate.op,
+        gate: gateName,
+        components: [...runnable].sort(),
+        digest,
+        members: [...members].sort((a, b) => a.member.localeCompare(b.member)),
+        status: "failed",
+        ...(waveFailures.length > 0 ? { failed: waveFailures } : {}),
       };
-      waves.push(stopped);
-      options.onWaveSettled?.(stopped);
-      gatedFact = check.pending;
-      break;
-    }
-
-    options.onProgress?.({ type: "wave-start", wave: waveNum, components: toRun });
-    const waveResults = await Promise.all(
-      toRun.map(async (name) => {
-        options.onProgress?.({ type: "component-start", wave: waveNum, component: name });
-        const plans = plansFor.get(name)!;
-        const ctx = { ...contexts.get(name)!, ...(Object.keys(plans).length > 0 ? { plans } : {}) };
-        const result = await runComponentDeploy(byName.get(name)!, ctx, registry, componentOutputs, options.onProgress, gates);
-        options.onProgress?.({
-          type: "component-done",
-          wave: waveNum,
-          component: name,
-          status: result.status === "fail" ? "failed" : result.status,
-        });
-        options.onComponentSettled?.(result, componentOutputs[name]);
-        return result;
-      }),
-    );
-    results.push(...waveResults);
+      if (toRun.length === 0) {
+        waves.push(record);
+        options.onWaveSettled?.(record);
+        return { end: "next" };
+      }
 
-    for (const result of waveResults) {
-      if (result.status === "ok") {
-        completed.push(result.component);
-        continue;
+      const check = await decideWaveGate(gates.port, {
+        op: waveGate.op,
+        gate: gateName,
+        digest,
+        description: waveGate.description ?? `wave ${waveNum} of ${plan.waves.length}: ${toRun.join(", ")}`,
+        ...(waveGate.timeout ? { timeout: waveGate.timeout } : {}),
+        ...(options.now ? { now: options.now } : {}),
+      });
+      if (!check.satisfied) {
+        // Nothing in this wave ran, and no later wave is planned: its plan
+        // would read outputs this wave has not written.
+        const stopped: WaveRecord = {
+          ...record,
+          status: "gated",
+          ...(check.mismatch?.approved ? { approved: check.mismatch.approved } : {}),
+        };
+        waves.push(stopped);
+        options.onWaveSettled?.(stopped);
+        gatedFact = check.pending;
+        return { end: "stop" };
       }
-      if (result.status === "fail") {
-        failed.push(result.component);
-        waveFailures.push({ component: result.component });
-      } else {
-        gatedFact ??= result.gate;
+      return { go: { check, record, toRun } };
+    },
+
+    async apply({ k: waveNum }, { contexts, plansFor, waveFailures }, { check, record, toRun }) {
+      options.onProgress?.({ type: "wave-start", wave: waveNum, components: toRun });
+      const waveResults = await Promise.all(
+        toRun.map(async (name) => {
+          options.onProgress?.({ type: "component-start", wave: waveNum, component: name });
+          const plans = plansFor.get(name)!;
+          const ctx = { ...contexts.get(name)!, ...(Object.keys(plans).length > 0 ? { plans } : {}) };
+          const result = await runComponentDeploy(byName.get(name)!, ctx, registry, componentOutputs, options.onProgress, gates);
+          options.onProgress?.({
+            type: "component-done",
+            wave: waveNum,
+            component: name,
+            status: result.status === "fail" ? "failed" : result.status,
+          });
+          options.onComponentSettled?.(result, componentOutputs[name]);
+          return result;
+        }),
+      );
+      results.push(...waveResults);
+
+      for (const result of waveResults) {
+        if (result.status === "ok") {
+          completed.push(result.component);
+          continue;
+        }
+        if (result.status === "fail") {
+          failed.push(result.component);
+          waveFailures.push({ component: result.component });
+        } else {
+          gatedFact ??= result.gate;
+        }
+        markBlocked(result.component);
       }
-      markBlocked(result.component);
-    }
 
-    const settled: WaveRecord = {
-      ...record,
-      status: waveFailures.length > 0 ? "failed" : "applied",
-      approvedBy: check.resolution.resolvedBy,
-      ...(waveFailures.length > 0 ? { failed: waveFailures } : {}),
-    };
-    waves.push(settled);
-    options.onWaveSettled?.(settled);
-    options.onProgress?.({
-      type: "wave-done",
-      wave: waveNum,
-      status: waveFailures.length > 0 ? "failed" : waveResults.some((r) => r.status === "gated") ? "gated" : "ok",
-    });
-  }
+      const settled: WaveRecord = {
+        ...record,
+        status: waveFailures.length > 0 ? "failed" : "applied",
+        approvedBy: check.resolution.resolvedBy,
+        ...(waveFailures.length > 0 ? { failed: waveFailures } : {}),
+      };
+      waves.push(settled);
+      options.onWaveSettled?.(settled);
+      options.onProgress?.({
+        type: "wave-done",
+        wave: waveNum,
+        status: waveFailures.length > 0 ? "failed" : waveResults.some((r) => r.status === "gated") ? "gated" : "ok",
+      });
+      return "next";
+    },
+  });
 
   const blocked: FanOutSkip[] = [...blockedBy.entries()]
     .sort(([a], [b]) => a.localeCompare(b))

package/src/config-sandbox.ts

@@ -1,5 +1,6 @@
 import { dirname } from "node:path";
 import { importConfigModule, requireConfigModule, type ConfigModuleNamespace } from "./config-import";
+import { esModuleNamespace } from "./module-interop";
 
 /**
  * chant #1113 — decides WHERE a project's `chant.config.ts` is evaluated.
@@ -84,7 +85,10 @@ export function resetSandboxConfigEvaluationForTests(): void {
  * evaluated, never how its result is read.
  */
 export function selectConfigExport(namespace: ConfigModuleNamespace): unknown {
-  return namespace.default ?? namespace.config ?? namespace;
+  // A config tsx compiled as CommonJS arrives as `{ default: module.exports }`
+  // under a native import (#3897); read the module's own namespace instead.
+  const ns = esModuleNamespace(namespace);
+  return ns.default ?? ns.config ?? ns;
 }
 
 /**

package/src/discovery/import.ts

@@ -1,5 +1,6 @@
 import { DiscoveryError } from "../errors";
 import { ensureTypeScriptLoader } from "../ts-loader";
+import { esModuleNamespace } from "../module-interop";
 
 /**
  * Modules whose evaluation threw, and the error each threw with (#2368).
@@ -59,7 +60,7 @@ export async function importModule(
 
   try {
     ensureTypeScriptLoader();
-    return await import(path);
+    return esModuleNamespace(await import(path));
   } catch (error) {
     const message =
       error instanceof Error ? error.message : "Unknown import error";

package/src/discovery/sandbox/driver.ts

@@ -59,6 +59,8 @@ const POST_SYNTH_MODULE = join(dirname(DISCOVERY_DIR), "lint", "post-synth.ts");
 // file, so the driver's `setBuildParams` call below mutates the one object
 // every bundled import observes.
 const PARAMS_MODULE = join(dirname(DISCOVERY_DIR), "params.ts");
+// #3897: a project file tsx compiled as CommonJS reads as its own namespace.
+const INTEROP_MODULE = join(dirname(DISCOVERY_DIR), "module-interop.ts");
 
 export interface GenerateDriverOptions {
   /** Absolute paths to the run-fallback files this build decided NOT to fold — see `discover()`'s fold/taint loop in `../index.ts`. */
@@ -130,6 +132,7 @@ export function generateDriverSource(options: GenerateDriverOptions): string {
     `import { classifyChildError } from ${lit(CHILD_ERRORS_MODULE)};`,
     `import { getProvenance } from ${lit(PROVENANCE_MODULE)};`,
     `import { setBuildParams } from ${lit(PARAMS_MODULE)};`,
+    `import { esModuleNamespace } from ${lit(INTEROP_MODULE)};`,
     `import { writeSync } from "node:fs";`,
     ``,
     `const BUILD_ROOT = ${lit(buildRoot)};`,
@@ -181,7 +184,7 @@ export function generateDriverSource(options: GenerateDriverOptions): string {
     lines.push(
       `  importing = ${lit(file)};`,
       `  try {`,
-      `    const mod = await import(${lit(file)});`,
+      `    const mod = esModuleNamespace(await import(${lit(file)}));`,
       `    modules.push({ file: ${lit(file)}, exports: mod });`,
       `  } catch (err) {`,
       `    errors.push(classifyChildError(${lit(file)}, err).toJSON());`,
@@ -261,6 +264,7 @@ export function generateConfigDriverSource(configPath: string): string {
   return [
     `import { classifyChildError } from ${lit(CHILD_ERRORS_MODULE)};`,
     `import { scanConfigWireSafety } from ${lit(CONFIG_WIRE_MODULE)};`,
+    `import { esModuleNamespace } from ${lit(INTEROP_MODULE)};`,
     `import { writeSync } from "node:fs";`,
     ``,
     ...sendFunctionSource(),
@@ -268,7 +272,7 @@ export function generateConfigDriverSource(configPath: string): string {
     `async function main() {`,
     `  let namespace;`,
     `  try {`,
-    `    namespace = await import(${lit(configPath)});`,
+    `    namespace = esModuleNamespace(await import(${lit(configPath)}));`,
     `  } catch (err) {`,
     `    await send({ kind: "chant-config", ok: false, error: classifyChildError(${lit(configPath)}, err).toJSON() });`,
     `    return;`,
@@ -337,6 +341,7 @@ export function generatePolicyDriverSource(policyPaths: readonly string[]): stri
     `import { classifyChildError } from ${lit(CHILD_ERRORS_MODULE)};`,
     `import { decodePolicyBuildResult, scanPolicyDiagnostics, PolicyWireError } from ${lit(POLICY_WIRE_MODULE)};`,
     `import { runPostSynthChecks, isPostSynthCheck } from ${lit(POST_SYNTH_MODULE)};`,
+    `import { esModuleNamespace } from ${lit(INTEROP_MODULE)};`,
     `import { writeSync } from "node:fs";`,
     ``,
     ...sendFunctionSource(),
@@ -382,7 +387,7 @@ export function generatePolicyDriverSource(policyPaths: readonly string[]): stri
   for (const policyPath of policyPaths) {
     lines.push(
       `  try {`,
-      `    const mod = await import(${lit(policyPath)});`,
+      `    const mod = esModuleNamespace(await import(${lit(policyPath)}));`,
       `    for (const value of Object.values(mod)) {`,
       `      if (isPostSynthCheck(value)) checks.push(guard(value, ${lit(policyPath)}));`,
       `    }`,

package/src/lexicon-module.ts

@@ -28,6 +28,7 @@ import { createRequire } from "node:module";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
 import { ensureTypeScriptLoader } from "./ts-loader";
+import { esModuleNamespace } from "./module-interop";
 
 /**
  * One `lexicons` entry: a package-backed name, or a name plus the module that
@@ -181,7 +182,7 @@ export async function importLexiconModule(name: string): Promise<Record<string,
   if (path === undefined) return undefined;
   try {
     ensureTypeScriptLoader();
-    return (await import(path)) as Record<string, unknown>;
+    return esModuleNamespace((await import(path)) as Record<string, unknown>);
   } catch (err) {
     throw new Error(
       `lexicon "${name}" is declared with module ${path}, which could not be loaded: ` +
@@ -262,12 +263,12 @@ export function resolveFromProject(spec: string, fromDir: string = process.cwd()
 export async function importLexiconPackage(spec: string, fromDir: string = process.cwd()): Promise<Record<string, unknown>> {
   try {
     ensureTypeScriptLoader();
-    return (await import(spec)) as Record<string, unknown>;
+    return esModuleNamespace((await import(spec)) as Record<string, unknown>);
   } catch (err) {
     const pkg = packageNameOf(spec);
     if (pkg === undefined || !isPackageNotFound(err, pkg)) throw err;
     const resolved = resolveFromProject(spec, fromDir);
     if (resolved === undefined) throw err;
-    return (await import(pathToFileURL(resolved).href)) as Record<string, unknown>;
+    return esModuleNamespace((await import(pathToFileURL(resolved).href)) as Record<string, unknown>);
   }
 }

package/src/lint/policy-import.ts

@@ -24,6 +24,7 @@
  */
 
 import { ensureTypeScriptLoader } from "../ts-loader";
+import { esModuleNamespace } from "../module-interop";
 
 /** Whether this process must run project policy modules inside the sandbox boundary instead of here. */
 let armed = false;
@@ -69,5 +70,5 @@ export async function importPolicyModule(policyPath: string): Promise<PolicyModu
     );
   }
   ensureTypeScriptLoader();
-  return (await import(policyPath)) as PolicyModuleNamespace;
+  return esModuleNamespace((await import(policyPath)) as PolicyModuleNamespace);
 }

package/src/lint/rule-loader.ts

@@ -2,6 +2,7 @@ import { readdirSync, existsSync } from "fs";
 import { dirname, join, resolve } from "path";
 import type { LintRule } from "./rule";
 import { ensureTypeScriptLoader } from "../ts-loader";
+import { esModuleNamespace } from "../module-interop";
 
 /**
  * Type guard to check if a value conforms to the LintRule interface.
@@ -84,7 +85,7 @@ export async function loadLocalRules(projectDir: string): Promise<LintRule[]> {
     let mod: Record<string, unknown>;
     try {
       ensureTypeScriptLoader();
-      mod = await import(filePath);
+      mod = esModuleNamespace(await import(filePath));
     } catch (err) {
       throw new Error(
         `Failed to load rule file "${file}": ${err instanceof Error ? err.message : String(err)}`,

package/src/meta/peer-deps.test.ts

@@ -124,3 +124,42 @@ describe("the provider-aware rule, over fixtures", () => {
     expect(rangeViolations(skewed, { aws: { typescript: ">=5.0.0" } })).toEqual([]);
   });
 });
+
+/**
+ * Same rule over every dependency field of every publishable package (#3905).
+ * docker, fly, k8s, grafana and helm once depended on sibling lexicons at `*`,
+ * which follows `latest` instead of the release they shipped in. Both release
+ * recipes now write `^<provider version>`; this fails if any `@intentius/*`
+ * range in dependencies, peerDependencies or optionalDependencies is `*` or
+ * anything other than the provider's current version.
+ */
+describe("every in-family @intentius/* range pins its provider's current version", () => {
+  type Manifest = {
+    name: string;
+    version: string;
+    private?: boolean;
+    dependencies?: Record<string, string>;
+    peerDependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+  };
+  const dirs = [
+    ...readdirSync(join(repoRoot, "packages")).map((n) => join("packages", n)),
+    ...lexicons.map((n) => join("lexicons", n)),
+  ].filter((d) => existsSync(join(repoRoot, d, "package.json")));
+  const manifests = dirs.map((d) => JSON.parse(readFileSync(join(repoRoot, d, "package.json"), "utf-8")) as Manifest);
+  const publishable = manifests.filter((m) => !m.private);
+  const versions = Object.fromEntries(publishable.map((m) => [m.name, m.version]));
+
+  test.each(publishable.map((m) => m.name))("%s", (name) => {
+    const m = publishable.find((p) => p.name === name)!;
+    const bad: string[] = [];
+    for (const field of ["dependencies", "peerDependencies", "optionalDependencies"] as const) {
+      for (const [dep, range] of Object.entries(m[field] ?? {})) {
+        if (!dep.startsWith("@intentius/")) continue;
+        const want = versions[dep] ? `^${versions[dep]}` : undefined;
+        if (range !== want) bad.push(`${field}.${dep} is "${range}", want ${want ?? "a published workspace package"}`);
+      }
+    }
+    expect(bad).toEqual([]);
+  });
+});

package/src/module-interop.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from "vitest";
+import { selectConfigExport } from "./config-sandbox";
+import { esModuleNamespace } from "./module-interop";
+
+/** What node's native import() hands back for a CommonJS module tsx compiled from `export default`. */
+function commonJsNamespace(exports: Record<string, unknown>): Record<string, unknown> {
+  const moduleExports: Record<string, unknown> = { ...exports };
+  Object.defineProperty(moduleExports, "__esModule", { value: true });
+  return { ...exports, default: moduleExports };
+}
+
+describe("esModuleNamespace (#3897)", () => {
+  test("a CommonJS __esModule namespace reads as the module's own exports", () => {
+    const config = { lexicons: ["terraform"] };
+    const helper = () => 1;
+    const ns = esModuleNamespace(commonJsNamespace({ default: config, helper }));
+    expect(ns.default).toBe(config);
+    expect(ns.helper).toBe(helper);
+    expect(Object.keys(ns)).not.toContain("__esModule");
+  });
+
+  test("a CommonJS module with no default export has none after unwrapping", () => {
+    const ns = esModuleNamespace(commonJsNamespace({ config: { lexicons: ["aws"] } }));
+    expect(ns.default).toBeUndefined();
+    expect(ns.config).toEqual({ lexicons: ["aws"] });
+  });
+
+  test("an enumerable __esModule marker is left out too", () => {
+    const ns = esModuleNamespace({ default: { __esModule: true, default: 1 } });
+    expect(ns).toEqual({ default: 1 });
+  });
+
+  test("an ES module whose default export has a default key is unchanged", () => {
+    const namespace = { default: { default: { lexicons: ["aws"] } } };
+    expect(esModuleNamespace(namespace)).toBe(namespace);
+  });
+
+  test("a default without the marker set to true is unchanged", () => {
+    const namespace = { default: { __esModule: "yes", default: 1 } };
+    expect(esModuleNamespace(namespace)).toBe(namespace);
+    const primitive = { default: 3 };
+    expect(esModuleNamespace(primitive)).toBe(primitive);
+    const empty = {};
+    expect(esModuleNamespace(empty)).toBe(empty);
+  });
+});
+
+describe("selectConfigExport (#3897)", () => {
+  test("a config tsx compiled as CommonJS selects the config object, not {default: config}", () => {
+    const config = { lexicons: ["terraform"], terraform: { roots: { estate: { dir: "estate" } } } };
+    expect(selectConfigExport(commonJsNamespace({ default: config }))).toBe(config);
+  });
+
+  test("an ES module config that legitimately has a default key keeps it", () => {
+    const config = { default: { lexicons: ["aws"] }, lexicons: ["aws"] };
+    expect(selectConfigExport({ default: config })).toBe(config);
+  });
+
+  test("a require()d CommonJS config still selects its default", () => {
+    const config = { lexicons: ["aws"] };
+    const moduleExports: Record<string, unknown> = { default: config };
+    Object.defineProperty(moduleExports, "__esModule", { value: true });
+    expect(selectConfigExport(moduleExports)).toBe(config);
+  });
+});

package/src/module-interop.ts

@@ -0,0 +1,39 @@
+/**
+ * The namespace a project module was authored with, whichever module format
+ * tsx compiled it to (#3897).
+ *
+ * A `.ts` file with no `"type": "module"` `package.json` above it is compiled
+ * by tsx as CommonJS: `exports.default = ...` plus a non-enumerable
+ * `__esModule: true` marker. The compiled CLI loads project files with a
+ * native `import()`, and Node hands a CommonJS module back as a namespace
+ * whose `default` is the whole `module.exports`. So `export default x` arrives
+ * as `namespace.default.default`. Under the source CLI tsx's ESM loader sits
+ * in front of the `import()` and does this interop itself, which is why the
+ * nesting only showed up once the CLI ran compiled (#3879).
+ *
+ * When `namespace.default` carries the `__esModule` marker, the module's real
+ * namespace is that exports object: this returns a copy of it with the marker
+ * left out. Anything else, including an ES module whose default export is an
+ * object that happens to have a `default` key, is returned unchanged.
+ */
+export function esModuleNamespace<T extends Record<string, unknown>>(namespace: T): T {
+  // `in` before the read: a vitest factory mock throws on reading an export
+  // it does not define, and most modules have no `default` at all.
+  if (namespace === null || typeof namespace !== "object" || !("default" in namespace)) return namespace;
+  const exported = namespace.default;
+  if (!isCommonJsEsModule(exported)) return namespace;
+  const unwrapped: Record<string, unknown> = {};
+  for (const key of Object.keys(exported)) {
+    if (key !== "__esModule") unwrapped[key] = exported[key];
+  }
+  return unwrapped as T;
+}
+
+/** A CommonJS `module.exports` that a compiler marked as an ES module. */
+function isCommonJsEsModule(value: unknown): value is Record<string, unknown> {
+  return (
+    value !== null &&
+    (typeof value === "object" || typeof value === "function") &&
+    (value as { __esModule?: unknown }).__esModule === true
+  );
+}

package/src/op/discover.ts

@@ -7,6 +7,7 @@ import { hasDiscoveryMarkerSync } from "../discovery/files";
 import { resolveDiscoveryGlobs } from "../config";
 import { isStewardDeclaration, type StewardDeclaration } from "./steward";
 import { ensureTypeScriptLoader } from "../ts-loader";
+import { esModuleNamespace } from "../module-interop";
 
 export interface DiscoveredOp {
   config: OpConfig;
@@ -152,7 +153,7 @@ export async function discoverOps(opts?: { cwd?: string }): Promise<OpDiscoveryR
   for (const filePath of files) {
     try {
       ensureTypeScriptLoader();
-      const mod = (await import(filePath)) as Record<string, unknown>;
+      const mod = esModuleNamespace((await import(filePath)) as Record<string, unknown>);
       const exported = opsExportedBy(mod);
 
       // A file may hold a steward and no Op (#2731): the steward sits beside
@@ -223,7 +224,7 @@ export async function discoverStewards(opts?: { cwd?: string }): Promise<Steward
     let mod: Record<string, unknown>;
     try {
       ensureTypeScriptLoader();
-      mod = (await import(filePath)) as Record<string, unknown>;
+      mod = esModuleNamespace((await import(filePath)) as Record<string, unknown>);
     } catch (err) {
       errors.push(`${filePath}: ${err instanceof Error ? err.message : String(err)}`);
       continue;