@intentius/chant 0.124.30 → 0.124.32

package/dist/workspace/trust-write.schema.json

@@ -0,0 +1,265 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://intentius.io/chant/schemas/workspace/trust-write/v1/trust-write.schema.json",
+  "title": "chant workspace trust runner add|remove output",
+  "description": "What `chant workspace trust runner add <principal> --key <key>` and `trust runner remove <principal>` print (#3510): the runner entry before and after the write, the digest of .chant/trust.json after it, or the reason it wrote nothing. Each write edits .chant/trust.json in the working tree in place and never commits. Readers ignore fields they do not know; a field is only ever added within a version. The error codes are a closed list, each in the one closed list of `reason-codes.ts`. Contract version 1 of this document is written by chant 0.124.31 and newer.",
+  "oneOf": [
+    {
+      "$ref": "#/$defs/result"
+    },
+    {
+      "$ref": "#/$defs/failure"
+    }
+  ],
+  "$defs": {
+    "runner": {
+      "type": "object",
+      "required": [
+        "principal",
+        "class",
+        "key"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "principal": {
+          "type": "string",
+          "minLength": 1
+        },
+        "class": {
+          "enum": [
+            "runner",
+            "service"
+          ]
+        },
+        "key": {
+          "type": "string",
+          "pattern": "^ssh-ed25519 [A-Za-z0-9+/]+={0,2}$",
+          "description": "The runner's public key, as an ssh-ed25519 line with no comment."
+        }
+      }
+    },
+    "digest": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "A SHA-256 of the file's bytes, in lowercase hex. A file that is not there has the digest of empty text."
+    },
+    "result": {
+      "description": "The entry was written, or would be with --dry-run, or the file already held it (changed false). Exit code 0.",
+      "type": "object",
+      "required": [
+        "$schema",
+        "contract",
+        "chant",
+        "action",
+        "name",
+        "path",
+        "digest",
+        "previousDigest",
+        "paths",
+        "changed",
+        "dryRun",
+        "previous",
+        "entry",
+        "runnerRole"
+      ],
+      "properties": {
+        "$schema": {
+          "const": "https://intentius.io/chant/schemas/workspace/trust-write/v1/trust-write.schema.json"
+        },
+        "contract": {
+          "const": 1
+        },
+        "chant": {
+          "type": "string",
+          "description": "The chant that wrote it."
+        },
+        "action": {
+          "enum": [
+            "runner add",
+            "runner remove"
+          ]
+        },
+        "name": {
+          "type": "string",
+          "description": "The runner's principal."
+        },
+        "path": {
+          "const": ".chant/trust.json",
+          "description": "The trust config, relative to the repository root."
+        },
+        "digest": {
+          "$ref": "#/$defs/digest",
+          "description": "The file's digest after the write, or as it would be with --dry-run: what the caller passes as --expect to its next trust write."
+        },
+        "previousDigest": {
+          "$ref": "#/$defs/digest",
+          "description": "The file's digest before the write."
+        },
+        "paths": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The trust config when the write changed it or would with --dry-run; empty when it already held what was given."
+        },
+        "changed": {
+          "type": "boolean",
+          "description": "Whether the file changed: paths is not empty."
+        },
+        "dryRun": {
+          "type": "boolean",
+          "description": "True when --dry-run was given: nothing was written, and the document says what would have been."
+        },
+        "previous": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/runner"
+            }
+          ],
+          "description": "The principal's runner entry before the write, or null when there was none."
+        },
+        "entry": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/runner"
+            }
+          ],
+          "description": "The principal's runner entry after the write, or null after runner remove."
+        },
+        "runnerRole": {
+          "type": "boolean",
+          "description": "Whether the principal holds the runner role after the write. runner add grants it for class runner; runner remove takes it away."
+        }
+      }
+    },
+    "failure": {
+      "type": "object",
+      "description": "Nothing was written. Exit code 1.",
+      "required": [
+        "$schema",
+        "contract",
+        "chant",
+        "action",
+        "name",
+        "error"
+      ],
+      "properties": {
+        "$schema": {
+          "const": "https://intentius.io/chant/schemas/workspace/trust-write/v1/trust-write.schema.json"
+        },
+        "contract": {
+          "const": 1
+        },
+        "chant": {
+          "type": "string"
+        },
+        "action": {
+          "enum": [
+            "runner add",
+            "runner remove"
+          ]
+        },
+        "name": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "error": {
+          "type": "object",
+          "required": [
+            "code",
+            "message"
+          ],
+          "properties": {
+            "code": {
+              "enum": [
+                "not-a-git-repository",
+                "write-usage-invalid",
+                "trust-config-invalid",
+                "trust-conflict",
+                "runner-key-invalid",
+                "runner-key-is-signer",
+                "runner-exists",
+                "runner-unknown",
+                "write-scope-member",
+                "write-scope-protected",
+                "write-scope-class-unknown",
+                "agent-unknown",
+                "principal-unidentified",
+                "write-lock-timeout",
+                "write-lock-not-held"
+              ]
+            },
+            "message": {
+              "type": "string"
+            }
+          }
+        },
+        "conflict": {
+          "type": "object",
+          "description": "With trust-conflict: the digest --expect named, the one the file has now, and its last chant write when the write journal knows it.",
+          "required": [
+            "path",
+            "expected",
+            "digest",
+            "lastWrite"
+          ],
+          "properties": {
+            "path": {
+              "type": "string"
+            },
+            "expected": {
+              "$ref": "#/$defs/digest"
+            },
+            "digest": {
+              "$ref": "#/$defs/digest"
+            },
+            "lastWrite": {
+              "oneOf": [
+                {
+                  "type": "null"
+                },
+                {
+                  "type": "object",
+                  "required": [
+                    "verb",
+                    "by",
+                    "agent",
+                    "at"
+                  ],
+                  "properties": {
+                    "verb": {
+                      "type": "string"
+                    },
+                    "by": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "agent": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "at": {
+                      "type": "string"
+                    }
+                  }
+                }
+              ]
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/dist/workspace/write-scope.d.ts

@@ -144,6 +144,15 @@ export interface PathChange {
     before(): string | null;
     after(): string | null;
 }
+/**
+ * The factory Op's check log, `.chant/factory/<item>/check.log` (#3512). The
+ * Check step writes it in the worktree (`../op/activities/factory.ts`,
+ * `factoryCheck`), attaches it as each criterion's evidence, and Record
+ * commits it with the build under the builder's Chant-Agent. It is chant's own
+ * output and in no member, so an agent's member scope would flag every build
+ * commit. The member check passes over it; a protected entry still covers it.
+ */
+export declare const FACTORY_CHECK_LOG: RegExp;
 /**
  * Whether `writer` may write the file at `path`, from the workspace root:
  * the path is in a member the writer may write, and no protected entry of

package/dist/workspace/write-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-scope.d.ts","sourceRoot":"","sources":["../../src/workspace/write-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAOH,OAAO,EAEL,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,SAAS,EAIT,UAAU,EAEV,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG3C,4EAA4E;AAC5E,eAAO,MAAM,SAAS,gBAAgB,CAAC;AAEvC,iHAAiH;AACjH,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,mGAAoI,CAAC;AACnK,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,mBAAmB,4HAA2F,CAAC;AAC5H,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAEjC;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE,aAAmC,GAAG,cAAc,CAE1I;AAED,8CAA8C;AAC9C,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,cAAc,CAAC;IACtB,yDAAyD;IACzD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAChC;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,IAAI,EAAE,cAAc;IAD/B,YACW,IAAI,EAAE,cAAc,EAC7B,OAAO,EAAE,MAAM,EAIhB;CACF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC3D,OAAO,GAAE,aAAmC,GAC3C,MAAM,CAsBR;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,2BAA2B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAU7L;AAED,kIAAkI;AAClI,wBAAgB,OAAO,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAI1F;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3H,oHAAoH;AACpH,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAmB1H,8DAA8D;AAC9D,MAAM,WAAW,UAAU;IACzB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gFAAgF;IAChF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,8GAA8G;IAC9G,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,aAAa,CA4BxI;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CASpG;AAkBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAiB/G;AAED,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,MAAM,IAAI,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,YAAY,CAqB1H;AAID,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,4HAA4H;IAC5H,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAC;IACrC,iEAAiE;IACjE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iGAAiG;IACjG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,sIAAsI;IACtI,OAAO,EAAE,aAAa,CAAC;IACvB,4JAA4J;IAC5J,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAoBD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,WAAW,CAejE;AAID;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAQlH;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;CAAE,GAAG,IAAI,CASlH;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACnI,WAAW,CASb;AAID,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,0GAA0G;IAC1G,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,iFAAiF;IACjF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,oJAAoJ;IACpJ,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,yFAAyF;IACzF,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,sKAAsK;IACtK,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,UAAU,CAAC;IACnB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gFAAgF;IAChF,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAkCD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,sGAAsG;IACtG,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAuE9B"}
+{"version":3,"file":"write-scope.d.ts","sourceRoot":"","sources":["../../src/workspace/write-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAOH,OAAO,EAEL,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,SAAS,EAIT,UAAU,EAEV,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAG3C,4EAA4E;AAC5E,eAAO,MAAM,SAAS,gBAAgB,CAAC;AAEvC,iHAAiH;AACjH,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,mGAAoI,CAAC;AACnK,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,mBAAmB,4HAA2F,CAAC;AAC5H,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAEjC;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE,aAAmC,GAAG,cAAc,CAE1I;AAED,8CAA8C;AAC9C,MAAM,WAAW,MAAM;IACrB,iDAAiD;IACjD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,cAAc,CAAC;IACtB,yDAAyD;IACzD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAChC;AAED,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,IAAI,EAAE,cAAc;IAD/B,YACW,IAAI,EAAE,cAAc,EAC7B,OAAO,EAAE,MAAM,EAIhB;CACF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,WAAW,GAAG,IAAI,EAC/B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC3D,OAAO,GAAE,aAAmC,GAC3C,MAAM,CAsBR;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,2BAA2B,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAU7L;AAED,kIAAkI;AAClI,wBAAgB,OAAO,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAI1F;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3H,oHAAoH;AACpH,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAmB1H,8DAA8D;AAC9D,MAAM,WAAW,UAAU;IACzB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gFAAgF;IAChF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,8GAA8G;IAC9G,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,0GAA0G;AAC1G,wBAAgB,WAAW,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,aAAa,CA4BxI;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CASpG;AAkBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAiB/G;AAED,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,MAAM,IAAI,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,QAA0C,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,YAAY,CAsB1H;AAID,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,4HAA4H;IAC5H,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAC;IACrC,iEAAiE;IACjE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iGAAiG;IACjG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,sIAAsI;IACtI,OAAO,EAAE,aAAa,CAAC;IACvB,4JAA4J;IAC5J,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAoBD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,WAAW,CAejE;AAID;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAQlH;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;CAAE,GAAG,IAAI,CASlH;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACnI,WAAW,CASb;AAID,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,0GAA0G;IAC1G,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,iFAAiF;IACjF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,oJAAoJ;IACpJ,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,yFAAyF;IACzF,IAAI,EAAE,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,sKAAsK;IACtK,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,UAAU,CAAC;IACnB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gFAAgF;IAChF,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAkCD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,sGAAsG;IACtG,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAuE9B"}

package/dist/workspace/write-scope.js

@@ -243,6 +243,15 @@ export function onlyKeysChanged(before, after, except) {
     const b = strip(after);
     return a !== null && b !== null && isDeepStrictEqual(a, b);
 }
+/**
+ * The factory Op's check log, `.chant/factory/<item>/check.log` (#3512). The
+ * Check step writes it in the worktree (`../op/activities/factory.ts`,
+ * `factoryCheck`), attaches it as each criterion's evidence, and Record
+ * commits it with the build under the builder's Chant-Agent. It is chant's own
+ * output and in no member, so an agent's member scope would flag every build
+ * commit. The member check passes over it; a protected entry still covers it.
+ */
+export const FACTORY_CHECK_LOG = /^\.chant\/factory\/[^/]+\/check\.log$/;
 /**
  * Whether `writer` may write the file at `path`, from the workspace root:
  * the path is in a member the writer may write, and no protected entry of
@@ -255,7 +264,8 @@ export function judgePath(declaration, writer, path, change) {
     if (scope === null)
         return OK;
     const member = memberHolding(path, declaration?.members ?? []);
-    if (!memberAllowed(writer, scope, member)) {
+    const chantOutput = member === null && FACTORY_CHECK_LOG.test(path);
+    if (!chantOutput && !memberAllowed(writer, scope, member)) {
         const where = member === null ? "is in no member" : `is in member ${member}`;
         return {
             ok: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.124.30",
+  "version": "0.124.32",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/__fixtures__/pr-loop/pr-apply-wave-waiting.note.golden.md

@@ -0,0 +1,48 @@
+<!-- chant-pr:prod -->
+### chant apply for `prod`
+
+Wave 2 waits at its gate `release-wave-2`; nothing in it applied. Head `222222222222`, measured from `111111111111`.
+
+> Wave 2 was planned after the waves before it applied, and the pull request's approved plan does not cover it.
+
+| Member | Component | Status | Create | Update | Replace | Delete |
+|---|---|---|---:|---:|---:|---:|
+| `a` | a | applied | 0 | 1 | 0 | 0 |
+| `app` | app | planned | 0 | 0 | 0 | 0 |
+
+| Wave | Components | Status | Approval |
+|---:|---|---|---|
+| 1 | `a` | applied | the pull request's `pr-apply` by `github:alice` |
+| 2 | `app` | waiting | its own `release-wave-2`, not approved yet |
+
+Wave 2 was planned after the waves before it applied, and the approved plan does not cover it:
+
+- app now writes app.main.cidr to a different value than the approved plan
+
+Read wave 2's plan, `jcs1-sha256:0000000000000000000000000000000000000000000000000000000000000007`, and approve it with:
+
+```
+chant approve pr-12 release-wave-2 --plan jcs1-sha256:0000000000000000000000000000000000000000000000000000000000000007 --approver github:<your-login> --sign
+```
+
+Then run the wave's apply job again.
+
+Plan digest: `jcs1-sha256:7623a8677afb0bf98d77c602521a3abfa96f76cff25675d350a28c2e26a7bad0`
+
+Approved by `github:alice` for this digest.
+
+### Plan summary
+
+2 members: 2 groups, 0 destroys or replacements.
+
+#### Group e84467713bf6: 1 member (outlier), change
+
+```
+~ terraform_data.subnet: input
+```
+
+Members: `a`
+
+#### Group 49648f9475c7: 1 member (outlier), no changes
+
+Members: `app`

package/src/cli/commands/__fixtures__/init-lexicon-output/package.json

@@ -11,12 +11,12 @@
     ".": {
       "development": "./src/index.ts",
       "types": "./dist/index.d.ts",
-      "default": "./src/index.ts"
+      "default": "./dist/index.js"
     },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
-      "default": "./src/*.ts"
+      "default": "./dist/*.js"
     },
     "./manifest": "./dist/manifest.json",
     "./meta": "./dist/meta.json",
@@ -26,7 +26,7 @@
     "generate": "npx tsx src/codegen/generate-cli.ts",
     "validate": "npx tsx src/validate-cli.ts",
     "docs": "npx tsx src/codegen/docs-cli.ts",
-    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete",
+    "build": "tsc -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
     "bundle": "tsx src/package-cli.ts"
   },

package/src/cli/commands/audit.test.ts

@@ -153,13 +153,13 @@ describe("auditCommand", () => {
     const envelope = JSON.parse(json.output) as { findings: Array<{ checkId: string; authority: Array<{ url: string }>; severity: string }> };
     const ftn11 = envelope.findings.find((f) => f.checkId === "FTN011")!;
     expect(ftn11.authority.length).toBeGreaterThan(0);
-    expect(ftn11.authority[0].url).toContain("fountain");
+    expect(ftn11.authority[0].url).toContain("managoat");
     expect(envelope.findings.find((f) => f.checkId === "FTN012")!.severity).toBe("error");
 
     const sarif = await auditCommand({ path: repo, format: "sarif" });
     const run = (JSON.parse(sarif.output) as { runs: Array<{ tool: { driver: { rules: Array<{ id: string; helpUri?: string }> } }; results: Array<{ ruleId: string }> }> }).runs[0];
     expect(run.results.some((r) => r.ruleId === "FTN011")).toBe(true);
-    expect(run.tool.driver.rules.find((r) => r.id === "FTN011")!.helpUri).toContain("fountain");
+    expect(run.tool.driver.rules.find((r) => r.id === "FTN011")!.helpUri).toContain("managoat");
 
     const md = await auditCommand({ path: repo, format: "markdown" });
     expect(md.output).toContain("FTN011");

package/src/cli/commands/check-lexicon-plugin.test.ts

@@ -55,6 +55,15 @@ describe("pluginEntryFor", () => {
     expect(pluginEntryFor(dir)).toBe(join(dir, "src/plugin.ts"));
   });
 
+  test("prefers the development source over the compiled default (#3981)", () => {
+    const dir = lexiconDir({
+      "package.json": JSON.stringify({ exports: { ".": { development: "./src/index.ts", default: "./dist/index.js" } } }),
+      "src/index.ts": "",
+      "dist/index.js": "",
+    });
+    expect(pluginEntryFor(dir)).toBe(join(dir, "src/index.ts"));
+  });
+
   test("skips a declared entry that does not exist", () => {
     const dir = lexiconDir({
       "package.json": JSON.stringify({ exports: { ".": { default: "./dist/index.js" } } }),

package/src/cli/commands/check-lexicon-plugin.ts

@@ -23,7 +23,7 @@ import { existsSync, readFileSync } from "fs";
 import { isAbsolute, join, resolve } from "path";
 import { pathToFileURL } from "url";
 import { isLexiconPlugin, type LexiconPlugin } from "../../lexicon";
-import { ensureTypeScriptLoader } from "../../ts-loader";
+import { ensureTypeScriptLoaderFor } from "../../ts-loader";
 import { esModuleNamespace } from "../../module-interop";
 
 export interface LoadedLexicon {
@@ -36,20 +36,23 @@ export interface LoadedLexicon {
 }
 
 /**
- * The module a lexicon package presents to consumers.
+ * The module a lexicon package presents to consumers, as its source.
  *
- * Tier 1 requires `exports["."].default` to be `./src/index.ts`, so that is the
- * first choice — it is the module core itself imports. The fallbacks keep this
- * usable on a lexicon that has not reached that check yet.
+ * Tier 1 requires `exports["."].development` to be `./src/index.ts` and
+ * `default` to be its compiled `./dist/index.js` (#3981). The check reads the
+ * lexicon's source, so `development` is the first choice: a `dist/` may be
+ * missing or older than the source. `default` and `main` come next, and the
+ * conventional paths keep this usable on a lexicon that has not reached that
+ * check yet.
  */
 export function pluginEntryFor(dir: string): string | undefined {
   const candidates: string[] = [];
   try {
     const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf-8")) as {
-      exports?: { "."?: { default?: string } };
+      exports?: { "."?: { development?: string; default?: string } };
       main?: string;
     };
-    for (const declared of [pkg.exports?.["."]?.default, pkg.main]) {
+    for (const declared of [pkg.exports?.["."]?.development, pkg.exports?.["."]?.default, pkg.main]) {
       if (typeof declared === "string") candidates.push(declared);
     }
   } catch {
@@ -78,7 +81,7 @@ export async function loadLexiconFromDir(dir: string): Promise<LoadedLexicon> {
 
   let mod: Record<string, unknown>;
   try {
-    ensureTypeScriptLoader();
+    ensureTypeScriptLoaderFor(entry);
     mod = esModuleNamespace((await import(pathToFileURL(entry).href)) as Record<string, unknown>);
   } catch (error) {
     return { entry, error: `import failed: ${error instanceof Error ? error.message : String(error)}` };

package/src/cli/commands/check-lexicon.test.ts

@@ -25,7 +25,7 @@ describe("checkLexicon", () => {
     expect(names).toContain("Registered intrinsics are exported by the package");
     expect(names).toContain("Registered intrinsics' isTag matches how they're authored");
     expect(names).toContain("dist/manifest.json declares a chantVersion");
-    expect(names).toContain('package.json routes exports["."].default at ./src/index.ts and deletes emitted JS in build');
+    expect(names).toContain('package.json routes exports["."] development at ./src/index.ts and default at ./dist/index.js, and build keeps emitted JS');
   });
 
   test("gitlab's own reference() intrinsic passes both the export and isTag audits", async () => {

package/src/cli/commands/check-lexicon.ts

@@ -310,27 +310,32 @@ export async function checkLexicon(dir: string): Promise<CheckResult> {
     detail: chantVersionDetail,
   });
 
-  // chant #1067 — packaging shape ("all 11 lexicons route exports['.'].default
-  // at ./src/index.ts and delete emitted JS in build") was real but
-  // unenforced; a lexicon shipping differently would break consumers
-  // silently. Cheap structural check on package.json, not a build execution.
+  // chant #1067 — packaging shape, real but unenforced before: a lexicon
+  // shipping differently would break consumers silently. Cheap structural
+  // check on package.json, not a build execution. #3981 — lexicons ship
+  // compiled JS: `default` is ./dist/index.js, `development` stays on
+  // ./src/index.ts for the repository's tools, and the build keeps the JS tsc
+  // emits (it used to delete it).
   const packageJsonRaw = readOr(join(dir, "package.json"));
   let packagingOk = false;
   let packagingDetail: string | undefined;
   if (packageJsonRaw) {
     try {
       const pkg = JSON.parse(packageJsonRaw) as {
-        exports?: { "."?: { default?: string } };
+        exports?: { "."?: { development?: string; default?: string } };
         scripts?: { build?: string };
       };
+      const developmentExport = pkg.exports?.["."]?.development;
       const defaultExport = pkg.exports?.["."]?.default;
       const buildScript = pkg.scripts?.build ?? "";
-      const exportOk = defaultExport === "./src/index.ts";
-      const deletesEmittedJs = /-delete/.test(buildScript) && /\.js/.test(buildScript);
-      packagingOk = exportOk && deletesEmittedJs;
+      const developmentOk = developmentExport === "./src/index.ts";
+      const defaultOk = defaultExport === "./dist/index.js";
+      const keepsEmittedJs = /tsconfig\.build\.json/.test(buildScript) && !/-delete/.test(buildScript);
+      packagingOk = developmentOk && defaultOk && keepsEmittedJs;
       const problems: string[] = [];
-      if (!exportOk) problems.push(`exports["."].default is ${JSON.stringify(defaultExport)}, expected "./src/index.ts"`);
-      if (!deletesEmittedJs) problems.push(`build script doesn't delete emitted .js from dist/: ${JSON.stringify(buildScript)}`);
+      if (!developmentOk) problems.push(`exports["."].development is ${JSON.stringify(developmentExport)}, expected "./src/index.ts"`);
+      if (!defaultOk) problems.push(`exports["."].default is ${JSON.stringify(defaultExport)}, expected "./dist/index.js"`);
+      if (!keepsEmittedJs) problems.push(`build script must compile tsconfig.build.json and keep the emitted .js in dist/: ${JSON.stringify(buildScript)}`);
       packagingDetail = problems.length > 0 ? problems.join("; ") : undefined;
     } catch {
       packagingDetail = "package.json is not valid JSON";
@@ -339,7 +344,7 @@ export async function checkLexicon(dir: string): Promise<CheckResult> {
     packagingDetail = "package.json missing or unreadable";
   }
   items.push({
-    name: 'package.json routes exports["."].default at ./src/index.ts and deletes emitted JS in build',
+    name: 'package.json routes exports["."] development at ./src/index.ts and default at ./dist/index.js, and build keeps emitted JS',
     tier: 1,
     pass: packagingOk,
     detail: packagingDetail,

package/src/cli/commands/import.ts

@@ -520,6 +520,43 @@ async function parseWithEmbedded(
   return { irs: parses.map((parse) => parse({ embedded })), embedded };
 }
 
+/**
+ * Build the source import wrote and name each error-severity post-synth
+ * finding that would stop `chant build` (#3605). The findings go through the
+ * same `lint.presets` and `lint.rules` filtering build applies, against the
+ * project config above `outputDir`, so a check the project turns off is not
+ * named. When the source does not build here (the lexicon is not installed
+ * beside it, or embedded content needs another lexicon's serializer), nothing
+ * is said: import reports what build would refuse, not why it cannot run.
+ */
+export async function buildErrorWarnings(plugin: LexiconPlugin, outputDir: string): Promise<string[]> {
+  try {
+    const checks = plugin.postSynthChecks?.() ?? [];
+    if (checks.length === 0) return [];
+    const [{ build }, { runPostSynthChecks }, { applyConfiguredPreset, applyConfiguredSeverity, resolvePresetIds }, { loadChantConfigUpward }] =
+      await Promise.all([import("../../build"), import("../../lint/post-synth"), import("../../lint/config"), import("../../config")]);
+    const result = await build(outputDir, [plugin.serializer]);
+    if (result.errors.length > 0) return [];
+    const { config } = await loadChantConfigUpward(outputDir);
+    const rules = config.lint?.rules;
+    // As build.ts runLexiconPostSynthChecks does: the plugin sees its own output only.
+    const output = result.outputs.get(plugin.serializer.name);
+    const outputs = new Map(output === undefined ? [] : [[plugin.serializer.name, output]]);
+    const diagnostics = runPostSynthChecks(checks, { ...result, outputs });
+    const presetIds = resolvePresetIds(plugin.lintPresets?.(), config.lint?.presets?.[plugin.name] ?? "recommended");
+    const afterPreset = applyConfiguredPreset(diagnostics, presetIds, rules).diagnostics;
+    return applyConfiguredSeverity(afterPreset, rules)
+      .diagnostics.filter((diag) => diag.severity === "error")
+      .map(
+        (diag) =>
+          `${diag.checkId}: ${diag.message.replace(/\.$/, "")}. chant build stops on this error; ` +
+          `change the generated source, or set lint.rules.${diag.checkId} to "off" in chant.config.ts.`,
+      );
+  } catch {
+    return [];
+  }
+}
+
 /** The shared tail of every template import: parse → generate → write. */
 async function parseAndWrite(
   plugin: LexiconPlugin,
@@ -615,6 +652,9 @@ async function parseAndWrite(
     generatedFiles.push(file.path);
   }
 
+  // What `chant build` will refuse, said now rather than at the first build (#3605).
+  warnings.push(...(await buildErrorWarnings(plugin, outputDir)));
+
   return {
     success: true,
     generatedFiles,

package/src/cli/commands/init-lexicon/templates/project.ts

@@ -13,12 +13,12 @@ export function generatePackageJson(name: string, names: { packageName: string }
       ".": {
         development: "./src/index.ts",
         types: "./dist/index.d.ts",
-        default: "./src/index.ts",
+        default: "./dist/index.js",
       },
       "./*": {
         development: "./src/*.ts",
         types: "./dist/*.d.ts",
-        default: "./src/*.ts",
+        default: "./dist/*.js",
       },
       "./manifest": "./dist/manifest.json",
       "./meta": "./dist/meta.json",
@@ -28,7 +28,8 @@ export function generatePackageJson(name: string, names: { packageName: string }
       generate: "npx tsx src/codegen/generate-cli.ts",
       validate: "npx tsx src/validate-cli.ts",
       docs: "npx tsx src/codegen/docs-cli.ts",
-      build: 'tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name "*.js" -o -name "*.js.map" \\) -delete',
+      // #3981 — the package ships the compiled dist/*.js its exports' `default` names.
+      build: "tsc -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json",
       prepack: "npm run generate && npm run bundle && npm run validate && npm run build",
       bundle: "tsx src/package-cli.ts",
     },