@intentius/chant 0.124.31 → 0.124.33

package/src/__fixtures__/pr-loop/pr-apply-wave-waiting.note.golden.md

@@ -0,0 +1,48 @@
+<!-- chant-pr:prod -->
+### chant apply for `prod`
+
+Wave 2 waits at its gate `release-wave-2`; nothing in it applied. Head `222222222222`, measured from `111111111111`.
+
+> Wave 2 was planned after the waves before it applied, and the pull request's approved plan does not cover it.
+
+| Member | Component | Status | Create | Update | Replace | Delete |
+|---|---|---|---:|---:|---:|---:|
+| `a` | a | applied | 0 | 1 | 0 | 0 |
+| `app` | app | planned | 0 | 0 | 0 | 0 |
+
+| Wave | Components | Status | Approval |
+|---:|---|---|---|
+| 1 | `a` | applied | the pull request's `pr-apply` by `github:alice` |
+| 2 | `app` | waiting | its own `release-wave-2`, not approved yet |
+
+Wave 2 was planned after the waves before it applied, and the approved plan does not cover it:
+
+- app now writes app.main.cidr to a different value than the approved plan
+
+Read wave 2's plan, `jcs1-sha256:0000000000000000000000000000000000000000000000000000000000000007`, and approve it with:
+
+```
+chant approve pr-12 release-wave-2 --plan jcs1-sha256:0000000000000000000000000000000000000000000000000000000000000007 --approver github:<your-login> --sign
+```
+
+Then run the wave's apply job again.
+
+Plan digest: `jcs1-sha256:7623a8677afb0bf98d77c602521a3abfa96f76cff25675d350a28c2e26a7bad0`
+
+Approved by `github:alice` for this digest.
+
+### Plan summary
+
+2 members: 2 groups, 0 destroys or replacements.
+
+#### Group e84467713bf6: 1 member (outlier), change
+
+```
+~ terraform_data.subnet: input
+```
+
+Members: `a`
+
+#### Group 49648f9475c7: 1 member (outlier), no changes
+
+Members: `app`

package/src/__fixtures__/pr-loop/pr-plan.note.golden.md

@@ -18,7 +18,7 @@ A reviewer who approved this pull request approves the plan with:
 chant approve pr-12 pr-apply --plan jcs1-sha256:7623a8677afb0bf98d77c602521a3abfa96f76cff25675d350a28c2e26a7bad0 --approver github:<your-login> --sign
 ```
 
-It applies on merge if the plan is still this one. If it moved, the apply refuses and names both digests.
+On merge the plan is recorded, and a release deploys it. With apply on merge it applies if the plan is still this one; if it moved, the apply refuses and names both digests.
 
 ### Plan summary
 

package/src/ci-jobs.ts

@@ -417,6 +417,12 @@ export const GITLAB_SCHEDULE_SOURCE = '$CI_PIPELINE_SOURCE == "schedule"';
 /** A job variable that makes the runner clone the whole history, which a job reading the base commit needs. */
 export const GITLAB_FULL_HISTORY = { GIT_DEPTH: "0" } as const;
 
+/** The tags a build request is pushed as (#4169), as a glob for a trigger. */
+export const BUILD_REQUEST_TAGS = "ci/build/**";
+
+/** The `rules:` if-expression for a build request's tag (#4169). */
+export const GITLAB_BUILD_REQUEST_RULE = "$CI_COMMIT_TAG =~ /^ci\\/build\\//";
+
 /** The `rules:` if-expression for a push to `branch`, a quoted name or an expression such as `$CI_DEFAULT_BRANCH`. */
 export function gitlabPushRule(branch: string): string {
   return `$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == ${branch}`;
@@ -462,11 +468,14 @@ export function gitlabRules(subject: string, trigger: OpTrigger, selector: { var
         return { if: `${GITLAB_MERGE_REQUEST_SOURCE} && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "${branch}"` };
       });
     }
-    case "push":
-      return pushBranches(trigger.branches).map((branch) => {
+    case "push": {
+      const rules = pushBranches(trigger.branches).map((branch) => {
         assertGitlabBranch(subject, branch);
         return { if: gitlabPushRule(JSON.stringify(branch)) };
       });
+      // #4169: a newest build also runs at each build request's tag.
+      return trigger.build === "newest" ? [...rules, { if: GITLAB_BUILD_REQUEST_RULE }] : rules;
+    }
   }
 }
 

package/src/cli/commands/__fixtures__/init-lexicon-output/package.json

@@ -11,12 +11,12 @@
     ".": {
       "development": "./src/index.ts",
       "types": "./dist/index.d.ts",
-      "default": "./src/index.ts"
+      "default": "./dist/index.js"
     },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
-      "default": "./src/*.ts"
+      "default": "./dist/*.js"
     },
     "./manifest": "./dist/manifest.json",
     "./meta": "./dist/meta.json",
@@ -26,7 +26,7 @@
     "generate": "npx tsx src/codegen/generate-cli.ts",
     "validate": "npx tsx src/validate-cli.ts",
     "docs": "npx tsx src/codegen/docs-cli.ts",
-    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete",
+    "build": "tsc -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
     "bundle": "tsx src/package-cli.ts"
   },

package/src/cli/commands/audit.test.ts

@@ -153,13 +153,13 @@ describe("auditCommand", () => {
     const envelope = JSON.parse(json.output) as { findings: Array<{ checkId: string; authority: Array<{ url: string }>; severity: string }> };
     const ftn11 = envelope.findings.find((f) => f.checkId === "FTN011")!;
     expect(ftn11.authority.length).toBeGreaterThan(0);
-    expect(ftn11.authority[0].url).toContain("fountain");
+    expect(ftn11.authority[0].url).toContain("managoat");
     expect(envelope.findings.find((f) => f.checkId === "FTN012")!.severity).toBe("error");
 
     const sarif = await auditCommand({ path: repo, format: "sarif" });
     const run = (JSON.parse(sarif.output) as { runs: Array<{ tool: { driver: { rules: Array<{ id: string; helpUri?: string }> } }; results: Array<{ ruleId: string }> }> }).runs[0];
     expect(run.results.some((r) => r.ruleId === "FTN011")).toBe(true);
-    expect(run.tool.driver.rules.find((r) => r.id === "FTN011")!.helpUri).toContain("fountain");
+    expect(run.tool.driver.rules.find((r) => r.id === "FTN011")!.helpUri).toContain("managoat");
 
     const md = await auditCommand({ path: repo, format: "markdown" });
     expect(md.output).toContain("FTN011");

package/src/cli/commands/check-lexicon-plugin.test.ts

@@ -55,6 +55,15 @@ describe("pluginEntryFor", () => {
     expect(pluginEntryFor(dir)).toBe(join(dir, "src/plugin.ts"));
   });
 
+  test("prefers the development source over the compiled default (#3981)", () => {
+    const dir = lexiconDir({
+      "package.json": JSON.stringify({ exports: { ".": { development: "./src/index.ts", default: "./dist/index.js" } } }),
+      "src/index.ts": "",
+      "dist/index.js": "",
+    });
+    expect(pluginEntryFor(dir)).toBe(join(dir, "src/index.ts"));
+  });
+
   test("skips a declared entry that does not exist", () => {
     const dir = lexiconDir({
       "package.json": JSON.stringify({ exports: { ".": { default: "./dist/index.js" } } }),

package/src/cli/commands/check-lexicon-plugin.ts

@@ -23,7 +23,7 @@ import { existsSync, readFileSync } from "fs";
 import { isAbsolute, join, resolve } from "path";
 import { pathToFileURL } from "url";
 import { isLexiconPlugin, type LexiconPlugin } from "../../lexicon";
-import { ensureTypeScriptLoader } from "../../ts-loader";
+import { ensureTypeScriptLoaderFor } from "../../ts-loader";
 import { esModuleNamespace } from "../../module-interop";
 
 export interface LoadedLexicon {
@@ -36,20 +36,23 @@ export interface LoadedLexicon {
 }
 
 /**
- * The module a lexicon package presents to consumers.
+ * The module a lexicon package presents to consumers, as its source.
  *
- * Tier 1 requires `exports["."].default` to be `./src/index.ts`, so that is the
- * first choice — it is the module core itself imports. The fallbacks keep this
- * usable on a lexicon that has not reached that check yet.
+ * Tier 1 requires `exports["."].development` to be `./src/index.ts` and
+ * `default` to be its compiled `./dist/index.js` (#3981). The check reads the
+ * lexicon's source, so `development` is the first choice: a `dist/` may be
+ * missing or older than the source. `default` and `main` come next, and the
+ * conventional paths keep this usable on a lexicon that has not reached that
+ * check yet.
  */
 export function pluginEntryFor(dir: string): string | undefined {
   const candidates: string[] = [];
   try {
     const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf-8")) as {
-      exports?: { "."?: { default?: string } };
+      exports?: { "."?: { development?: string; default?: string } };
       main?: string;
     };
-    for (const declared of [pkg.exports?.["."]?.default, pkg.main]) {
+    for (const declared of [pkg.exports?.["."]?.development, pkg.exports?.["."]?.default, pkg.main]) {
       if (typeof declared === "string") candidates.push(declared);
     }
   } catch {
@@ -78,7 +81,7 @@ export async function loadLexiconFromDir(dir: string): Promise<LoadedLexicon> {
 
   let mod: Record<string, unknown>;
   try {
-    ensureTypeScriptLoader();
+    ensureTypeScriptLoaderFor(entry);
     mod = esModuleNamespace((await import(pathToFileURL(entry).href)) as Record<string, unknown>);
   } catch (error) {
     return { entry, error: `import failed: ${error instanceof Error ? error.message : String(error)}` };

package/src/cli/commands/check-lexicon.test.ts

@@ -25,7 +25,7 @@ describe("checkLexicon", () => {
     expect(names).toContain("Registered intrinsics are exported by the package");
     expect(names).toContain("Registered intrinsics' isTag matches how they're authored");
     expect(names).toContain("dist/manifest.json declares a chantVersion");
-    expect(names).toContain('package.json routes exports["."].default at ./src/index.ts and deletes emitted JS in build');
+    expect(names).toContain('package.json routes exports["."] development at ./src/index.ts and default at ./dist/index.js, and build keeps emitted JS');
   });
 
   test("gitlab's own reference() intrinsic passes both the export and isTag audits", async () => {

package/src/cli/commands/check-lexicon.ts

@@ -310,27 +310,32 @@ export async function checkLexicon(dir: string): Promise<CheckResult> {
     detail: chantVersionDetail,
   });
 
-  // chant #1067 — packaging shape ("all 11 lexicons route exports['.'].default
-  // at ./src/index.ts and delete emitted JS in build") was real but
-  // unenforced; a lexicon shipping differently would break consumers
-  // silently. Cheap structural check on package.json, not a build execution.
+  // chant #1067 — packaging shape, real but unenforced before: a lexicon
+  // shipping differently would break consumers silently. Cheap structural
+  // check on package.json, not a build execution. #3981 — lexicons ship
+  // compiled JS: `default` is ./dist/index.js, `development` stays on
+  // ./src/index.ts for the repository's tools, and the build keeps the JS tsc
+  // emits (it used to delete it).
   const packageJsonRaw = readOr(join(dir, "package.json"));
   let packagingOk = false;
   let packagingDetail: string | undefined;
   if (packageJsonRaw) {
     try {
       const pkg = JSON.parse(packageJsonRaw) as {
-        exports?: { "."?: { default?: string } };
+        exports?: { "."?: { development?: string; default?: string } };
         scripts?: { build?: string };
       };
+      const developmentExport = pkg.exports?.["."]?.development;
       const defaultExport = pkg.exports?.["."]?.default;
       const buildScript = pkg.scripts?.build ?? "";
-      const exportOk = defaultExport === "./src/index.ts";
-      const deletesEmittedJs = /-delete/.test(buildScript) && /\.js/.test(buildScript);
-      packagingOk = exportOk && deletesEmittedJs;
+      const developmentOk = developmentExport === "./src/index.ts";
+      const defaultOk = defaultExport === "./dist/index.js";
+      const keepsEmittedJs = /tsconfig\.build\.json/.test(buildScript) && !/-delete/.test(buildScript);
+      packagingOk = developmentOk && defaultOk && keepsEmittedJs;
       const problems: string[] = [];
-      if (!exportOk) problems.push(`exports["."].default is ${JSON.stringify(defaultExport)}, expected "./src/index.ts"`);
-      if (!deletesEmittedJs) problems.push(`build script doesn't delete emitted .js from dist/: ${JSON.stringify(buildScript)}`);
+      if (!developmentOk) problems.push(`exports["."].development is ${JSON.stringify(developmentExport)}, expected "./src/index.ts"`);
+      if (!defaultOk) problems.push(`exports["."].default is ${JSON.stringify(defaultExport)}, expected "./dist/index.js"`);
+      if (!keepsEmittedJs) problems.push(`build script must compile tsconfig.build.json and keep the emitted .js in dist/: ${JSON.stringify(buildScript)}`);
       packagingDetail = problems.length > 0 ? problems.join("; ") : undefined;
     } catch {
       packagingDetail = "package.json is not valid JSON";
@@ -339,7 +344,7 @@ export async function checkLexicon(dir: string): Promise<CheckResult> {
     packagingDetail = "package.json missing or unreadable";
   }
   items.push({
-    name: 'package.json routes exports["."].default at ./src/index.ts and deletes emitted JS in build',
+    name: 'package.json routes exports["."] development at ./src/index.ts and default at ./dist/index.js, and build keeps emitted JS',
     tier: 1,
     pass: packagingOk,
     detail: packagingDetail,

package/src/cli/commands/import.ts

@@ -520,6 +520,43 @@ async function parseWithEmbedded(
   return { irs: parses.map((parse) => parse({ embedded })), embedded };
 }
 
+/**
+ * Build the source import wrote and name each error-severity post-synth
+ * finding that would stop `chant build` (#3605). The findings go through the
+ * same `lint.presets` and `lint.rules` filtering build applies, against the
+ * project config above `outputDir`, so a check the project turns off is not
+ * named. When the source does not build here (the lexicon is not installed
+ * beside it, or embedded content needs another lexicon's serializer), nothing
+ * is said: import reports what build would refuse, not why it cannot run.
+ */
+export async function buildErrorWarnings(plugin: LexiconPlugin, outputDir: string): Promise<string[]> {
+  try {
+    const checks = plugin.postSynthChecks?.() ?? [];
+    if (checks.length === 0) return [];
+    const [{ build }, { runPostSynthChecks }, { applyConfiguredPreset, applyConfiguredSeverity, resolvePresetIds }, { loadChantConfigUpward }] =
+      await Promise.all([import("../../build"), import("../../lint/post-synth"), import("../../lint/config"), import("../../config")]);
+    const result = await build(outputDir, [plugin.serializer]);
+    if (result.errors.length > 0) return [];
+    const { config } = await loadChantConfigUpward(outputDir);
+    const rules = config.lint?.rules;
+    // As build.ts runLexiconPostSynthChecks does: the plugin sees its own output only.
+    const output = result.outputs.get(plugin.serializer.name);
+    const outputs = new Map(output === undefined ? [] : [[plugin.serializer.name, output]]);
+    const diagnostics = runPostSynthChecks(checks, { ...result, outputs });
+    const presetIds = resolvePresetIds(plugin.lintPresets?.(), config.lint?.presets?.[plugin.name] ?? "recommended");
+    const afterPreset = applyConfiguredPreset(diagnostics, presetIds, rules).diagnostics;
+    return applyConfiguredSeverity(afterPreset, rules)
+      .diagnostics.filter((diag) => diag.severity === "error")
+      .map(
+        (diag) =>
+          `${diag.checkId}: ${diag.message.replace(/\.$/, "")}. chant build stops on this error; ` +
+          `change the generated source, or set lint.rules.${diag.checkId} to "off" in chant.config.ts.`,
+      );
+  } catch {
+    return [];
+  }
+}
+
 /** The shared tail of every template import: parse → generate → write. */
 async function parseAndWrite(
   plugin: LexiconPlugin,
@@ -615,6 +652,9 @@ async function parseAndWrite(
     generatedFiles.push(file.path);
   }
 
+  // What `chant build` will refuse, said now rather than at the first build (#3605).
+  warnings.push(...(await buildErrorWarnings(plugin, outputDir)));
+
   return {
     success: true,
     generatedFiles,

package/src/cli/commands/init-lexicon/templates/project.ts

@@ -13,12 +13,12 @@ export function generatePackageJson(name: string, names: { packageName: string }
       ".": {
         development: "./src/index.ts",
         types: "./dist/index.d.ts",
-        default: "./src/index.ts",
+        default: "./dist/index.js",
       },
       "./*": {
         development: "./src/*.ts",
         types: "./dist/*.d.ts",
-        default: "./src/*.ts",
+        default: "./dist/*.js",
       },
       "./manifest": "./dist/manifest.json",
       "./meta": "./dist/meta.json",
@@ -28,7 +28,8 @@ export function generatePackageJson(name: string, names: { packageName: string }
       generate: "npx tsx src/codegen/generate-cli.ts",
       validate: "npx tsx src/validate-cli.ts",
       docs: "npx tsx src/codegen/docs-cli.ts",
-      build: 'tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name "*.js" -o -name "*.js.map" \\) -delete',
+      // #3981 — the package ships the compiled dist/*.js its exports' `default` names.
+      build: "tsc -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json",
       prepack: "npm run generate && npm run bundle && npm run validate && npm run build",
       bundle: "tsx src/package-cli.ts",
     },

package/src/cli/commands/init-lexicon.test.ts

@@ -274,13 +274,16 @@ describe("scaffold content validation", () => {
   });
 
   // #2090, the scaffolded package.json failed tier 1 as generated: a bare
-  // string exports["."], a build script that never deletes emitted .js, and
-  // a prepack that never bundled, so dist/manifest.json never existed.
-  test("package.json exports[\".\"].default is ./src/index.ts, build deletes emitted JS, prepack bundles (#2090)", () => {
+  // string exports["."] and a prepack that never bundled, so
+  // dist/manifest.json never existed. #3981 — the package ships compiled JS.
+  test("package.json exports[\".\"] is development src, default dist JS, build keeps JS, prepack bundles (#2090, #3981)", () => {
     const pkg = JSON.parse(readFileSync(join(targetDir, "package.json"), "utf-8"));
-    expect(pkg.exports["."].default).toBe("./src/index.ts");
-    expect(pkg.scripts.build).toContain("-delete");
+    expect(pkg.exports["."].development).toBe("./src/index.ts");
+    expect(pkg.exports["."].default).toBe("./dist/index.js");
+    expect(pkg.exports["./*"].default).toBe("./dist/*.js");
+    expect(pkg.scripts.build).not.toContain("-delete");
     expect(pkg.scripts.prepack).toContain("bundle");
+    expect(pkg.scripts.prepack).toContain("npm run build");
   });
 
   test("tsconfig.build.json uses bundler resolution + the development condition (#749)", () => {

package/src/cli/commands/onboard.test.ts

@@ -305,6 +305,51 @@ describe("onboardCommand", () => {
   });
 });
 
+describe("chant.yml validate step for a lexicon it already has (#2877)", () => {
+  let root: string;
+
+  beforeEach(() => {
+    root = makeTempDir();
+    writeFixtureRepo(root);
+  });
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  const withGithubStep = (run: string) =>
+    ciContent.replace(
+      "      - name: Generate and validate K8s lexicon",
+      `      - name: Generate and validate GitHub lexicon\n        ${run}\n\n      - name: Generate and validate K8s lexicon`,
+    );
+
+  const githubSteps = (ci: string) => ci.match(/Generate and validate github lexicon/gi)?.length;
+
+  test("a named step's bare run: line counts as the lexicon's prepack line", () => {
+    const before = withGithubStep("run: npm run --prefix lexicons/github prepack");
+    expect(before).not.toBe(ciContent);
+    writeFileSync(join(root, ".github/workflows/chant.yml"), before);
+
+    const result = onboardCommand({ name: "github", root });
+    expect(result.patched).not.toContain("chant.yml (prepack + validate)");
+    expect(result.skipped).toContain("chant.yml: github already in chant.yml");
+    expect(readFileSync(join(root, ".github/workflows/chant.yml"), "utf-8")).toBe(before);
+  });
+
+  test("the step-name check ignores case (Github vs GitHub)", () => {
+    // A step whose run line is not a plain prepack call, so only the name can
+    // tell onboard the validate step already exists.
+    writeFileSync(
+      join(root, ".github/workflows/chant.yml"),
+      withGithubStep("run: npm run --prefix lexicons/github prepack -- --strict"),
+    );
+
+    onboardCommand({ name: "github", root });
+    const ci = readFileSync(join(root, ".github/workflows/chant.yml"), "utf-8");
+    expect(githubSteps(ci)).toBe(1);
+  });
+});
+
 describe("root tsconfig.json paths (#1614)", () => {
   let root: string;
 

package/src/cli/commands/onboard.ts

@@ -32,13 +32,14 @@ function findRepoRoot(): string {
 }
 
 /**
- * A real prepack invocation line: a Dockerfile `RUN`, a workflow `- run:`,
- * or a bare line inside a `run: |` block. Comments, `echo` messages and
+ * A real prepack invocation line: a Dockerfile `RUN`, a workflow `- run:` or
+ * `run:` step key (a named step puts `run:` on its own line, #2877), or a bare
+ * line inside a `run: |` block. Comments, `echo` messages and
  * `$lex` / `<lex>` placeholders do not match. Matching those placeholder
  * substrings was how onboard appended duplicates to Dockerfile.smoke on
  * every run (#1678).
  */
-const PREPACK_LINE = /^\s*(?:RUN\s+|-\s*run:\s*)?npm run --prefix lexicons\/[a-z0-9-]+ prepack\s*$/i;
+const PREPACK_LINE = /^\s*(?:RUN\s+|(?:-\s*)?run:\s*)?npm run --prefix lexicons\/[a-z0-9-]+ prepack\s*$/i;
 
 function isPrepackLine(line: string): boolean {
   return PREPACK_LINE.test(line);
@@ -256,7 +257,10 @@ function patchCiWorkflow(root: string, name: string): PatchResult {
   const displayName = name.charAt(0).toUpperCase() + name.slice(1);
   const validateStepName = `Generate and validate ${displayName} lexicon`;
 
-  if (!lines.some((l) => l.includes(validateStepName))) {
+  // Case-insensitive: the name is built from the directory ("Github"), and an
+  // existing step may spell the product its own way ("GitHub", #2877).
+  const stepNameLower = validateStepName.toLowerCase();
+  if (!lines.some((l) => l.toLowerCase().includes(stepNameLower))) {
     let lastValidateRunIdx = -1;
     for (let i = 0; i < lines.length; i++) {
       if (lines[i].includes("Generate and validate")) {

package/src/cli/commands/update.test.ts

@@ -25,6 +25,12 @@ describe("updateCommand", () => {
       const result = await updateCommand({ path: testDir });
       expect(result.success).toBe(true);
       expect(result.warnings.some((w) => w.includes("not found"))).toBe(true);
+      // chant #3988 — the warning names the install command for the package.
+      expect(
+        result.warnings.some((w) =>
+          w.includes('npm install --save-dev @intentius/chant-lexicon-nonexistent'),
+        ),
+      ).toBe(true);
     });
   });
 

package/src/cli/commands/update.ts

@@ -154,7 +154,10 @@ export async function updateCommand(options: UpdateOptions): Promise<UpdateResul
     const pkgPath = resolvePackagePath(pkgName, projectDir);
 
     if (!pkgPath) {
-      warnings.push(`${pkgName} not found in node_modules. Run "npm install" first.`);
+      // chant #3988 — update copies from node_modules and never installs.
+      warnings.push(
+        `${pkgName} not found in node_modules. chant update does not install lexicons: run "npm install --save-dev ${pkgName}" first.`,
+      );
       continue;
     }
 

package/src/cli/compiled-cli.e2e.test.ts

@@ -7,14 +7,19 @@
  * Each run is traced through a load hook that NODE_OPTIONS hands to the CLI's
  * node, so the test can say what loaded: none of chant's TypeScript source,
  * ever, and tsx only for a command that imports TypeScript (here the
- * lexicon and the project source). tsx's ESM hooks run on a thread of their
- * own, about 200 MB of the process (#3276), so a workspace read must not
- * register it either.
+ * project source). tsx's ESM hooks run on a thread of their own, about 200 MB
+ * of the process (#3276), so a workspace read must not register it either.
+ *
+ * The lexicon ships compiled JS (#3981): its exports' `default` is
+ * `dist/*.js`. No command loads a module of the lexicon's TypeScript, and
+ * `serve mcp` on a project whose config is JSON loads no tsx at all, with the
+ * same lint rules and post-synth checks as the lexicon loaded from source.
  *
  * End to end because it packs, installs from the registry and spawns the CLI.
  */
 
 import { execFileSync, spawnSync } from "node:child_process";
+import { loadPlugin } from "./plugins";
 import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
@@ -33,14 +38,20 @@ let waves: string;
 let workspace: string;
 let chant: string;
 let tracer: string;
+let mcpProject: string;
 
 const TRACER = `
 import { registerHooks } from "node:module";
 import { appendFileSync } from "node:fs";
 const out = process.env.CHANT_TRACE_OUT;
-const seen = { chantSrc: 0, chantDist: 0, tsx: 0, typescript: 0, dist: [] };
+const seen = { chantSrc: 0, chantDist: 0, tsx: 0, typescript: 0, dist: [], lexiconTs: 0, lexiconJs: 0 };
 registerHooks({
   load(url, context, next) {
+    if (url.includes("/@intentius/chant-lexicon-")) {
+      const path = url.replace(/[?#].*$/, "");
+      if (/\\.[cm]?tsx?$/.test(path) && !/\\.d\\.[cm]?ts$/.test(path)) seen.lexiconTs++;
+      else if (path.includes("/dist/") && path.endsWith(".js")) seen.lexiconJs++;
+    }
     if (url.includes("/@intentius/chant/src/")) seen.chantSrc++;
     else if (url.includes("/@intentius/chant/dist/")) { seen.chantDist++; seen.dist.push(url.slice(url.indexOf("/@intentius/chant/dist/") + 23)); }
     else if (url.includes("/node_modules/tsx/")) seen.tsx++;
@@ -61,15 +72,15 @@ interface Run {
   status: number | null;
   stdout: string;
   stderr: string;
-  /** Counts of what loaded, plus each compiled module's path under `dist/`. */
-  loaded: { chantSrc: number; chantDist: number; tsx: number; typescript: number; dist: string[] };
+  /** Counts of what loaded, plus each compiled module's path under `dist/`. `lexiconTs` and `lexiconJs` count the lexicon's TypeScript and compiled modules. */
+  loaded: { chantSrc: number; chantDist: number; tsx: number; typescript: number; dist: string[]; lexiconTs: number; lexiconJs: number };
 }
 
-function run(cwd: string, args: string[], extraEnv: NodeJS.ProcessEnv = {}, command = chant): Run {
+function run(cwd: string, args: string[], extraEnv: NodeJS.ProcessEnv = {}, command = chant, input?: string): Run {
   const traceOut = join(scratch, `trace-${Math.random().toString(36).slice(2)}.jsonl`);
   const env: NodeJS.ProcessEnv = { ...process.env, ...extraEnv, NODE_OPTIONS: `--import ${tracer}`, CHANT_TRACE_OUT: traceOut };
   delete env.CHANT_ENV;
-  const result = spawnSync(command, args, { cwd, env, encoding: "utf-8" });
+  const result = spawnSync(command, args, { cwd, env, encoding: "utf-8", input, timeout: 120_000 });
   const lines = readFileSync(traceOut, "utf-8").trim().split("\n");
   return { status: result.status, stdout: result.stdout, stderr: result.stderr, loaded: JSON.parse(lines[0]!) as Run["loaded"] };
 }
@@ -80,7 +91,9 @@ beforeAll(() => {
   writeFileSync(tracer, TRACER);
   const core = pack(coreRoot);
   // The lexicon's prepack regenerates it from upstream specs; the checkout's
-  // generated source and dist are what this test needs, so pack them as they are.
+  // generated source and bundle are what this test needs, so pack them as they
+  // are, after the prepack's last step, the build that writes dist/*.js.
+  execFileSync("npm", ["run", "build"], { cwd: renderRoot, stdio: ["ignore", "pipe", "pipe"] });
   const render = pack(renderRoot, true);
 
   project = join(scratch, "project");
@@ -95,6 +108,13 @@ beforeAll(() => {
   );
   chant = join(project, "node_modules", ".bin", "chant");
 
+  // The same lexicon, from a config that is JSON, with no source: nothing for tsx to load.
+  mcpProject = join(scratch, "mcp-project");
+  mkdirSync(mcpProject);
+  writeFileSync(join(mcpProject, "package.json"), JSON.stringify({ name: "compiled-cli-mcp-e2e", private: true, type: "module" }));
+  writeFileSync(join(mcpProject, "chant.config.json"), JSON.stringify({ lexicons: ["render"] }));
+  symlinkSync(join(project, "node_modules"), join(mcpProject, "node_modules"), "dir");
+
   // The same project with no package.json at all, so nothing above the config
   // says "type": "module" and tsx compiles chant.config.ts as CommonJS (#3897).
   cjsProject = join(scratch, "cjs-project");
@@ -217,19 +237,64 @@ describe("the installed chant CLI (#3878)", () => {
     expect(heavy).toEqual([]);
   });
 
-  test("build loads the TypeScript lexicon and project through tsx, against the one compiled core", () => {
+  test("build loads the project through tsx and the lexicon as compiled JS, against the one compiled core", () => {
     const r = run(project, ["build", "src", "-o", "out/render.json"]);
     expect(r.status, r.stderr).toBe(0);
     const built = JSON.parse(readFileSync(join(project, "out", "render.json"), "utf-8")) as Record<string, { body?: { name?: string } }>;
     expect(built.db?.body?.name).toBe("e2e-db");
     expect(r.loaded.tsx).toBeGreaterThan(0);
     expect(r.loaded.chantSrc).toBe(0);
+    expect(r.loaded.lexiconJs).toBeGreaterThan(0);
+    expect(r.loaded.lexiconTs).toBe(0);
   });
 
-  test("lint passes on the project", () => {
+  test("lint passes on the project and loads none of the lexicon's TypeScript", () => {
     const r = run(project, ["lint", "src"]);
     expect(r.status, r.stdout + r.stderr).toBe(0);
     expect(r.loaded.chantSrc).toBe(0);
+    expect(r.loaded.lexiconTs).toBe(0);
+  });
+
+  test("serve mcp loads the packed lexicon's plugin with no tsx (#3981)", () => {
+    const input =
+      [
+        { jsonrpc: "2.0", id: 1, method: "initialize", params: { protocolVersion: "2024-11-05", clientInfo: { name: "e2e" } } },
+        { jsonrpc: "2.0", method: "notifications/initialized" },
+        { jsonrpc: "2.0", id: 2, method: "tools/list", params: {} },
+        { jsonrpc: "2.0", id: 3, method: "resources/list", params: {} },
+      ]
+        .map((m) => JSON.stringify(m))
+        .join("\n") + "\n";
+    const r = run(mcpProject, ["serve", "mcp"], {}, chant, input);
+    expect(r.status, r.stderr).toBe(0);
+    const responses = r.stdout.trim().split("\n").filter(Boolean).map((line) => JSON.parse(line) as { id?: number; result?: Record<string, unknown> });
+    const result = (id: number) => responses.find((m) => m.id === id)?.result;
+    expect((result(1)?.serverInfo as { name?: string } | undefined)?.name).toBe("chant");
+    const tools = ((result(2)?.tools ?? []) as Array<{ name: string }>).map((t) => t.name);
+    for (const name of ["build", "lint", "explain"]) expect(tools).toContain(name);
+    expect(r.loaded.lexiconJs).toBeGreaterThan(0);
+    expect(r.loaded).toMatchObject({ chantSrc: 0, tsx: 0, lexiconTs: 0 });
+  });
+
+  test("the packed lexicon's plugin has the lint rules and post-synth checks of its source (#3981)", async () => {
+    // The plugin as the installed CLI loads it: compiled core, plain node, the lexicon's dist/*.js.
+    const script =
+      `const core = ${JSON.stringify(pathToFileURL(join(project, "node_modules", "@intentius", "chant", "dist")).href)};\n` +
+      `const { installCompiledCli } = await import(core + "/ts-loader.js");\n` +
+      `installCompiledCli();\n` +
+      `const { loadPlugin } = await import(core + "/cli/plugins.js");\n` +
+      `const plugin = await loadPlugin("render");\n` +
+      `process.stdout.write(JSON.stringify({ lintRules: plugin.lintRules().map((r) => r.id).sort(), postSynthChecks: (plugin.postSynthChecks?.() ?? []).map((c) => c.id).sort() }));\n`;
+    const r = run(mcpProject, ["--input-type=module", "-e", script], {}, process.execPath);
+    expect(r.status, r.stderr).toBe(0);
+    expect(r.loaded).toMatchObject({ chantSrc: 0, tsx: 0, lexiconTs: 0 });
+    const packed = JSON.parse(r.stdout) as { lintRules: string[]; postSynthChecks: string[] };
+
+    // The same plugin from the repository's source, in this (vitest) process.
+    const source = await loadPlugin("render");
+    expect(packed.lintRules).toEqual((source.lintRules?.() ?? []).map((rule) => rule.id).sort());
+    expect(packed.postSynthChecks).toEqual((source.postSynthChecks?.() ?? []).map((check) => check.id).sort());
+    expect(packed.lintRules.length).toBeGreaterThan(0);
   });
 
   test("build --sandbox bundles chant's source for the sandboxed child", () => {