Align zig-dtsx types export with its Pantry package payload

Observed package metadata

The actual public Pantry zig-dtsx@0.11.24 archive declares exports["."].types = "./dist/index.d.ts", but that file is absent. The archive contains 22 regular payload files, including the authored src/index.ts FFI binding and six prebuilt native libraries. Its source files list includes src and prebuilt, not dist.

• Exact source package manifest
• Original public Pantry archive SHA256: f8b2724496d2815fa292009f83601e99e1dbec507df09c7a240f100cb7dd9f85
• Original archive size: 1,803,610 bytes
• Registry SHA256/size and original clean scan matched; all six FFI library profiles matched the original GitHub release library bytes.

This is an observed missing declared target, not a claim that every TypeScript consumer fails: conditional resolution may fall back to the authored import target. Earliest released impact is not established.

Acceptance

• Align the package's public type target with files produced and included by its owning build/package configuration.
• Add a maintained normal-pack check for declared target presence and strict consumer resolution of the intended binding API, without consumer aliases or installed-file edits.
• Preserve the six native FFI profiles and document package eligibility accurately. zig-dtsx is intentionally Pantry-only and is skipped by the npm publisher; the standalone native CLI release archives are a separate delivery surface. The five npm JS declaration-tool packages are not blocked by this metadata observation.

Related #3134 package-delivery verification. Separate from #3135 class-member extraction; no change to that patch is requested and no blocking dependency on the qualified npm declaration-tool cohort is asserted.

Source progress, publication still pending.

The authored Bun FFI types target is corrected in 4b8713f. The package also now keeps its benchmark-only core dependency in devDependencies in b913675. A genuine future-workspace normal-pack/install regression first failed for the exact unpublished core version, then passed after the ownership correction. Both lockfiles were regenerated normally.

All three maintained package cases pass with 38 assertions and unchanged five-second case bounds, including strict positive/TS2322-negative consumers. Owner types, strict fixture types and Pickier pass. Native binding/build/benchmark code is unchanged.

Both source review axes passed. The new exact-source CI run is pending; no new release has been started. This issue stays open until the original release/native gates, actual public packages and ordinary public consumers are verified.

The canonical existing bun run release:patch completed once with the qualified Bumpx 0.2.31 producer and normal main/tag pushes. Candidate v0.11.26 is exact commit 36efb297051bbb7c0351cae35bd2d10a2c674fdb, authored and committed by Chris without coauthors. The prior exact-source CI passed all eight jobs.

Candidate CI and Releaser are running. This is a candidate identity, not completed publication: original native gates, actual npm/Pantry payloads, all six FFI profiles/twelve native archives, and ordinary public consumers remain under verification before closure.

Public qualification completed for v0.11.26, exact source 36efb297051bbb7c0351cae35bd2d10a2c674fdb.

• The original fix-source CI, release-commit CI, and Releaser passed all required original jobs/steps, including pinned Zig 0.17.0-dev.1282+c0f9b51d8. The canonical release command ran once successfully, without reruns or retagging.
• All five original npm packages (214 files), six Pantry packages (236 files), twelve original native archives and six embedded FFI profiles passed original registry/API digest, size, safe-member and archive-integrity checks. All five advertised npm provenance statements bind the actual subjects to this source/tag/run; this is not an independent Sigstore trust-chain verification claim.
• The public native archive now advertises its actual shipped ./src/index.ts, whose bytes match authored source. Its benchmark-only generator dependency is outside the runtime dependency graph. A normal/frozen direct public-tar consumer matched all 22 original native package files, installed no core generator, and passed strict positive and sole-TS2322 negative checks with skipLibCheck:false, empty paths, and the unchanged five-second case bound.
• Ordinary registry-installed tools matched all 214 original files; twelve public CLI/core/Bun-plugin library cases passed strict precision/privacy/brand controls through normal pack/install/frozen, with all 36 generated library payloads matched.

The first external observer artificially pinned old @types/bun1.3.13 and encountered TS2300 in its FFI declarations. A no-DTSX bun:ffi baseline reproduces those same errors. The corrected ordinary consumer uses the actual maintained ^1.3.11 range, normally selecting 1.4.4. Both graphs and the first failure remain retained; no compiler change, declaration patch or suppression was used. Native archive verification does not claim cross-platform execution or signing/notarization.

Retained final receipt: SHA256 bae5711350b2eeb95067cf74a22aeb78b749e389748b3490211f1d263f66af3a with 381 bounded input references. Framework adoption is separate.

Completed in v0.11.26, exact source 36efb297051bbb7c0351cae35bd2d10a2c674fdb. All three original acceptance criteria are verified:

1. The public types target is the actually shipped authored ./src/index.ts. All 22 original native package files matched the ordinary installed public archive.
2. The maintained package tests check normal-pack targets and strict binding resolution. Three cases pass with 38 assertions and unchanged five-second bounds. The actual public Pantry consumer also passed normal/frozen install, strict positive and sole-TS2322 negative checks, empty paths, no overrides or installed edits, and no runtime core-generator dependency.
3. All six FFI profiles match the original GitHub library bytes; all twelve native archives passed original API digest/size, archive integrity and target-header checks. Package documentation correctly distinguishes Pantry/Bun FFI, standalone CLI archives and the separate npm tools.

The original source CI, release-commit CI and Releaser all passed, preserving pinned Zig 0.17.0-dev.1282+c0f9b51 and normal producer semantics. Independent completion audit rechecked all 381 receipt inputs, five npm payloads, six Pantry payloads and strict public consumers. Final proof SHA256: bae5711350b2eeb95067cf74a22aeb78b749e389748b3490211f1d263f66af3a; independent assessment: 012a0aa0a93c97281b32666b0fb74595fdadec5a379cd97bf985fc192dfaa4f1.

The artificial exact-old Bun types 1.3.13 failure remains preserved and reproduces without DTSX; the maintained authored range selects 1.4.4 and passes. No cross-platform native execution, signing/notarization or independent Sigstore trust-chain claim is made. Framework adoption remains separate.