feat: flat output layout (clean break, no src/ wrapper)

[brainkim]

Closes #9.

What this does

Modules publish at the tarball root (<pkg>/index.js) instead of nested under src/. jsDelivr/unpkg serve literal paths and never consult the exports map, so the old layout 404'd every copy-pasted CDN file URL. This is the default behavior — no config flag — and a clean break: no compatibility layer ships.

consumer	before	after
cdn.jsdelivr.net/npm/<pkg>/index.js	404	200
cdn.jsdelivr.net/npm/<pkg>/src/index.js	200	404 after republish (accepted break)
bare specifier / exports map	works	works (keys never contained src/)
npm link root/dist symmetry	works	works (dist/ prefix strip unchanged)

The accepted break is small by construction: the src/ layout only ever existed for packages published with libuild 0.1.x (~9 months). The crank-ecosystem URLs that motivated #9 are already flat — this restores them.

Layout

dist/
  index.js  index.cjs  index.d.ts     # modules at the root
  bin/cli.js                          # executables stay in bin/
  _chunks/                            # code-splitting chunks
  impl/…                              # internal modules relocate with the tree
  package.json  README.md  …

Design notes from the issue discussion:

• Proposal A (flat build via explicit {in, out} entry points), not B — keeping bin/ as a subdir at build time is what per-entry output mapping gives natively.
• No collision guard needed: with bin/ a subdir and outputs carrying .js/.cjs/.d.ts extensions, no reachable collision with copied metadata files exists. (The src/bin/ entry flavor in the old code is dead — nothing produces source: 'src'.)
• An earlier revision of this branch shipped re-export stubs under dist/src/ for old URLs; dropped in the second commit per discussion — band-aid off.

Bugs found & fixed along the way

1. UMD plugin corrupted sibling entries (pre-existing on main): it wrapped every .js in its outdir, so any package with src/umd.ts plus other entries shipped UMD-mangled ESM files. Now wraps only its own output; regression test included.
2. --save bin kept stale nested paths (caught by test-update agent): bin: "src/cli.js" saved as ./dist/src/cli.js; now flattened to the real executable.
3. --save idempotency (caught by agents): the ambient .d.ts export whitelist and the multi-entry discovery heuristic both assumed /src/-shaped saved values; both now accept flat forms.

Verification

• 137 tests, 133 pass — the 4 failures are the pre-existing npm-flag-filtering failures, identical on main.
• New test/flat-output.test.ts: flat layout + no src/ in output, root-module runtime resolution (CDN-literal simulation), P1: Module augmentation and .d.ts paths broken in published package #1-style guard (internal-module .d.ts + declare module relocate together, relative imports intact), UMD non-corruption, npm pack tarball shape (asserts nothing ships under src/), --save bin regression.
• E2E outside the suite: packed a fixture tarball, consumed via tsc (nodenext) through the exports map — typechecks; runtime imports work.
• Dogfooded: libuild builds itself flat (dist/src gone), CLI executes, --save round-trips.

Also in this release (maintenance batch)

Per "never let a breaking change go to waste", commit 26b6723 folds in:

• esbuild ^0.19 → ^0.28.1 (nine esbuild-breaking minors; zero API fallout), commander 15, patch bumps
• .tsx entry points (Support .tsx entry points #6): discovered and built; tsconfig jsx settings honored for declarations
• build --save missing 'import' field in '.' export entry #7 fixed: --save no longer drops import/require conditions from a types-only . export
• publish flag whitelist restored: the security validation from 47a93bb was silently dropped in the commander rewrite — the 4 chronically failing security tests were right all along. Suite is now fully green: 139 pass, 0 fail.
• dead-code removal (unreachable src/bin flavor, unused params, deprecated substr)

Breaking-change notes (0.2.0)

• Literal <pkg>/src/* URLs into previously published packages 404 once those packages republish. Node/bundler consumers unaffected.
• Root --save paths change shape (./dist/index.js); old saved paths migrate automatically on the next --save.
• The dist files field is dropped when it only contained layout dirs (npm packs the whole dist dir); author extras keep the field with module patterns appended.

🤖 Generated with Claude Code