release(v4.11.1): ship pre-built dist/ to npm registry

publish-all.ts now does a tsc → dist/ build per package before pack, then
rewrites package.json's main/types/exports to point at the built artefacts
and ensures `files: ["dist"]` so the tarball ships only the built code.
The in-repo package.json is restored in the finally block so dev/typecheck
keep working without a build pass.

Why: strict-mode consumers (Cyndr) were forced to recompile Shade source
under their own tsconfig and tripped on internal `process.env.X` accesses
and implicit-any parameters. Shipping pre-built `.js` + `.d.ts` makes the
strictness contract live entirely inside Shade.

scripts/publish-all.ts

@@ -99,10 +99,23 @@ async function main() {
     const pkgJson = JSON.parse(originalPkgJson);
     console.log(`→ ${pkgJson.name}@${pkgJson.version}`);
 
-    rewriteWorkspaceSpecs(pkgJson, versionByName);
-    writeFileSync(pkgJsonPath, `${JSON.stringify(pkgJson, null, 2)}\n`);
-
     try {
+      // Phase 1 — build. Leave `main`/`types`/`exports` pointing at `src/`
+      // so `tsc` can resolve cross-package `@shade/*` imports through
+      // workspace source (`dist/` doesn't exist yet for sibling packages
+      // when their package.json points there). We ship pre-built artefacts
+      // so strict-mode consumers (Cyndr et al.) don't recompile our source.
+      await $`cd ${pkgDir} && rm -rf dist && bunx tsc -p tsconfig.json`.quiet();
+
+      // Phase 2 — rewrite package.json for the publish surface. Swap entry
+      // points to `dist/`, drop `workspace:*` for real versions, ensure
+      // `files: ["dist"]` so npm pack ships only the built artefacts.
+      // Restored from `originalPkgJson` in the `finally` block at the end.
+      rewriteWorkspaceSpecs(pkgJson, versionByName);
+      rewriteEntryPointsForDist(pkgJson);
+      ensureFilesIncludesDist(pkgJson);
+      writeFileSync(pkgJsonPath, `${JSON.stringify(pkgJson, null, 2)}\n`);
+
       if (dryRun) {
         await $`cd ${pkgDir} && bun pm pack --dry-run`.quiet();
       } else {
@@ -159,6 +172,55 @@ function rewriteWorkspaceSpecs(
   }
 }
 
+/**
+ * Swap `src/*.ts` references in `main`, `types`, and every `exports.<subpath>`
+ * entry over to `dist/*.{js,d.ts}` for the duration of the publish. The
+ * in-repo `package.json` is restored from `originalPkgJson` after pack so
+ * the source-pointing form survives in git.
+ *
+ * Why this lives at publish time instead of permanently: tooling that runs
+ * before any build (`tsc --noEmit`, IDE hover, the workspace dev loop) needs
+ * `main` to point at source so cross-package imports resolve without a
+ * forced build pass. Shipping dist-only is a consumer-facing concern.
+ */
+function rewriteEntryPointsForDist(pkgJson: Record<string, unknown>): void {
+  if (typeof pkgJson.main === 'string') {
+    pkgJson.main = pkgJson.main.replace(/^src\//, 'dist/').replace(/\.ts$/, '.js');
+  }
+  if (typeof pkgJson.types === 'string') {
+    pkgJson.types = pkgJson.types.replace(/^src\//, 'dist/').replace(/\.ts$/, '.d.ts');
+  }
+  if (pkgJson.exports !== undefined) {
+    pkgJson.exports = mapExportsForDist(pkgJson.exports);
+  }
+}
+
+function mapExportsForDist(node: unknown, isTypesCondition = false): unknown {
+  if (typeof node === 'string') {
+    if (!node.startsWith('./src/')) return node;
+    return node
+      .replace(/^\.\/src\//, './dist/')
+      .replace(/\.ts$/, isTypesCondition ? '.d.ts' : '.js');
+  }
+  if (node === null || typeof node !== 'object' || Array.isArray(node)) {
+    return node;
+  }
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(node as Record<string, unknown>)) {
+    out[key] = mapExportsForDist(value, key === 'types' || isTypesCondition);
+  }
+  return out;
+}
+
+function ensureFilesIncludesDist(pkgJson: Record<string, unknown>): void {
+  const files = pkgJson['files'];
+  if (Array.isArray(files)) {
+    if (!files.includes('dist')) files.push('dist');
+  } else {
+    pkgJson['files'] = ['dist'];
+  }
+}
+
 main().catch((err) => {
   console.error(err);
   process.exit(1);