@brust/core 2.0.0-alpha.8 → 2.0.0-alpha.9

package/native/index.d.ts

@@ -64,8 +64,9 @@ export interface CompiledTree {
 /**
  * Compiles `path` (relative to `root`) and every child it reaches through lowering. `css_modules` (L20): the class
  * map of each `*.module.css`, keyed by its path relative to `root`; `styles.x` folds to the literal class.
+ * `packages` (F153c): the JSON resolution map of the package sources the build wrote (`pkg-src.ts`).
  */
-export declare function compileTree(path: string, root: string, runtimeImport: string, serverOnly: Array<string>, slotValues?: string | undefined | null, cssModules?: Record<string, Record<string, string>> | undefined | null, iconSvgs?: string | undefined | null, routeRoots?: Array<string> | undefined | null): CompiledTree
+export declare function compileTree(path: string, root: string, runtimeImport: string, serverOnly: Array<string>, slotValues?: string | undefined | null, cssModules?: Record<string, Record<string, string>> | undefined | null, iconSvgs?: string | undefined | null, routeRoots?: Array<string> | undefined | null, pathAliases?: string | undefined | null, packages?: string | undefined | null): CompiledTree
 
 /** The bound address as `host:port` (port 0 resolves here). */
 export declare function localAddr(): string

package/native/index.js

@@ -89,8 +89,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-android-arm64')
         const bindingPackageVersion = require('@brust/native-android-arm64/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -105,8 +105,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-android-arm-eabi')
         const bindingPackageVersion = require('@brust/native-android-arm-eabi/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -126,8 +126,8 @@ function requireNative() {
         try {
           const binding = require('@brust/native-win32-x64-gnu')
           const bindingPackageVersion = require('@brust/native-win32-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -142,8 +142,8 @@ function requireNative() {
         try {
           const binding = require('@brust/native-win32-x64-msvc')
           const bindingPackageVersion = require('@brust/native-win32-x64-msvc/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -159,8 +159,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-win32-ia32-msvc')
         const bindingPackageVersion = require('@brust/native-win32-ia32-msvc/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -175,8 +175,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-win32-arm64-msvc')
         const bindingPackageVersion = require('@brust/native-win32-arm64-msvc/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -194,8 +194,8 @@ function requireNative() {
     try {
       const binding = require('@brust/native-darwin-universal')
       const bindingPackageVersion = require('@brust/native-darwin-universal/package.json').version
-      if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-        throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
       }
       return binding
     } catch (e) {
@@ -210,8 +210,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-darwin-x64')
         const bindingPackageVersion = require('@brust/native-darwin-x64/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -226,8 +226,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-darwin-arm64')
         const bindingPackageVersion = require('@brust/native-darwin-arm64/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -246,8 +246,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-freebsd-x64')
         const bindingPackageVersion = require('@brust/native-freebsd-x64/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -262,8 +262,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-freebsd-arm64')
         const bindingPackageVersion = require('@brust/native-freebsd-arm64/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -283,8 +283,8 @@ function requireNative() {
         try {
           const binding = require('@brust/native-linux-x64-musl')
           const bindingPackageVersion = require('@brust/native-linux-x64-musl/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -299,8 +299,8 @@ function requireNative() {
         try {
           const binding = require('@brust/native-linux-x64-gnu')
           const bindingPackageVersion = require('@brust/native-linux-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -317,8 +317,8 @@ function requireNative() {
         try {
           const binding = require('@brust/native-linux-arm64-musl')
           const bindingPackageVersion = require('@brust/native-linux-arm64-musl/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -333,8 +333,8 @@ function requireNative() {
         try {
           const binding = require('@brust/native-linux-arm64-gnu')
           const bindingPackageVersion = require('@brust/native-linux-arm64-gnu/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -351,8 +351,8 @@ function requireNative() {
         try {
           const binding = require('@brust/native-linux-arm-musleabihf')
           const bindingPackageVersion = require('@brust/native-linux-arm-musleabihf/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -367,8 +367,8 @@ function requireNative() {
         try {
           const binding = require('@brust/native-linux-arm-gnueabihf')
           const bindingPackageVersion = require('@brust/native-linux-arm-gnueabihf/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -385,8 +385,8 @@ function requireNative() {
         try {
           const binding = require('@brust/native-linux-loong64-musl')
           const bindingPackageVersion = require('@brust/native-linux-loong64-musl/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -401,8 +401,8 @@ function requireNative() {
         try {
           const binding = require('@brust/native-linux-loong64-gnu')
           const bindingPackageVersion = require('@brust/native-linux-loong64-gnu/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -419,8 +419,8 @@ function requireNative() {
         try {
           const binding = require('@brust/native-linux-riscv64-musl')
           const bindingPackageVersion = require('@brust/native-linux-riscv64-musl/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -435,8 +435,8 @@ function requireNative() {
         try {
           const binding = require('@brust/native-linux-riscv64-gnu')
           const bindingPackageVersion = require('@brust/native-linux-riscv64-gnu/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -452,8 +452,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-linux-ppc64-gnu')
         const bindingPackageVersion = require('@brust/native-linux-ppc64-gnu/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -468,8 +468,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-linux-s390x-gnu')
         const bindingPackageVersion = require('@brust/native-linux-s390x-gnu/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -488,8 +488,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-openharmony-arm64')
         const bindingPackageVersion = require('@brust/native-openharmony-arm64/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -504,8 +504,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-openharmony-x64')
         const bindingPackageVersion = require('@brust/native-openharmony-x64/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -520,8 +520,8 @@ function requireNative() {
       try {
         const binding = require('@brust/native-openharmony-arm')
         const bindingPackageVersion = require('@brust/native-openharmony-arm/package.json').version
-        if (bindingPackageVersion !== '2.0.0-alpha.8' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '2.0.0-alpha.9' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -661,8 +661,8 @@ if (!nativeBinding || forceWasi) {
       if (!candidateFailed) {
         if (process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
           const bindingPackageVersion = require('@brust/native-wasm32-wasi/package.json').version
-          if (bindingPackageVersion !== '2.0.0-alpha.8') {
-            throw new Error(`WASI binding package version mismatch, expected 2.0.0-alpha.8 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '2.0.0-alpha.9') {
+            throw new Error(`WASI binding package version mismatch, expected 2.0.0-alpha.9 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
         }
         wasiBinding = require('@brust/native-wasm32-wasi')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brust/core",
-  "version": "2.0.0-alpha.8",
+  "version": "2.0.0-alpha.9",
   "description": "brust v2 — React components compiled to Rust-rendered templates",
   "license": "MIT",
   "homepage": "https://brust.dev",
@@ -55,7 +55,7 @@
     ]
   },
   "dependencies": {
-    "@brust/runtime-dom": "2.0.0-alpha.8"
+    "@brust/runtime-dom": "2.0.0-alpha.9"
   },
   "peerDependencies": {
     "react": "^19.0.0",
@@ -93,12 +93,12 @@
     "access": "public"
   },
   "optionalDependencies": {
-    "@brust/native-darwin-x64": "2.0.0-alpha.8",
-    "@brust/native-darwin-arm64": "2.0.0-alpha.8",
-    "@brust/native-linux-x64-gnu": "2.0.0-alpha.8",
-    "@brust/native-linux-arm64-gnu": "2.0.0-alpha.8",
-    "@brust/native-linux-x64-musl": "2.0.0-alpha.8",
-    "@brust/native-linux-arm64-musl": "2.0.0-alpha.8",
-    "@brust/core-cf": "2.0.0-alpha.8"
+    "@brust/native-darwin-x64": "2.0.0-alpha.9",
+    "@brust/native-darwin-arm64": "2.0.0-alpha.9",
+    "@brust/native-linux-x64-gnu": "2.0.0-alpha.9",
+    "@brust/native-linux-arm64-gnu": "2.0.0-alpha.9",
+    "@brust/native-linux-x64-musl": "2.0.0-alpha.9",
+    "@brust/native-linux-arm64-musl": "2.0.0-alpha.9",
+    "@brust/core-cf": "2.0.0-alpha.9"
   }
 }

package/src/build/bundle.ts

@@ -15,6 +15,7 @@ import type { Compiled } from './compile'
 import { cssPlugin } from './css'
 import { BuildError } from './errors'
 import { RUNTIME_FEATURES } from './features'
+import { packageDirOf } from './pkg-src'
 
 const REACT_EXTERNALS = ['react', 'react/*', 'react-dom', 'react-dom/*']
 /** Production React (and the production JSX transform: `react/jsx-runtime`, never `jsxDEV`). `brust dev` builds set
@@ -75,6 +76,9 @@ export function sourceDirPlugin(sourceOf: SourceOf, appRoot: string, external: s
       })
       b.onResolve({ filter: /^[^./]/ }, (a) => {
         if (!sourceOf.has(a.importer) || matchesExternal(a.path, external)) return undefined
+        // F153c: an artifact compiled from a package's source imports what that package sees.
+        const pkg = packageDirOf(sourceOf.get(a.importer)!)
+        if (pkg !== undefined) return { path: Bun.resolveSync(a.path, pkg) }
         // A package the staged file can see from where it sits resolves natively: the bundler then picks the package's ESM
         // entry (`module` / `exports.import`) and tree-shakes it. `Bun.resolveSync` answers with the CJS `main`, which
         // bundles the whole package (recharts: +85 KB gzip on the chart page). Packages only the app root sees (a staged

package/src/build/compile.ts

@@ -7,6 +7,8 @@ import { relative, sep } from 'node:path'
 import { type CompiledComponent, type CompiledTree, compileTree } from '../../native/index.js'
 import type { FlatRoute, Route } from '../routes'
 import { BuildError } from './errors'
+import { checkAliasAgreement, readPathAliases } from './tsconfig-paths'
+import type { PackageSources } from './pkg-src'
 
 /** `ComponentIR` as the compiler serialises it (snake_case), with the fields that are absent
  * when default (`ir/mod.rs`) normalised. The build reads it; it never rewrites it. */
@@ -111,11 +113,17 @@ export function compileApp(opts: {
   iconsFinal?: boolean
   /** Values the build computed for `ir.build_eval` slots, by key (L2): the slots become literals. */
   slotValues?: Record<string, unknown>
+  /** F153c: the package sources this build wrote (`pkg-src.ts`); absent = package imports are islands. */
+  packages?: PackageSources
 }): { compiled: Map<string, Compiled>; routeComponent: Map<string, string> } {
   const { appRoot, leaves, componentFile } = opts
   const iconSvgsJson = opts.iconsFinal ? JSON.stringify({ final: true, svgs: opts.iconSvgs ?? {} }) : undefined
   const slotValuesJson = opts.slotValues && Object.keys(opts.slotValues).length > 0 ? JSON.stringify(opts.slotValues) : undefined
+  const packagesJson = opts.packages ? JSON.stringify(opts.packages) : undefined
   // The Rust side keys each map by its path relative to the app root (`/`-separated), like an import resolves.
+  const { aliases, notes } = readPathAliases(appRoot)
+  for (const n of notes) opts.log(`warning tsconfig-paths ${n}`)
+  const pathAliasesJson = aliases.length > 0 ? JSON.stringify(aliases) : undefined
   const cssModules = Object.fromEntries([...(opts.cssMaps ?? [])].map(([abs, map]) => [relative(realpathSync(appRoot), abs).split(sep).join('/'), map]))
   const seen = new Map<string, Seen>()
   const rootIdOfFile = new Map<string, string>()
@@ -139,7 +147,7 @@ export function compileApp(opts: {
     let rootId = rootIdOfFile.get(file)
     if (!rootId) {
       const rel = relative(appRoot, file)
-      const tree = compileTree(rel, appRoot, opts.runtimeImport, opts.serverOnly, slotValuesJson, cssModules, iconSvgsJson, routeRoots)
+      const tree = compileTree(rel, appRoot, opts.runtimeImport, opts.serverOnly, slotValuesJson, cssModules, iconSvgsJson, routeRoots, pathAliasesJson, packagesJson)
       if (tree.error) throw new BuildError(tree.error.rule, `${where(rel, tree.error)} ${tree.error.message}`)
       for (const [i, c] of tree.components.entries()) {
         // A lowering Error that came back as a diagnostic is a build error too (contract 9).
@@ -161,6 +169,7 @@ export function compileApp(opts: {
     for (const d of c.diagnostics)
       if (d.class === 'fallback' || d.class === 'warning') opts.log(`warning ${d.rule} ${where(c.source, d)} ${d.message}`)
     const ir = JSON.parse(c.ir) as ComponentIR
+    if (ir.alias_imports?.length) checkAliasAgreement(appRoot, ir.alias_imports)
     ir.use_id_slots ??= 0
     ir.uses_outlet ??= false
     ir.instances ??= []

package/src/build/index.ts

@@ -13,6 +13,7 @@ import { runActionsOnly } from './actions-only'
 import { type CfPrepared, buildCloudflare, prepareCloudflare } from './cloudflare'
 import { renderIcons } from './build-icons'
 import { evaluateBuildSlots } from './build-eval'
+import { preparePackageSources } from './pkg-src'
 import { type Compiled, compileApp } from './compile'
 import { buildCss, CssGraph, directCss, resolveGlobals, routeCssSources } from './css'
 import { type ActionsBuildConfig, type CacheBuildConfig, loadBuildConfig } from './config'
@@ -248,6 +249,14 @@ async function buildInto(
   }
   const firstLog: string[] = []
   let { compiled, routeComponent } = compileApp({ ...compileOpts, log: (l) => firstLog.push(l) })
+  // F153c: the packages the app imports components from are compiled from their source when they publish it (and
+  // it matches what they publish); the app is compiled again with those sources. A refused package stays the island.
+  const external = [...new Set([...compiled.values()].flatMap((c) => (c.ir.external ? [c.ir.external.source] : [])))]
+  const packages = preparePackageSources(appRoot, external)
+  if (Object.keys(packages.scopes).length > 0) {
+    firstLog.length = 0
+    ;({ compiled, routeComponent } = compileApp({ ...compileOpts, packages, log: (l) => firstLog.push(l) }))
+  }
   // L23: lucide icons the compiler could inline are rendered here (react-dom/server); L2: slots that read
   // nothing request- or time-dependent are computed once, here. The app is compiled again with both (an icon with
   // no markup stays the L22 island; a slot with a value is a literal: no job, no worker). The first compile's
@@ -258,7 +267,7 @@ async function buildInto(
   const hasSlots = Object.keys(slotValues).length > 0
   if (hasIcons || hasSlots) {
     if (!hasIcons) firstLog.forEach((l) => o.log(l))
-    ;({ compiled, routeComponent } = compileApp({ ...compileOpts, iconSvgs, iconsFinal: hasIcons, slotValues, log: hasIcons ? o.log : () => {} }))
+    ;({ compiled, routeComponent } = compileApp({ ...compileOpts, packages, iconSvgs, iconsFinal: hasIcons, slotValues, log: hasIcons ? o.log : () => {} }))
   } else firstLog.forEach((l) => o.log(l))
 
   // F158 (R34.69/70): the compiler makes a caller of a route component fall back to React, so none is a revive host;

package/src/build/pkg-src.ts

@@ -0,0 +1,366 @@
+// Package sources (shadcn S3 step 1, F153c, R34.61/R34.62): the compiler analyses a package component from the
+// AUTHORED source its source map carries (`sourcesContent`), never from the published JS (G1, G2). This module runs
+// no package code: sources are read, transpiled for the integrity check, and written, never imported; the compiler
+// only parses them, and the build never evaluates a slot of a component compiled from them (L2). (The route scan
+// imports the app graph, and with it the packages' published JS, as it always has: that is not new here.)
+//
+// For every bare import the app reaches (and, transitively, every bare import of a package source written here),
+// the package's ESM entry is resolved, its `.map` read, and the `.ts`/`.tsx` sources written under
+// `<app>/.brust/pkg-src/p-<hash>/` (the hash of the package's path: bun's store installs one copy per dependant; no
+// text the package controls is ever part of a path). The compiler gets the resolution map (`PackageSources`), so it reads only what this build wrote:
+// the directory is removed first, and a stale one is never consulted.
+//
+// Fail closed: a package with no ESM entry, no map, no source for its entry, a source outside the package, a
+// relative import the map does not carry, a dynamic `import()` or `eval`, or a source whose literals and names are
+// not all in the published JS (R34.62: the React build runs the dist, not the map; a containment check of literals and
+// names, i.e. fidelity, not a security boundary: the author controls both files) is REFUSED, with the reason;
+// the compiler then renders its components as React islands of the package export, exactly as before.
+import { createHash } from 'node:crypto'
+import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { dirname, join, posix, relative, resolve, sep } from 'node:path'
+import { BuildError } from './errors'
+
+/** What the compiler reads (`AnalyzeOptions.packages`): per importing scope (`""` = the app, else the root-relative
+ * directory of a written package), each bare specifier → the root-relative path of its written entry source, or the
+ * reason it was refused. */
+export interface PackageSources {
+  scopes: Record<string, Record<string, string>>
+  refused: Record<string, Record<string, string>>
+  /** Each written directory (root-relative) → the package's real directory: a bare import in an artifact compiled from
+   * a package source resolves from the package, as it does in a real install (not read by the compiler). */
+  dirs: Record<string, string>
+}
+
+/** The last build's written directories (absolute) → the package's real directory, for the bundler. */
+const writtenDirs = new Map<string, string>()
+
+/** The real directory of the package whose written source `file` (absolute) is, if it is one. */
+export function packageDirOf(file: string): string | undefined {
+  for (const [dir, real] of writtenDirs) if (file.startsWith(dir + sep) || file.startsWith(`${dir}/`)) return real
+  return undefined
+}
+
+/** Where the sources go, relative to the app root. */
+export const PKG_SRC_DIR = '.brust/pkg-src'
+
+/** Never followed: the React runtime itself, brust, and platform modules. */
+const NEVER = (spec: string) =>
+  /^(react|react-dom|scheduler)(\/|$)/.test(spec) ||
+  /^(@brust\/|brust(\/|$)|brustjs(\/|$))/.test(spec) ||
+  /^(node|bun):/.test(spec) ||
+  // L23 inlines lucide icons from the package export; the icons pass owns them.
+  /^lucide-react(\/|$)/.test(spec)
+
+const LIMITS = { packages: 256, bytesPerPackage: 4 * 1024 * 1024, totalBytes: 64 * 1024 * 1024 }
+
+type Outcome = { ok: true; dir: string; entry: string; imports: string[] } | { ok: false; reason: string }
+
+/** `@scope/name/sub` → [`@scope/name`, `sub`]. */
+export function splitSpecifier(spec: string): [string, string] {
+  const parts = spec.split('/')
+  const n = spec.startsWith('@') ? 2 : 1
+  return [parts.slice(0, n).join('/'), parts.slice(n).join('/')]
+}
+
+/** The first `node_modules/<name>` from `from` upwards, as a real path. */
+function findPackage(name: string, from: string): string | null {
+  for (let dir = from; ; ) {
+    const p = join(dir, 'node_modules', name)
+    if (existsSync(join(p, 'package.json'))) return realpathSync(p)
+    const up = dirname(dir)
+    if (up === dir) return null
+    dir = up
+  }
+}
+
+/** The package's ESM entry for `import` (exports `.` → `import`/`module`/`default`, then `module`). */
+function esmEntry(pj: Record<string, unknown>): string | null {
+  const pick = (x: unknown): string | null => {
+    if (typeof x === 'string') return x
+    if (!x || typeof x !== 'object') return null
+    const o = x as Record<string, unknown>
+    for (const k of ['import', 'module', 'default']) if (k in o) return pick(o[k])
+    return null
+  }
+  const exp = pj.exports
+  const dot = typeof exp === 'string' ? exp : exp && typeof exp === 'object' ? (exp as Record<string, unknown>)['.'] : undefined
+  const viaExports = dot === undefined ? null : pick(dot)
+  if (viaExports) return viaExports
+  return typeof pj.module === 'string' ? pj.module : null
+}
+
+/** The source map of `file`: its `sourceMappingURL` (a relative file), else `<file>.map`. */
+function mapOf(file: string): string | null {
+  const text = readFileSync(file, 'utf8')
+  const m = /\/\/# sourceMappingURL=([^\s'"]+)\s*$/.exec(text)
+  if (m && !m[1]!.startsWith('data:') && !/^[a-z]+:/i.test(m[1]!)) {
+    const p = join(dirname(file), m[1]!)
+    if (existsSync(p)) return p
+  }
+  return existsSync(`${file}.map`) ? `${file}.map` : null
+}
+
+// ---------------------------------------------------------------------------------------------------------------
+// Integrity (R34.62): every string/number literal and every name of the transpiled sources occurs in the published
+// file the map belongs to. Both sides go through the same transpiler first, so quoting and type syntax agree.
+
+/** Names the JSX transform and esbuild add or rename (`undefined` prints as `void 0`); not evidence either way. */
+const JSX_NAMES = new Set(['createElement', '__name', '__defProp', 'React', 'undefined'])
+const JSX_RUNTIME = /^(?:jsx|jsxs|jsxDEV|Fragment)(?:_[\w$]+)?$/
+/** Keywords are syntax, not names: esbuild prints `const` as `var` and drops `type`/`interface` with the types. */
+const KEYWORDS = new Set(
+  'await break case catch class const continue debugger default delete do else enum export extends false finally for function if implements import in instanceof interface let new null package private protected public return static super switch this throw true try typeof var void while with yield async of get set as from type declare readonly abstract namespace module satisfies keyof infer is unique asserts override accessor'.split(' '),
+)
+
+export interface Skeleton {
+  strings: Set<string>
+  names: Set<string>
+}
+
+/** Literals and names of transpiled JS (a small lexer: strings, templates, comments, numbers, identifiers; a regex
+ * literal may be read as names, which only makes a mismatch more likely: fail closed). */
+export function skeleton(js: string): Skeleton {
+  const strings = new Set<string>()
+  const names = new Set<string>()
+  let i = 0
+  const n = js.length
+  const templateDepth: number[] = []
+  let braces = 0
+  const readTemplateChunk = () => {
+    // at the char after '`' or after the '}' that closes `${`
+    let s = ''
+    while (i < n) {
+      const c = js[i]!
+      if (c === '\\') {
+        s += js.slice(i, i + 2)
+        i += 2
+      } else if (c === '`') {
+        i++
+        strings.add(s)
+        return
+      } else if (c === '$' && js[i + 1] === '{') {
+        i += 2
+        strings.add(s)
+        templateDepth.push(braces)
+        braces++
+        return
+      } else {
+        s += c
+        i++
+      }
+    }
+  }
+  while (i < n) {
+    const c = js[i]!
+    if (c === '/' && js[i + 1] === '/') {
+      while (i < n && js[i] !== '\n') i++
+    } else if (c === '/' && js[i + 1] === '*') {
+      const end = js.indexOf('*/', i + 2)
+      i = end < 0 ? n : end + 2
+    } else if (c === '"' || c === "'") {
+      let s = ''
+      i++
+      while (i < n && js[i] !== c) {
+        if (js[i] === '\\') {
+          s += js.slice(i, i + 2)
+          i += 2
+        } else s += js[i++]
+      }
+      i++
+      strings.add(s)
+    } else if (c === '`') {
+      i++
+      readTemplateChunk()
+    } else if (c === '{') {
+      braces++
+      i++
+    } else if (c === '}') {
+      braces--
+      i++
+      if (templateDepth.length && templateDepth[templateDepth.length - 1] === braces) {
+        templateDepth.pop()
+        readTemplateChunk()
+      }
+    } else if (/[0-9]/.test(c) || (c === '.' && /[0-9]/.test(js[i + 1] ?? ''))) {
+      const m = /^(?:0[xX][0-9a-fA-F_]+|0[bB][01_]+|0[oO][0-7_]+|(?:\d[\d_]*\.?\d*(?:[eE][+-]?\d+)?|\.\d+(?:[eE][+-]?\d+)?))n?/.exec(js.slice(i))
+      const tok = m ? m[0] : c
+      const num = Number(tok.replace(/_/g, '').replace(/n$/, ''))
+      strings.add(Number.isNaN(num) ? tok : `#${num}`)
+      i += tok.length
+    } else if (/[A-Za-z_$]/.test(c)) {
+      const m = /^[A-Za-z_$][\w$]*/.exec(js.slice(i))!
+      names.add(m[0])
+      i += m[0].length
+    } else i++
+  }
+  return { strings, names }
+}
+
+const transpile = (code: string, loader: 'tsx' | 'ts' | 'js') =>
+  new Bun.Transpiler({ loader, target: 'browser', minifyWhitespace: false, deadCodeElimination: false, trimUnusedImports: false }).transformSync(code)
+
+/** What of `sources` is not in `published`; empty = the sources are what the published file was built from. */
+export function integrityGaps(sources: { path: string; text: string }[], published: string): string[] {
+  const pub = skeleton(transpile(published, 'js'))
+  const gaps: string[] = []
+  for (const s of sources) {
+    const loader = s.path.endsWith('.tsx') ? 'tsx' : 'ts'
+    const sk = skeleton(transpile(s.text, loader))
+    // Import specifiers are module names, which bundling replaces; they are checked as imports instead.
+    for (const im of new Bun.Transpiler({ loader }).scanImports(s.text)) sk.strings.delete(im.path)
+    for (const v of sk.strings) if (!pub.strings.has(v)) gaps.push(`${s.path}: literal ${JSON.stringify(v.startsWith('#') ? v.slice(1) : v).slice(0, 60)}`)
+    for (const v of sk.names) if (!JSX_NAMES.has(v) && !JSX_RUNTIME.test(v) && !KEYWORDS.has(v) && !pub.names.has(v)) gaps.push(`${s.path}: name \`${v}\``)
+  }
+  return gaps
+}
+
+// ---------------------------------------------------------------------------------------------------------------
+
+/** Reads one package (real directory `dir`), checks it, and writes its sources under `outRoot`. */
+function writePackage(appRoot: string, dir: string, budget: { bytes: number }): Outcome {
+  const pj = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')) as Record<string, unknown>
+  const entryRel = esmEntry(pj)
+  if (!entryRel) return { ok: false, reason: 'no ESM entry (exports `import` or `module`)' }
+  const entry = join(dir, entryRel)
+  if (!existsSync(entry) || !statSync(entry).isFile()) return { ok: false, reason: `the ESM entry ${entryRel} is missing` }
+  const mapFile = mapOf(entry)
+  if (!mapFile) return { ok: false, reason: 'no source map for the ESM entry' }
+  let map: { sources?: unknown; sourcesContent?: unknown }
+  try {
+    map = JSON.parse(readFileSync(mapFile, 'utf8'))
+  } catch {
+    return { ok: false, reason: 'the source map is not JSON' }
+  }
+  const sources = Array.isArray(map.sources) ? (map.sources as unknown[]) : []
+  const contents = Array.isArray(map.sourcesContent) ? (map.sourcesContent as unknown[]) : []
+  // Each source as a path inside the package; anything outside it, or not TS/TSX, is not ours to read.
+  const files: { path: string; text: string }[] = []
+  for (const [k, s] of sources.entries()) {
+    const text = contents[k]
+    if (typeof s !== 'string' || typeof text !== 'string') continue
+    const abs = posix.normalize(posix.join(relative(dir, dirname(mapFile)).split(sep).join('/'), s))
+    if (abs.startsWith('..') || posix.isAbsolute(abs) || /^[a-z]+:/i.test(s)) return { ok: false, reason: `the source ${s} lies outside the package` }
+    if (!/\.tsx?$/.test(abs)) continue
+    files.push({ path: abs, text })
+  }
+  if (files.length === 0) return { ok: false, reason: 'the source map carries no TypeScript sources (`sourcesContent`)' }
+  const bytes = files.reduce((a, f) => a + f.text.length, 0)
+  if (bytes > LIMITS.bytesPerPackage) return { ok: false, reason: `the sources are ${bytes} bytes (limit ${LIMITS.bytesPerPackage})` }
+  if (budget.bytes + bytes > LIMITS.totalBytes) return { ok: false, reason: 'the package-source budget of this build is spent' }
+  // Imports: relative ones must be in the map (the compiler would otherwise fail on them), bare ones are followed.
+  const have = new Set(files.map((f) => f.path))
+  const bare = new Set<string>()
+  const imported = new Set<string>()
+  for (const f of files) {
+    if (/\beval\s*\(|\bnew\s+Function\b/.test(f.text)) return { ok: false, reason: `${f.path} calls eval or new Function` }
+    let imports: { path: string; kind: string }[]
+    try {
+      imports = new Bun.Transpiler({ loader: f.path.endsWith('.tsx') ? 'tsx' : 'ts' }).scanImports(f.text)
+    } catch (e) {
+      return { ok: false, reason: `${f.path} does not parse: ${String(e instanceof Error ? e.message : e).split('\n')[0]}` }
+    }
+    for (const im of imports) {
+      // The JSX transform's own runtime import (the transpiler adds it), and React itself.
+      if (NEVER(im.path)) continue
+      if (im.kind === 'dynamic-import' || im.kind === 'require-call' || im.kind === 'require-resolve') return { ok: false, reason: `${f.path} has a ${im.kind} (${im.path})` }
+      if (im.path.startsWith('./') || im.path.startsWith('../')) {
+        const base = posix.normalize(posix.join(posix.dirname(f.path), im.path))
+        const hit = [base, `${base}.tsx`, `${base}.ts`, `${base}/index.tsx`, `${base}/index.ts`].find((c) => have.has(c))
+        if (hit) imported.add(hit)
+        else return { ok: false, reason: `${f.path} imports ${im.path}, which the source map does not carry` }
+      } else if (im.path.startsWith('/') || /^[a-z]+:/i.test(im.path)) return { ok: false, reason: `${f.path} imports ${im.path}` }
+      else bare.add(im.path)
+    }
+  }
+  // The entry source: the one `package.json#source` names, else the only source no other source imports.
+  const declared = typeof pj.source === 'string' ? posix.normalize(pj.source.replace(/^\.\//, '')) : null
+  const roots = files.filter((f) => !imported.has(f.path))
+  const entrySrc = files.find((f) => f.path === declared) ?? (roots.length === 1 ? roots[0] : undefined)
+  if (!entrySrc) return { ok: false, reason: `the source map has ${files.length} sources and none is the entry (no \`source\` field, ${roots.length} unimported)` }
+  // R34.62: the published file must be what these sources were built into.
+  let gaps: string[]
+  try {
+    gaps = integrityGaps(files, readFileSync(entry, 'utf8'))
+  } catch (e) {
+    return { ok: false, reason: `the integrity check could not read the sources or ${entryRel}: ${String(e instanceof Error ? e.message : e).split('\n')[0]}` }
+  }
+  if (gaps.length > 0) return { ok: false, reason: `the sources do not match the published ${entryRel} (${gaps.length} differences, first: ${gaps[0]})` }
+  // Keyed on where the package sits relative to the app (stable across machines), not its absolute path.
+  // Review F1 (security): no package-controlled text in the path. The directory is named by a hash of where the package
+  // sits relative to the app (stable across machines), and every target must resolve inside the directory this build
+  // owns before anything is created; a `name`/`version` of `../..` cannot move a write.
+  const hash = createHash('sha256').update(relative(appRoot, dir).split(sep).join('/')).digest('hex').slice(0, 16)
+  const outRel = posix.join(PKG_SRC_DIR, `p-${hash}`)
+  const own = resolve(appRoot, PKG_SRC_DIR) + sep
+  const targets = files.map((f) => ({ f, target: resolve(appRoot, outRel, f.path) }))
+  const escaped = targets.find((t) => !t.target.startsWith(own))
+  if (escaped) return { ok: false, reason: `the source ${escaped.f.path} would be written outside ${PKG_SRC_DIR}` }
+  for (const { f, target } of targets) {
+    mkdirSync(dirname(target), { recursive: true })
+    // The directories just made are this build's: a real path elsewhere means a link was planted in between.
+    if (!`${realpathSync(dirname(target))}${sep}`.startsWith(realpathSync(resolve(appRoot, PKG_SRC_DIR)) + sep))
+      return { ok: false, reason: `the source ${f.path} would be written outside ${PKG_SRC_DIR}` }
+    writeFileSync(target, f.text)
+  }
+  budget.bytes += bytes
+  return { ok: true, dir: outRel, entry: posix.join(outRel, entrySrc.path), imports: [...bare].sort() }
+}
+
+/**
+ * Writes the sources of every package `specs` reaches from the app (and of every package those sources import),
+ * and returns the resolution map for the compiler. The directory is rebuilt from nothing on every call.
+ */
+export function preparePackageSources(appRoot: string, specs: Iterable<string>): PackageSources {
+  const root = realpathSync(appRoot)
+  rmSync(join(root, PKG_SRC_DIR), { recursive: true, force: true })
+  mkdirSync(join(root, PKG_SRC_DIR), { recursive: true })
+  // The directory this build owns must itself be inside the app (`.brust` is not a link out of it).
+  if (!realpathSync(join(root, PKG_SRC_DIR)).startsWith(root + sep)) throw new BuildError('package-source', `${PKG_SRC_DIR} resolves outside the app root (a link?); remove it and build again`)
+  const out: PackageSources = { scopes: {}, refused: {}, dirs: {} }
+  writtenDirs.clear()
+  const byDir = new Map<string, Outcome>()
+  const budget = { bytes: 0 }
+  // (scope, the real directory bare imports resolve from, specifier)
+  const queue: [string, string, string][] = [...new Set(specs)].sort().map((s) => ['', root, s])
+  const seen = new Set<string>()
+  while (queue.length > 0) {
+    const [scope, from, spec] = queue.shift()!
+    const key = `${scope}\0${spec}`
+    if (seen.has(key) || NEVER(spec)) continue
+    seen.add(key)
+    const refuse = (reason: string) => {
+      ;(out.refused[scope] ??= {})[spec] = reason
+    }
+    const [name, sub] = splitSpecifier(spec)
+    if (sub) {
+      refuse('a package subpath import is not followed')
+      continue
+    }
+    const dir = findPackage(name, from)
+    if (!dir) {
+      refuse('not installed')
+      continue
+    }
+    let o = byDir.get(dir)
+    if (!o) {
+      try {
+        o = byDir.size >= LIMITS.packages ? { ok: false, reason: `more than ${LIMITS.packages} packages` } : writePackage(root, dir, budget)
+      } catch (e) {
+        // An unreadable package.json or map is a refusal: a package never fails the build here.
+        o = { ok: false, reason: `unreadable: ${String(e instanceof Error ? e.message : e).split('\n')[0]}` }
+      }
+      byDir.set(dir, o)
+      // A refusal is reported where it matters: the compiler names it on the island it leaves (`external-component`).
+      if (o.ok) {
+        out.dirs[o.dir] = dir
+        writtenDirs.set(join(root, o.dir), dir)
+        for (const im of o.imports) queue.push([o.dir, dir, im])
+      }
+    }
+    if (o.ok) (out.scopes[scope] ??= {})[spec] = o.entry
+    else refuse(o.reason)
+  }
+  mkdirSync(join(root, PKG_SRC_DIR), { recursive: true })
+  writeFileSync(join(root, PKG_SRC_DIR, 'index.json'), `${JSON.stringify(out, null, 2)}\n`)
+  return out
+}

package/src/build/tsconfig-paths.ts

@@ -0,0 +1,67 @@
+// `tsconfig` `paths` aliases (shadcn S1, R34.76): `import … from "@/components/ui/button"` is a file of the app. The compiler
+// resolves the specifiers that match an alias to the relative import of the file they name, from root-relative templates
+// this module reads out of the app's own `tsconfig.json` / `jsconfig.json`. v1 reads that one file: no `extends`, no
+// `references` (a named fallback below); exact and single-`*` patterns only. The bundler resolves the same specifiers
+// natively; `checkAliasAgreement` fails the build if the two ever disagree.
+import { existsSync, readFileSync, realpathSync } from 'node:fs'
+import { dirname, isAbsolute, join, normalize, relative, sep } from 'node:path'
+import { BuildError } from './errors'
+
+export interface PathAlias {
+  pattern: string
+  targets: string[]
+}
+
+const FILES = ['tsconfig.json', 'jsconfig.json']
+
+/** The aliases of the app's tsconfig, as root-relative `/`-separated templates; `notes` says what was left out and why. */
+export function readPathAliases(appRoot: string): { aliases: PathAlias[]; notes: string[] } {
+  const file = FILES.map((f) => join(appRoot, f)).find((f) => existsSync(f))
+  if (!file) return { aliases: [], notes: [] }
+  let json: { extends?: unknown; references?: unknown; compilerOptions?: { baseUrl?: unknown; paths?: unknown } }
+  try {
+    json = Bun.JSONC.parse(readFileSync(file, 'utf8')) as typeof json
+  } catch {
+    return { aliases: [], notes: [`${relative(appRoot, file)} could not be parsed; its \`paths\` aliases are not followed`] }
+  }
+  const notes: string[] = []
+  const paths = json?.compilerOptions?.paths
+  if (json?.extends !== undefined || json?.references !== undefined)
+    notes.push(
+      `${relative(appRoot, file)} uses \`${json.extends !== undefined ? 'extends' : 'references'}\`, which brust does not follow: \`paths\` aliases written in another tsconfig stay package imports (put \`paths\` in ${relative(appRoot, file)})`,
+    )
+  if (!paths || typeof paths !== 'object') return { aliases: [], notes }
+  const base = typeof json.compilerOptions?.baseUrl === 'string' ? json.compilerOptions.baseUrl : '.'
+  const aliases: PathAlias[] = []
+  for (const [pattern, raw] of Object.entries(paths as Record<string, unknown>)) {
+    const stars = pattern.split('*').length - 1
+    if (stars > 1 || !Array.isArray(raw)) {
+      notes.push(`the \`paths\` pattern "${pattern}" is not an exact or single-\`*\` pattern; it is not followed`)
+      continue
+    }
+    const targets: string[] = []
+    for (const t of raw) {
+      if (typeof t !== 'string' || (t.split('*').length - 1) > 1 || isAbsolute(t)) continue
+      const rel = normalize(join(base, t)).split(sep).join('/')
+      // Outside the app sources, or a package: not a file the compiler reads.
+      if (rel.startsWith('..') || rel.includes('node_modules/')) continue
+      targets.push(rel)
+    }
+    if (targets.length > 0) aliases.push({ pattern, targets })
+  }
+  return { aliases, notes }
+}
+
+/** The compiler's answer for every alias import must be the file the bundler resolves the same specifier to. */
+export function checkAliasAgreement(appRoot: string, imports: { from: string; spec: string; target: string }[]): void {
+  for (const { from, spec, target } of imports) {
+    let got: string
+    try {
+      got = realpathSync(Bun.resolveSync(spec, dirname(join(appRoot, from))))
+    } catch {
+      throw new BuildError('alias-mismatch', `${from}: the compiler resolves "${spec}" to ${target}, but the bundler cannot resolve it (check tsconfig \`paths\`)`)
+    }
+    if (got !== realpathSync(join(appRoot, target)))
+      throw new BuildError('alias-mismatch', `${from}: "${spec}" resolves to ${target} for the compiler but to ${relative(appRoot, got)} for the bundler (tsconfig \`paths\` is read differently); fix the alias or use a relative import`)
+  }
+}