@exodus/stasis 1.0.0-beta.1 → 1.0.0-beta.3

package/src/cmd/bundle.js

@@ -1,17 +1,19 @@
 import { isUtf8 } from 'node:buffer'
-import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from 'node:fs'
 import { dirname, extname, isAbsolute, join, posix, relative, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { brotliCompressSync } from 'node:zlib'
+import { brotliCompressSync, brotliDecompressSync } from 'node:zlib'
 
 import { Bundle } from '@exodus/stasis-core/bundle'
 import { Lockfile } from '@exodus/stasis-core/lockfile'
 import { scan } from '../scan.js'
 import { createFieldResolver, resolveConditions } from '../resolve-fields.js'
+import { createMetroResolver } from '../metro-resolver.js'
 import { State } from '@exodus/stasis-core/state'
 import { brotliOptions } from '@exodus/stasis-core/brotli'
 import { sha512integrity } from '@exodus/stasis-core/state-util'
-import { assertRealPathWithinBase, moduleFileKey, splitNodeModulesPath } from '@exodus/stasis-core/util'
+import { findPackageMetadata, normalizeEntries, packageType, readJson, readModuleManifest } from '@exodus/stasis-core/bundle-util'
+import { RN_CORE_INCLUDE_FILES, assertRealPathWithinBase, classifyNativeCapture, isExcludedNativeDir, isExecutableFile, isNativeArtifact, isNativeManifest, isPodspec, isSkippedNativeWalkDir, moduleFileKey, parseResourcesOption, refineNativeCapture, splitNodeModulesPath } from '@exodus/stasis-core/util'
 import {
   buildSolidityTree,
   collectSolidityFilesFromDisk,
@@ -31,16 +33,13 @@ const JS_EXTS = new Set(['.js', '.cjs', '.mjs', '.ts', '.cts', '.mts'])
 const BASH_EXTS = new Set(['.sh', '.bash'])
 const RUST_EXTS = new Set(['.rs'])
 
-// Fallback package identity for the workspace bucket when no package.json
-// with a name+version can be found by walking up from any of the bundled
-// files. Bundle.parse requires every workspace/module bucket to have
-// both fields, so we have to attest something.
+// Fallback identity for the workspace bucket; Bundle.parse requires every bucket to attest name+version.
 const SOLIDITY_WORKSPACE_NAME = 'solidity-bundle'
 const SOLIDITY_WORKSPACE_VERSION = '0.0.0'
 const SOLIDITY_FORMAT = 'solidity'
 const BASH_WORKSPACE_NAME = 'bash-bundle'
 const BASH_WORKSPACE_VERSION = '0.0.0'
-const BASH_FORMAT = 'bash'
+const SHELL_FORMAT = 'shell'
 
 const RUST_WORKSPACE_NAME = 'rust-bundle'
 const RUST_WORKSPACE_VERSION = '0.0.0'
@@ -50,47 +49,8 @@ const PHP_WORKSPACE_NAME = 'php-bundle'
 const PHP_WORKSPACE_VERSION = '0.0.0'
 const PHP_FORMAT = 'php'
 
-// Walk up from the file's directory looking for the nearest package.json
-// with both `name` and `version`. Returns { pkgDir, name, version }
-// (pkgDir relative to `baseDir`, "." for the project root) or null when no
-// such package.json exists at or above the file.
-function findPackageMetadata(baseDir, fileRelPath) {
-  let dir = dirname(fileRelPath)
-  while (true) {
-    const pkgPath = join(baseDir, dir, 'package.json')
-    if (existsSync(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
-        if (pkg.name && pkg.version) {
-          return { pkgDir: dir, name: pkg.name, version: pkg.version }
-        }
-      } catch { /* malformed — keep walking */ }
-    }
-    if (dir === '.' || dir === '/' || dir === '') return null
-    const parent = dirname(dir)
-    if (parent === dir) return null
-    dir = parent
-  }
-}
-
-function normalizeEntries(entries, cwd) {
-  const baseDir = resolve(cwd)
-  return entries.map((e) => {
-    const abs = resolve(cwd, e)
-    const rel = relative(baseDir, abs).split(/[\\/]/u).join('/')
-    // On Windows, `path.relative()` returns an absolute path when `abs` is on
-    // a different drive than `baseDir` — that wouldn't start with `..` but
-    // still escapes, so reject both forms.
-    if (rel.startsWith('..') || isAbsolute(rel)) throw new Error(`Entry escapes baseDir: ${e}`)
-    return rel.replace(/^\.\//u, '')
-  })
-}
-
-// Deepest directory that is a parent of every file in `paths`, expressed
-// relative to `cwd`. `paths` may be POSIX-relative-to-cwd; entries that
-// escape cwd (e.g. `../deps/X.sol` via remapping) push the result above
-// cwd, in which case the returned path starts with `..`. Returns "." when
-// the outermost directory IS cwd itself.
+// Deepest common parent dir of `paths`, relative to `cwd`; starts with `..` when entries
+// escape cwd (e.g. via remapping), or "." when it is cwd itself.
 export function outermostDir(paths, cwd) {
   if (paths.length === 0) return '.'
   const cwdAbs = posix.resolve(cwd.replaceAll(/\\/gu, '/'))
@@ -107,35 +67,21 @@ export function outermostDir(paths, cwd) {
   return rel === '' ? '.' : rel
 }
 
-function readJson(file) {
-  try {
-    return JSON.parse(readFileSync(file, 'utf8'))
-  } catch {
-    return null
-  }
-}
-
-// Split a Soldeer dependency dir name (`<name>-<version>`) into its parts, e.g.
-// `@openzeppelin-contracts-5.0.2` -> { name: '@openzeppelin-contracts',
-// version: '5.0.2' }. Soldeer encodes the version into the directory name, so
-// that's the authoritative identity for a Soldeer package. Falls back to
-// version 0.0.0 when the dir doesn't end in a semver (every bucket must attest
-// a version).
+// Split a Soldeer dep dir `<name>-<version>` (its authoritative identity); falls back to
+// version 0.0.0 when it doesn't end in a semver (every bucket must attest a version).
 function parseSoldeerDir(seg) {
   const m = /^(.+)-(\d+\.\d+\.\d+(?:[-+][\w.-]+)?)$/u.exec(seg)
   return m ? { name: m[1], version: m[2] } : { name: seg, version: '0.0.0' }
 }
 
-// Extract `owner/repo` from a github.com remote (https, ssh, or scp-style),
-// dropping a trailing `.git`. Returns null for non-github hosts.
+// Extract `owner/repo` from a github.com remote (https/ssh/scp); null for non-github hosts.
 function githubSlug(url) {
   const m = /github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?\/?$/iu.exec(url)
   return m ? `${m[1]}/${m[2]}` : null
 }
 
-// Parse `.gitmodules` into Map<submodulePath, { name, branch }>, keeping only
-// github.com submodules (the ones we can attribute as `github`). `.gitmodules`
-// is git-config INI: `[submodule "<n>"]` sections with `path`/`url`/`branch`.
+// Parse `.gitmodules` (git-config INI) into Map<submodulePath, { name, branch }>,
+// github.com submodules only.
 function parseGithubSubmodules(baseDir) {
   const byPath = new Map()
   const text = readFileSyncOrNull(join(baseDir, '.gitmodules'))
@@ -173,13 +119,9 @@ function readFileSyncOrNull(file) {
   }
 }
 
-// Classify a bundled Solidity file into its dependency bucket. Solidity installs
-// deps three ways, each its own ecosystem: npm (`node_modules`, left to the
-// shared bucketizer), Soldeer (`dependencies/<name>-<version>/` → `soldeer`),
-// and `forge install` git submodules (`lib/<dir>/`, when `.gitmodules` records a
-// github.com URL → `github`, per SBOM/Package-URL `pkg:github/owner/repo`).
-// Returns { bucketDir, name, version, ecosystem } for a Soldeer/github dep, or
-// null to defer to the package.json/node_modules/workspace logic.
+// Classify a Solidity file's dep bucket: Soldeer (`dependencies/<name>-<version>/`) or a
+// github submodule (`lib/`, via `.gitmodules`), else null to defer to the node_modules/
+// workspace logic.
 function makeSolidityClassifier(baseDir) {
   const submodules = parseGithubSubmodules(baseDir)
   return (path) => {
@@ -200,9 +142,7 @@ function makeSolidityClassifier(baseDir) {
   }
 }
 
-// Minimal Cargo.toml reader: pull `name`/`version` from the `[package]` table.
-// A full TOML parse isn't warranted — those two string keys are all we need to
-// identify a vendored crate. Returns null when there's no readable package name.
+// Minimal Cargo.toml reader: name/version from the `[package]` table; null when no name.
 function parseCargoToml(file) {
   const text = readFileSyncOrNull(file)
   if (!text) return null
@@ -210,7 +150,7 @@ function parseCargoToml(file) {
   let body = text
   if (at !== -1) {
     const rest = text.slice(at)
-    const next = rest.slice(1).search(/^\[/mu) // start of the table after [package]
+    const next = rest.slice(1).search(/^\[/mu)
     body = next === -1 ? rest : rest.slice(0, next + 1)
   }
   const name = /^\s*name\s*=\s*"([^"]+)"/mu.exec(body)?.[1]
@@ -218,10 +158,8 @@ function parseCargoToml(file) {
   return name ? { name, version: version ?? '0.0.0' } : null
 }
 
-// Classify a bundled Rust file. `cargo vendor` copies external crates in-tree
-// under `vendor/<dir>/`; each is its own crate with a Cargo.toml, so bucket it
-// under `vendor/<dir>` and tag it `cargo` (Package-URL `pkg:cargo/<name>`). The
-// workspace's own code and path/workspace members defer to the workspace logic.
+// Classify a Rust file: `cargo vendor` crates under `vendor/<dir>/` (tagged `cargo`), else
+// null to defer to the workspace logic.
 function makeRustClassifier(baseDir) {
   return (path) => {
     if (!path.startsWith('vendor/')) return null
@@ -233,44 +171,24 @@ function makeRustClassifier(baseDir) {
   }
 }
 
-// Assemble a scope=full code Bundle from a collected source set and its
-// resolution graph. Shared by every non-JS bundler (Solidity/Bash/Rust): the
-// language-specific work (collecting files, resolving the graph, deciding what
-// counts as "missing") happens in the caller; here every file is bucketized
-// the same way, tagged `format`, and the whole resolution graph is keyed under
-// a single `conditionKey`.
-//
-// Files are partitioned into per-package buckets by the nearest package.json
-// with name+version: node_modules files into `node_modules/<pkg>` buckets,
-// workspace files into their package dir, and anything with no discoverable
-// package.json into the "." bucket with the given placeholder identity (the
-// Bundle layout requires every bucket to attest a name+version). A file under
-// node_modules whose nearest package.json is the workspace root is rejected —
-// that hides a misconfigured dependency rather than silently mislabeling it.
-//
-// Unlike the wildcard "*" JS bundles use, these formats don't vary by Node
-// resolution condition, so every edge lands under the one `conditionKey`.
-//
-// Dependency buckets (those under node_modules) are tagged `ecosystem: 'npm'`:
-// node_modules is npm's install layout, so that's where the package came from,
-// regardless of the bundle's language — a Solidity or Bash import resolved out
-// of node_modules is an npm package all the same. This mirrors State's own
-// node_modules tagging (see stasis-core state.js) and lets consumers tell deps
-// apart from the workspace's own packages; the workspace/`.` bucket carries no
-// ecosystem. (PHP's Composer `vendor/` deps are tagged `composer` separately, by
-// the PHP bucketizer.)
-//
-// `classifyDep(path)` is an optional language-specific hook: when it returns a
-// { bucketDir, name, version, ecosystem } record the file is placed there
-// directly, which is how non-node_modules ecosystems are attributed (e.g.
-// Solidity's Soldeer `dependencies/` and github submodules). Returning null (or
-// omitting the hook) defers to the node_modules/package.json/workspace logic.
-// `format` tags every file uniformly (the single-language non-JS callers); pass
-// `formats` (a Map<path, format>) instead to tag per file, as the JS resolver path
-// does (a graph mixes module / commonjs / *-typescript / json). `resolutions`
-// values may be a target string (a flat edge) or a Map<platform, target> (a `--metro`
-// edge that resolves differently per platform) -- both round-trip through the bundle's
-// recursive serializer untouched.
+// Project-relative paths in `sources` whose on-disk file carries a POSIX execute bit -- the
+// `executable` list both artifacts record. The State-driven path derives this in addFile; the
+// static builders never touch a State, so they stat here.
+function executableSources(baseDir, sources) {
+  const executable = new Set()
+  for (const path of sources.keys()) {
+    if (isExecutableFile(join(baseDir, path))) executable.add(path)
+  }
+  return executable
+}
+
+// Assemble a full-scope code Bundle shared by the non-JS bundlers. Files are bucketed by
+// nearest package.json (node_modules -> `npm`-tagged bucket, workspace -> its dir, none ->
+// "." with the placeholder identity); a node_modules file whose nearest package.json is the
+// workspace root is rejected, not mislabeled. `classifyDep(path)` optionally places a file
+// directly (non-node_modules ecosystems like Soldeer/github); null defers. `format` tags
+// every file, or pass `formats` (Map<path,format>) to tag per file. `resolutions` values are
+// a flat target string or a Map<platform,target>; both round-trip untouched.
 function assembleCodeBundle({
   baseDir, entries, sources, resolutions, workspaceName, workspaceVersion, format, formats, conditionKey, classifyDep,
 }) {
@@ -313,19 +231,23 @@ function assembleCodeBundle({
   for (const [parent, specMap] of resolutions) importsForKey.set(parent, specMap)
   const imports = new Map([[conditionKey, importsForKey]])
 
+  // Executable bits, straight off disk (a synthetic source with no file there is simply not
+  // executable). Shell bundles lean on this most: `stasis extract` puts the +x back on the scripts.
+  const executable = executableSources(baseDir, sources)
+
+  // Attribute files to the `bundle` consumer (static builders skip State's per-file tagging).
   return new Bundle({
     config: { scope: 'full' },
     entries: new Set(entries),
     modules,
     formats: formatsMap,
     imports,
-  })
+    executable,
+  }).withReason('bundle')
 }
 
-// Build a stasis Bundle (in-memory) from a list of entry .sol files and
-// an optional mapping file. The mapping file (foundry.toml or
-// remappings.txt) is parsed for remappings but NOT included in the
-// bundle's sources. Returns the constructed `Bundle`.
+// Build an in-memory Bundle from entry .sol files; `mappingFile` (foundry.toml/remappings.txt)
+// is parsed for remappings but not bundled.
 export async function buildSolidityBundle({ cwd = process.cwd(), entries, mappingFile } = {}) {
   if (!Array.isArray(entries) || entries.length === 0) {
     throw new Error('buildSolidityBundle: at least one entry .sol file is required')
@@ -341,10 +263,7 @@ export async function buildSolidityBundle({ cwd = process.cwd(), entries, mappin
   const sources = await collectSolidityFilesFromDisk(baseDir, normalized, remappings)
   const { resolutions, missing } = buildSolidityTree(sources, { remappings, baseDir })
 
-  // Bundles must be self-contained. Refuse to write one when an entry
-  // can't be loaded from disk, or when any in-bundle file has an import
-  // we couldn't resolve — otherwise downstream consumers would silently
-  // operate on a partial set of sources.
+  // Bundles must be self-contained: fail on a missing entry or unresolved import.
   const issues = []
   for (const entry of normalized) {
     if (!sources.has(entry)) issues.push(`Missing entry: ${entry}`)
@@ -369,19 +288,9 @@ export async function buildSolidityBundle({ cwd = process.cwd(), entries, mappin
   })
 }
 
-// Build a stasis Bundle (in-memory) from a list of entry .sh/.bash files by
-// walking the source/exec graph and reading every reachable script from disk.
-// Mirrors buildSolidityBundle's bucketizing, with a bash-specific policy:
-//   - a .sh/.bash reference whose path lands INSIDE the bundle root
-//     (`source ./lib.sh`, `dir/x.sh`) but resolves to no bundled script is
-//     fatal — a self-contained bundle can't carry a dangling local source —
-//     as is a missing entry.
-//   - everything else is best-effort and dropped: PATH commands (`grep`,
-//     `node`), dynamic `$VAR` paths, extensionless sources, absolute system
-//     paths (`source /etc/profile.d/x.sh`), and `../` paths that escape the
-//     root — none can live in the bundle.
-//   - imports live under a dedicated "bash" condition key (like "solidity"),
-//     not the JS-bundle wildcard "*".
+// Build an in-memory Bundle from entry .sh/.bash files by walking the source/exec graph.
+// A local `source` inside the bundle root that resolves to no bundled script is fatal;
+// external refs (PATH commands, `$VAR`, absolute, `../`-escaping) are dropped.
 export async function buildBashBundle({ cwd = process.cwd(), entries } = {}) {
   if (!Array.isArray(entries) || entries.length === 0) {
     throw new Error('buildBashBundle: at least one entry .sh/.bash file is required')
@@ -396,11 +305,7 @@ export async function buildBashBundle({ cwd = process.cwd(), entries } = {}) {
   const sources = await collectBashFilesFromDisk(baseDir, normalized)
   const { resolutions, missing } = buildBashTree(sources)
 
-  // Bundles must be self-contained: every entry must load, and every .sh/.bash
-  // reference pointing inside the bundle root must resolve to a bundled script.
-  // External/best-effort references (commands, $VAR paths, extensionless,
-  // absolute, or `../`-escaping sources) are left out by buildBashTree and
-  // never reach `missing`.
+  // Self-contained: fail on a missing entry or unresolved in-root script (external refs never reach `missing`).
   const issues = []
   for (const entry of normalized) {
     if (!sources.has(entry)) issues.push(`Missing entry: ${entry}`)
@@ -419,19 +324,14 @@ export async function buildBashBundle({ cwd = process.cwd(), entries } = {}) {
     resolutions,
     workspaceName: BASH_WORKSPACE_NAME,
     workspaceVersion: BASH_WORKSPACE_VERSION,
-    format: BASH_FORMAT,
-    conditionKey: 'bash',
+    format: SHELL_FORMAT,
+    conditionKey: SHELL_FORMAT,
   })
 }
 
-// Build a stasis Bundle (in-memory) from a list of entry .rs files by walking
-// `mod` declarations from each crate root and reading every reachable module
-// from disk. The bundle must be self-contained: an unresolvable `mod foo;`
-// (no backing file) is fatal, as is a missing entry. `use crate::` edges are
-// recorded in the import graph but stay best-effort — they never widen the
-// file set, and their resolution is approximate (item-vs-module, re-exports),
-// so they aren't gated; external crates and std are ignored outright. Imports
-// live under a dedicated "rust" condition key.
+// Build an in-memory Bundle from entry .rs files by walking `mod` declarations. An
+// unresolvable `mod` is fatal; `use crate::` edges are recorded best-effort (never widen
+// the file set, not gated).
 export async function buildRustBundle({ cwd = process.cwd(), entries } = {}) {
   if (!Array.isArray(entries) || entries.length === 0) {
     throw new Error('buildRustBundle: at least one entry .rs file is required')
@@ -470,25 +370,10 @@ export async function buildRustBundle({ cwd = process.cwd(), entries } = {}) {
   })
 }
 
-// Build a stasis Bundle (in-memory) from a list of entry .php files by
-// statically scanning their `require`/`include` graph -- and, when the project
-// uses Composer, the class-autoload graph too -- reading every reachable file
-// from disk. No PHP is ever executed. Mirrors buildSolidityBundle: files are
-// bucketed per package.json, tagged with the `php` format, and edges are keyed
-// under a dedicated "php" condition bucket.
-//
-// Composer autoloading is followed automatically when a composer.json (or
-// generated vendor/composer/autoload_*.php map) is present: PSR-4/PSR-0/
-// classmap/files config is read and the classes each file references (`use`
-// imports, `new`/`extends`/`implements`, type hints, …) are resolved to their
-// files the way Composer's ClassLoader would. That resolution is best-effort
-// (unresolvable references are typically built-in or extension classes), so it
-// never blocks the bundle; explicit `require`/`include` of a literal path is
-// still strict.
-//
-// Refuses to write when an entry can't be loaded or any explicit include is
-// unresolved -- a bundle with holes would silently operate on a partial set of
-// sources.
+// Build an in-memory Bundle from entry .php files by statically scanning the
+// require/include graph (and Composer's class-autoload graph when present); no PHP is
+// executed. Autoload resolution is best-effort; explicit require/include of a literal path
+// is strict, and a missing entry or unresolved explicit include is fatal.
 export async function buildPhpBundle({ cwd = process.cwd(), entries } = {}) {
   if (!Array.isArray(entries) || entries.length === 0) {
     throw new Error('buildPhpBundle: at least one entry .php file is required')
@@ -501,9 +386,8 @@ export async function buildPhpBundle({ cwd = process.cwd(), entries } = {}) {
   const normalized = normalizeEntries(entries, cwd)
   const autoload = loadComposerAutoload(baseDir)
 
-  // Laravel auto-discovers vendor/app service providers (via composer metadata
-  // and bootstrap/providers.php) rather than referencing them statically; seed
-  // them as extra roots so the config/route/view files they pull in get bundled.
+  // Laravel auto-discovers service providers rather than referencing them statically; seed
+  // them as extra roots so their config/route/view files get bundled.
   const providerRoots = loadLaravelProviderFiles(baseDir, autoload)
 
   const sources = await collectPhpFilesFromDisk(baseDir, [...normalized, ...providerRoots], { autoload })
@@ -520,38 +404,46 @@ export async function buildPhpBundle({ cwd = process.cwd(), entries } = {}) {
     throw new Error(`PHP bundle has unresolved imports:\n${issues.map((s) => `  ${s}`).join('\n')}`)
   }
 
-  // Group per Composer package (vendor/<pkg> buckets with name+version from
-  // composer.json / installed.json), not the node_modules-based bucketizer.
+  // Group per Composer package (vendor/<pkg>), not the node_modules bucketizer.
   const modules = bucketizePhpSources(baseDir, sources, PHP_WORKSPACE_NAME, PHP_WORKSPACE_VERSION)
 
   const formats = new Map()
   for (const path of sources.keys()) formats.set(path, PHP_FORMAT)
 
-  // PHP includes don't depend on Node conditions; key them under a dedicated
-  // "php" bucket rather than the wildcard "*" used for JS code bundles.
+  // PHP includes don't vary by Node condition; key edges under "php", not the JS wildcard "*".
   const importsForKey = new Map()
   for (const [parent, specMap] of resolutions) importsForKey.set(parent, specMap)
   const imports = new Map([['php', importsForKey]])
 
+  // Attribute to the `bundle` consumer, like the other static builders.
   return new Bundle({
     config: { scope: 'full' },
     entries: new Set(normalized),
     modules,
     formats,
     imports,
-  })
+    executable: executableSources(baseDir, sources),
+  }).withReason('bundle')
+}
+
+// Render a scanned file URL for diagnostics: project-relative when inside `baseDir`, else absolute.
+// The scan issue checks run on the LIVE scan, whose files/imports are keyed by absolute file: URLs
+// (the resolver returns absolute paths); relativizing here matches the project-relative paths the
+// bundle itself stores (toRel), rather than leaking the machine's absolute paths into the message.
+function displayPath(url, baseDir) {
+  const abs = fileURLToPath(url)
+  if (!baseDir) return abs
+  const rel = relative(baseDir, abs)
+  return rel && !rel.startsWith('..') && !isAbsolute(rel) ? rel : abs
 }
 
-// Classify a scanner's unresolved edges + parse errors into `fatal` (the bundle
-// would be broken, or silently divergent from plain node, at load) vs tolerated
-// (a miss runtime code can catch). The rationale for each rule lives at the call
-// site in buildJsBundle; this is the shared computation so the plain and the
-// resolver-driven (`--mainFields`) JS paths gate identically.
-function analyzeScanner(scanner) {
-  // Static reachability: files reached from an entry through static ESM
-  // `import`/`export ... from` edges load eagerly, before any user code runs, so
-  // a failure there is uncatchable; below a require()/dynamic-import() boundary it
-  // surfaces as a catchable miss and only warns.
+// Classify scanner unresolved edges + parse errors into fatal (broken/divergent at load)
+// vs tolerated (a catchable runtime miss). Shared so the plain and --mainFields JS paths
+// gate identically. `baseDir` relativizes the paths in the emitted messages (see displayPath).
+function analyzeScanner(scanner, { baseDir } = {}) {
+  const show = (url) => displayPath(url, baseDir)
+  // Static ESM import/export-from edges load eagerly before user code, so a failure there is
+  // uncatchable (fatal); misses below a require()/dynamic-import() boundary are catchable (warn).
   const staticKinds = new Set(['import', 'export-from'])
   const staticReachable = new Set(scanner.entries)
   const walk = [...scanner.entries]
@@ -566,20 +458,19 @@ function analyzeScanner(scanner) {
   const fatalUnresolved = (u) => staticKinds.has(u.kind) && staticReachable.has(u.parentURL)
   const fatal = scanner.unresolved
     .filter((u) => fatalUnresolved(u))
-    .map((u) => `unresolved ${u.kind} ${u.spec} from ${fileURLToPath(u.parentURL)} (${u.reason})`)
-  // Parse failures whose edges are genuinely unknown: a module-family file in the
-  // eagerly-linked set, or any file the parser couldn't process at all.
+    .map((u) => `unresolved ${u.kind} ${u.spec} from ${show(u.parentURL)} (${u.reason})`)
+  // Fatal parse: an eagerly-linked module-family file, or any file the parser couldn't process.
   const fatalParse = (p) => staticReachable.has(p.url) && (p.format?.startsWith('module') === true || !p.recovered)
   for (const p of scanner.parseErrors) {
-    if (fatalParse(p)) fatal.push(`parse error in ${fileURLToPath(p.url)}: ${p.message}`)
+    if (fatalParse(p)) fatal.push(`parse error in ${show(p.url)}: ${p.message}`)
   }
-  // Edges resolving to a file a source bundle can't carry (extensionless, .node,
-  // .wasm): scan records the edge but never queues the child, so load would die.
+  // Edge resolving to a file a source bundle can't carry (.node/.wasm/extensionless): scan
+  // records it but never queues the child, so load would die.
   for (const [, byParent] of scanner.imports) {
     for (const [parentURL, specMap] of byParent) {
       for (const [spec, childURL] of specMap) {
         if (!scanner.files.has(childURL)) {
-          fatal.push(`${spec} from ${fileURLToPath(parentURL)} resolves to ${fileURLToPath(childURL)}, which a source bundle can't carry`)
+          fatal.push(`${spec} from ${show(parentURL)} resolves to ${show(childURL)}, which a source bundle can't carry`)
         }
       }
     }
@@ -589,10 +480,11 @@ function analyzeScanner(scanner) {
   return { fatal, tolerated, toleratedParse }
 }
 
-// Throw on any fatal scan issue (the bundle can't be written); warn on tolerated
-// ones. `label`, when set, tags the scan pass in the message.
-function reportScanIssues({ fatal, tolerated, toleratedParse }, { label = '' } = {}) {
+// Throw on fatal scan issues; warn on tolerated ones. `label` tags the scan pass; `baseDir`
+// relativizes the paths in the warnings (see displayPath), matching analyzeScanner's messages.
+function reportScanIssues({ fatal, tolerated, toleratedParse }, { label = '', baseDir } = {}) {
   const where = label ? ` (${label})` : ''
+  const show = (url) => displayPath(url, baseDir)
   if (fatal.length > 0) {
     const shown = fatal.slice(0, 10).map((s) => `  ${s}`).join('\n')
     const more = fatal.length > 10 ? `\n  ... and ${fatal.length - 10} more` : ''
@@ -601,7 +493,7 @@ function reportScanIssues({ fatal, tolerated, toleratedParse }, { label = '' } =
   if (tolerated.length > 0) {
     const summary = tolerated
       .slice(0, 10)
-      .map((u) => `  ${u.kind} ${u.spec ?? '<dynamic>'} from ${fileURLToPath(u.parentURL)} (${u.reason})`)
+      .map((u) => `  ${u.kind} ${u.spec ?? '<dynamic>'} from ${show(u.parentURL)} (${u.reason})`)
       .join('\n')
     const more = tolerated.length > 10 ? `\n  ... and ${tolerated.length - 10} more` : ''
     console.warn(`[stasis] Bundle has ${tolerated.length} unresolved import(s)${where}; they will fall through at load time:\n${summary}${more}`)
@@ -609,47 +501,19 @@ function reportScanIssues({ fatal, tolerated, toleratedParse }, { label = '' } =
   if (toleratedParse.length > 0) {
     const summary = toleratedParse
       .slice(0, 10)
-      .map((p) => `  ${fileURLToPath(p.url)}: ${p.message}`)
+      .map((p) => `  ${show(p.url)}: ${p.message}`)
       .join('\n')
     const more = toleratedParse.length > 10 ? `\n  ... and ${toleratedParse.length - 10} more` : ''
     console.warn(`[stasis] Bundle has ${toleratedParse.length} file(s) with parse errors${where}; their recorded imports may be incomplete:\n${summary}${more}`)
   }
 }
 
-// Build a stasis Bundle (in-memory) from a list of entry .js/.cjs/.mjs (or
-// .ts/.cts/.mts) files by statically scanning the require/import graph and
-// reading reachable file contents from disk -- no user code is ever loaded or
-// executed. TypeScript files behave exactly like JS ones: sources are stored
-// verbatim with Node's type-stripping formats recorded, and Node strips the
-// types at load time. The bundle shape matches what @exodus/stasis-core/hooks
-// records at runtime, so the result loads via `stasis run --bundle=load`
-// interchangeably with a runtime-produced one.
-//
-// Refuses to write when the bundle is guaranteed broken (or silently divergent
-// from plain node) at load time: an unresolved static ESM `import`/`export ...
-// from` edge reachable from an entry through static edges alone (link-time,
-// uncatchable), a module file that can't be parsed (its static edges are
-// unknown), or an edge resolving to a file a source bundle can't carry
-// (extensionless, .node, .wasm). Failures that runtime code can catch --
-// unresolved require()/dynamic import() edges, including entire subtrees
-// behind such a boundary -- only warn (see below).
-//
-// Scope comes from the project's stasis.config.json (or `EXODUS_STASIS_SCOPE`);
-// pass `scope` explicitly to override.
-//
-// `conditions` are extra `exports`/`imports` resolution conditions, merged on top
-// of the format-derived base set Node always asserts (`node`, `import`/`require`,
-// `module-sync`, `node-addons`). They change which branch of a package's
-// conditional `exports` the static scan follows -- and therefore which file lands
-// in the bundle -- exactly as if Node resolved with those conditions active. Empty
-// (the default) reproduces plain Node resolution.
-//
-// NOTE: conditions are only one input to module resolution. On their own they do
-// NOT honour legacy package `mainFields` (`react-native`/`browser`/`main`) or
-// platform-specific file suffixes (`.ios`/`.android`/`.native`), neither of which
-// the `exports` field expresses; `--mainFields` (see buildResolvedJsBundle) adds
-// the former.
-export async function buildJsBundle({ cwd = process.cwd(), entries, scope, conditions = [] } = {}) {
+// Build a JS/TS Bundle (in-memory) by statically scanning the require/import graph; no
+// user code is executed, and TS is stored verbatim (Node strips types at load). Scope comes
+// from stasis.config.json / `EXODUS_STASIS_SCOPE` unless `scope` overrides. `conditions` are
+// extra `exports`/`imports` conditions; on their own they don't honour legacy mainFields or
+// platform suffixes (see `--mainFields` / buildResolvedJsBundle).
+export async function buildJsBundle({ cwd = process.cwd(), entries, scope, conditions = [], jsx = false, flow = false, resources = [], packageJSON = false } = {}) {
   if (!Array.isArray(entries) || entries.length === 0) {
     throw new Error('buildJsBundle: at least one entry .js/.cjs/.mjs/.ts/.cts/.mts file is required')
   }
@@ -660,84 +524,138 @@ export async function buildJsBundle({ cwd = process.cwd(), entries, scope, condi
   const baseDir = resolve(cwd)
   const absEntries = entries.map((e) => resolve(baseDir, e))
 
-  // Normalize conditions the way the CLI already does (trim, drop empties), so the
-  // programmatic API (`buildBundle({ conditions })`) tolerates the same sloppy input.
-  // A '' or whitespace-only condition never matches an `exports` key, so dropping it
-  // is a no-op for clean input -- this just stops a bogus token reaching the resolver.
+  // Normalize conditions (trim, drop empties) so a sloppy programmatic caller can't push a
+  // bogus token into the resolver.
   const scanConditions = conditions.map((c) => (typeof c === 'string' ? c.trim() : c)).filter(Boolean)
+  // --resources: extensions/filenames carried as opaque assets instead of failing "can't carry".
+  const resourceSet = parseResourcesOption('buildJsBundle', resources)
 
-  const scanner = scan(absEntries, { conditions: scanConditions })
-
-  // Fail closed exactly where the bundle is GUARANTEED broken (or silently
-  // divergent from plain node) at load time; warn where runtime code can catch
-  // the miss the same way it would without a bundle. Static ESM edges load
-  // eagerly (uncatchable) so unresolved ones / unknown parse holes there are
-  // fatal; require()/dynamic-import() misses surface at the callsite and only
-  // warn -- the optional-dependency pattern (`try { require(x) } catch {}`) keeps
-  // bundling, because the runtime loader never records those edges either and
-  // state.getImport throws the same catchable MODULE_NOT_FOUND at load. Edges
-  // resolving to a file a source bundle can't carry are always fatal. (See
-  // analyzeScanner for the precise rules.)
-  reportScanIssues(analyzeScanner(scanner))
-
-  // Use a non-preload State to materialise the bundle: addFile bucketizes by
-  // package.json + records hashes/sources/formats, and addImport replays the
-  // per-edge import map. State.s `serialize` then emits the same v1 layout
-  // the runtime loader writes — see @exodus/stasis-core/hooks for the matching pair.
-  //
-  // bundle=replace skips reading any pre-existing stasis.code.br on disk;
-  // bundle=add would merge it, leaking stale formats/imports entries for
-  // files the new bundle doesn't carry. lock=ignore tolerates a pre-existing
-  // stasis.lock.json without loading or validating it (the bundle path
-  // doesn't consume one), and refusing to coexist with one (lock=none) would
-  // make `stasis bundle` brittle in any project that's also using `stasis run`.
+  const scanner = scan(absEntries, { conditions: scanConditions, jsx, flow, resources: resourceSet })
+
+  // Fail closed where the bundle is guaranteed broken at load; warn on catchable misses (see analyzeScanner).
+  reportScanIssues(analyzeScanner(scanner, { baseDir }), { baseDir })
+
+  // Materialise via a non-preload State: addFile bucketizes + records sources/formats,
+  // addImport replays the edge map; serialize emits the runtime loader's v1 layout.
+  // bundle:'replace' skips reading any on-disk stasis.code.br (bundle:'add' would leak stale
+  // entries); lock:'ignore' tolerates a pre-existing lockfile without consuming it.
   const state = new State(baseDir, { bundle: 'replace', lock: 'ignore', ...(scope ? { scope } : {}) })
   for (const [url, info] of scanner.files) {
+    // A resource carries bytes only: addFile derives resource vs resource:base64 from the content
+    // and stores it under `resources` (a resource can't be an entry, so no isEntry).
+    if (info.resource) {
+      state.addFile(url, { resource: true })
+      continue
+    }
     const isEntry = scanner.entries.has(url)
     state.addFile(url, { format: info.format, isEntry })
   }
-  // Static bundles can't anticipate the full condition set Node will pass to
-  // its resolve hook at load time (Node adds runtime conditions like
-  // 'module-sync', 'node-addons' that aren't accept-list conditions). Store
-  // every edge under the wildcard '*' key; State.getImport falls back to it
-  // when the runtime-condition lookup misses.
-  for (const [, byParent] of scanner.imports) {
-    for (const [parentURL, specs] of byParent) {
+  // Edges where every context agrees keep the wildcard '*' key (getImport's fallback when a
+  // condition lookup misses). Where the require()- and import()-context resolutions of one
+  // (parent, specifier) DIVERGE, each target keeps its real condition key -- one '*' entry
+  // would serve one context the other's file; an unmatched set fails closed via resolveBundled.
+  const byParent = new Map()
+  for (const [key, parents] of scanner.imports) {
+    for (const [parentURL, specs] of parents) {
+      if (!byParent.has(parentURL)) byParent.set(parentURL, new Map())
+      const bySpec = byParent.get(parentURL)
       for (const [spec, childURL] of specs) {
-        state.addImport(parentURL, spec, childURL, { conditions: '*' })
+        if (!bySpec.has(spec)) bySpec.set(spec, new Map())
+        bySpec.get(spec).set(key, childURL)
+      }
+    }
+  }
+  for (const [parentURL, bySpec] of byParent) {
+    for (const [spec, byKey] of bySpec) {
+      const targets = new Set(byKey.values())
+      if (targets.size === 1) {
+        state.addImport(parentURL, spec, [...targets][0], { conditions: '*' })
+      } else {
+        for (const [key, childURL] of byKey) {
+          state.addImport(parentURL, spec, childURL, { conditions: key.split(', ') })
+        }
       }
     }
   }
+  // --package-json: fold each bundled module's package.json into the State's buckets (idempotent --
+  // no-ops any manifest the scan already reached). State's bundle=replace makes writeBundle true, so addFile accepts them.
+  if (packageJSON) state.includePackageJson()
   return state
 }
 
-// Source extensions probed when a resolved entry/redirect target names no extension.
-// Limited to what a source bundle can actually carry (scan's RESOLVABLE_EXTS), so the
-// resolver never resolves a file the bundle would then reject. `--mainFields` lets a
-// caller pick its own fields, `--metro` presets the React Native fields, and
-// `--conditions` adds its own extra exports conditions.
+// Extensions probed when a resolved target names none. Limited to what a source bundle can
+// carry (scan's RESOLVABLE_EXTS) so the resolver never resolves a file the bundle would reject.
+// --jsx widens this to the JSX/TSX extensions (mirroring scan's jsx-gated RESOLVABLE_EXTS) so an
+// extensionless `import './Foo'` can land on Foo.jsx/Foo.tsx, as Metro's sourceExts do. `.js`/`.ts`
+// keep their existing precedence (base order preserved as a subsequence); collisions across the
+// added extensions are rare and, like the base list, don't track the project's real Metro order.
 const SOURCE_EXTS = ['js', 'json', 'ts']
-// React Native preset mainFields asserted by `--metro` (which sets these plus the
-// react-native/browser conditions and platform suffixes, so the user supplies neither
-// --mainFields nor --conditions alongside it).
+const SOURCE_EXTS_JSX = ['js', 'jsx', 'json', 'ts', 'tsx']
+// React Native preset mainFields for `--metro` (which also sets the RN conditions + platform suffixes).
 const METRO_MAIN_FIELDS = ['react-native', 'browser', 'main']
-// Synthetic, project-relative path for the empty module a browser/react-native
-// `false` redirect resolves to. Carried in the bundle as a real (empty) CJS file
-// so the edge points at attestable bytes rather than a sentinel.
+// Synthetic path for the empty module a browser/react-native `false` redirect resolves to,
+// carried as a real empty CJS file so the edge points at attestable bytes.
 const EMPTY_MODULE_PATH = '.stasis/empty-module.js'
 
-// Build a JS/TS Bundle (and companion Lockfile) through the legacy-field resolver
-// (src/resolve-fields.js) rather than Node's resolver -- the `--mainFields` and
-// `--metro` paths. The graph is scanned once PER platform (just `[null]` in
-// `--mainFields` mode, where there are no platform suffixes); the file set is the union
-// across platforms, and each `(parent, specifier)` edge is recorded FLAT (a single
-// target) when every platform that has it agrees, and UNFLATTENED to a
-// `{ platform: target }` map only where platforms genuinely diverge. A single platform
-// therefore never unflattens; platform keys are exactly the supplied platforms (no
-// wildcard). A browser/react-native `false` redirect resolves to a synthetic empty
-// module carried in the bundle. Returns { bundle, lockfile } (the lockfile attests the
-// same files + the same -- possibly per-platform -- edges, by integrity).
-async function buildResolvedJsBundle({ cwd = process.cwd(), entries, mainFields, platforms, conditions = [], metro = false }) {
+// Recursively collect files under a native ios/android dir, skipping build output and symlinks
+// (cycle/escape hazard). Absolute paths into `out`.
+function walkNativeDir(dirAbs, out) {
+  let entries
+  try {
+    entries = readdirSync(dirAbs, { withFileTypes: true })
+  } catch {
+    return // absent -- nothing for this platform
+  }
+  for (const ent of entries) {
+    if (ent.isSymbolicLink()) continue
+    const full = join(dirAbs, ent.name)
+    if (ent.isDirectory()) {
+      if (!isSkippedNativeWalkDir(ent.name)) walkNativeDir(full, out)
+    } else if (ent.isFile() && !isNativeArtifact(ent.name)) {
+      out.push(full)
+    }
+  }
+}
+
+// Recursively collect podspec-load manifests (isNativeManifest) under `dirAbs`. RN's own
+// podspecs live in scattered subdirs a root-only scan would miss, so recurse fully.
+function collectNativeManifests(dirAbs, out, atRoot = false) {
+  let entries
+  try {
+    entries = readdirSync(dirAbs, { withFileTypes: true })
+  } catch {
+    return
+  }
+  for (const ent of entries) {
+    if (ent.isSymbolicLink()) continue
+    const full = join(dirAbs, ent.name)
+    if (ent.isDirectory()) {
+      if (!isSkippedNativeWalkDir(ent.name) && !(atRoot && isExcludedNativeDir(ent.name))) collectNativeManifests(full, out)
+    } else if (ent.isFile() && isNativeManifest(ent.name)) {
+      out.push(full)
+    }
+  }
+}
+
+// Native source files a bundled RN dep contributes to the app's native build (podspecs +
+// ios/android sources). Manifests are kept only when the package is actually native (podspec
+// or ios/android dir), else a JS-only dep's package.json would be pulled in. Deduped absolute paths.
+function nativeModuleFiles(pkgAbs) {
+  const manifests = []
+  collectNativeManifests(pkgAbs, manifests, true)
+  const hasIos = existsSync(join(pkgAbs, 'ios'))
+  const hasAndroid = existsSync(join(pkgAbs, 'android'))
+  if (!hasIos && !hasAndroid && !manifests.some((f) => isPodspec(f))) return []
+  const out = [...manifests]
+  if (hasIos) walkNativeDir(join(pkgAbs, 'ios'), out)
+  if (hasAndroid) walkNativeDir(join(pkgAbs, 'android'), out)
+  return [...new Set(out)]
+}
+
+// Build a JS/TS Bundle + companion Lockfile via the legacy-field resolver (`--mainFields`/
+// `--metro`). Scanned once per platform; each edge is recorded flat when the platforms that
+// have it agree, or as a `{ platform: target }` map where they diverge. Returns { bundle, lockfile }.
+async function buildResolvedJsBundle({ cwd = process.cwd(), entries, mainFields, platforms, conditions = [], metro = false, metroResolver = false, jsx = false, flow = false, resources = [], packageJSON = false }) {
   const baseDir = resolve(cwd)
   const absEntries = entries.map((e) => resolve(baseDir, e))
   const normalized = normalizeEntries(entries, cwd)
@@ -750,36 +668,48 @@ async function buildResolvedJsBundle({ cwd = process.cwd(), entries, mainFields,
     return rel
   }
 
-  // Normalize conditions like buildJsBundle does, so a sloppy programmatic caller
-  // (stray '' / whitespace) can't push a bogus token into the resolver.
+  // Normalize conditions (drop stray ''/whitespace) so a sloppy caller can't push a bogus token into the resolver.
   const scanConditions = conditions.map((c) => (typeof c === 'string' ? c.trim() : c)).filter(Boolean)
 
+  // Under --jsx the resolver probes .jsx/.tsx too, matching scan's jsx-widened carryable set.
+  const sourceExts = jsx ? SOURCE_EXTS_JSX : SOURCE_EXTS
+  // --resources: extensions/filenames carried as opaque assets instead of failing "can't carry".
+  const resourceSet = parseResourcesOption('buildResolvedJsBundle', resources)
+
   const formatsByRel = new Map()
-  // parentRel -> specifier -> Map<platformKey, targetRel>. Collapsed into flat /
-  // platform-map edges after every platform has been scanned.
+  // Reached files the scanner tagged as resources (rel keys); read as bytes below, not UTF-8 source.
+  const resourceRels = new Set()
+  // parentRel -> specifier -> Map<platformKey, targetRel>; collapsed after all platforms scanned.
   const edges = new Map()
-  const reached = new Set() // absolute paths of every real file reached on any platform
+  const reached = new Set() // absolute paths reached on any platform
   let usesEmpty = false
 
   for (const platform of platforms) {
-    // `--metro` asserts the React Native preset's conditions (react-native, plus
-    // browser for the web platform); `--mainFields` (platform === null) carries the
-    // user's own `--conditions`. scan layers these on the format-derived base.
+    // --metro asserts the RN conditions (+ browser on web); --mainFields (platform null) carries the user's --conditions.
     const extras = metro ? ['react-native', ...(platform === 'web' ? ['browser'] : [])] : scanConditions
-    const resolver = createFieldResolver({
-      mainFields,
-      platform,
-      preferNative: platform !== null && platform !== 'web',
-      sourceExts: SOURCE_EXTS,
-      conditions: resolveConditions('commonjs', extras),
-    })
-    const scanner = scan(absEntries, { conditions: extras, resolve: resolver })
-    reportScanIssues(analyzeScanner(scanner), { label: platform ?? 'mainFields' })
+    // --metro --metro-resolver delegates to the project's own metro-resolver for byte-for-byte Metro
+    // fidelity; otherwise the built-in field/suffix resolver (resolve-fields.js) reproduces it.
+    // metro-resolver derives default/require|import/platform conditions itself, so it takes only the
+    // extra `react-native` condition (browser comes from its per-platform map, keyed on `web`).
+    const resolver = metroResolver
+      ? createMetroResolver({ projectDir: baseDir, platform, sourceExts, mainFields, conditionNames: ['react-native'] })
+      : createFieldResolver({
+          mainFields,
+          platform,
+          preferNative: platform !== null && platform !== 'web',
+          sourceExts,
+          conditions: resolveConditions('commonjs', extras),
+          // Opt into Metro's package-entry browser-field quirks only on the --metro path.
+          metro,
+        })
+    const scanner = scan(absEntries, { conditions: extras, resolve: resolver, jsx, flow, resources: resourceSet })
+    reportScanIssues(analyzeScanner(scanner, { baseDir }), { baseDir, label: platform ?? 'mainFields' })
 
     const platformKey = platform ?? '*' // '*' is a private placeholder for the single mainFields pass; it never unflattens
     for (const [url, info] of scanner.files) {
       const rel = toRel(fileURLToPath(url))
       reached.add(fileURLToPath(url))
+      if (info.resource) resourceRels.add(rel)
       formatsByRel.set(rel, info.format)
       for (const e of info.edges) {
         if (e.builtin || e.dynamic) continue
@@ -795,28 +725,31 @@ async function buildResolvedJsBundle({ cwd = process.cwd(), entries, mainFields,
     }
   }
 
-  // Read every reached file's bytes once: content for the bundle, integrity for the
-  // lockfile (hash the raw bytes so it matches `stasis run --lock=frozen`). The stored
-  // source is UTF-8 text, so the bytes must BE valid UTF-8 -- otherwise toString('utf8')
-  // would lossily diverge from the hashed bytes.
+  // Read each reached file once: bytes for the bundle, integrity for the lockfile. Source is
+  // stored as UTF-8 text, so non-UTF-8 bytes would diverge from the hashed bytes -- reject them.
   const sources = new Map()
   const integrities = new Map()
   const realBase = realpathSync(baseDir)
   for (const abs of reached) {
     const rel = toRel(abs)
-    // A bundle must carry only in-tree, attestable bytes. The field resolver returns the
-    // lexical path it probed, so an in-tree-named symlink whose real target escapes the
-    // project root would slip past toRel's textual check -- realpath it and fail closed,
-    // the same way the State-based JS path and the non-JS loaders do.
+    // Security: the field resolver returns the lexical path, so an in-tree-named symlink
+    // escaping the root would slip past toRel's textual check -- realpath and fail closed.
     assertRealPathWithinBase(realBase, baseDir, rel)
     const buf = readFileSync(abs)
-    if (!isUtf8(buf)) throw new Error(`JS bundle source is not valid UTF-8: ${rel}`)
-    sources.set(rel, buf.toString('utf8'))
+    if (resourceRels.has(rel)) {
+      // A resource carries bytes, not JS source: store UTF-8 verbatim or base64 when binary, and
+      // tag the byte-derived format (same shape as the --metro native capture below).
+      const utf8 = isUtf8(buf)
+      sources.set(rel, utf8 ? buf.toString('utf8') : buf.toString('base64'))
+      formatsByRel.set(rel, utf8 ? 'resource' : 'resource:base64')
+    } else {
+      if (!isUtf8(buf)) throw new Error(`JS bundle source is not valid UTF-8: ${rel}`)
+      sources.set(rel, buf.toString('utf8'))
+    }
     integrities.set(rel, sha512integrity(buf))
   }
   if (usesEmpty) {
-    // The empty module is synthetic; refuse to shadow a real reached file that
-    // happens to sit at the reserved path rather than silently clobber it.
+    // Refuse to shadow a real reached file sitting at the reserved empty-module path.
     if (formatsByRel.has(EMPTY_MODULE_PATH)) {
       throw new Error(`Bundle needs the reserved empty-module path ${EMPTY_MODULE_PATH}, but the project has a real file there`)
     }
@@ -825,8 +758,96 @@ async function buildResolvedJsBundle({ cwd = process.cwd(), entries, mainFields,
     integrities.set(EMPTY_MODULE_PATH, sha512integrity(Buffer.alloc(0)))
   }
 
-  // Collapse each edge: one distinct target across the platforms that have it -> flat
-  // string; otherwise a Map<platform, target> (platform keys only, sorted).
+  // --metro also carries each bundled dependency's native build-input surface (ios/android
+  // sources + podspecs), scoped to the node_modules packages actually in the bundle. Native
+  // source is stored as code under a language tag; other assets as 'resource'/'resource:base64'.
+  if (metro) {
+    const pkgDirs = new Set()
+    for (const abs of reached) {
+      // Follow the CODE/module graph only: a package reached solely for an asset (--resources) is
+      // not a linked native dependency, so it must not drag in its ios/android surface.
+      if (resourceRels.has(toRel(abs))) continue
+      const nm = splitNodeModulesPath(toRel(abs))
+      if (nm) pkgDirs.add(nm.dir)
+    }
+    for (const pkgDir of [...pkgDirs].toSorted()) {
+      const pkgAbs = join(baseDir, pkgDir)
+      // react-native core isn't a Pod (config reports it via reactNativePath, not `dependencies`),
+      // so walk its whole tree for native source (React/, ReactCommon/, ReactAndroid/, ...) the same
+      // way a native dep's ios/android surface is walked; every other dep gets its ios/android + podspecs.
+      const isRnCore = pkgDir.slice(pkgDir.lastIndexOf('node_modules/') + 'node_modules/'.length) === 'react-native'
+      const files = isRnCore ? [] : nativeModuleFiles(pkgAbs)
+      if (isRnCore) walkNativeDir(pkgAbs, files)
+      for (const abs of files) {
+        const rel = toRel(abs)
+        if (sources.has(rel)) continue
+        assertRealPathWithinBase(realBase, baseDir, rel)
+        // classifyNativeCapture (shared with the StasisMetro plugin) returns action skip/code/resource with a format tag.
+        const byName = classifyNativeCapture(rel)
+        if (byName.action === 'skip') continue
+        const buf = readFileSync(abs)
+        // Byte-level rules (prebuilt binaries, binary plists) -- see refineNativeCapture.
+        const { action, format } = refineNativeCapture(byName, rel, buf, resourceSet)
+        if (action === 'skip') continue
+        const utf8 = isUtf8(buf)
+        if (action === 'code') {
+          if (!utf8) throw new Error(`native source is not valid UTF-8: ${rel}`)
+          sources.set(rel, buf.toString('utf8'))
+          formatsByRel.set(rel, format)
+        } else {
+          sources.set(rel, utf8 ? buf.toString('utf8') : buf.toString('base64'))
+          formatsByRel.set(rel, utf8 ? 'resource' : 'resource:base64')
+        }
+        integrities.set(rel, sha512integrity(buf))
+      }
+      // RN core's `.js` build scripts the classify loop skips (Metro-owned by extension, but never in
+      // the graph): force-include as code so the podspec/Ruby that invokes them at pod-install resolves.
+      if (isRnCore) {
+        for (const file of RN_CORE_INCLUDE_FILES) {
+          const abs = join(pkgAbs, file)
+          if (!existsSync(abs)) continue
+          const rel = toRel(abs)
+          if (sources.has(rel)) continue
+          assertRealPathWithinBase(realBase, baseDir, rel)
+          const buf = readFileSync(abs)
+          if (!isUtf8(buf)) throw new Error(`native source is not valid UTF-8: ${rel}`)
+          sources.set(rel, buf.toString('utf8'))
+          formatsByRel.set(rel, packageType(abs) === 'module' ? 'module' : 'commonjs')
+          integrities.set(rel, sha512integrity(buf))
+        }
+      }
+    }
+  }
+
+  // --package-json: fold each bundled module's package.json into `sources` (and its integrity into
+  // the companion lockfile) even when the scan never reached it. Buckets are the same ones
+  // assembleCodeBundle derives (findPackageMetadata -> pkgDir, else the '.' workspace bucket);
+  // findPackageMetadata is memoized per directory so a package's many files don't each re-walk to the
+  // same manifest. readModuleManifest applies the read/validate rules shared with the State path
+  // (containment, UTF-8-aborts); no identity check here -- these buckets are all fresh from disk.
+  if (packageJSON) {
+    const metaByDir = new Map()
+    const pkgDirs = new Set()
+    for (const abs of reached) {
+      const rel = toRel(abs)
+      const dir = dirname(rel)
+      if (!metaByDir.has(dir)) metaByDir.set(dir, findPackageMetadata(baseDir, rel))
+      const meta = metaByDir.get(dir)
+      if (meta) pkgDirs.add(meta.pkgDir)
+      else if (!splitNodeModulesPath(rel)) pkgDirs.add('.')
+    }
+    for (const pkgDir of pkgDirs) {
+      const rel = moduleFileKey(pkgDir, 'package.json')
+      if (sources.has(rel)) continue
+      const buf = readModuleManifest({ baseDir, realBase, rel })
+      if (!buf) continue
+      sources.set(rel, buf.toString('utf8'))
+      formatsByRel.set(rel, 'json')
+      integrities.set(rel, sha512integrity(buf))
+    }
+  }
+
+  // Collapse each edge: one distinct target across platforms -> flat string; else a sorted Map<platform, target>.
   const resolutions = new Map()
   for (const [parent, bySpec] of edges) {
     const specMap = new Map()
@@ -853,9 +874,7 @@ async function buildResolvedJsBundle({ cwd = process.cwd(), entries, mainFields,
     conditionKey: '*',
   })
 
-  // The companion lockfile mirrors the bundle exactly, swapping file content for
-  // its integrity. modules/imports/formats/entries are shared shapes, so a frozen
-  // lockfile attests the same resolution graph the bundle carries.
+  // The companion lockfile mirrors the bundle, swapping file content for its integrity.
   const lockModules = new Map()
   for (const [dir, m] of bundle.modules) {
     const files = Object.create(null)
@@ -868,15 +887,15 @@ async function buildResolvedJsBundle({ cwd = process.cwd(), entries, mainFields,
     modules: lockModules,
     imports: bundle.imports,
     formats: bundle.formats,
+    // Same file set as the bundle, so the same executable list attests it.
+    executable: bundle.executable,
   })
 
   return { bundle, lockfile }
 }
 
-// Classify entries into the single bundle language they all share and check
-// option applicability. Shared by buildBundle and bundleCommand; `name`
-// prefixes error messages with the caller.
-function classifyEntries(name, { entries, mappingFile, scope, lockfile, conditions, mainFields, platforms, metro }) {
+// Classify entries into their single shared language and check option applicability; `name` prefixes errors.
+function classifyEntries(name, { entries, mappingFile, scope, lockfile, conditions, mainFields, platforms, metro, metroResolver, jsx, flow, resources, packageJSON }) {
   if (!Array.isArray(entries) || entries.length === 0) {
     throw new Error(`${name}: at least one entry file is required`)
   }
@@ -898,22 +917,39 @@ function classifyEntries(name, { entries, mappingFile, scope, lockfile, conditio
   if (lockfile !== undefined && kind !== 'js') {
     throw new Error(`${name}: --lockfile is only valid for JS bundles`)
   }
-  // Conditions only steer Node's `exports`/`imports` resolution, which the other
-  // languages' resolvers don't consult -- reject them rather than accept a flag
-  // that would silently do nothing.
+  // Reject --conditions for non-JS: their resolvers don't consult exports/imports conditions, so it would silently do nothing.
   if (Array.isArray(conditions) && conditions.length > 0 && kind !== 'js') {
     throw new Error(`${name}: --conditions is only valid for JS bundles`)
   }
+  // --flow strips Flow type syntax before the JS parser; the non-JS loaders never parse with oxc.
+  if (flow && kind !== 'js') {
+    throw new Error(`${name}: --flow is only valid for JS bundles`)
+  }
+  // --resources carries allowlisted assets reached through the JS import graph; JS-only. The list
+  // is validated (parseResourcesOption) in the builders, but reject a code extension here too so a
+  // typo surfaces with the command name rather than deep in the scan.
+  if (Array.isArray(resources) && resources.length > 0) {
+    if (kind !== 'js') throw new Error(`${name}: --resources is only valid for JS bundles`)
+    parseResourcesOption(name, resources)
+  }
   // --mainFields and --metro/--platforms are legacy-/platform-resolution knobs; JS-only.
   if (mainFields !== undefined && kind !== 'js') {
     throw new Error(`${name}: --mainFields is only valid for JS bundles`)
   }
+  // --jsx toggles the scanner's JSX parsing for the .js family; only JS entries are scanned.
+  if (jsx && kind !== 'js') {
+    throw new Error(`${name}: --jsx is only valid for JS bundles`)
+  }
+  // --package-json folds each bundled module's npm package.json in; JS-only (the sol/php/bash/rust
+  // bucketizers group by their own ecosystems' manifests, not an npm package.json).
+  if (packageJSON && kind !== 'js') {
+    throw new Error(`${name}: --package-json is only valid for JS bundles`)
+  }
   if ((metro || (Array.isArray(platforms) && platforms.length > 0)) && kind !== 'js') {
     throw new Error(`${name}: --metro is only valid for JS bundles`)
   }
-  // `--metro` is a preset for conditions + mainFields + platform suffixes, so it can't
-  // be combined with explicit --conditions/--mainFields (they'd conflict), and it needs
-  // --platforms to know which suffixes to resolve. `--platforms` is meaningless without it.
+  // --metro presets conditions + mainFields + platform suffixes, so it can't combine with
+  // explicit --conditions/--mainFields and requires --platforms; --platforms is meaningless without it.
   if (metro) {
     if (Array.isArray(conditions) && conditions.length > 0) {
       throw new Error(`${name}: --conditions can't be combined with --metro (it sets its own conditions)`)
@@ -924,9 +960,8 @@ function classifyEntries(name, { entries, mappingFile, scope, lockfile, conditio
     if (!Array.isArray(platforms) || platforms.length === 0) {
       throw new Error(`${name}: --metro requires --platforms (e.g. --platforms=ios,android)`)
     }
-    // A platform name becomes a bundle/lockfile edge key (Bundle/Lockfile parse reject
-    // a '/'); '*' is the reserved private placeholder. Reject both so the writer can
-    // never emit an edge map the readers refuse -- a divergent-edge, data-dependent break.
+    // A platform name becomes an edge key: reject '/' (Bundle/Lockfile parse refuse it) and
+    // the reserved '*' placeholder, so the writer never emits a map the readers reject.
     for (const p of platforms) {
       if (typeof p !== 'string' || p.length === 0 || p === '*' || p.includes('/')) {
         throw new Error(`${name}: invalid platform '${p}' (a platform name can't be empty, contain '/', or be '*')`)
@@ -935,36 +970,22 @@ function classifyEntries(name, { entries, mappingFile, scope, lockfile, conditio
   } else if (Array.isArray(platforms) && platforms.length > 0) {
     throw new Error(`${name}: --platforms is only valid with --metro`)
   }
-  // The field resolver always emits a full-scope bundle (no node_modules-only mode), so
-  // --scope alongside --mainFields/--metro would be silently ignored -- reject it.
+  // --metro-resolver swaps in the project's real metro-resolver; it only means something under --metro.
+  if (metroResolver && !metro) {
+    throw new Error(`${name}: --metro-resolver is only valid with --metro`)
+  }
+  // The field resolver always emits full-scope, so --scope with --mainFields/--metro would be silently ignored -- reject it.
   if (scope !== undefined && (mainFields !== undefined || metro)) {
     throw new Error(`${name}: --scope is not supported with --mainFields or --metro`)
   }
   return kind
 }
 
-// Programmatic equivalent of `stasis bundle`: build and return an in-memory
-// Bundle from a list of entry files, without writing anything to disk
-// (serialize with bundle.serialize() to get the JSON that `stasis bundle`
-// brotli-compresses into stasis.code.br).
-//
-// Dispatch by extension matches the CLI: all entries must be one language —
-// .sol (Solidity), .php (PHP), .js/.cjs/.mjs/.ts/.cts/.mts (JS/TS, via static
-// scan), .sh/.bash (Bash), or .rs (Rust); mixing fails fast. `mappingFile` is
-// the optional Solidity remappings file (foundry.toml or remappings.txt) and
-// is only valid for .sol entries; `scope` overrides the configured bundle
-// scope and is only valid for JS/TS entries; `conditions` are extra `exports`
-// resolution conditions (e.g. `['react-native']`) and are JS/TS-only too.
-//
-// `mainFields` (an array of legacy package fields, e.g. `['react-native','browser','main']`)
-// selects the legacy-field resolver -- see buildResolvedJsBundle. It resolves
-// non-`exports` packages via those fields, including the browser-field object
-// redirection, and composes with `conditions`. `metro: true` is instead a preset that
-// sets its OWN React Native fields + conditions + platform suffixes (so it is not
-// combined with `mainFields`/`conditions`) and requires `platforms` (e.g.
-// `['ios','android']`); the edge graph is then per-platform. JS/TS-only.
-export async function buildBundle({ cwd = process.cwd(), entries, mappingFile, scope, conditions, mainFields, platforms, metro } = {}) {
-  const kind = classifyEntries('buildBundle', { entries, mappingFile, scope, conditions, mainFields, platforms, metro })
+// Programmatic equivalent of `stasis bundle`: build and return an in-memory Bundle without
+// writing to disk. Files are attributed to the `bundle` consumer. Option applicability
+// (--mapping/.sol, --scope|--conditions|--mainFields|--metro|--jsx|--flow/JS) is enforced by classifyEntries.
+export async function buildBundle({ cwd = process.cwd(), entries, mappingFile, scope, conditions, mainFields, platforms, metro, metroResolver, jsx = false, flow = false, resources = [], packageJSON = false } = {}) {
+  const kind = classifyEntries('buildBundle', { entries, mappingFile, scope, conditions, mainFields, platforms, metro, metroResolver, jsx, flow, resources, packageJSON })
   if (kind === 'sol') return buildSolidityBundle({ cwd, entries, mappingFile })
   if (kind === 'php') return buildPhpBundle({ cwd, entries })
   if (kind === 'bash') return buildBashBundle({ cwd, entries })
@@ -977,59 +998,43 @@ export async function buildBundle({ cwd = process.cwd(), entries, mappingFile, s
       platforms: metro ? platforms : [null],
       conditions,
       metro: Boolean(metro),
+      metroResolver: Boolean(metroResolver),
+      jsx,
+      flow,
+      resources,
+      packageJSON,
     })
     return bundle
   }
-  const state = await buildJsBundle({ cwd, entries, scope, conditions })
-  return state.sourceBundle
+  const state = await buildJsBundle({ cwd, entries, scope, conditions, jsx, flow, resources, packageJSON })
+  // Stamp the `bundle` consumer (the static build carries none).
+  return state.sourceBundle.withReason('bundle')
 }
 
-// Where `stasis bundle` writes when no --output is given: stasis.code.br, the
-// same name `stasis run --bundle=load` discovers by default, so the two commands
-// round-trip with no flags. A file (not stdout) is the common case; pass
-// --output=- to stream the raw brotli bytes to stdout.
+// Default output: stasis.code.br, the same name `stasis run --bundle=load` discovers, so the two round-trip with no flags.
 const DEFAULT_BUNDLE_FILE = 'stasis.code.br'
 
-// Run the bundle CLI command end-to-end. Always produces a brotli-compressed
-// stasis bundle (matching the on-disk format of `stasis.code.br`). Writes to
-// `output` when given, to stasis.code.br in `cwd` by default, or to stdout
-// when `output` is `-`. Prints a one-line `[stasis] Bundled <n> files in <p>
-// packages from <dir> to <dest>` summary to stderr so it doesn't interleave
-// with binary output written to stdout.
-//
-// Dispatch by extension: all entries must be one language — .sol (Solidity),
-// .php (PHP), .js/.cjs/.mjs/.ts/.cts/.mts (JS/TS, via static scan), .sh/.bash
-// (Bash, via source/exec graph walk), or .rs (Rust, via mod-declaration walk).
-// Mixing fails fast; --mapping is .sol only, --scope/--lockfile/--conditions are
-// JS/TS only.
-//
-// `conditions` are extra Node `exports`/`imports` resolution conditions to assert
-// during the static scan (e.g. `['react-native']` or `['browser']`). They only
-// affect `exports`/`imports` condition matching -- not legacy mainFields -- so on
-// their own they don't honour a package's legacy entry fields. See buildJsBundle.
-//
-// For JS bundles, an optional `lockfile` path writes a stasis.lock.json that
-// attests every file in the bundle. The static scan walks both branches of
-// conditional requires (e.g. debug/src/index.js' `if (browser) require('./browser')
-// else require('./node')`), so the runtime lockfile from `stasis run --lock=add`
-// won't attest the unused branch -- if the user wants `lock=frozen` against a
-// statically-built bundle, they need this companion lockfile.
-//
-// With `--conditions`, that companion lockfile attests the conditions-SELECTED
-// resolution graph. A plain `stasis run --lock=frozen` doesn't replay `--conditions`,
-// so it resolves different files on disk and fails closed (correctly -- the lockfile
-// genuinely attests a different graph). Pair such a lockfile with `--bundle=load`, or
-// replay the same `--conditions` at run time, so the attested and observed graphs agree.
-export async function bundleCommand({ cwd = process.cwd(), entries, mappingFile, output, scope, lockfile, conditions, mainFields, platforms, metro } = {}) {
-  const kind = classifyEntries('bundleCommand', { entries, mappingFile, scope, lockfile, conditions, mainFields, platforms, metro })
+// Run `stasis bundle`: build a brotli-compressed bundle and write it to `output`
+// (stasis.code.br by default, `-` for stdout; the summary goes to stderr so it never
+// interleaves with binary stdout). An optional JS `lockfile` attests every bundled file;
+// with `--conditions` it attests the conditions-selected graph, so a plain
+// `stasis run --lock=frozen` (which doesn't replay them) fails closed -- pair it with
+// `--bundle=load` or replay the conditions. `add` unions the fresh build into the bundle
+// already on disk (strict; a conflicting file throws) and can't target stdout.
+export async function bundleCommand({ cwd = process.cwd(), entries, mappingFile, output, scope, lockfile, conditions, mainFields, platforms, metro, metroResolver, jsx = false, flow = false, resources = [], packageJSON = false, brotliQuality, add = false } = {}) {
+  const kind = classifyEntries('bundleCommand', { entries, mappingFile, scope, lockfile, conditions, mainFields, platforms, metro, metroResolver, jsx, flow, resources, packageJSON })
+
+  const target = output ?? DEFAULT_BUNDLE_FILE
+  // --add has nothing to merge into on stdout (write-only).
+  if (add && target === '-') {
+    throw new Error('bundleCommand: --add cannot be combined with --output=- (nothing to merge into on stdout)')
+  }
 
   let bundle
   let lockData
   if (kind === 'js' && (metro || mainFields !== undefined)) {
-    // The legacy-field resolver path builds the Bundle (and the matching Lockfile)
-    // directly -- it carries per-platform edges and a synthetic empty module (for a
-    // browser/react-native `false` redirect) that State's disk-reading addFile can't
-    // represent.
+    // The legacy-field resolver builds Bundle + Lockfile directly (per-platform edges + a
+    // synthetic empty module State's addFile can't represent).
     const built = await buildResolvedJsBundle({
       cwd,
       entries,
@@ -1037,30 +1042,63 @@ export async function bundleCommand({ cwd = process.cwd(), entries, mappingFile,
       platforms: metro ? platforms : [null],
       conditions,
       metro: Boolean(metro),
+      metroResolver: Boolean(metroResolver),
+      jsx,
+      flow,
+      resources,
+      packageJSON,
     })
     bundle = built.bundle
     if (lockfile) lockData = built.lockfile.serialize()
   } else if (kind === 'js' && lockfile) {
-    // The companion lockfile attests file hashes, which only State carries —
-    // a Bundle holds sources, not digests — so this path keeps the State.
-    const state = await buildJsBundle({ cwd, entries, scope, conditions })
-    bundle = state.sourceBundle
+    // Keep the State: only it carries the file hashes the companion lockfile needs (a Bundle holds sources, not digests).
+    const state = await buildJsBundle({ cwd, entries, scope, conditions, jsx, flow, resources, packageJSON })
+    // Stamp the `bundle` consumer (this branch bypasses buildBundle to keep the State).
+    bundle = state.sourceBundle.withReason('bundle')
     lockData = state.lockData
   } else {
-    bundle = await buildBundle({ cwd, entries, mappingFile, scope, conditions })
+    bundle = await buildBundle({ cwd, entries, mappingFile, scope, conditions, jsx, flow, resources, packageJSON })
   }
+
+  // --add: union the fresh build into the existing on-disk bundle; a conflicting file throws. Skipped when nothing is on disk.
+  const outAbs = target === '-' ? undefined : resolve(cwd, target)
+  // Files the pre-existing bundle carried; undefined when no merge happened (the summary's merged sentinel).
+  let mergedFrom
+  if (add && existsSync(outAbs)) {
+    let existing
+    try {
+      existing = Bundle.parse(brotliDecompressSync(readFileSync(outAbs)).toString('utf8'))
+    } catch (cause) {
+      throw new Error(`bundleCommand: --add failed to read the existing bundle at ${target}`, { cause })
+    }
+    mergedFrom = existing.sources.size
+    bundle = existing.merge(bundle)
+    // Keep the companion lockfile consistent with the merged bundle: union an existing one.
+    // With none on disk we can't attest the pre-existing bundle's files (their hashes live
+    // only in that missing lockfile), so refuse rather than write an under-attesting lockfile.
+    if (lockData && lockfile) {
+      const lockAbs = resolve(cwd, lockfile)
+      if (!existsSync(lockAbs)) {
+        throw new Error(`bundleCommand: --add can't write a complete lockfile at ${lockfile}: the bundle at ${target} already carries files a fresh lockfile wouldn't attest, and there's no existing lockfile to merge into. Write --lockfile alongside the bundle from the first build, or drop --lockfile.`)
+      }
+      let existingLock
+      try {
+        existingLock = Lockfile.parse(readFileSync(lockAbs, 'utf8'))
+      } catch (cause) {
+        throw new Error(`bundleCommand: --add failed to read the existing lockfile at ${lockfile}`, { cause })
+      }
+      lockData = existingLock.merge(Lockfile.parse(lockData)).serialize()
+    }
+  }
+
   const serialized = bundle.serialize()
   const files = [...bundle.sources.keys()]
   const modules = bundle.modules
 
-  const data = brotliCompressSync(serialized, brotliOptions())
-  // Default to writing stasis.code.br in cwd; `-` is the conventional opt-in
-  // for streaming the raw brotli bytes to stdout (e.g. to pipe somewhere else).
-  const target = output ?? DEFAULT_BUNDLE_FILE
+  const data = brotliCompressSync(serialized, brotliOptions(brotliQuality))
   if (target === '-') {
     process.stdout.write(data)
   } else {
-    const outAbs = resolve(cwd, target)
     mkdirSync(dirname(outAbs), { recursive: true })
     writeFileSync(outAbs, data)
   }
@@ -1071,9 +1109,14 @@ export async function bundleCommand({ cwd = process.cwd(), entries, mappingFile,
   }
   const fromDir = outermostDir(files, resolve(cwd))
   const dest = target === '-' ? '<stdout>' : target
-  // Count packages: every non-empty bucket, with the project's own source (the
-  // "." workspace bucket) counting as one package alongside each dependency.
+  // Count packages: every non-empty bucket (the "." workspace bucket counts as one).
   const packages = [...modules.values()].filter((m) => Object.keys(m.files).length > 0).length
   const pkgLabel = `${packages} package${packages === 1 ? '' : 's'}`
-  console.warn(`[stasis] Bundled ${files.length} files in ${pkgLabel} from ${fromDir} to ${dest}`)
+  // On a merge, report newly-added files alongside the totals; a fresh write keeps the plain line.
+  if (mergedFrom !== undefined) {
+    const added = files.length - mergedFrom
+    console.warn(`[stasis] Added ${added} file${added === 1 ? '' : 's'} (${files.length} total in ${pkgLabel}) from ${fromDir} to ${dest}`)
+  } else {
+    console.warn(`[stasis] Bundled ${files.length} files in ${pkgLabel} from ${fromDir} to ${dest}`)
+  }
 }