@multiplatform.one/config 7.6.3 → 7.7.1

package/lint.mjs

@@ -27,6 +27,22 @@
  *    whose path is not a DRAWING member in docs/theme-propagation-spec.md.
  *    The oxlint rule skips registered drawings; this check is what makes
  *    adding an undeclared drawing file still fail.
+ * 7. Fail on a METRO SUBPATH WITHOUT A FALLBACK (MPO-185) — a package.json
+ *    subpath export in a source-consumed package whose Metro condition points
+ *    into `dist/` with no `<pkg>/<subpath>.*` file on disk. Metro never
+ *    reconsiders the map's `source` condition after the dist miss, so the
+ *    first import of that subpath fails the whole bundle.
+ * 8. Fail on a REACT-NATIVE NAMED IMPORT WITH NO REACT-NATIVE-WEB EXPORT
+ *    (MPO-199) — a `import { X } from "react-native"` in a file the web
+ *    target resolves, where react-native-web exports no X. The alias makes
+ *    that a module-evaluation SyntaxError, which takes the whole preview
+ *    bundle down rather than one component.
+ * 9. Fail on an `import.meta` TOKEN in public/<pkg>/src (MPO-204) — in a
+ *    classic script it is a PARSE-time SyntaxError, and two bundles execute
+ *    mpo as one (the vxrn/rolldown Hermes bundle, and any Metro bundle for
+ *    platform=web, i.e. an Expo DOM component). Node-only build tooling is
+ *    exempt by construction: a file that imports a `node:` builtin cannot run
+ *    in a browser or on Hermes anyway.
  *
  * Usage:
  *   import { runConventionChecks } from "@multiplatform.one/config/lint";
@@ -253,12 +269,16 @@ function keysOfBlock(body, indent) {
 let sourceFileCache;
 function sourceFiles() {
   if (sourceFileCache) return sourceFileCache;
-  /** @type {{ rel: string, src: string }[]} */
+  /** @type {{ abs: string, rel: string, src: string }[]} */
   const files = [];
   const collect = (filePath) => {
     if (!/\.(tsx|ts|jsx|js)$/.test(filePath)) return;
     if (/\.(spec|test)\./.test(filePath)) return;
-    files.push({ rel: relative(ROOT, filePath), src: readFileSync(filePath, "utf8") });
+    files.push({
+      abs: filePath,
+      rel: relative(ROOT, filePath),
+      src: readFileSync(filePath, "utf8"),
+    });
   };
   for (const dir of [PUBLIC_DIR, APPS_DIR, FEATURES_DIR]) walkFiles(dir, collect);
   sourceFileCache = files;
@@ -778,6 +798,391 @@ function checkUndeclaredDrawings() {
   return { violations, ok: true };
 }
 
+/**
+ * MPO-109 WORKSPACE PATHS SHADOW — `compilerOptions.paths` REPLACES the
+ * inherited map, it never merges with it. `tsconfig.base.json` extends the
+ * generated `tamagui-workspace-paths.generated.json`, so one local entry in a
+ * package tsconfig hides every `@multiplatform.one/*` mapping from that
+ * program and the whole package fails to resolve its own workspace. That is
+ * where apps/one's 578 typecheck errors came from, and features, apps/storybook,
+ * apps/storybook-expo, apps/uxpin and public/keycloak each carried the same
+ * override.
+ *
+ * The fix for a deep-import alias is the package's own `exports` map, which the
+ * generator reads. Escape (rare, for a program that deliberately does not
+ * extend the base): `// workspace-paths-escape:` with a reason on the line
+ * above `"paths"`.
+ */
+function checkTsconfigWorkspacePaths() {
+  /** @type {string[]} */
+  const violations = [];
+  /** @type {string[]} */
+  const files = [];
+  const featuresTsconfig = join(FEATURES_DIR, "tsconfig.json");
+  if (existsSync(featuresTsconfig)) files.push(featuresTsconfig);
+  for (const dir of [APPS_DIR, PACKAGES_DIR, PUBLIC_DIR]) {
+    if (!existsSync(dir)) continue;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      const candidate = join(dir, entry.name, "tsconfig.json");
+      if (existsSync(candidate)) files.push(candidate);
+    }
+  }
+  for (const file of files) {
+    const src = readFileSync(file, "utf8");
+    // Whole-line comments only: a `//` inside a string (the $schema URL) must
+    // survive, and these files are JSONC, not JSON5.
+    const stripped = src.replace(/^[ \t]*\/\/.*$/gm, "");
+    let doc;
+    try {
+      doc = JSON.parse(stripped);
+    } catch {
+      continue;
+    }
+    const paths = doc?.compilerOptions?.paths;
+    if (!paths || typeof paths !== "object") continue;
+    const extendsField = doc.extends;
+    const extendsBase = Array.isArray(extendsField)
+      ? extendsField.some((e) => typeof e === "string" && e.includes("tsconfig.base"))
+      : typeof extendsField === "string" && extendsField.includes("tsconfig.base");
+    if (!extendsBase) continue;
+    const decl = src.match(/^[ \t]*"paths"\s*:/m);
+    const index = decl?.index ?? 0;
+    const before = src.slice(0, index);
+    if (/workspace-paths-escape:/.test(before.split("\n").slice(-3).join("\n"))) continue;
+    violations.push(
+      `${relative(ROOT, file)}:${lineAt(src, index)} — declares \`compilerOptions.paths\` (${Object.keys(paths).join(", ")}) while extending tsconfig.base`,
+    );
+  }
+  return violations;
+}
+
+/**
+ * Metro (MPO-185): the condition names Metro matches, per platform, when
+ * `resolver.unstable_enablePackageExports` is on. `require`/`import` are
+ * Metro's own defaults; Expo's metro-config adds `react-native` for ios and
+ * android and `browser` for web. `default` always matches. Keys are matched
+ * in the ORDER the exports map declares them, first hit wins, and neither
+ * `source` nor `types` is ever in the set.
+ */
+const METRO_PLATFORM_CONDITIONS = {
+  ios: new Set(["react-native", "import", "require", "default"]),
+  web: new Set(["browser", "import", "require", "default"]),
+};
+/** What Metro's file-based fallback will accept at `<pkg>/<subpath>`. */
+const METRO_FALLBACK_EXTS = ["ts", "tsx", "js", "jsx", "mjs", "cjs"];
+
+/**
+ * First target Metro would pick from an exports-map entry for one condition
+ * set, walking nested condition objects in declaration order.
+ * @param {unknown} target
+ * @param {Set<string>} conditions
+ * @returns {string | null}
+ */
+function metroExportTarget(target, conditions) {
+  if (typeof target === "string") return target;
+  if (Array.isArray(target)) {
+    for (const item of target) {
+      const hit = metroExportTarget(item, conditions);
+      if (hit) return hit;
+    }
+    return null;
+  }
+  if (!target || typeof target !== "object") return null;
+  for (const [key, value] of Object.entries(target)) {
+    if (!conditions.has(key)) continue;
+    const hit = metroExportTarget(value, conditions);
+    if (hit) return hit;
+  }
+  return null;
+}
+
+/**
+ * @param {unknown} target
+ * @returns {boolean} true when any condition in the entry is `source`
+ */
+function declaresSourceCondition(target) {
+  if (!target || typeof target !== "object") return false;
+  if (Array.isArray(target)) return target.some(declaresSourceCondition);
+  return Object.entries(target).some(
+    ([key, value]) => key === "source" || declaresSourceCondition(value),
+  );
+}
+
+/**
+ * @param {string} pkgRoot
+ * @param {string} subpath an exports key such as `./seam`
+ */
+function hasMetroFallback(pkgRoot, subpath) {
+  const base = join(pkgRoot, subpath.replace(/^\.\//, ""));
+  if (METRO_FALLBACK_EXTS.some((ext) => existsSync(`${base}.${ext}`))) return true;
+  if (existsSync(join(base, "package.json"))) return true;
+  return METRO_FALLBACK_EXTS.some((ext) => existsSync(join(base, `index.${ext}`)));
+}
+
+/**
+ * Metro subpath fallback (MPO-185).
+ *
+ * Metro reads the exports map, picks the first condition it recognises, and
+ * if that file is missing it does NOT reconsider `source` or `default`: it
+ * warns and retries as a plain file lookup for `<pkg>/<subpath>.*`. The
+ * packages under public/ and packages/ are consumed from source and never
+ * built, so a subpath whose Metro condition points into `dist/` fails the
+ * whole bundle the first time anything in a Metro graph imports it. The `.`
+ * export is exempt because its file fallback lands on the package root, where
+ * `main`/`module` point at src.
+ *
+ * A package is source-consumed when the entry or the package declares a
+ * `source` condition, or `main` points into src/. A genuinely built package
+ * (keycloak-js: no `source`, `main` in dist, `prepare` builds it) is skipped.
+ */
+function checkMetroSubpathFallbacks() {
+  /** @type {string[]} */
+  const violations = [];
+  for (const dir of [PUBLIC_DIR, PACKAGES_DIR]) {
+    if (!existsSync(dir)) continue;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      const pkgRoot = join(dir, entry.name);
+      const pkgJsonPath = join(pkgRoot, "package.json");
+      if (!existsSync(pkgJsonPath)) continue;
+      let pkg;
+      try {
+        pkg = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
+      } catch {
+        continue;
+      }
+      const exportsMap = pkg?.exports;
+      if (!exportsMap || typeof exportsMap !== "object" || Array.isArray(exportsMap)) continue;
+      const packageFromSource =
+        typeof pkg.source === "string" ||
+        (typeof pkg.main === "string" && /^(\.\/)?src\//.test(pkg.main)) ||
+        declaresSourceCondition(exportsMap["."]);
+      for (const [subpath, target] of Object.entries(exportsMap)) {
+        if (!subpath.startsWith("./") || subpath.includes("*")) continue;
+        if (!packageFromSource && !declaresSourceCondition(target)) continue;
+        if (hasMetroFallback(pkgRoot, subpath)) continue;
+        for (const [platform, conditions] of Object.entries(METRO_PLATFORM_CONDITIONS)) {
+          const resolved = metroExportTarget(target, conditions);
+          if (!resolved || !resolved.startsWith("./dist/")) continue;
+          violations.push(
+            `${relative(ROOT, pkgJsonPath)} — "${subpath}" resolves to ${resolved} on ${platform}, which is unbuilt; add ${relative(ROOT, join(pkgRoot, `${subpath.replace(/^\.\//, "")}.ts`))} re-exporting the source entry`,
+          );
+          break;
+        }
+      }
+    }
+  }
+  return violations;
+}
+
+/**
+ * react-native-web's export list, read from the copy installed under ROOT.
+ *
+ * `dist/index.js` is the file the web target evaluates — it is RNW's `module`
+ * entry and what the storybook alias resolves `react-native` to — so its
+ * `export { … }` clauses ARE the vocabulary. Reading them is what keeps this
+ * check from drifting when RNW is upgraded; a hand-kept list would go stale
+ * the first time upstream adds or drops an export.
+ *
+ * @returns {Set<string> | undefined} undefined when RNW is not installed, which
+ * disables the check rather than failing a partial install.
+ */
+function readReactNativeWebExports() {
+  const entry = join(ROOT, "node_modules", "react-native-web", "dist", "index.js");
+  if (!existsSync(entry)) return undefined;
+  /** @type {Set<string>} */
+  const names = new Set();
+  for (const clause of readFileSync(entry, "utf8").matchAll(/export\s*\{([^}]*)\}/g)) {
+    for (const specifier of clause[1].split(",")) {
+      const name = specifier
+        .trim()
+        .split(/\s+as\s+/)
+        .pop();
+      if (name) names.add(name);
+    }
+  }
+  return names.size ? names : undefined;
+}
+
+/** Platform-suffixed files the web resolver never reaches. */
+const NATIVE_ONLY_FILE_RE = /\.(native|ios|android)\.(tsx|ts|jsx|js)$/;
+
+/**
+ * `import … from "react-native"`, including the multi-line brace form.
+ *
+ * The body may contain no quote and no `;`, which is what stops the non-greedy
+ * match from swallowing an earlier `import … from "react"` and attributing
+ * ITS names to react-native.
+ */
+const REACT_NATIVE_IMPORT_RE = /import\s+([^;'"]*?)from\s*["']react-native["']/g;
+
+/** @param {string} absPath @param {string} dir */
+function isUnder(absPath, dir) {
+  const rel = relative(dir, absPath);
+  return rel !== "" && !rel.startsWith("..");
+}
+
+/**
+ * react-native named import with no react-native-web counterpart (MPO-199).
+ *
+ * Every web build aliases `react-native` to `react-native-web`
+ * (apps/storybook/.storybook/main.ts, createStorybookViteConfig, the app vite
+ * config). RNW does not implement all of react-native, so a NAMED import of
+ * something it never exports is not a missing feature at runtime — it is a
+ * module-evaluation SyntaxError, and one failing module takes the WHOLE bundle
+ * with it. That is how `import { ActionSheetIOS } from "react-native"` in
+ * Select (2b94d9eeb) made every story in the gallery render blank, not just
+ * Select's.
+ *
+ * A `Platform.OS` guard inside the file cannot save it: the import fails
+ * before any code runs. The two legal shapes are a namespace import, which
+ * lands on `undefined` for a missing name (8c62c2a6f, the fix), and a
+ * `.native.tsx` / `.ios.tsx` sibling the web resolver never reaches.
+ *
+ * Scope is public/ and features/ — the trees the preview bundle is built from.
+ * Type-only specifiers are erased before any bundler sees them, so
+ * `import type { GestureResponderEvent }` is fine and stays fine.
+ */
+function checkReactNativeWebExports() {
+  const exported = readReactNativeWebExports();
+  if (!exported) return { ok: false, violations: /** @type {string[]} */ ([]) };
+  /** @type {string[]} */
+  const violations = [];
+  for (const { abs, rel, src } of sourceFiles()) {
+    if (!isUnder(abs, PUBLIC_DIR) && !isUnder(abs, FEATURES_DIR)) continue;
+    if (NATIVE_ONLY_FILE_RE.test(abs)) continue;
+    if (!src.includes("react-native")) continue;
+    for (const statement of src.matchAll(REACT_NATIVE_IMPORT_RE)) {
+      const clause = statement[1].trim();
+      if (/^type\b/.test(clause)) continue;
+      const named = clause.match(/\{([\s\S]*)\}/);
+      // No brace group means a default or `* as ns` import, and a namespace
+      // read of a missing name is `undefined`, never a SyntaxError.
+      if (!named) continue;
+      for (const specifier of named[1].split(",")) {
+        const entry = specifier.trim();
+        if (!entry || /^type\b/.test(entry)) continue;
+        const name = entry.split(/\s+as\s+/)[0].trim();
+        if (!name || exported.has(name)) continue;
+        violations.push(
+          `${rel}:${lineAt(src, statement.index ?? 0)} — ${name} (react-native-web exports no ${name})`,
+        );
+      }
+    }
+  }
+  return { ok: true, violations };
+}
+
+/**
+ * Offsets in `src` that are live CODE — not inside a comment, a string or a
+ * template literal. One left-to-right pass. Regex literals are treated as
+ * code, and a `${…}` interpolation is treated as string, which can only ever
+ * make this check miss something, never invent a violation.
+ *
+ * @param {string} src
+ * @returns {Uint8Array} 1 at every code offset
+ */
+function codeOffsets(src) {
+  const mask = new Uint8Array(src.length);
+  let i = 0;
+  while (i < src.length) {
+    const char = src[i];
+    const next = src[i + 1];
+    if (char === "/" && next === "/") {
+      while (i < src.length && src[i] !== "\n") i++;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      i += 2;
+      while (i < src.length && !(src[i] === "*" && src[i + 1] === "/")) i++;
+      i += 2;
+      continue;
+    }
+    if (char === '"' || char === "'" || char === "`") {
+      const quote = char;
+      i++;
+      while (i < src.length) {
+        if (src[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        if (src[i] === quote) {
+          i++;
+          break;
+        }
+        i++;
+      }
+      continue;
+    }
+    mask[i] = 1;
+    i++;
+  }
+  return mask;
+}
+
+const IMPORT_META_RE = /\bimport\s*\.\s*meta\b/g;
+const IMPORT_META_SCANNED_RE = /\.(tsx|ts|jsx|js|mjs|cjs|mts|cts)$/;
+
+/**
+ * A VALUE import of a node: builtin. `import type { … } from "node:fs"` is
+ * erased, so it proves nothing about where the file runs and does not count.
+ */
+const NODE_BUILTIN_IMPORT_RE =
+  /(?:^|\n)\s*import\s+(?!type\s)[^;'"]*from\s*["']node:[^"']+["']|require\(\s*["']node:[^"']+["']\s*\)|import\(\s*["']node:[^"']+["']\s*\)/;
+
+/**
+ * `import.meta` in a public package's runtime source (MPO-204).
+ *
+ * MPO-192's ruling, generalised. `import.meta` is legal only in an ES module;
+ * in a CLASSIC script it is a PARSE-time SyntaxError, so no `typeof
+ * import.meta` guard and no try/catch around it ever gets to run — the file
+ * simply never parses and takes its consumers down with it, silently. Two
+ * bundles execute mpo as a classic script: the vxrn/rolldown native bundle for
+ * Hermes, and any Metro bundle built for platform=web, which is exactly what
+ * an Expo DOM component (`'use dom'`) is. A `.web.ts` twin is not an escape
+ * either: One's web build and tamagui-build resolve `.web.ts` the way Metro
+ * does, so a twin lands in the Vite build too.
+ *
+ * The replacement is a static `process.env.<KEY>` member read inside a
+ * try/catch (public/platform/src/config/runtimeConfig.ts), or, for an SSR
+ * flag, `isServer` from @multiplatform.one/platform, which is split at the
+ * FILE level rather than by a bundler define.
+ *
+ * Exempt, by construction rather than by allowlist: a file that imports a
+ * `node:` builtin as a value is Node-only build tooling
+ * (@multiplatform.one/config's vite/vitest configs, the CLI,
+ * @multiplatform.one/utils/dev) and could not run in a browser or on Hermes
+ * whatever it did with import.meta. Specs are exempt for the same reason —
+ * vitest runs them in Node and provides `import.meta.env` itself.
+ */
+function checkImportMetaInPublicSource() {
+  /** @type {string[]} */
+  const violations = [];
+  if (!existsSync(PUBLIC_DIR)) return violations;
+  for (const pkg of readdirSync(PUBLIC_DIR, { withFileTypes: true })) {
+    if (!pkg.isDirectory() || pkg.name.startsWith(".") || pkg.name === "node_modules") continue;
+    walkFiles(join(PUBLIC_DIR, pkg.name, "src"), (filePath) => {
+      if (!IMPORT_META_SCANNED_RE.test(filePath)) return;
+      if (/\.(spec|test)\./.test(filePath)) return;
+      const src = readFileSync(filePath, "utf8");
+      if (!IMPORT_META_RE.test(src)) {
+        IMPORT_META_RE.lastIndex = 0;
+        return;
+      }
+      IMPORT_META_RE.lastIndex = 0;
+      if (NODE_BUILTIN_IMPORT_RE.test(src)) return;
+      const mask = codeOffsets(src);
+      for (const match of src.matchAll(IMPORT_META_RE)) {
+        const index = match.index ?? 0;
+        if (mask[index] !== 1) continue;
+        violations.push(`${relative(ROOT, filePath)}:${lineAt(src, index)}`);
+      }
+    });
+  }
+  return violations;
+}
+
 /**
  * Run structural convention checks over a consumer tree.
  *
@@ -791,6 +1196,10 @@ export function runConventionChecks(options = {}) {
   const sizeRecipeEscape = checkSizeRecipeEscape();
   const storyShape = checkStoryFileShape();
   const undeclaredDrawings = checkUndeclaredDrawings();
+  const tsconfigPaths = checkTsconfigWorkspacePaths();
+  const metroFallbacks = checkMetroSubpathFallbacks();
+  const rnWebExports = checkReactNativeWebExports();
+  const importMeta = checkImportMetaInPublicSource();
   const tokens = checkTransitionTokens();
   const styleTokens = checkStyleTokens();
   const themeNames = checkThemeNames();
@@ -857,6 +1266,42 @@ export function runConventionChecks(options = {}) {
     console.error("");
   }
 
+  if (tsconfigPaths.length) {
+    failed = true;
+    console.error(
+      "Convention (MPO-109 WORKSPACE PATHS SHADOW): `compilerOptions.paths` REPLACES the map tsconfig.base.json inherits from tamagui-workspace-paths.generated.json, so one local entry hides every `@multiplatform.one/*` mapping from that program. Declare the alias in the target package's `exports` (the generator reads it) instead. Escape with `// workspace-paths-escape: <reason>` above the key.\n",
+    );
+    for (const msg of tsconfigPaths) console.error(`  ${msg}`);
+    console.error("");
+  }
+
+  if (metroFallbacks.length) {
+    failed = true;
+    console.error(
+      "Convention (MPO-185 METRO SUBPATH FALLBACK): a subpath export in a source-consumed package must have a `<pkg>/<subpath>.ts` file re-exporting its source entry. Metro resolves the exports map to dist/, finds nothing (public/ is never built), and falls back to a FILE lookup at that path — it never reconsiders `source`, so the first import of the subpath fails the whole bundle. A genuinely built package carries no `source` condition and is skipped.\n",
+    );
+    for (const msg of metroFallbacks) console.error(`  ${msg}`);
+    console.error("");
+  }
+
+  if (rnWebExports.violations.length) {
+    failed = true;
+    console.error(
+      'Convention (MPO-199 REACT-NATIVE-WEB EXPORT): a NAMED import from "react-native" must name something react-native-web exports. Every web build aliases react-native to react-native-web, so a name it does not export is a module-evaluation SyntaxError that takes the WHOLE bundle down — every story in the gallery, not just the importing component — and a Platform.OS guard cannot help, because the import fails before any code runs. Read it off a namespace import (`import * as ReactNative from "react-native"`) or move the call into a .native.tsx sibling. `import type { … }` is erased and never counts.\n',
+    );
+    for (const msg of rnWebExports.violations) console.error(`  ${msg}`);
+    console.error("");
+  }
+
+  if (importMeta.length) {
+    failed = true;
+    console.error(
+      "Convention (MPO-204 NO import.meta IN public/*/src): `import.meta` is legal only in an ES module. In a CLASSIC script it is a PARSE-time SyntaxError, so no `typeof import.meta` guard and no try/catch around it ever runs — the file never parses and takes its consumers with it, silently. Two bundles execute mpo as a classic script: the vxrn/rolldown native bundle for Hermes, and any Metro bundle for platform=web, which is what an Expo DOM component (`'use dom'`) is. Read a static `process.env.<KEY>` member expression inside try/catch instead (public/platform/src/config/runtimeConfig.ts), or take an SSR flag from `isServer` in @multiplatform.one/platform. A .web.ts twin is not an escape — One's web build and tamagui-build resolve it like Metro. Node-only build tooling (a file importing a `node:` builtin) and specs are exempt.\n",
+    );
+    for (const msg of importMeta) console.error(`  ${msg}`);
+    console.error("");
+  }
+
   if (tokens.violations.length) {
     failed = true;
     console.error(
@@ -897,6 +1342,7 @@ export function runConventionChecks(options = {}) {
     ["style token", styleTokens.ok],
     ["theme name", themeNames.ok],
     ["intent", intents.ok],
+    ["react-native-web export", rnWebExports.ok],
   ]) {
     if (!ok) {
       console.warn(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/config",
-  "version": "7.6.3",
+  "version": "7.7.1",
   "description": "Shared build and test configuration presets for multiplatform.one",
   "keywords": [
     "config",
@@ -102,7 +102,7 @@
     "vite-plugin-external": "^6.2.2",
     "vite-plugin-i18next-loader": "^3.1.3",
     "vitest": "^4.1.5",
-    "@multiplatform.one/utils": "7.6.3"
+    "@multiplatform.one/utils": "7.7.1"
   },
   "devDependencies": {
     "tsdown": "^0.21.10",

package/src/baseTsconfigTypes.spec.ts

@@ -0,0 +1,42 @@
+/**
+ * The shared `types` array is load-bearing — MPO-109.
+ *
+ * `public/config/tsconfig/base.json` sets `compilerOptions.types`, which turns
+ * OFF automatic @types inclusion for every program in the workspace. Anything
+ * missing from that list is simply absent, with no error at the point of loss.
+ *
+ * `chai` is the one that bit. @vitest/expect declares
+ *
+ *   interface Assertion<T> extends VitestAssertion<Chai.Assertion, T>, ...
+ *
+ * so with no global `Chai` namespace the base interface collapses and takes
+ * `.not` and the jest-dom matchers with it. Measured on 2026-09-04 against
+ * origin/main cb157dd0f: public/components 421 -> 26, public/forms 343 -> 4,
+ * features 168 -> 138, public/utils 4 -> 0, and no package got worse.
+ *
+ * Same shape as the workspace `paths` map: a config key that REPLACES rather
+ * than merges, quietly dropping what it did not enumerate.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+const baseTsconfig = path.resolve(__dirname, "../tsconfig/base.json");
+
+/** JSONC: whole-line `//` comments only, plus trailing commas. */
+function readJsonc(file: string): any {
+  const src = fs.readFileSync(file, "utf8");
+  return JSON.parse(src.replace(/^[ \t]*\/\/.*$/gm, "").replace(/,(\s*[}\]])/g, "$1"));
+}
+
+describe("base tsconfig types (MPO-109)", () => {
+  it("keeps chai in the explicit types array", () => {
+    const types = readJsonc(baseTsconfig)?.compilerOptions?.types;
+    expect(types).toContain("chai");
+  });
+
+  it("keeps the jest-dom vitest matchers alongside it", () => {
+    const types = readJsonc(baseTsconfig)?.compilerOptions?.types;
+    expect(types).toContain("@testing-library/jest-dom/vitest");
+  });
+});

package/src/emittingTsconfigPaths.spec.ts

@@ -0,0 +1,85 @@
+/**
+ * Emitting programs must not inherit the workspace `paths` map — MPO-109.
+ *
+ * `tsconfig.base.json` extends `tamagui-workspace-paths.generated.json`, which
+ * points every `@multiplatform.one/*` specifier at a sibling's repo-relative
+ * `src/`. That is right for a typecheck program and wrong for one that emits
+ * declarations under a `rootDir`: a `paths` hit makes the sibling source a file
+ * OF THAT PROGRAM, so `rootDir` rejects it —
+ *
+ *   TS6059 File 'public/utils/src/dev.ts' is not under rootDir '.../src'
+ *   TS6307 ... is not listed within the file list of project ...
+ *
+ * Every emitting package clears the map and resolves siblings through their
+ * exports `source` condition instead (node_modules-external under
+ * preserveSymlinks, so `rootDir` never sees them). The three vite plugins had
+ * no build config at all and compiled straight off the base, which is how
+ * `@multiplatform.one/utils/dev` broke `build-gnome`. The bare-name form was
+ * already reachable on main, so this guard exists to stop the next one.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+const root = path.resolve(__dirname, "../../..");
+const publicDir = path.join(root, "public");
+
+/** JSONC: whole-line `//` comments only, plus trailing commas. */
+function readJsonc(file: string): any {
+  const src = fs.readFileSync(file, "utf8");
+  return JSON.parse(src.replace(/^[ \t]*\/\/.*$/gm, "").replace(/,(\s*[}\]])/g, "$1"));
+}
+
+function extendsBase(doc: any): boolean {
+  const value = doc?.extends;
+  const list = Array.isArray(value) ? value : [value];
+  return list.some((entry) => typeof entry === "string" && entry.includes("tsconfig.base"));
+}
+
+/** The config each package's `build` script actually hands to tsc. */
+function buildConfigs(): { pkg: string; file: string; doc: any }[] {
+  const found: { pkg: string; file: string; doc: any }[] = [];
+  for (const entry of fs.readdirSync(publicDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const pkgJson = path.join(publicDir, entry.name, "package.json");
+    if (!fs.existsSync(pkgJson)) continue;
+    const build = JSON.parse(fs.readFileSync(pkgJson, "utf8"))?.scripts?.build;
+    if (typeof build !== "string") continue;
+    const named = build.match(/tsc\s+(?:-p|--project)\s+(\S+)/)?.[1];
+    const file = path.join(publicDir, entry.name, named ?? "tsconfig.json");
+    if (!/\btsc\b/.test(build) || !fs.existsSync(file)) continue;
+    found.push({ pkg: entry.name, file, doc: readJsonc(file) });
+  }
+  return found;
+}
+
+describe("emitting tsconfigs (MPO-109)", () => {
+  it("finds the build configs", () => {
+    expect(buildConfigs().length).toBeGreaterThan(10);
+  });
+
+  it("never lets a rootDir-constrained emitting program inherit the workspace paths map", () => {
+    const offenders = buildConfigs()
+      .filter(({ doc }) => {
+        const co = doc?.compilerOptions ?? {};
+        if (co.noEmit === true || co.rootDir === undefined) return false;
+        if (!extendsBase(doc)) return false;
+        // Clearing the inherited map is the fix; `{}` counts.
+        return co.paths === undefined;
+      })
+      .map(({ pkg, file }) => `${pkg} (${path.relative(root, file)})`);
+    expect(offenders).toEqual([]);
+  });
+
+  it("gives every such program the exports `source` condition to resolve siblings with", () => {
+    const missing = buildConfigs()
+      .filter(({ doc }) => {
+        const co = doc?.compilerOptions ?? {};
+        if (co.noEmit === true || co.rootDir === undefined) return false;
+        if (!extendsBase(doc)) return false;
+        return !(co.customConditions ?? []).includes("source");
+      })
+      .map(({ pkg }) => pkg);
+    expect(missing).toEqual([]);
+  });
+});