@multiplatform.one/config 7.6.3 → 7.7.1

package/src/lint.spec.ts

@@ -51,6 +51,73 @@ describe("runConventionChecks", () => {
   });
 });
 
+describe("workspace paths shadow (MPO-109)", () => {
+  function run(root: string) {
+    const error = vi.spyOn(console, "error").mockImplementation(() => {});
+    const log = vi.spyOn(console, "log").mockImplementation(() => {});
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const code = runConventionChecks({ roots: { root } });
+    const messages = error.mock.calls.map((call) => String(call[0])).join("\n");
+    error.mockRestore();
+    log.mockRestore();
+    warn.mockRestore();
+    return { code, messages };
+  }
+
+  it("fails an app tsconfig that declares paths while extending tsconfig.base", () => {
+    const root = makeTree();
+    writeFileSync(
+      join(root, "apps", "demo", "tsconfig.json"),
+      `{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "paths": { "@/*": ["./*"] }
+  }
+}
+`,
+    );
+    const { code, messages } = run(root);
+    expect(code).toBe(1);
+    expect(messages).toContain("WORKSPACE PATHS SHADOW");
+    expect(messages).toContain("apps/demo/tsconfig.json");
+  });
+
+  it("passes with no paths, with an escape comment, and when the config does not extend the base", () => {
+    const root = makeTree();
+    writeFileSync(
+      join(root, "apps", "demo", "tsconfig.json"),
+      `{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": { "noEmit": true }
+}
+`,
+    );
+    mkdirSync(join(root, "features", "escaped"), { recursive: true });
+    mkdirSync(join(root, "public", "standalone"), { recursive: true });
+    writeFileSync(
+      join(root, "public", "standalone", "tsconfig.json"),
+      `{
+  "compilerOptions": { "paths": { "@/*": ["./*"] } }
+}
+`,
+    );
+    mkdirSync(join(root, "packages", "escaped"), { recursive: true });
+    writeFileSync(
+      join(root, "packages", "escaped", "tsconfig.json"),
+      `{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    // workspace-paths-escape: this program deliberately owns its own map
+    "paths": { "@/*": ["./*"] }
+  }
+}
+`,
+    );
+    expect(run(root).code).toBe(0);
+  });
+});
+
 describe("story file shape (MPO-93)", () => {
   function storyTree() {
     const root = makeTree();
@@ -172,3 +239,315 @@ describe("undeclared drawing file (MPO-17)", () => {
     expect(code).toBe(0);
   });
 });
+
+describe("metro subpath fallback (MPO-185)", () => {
+  function pkgTree(pkg: Record<string, unknown>) {
+    const root = makeTree();
+    mkdirSync(join(root, "public", "pkg", "src"), { recursive: true });
+    writeFileSync(join(root, "public", "pkg", "src", "thing.ts"), "export const thing = 1;\n");
+    writeFileSync(
+      join(root, "public", "pkg", "package.json"),
+      JSON.stringify({ name: "@multiplatform.one/pkg", ...pkg }, null, 2),
+    );
+    return root;
+  }
+  function run(root: string) {
+    const error = vi.spyOn(console, "error").mockImplementation(() => {});
+    const log = vi.spyOn(console, "log").mockImplementation(() => {});
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const code = runConventionChecks({ roots: { root } });
+    const lines = error.mock.calls.map((c) => String(c[0]));
+    error.mockRestore();
+    log.mockRestore();
+    warn.mockRestore();
+    return { code, lines };
+  }
+  const sourceConsumed = {
+    source: "src/index.ts",
+    main: "src/index.ts",
+    exports: {
+      "./package.json": "./package.json",
+      "./src/*": "./src/*",
+      ".": { source: "./src/index.ts", import: "./dist/esm/index.mjs" },
+    },
+  };
+
+  it("fails a source-consumed subpath whose Metro condition points into dist/ with no fallback file", () => {
+    const root = pkgTree({
+      ...sourceConsumed,
+      exports: {
+        ...sourceConsumed.exports,
+        "./thing": {
+          source: "./src/thing.ts",
+          types: "./types/thing.d.ts",
+          import: "./dist/esm/thing.mjs",
+          require: "./dist/cjs/thing.cjs",
+          default: "./src/thing.ts",
+        },
+      },
+    });
+    const { code, lines } = run(root);
+    expect(code).toBe(1);
+    expect(lines.join("\n")).toMatch(/MPO-185 METRO SUBPATH FALLBACK/);
+    expect(lines.join("\n")).toMatch(
+      /public\/pkg\/package\.json — "\.\/thing" resolves to \.\/dist\/esm\/thing\.mjs on ios/,
+    );
+  });
+
+  it("fails when only the nested react-native condition points into dist/", () => {
+    const root = pkgTree({
+      ...sourceConsumed,
+      exports: {
+        ...sourceConsumed.exports,
+        "./thing": {
+          source: "./src/thing.ts",
+          "react-native": { import: "./dist/esm/thing.native.js" },
+          default: "./src/thing.ts",
+        },
+      },
+    });
+    const { code, lines } = run(root);
+    expect(code).toBe(1);
+    expect(lines.join("\n")).toMatch(/resolves to \.\/dist\/esm\/thing\.native\.js on ios/);
+  });
+
+  it("passes once <pkg>/<subpath>.ts exists on disk", () => {
+    const root = pkgTree({
+      ...sourceConsumed,
+      exports: {
+        ...sourceConsumed.exports,
+        "./thing": { source: "./src/thing.ts", import: "./dist/esm/thing.mjs" },
+      },
+    });
+    writeFileSync(join(root, "public", "pkg", "thing.ts"), 'export * from "./src/thing";\n');
+    expect(run(root).code).toBe(0);
+  });
+
+  it("passes a subpath whose first Metro condition already lands in src/ on every platform", () => {
+    const root = pkgTree({
+      ...sourceConsumed,
+      exports: {
+        ...sourceConsumed.exports,
+        "./thing": { source: "./src/thing.ts", default: "./src/thing.ts" },
+      },
+    });
+    expect(run(root).code).toBe(0);
+  });
+
+  it("skips a built package with no source condition (keycloak-js shape) and ignores `.` and wildcards", () => {
+    const root = pkgTree({
+      main: "./dist/index.js",
+      exports: {
+        ".": { types: "./dist/index.d.ts", import: "./dist/index.js", default: "./dist/index.js" },
+        "./authz": { types: "./dist/authz.d.ts", import: "./dist/authz.js" },
+        "./dist/*": "./dist/*",
+      },
+    });
+    expect(run(root).code).toBe(0);
+  });
+});
+
+describe("react-native-web export guard (MPO-199)", () => {
+  /**
+   * The vocabulary comes from the INSTALLED react-native-web, so the fixture
+   * ships its own `dist/index.js` — that is also the proof the check reads the
+   * list rather than carrying a hardcoded guess.
+   */
+  function rnwTree(exportNames: string[] = ["Platform", "Pressable", "View"]) {
+    const root = makeTree();
+    const dist = join(root, "node_modules", "react-native-web", "dist");
+    mkdirSync(dist, { recursive: true });
+    writeFileSync(
+      join(dist, "index.js"),
+      `${exportNames
+        .map((name) => `export { default as ${name} } from './exports/${name}';`)
+        .join("\n")}\n`,
+    );
+    mkdirSync(join(root, "public", "forms", "src", "fields", "Select"), { recursive: true });
+    return root;
+  }
+
+  function run(root: string) {
+    const error = vi.spyOn(console, "error").mockImplementation(() => {});
+    const log = vi.spyOn(console, "log").mockImplementation(() => {});
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const code = runConventionChecks({ roots: { root } });
+    const messages = error.mock.calls.map((call) => String(call[0])).join("\n");
+    error.mockRestore();
+    log.mockRestore();
+    warn.mockRestore();
+    return { code, messages };
+  }
+
+  const selectFile = join("public", "forms", "src", "fields", "Select", "index.tsx");
+
+  it("fails the historic Select import (2b94d9eeb) and names the file, line and missing export", () => {
+    const root = rnwTree();
+    writeFileSync(
+      join(root, selectFile),
+      `import { useState } from "react";
+import { ActionSheetIOS, Platform, Pressable as RNPressable } from "react-native";
+
+export const Select = () => (ActionSheetIOS && Platform && RNPressable ? useState : null);
+`,
+    );
+    const { code, messages } = run(root);
+    expect(code).toBe(1);
+    expect(messages).toContain("REACT-NATIVE-WEB EXPORT");
+    expect(messages).toContain(`${selectFile}:2 — ActionSheetIOS`);
+  });
+
+  it("passes the namespace read (8c62c2a6f), a type-only import, aliases and exported names", () => {
+    const root = rnwTree();
+    writeFileSync(
+      join(root, selectFile),
+      `import * as ReactNative from "react-native";
+import { Platform, Pressable as RNPressable } from "react-native";
+import type { GestureResponderEvent } from "react-native";
+import { View, type LayoutChangeEvent } from "react-native";
+
+export const sheet = (ReactNative as { ActionSheetIOS?: unknown }).ActionSheetIOS;
+export const parts = { Platform, RNPressable, View };
+export type Events = GestureResponderEvent | LayoutChangeEvent;
+`,
+    );
+    expect(run(root).code).toBe(0);
+  });
+
+  it("never flags a platform-suffixed file the web resolver cannot reach", () => {
+    const root = rnwTree();
+    mkdirSync(join(root, "public", "rich-text", "src", "toolbar"), { recursive: true });
+    writeFileSync(
+      join(root, "public", "rich-text", "src", "toolbar", "ColorPicker.native.tsx"),
+      'import { ActionSheetIOS, Alert, Platform } from "react-native";\nexport const p = { ActionSheetIOS, Alert, Platform };\n',
+    );
+    writeFileSync(
+      join(root, "public", "forms", "src", "fields", "Select", "index.ios.tsx"),
+      'import { ActionSheetIOS } from "react-native";\nexport const p = ActionSheetIOS;\n',
+    );
+    expect(run(root).code).toBe(0);
+  });
+
+  it("does not attribute a neighbouring import's names to react-native", () => {
+    const root = rnwTree();
+    writeFileSync(
+      join(root, selectFile),
+      `import { useCallback } from "react";
+import { CaretDownIcon } from "@phosphor-icons/react";
+import { Platform } from "react-native";
+
+export const parts = { useCallback, CaretDownIcon, Platform };
+`,
+    );
+    expect(run(root).code).toBe(0);
+  });
+});
+
+describe("no import.meta in public/*/src (MPO-204)", () => {
+  function run(root: string) {
+    const error = vi.spyOn(console, "error").mockImplementation(() => {});
+    const log = vi.spyOn(console, "log").mockImplementation(() => {});
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const code = runConventionChecks({ roots: { root } });
+    const messages = error.mock.calls.map((call) => String(call[0])).join("\n");
+    error.mockRestore();
+    log.mockRestore();
+    warn.mockRestore();
+    return { code, messages };
+  }
+
+  function publicSrc(root: string, pkg: string, name: string, body: string) {
+    mkdirSync(join(root, "public", pkg, "src"), { recursive: true });
+    writeFileSync(join(root, "public", pkg, "src", name), body);
+    return join("public", pkg, "src", name);
+  }
+
+  it("fails a live import.meta.env read and names the file and line", () => {
+    const root = makeTree();
+    const file = publicSrc(
+      root,
+      "frappe",
+      "useLiveQuery.ts",
+      `const IS_SSR: boolean = (() => {
+  try {
+    return (import.meta as ImportMeta & { env?: { SSR?: boolean } }).env?.SSR === true;
+  } catch {
+    return false;
+  }
+})();
+export default IS_SSR;
+`,
+    );
+    const { code, messages } = run(root);
+    expect(code).toBe(1);
+    expect(messages).toContain("NO import.meta IN public/*/src");
+    expect(messages).toContain(`${file}:3`);
+  });
+
+  it("ignores the token inside comments and strings, which is how the fix documents itself", () => {
+    const root = makeTree();
+    publicSrc(
+      root,
+      "platform",
+      "runtimeConfig.ts",
+      `/**
+ * Build-time config with no import.meta anywhere: in a classic script
+ * import.meta is a parse-time SyntaxError.
+ */
+// a bare \`typeof import.meta\` guard is NOT replaced
+export const why = "import.meta is banned here";
+export function bakedEnv() {
+  try {
+    return { VITE_MP_CONFIG: process.env.VITE_MP_CONFIG };
+  } catch {
+    return {};
+  }
+}
+`,
+    );
+    expect(run(root).code).toBe(0);
+  });
+
+  it("exempts Node-only build tooling by construction: a value import of a node: builtin", () => {
+    const root = makeTree();
+    publicSrc(
+      root,
+      "config",
+      "vitest.ts",
+      `import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const here = path.dirname(fileURLToPath(import.meta.url));
+`,
+    );
+    expect(run(root).code).toBe(0);
+  });
+
+  it("does NOT let a type-only node: import buy the exemption", () => {
+    const root = makeTree();
+    const file = publicSrc(
+      root,
+      "components",
+      "widget.ts",
+      `import type { PathLike } from "node:fs";
+
+export const mode = (import.meta as ImportMeta & { env?: { MODE?: string } }).env?.MODE;
+export type Where = PathLike;
+`,
+    );
+    const { code, messages } = run(root);
+    expect(code).toBe(1);
+    expect(messages).toContain(`${file}:3`);
+  });
+
+  it("exempts specs, which vitest runs in node and hands a real import.meta.env", () => {
+    const root = makeTree();
+    publicSrc(
+      root,
+      "markdown",
+      "nativeGraph.spec.ts",
+      'export const dir = new URL(".", import.meta.url).pathname;\n',
+    );
+    expect(run(root).code).toBe(0);
+  });
+});

package/src/singletonDepAliases.spec.ts

@@ -0,0 +1,83 @@
+import fs from "node:fs";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { createStorybookViteConfig } from "./storybook";
+import { singletonDepAliases } from "./singletonDepAliases";
+
+const workspaceRoot = path.resolve(__dirname, "../../..");
+
+describe("singletonDepAliases", () => {
+  it("pins react-cookie to one existing package directory (MPO-215)", () => {
+    // react-cookie runs React.createContext(null) at module scope. Two
+    // realpaths for it means two contexts: @multiplatform.one/storybook's
+    // framework decorator renders <CookiesProvider> from one and
+    // @multiplatform.one/theme's useTheme reads useCookies from the other,
+    // which throws "Missing <CookiesProvider>" with the provider sitting two
+    // lines above it in the same tree.
+    const aliases = singletonDepAliases(workspaceRoot);
+    expect(aliases["react-cookie"]).toBeTruthy();
+    expect(path.isAbsolute(aliases["react-cookie"])).toBe(true);
+    expect(fs.existsSync(path.join(aliases["react-cookie"], "package.json"))).toBe(true);
+  });
+
+  it("pins the tamagui theme record to one package directory (MPO-217)", () => {
+    // @tamagui/web owns the theme context. Two realpaths for it means two
+    // contexts: public/frappe's story files import "tamagui" from a package
+    // with no copy of its own, so they reach the hoisted chain while every
+    // other importer reaches the pnpm store chain, and their components read
+    // a context no provider ever wrote to — tamagui's `Missing theme.`.
+    const aliases = singletonDepAliases(workspaceRoot);
+    for (const pkg of ["@tamagui/core", "@tamagui/web"]) {
+      expect(aliases[pkg], `${pkg} must be pinned`).toBeTruthy();
+      expect(path.isAbsolute(aliases[pkg])).toBe(true);
+      expect(fs.existsSync(path.join(aliases[pkg], "package.json"))).toBe(true);
+    }
+  });
+
+  it("does not pin tamagui itself (MPO-217)", () => {
+    // A directory alias would resolve "tamagui/linear-gradient" to the
+    // metro-compat stub that requires the CJS build, instead of the ESM
+    // target the exports map picks for the browser. Pinning core and web is
+    // enough: both tamagui records import @tamagui/core by bare specifier.
+    expect(singletonDepAliases(workspaceRoot).tamagui).toBeUndefined();
+  });
+
+  it("omits packages that are not installed", () => {
+    // Resolution runs against the given root, so a consumer without the
+    // package gets no alias rather than a broken one.
+    const aliases = singletonDepAliases(path.join(workspaceRoot, "public", "config"));
+    for (const target of Object.values(aliases)) {
+      expect(fs.existsSync(target)).toBe(true);
+    }
+  });
+});
+
+describe("createStorybookViteConfig react-cookie singleton", () => {
+  const config = createStorybookViteConfig({ workspaceRoot });
+
+  it("aliases react-cookie so the build cannot resolve two module records", () => {
+    // resolve.dedupe does NOT cover this. Measured against Vite 8 / Rolldown:
+    // a build carrying dedupe: ["react-cookie"] emitted a byte-identical
+    // iframe chunk and the story still threw. The alias is what moves it.
+    const alias = (config.resolve?.alias ?? {}) as Record<string, string>;
+    expect(alias["react-cookie"]).toBeTruthy();
+    expect(path.isAbsolute(alias["react-cookie"])).toBe(true);
+  });
+
+  it("aliases the tamagui theme record so the build cannot split it (MPO-217)", () => {
+    const alias = (config.resolve?.alias ?? {}) as Record<string, string>;
+    for (const pkg of ["@tamagui/core", "@tamagui/web"]) {
+      expect(alias[pkg], `${pkg} must be aliased`).toBeTruthy();
+      expect(path.isAbsolute(alias[pkg])).toBe(true);
+    }
+    expect(alias.tamagui).toBeUndefined();
+  });
+
+  it("pre-bundles react-cookie in dev so dev and build share one record", () => {
+    // The dev server hid this bug for as long as it existed: the optimizer
+    // keys pre-bundled deps by package NAME, so both realpaths collapsed onto
+    // one deps/react-cookie.js and every story rendered. Listing it keeps dev
+    // explicit about the same invariant the build now pins by alias.
+    expect(config.optimizeDeps?.include ?? []).toContain("react-cookie");
+  });
+});

package/src/singletonDepAliases.ts

@@ -0,0 +1,105 @@
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+
+/**
+ * Packages that create a React context at module scope and must therefore
+ * resolve to exactly ONE module record across the whole bundle.
+ *
+ * MPO-215. `react-cookie` runs `React.createContext(null)` when its entry
+ * evaluates. `@multiplatform.one/storybook` renders `<CookiesProvider>` in the
+ * framework decorator and `@multiplatform.one/theme`'s `useTheme` reads it via
+ * `useCookies`, so provider and consumer live in two different workspace
+ * packages. When those two packages resolve `react-cookie` to two different
+ * realpaths — a hoisted `node_modules/react-cookie` for the importer that does
+ * not declare it, the pnpm store copy for the one that does — the entry
+ * evaluates twice, there are two contexts, and `useCookies` throws
+ * `Missing <CookiesProvider>` with the provider sitting two lines above it in
+ * the same tree.
+ *
+ * Nothing catches that today. The dev server pre-bundles bare imports by
+ * package NAME, which collapses both realpaths onto one `deps/react-cookie.js`
+ * and renders fine; the production build has no optimizer, so both paths
+ * survive, every story renders Storybook's error panel, and
+ * `storybook build` still exits 0.
+ *
+ * `resolve.dedupe` does not fix it: measured against Vite 8 / Rolldown, a
+ * build with `dedupe: ["react-cookie"]` emitted a byte-identical iframe chunk
+ * and the story still threw. An alias to one absolute directory does, which is
+ * the same instrument the storybook config already uses to pin react,
+ * react-dom and react-is.
+ *
+ * MPO-217. `@tamagui/web` is the same shape. It owns the theme context, the
+ * style registry and the config singleton; `@tamagui/core` re-exports it and
+ * `tamagui` re-exports that, so every tamagui component in the tree reads the
+ * theme through whichever `@tamagui/web` record its own import chain reached.
+ *
+ * Measured on the build's module graph at e19a0fda3: `tamagui` resolved to
+ * two realpaths. 562 importers (public/components, public/backoffice,
+ * public/storybook and the rest) took the pnpm store copy, whose chain is
+ * store `tamagui` -> store `@tamagui/core` -> store `@tamagui/web`; five took
+ * the hoisted `node_modules/tamagui`, which has no nested node_modules and so
+ * walks up to the hoisted `@tamagui/core` and `@tamagui/web`. Those five were
+ * public/frappe's story files — the only modules in the repo that import
+ * `tamagui` from a package with no copy of its own — and their 14 stories were
+ * the 14 that threw `Missing theme.` on storybook-static while rendering on
+ * dev. The theme provider is mounted from the store record; their `Button`,
+ * `Text` and `YStack` read the hoisted record's context, which no provider
+ * ever wrote to.
+ *
+ * `tamagui` itself is deliberately NOT pinned. A directory alias resolves
+ * `tamagui/linear-gradient` to `node_modules/tamagui/linear-gradient/`, a
+ * metro-compat stub that `require`s the CJS build, instead of the ESM target
+ * the package's exports map picks for the browser. Pinning core and web is
+ * enough: both `tamagui` records import `@tamagui/core` by bare specifier, so
+ * they funnel into one web record and one theme context.
+ */
+const CONTEXT_SINGLETONS: readonly string[] = ["react-cookie", "@tamagui/core", "@tamagui/web"];
+
+/**
+ * Vite `resolve.alias` entries pinning each context singleton to one directory.
+ *
+ * Alias keys match the whole specifier or a `key + "/"` prefix, so subpath
+ * imports follow the same copy instead of resolving independently. Entries are
+ * omitted when the package is not installed, so a consumer that does not use
+ * cookies is unaffected.
+ *
+ * @param root Directory whose `node_modules` the packages resolve from.
+ */
+export function singletonDepAliases(root: string = process.cwd()): Record<string, string> {
+  const aliases: Record<string, string> = {};
+  const requireFrom = createRequire(path.join(root, "package.json"));
+
+  for (const pkgName of CONTEXT_SINGLETONS) {
+    const pkgDir = resolvePackageDir(pkgName, root, requireFrom);
+    if (pkgDir) aliases[pkgName] = pkgDir;
+  }
+
+  return aliases;
+}
+
+function resolvePackageDir(
+  pkgName: string,
+  root: string,
+  requireFrom: NodeRequire,
+): string | undefined {
+  try {
+    return path.dirname(requireFrom.resolve(`${pkgName}/package.json`));
+  } catch {
+    // react-cookie 8's exports map declares only ".", so "./package.json" is
+    // ERR_PACKAGE_PATH_NOT_EXPORTED. Resolve the entry instead and walk up to
+    // the directory that owns it — the pnpm store copy when nothing is
+    // hoisted, which is exactly the copy that must win.
+    try {
+      let dir = path.dirname(requireFrom.resolve(pkgName));
+      while (dir !== path.dirname(dir)) {
+        if (fs.existsSync(path.join(dir, "package.json"))) return dir;
+        dir = path.dirname(dir);
+      }
+    } catch {
+      // not installed
+    }
+    const hoisted = path.join(root, "node_modules", ...pkgName.split("/"));
+    return fs.existsSync(path.join(hoisted, "package.json")) ? hoisted : undefined;
+  }
+}

package/src/storybook.ts

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import type { Plugin, UserConfig } from "vite";
+import { singletonDepAliases } from "./singletonDepAliases.js";
 import { unexportedDepAliases } from "./unexportedDepAliases.js";
 import { discoverPublicPackageRoots, resolvePackageMainSource } from "./workspacePublicPackages.js";
 import { ensureTamaguiWorkspacePaths } from "./tamaguiWorkspacePaths.js";
@@ -59,6 +60,9 @@ export function createStorybookViteConfig(
     ...discoverPackageAliases(packagesDir),
     ...discoverPublicPackageViteAliases(workspaceRoot),
     ...unexportedDepAliases(workspaceRoot),
+    // MPO-215: last, so a context singleton can never be shadowed by a
+    // discovered workspace alias.
+    ...singletonDepAliases(workspaceRoot),
   };
 
   if (options.aliases) {
@@ -171,6 +175,18 @@ export function createStorybookViteConfig(
         "@tamagui/themes",
         "@tamagui/toast",
         "@tamagui/use-presence",
+        // MPO-215: keep dev on the same single record the build now pins by
+        // alias, so a cookie-context bug can never be dev-only again.
+        "react-cookie",
+        // Subpath, not a package: public/components/src/tamagui.ts re-exports
+        // LinearGradient from "tamagui/linear-gradient" (MPO-21 G2), so the
+        // story graph never reaches "@tamagui/linear-gradient" above. Without
+        // this line the subpath is optimized in whatever generation discovers
+        // it, carries its own tamagui core registry, and
+        // components-lineargradient--default renders 0 nodes with "Can't find
+        // Tamagui configuration" plus the duplicate-instances warning.
+        // "@tamagui/config/v5" above is the same shape.
+        "tamagui/linear-gradient",
         "@mdx-js/react",
         "i18next",
         "react-i18next",

package/src/tamaguiWorkspacePaths.spec.ts

@@ -70,6 +70,40 @@ describe("ensureTamaguiWorkspacePaths", () => {
     expect(notices[0]).toContain("was missing");
   });
 
+  it("emits the subpath exports a package declares (MPO-109)", () => {
+    const { root, configDir } = fakeRepo(fs.readFileSync(realGenerator, "utf8"));
+    fs.mkdirSync(path.join(root, "public/widget/src/desk"), { recursive: true });
+    fs.writeFileSync(path.join(root, "public/widget/src/dev.ts"), "export const dev = 1;\n");
+    fs.writeFileSync(
+      path.join(root, "public/widget/src/desk/Shell.tsx"),
+      "export const Shell = 1;\n",
+    );
+    fs.writeFileSync(
+      path.join(root, "public/widget/package.json"),
+      JSON.stringify({
+        name: "@fake/widget",
+        exports: {
+          ".": { source: "./src/index.ts" },
+          // condition object: the declared `source`, never the gitignored types/
+          "./dev": { source: "./src/dev.ts", types: "./types/dev.d.ts" },
+          // wildcard string target: an app deep-imports through this prefix
+          "./src/*": "./src/*",
+          // declared but absent on disk — must not reach the map
+          "./ghost": { source: "./src/ghost.ts" },
+        },
+      }),
+    );
+    const generatedPath = path.join(configDir, tamaguiWorkspacePathsFile);
+    const result = ensureTamaguiWorkspacePaths({ configPackageDir: configDir, log: () => {} });
+    expect(result.status).toBe("generated");
+    const { paths } = JSON.parse(fs.readFileSync(generatedPath, "utf8")).compilerOptions;
+    expect(paths["@fake/widget"]).toEqual(["../../widget/src/index.ts"]);
+    expect(paths["@fake/widget/dev"]).toEqual(["../../widget/src/dev.ts"]);
+    expect(paths["@fake/widget/src/*"]).toEqual(["../../widget/src/*"]);
+    expect(paths).not.toHaveProperty("@fake/widget/ghost");
+    expect(paths).not.toHaveProperty("@fake/widget/package.json");
+  });
+
   it("leaves an existing file alone and stays silent", () => {
     const { configDir } = fakeRepo(fs.readFileSync(realGenerator, "utf8"));
     const generatedPath = path.join(configDir, tamaguiWorkspacePathsFile);