@multiplatform.one/config 7.7.0 → 7.7.2

package/lib/index.js

@@ -1,5 +1,5 @@
-import { t as createViteConfig } from "./vite-Rv5b8Wxp.js";
-import { t as createStorybookViteConfig } from "./storybook-BnfZmzIL.js";
+import { t as createViteConfig } from "./vite-uwqTTN8M.js";
+import { t as createStorybookViteConfig } from "./storybook-BuO1e8Sb.js";
 import { n as tamaguiWorkspacePathsFile, t as ensureTamaguiWorkspacePaths } from "./tamaguiWorkspacePaths-ZIcqybtn.js";
 import { createVitestConfig } from "./vitest.js";
 

package/lib/{storybook-BnfZmzIL.js → storybook-BuO1e8Sb.js}

@@ -4,6 +4,100 @@ import { createRequire } from "node:module";
 import fs from "node:fs";
 import path from "node:path";
 
+//#region src/singletonDepAliases.ts
+/**
+* Packages that create a React context at module scope and must therefore
+* resolve to exactly ONE module record across the whole bundle.
+*
+* MPO-215. `react-cookie` runs `React.createContext(null)` when its entry
+* evaluates. `@multiplatform.one/storybook` renders `<CookiesProvider>` in the
+* framework decorator and `@multiplatform.one/theme`'s `useTheme` reads it via
+* `useCookies`, so provider and consumer live in two different workspace
+* packages. When those two packages resolve `react-cookie` to two different
+* realpaths — a hoisted `node_modules/react-cookie` for the importer that does
+* not declare it, the pnpm store copy for the one that does — the entry
+* evaluates twice, there are two contexts, and `useCookies` throws
+* `Missing <CookiesProvider>` with the provider sitting two lines above it in
+* the same tree.
+*
+* Nothing catches that today. The dev server pre-bundles bare imports by
+* package NAME, which collapses both realpaths onto one `deps/react-cookie.js`
+* and renders fine; the production build has no optimizer, so both paths
+* survive, every story renders Storybook's error panel, and
+* `storybook build` still exits 0.
+*
+* `resolve.dedupe` does not fix it: measured against Vite 8 / Rolldown, a
+* build with `dedupe: ["react-cookie"]` emitted a byte-identical iframe chunk
+* and the story still threw. An alias to one absolute directory does, which is
+* the same instrument the storybook config already uses to pin react,
+* react-dom and react-is.
+*
+* MPO-217. `@tamagui/web` is the same shape. It owns the theme context, the
+* style registry and the config singleton; `@tamagui/core` re-exports it and
+* `tamagui` re-exports that, so every tamagui component in the tree reads the
+* theme through whichever `@tamagui/web` record its own import chain reached.
+*
+* Measured on the build's module graph at e19a0fda3: `tamagui` resolved to
+* two realpaths. 562 importers (public/components, public/backoffice,
+* public/storybook and the rest) took the pnpm store copy, whose chain is
+* store `tamagui` -> store `@tamagui/core` -> store `@tamagui/web`; five took
+* the hoisted `node_modules/tamagui`, which has no nested node_modules and so
+* walks up to the hoisted `@tamagui/core` and `@tamagui/web`. Those five were
+* public/frappe's story files — the only modules in the repo that import
+* `tamagui` from a package with no copy of its own — and their 14 stories were
+* the 14 that threw `Missing theme.` on storybook-static while rendering on
+* dev. The theme provider is mounted from the store record; their `Button`,
+* `Text` and `YStack` read the hoisted record's context, which no provider
+* ever wrote to.
+*
+* `tamagui` itself is deliberately NOT pinned. A directory alias resolves
+* `tamagui/linear-gradient` to `node_modules/tamagui/linear-gradient/`, a
+* metro-compat stub that `require`s the CJS build, instead of the ESM target
+* the package's exports map picks for the browser. Pinning core and web is
+* enough: both `tamagui` records import `@tamagui/core` by bare specifier, so
+* they funnel into one web record and one theme context.
+*/
+const CONTEXT_SINGLETONS = [
+	"react-cookie",
+	"@tamagui/core",
+	"@tamagui/web"
+];
+/**
+* Vite `resolve.alias` entries pinning each context singleton to one directory.
+*
+* Alias keys match the whole specifier or a `key + "/"` prefix, so subpath
+* imports follow the same copy instead of resolving independently. Entries are
+* omitted when the package is not installed, so a consumer that does not use
+* cookies is unaffected.
+*
+* @param root Directory whose `node_modules` the packages resolve from.
+*/
+function singletonDepAliases(root = process.cwd()) {
+	const aliases = {};
+	const requireFrom = createRequire(path.join(root, "package.json"));
+	for (const pkgName of CONTEXT_SINGLETONS) {
+		const pkgDir = resolvePackageDir$1(pkgName, root, requireFrom);
+		if (pkgDir) aliases[pkgName] = pkgDir;
+	}
+	return aliases;
+}
+function resolvePackageDir$1(pkgName, root, requireFrom) {
+	try {
+		return path.dirname(requireFrom.resolve(`${pkgName}/package.json`));
+	} catch {
+		try {
+			let dir = path.dirname(requireFrom.resolve(pkgName));
+			while (dir !== path.dirname(dir)) {
+				if (fs.existsSync(path.join(dir, "package.json"))) return dir;
+				dir = path.dirname(dir);
+			}
+		} catch {}
+		const hoisted = path.join(root, "node_modules", ...pkgName.split("/"));
+		return fs.existsSync(path.join(hoisted, "package.json")) ? hoisted : void 0;
+	}
+}
+
+//#endregion
 //#region src/unexportedDepAliases.ts
 /**
 * Package subtrees that consumers deep-import but the publisher never declared
@@ -95,7 +189,8 @@ function createStorybookViteConfig(options = {}) {
 	const aliases = {
 		...discoverPackageAliases(path.join(workspaceRoot, "packages")),
 		...discoverPublicPackageViteAliases(workspaceRoot),
-		...unexportedDepAliases(workspaceRoot)
+		...unexportedDepAliases(workspaceRoot),
+		...singletonDepAliases(workspaceRoot)
 	};
 	if (options.aliases) Object.assign(aliases, options.aliases);
 	const sortedAliases = {};
@@ -157,6 +252,8 @@ function createStorybookViteConfig(options = {}) {
 				"@tamagui/themes",
 				"@tamagui/toast",
 				"@tamagui/use-presence",
+				"react-cookie",
+				"tamagui/linear-gradient",
 				"@mdx-js/react",
 				"i18next",
 				"react-i18next",

package/lib/storybook.js

@@ -1,3 +1,3 @@
-import { t as createStorybookViteConfig } from "./storybook-BnfZmzIL.js";
+import { t as createStorybookViteConfig } from "./storybook-BuO1e8Sb.js";
 
 export { createStorybookViteConfig };

package/lib/{vite-Rv5b8Wxp.js → vite-uwqTTN8M.js}

@@ -190,7 +190,13 @@ function createViteConfig(options = {}) {
 	return {
 		css: { modules: { localsConvention: "camelCase" } },
 		build: { chunkSizeWarningLimit: 600 },
-		define: { "process.env.VITE_FRAPPE_ENABLED": JSON.stringify(process.env.VITE_FRAPPE_ENABLED === "true" ? "true" : "false") },
+		define: {
+			"process.env.VITE_FRAPPE_ENABLED": JSON.stringify(process.env.VITE_FRAPPE_ENABLED === "true" ? "true" : "false"),
+			...publicConfigKeys.length > 0 ? {
+				"process.env.VITE_MP_CONFIG": JSON.stringify(process.env.VITE_MP_CONFIG ?? ""),
+				"process.env.VITE_MP_PUBLIC_CONFIG_KEYS": JSON.stringify(process.env.VITE_MP_PUBLIC_CONFIG_KEYS ?? "")
+			} : {}
+		},
 		ssr: ssr || defaultSsr,
 		resolve: {
 			alias: {

package/lib/vite.js

@@ -1,4 +1,4 @@
-import { t as createViteConfig } from "./vite-Rv5b8Wxp.js";
+import { t as createViteConfig } from "./vite-uwqTTN8M.js";
 import { n as publicPackageViteSourceAliases, t as discoverPublicPackageRoots } from "./workspacePublicPackages-COicQSj4.js";
 
 export { createViteConfig, discoverPublicPackageRoots, publicPackageViteSourceAliases };

package/lint.mjs

@@ -27,6 +27,33 @@
  *    whose path is not a DRAWING member in docs/theme-propagation-spec.md.
  *    The oxlint rule skips registered drawings; this check is what makes
  *    adding an undeclared drawing file still fail.
+ * 7. Fail on a METRO SUBPATH WITHOUT A FALLBACK (MPO-185) — a package.json
+ *    subpath export in a source-consumed package whose Metro condition points
+ *    into `dist/` with no `<pkg>/<subpath>.*` file on disk. Metro never
+ *    reconsiders the map's `source` condition after the dist miss, so the
+ *    first import of that subpath fails the whole bundle.
+ * 8. Fail on a REACT-NATIVE NAMED IMPORT WITH NO REACT-NATIVE-WEB EXPORT
+ *    (MPO-199) — a `import { X } from "react-native"` in a file the web
+ *    target resolves, where react-native-web exports no X. The alias makes
+ *    that a module-evaluation SyntaxError, which takes the whole preview
+ *    bundle down rather than one component.
+ * 9. Fail on a `.react-flow__` SELECTOR outside the token bridge (MPO-191) —
+ *    React Flow paints through `var(--xy-thing, var(--xy-thing-default))`, so
+ *    every colour, width and shadow is settable without touching its
+ *    stylesheet. A hand-written `.react-flow__` rule anywhere else forks that
+ *    paint: it wins or loses on specificity rather than on the knob, and the
+ *    next library upgrade silently changes which. The whole point of the
+ *    bridge is that a designer never touches React Flow CSS — including us —
+ *    so the rule is mechanical. `theme/graphVars.ts` (the map) and the
+ *    package's own `css/` tree (outside `src`) are the two places it may live.
+ *    Comments and specs are exempt; strings are not, because a hand-written
+ *    rule lives in a template literal.
+ * 10. Fail on an `import.meta` TOKEN in public/<pkg>/src (MPO-204) — in a
+ *    classic script it is a PARSE-time SyntaxError, and two bundles execute
+ *    mpo as one (the vxrn/rolldown Hermes bundle, and any Metro bundle for
+ *    platform=web, i.e. an Expo DOM component). Node-only build tooling is
+ *    exempt by construction: a file that imports a `node:` builtin cannot run
+ *    in a browser or on Hermes anyway.
  *
  * Usage:
  *   import { runConventionChecks } from "@multiplatform.one/config/lint";
@@ -253,12 +280,16 @@ function keysOfBlock(body, indent) {
 let sourceFileCache;
 function sourceFiles() {
   if (sourceFileCache) return sourceFileCache;
-  /** @type {{ rel: string, src: string }[]} */
+  /** @type {{ abs: string, rel: string, src: string }[]} */
   const files = [];
   const collect = (filePath) => {
     if (!/\.(tsx|ts|jsx|js)$/.test(filePath)) return;
     if (/\.(spec|test)\./.test(filePath)) return;
-    files.push({ rel: relative(ROOT, filePath), src: readFileSync(filePath, "utf8") });
+    files.push({
+      abs: filePath,
+      rel: relative(ROOT, filePath),
+      src: readFileSync(filePath, "utf8"),
+    });
   };
   for (const dir of [PUBLIC_DIR, APPS_DIR, FEATURES_DIR]) walkFiles(dir, collect);
   sourceFileCache = files;
@@ -837,6 +868,414 @@ function checkTsconfigWorkspacePaths() {
   return violations;
 }
 
+/**
+ * Metro (MPO-185): the condition names Metro matches, per platform, when
+ * `resolver.unstable_enablePackageExports` is on. `require`/`import` are
+ * Metro's own defaults; Expo's metro-config adds `react-native` for ios and
+ * android and `browser` for web. `default` always matches. Keys are matched
+ * in the ORDER the exports map declares them, first hit wins, and neither
+ * `source` nor `types` is ever in the set.
+ */
+const METRO_PLATFORM_CONDITIONS = {
+  ios: new Set(["react-native", "import", "require", "default"]),
+  web: new Set(["browser", "import", "require", "default"]),
+};
+/** What Metro's file-based fallback will accept at `<pkg>/<subpath>`. */
+const METRO_FALLBACK_EXTS = ["ts", "tsx", "js", "jsx", "mjs", "cjs"];
+
+/**
+ * First target Metro would pick from an exports-map entry for one condition
+ * set, walking nested condition objects in declaration order.
+ * @param {unknown} target
+ * @param {Set<string>} conditions
+ * @returns {string | null}
+ */
+function metroExportTarget(target, conditions) {
+  if (typeof target === "string") return target;
+  if (Array.isArray(target)) {
+    for (const item of target) {
+      const hit = metroExportTarget(item, conditions);
+      if (hit) return hit;
+    }
+    return null;
+  }
+  if (!target || typeof target !== "object") return null;
+  for (const [key, value] of Object.entries(target)) {
+    if (!conditions.has(key)) continue;
+    const hit = metroExportTarget(value, conditions);
+    if (hit) return hit;
+  }
+  return null;
+}
+
+/**
+ * @param {unknown} target
+ * @returns {boolean} true when any condition in the entry is `source`
+ */
+function declaresSourceCondition(target) {
+  if (!target || typeof target !== "object") return false;
+  if (Array.isArray(target)) return target.some(declaresSourceCondition);
+  return Object.entries(target).some(
+    ([key, value]) => key === "source" || declaresSourceCondition(value),
+  );
+}
+
+/**
+ * @param {string} pkgRoot
+ * @param {string} subpath an exports key such as `./seam`
+ */
+function hasMetroFallback(pkgRoot, subpath) {
+  const base = join(pkgRoot, subpath.replace(/^\.\//, ""));
+  if (METRO_FALLBACK_EXTS.some((ext) => existsSync(`${base}.${ext}`))) return true;
+  if (existsSync(join(base, "package.json"))) return true;
+  return METRO_FALLBACK_EXTS.some((ext) => existsSync(join(base, `index.${ext}`)));
+}
+
+/**
+ * Metro subpath fallback (MPO-185).
+ *
+ * Metro reads the exports map, picks the first condition it recognises, and
+ * if that file is missing it does NOT reconsider `source` or `default`: it
+ * warns and retries as a plain file lookup for `<pkg>/<subpath>.*`. The
+ * packages under public/ and packages/ are consumed from source and never
+ * built, so a subpath whose Metro condition points into `dist/` fails the
+ * whole bundle the first time anything in a Metro graph imports it. The `.`
+ * export is exempt because its file fallback lands on the package root, where
+ * `main`/`module` point at src.
+ *
+ * A package is source-consumed when the entry or the package declares a
+ * `source` condition, or `main` points into src/. A genuinely built package
+ * (keycloak-js: no `source`, `main` in dist, `prepare` builds it) is skipped.
+ */
+function checkMetroSubpathFallbacks() {
+  /** @type {string[]} */
+  const violations = [];
+  for (const dir of [PUBLIC_DIR, PACKAGES_DIR]) {
+    if (!existsSync(dir)) continue;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      const pkgRoot = join(dir, entry.name);
+      const pkgJsonPath = join(pkgRoot, "package.json");
+      if (!existsSync(pkgJsonPath)) continue;
+      let pkg;
+      try {
+        pkg = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
+      } catch {
+        continue;
+      }
+      const exportsMap = pkg?.exports;
+      if (!exportsMap || typeof exportsMap !== "object" || Array.isArray(exportsMap)) continue;
+      const packageFromSource =
+        typeof pkg.source === "string" ||
+        (typeof pkg.main === "string" && /^(\.\/)?src\//.test(pkg.main)) ||
+        declaresSourceCondition(exportsMap["."]);
+      for (const [subpath, target] of Object.entries(exportsMap)) {
+        if (!subpath.startsWith("./") || subpath.includes("*")) continue;
+        if (!packageFromSource && !declaresSourceCondition(target)) continue;
+        if (hasMetroFallback(pkgRoot, subpath)) continue;
+        for (const [platform, conditions] of Object.entries(METRO_PLATFORM_CONDITIONS)) {
+          const resolved = metroExportTarget(target, conditions);
+          if (!resolved || !resolved.startsWith("./dist/")) continue;
+          violations.push(
+            `${relative(ROOT, pkgJsonPath)} — "${subpath}" resolves to ${resolved} on ${platform}, which is unbuilt; add ${relative(ROOT, join(pkgRoot, `${subpath.replace(/^\.\//, "")}.ts`))} re-exporting the source entry`,
+          );
+          break;
+        }
+      }
+    }
+  }
+  return violations;
+}
+
+/**
+ * react-native-web's export list, read from the copy installed under ROOT.
+ *
+ * `dist/index.js` is the file the web target evaluates — it is RNW's `module`
+ * entry and what the storybook alias resolves `react-native` to — so its
+ * `export { … }` clauses ARE the vocabulary. Reading them is what keeps this
+ * check from drifting when RNW is upgraded; a hand-kept list would go stale
+ * the first time upstream adds or drops an export.
+ *
+ * @returns {Set<string> | undefined} undefined when RNW is not installed, which
+ * disables the check rather than failing a partial install.
+ */
+function readReactNativeWebExports() {
+  const entry = join(ROOT, "node_modules", "react-native-web", "dist", "index.js");
+  if (!existsSync(entry)) return undefined;
+  /** @type {Set<string>} */
+  const names = new Set();
+  for (const clause of readFileSync(entry, "utf8").matchAll(/export\s*\{([^}]*)\}/g)) {
+    for (const specifier of clause[1].split(",")) {
+      const name = specifier
+        .trim()
+        .split(/\s+as\s+/)
+        .pop();
+      if (name) names.add(name);
+    }
+  }
+  return names.size ? names : undefined;
+}
+
+/** Platform-suffixed files the web resolver never reaches. */
+const NATIVE_ONLY_FILE_RE = /\.(native|ios|android)\.(tsx|ts|jsx|js)$/;
+
+/**
+ * `import … from "react-native"`, including the multi-line brace form.
+ *
+ * The body may contain no quote and no `;`, which is what stops the non-greedy
+ * match from swallowing an earlier `import … from "react"` and attributing
+ * ITS names to react-native.
+ */
+const REACT_NATIVE_IMPORT_RE = /import\s+([^;'"]*?)from\s*["']react-native["']/g;
+
+/** @param {string} absPath @param {string} dir */
+function isUnder(absPath, dir) {
+  const rel = relative(dir, absPath);
+  return rel !== "" && !rel.startsWith("..");
+}
+
+/**
+ * react-native named import with no react-native-web counterpart (MPO-199).
+ *
+ * Every web build aliases `react-native` to `react-native-web`
+ * (apps/storybook/.storybook/main.ts, createStorybookViteConfig, the app vite
+ * config). RNW does not implement all of react-native, so a NAMED import of
+ * something it never exports is not a missing feature at runtime — it is a
+ * module-evaluation SyntaxError, and one failing module takes the WHOLE bundle
+ * with it. That is how `import { ActionSheetIOS } from "react-native"` in
+ * Select (2b94d9eeb) made every story in the gallery render blank, not just
+ * Select's.
+ *
+ * A `Platform.OS` guard inside the file cannot save it: the import fails
+ * before any code runs. The two legal shapes are a namespace import, which
+ * lands on `undefined` for a missing name (8c62c2a6f, the fix), and a
+ * `.native.tsx` / `.ios.tsx` sibling the web resolver never reaches.
+ *
+ * Scope is public/ and features/ — the trees the preview bundle is built from.
+ * Type-only specifiers are erased before any bundler sees them, so
+ * `import type { GestureResponderEvent }` is fine and stays fine.
+ */
+function checkReactNativeWebExports() {
+  const exported = readReactNativeWebExports();
+  if (!exported) return { ok: false, violations: /** @type {string[]} */ ([]) };
+  /** @type {string[]} */
+  const violations = [];
+  for (const { abs, rel, src } of sourceFiles()) {
+    if (!isUnder(abs, PUBLIC_DIR) && !isUnder(abs, FEATURES_DIR)) continue;
+    if (NATIVE_ONLY_FILE_RE.test(abs)) continue;
+    if (!src.includes("react-native")) continue;
+    for (const statement of src.matchAll(REACT_NATIVE_IMPORT_RE)) {
+      const clause = statement[1].trim();
+      if (/^type\b/.test(clause)) continue;
+      const named = clause.match(/\{([\s\S]*)\}/);
+      // No brace group means a default or `* as ns` import, and a namespace
+      // read of a missing name is `undefined`, never a SyntaxError.
+      if (!named) continue;
+      for (const specifier of named[1].split(",")) {
+        const entry = specifier.trim();
+        if (!entry || /^type\b/.test(entry)) continue;
+        const name = entry.split(/\s+as\s+/)[0].trim();
+        if (!name || exported.has(name)) continue;
+        violations.push(
+          `${rel}:${lineAt(src, statement.index ?? 0)} — ${name} (react-native-web exports no ${name})`,
+        );
+      }
+    }
+  }
+  return { ok: true, violations };
+}
+
+/**
+ * Offsets in `src` that are live CODE — not inside a comment, a string or a
+ * template literal. One left-to-right pass. Regex literals are treated as
+ * code, and a `${…}` interpolation is treated as string, which can only ever
+ * make this check miss something, never invent a violation.
+ *
+ * @param {string} src
+ * @returns {Uint8Array} 1 at every code offset
+ */
+function codeOffsets(src) {
+  const mask = new Uint8Array(src.length);
+  let i = 0;
+  while (i < src.length) {
+    const char = src[i];
+    const next = src[i + 1];
+    if (char === "/" && next === "/") {
+      while (i < src.length && src[i] !== "\n") i++;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      i += 2;
+      while (i < src.length && !(src[i] === "*" && src[i + 1] === "/")) i++;
+      i += 2;
+      continue;
+    }
+    if (char === '"' || char === "'" || char === "`") {
+      const quote = char;
+      i++;
+      while (i < src.length) {
+        if (src[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        if (src[i] === quote) {
+          i++;
+          break;
+        }
+        i++;
+      }
+      continue;
+    }
+    mask[i] = 1;
+    i++;
+  }
+  return mask;
+}
+
+const IMPORT_META_RE = /\bimport\s*\.\s*meta\b/g;
+const IMPORT_META_SCANNED_RE = /\.(tsx|ts|jsx|js|mjs|cjs|mts|cts)$/;
+
+/**
+ * A VALUE import of a node: builtin. `import type { … } from "node:fs"` is
+ * erased, so it proves nothing about where the file runs and does not count.
+ */
+const NODE_BUILTIN_IMPORT_RE =
+  /(?:^|\n)\s*import\s+(?!type\s)[^;'"]*from\s*["']node:[^"']+["']|require\(\s*["']node:[^"']+["']\s*\)|import\(\s*["']node:[^"']+["']\s*\)/;
+
+/**
+ * `import.meta` in a public package's runtime source (MPO-204).
+ *
+ * MPO-192's ruling, generalised. `import.meta` is legal only in an ES module;
+ * in a CLASSIC script it is a PARSE-time SyntaxError, so no `typeof
+ * import.meta` guard and no try/catch around it ever gets to run — the file
+ * simply never parses and takes its consumers down with it, silently. Two
+ * bundles execute mpo as a classic script: the vxrn/rolldown native bundle for
+ * Hermes, and any Metro bundle built for platform=web, which is exactly what
+ * an Expo DOM component (`'use dom'`) is. A `.web.ts` twin is not an escape
+ * either: One's web build and tamagui-build resolve `.web.ts` the way Metro
+ * does, so a twin lands in the Vite build too.
+ *
+ * The replacement is a static `process.env.<KEY>` member read inside a
+ * try/catch (public/platform/src/config/runtimeConfig.ts), or, for an SSR
+ * flag, `isServer` from @multiplatform.one/platform, which is split at the
+ * FILE level rather than by a bundler define.
+ *
+ * Exempt, by construction rather than by allowlist: a file that imports a
+ * `node:` builtin as a value is Node-only build tooling
+ * (@multiplatform.one/config's vite/vitest configs, the CLI,
+ * @multiplatform.one/utils/dev) and could not run in a browser or on Hermes
+ * whatever it did with import.meta. Specs are exempt for the same reason —
+ * vitest runs them in Node and provides `import.meta.env` itself.
+ */
+function checkImportMetaInPublicSource() {
+  /** @type {string[]} */
+  const violations = [];
+  if (!existsSync(PUBLIC_DIR)) return violations;
+  for (const pkg of readdirSync(PUBLIC_DIR, { withFileTypes: true })) {
+    if (!pkg.isDirectory() || pkg.name.startsWith(".") || pkg.name === "node_modules") continue;
+    walkFiles(join(PUBLIC_DIR, pkg.name, "src"), (filePath) => {
+      if (!IMPORT_META_SCANNED_RE.test(filePath)) return;
+      if (/\.(spec|test)\./.test(filePath)) return;
+      const src = readFileSync(filePath, "utf8");
+      if (!IMPORT_META_RE.test(src)) {
+        IMPORT_META_RE.lastIndex = 0;
+        return;
+      }
+      IMPORT_META_RE.lastIndex = 0;
+      if (NODE_BUILTIN_IMPORT_RE.test(src)) return;
+      const mask = codeOffsets(src);
+      for (const match of src.matchAll(IMPORT_META_RE)) {
+        const index = match.index ?? 0;
+        if (mask[index] !== 1) continue;
+        violations.push(`${relative(ROOT, filePath)}:${lineAt(src, index)}`);
+      }
+    });
+  }
+  return violations;
+}
+
+// ── React Flow selectors outside the token bridge (MPO-191) ───────────────
+
+const REACT_FLOW_SELECTOR_RE = /\.react-flow__[\w-]+/g;
+/**
+ * The two files a `.react-flow__` string may live in, both DECLARED boundaries.
+ *
+ * `theme/graphVars.ts` owns the paint: every React Flow surface is set through
+ * its own `--xy-*` variable there, never through a rule.
+ *
+ * `react-flow/xy.ts` owns the @xyflow DOM contract — it is already the one file
+ * allowed to import the library at all (oxlint `no-restricted-imports`), and a
+ * class NAME is part of that contract the same way an exported symbol is. The
+ * long press has to find the pane to listen on it, which is a DOM lookup and
+ * not a paint rule; putting the string at the call site would mean a library
+ * rename lands in a `querySelector` that returns null in silence.
+ */
+const GRAPH_VARS_EXEMPT = ["theme/graphVars.ts", "react-flow/xy.ts"];
+const REACT_FLOW_SCANNED_RE = /\.(tsx|ts|jsx|js|mjs|cjs|css)$/;
+
+/**
+ * Offsets that are NOT inside a comment.
+ *
+ * `codeOffsets` masks strings as well, which is the opposite of what this needs:
+ * a hand-written React Flow rule lives in a template literal or a `className`,
+ * so strings are exactly the interesting part. Comments are not — the map's own
+ * allowlist explains itself by naming `.react-flow__node-input`, and that
+ * explanation must not be the thing that fails the build.
+ * @param {string} src
+ */
+function nonCommentOffsets(src) {
+  const mask = new Uint8Array(src.length).fill(1);
+  let i = 0;
+  while (i < src.length) {
+    const char = src[i];
+    const next = src[i + 1];
+    if (char === "/" && next === "/") {
+      while (i < src.length && src[i] !== "\n") mask[i++] = 0;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      while (i < src.length && !(src[i] === "*" && src[i + 1] === "/")) mask[i++] = 0;
+      mask[i] = 0;
+      mask[i + 1] = 0;
+      i += 2;
+      continue;
+    }
+    i++;
+  }
+  return mask;
+}
+
+/**
+ * MPO-191: a `.react-flow__` selector under public/<pkg>/src, outside the one
+ * file that owns the mapping.
+ */
+function checkGraphVarsCoverage() {
+  /** @type {string[]} */
+  const violations = [];
+  if (!existsSync(PUBLIC_DIR)) return violations;
+  for (const pkg of readdirSync(PUBLIC_DIR, { withFileTypes: true })) {
+    if (!pkg.isDirectory() || pkg.name.startsWith(".") || pkg.name === "node_modules") continue;
+    walkFiles(join(PUBLIC_DIR, pkg.name, "src"), (filePath) => {
+      if (!REACT_FLOW_SCANNED_RE.test(filePath)) return;
+      const posix = filePath.replace(/\\/g, "/");
+      if (GRAPH_VARS_EXEMPT.some((exempt) => posix.endsWith(exempt))) return;
+      // Specs are exempt for the reason check 10 exempts them: a spec that
+      // asserts WHICH classes a variable binds to has to name those classes,
+      // and it ships no paint. Nothing else is exempt, including stories.
+      if (/\.(spec|test)\./.test(filePath)) return;
+      const src = readFileSync(filePath, "utf8");
+      if (!src.includes(".react-flow__")) return;
+      const mask = nonCommentOffsets(src);
+      for (const match of src.matchAll(REACT_FLOW_SELECTOR_RE)) {
+        const index = match.index ?? 0;
+        if (mask[index] !== 1) continue;
+        violations.push(`${relative(ROOT, filePath)}:${lineAt(src, index)} — ${match[0]}`);
+      }
+    });
+  }
+  return violations;
+}
+
 /**
  * Run structural convention checks over a consumer tree.
  *
@@ -851,6 +1290,10 @@ export function runConventionChecks(options = {}) {
   const storyShape = checkStoryFileShape();
   const undeclaredDrawings = checkUndeclaredDrawings();
   const tsconfigPaths = checkTsconfigWorkspacePaths();
+  const metroFallbacks = checkMetroSubpathFallbacks();
+  const rnWebExports = checkReactNativeWebExports();
+  const importMeta = checkImportMetaInPublicSource();
+  const graphVars = checkGraphVarsCoverage();
   const tokens = checkTransitionTokens();
   const styleTokens = checkStyleTokens();
   const themeNames = checkThemeNames();
@@ -926,6 +1369,42 @@ export function runConventionChecks(options = {}) {
     console.error("");
   }
 
+  if (metroFallbacks.length) {
+    failed = true;
+    console.error(
+      "Convention (MPO-185 METRO SUBPATH FALLBACK): a subpath export in a source-consumed package must have a `<pkg>/<subpath>.ts` file re-exporting its source entry. Metro resolves the exports map to dist/, finds nothing (public/ is never built), and falls back to a FILE lookup at that path — it never reconsiders `source`, so the first import of the subpath fails the whole bundle. A genuinely built package carries no `source` condition and is skipped.\n",
+    );
+    for (const msg of metroFallbacks) console.error(`  ${msg}`);
+    console.error("");
+  }
+
+  if (rnWebExports.violations.length) {
+    failed = true;
+    console.error(
+      'Convention (MPO-199 REACT-NATIVE-WEB EXPORT): a NAMED import from "react-native" must name something react-native-web exports. Every web build aliases react-native to react-native-web, so a name it does not export is a module-evaluation SyntaxError that takes the WHOLE bundle down — every story in the gallery, not just the importing component — and a Platform.OS guard cannot help, because the import fails before any code runs. Read it off a namespace import (`import * as ReactNative from "react-native"`) or move the call into a .native.tsx sibling. `import type { … }` is erased and never counts.\n',
+    );
+    for (const msg of rnWebExports.violations) console.error(`  ${msg}`);
+    console.error("");
+  }
+
+  if (graphVars.length) {
+    failed = true;
+    console.error(
+      "Convention (MPO-191 GRAPH VARS COVERAGE): a `.react-flow__` selector belongs in the token bridge, nowhere else. React Flow reads every paint through `var(--xy-thing, var(--xy-thing-default))`, so the whole surface is settable without touching its stylesheet; a rule written anywhere else wins or loses on specificity instead of on the knob, and the next @xyflow/react upgrade silently changes which. Set the variable in `theme/graphVars.ts`, or put the rule in the package's own `css/` tree (outside `src`) where a reviewer reads it whole. A DOM LOOKUP is the one other legitimate use, and it belongs in `react-flow/xy.ts` beside the rest of the @xyflow contract. A mention inside a comment is fine and is not flagged.\n",
+    );
+    for (const msg of graphVars) console.error(`  ${msg}`);
+    console.error("");
+  }
+
+  if (importMeta.length) {
+    failed = true;
+    console.error(
+      "Convention (MPO-204 NO import.meta IN public/*/src): `import.meta` is legal only in an ES module. In a CLASSIC script it is a PARSE-time SyntaxError, so no `typeof import.meta` guard and no try/catch around it ever runs — the file never parses and takes its consumers with it, silently. Two bundles execute mpo as a classic script: the vxrn/rolldown native bundle for Hermes, and any Metro bundle for platform=web, which is what an Expo DOM component (`'use dom'`) is. Read a static `process.env.<KEY>` member expression inside try/catch instead (public/platform/src/config/runtimeConfig.ts), or take an SSR flag from `isServer` in @multiplatform.one/platform. A .web.ts twin is not an escape — One's web build and tamagui-build resolve it like Metro. Node-only build tooling (a file importing a `node:` builtin) and specs are exempt.\n",
+    );
+    for (const msg of importMeta) console.error(`  ${msg}`);
+    console.error("");
+  }
+
   if (tokens.violations.length) {
     failed = true;
     console.error(
@@ -966,6 +1445,7 @@ export function runConventionChecks(options = {}) {
     ["style token", styleTokens.ok],
     ["theme name", themeNames.ok],
     ["intent", intents.ok],
+    ["react-native-web export", rnWebExports.ok],
   ]) {
     if (!ok) {
       console.warn(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/config",
-  "version": "7.7.0",
+  "version": "7.7.2",
   "description": "Shared build and test configuration presets for multiplatform.one",
   "keywords": [
     "config",
@@ -102,7 +102,7 @@
     "vite-plugin-external": "^6.2.2",
     "vite-plugin-i18next-loader": "^3.1.3",
     "vitest": "^4.1.5",
-    "@multiplatform.one/utils": "7.7.0"
+    "@multiplatform.one/utils": "7.7.2"
   },
   "devDependencies": {
     "tsdown": "^0.21.10",

package/src/lint.spec.ts

@@ -239,3 +239,315 @@ describe("undeclared drawing file (MPO-17)", () => {
     expect(code).toBe(0);
   });
 });
+
+describe("metro subpath fallback (MPO-185)", () => {
+  function pkgTree(pkg: Record<string, unknown>) {
+    const root = makeTree();
+    mkdirSync(join(root, "public", "pkg", "src"), { recursive: true });
+    writeFileSync(join(root, "public", "pkg", "src", "thing.ts"), "export const thing = 1;\n");
+    writeFileSync(
+      join(root, "public", "pkg", "package.json"),
+      JSON.stringify({ name: "@multiplatform.one/pkg", ...pkg }, null, 2),
+    );
+    return root;
+  }
+  function run(root: string) {
+    const error = vi.spyOn(console, "error").mockImplementation(() => {});
+    const log = vi.spyOn(console, "log").mockImplementation(() => {});
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const code = runConventionChecks({ roots: { root } });
+    const lines = error.mock.calls.map((c) => String(c[0]));
+    error.mockRestore();
+    log.mockRestore();
+    warn.mockRestore();
+    return { code, lines };
+  }
+  const sourceConsumed = {
+    source: "src/index.ts",
+    main: "src/index.ts",
+    exports: {
+      "./package.json": "./package.json",
+      "./src/*": "./src/*",
+      ".": { source: "./src/index.ts", import: "./dist/esm/index.mjs" },
+    },
+  };
+
+  it("fails a source-consumed subpath whose Metro condition points into dist/ with no fallback file", () => {
+    const root = pkgTree({
+      ...sourceConsumed,
+      exports: {
+        ...sourceConsumed.exports,
+        "./thing": {
+          source: "./src/thing.ts",
+          types: "./types/thing.d.ts",
+          import: "./dist/esm/thing.mjs",
+          require: "./dist/cjs/thing.cjs",
+          default: "./src/thing.ts",
+        },
+      },
+    });
+    const { code, lines } = run(root);
+    expect(code).toBe(1);
+    expect(lines.join("\n")).toMatch(/MPO-185 METRO SUBPATH FALLBACK/);
+    expect(lines.join("\n")).toMatch(
+      /public\/pkg\/package\.json — "\.\/thing" resolves to \.\/dist\/esm\/thing\.mjs on ios/,
+    );
+  });
+
+  it("fails when only the nested react-native condition points into dist/", () => {
+    const root = pkgTree({
+      ...sourceConsumed,
+      exports: {
+        ...sourceConsumed.exports,
+        "./thing": {
+          source: "./src/thing.ts",
+          "react-native": { import: "./dist/esm/thing.native.js" },
+          default: "./src/thing.ts",
+        },
+      },
+    });
+    const { code, lines } = run(root);
+    expect(code).toBe(1);
+    expect(lines.join("\n")).toMatch(/resolves to \.\/dist\/esm\/thing\.native\.js on ios/);
+  });
+
+  it("passes once <pkg>/<subpath>.ts exists on disk", () => {
+    const root = pkgTree({
+      ...sourceConsumed,
+      exports: {
+        ...sourceConsumed.exports,
+        "./thing": { source: "./src/thing.ts", import: "./dist/esm/thing.mjs" },
+      },
+    });
+    writeFileSync(join(root, "public", "pkg", "thing.ts"), 'export * from "./src/thing";\n');
+    expect(run(root).code).toBe(0);
+  });
+
+  it("passes a subpath whose first Metro condition already lands in src/ on every platform", () => {
+    const root = pkgTree({
+      ...sourceConsumed,
+      exports: {
+        ...sourceConsumed.exports,
+        "./thing": { source: "./src/thing.ts", default: "./src/thing.ts" },
+      },
+    });
+    expect(run(root).code).toBe(0);
+  });
+
+  it("skips a built package with no source condition (keycloak-js shape) and ignores `.` and wildcards", () => {
+    const root = pkgTree({
+      main: "./dist/index.js",
+      exports: {
+        ".": { types: "./dist/index.d.ts", import: "./dist/index.js", default: "./dist/index.js" },
+        "./authz": { types: "./dist/authz.d.ts", import: "./dist/authz.js" },
+        "./dist/*": "./dist/*",
+      },
+    });
+    expect(run(root).code).toBe(0);
+  });
+});
+
+describe("react-native-web export guard (MPO-199)", () => {
+  /**
+   * The vocabulary comes from the INSTALLED react-native-web, so the fixture
+   * ships its own `dist/index.js` — that is also the proof the check reads the
+   * list rather than carrying a hardcoded guess.
+   */
+  function rnwTree(exportNames: string[] = ["Platform", "Pressable", "View"]) {
+    const root = makeTree();
+    const dist = join(root, "node_modules", "react-native-web", "dist");
+    mkdirSync(dist, { recursive: true });
+    writeFileSync(
+      join(dist, "index.js"),
+      `${exportNames
+        .map((name) => `export { default as ${name} } from './exports/${name}';`)
+        .join("\n")}\n`,
+    );
+    mkdirSync(join(root, "public", "forms", "src", "fields", "Select"), { recursive: true });
+    return root;
+  }
+
+  function run(root: string) {
+    const error = vi.spyOn(console, "error").mockImplementation(() => {});
+    const log = vi.spyOn(console, "log").mockImplementation(() => {});
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const code = runConventionChecks({ roots: { root } });
+    const messages = error.mock.calls.map((call) => String(call[0])).join("\n");
+    error.mockRestore();
+    log.mockRestore();
+    warn.mockRestore();
+    return { code, messages };
+  }
+
+  const selectFile = join("public", "forms", "src", "fields", "Select", "index.tsx");
+
+  it("fails the historic Select import (2b94d9eeb) and names the file, line and missing export", () => {
+    const root = rnwTree();
+    writeFileSync(
+      join(root, selectFile),
+      `import { useState } from "react";
+import { ActionSheetIOS, Platform, Pressable as RNPressable } from "react-native";
+
+export const Select = () => (ActionSheetIOS && Platform && RNPressable ? useState : null);
+`,
+    );
+    const { code, messages } = run(root);
+    expect(code).toBe(1);
+    expect(messages).toContain("REACT-NATIVE-WEB EXPORT");
+    expect(messages).toContain(`${selectFile}:2 — ActionSheetIOS`);
+  });
+
+  it("passes the namespace read (8c62c2a6f), a type-only import, aliases and exported names", () => {
+    const root = rnwTree();
+    writeFileSync(
+      join(root, selectFile),
+      `import * as ReactNative from "react-native";
+import { Platform, Pressable as RNPressable } from "react-native";
+import type { GestureResponderEvent } from "react-native";
+import { View, type LayoutChangeEvent } from "react-native";
+
+export const sheet = (ReactNative as { ActionSheetIOS?: unknown }).ActionSheetIOS;
+export const parts = { Platform, RNPressable, View };
+export type Events = GestureResponderEvent | LayoutChangeEvent;
+`,
+    );
+    expect(run(root).code).toBe(0);
+  });
+
+  it("never flags a platform-suffixed file the web resolver cannot reach", () => {
+    const root = rnwTree();
+    mkdirSync(join(root, "public", "rich-text", "src", "toolbar"), { recursive: true });
+    writeFileSync(
+      join(root, "public", "rich-text", "src", "toolbar", "ColorPicker.native.tsx"),
+      'import { ActionSheetIOS, Alert, Platform } from "react-native";\nexport const p = { ActionSheetIOS, Alert, Platform };\n',
+    );
+    writeFileSync(
+      join(root, "public", "forms", "src", "fields", "Select", "index.ios.tsx"),
+      'import { ActionSheetIOS } from "react-native";\nexport const p = ActionSheetIOS;\n',
+    );
+    expect(run(root).code).toBe(0);
+  });
+
+  it("does not attribute a neighbouring import's names to react-native", () => {
+    const root = rnwTree();
+    writeFileSync(
+      join(root, selectFile),
+      `import { useCallback } from "react";
+import { CaretDownIcon } from "@phosphor-icons/react";
+import { Platform } from "react-native";
+
+export const parts = { useCallback, CaretDownIcon, Platform };
+`,
+    );
+    expect(run(root).code).toBe(0);
+  });
+});
+
+describe("no import.meta in public/*/src (MPO-204)", () => {
+  function run(root: string) {
+    const error = vi.spyOn(console, "error").mockImplementation(() => {});
+    const log = vi.spyOn(console, "log").mockImplementation(() => {});
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const code = runConventionChecks({ roots: { root } });
+    const messages = error.mock.calls.map((call) => String(call[0])).join("\n");
+    error.mockRestore();
+    log.mockRestore();
+    warn.mockRestore();
+    return { code, messages };
+  }
+
+  function publicSrc(root: string, pkg: string, name: string, body: string) {
+    mkdirSync(join(root, "public", pkg, "src"), { recursive: true });
+    writeFileSync(join(root, "public", pkg, "src", name), body);
+    return join("public", pkg, "src", name);
+  }
+
+  it("fails a live import.meta.env read and names the file and line", () => {
+    const root = makeTree();
+    const file = publicSrc(
+      root,
+      "frappe",
+      "useLiveQuery.ts",
+      `const IS_SSR: boolean = (() => {
+  try {
+    return (import.meta as ImportMeta & { env?: { SSR?: boolean } }).env?.SSR === true;
+  } catch {
+    return false;
+  }
+})();
+export default IS_SSR;
+`,
+    );
+    const { code, messages } = run(root);
+    expect(code).toBe(1);
+    expect(messages).toContain("NO import.meta IN public/*/src");
+    expect(messages).toContain(`${file}:3`);
+  });
+
+  it("ignores the token inside comments and strings, which is how the fix documents itself", () => {
+    const root = makeTree();
+    publicSrc(
+      root,
+      "platform",
+      "runtimeConfig.ts",
+      `/**
+ * Build-time config with no import.meta anywhere: in a classic script
+ * import.meta is a parse-time SyntaxError.
+ */
+// a bare \`typeof import.meta\` guard is NOT replaced
+export const why = "import.meta is banned here";
+export function bakedEnv() {
+  try {
+    return { VITE_MP_CONFIG: process.env.VITE_MP_CONFIG };
+  } catch {
+    return {};
+  }
+}
+`,
+    );
+    expect(run(root).code).toBe(0);
+  });
+
+  it("exempts Node-only build tooling by construction: a value import of a node: builtin", () => {
+    const root = makeTree();
+    publicSrc(
+      root,
+      "config",
+      "vitest.ts",
+      `import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const here = path.dirname(fileURLToPath(import.meta.url));
+`,
+    );
+    expect(run(root).code).toBe(0);
+  });
+
+  it("does NOT let a type-only node: import buy the exemption", () => {
+    const root = makeTree();
+    const file = publicSrc(
+      root,
+      "components",
+      "widget.ts",
+      `import type { PathLike } from "node:fs";
+
+export const mode = (import.meta as ImportMeta & { env?: { MODE?: string } }).env?.MODE;
+export type Where = PathLike;
+`,
+    );
+    const { code, messages } = run(root);
+    expect(code).toBe(1);
+    expect(messages).toContain(`${file}:3`);
+  });
+
+  it("exempts specs, which vitest runs in node and hands a real import.meta.env", () => {
+    const root = makeTree();
+    publicSrc(
+      root,
+      "markdown",
+      "nativeGraph.spec.ts",
+      'export const dir = new URL(".", import.meta.url).pathname;\n',
+    );
+    expect(run(root).code).toBe(0);
+  });
+});

package/src/singletonDepAliases.spec.ts

@@ -0,0 +1,83 @@
+import fs from "node:fs";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { createStorybookViteConfig } from "./storybook";
+import { singletonDepAliases } from "./singletonDepAliases";
+
+const workspaceRoot = path.resolve(__dirname, "../../..");
+
+describe("singletonDepAliases", () => {
+  it("pins react-cookie to one existing package directory (MPO-215)", () => {
+    // react-cookie runs React.createContext(null) at module scope. Two
+    // realpaths for it means two contexts: @multiplatform.one/storybook's
+    // framework decorator renders <CookiesProvider> from one and
+    // @multiplatform.one/theme's useTheme reads useCookies from the other,
+    // which throws "Missing <CookiesProvider>" with the provider sitting two
+    // lines above it in the same tree.
+    const aliases = singletonDepAliases(workspaceRoot);
+    expect(aliases["react-cookie"]).toBeTruthy();
+    expect(path.isAbsolute(aliases["react-cookie"])).toBe(true);
+    expect(fs.existsSync(path.join(aliases["react-cookie"], "package.json"))).toBe(true);
+  });
+
+  it("pins the tamagui theme record to one package directory (MPO-217)", () => {
+    // @tamagui/web owns the theme context. Two realpaths for it means two
+    // contexts: public/frappe's story files import "tamagui" from a package
+    // with no copy of its own, so they reach the hoisted chain while every
+    // other importer reaches the pnpm store chain, and their components read
+    // a context no provider ever wrote to — tamagui's `Missing theme.`.
+    const aliases = singletonDepAliases(workspaceRoot);
+    for (const pkg of ["@tamagui/core", "@tamagui/web"]) {
+      expect(aliases[pkg], `${pkg} must be pinned`).toBeTruthy();
+      expect(path.isAbsolute(aliases[pkg])).toBe(true);
+      expect(fs.existsSync(path.join(aliases[pkg], "package.json"))).toBe(true);
+    }
+  });
+
+  it("does not pin tamagui itself (MPO-217)", () => {
+    // A directory alias would resolve "tamagui/linear-gradient" to the
+    // metro-compat stub that requires the CJS build, instead of the ESM
+    // target the exports map picks for the browser. Pinning core and web is
+    // enough: both tamagui records import @tamagui/core by bare specifier.
+    expect(singletonDepAliases(workspaceRoot).tamagui).toBeUndefined();
+  });
+
+  it("omits packages that are not installed", () => {
+    // Resolution runs against the given root, so a consumer without the
+    // package gets no alias rather than a broken one.
+    const aliases = singletonDepAliases(path.join(workspaceRoot, "public", "config"));
+    for (const target of Object.values(aliases)) {
+      expect(fs.existsSync(target)).toBe(true);
+    }
+  });
+});
+
+describe("createStorybookViteConfig react-cookie singleton", () => {
+  const config = createStorybookViteConfig({ workspaceRoot });
+
+  it("aliases react-cookie so the build cannot resolve two module records", () => {
+    // resolve.dedupe does NOT cover this. Measured against Vite 8 / Rolldown:
+    // a build carrying dedupe: ["react-cookie"] emitted a byte-identical
+    // iframe chunk and the story still threw. The alias is what moves it.
+    const alias = (config.resolve?.alias ?? {}) as Record<string, string>;
+    expect(alias["react-cookie"]).toBeTruthy();
+    expect(path.isAbsolute(alias["react-cookie"])).toBe(true);
+  });
+
+  it("aliases the tamagui theme record so the build cannot split it (MPO-217)", () => {
+    const alias = (config.resolve?.alias ?? {}) as Record<string, string>;
+    for (const pkg of ["@tamagui/core", "@tamagui/web"]) {
+      expect(alias[pkg], `${pkg} must be aliased`).toBeTruthy();
+      expect(path.isAbsolute(alias[pkg])).toBe(true);
+    }
+    expect(alias.tamagui).toBeUndefined();
+  });
+
+  it("pre-bundles react-cookie in dev so dev and build share one record", () => {
+    // The dev server hid this bug for as long as it existed: the optimizer
+    // keys pre-bundled deps by package NAME, so both realpaths collapsed onto
+    // one deps/react-cookie.js and every story rendered. Listing it keeps dev
+    // explicit about the same invariant the build now pins by alias.
+    expect(config.optimizeDeps?.include ?? []).toContain("react-cookie");
+  });
+});

package/src/singletonDepAliases.ts

@@ -0,0 +1,105 @@
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+
+/**
+ * Packages that create a React context at module scope and must therefore
+ * resolve to exactly ONE module record across the whole bundle.
+ *
+ * MPO-215. `react-cookie` runs `React.createContext(null)` when its entry
+ * evaluates. `@multiplatform.one/storybook` renders `<CookiesProvider>` in the
+ * framework decorator and `@multiplatform.one/theme`'s `useTheme` reads it via
+ * `useCookies`, so provider and consumer live in two different workspace
+ * packages. When those two packages resolve `react-cookie` to two different
+ * realpaths — a hoisted `node_modules/react-cookie` for the importer that does
+ * not declare it, the pnpm store copy for the one that does — the entry
+ * evaluates twice, there are two contexts, and `useCookies` throws
+ * `Missing <CookiesProvider>` with the provider sitting two lines above it in
+ * the same tree.
+ *
+ * Nothing catches that today. The dev server pre-bundles bare imports by
+ * package NAME, which collapses both realpaths onto one `deps/react-cookie.js`
+ * and renders fine; the production build has no optimizer, so both paths
+ * survive, every story renders Storybook's error panel, and
+ * `storybook build` still exits 0.
+ *
+ * `resolve.dedupe` does not fix it: measured against Vite 8 / Rolldown, a
+ * build with `dedupe: ["react-cookie"]` emitted a byte-identical iframe chunk
+ * and the story still threw. An alias to one absolute directory does, which is
+ * the same instrument the storybook config already uses to pin react,
+ * react-dom and react-is.
+ *
+ * MPO-217. `@tamagui/web` is the same shape. It owns the theme context, the
+ * style registry and the config singleton; `@tamagui/core` re-exports it and
+ * `tamagui` re-exports that, so every tamagui component in the tree reads the
+ * theme through whichever `@tamagui/web` record its own import chain reached.
+ *
+ * Measured on the build's module graph at e19a0fda3: `tamagui` resolved to
+ * two realpaths. 562 importers (public/components, public/backoffice,
+ * public/storybook and the rest) took the pnpm store copy, whose chain is
+ * store `tamagui` -> store `@tamagui/core` -> store `@tamagui/web`; five took
+ * the hoisted `node_modules/tamagui`, which has no nested node_modules and so
+ * walks up to the hoisted `@tamagui/core` and `@tamagui/web`. Those five were
+ * public/frappe's story files — the only modules in the repo that import
+ * `tamagui` from a package with no copy of its own — and their 14 stories were
+ * the 14 that threw `Missing theme.` on storybook-static while rendering on
+ * dev. The theme provider is mounted from the store record; their `Button`,
+ * `Text` and `YStack` read the hoisted record's context, which no provider
+ * ever wrote to.
+ *
+ * `tamagui` itself is deliberately NOT pinned. A directory alias resolves
+ * `tamagui/linear-gradient` to `node_modules/tamagui/linear-gradient/`, a
+ * metro-compat stub that `require`s the CJS build, instead of the ESM target
+ * the package's exports map picks for the browser. Pinning core and web is
+ * enough: both `tamagui` records import `@tamagui/core` by bare specifier, so
+ * they funnel into one web record and one theme context.
+ */
+const CONTEXT_SINGLETONS: readonly string[] = ["react-cookie", "@tamagui/core", "@tamagui/web"];
+
+/**
+ * Vite `resolve.alias` entries pinning each context singleton to one directory.
+ *
+ * Alias keys match the whole specifier or a `key + "/"` prefix, so subpath
+ * imports follow the same copy instead of resolving independently. Entries are
+ * omitted when the package is not installed, so a consumer that does not use
+ * cookies is unaffected.
+ *
+ * @param root Directory whose `node_modules` the packages resolve from.
+ */
+export function singletonDepAliases(root: string = process.cwd()): Record<string, string> {
+  const aliases: Record<string, string> = {};
+  const requireFrom = createRequire(path.join(root, "package.json"));
+
+  for (const pkgName of CONTEXT_SINGLETONS) {
+    const pkgDir = resolvePackageDir(pkgName, root, requireFrom);
+    if (pkgDir) aliases[pkgName] = pkgDir;
+  }
+
+  return aliases;
+}
+
+function resolvePackageDir(
+  pkgName: string,
+  root: string,
+  requireFrom: NodeRequire,
+): string | undefined {
+  try {
+    return path.dirname(requireFrom.resolve(`${pkgName}/package.json`));
+  } catch {
+    // react-cookie 8's exports map declares only ".", so "./package.json" is
+    // ERR_PACKAGE_PATH_NOT_EXPORTED. Resolve the entry instead and walk up to
+    // the directory that owns it — the pnpm store copy when nothing is
+    // hoisted, which is exactly the copy that must win.
+    try {
+      let dir = path.dirname(requireFrom.resolve(pkgName));
+      while (dir !== path.dirname(dir)) {
+        if (fs.existsSync(path.join(dir, "package.json"))) return dir;
+        dir = path.dirname(dir);
+      }
+    } catch {
+      // not installed
+    }
+    const hoisted = path.join(root, "node_modules", ...pkgName.split("/"));
+    return fs.existsSync(path.join(hoisted, "package.json")) ? hoisted : undefined;
+  }
+}

package/src/storybook.ts

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import type { Plugin, UserConfig } from "vite";
+import { singletonDepAliases } from "./singletonDepAliases.js";
 import { unexportedDepAliases } from "./unexportedDepAliases.js";
 import { discoverPublicPackageRoots, resolvePackageMainSource } from "./workspacePublicPackages.js";
 import { ensureTamaguiWorkspacePaths } from "./tamaguiWorkspacePaths.js";
@@ -59,6 +60,9 @@ export function createStorybookViteConfig(
     ...discoverPackageAliases(packagesDir),
     ...discoverPublicPackageViteAliases(workspaceRoot),
     ...unexportedDepAliases(workspaceRoot),
+    // MPO-215: last, so a context singleton can never be shadowed by a
+    // discovered workspace alias.
+    ...singletonDepAliases(workspaceRoot),
   };
 
   if (options.aliases) {
@@ -171,6 +175,18 @@ export function createStorybookViteConfig(
         "@tamagui/themes",
         "@tamagui/toast",
         "@tamagui/use-presence",
+        // MPO-215: keep dev on the same single record the build now pins by
+        // alias, so a cookie-context bug can never be dev-only again.
+        "react-cookie",
+        // Subpath, not a package: public/components/src/tamagui.ts re-exports
+        // LinearGradient from "tamagui/linear-gradient" (MPO-21 G2), so the
+        // story graph never reaches "@tamagui/linear-gradient" above. Without
+        // this line the subpath is optimized in whatever generation discovers
+        // it, carries its own tamagui core registry, and
+        // components-lineargradient--default renders 0 nodes with "Can't find
+        // Tamagui configuration" plus the duplicate-instances warning.
+        // "@tamagui/config/v5" above is the same shape.
+        "tamagui/linear-gradient",
         "@mdx-js/react",
         "i18next",
         "react-i18next",

package/src/vite.ts

@@ -443,6 +443,20 @@ export function createViteConfig(options: CreateViteConfigOptions = {}): UserCon
       "process.env.VITE_FRAPPE_ENABLED": JSON.stringify(
         process.env.VITE_FRAPPE_ENABLED === "true" ? "true" : "false",
       ),
+      // The public-config bake. @multiplatform.one/platform's runtimeConfig
+      // reads exactly these two static expressions (it carries no import.meta,
+      // because Expo DOM components run it as a classic script, MPO-192), and
+      // a static `process.env.<KEY>` is what Vite, vxrn/One and Metro all
+      // inline. Absent when no public keys were declared, so a build without
+      // them leaves the expressions alone and the reader falls back to {}.
+      ...(publicConfigKeys.length > 0
+        ? {
+            "process.env.VITE_MP_CONFIG": JSON.stringify(process.env.VITE_MP_CONFIG ?? ""),
+            "process.env.VITE_MP_PUBLIC_CONFIG_KEYS": JSON.stringify(
+              process.env.VITE_MP_PUBLIC_CONFIG_KEYS ?? "",
+            ),
+          }
+        : {}),
     },
     ssr: ssr || defaultSsr,
     resolve: {

package/types/singletonDepAliases.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Vite `resolve.alias` entries pinning each context singleton to one directory.
+ *
+ * Alias keys match the whole specifier or a `key + "/"` prefix, so subpath
+ * imports follow the same copy instead of resolving independently. Entries are
+ * omitted when the package is not installed, so a consumer that does not use
+ * cookies is unaffected.
+ *
+ * @param root Directory whose `node_modules` the packages resolve from.
+ */
+export declare function singletonDepAliases(root?: string): Record<string, string>;
+//# sourceMappingURL=singletonDepAliases.d.ts.map

package/types/singletonDepAliases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"singletonDepAliases.d.ts","sourceRoot":"","sources":["../src/singletonDepAliases.ts"],"names":[],"mappings":"AA0DA;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,MAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUxF"}

package/types/storybook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storybook.d.ts","sourceRoot":"","sources":["../src/storybook.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAU,UAAU,EAAE,MAAM,MAAM,CAAC;AAK/C,MAAM,WAAW,gCAAgC;IAC/C;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC;;OAEG;IACH,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAEhC;;OAEG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,gCAAqC,GAC7C,UAAU,CAwKZ"}
+{"version":3,"file":"storybook.d.ts","sourceRoot":"","sources":["../src/storybook.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAU,UAAU,EAAE,MAAM,MAAM,CAAC;AAM/C,MAAM,WAAW,gCAAgC;IAC/C;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC;;OAEG;IACH,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAEhC;;OAEG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,gCAAqC,GAC7C,UAAU,CAuLZ"}

package/types/vite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite.d.ts","sourceRoot":"","sources":["../src/vite.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAU,UAAU,EAAE,MAAM,MAAM,CAAC;AAI/C,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;OAEG;IACH,OAAO,CAAC,EACJ,OAAO,GACP;QACE;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QAEtB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB;;WAEG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAEN;;OAEG;IACH,IAAI,CAAC,EACD,OAAO,GACP;QACE;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAEjB;;WAEG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IAEN;;;OAGG;IACH,GAAG,CAAC,EACA,OAAO,GACP;QACE,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC3B,GAAG,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACtD,KAAK,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC/B,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,CAAC;IAEN;;OAEG;IACH,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAExB;;OAEG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAE9B;;OAEG;IACH,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAEhC;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;OAEG;IACH,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAElC;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ;;;;;;WAMG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;;;;WAOG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,UAAU,CA4SlF;AAED,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"vite.d.ts","sourceRoot":"","sources":["../src/vite.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAU,UAAU,EAAE,MAAM,MAAM,CAAC;AAI/C,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;OAEG;IACH,OAAO,CAAC,EACJ,OAAO,GACP;QACE;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QAEtB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB;;WAEG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IAEN;;OAEG;IACH,IAAI,CAAC,EACD,OAAO,GACP;QACE;;;WAGG;QACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAEjB;;WAEG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;IAEN;;;OAGG;IACH,GAAG,CAAC,EACA,OAAO,GACP;QACE,MAAM,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC3B,GAAG,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACtD,KAAK,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC/B,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,CAAC;IAEN;;OAEG;IACH,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAExB;;OAEG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAE9B;;OAEG;IACH,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAEhC;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;OAEG;IACH,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAElC;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ;;;;;;WAMG;QACH,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB;;;;;;;WAOG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,UAAU,CA0TlF;AAED,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC"}