peachsim 0.1.2209 → 0.1.2213

package/src/host/bridge-host.ts

@@ -55,6 +55,7 @@ import {
   sendFileWithRanges,
 } from '../runtime-assets.ts'
 import { rnxRuntime } from '../runtime-delivery.ts'
+import { ensureRuntimePackFor } from '../runtime-packs.ts'
 import { handleTurboRequest, TURBO_ROUTE } from '../turbo-bundle.ts'
 import { AgentHost, type AgentHostOptions } from './agent-host.ts'
 import { serveAppPackageResource } from './app-package-handler'
@@ -1920,116 +1921,119 @@ export class SootSimBridgeHost {
     // inside baseDir that point outside — without it, an attacker who can
     // drop a symlink in the runtime dir gets arbitrary-read through the
     // daemon. realpath also collapses any remaining normalizable segments.
-    fs.realpath(resolved, (realErr, realResolved) => {
-      const servePath = realErr ? resolved : realResolved
-      const servePathWithSep = servePath.endsWith(path.sep)
-        ? servePath
-        : servePath + path.sep
-      if (!realErr) {
-        const realBaseWithSep = (() => {
-          try {
-            const rb = fs.realpathSync(baseDir)
-            return rb.endsWith(path.sep) ? rb : rb + path.sep
-          } catch {
-            return baseWithSep
+    // a pack-owned prefix downloads on first request before the file resolves
+    void ensureRuntimePackFor(baseDir, rel).then(() =>
+      fs.realpath(resolved, (realErr, realResolved) => {
+        const servePath = realErr ? resolved : realResolved
+        const servePathWithSep = servePath.endsWith(path.sep)
+          ? servePath
+          : servePath + path.sep
+        if (!realErr) {
+          const realBaseWithSep = (() => {
+            try {
+              const rb = fs.realpathSync(baseDir)
+              return rb.endsWith(path.sep) ? rb : rb + path.sep
+            } catch {
+              return baseWithSep
+            }
+          })()
+          if (
+            !servePathWithSep.startsWith(realBaseWithSep) &&
+            servePath + path.sep !== realBaseWithSep
+          ) {
+            res.writeHead(403)
+            res.end('forbidden')
+            return
           }
-        })()
-        if (
-          !servePathWithSep.startsWith(realBaseWithSep) &&
-          servePath + path.sep !== realBaseWithSep
-        ) {
-          res.writeHead(403)
-          res.end('forbidden')
-          return
         }
-      }
 
-      fs.stat(servePath, (err, stats) => {
-        if (err || !stats?.isFile()) {
-          // SPA fallback — but only for extensionless paths. a 404 on
-          // /main.a1b2c3.js should 404, not return index.html as js,
-          // which the sim then chokes on.
-          const ext = path.extname(rel).toLowerCase()
-          if (ext && ext !== '.html') {
-            res.writeHead(404)
-            res.end('not found')
-            return
-          }
-          // never SPA-fallback internal endpoint namespaces — those are
-          // expected to return JSON (or a real 404) and the engine calls
-          // .json() on the response. without this, a tenant-worker fetch
-          // to an unimplemented /__foo or /api/foo gets a 200 + index.html
-          // and explodes with "Unexpected token '<', '<!doctype'... is not
-          // valid JSON". /__server-scan is the canonical case (see the
-          // handler above).
-          if (rel.startsWith('/__') || rel.startsWith('/api/') || rel === '/api') {
-            res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' })
-            res.end('not found')
-            return
-          }
-          const indexPath = path.join(baseDir, 'index.html')
-          fs.readFile(indexPath, (err2, data) => {
-            if (err2) {
+        fs.stat(servePath, (err, stats) => {
+          if (err || !stats?.isFile()) {
+            // SPA fallback — but only for extensionless paths. a 404 on
+            // /main.a1b2c3.js should 404, not return index.html as js,
+            // which the sim then chokes on.
+            const ext = path.extname(rel).toLowerCase()
+            if (ext && ext !== '.html') {
               res.writeHead(404)
               res.end('not found')
               return
             }
-            res.writeHead(200, {
-              'Content-Type': 'text/html; charset=utf-8',
-              'Cache-Control': 'no-store',
-            })
-            if (method === 'HEAD') {
-              res.end()
+            // never SPA-fallback internal endpoint namespaces — those are
+            // expected to return JSON (or a real 404) and the engine calls
+            // .json() on the response. without this, a tenant-worker fetch
+            // to an unimplemented /__foo or /api/foo gets a 200 + index.html
+            // and explodes with "Unexpected token '<', '<!doctype'... is not
+            // valid JSON". /__server-scan is the canonical case (see the
+            // handler above).
+            if (rel.startsWith('/__') || rel.startsWith('/api/') || rel === '/api') {
+              res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' })
+              res.end('not found')
               return
             }
-            res.end(
-              injectSharedConfigIntoHtml(data, this.effectivePort, this.contrastOrigin),
-            )
-          })
-          return
-        }
-        const ext = path.extname(servePath).toLowerCase()
-        const contentType = HTTP_MIME_TYPES[ext] || 'application/octet-stream'
-        // no-store across the board: the runtime is served from a versioned
-        // directory but the HTTP path doesn't include the version, so the
-        // same URL serves different content after a runtime swap. caching
-        // any asset means a stale-bundle reload after runtime:changed.
-        res.writeHead(200, {
-          'Content-Type': contentType,
-          'Cache-Control': 'no-store',
-          // native file documents have an opaque origin when reading public fonts.
-          ...(publicEngineFont ? { 'Access-Control-Allow-Origin': '*' } : {}),
-        })
-        if (method === 'HEAD') {
-          res.end()
-          return
-        }
-        // html responses inline the daemon-injected `__sootsimSharedConfig`
-        // global so the engine's settingsStore initializes from disk on
-        // boot. for everything else stream the file straight through.
-        if (ext === '.html') {
-          fs.readFile(servePath, (readErr, data) => {
-            if (readErr) {
-              try {
+            const indexPath = path.join(baseDir, 'index.html')
+            fs.readFile(indexPath, (err2, data) => {
+              if (err2) {
+                res.writeHead(404)
+                res.end('not found')
+                return
+              }
+              res.writeHead(200, {
+                'Content-Type': 'text/html; charset=utf-8',
+                'Cache-Control': 'no-store',
+              })
+              if (method === 'HEAD') {
                 res.end()
-              } catch {}
-              return
-            }
-            res.end(
-              injectSharedConfigIntoHtml(data, this.effectivePort, this.contrastOrigin),
-            )
+                return
+              }
+              res.end(
+                injectSharedConfigIntoHtml(data, this.effectivePort, this.contrastOrigin),
+              )
+            })
+            return
+          }
+          const ext = path.extname(servePath).toLowerCase()
+          const contentType = HTTP_MIME_TYPES[ext] || 'application/octet-stream'
+          // no-store across the board: the runtime is served from a versioned
+          // directory but the HTTP path doesn't include the version, so the
+          // same URL serves different content after a runtime swap. caching
+          // any asset means a stale-bundle reload after runtime:changed.
+          res.writeHead(200, {
+            'Content-Type': contentType,
+            'Cache-Control': 'no-store',
+            // native file documents have an opaque origin when reading public fonts.
+            ...(publicEngineFont ? { 'Access-Control-Allow-Origin': '*' } : {}),
           })
-          return
-        }
-        const stream = fs.createReadStream(servePath)
-        stream.pipe(res)
-        stream.on('error', () => {
-          try {
+          if (method === 'HEAD') {
             res.end()
-          } catch {}
+            return
+          }
+          // html responses inline the daemon-injected `__sootsimSharedConfig`
+          // global so the engine's settingsStore initializes from disk on
+          // boot. for everything else stream the file straight through.
+          if (ext === '.html') {
+            fs.readFile(servePath, (readErr, data) => {
+              if (readErr) {
+                try {
+                  res.end()
+                } catch {}
+                return
+              }
+              res.end(
+                injectSharedConfigIntoHtml(data, this.effectivePort, this.contrastOrigin),
+              )
+            })
+            return
+          }
+          const stream = fs.createReadStream(servePath)
+          stream.pipe(res)
+          stream.on('error', () => {
+            try {
+              res.end()
+            } catch {}
+          })
         })
-      })
-    })
+      }),
+    )
   }
 
   private sweepIdleCliClients() {

package/src/metro-plugin.ts

@@ -51,6 +51,7 @@ import {
   serveRuntimeFile,
   SOOTSIM_RUNTIME_MISSING_MESSAGE,
 } from './runtime-assets'
+import { ensureRuntimePackFor } from './runtime-packs'
 import {
   getRuntimePlatformAdapter,
   isRuntimePlatform,
@@ -451,7 +452,7 @@ export function withPeach<T extends Record<string, unknown>>(
 
       const server = connect()
 
-      server.use((req: any, res: any, next: any) => {
+      server.use(async (req: any, res: any, next: any) => {
         if (isReplacementModuleRequestUrl(req.url)) {
           void handleReplacementModuleRequest(req, res, {
             servedRoots: [cfgProjectRoot, ...cfgWatchFolders],
@@ -501,6 +502,8 @@ export function withPeach<T extends Record<string, unknown>>(
           return
         }
 
+        await ensureRuntimePackFor(runtimeRoot, pathname)
+
         // root-relative runtime assets emitted by the shell and engine vite
         // builds. if a user app has its own /assets/foo request, we only
         // intercept when that exact file exists in the runtime; otherwise

package/src/native-static-libraries.ts

@@ -192,6 +192,13 @@ export const NATIVE_STATIC_LIBRARY_RECIPES = [
     recipe: 'a2642115a5eeb04559c9f1daaa4b4cbe4b1c211533b4cc80cb8339a4477af205',
     archive: 'libsksg.a',
   },
+  {
+    name: 'webgpu_dawn',
+    nativeSha256: '95078993275bccc969b1dfa1ad0934cbacc05ae59e8aa2a6cc46ce93e97d4f69',
+    upstream: '3d786993a7ded64c4ebb4884b9b079db9ad0e580',
+    recipe: 'c55468cc976e837ad894133f2231beb7d1ed64633af7b457b8a2610d7df45994',
+    archive: 'libwebgpu_dawn.a',
+  },
 ]
 
 export function nativeStaticLibraryEntry(

package/src/react-native-coverage/native-source-ranges-file.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod'
-import rangesData from '../../../peach-compat/src/generated/native-source-ranges.json'
+import rangesData from '../../../peach-compat/src/generated/native-source-ranges.json' with { type: 'json' }
 import type { NativeSourceRangesFile } from '../../../peach-compat/src/native-source-ranges-types'
 
 const run = z.object({

package/src/runtime-assets.ts

@@ -118,7 +118,6 @@ const ROOT_RUNTIME_PATHS = [
   '/fonts/',
   '/icons/',
   '/sounds/',
-  '/spike/',
   '/test-wallpaper.jpg',
   '/preview-sw.js',
   '/preview/guest-bridge-host.js',

package/src/runtime-delivery.ts

@@ -33,7 +33,7 @@ export const RNX_RUNTIME_PRODUCT: RuntimeProduct = {
   id: 'peach',
   defaultCdnOrigin: DEFAULT_RUNTIME_CDN_ORIGIN,
   manifestPath: '/runtimes/manifest.json',
-  tarballPath: (version) => `/runtimes/sootsim-runtime-${version}.tar.gz`,
+  tarballPath: (version) => `/runtimes/sootsim-runtime-${version}.tar.zst`,
   // the engine runtime is a static SPA: shell at the root, engine/ and
   // engine-tenant/ beneath it. index.html is what the daemon and the
   // vite/metro plugins serve, so its absence means the tarball is not one.

package/src/runtime-packs.ts

@@ -0,0 +1,212 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { setTimeout } from 'node:timers'
+import {
+  installVerifiedTarball,
+  RUNTIME_MERGE_PACK_DIR,
+  RUNTIME_MERGE_PACK_INSTALL,
+  RUNTIME_MERGE_PACK_MERGED,
+  RUNTIME_PACK_MARKER,
+  RUNTIME_PACK_PREFIXES,
+  RUNTIME_PACKS_FILE,
+  type RuntimePacks,
+} from '@contrast/runtime-delivery'
+import { rnxRuntime } from './runtime-delivery.ts'
+
+// pieces only some apps reach ship beside the runtime archive, not in it. the
+// archive carries `packs.json` naming each; the first request under a pack's
+// prefix downloads it, checks its digest and lands it by rename, exactly as the
+// archive itself installs. the desktop bundle keeps every prefix in place.
+const inflight = new Map<string, Promise<void>>()
+// an installed version's packs.json never changes
+const packsByRoot = new Map<string, RuntimePacks | null>()
+// listed pack files by basename, each with its runtime-relative path and pack
+const listedByRoot = new Map<string, Map<string, { file: string; pack: string }[]>>()
+
+function listedFiles(runtimeRoot: string) {
+  let listed = listedByRoot.get(runtimeRoot)
+  if (listed) return listed
+  listed = new Map()
+  for (const [pack, entry] of Object.entries(readPacks(runtimeRoot) ?? {}))
+    for (const file of entry.files ?? []) {
+      const name = path.posix.basename(file)
+      listed.set(name, [...(listed.get(name) ?? []), { file, pack }])
+    }
+  listedByRoot.set(runtimeRoot, listed)
+  return listed
+}
+
+function readPacks(runtimeRoot: string): RuntimePacks | null {
+  const cached = packsByRoot.get(runtimeRoot)
+  if (cached !== undefined) return cached
+  const file = path.join(runtimeRoot, RUNTIME_PACKS_FILE)
+  if (!fs.existsSync(file)) {
+    packsByRoot.set(runtimeRoot, null)
+    return null
+  }
+  const parsed: unknown = JSON.parse(fs.readFileSync(file, 'utf8'))
+  const packs: RuntimePacks = {}
+  if (typeof parsed !== 'object' || parsed === null)
+    throw new Error(`${file} is not an object`)
+  for (const [prefix, entry] of Object.entries(parsed)) {
+    if (typeof entry?.file !== 'string' || typeof entry?.sha256 !== 'string')
+      throw new Error(`${file} entry ${prefix} lacks file and sha256`)
+    const files: unknown = entry.files
+    if (
+      files !== undefined &&
+      !(Array.isArray(files) && files.every((f) => typeof f === 'string'))
+    )
+      throw new Error(`${file} entry ${prefix} has files that are not paths`)
+    packs[prefix] = {
+      file: entry.file,
+      sha256: entry.sha256,
+      ...(files ? { files } : {}),
+    }
+  }
+  packsByRoot.set(runtimeRoot, packs)
+  return packs
+}
+
+/** make sure the pack that owns a request path is on disk. never rejects: a
+ *  pack that cannot download logs once and the file then answers 404. */
+export async function ensureRuntimePackFor(
+  runtimeRoot: string,
+  pathname: string,
+): Promise<void> {
+  warmRuntimePacks(runtimeRoot)
+  const prefix = RUNTIME_PACK_PREFIXES.find((candidate) =>
+    pathname.includes(`/${candidate}`),
+  )
+  if (prefix) {
+    await installNamedPack(runtimeRoot, prefix)
+    return
+  }
+  const listed = listedFiles(runtimeRoot)
+    .get(path.posix.basename(pathname))
+    ?.find(({ file }) => pathname.endsWith(`/${file}`))
+  if (listed) {
+    if (!fs.existsSync(path.join(runtimeRoot, listed.file)))
+      await installNamedPack(runtimeRoot, listed.pack)
+    return
+  }
+  const at = pathname.indexOf(`/${RUNTIME_MERGE_PACK_DIR}`)
+  if (at === -1) return
+  const tenantDir = path.join(runtimeRoot, RUNTIME_MERGE_PACK_DIR)
+  const rel = pathname.slice(at + RUNTIME_MERGE_PACK_DIR.length + 1)
+  // the production pack holds only chunks; a missing source map or json is a plain 404
+  if (!/\.m?js$/.test(rel) || fs.existsSync(path.join(tenantDir, rel))) return
+  await installNamedPack(runtimeRoot, RUNTIME_MERGE_PACK_DIR)
+}
+
+function installNamedPack(runtimeRoot: string, name: string): Promise<boolean> {
+  if (name === RUNTIME_MERGE_PACK_DIR) {
+    const tenantDir = path.join(runtimeRoot, RUNTIME_MERGE_PACK_DIR)
+    return mergePack(
+      runtimeRoot,
+      name,
+      path.join(tenantDir, RUNTIME_MERGE_PACK_INSTALL),
+      tenantDir,
+    )
+  }
+  if (readPacks(runtimeRoot)?.[name]?.files)
+    return mergePack(
+      runtimeRoot,
+      name,
+      path.join(runtimeRoot, `.pack-${name}`),
+      runtimeRoot,
+    )
+  return installPack(runtimeRoot, name, path.join(runtimeRoot, name.slice(0, -1)))
+}
+
+// once the first page has loaded, fetch every remaining pack one at a time so
+// later use never waits on the network. a request for a pack joins its download;
+// a failed download ends the warm, so an offline machine logs once.
+const WARM_DELAY_MS = 30_000
+const warming = new Set<string>()
+
+function warmRuntimePacks(runtimeRoot: string): void {
+  if (warming.has(runtimeRoot)) return
+  warming.add(runtimeRoot)
+  const warm = async () => {
+    for (const name of Object.keys(readPacks(runtimeRoot) ?? {}))
+      if (!(await installNamedPack(runtimeRoot, name))) return
+  }
+  const schedule: (fn: () => void, ms: number) => NodeJS.Timeout = setTimeout
+  schedule(() => void warm(), WARM_DELAY_MS).unref()
+}
+
+// a merge pack installs beside the tree it belongs to, then hard-links its files
+// into place so the tree keeps one copy on disk. a link that already exists came
+// from an earlier or concurrent merge of the same bytes.
+async function mergePack(
+  runtimeRoot: string,
+  name: string,
+  installDir: string,
+  targetDir: string,
+): Promise<boolean> {
+  if (fs.existsSync(path.join(installDir, RUNTIME_MERGE_PACK_MERGED))) return true
+  if (!(await installPack(runtimeRoot, name, installDir))) return false
+  const link = (sub: string): void => {
+    for (const entry of fs.readdirSync(path.join(installDir, sub), {
+      withFileTypes: true,
+    })) {
+      const child = path.join(sub, entry.name)
+      if (entry.isDirectory()) {
+        fs.mkdirSync(path.join(targetDir, child), { recursive: true })
+        link(child)
+      } else if (entry.name !== RUNTIME_PACK_MARKER) {
+        try {
+          fs.linkSync(path.join(installDir, child), path.join(targetDir, child))
+        } catch (error) {
+          if (!(error instanceof Error && 'code' in error && error.code === 'EEXIST'))
+            throw error
+        }
+      }
+    }
+  }
+  try {
+    link('')
+    fs.writeFileSync(path.join(installDir, RUNTIME_MERGE_PACK_MERGED), '')
+    return true
+  } catch (error) {
+    console.error(
+      `[peach] ${name} pack merge failed: ${error instanceof Error ? error.message : String(error)}`,
+    )
+    return false
+  }
+}
+
+async function installPack(
+  runtimeRoot: string,
+  prefix: string,
+  destDir: string,
+): Promise<boolean> {
+  const marker = path.join(destDir, RUNTIME_PACK_MARKER)
+  if (fs.existsSync(marker)) return true
+  const pack = readPacks(runtimeRoot)?.[prefix]
+  // a runtime that shipped the prefix inline has no pack entry
+  if (!pack) return true
+  let install = inflight.get(destDir)
+  if (!install) {
+    const version = path.basename(runtimeRoot)
+    // the hash in the url keeps a refreshed pre-release from hitting a stale cached pack
+    const url = new URL(pack.file, rnxRuntime.tarballUrl(version))
+    url.searchParams.set('sha256', pack.sha256)
+    install = installVerifiedTarball({
+      url: url.toString(),
+      digest: { algorithm: 'sha256', encoding: 'hex', value: pack.sha256 },
+      destDir,
+      installedMarker: RUNTIME_PACK_MARKER,
+      label: `peach runtime ${version} pack ${prefix}`,
+    })
+      .catch((error: unknown) => {
+        console.error(
+          `[peach] ${prefix} pack download failed: ${error instanceof Error ? error.message : String(error)}`,
+        )
+      })
+      .finally(() => inflight.delete(destDir))
+    inflight.set(destDir, install)
+  }
+  await install
+  return fs.existsSync(marker)
+}

package/src/swift-compile.ts

@@ -62,6 +62,7 @@ import {
   SWIFT_OBJC_INTEROP_FLAGS,
   swiftClangImporterFlags,
   swiftObjCModuleMap,
+  swiftSubmoduleImports,
 } from './swift-objc-import'
 import { swiftObjCRuntimeFlags } from './swift-objc-runtime'
 import { iosDeploymentMinimum, objcSdkIntakeFlags } from './swift-objc-standin'
@@ -3832,6 +3833,25 @@ function stripCCode(source: string): string {
   return code
 }
 
+// whether the unit's code under wasm32 takes its own return address, which
+// the WebAssembly backend rejects ("hasn't implemented __builtin_return_address"):
+// native machine code the target has no lowering for, like assembly. branches
+// the native architecture macros guard are not wasm code.
+const wasmMacroEnvironment: SwiftCMacroEnvironment = {
+  ...emptyMacroEnvironment,
+  defines: new Map([
+    ['__wasm__', '1'],
+    ['__wasm32__', '1'],
+    ['__wasi__', '1'],
+  ]),
+}
+export function swiftCTakesReturnAddress(source: string): boolean {
+  if (!source.includes('__builtin_return_address')) return false
+  return /\b__builtin_return_address\s*\(/.test(
+    cActiveCode(stripCCode(source), wasmMacroEnvironment),
+  )
+}
+
 // every name the given sources define. order and conditions are not
 // evaluated: a name defined anywhere makes its guards undecided.
 export function swiftCDefinedNames(sources: Iterable<string>): Set<string> {
@@ -4360,6 +4380,11 @@ export function writeSwiftProject(
         clangImportedModules.add(name)
       }
   }
+  const submoduleImports = swiftSubmoduleImports(
+    Object.entries(input.files).flatMap(([file, contents]) =>
+      file.endsWith('.swift') ? [contents] : [],
+    ),
+  )
   const headerDirectory = path.join(layout.root, '.build', 'peach-cxx-headers')
   const flattenedHeaders = new Set<string>()
   // product header aliases belong to this input. keep emitted Swift headers,
@@ -4906,6 +4931,7 @@ export function writeSwiftProject(
             swiftObjCModuleMap(
               swiftTargetModuleName(target.name),
               roots.map((file) => path.join(layout.root, file)),
+              submoduleImports.get(swiftTargetModuleName(target.name)),
             ))
         if (moduleContents === undefined)
           throw new Error('missing original module map ' + modulemap)
@@ -5295,13 +5321,17 @@ export function writeSwiftProject(
       modulemap,
       originalMap
         ? `extern module ${moduleName} ${JSON.stringify(path.join(layout.root, originalMap))}\nmodule ${moduleName}.Swift {\n  header ${JSON.stringify(path.join(headerDirectory, name + '-Swift.h'))}\n  requires objc\n}\n`
-        : swiftObjCModuleMap(moduleName, [
-            ...(
-              input.nativeTargets?.find((target) => target.name === name)
-                ?.publicHeaders ?? []
-            ).map((header) => path.join(layout.root, header)),
-            path.join(headerDirectory, name + '-Swift.h'),
-          ]),
+        : swiftObjCModuleMap(
+            moduleName,
+            [
+              ...(
+                input.nativeTargets?.find((target) => target.name === name)
+                  ?.publicHeaders ?? []
+              ).map((header) => path.join(layout.root, header)),
+              path.join(headerDirectory, name + '-Swift.h'),
+            ],
+            submoduleImports.get(moduleName),
+          ),
     )
     nativeHeaderFlags.push('-fmodule-map-file=' + modulemap)
   }
@@ -6588,8 +6618,15 @@ async function buildFrameworkProducts(
   const linked = frameworkLinkClosure(scratch, linkedTargets.targets)
   const objects = linked.objects
   if (linked.modules.has('UniformTypeIdentifiers')) {
-    const object = path.join(scratch, 'UniformTypeIdentifiers-NativeConstants.o')
-    if (!existsSync(object)) {
+    const constantsDir = path.join(scratch, 'uniform-type-constants')
+    const constantsStamp = path.join(constantsDir, '.complete')
+    const object = path.join(constantsDir, 'UniformTypeIdentifiers-NativeConstants.o')
+    if (
+      !existsSync(constantsStamp) ||
+      readFileSync(constantsStamp, 'utf8') !== args.frameworkKey
+    ) {
+      rmSync(constantsDir, { recursive: true, force: true })
+      mkdirSync(constantsDir)
       const sdkPaths = swiftSdkPaths(args.moduleRoot, args.toolchainBin)
       compileUniformTypeConstants({
         bin: args.toolchainBin,
@@ -6597,8 +6634,9 @@ async function buildFrameworkProducts(
         darwin: sdkPaths.darwin,
         packageRoot: args.moduleRoot,
         minimum: darwinRecordsMinimum(),
-        out: scratch,
+        out: constantsDir,
       })
+      writeFileSync(constantsStamp, args.frameworkKey)
     }
     objects.push(object)
     linked.owners.set(object, 'UniformTypeIdentifiers')

package/src/swift-host.ts

@@ -83,7 +83,8 @@ import {
   type SwiftPackageGap,
   type SwiftPackages,
 } from './swift-packages'
-import { rasterizePdfFile } from './swift-pdf-raster'
+import { rasterizePdfFile, rasterizeSvgFile } from './swift-pdf-raster'
+import { shippedBinaryDiffers } from './swift-shipped-binaries'
 import {
   packageInputPath,
   readPackageFile as readSwiftSourceFile,
@@ -596,7 +597,7 @@ async function swiftPackages(
   // compiling, or a placeholder package's swift target: each stands in from
   // its public surface.
   const standinArtifact = (binary: SwiftPackageBinary) =>
-    binary.publicHeaders === undefined || binary.assemblySources !== undefined
+    binary.publicHeaders === undefined || binary.unloweredSources !== undefined
   const artifacts = reached.filter(standinArtifact)
   if (entry.moduleRoot && entry.provided && artifacts.length > 0) {
     const resolved = swiftModuleToolchain(entry.moduleRoot)
@@ -618,10 +619,16 @@ async function swiftPackages(
     const cxxArtifacts = reached.filter(standinArtifact)
     const generation = standinGenerationInputs(cxxArtifacts, toolchain, entry.behavior)
     if (cached.standinKey !== generation) {
+      // an archive other than the one peach ships a module for stands in itself
+      const replaced = new Set(
+        cxxArtifacts
+          .filter((binary) => shippedBinaryDiffers(binary.target, binary.checksum))
+          .map((binary) => binary.target),
+      )
       const built = await swiftStandins(
         cxxArtifacts,
         toolchain,
-        entry.provided,
+        new Set([...entry.provided].filter((name) => !replaced.has(name))),
         entry.behavior,
       )
       cached.packages = await resolveSwiftPackagesAsync({
@@ -637,6 +644,9 @@ async function swiftPackages(
             .map((binary) => binary.target)
             .filter((target) => !built.gaps.has(target)),
         ]),
+        standinTargets: new Set(
+          [...replaced].filter((target) => !built.gaps.has(target)),
+        ),
         binaryGaps: built.gaps,
         owners,
       })
@@ -1941,6 +1951,15 @@ export function buildSwiftResourceTable(
         throw new Error('swift image pack exceeds the compile service caps')
       }
       bytes = readPackageFile(project.packagePath, disk, limits.imageBytes)
+      const svg =
+        ext === '.svg'
+          ? rasterizeSvgFile(disk, createHash('sha256').update(bytes).digest('hex'))
+          : null
+      if (svg) {
+        bytes = svg.bytes
+        ext = '.png'
+        uploadName = `${path.posix.basename(file, path.posix.extname(file))}.png`
+      }
     }
     if (imageBytes + bytes.length > limits.imageTotalBytes) {
       throw new Error('swift image pack exceeds the compile service caps')