peachsim 0.1.637 → 0.1.639

package/dist-lib/vite-swift.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.637 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.639 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -45,6 +45,31 @@ __export(vite_plugin_swift_exports, {
   swiftPlugin: () => swiftPlugin
 });
 module.exports = __toCommonJS(vite_plugin_swift_exports);
+var import_node_fs5 = __toESM(require("node:fs"), 1);
+var import_node_path6 = __toESM(require("node:path"), 1);
+
+// ../sootsim-swift/src/entryModule.ts
+function nativeExportLines(args, commonjs) {
+  const native = args.native;
+  if (!native) return [];
+  return Object.entries(native.modules).map(([name, methods]) => {
+    const calls = methods.map(
+      (method) => `${method}: (...args) => callSwiftModule(options, ${JSON.stringify(`${native.packageId}.${name}`)}, ${JSON.stringify(method)}, args, ${JSON.stringify(native.contractHash)})`
+    ).join(", ");
+    return commonjs ? `module.exports.${name} = Object.freeze({ ${calls} })` : `export const ${name} = Object.freeze({ ${calls} })`;
+  });
+}
+function swiftEntryModuleEsm(args) {
+  return [
+    `import { createSwiftEntry, callSwiftModule } from 'peachsim/swift'`,
+    `const options = ${JSON.stringify({ url: args.url, hash: args.hash, icuUrl: args.icuUrl, rootId: args.rootId, resources: args.resources, bundleFiles: args.bundleFiles, colors: args.colors, symbols: args.symbols })}`,
+    ...!args.native || args.native.defaultView ? ["export default createSwiftEntry(options)"] : [],
+    ...nativeExportLines(args, false),
+    ""
+  ].join("\n");
+}
+
+// src/swift-host.ts
 var import_node_crypto3 = require("node:crypto");
 var import_node_fs4 = __toESM(require("node:fs"), 1);
 var import_node_os3 = __toESM(require("node:os"), 1);
@@ -82,8 +107,8 @@ function pickImagesetFile(images) {
     scale: pick.scale === "2x" ? 2 : pick.scale === "3x" ? 3 : 1
   };
 }
-function flatScale(path5) {
-  const match = /@([23])x\.[^./]+$/.exec(path5);
+function flatScale(path6) {
+  const match = /@([23])x\.[^./]+$/.exec(path6);
   return match ? Number(match[1]) : 1;
 }
 function providesNamespace(text) {
@@ -110,13 +135,13 @@ function catalogEntryName(contentsPath, kind, readText) {
   }
   return segments.join("/");
 }
-function isFlatResourceImage(path5) {
-  return path5.split("/").includes("Resources") && RASTER_EXTENSIONS.has(extOf(path5));
+function isFlatResourceImage(path6) {
+  return path6.split("/").includes("Resources") && RASTER_EXTENSIONS.has(extOf(path6));
 }
 function enumerateBundleImages(paths, readText) {
   const table = [];
   const seen = /* @__PURE__ */ new Set();
-  const catalogs = paths.filter((path5) => baseOf(path5) === "Contents.json");
+  const catalogs = paths.filter((path6) => baseOf(path6) === "Contents.json");
   for (const contentsPath of catalogs) {
     const name = catalogEntryName(contentsPath, ".imageset", readText);
     if (name === null || seen.has(name)) continue;
@@ -137,12 +162,12 @@ function enumerateBundleImages(paths, readText) {
     seen.add(name);
     table.push({ name, file: `${dir}/${pick.filename}`, scale: pick.scale });
   }
-  for (const path5 of paths) {
-    if (!isFlatResourceImage(path5)) continue;
-    const name = baseOf(path5).slice(0, -extOf(path5).length);
+  for (const path6 of paths) {
+    if (!isFlatResourceImage(path6)) continue;
+    const name = baseOf(path6).slice(0, -extOf(path6).length);
     if (name === "" || seen.has(name)) continue;
     seen.add(name);
-    table.push({ name, file: path5, scale: flatScale(path5) });
+    table.push({ name, file: path6, scale: flatScale(path6) });
   }
   return table;
 }
@@ -171,7 +196,7 @@ function colorsetValue(color) {
 }
 function enumerateBundleColors(paths, readText) {
   const table = {};
-  for (const contentsPath of paths.filter((path5) => baseOf(path5) === "Contents.json")) {
+  for (const contentsPath of paths.filter((path6) => baseOf(path6) === "Contents.json")) {
     const name = catalogEntryName(contentsPath, ".colorset", readText);
     if (name === null || name in table) continue;
     let colors;
@@ -236,8 +261,8 @@ function axisExtremes(points) {
 function pathBounds(d) {
   const xs = [];
   const ys = [];
-  for (const path5 of d)
-    (0, import_svgpath.default)(path5).abs().unshort().unarc().iterate((segment, _index, x, y) => {
+  for (const path6 of d)
+    (0, import_svgpath.default)(path6).abs().unshort().unarc().iterate((segment, _index, x, y) => {
       const [command, ...args] = segment;
       if (command === "M" || command === "L") {
         xs.push(Number(args[0]));
@@ -264,7 +289,7 @@ function guide(svg, id, axis) {
 }
 function enumerateBundleSymbols(paths, readText) {
   const table = {};
-  for (const contentsPath of paths.filter((path5) => baseOf(path5) === "Contents.json")) {
+  for (const contentsPath of paths.filter((path6) => baseOf(path6) === "Contents.json")) {
     const name = catalogEntryName(contentsPath, ".symbolset", readText);
     if (name === null || name in table) continue;
     let symbols;
@@ -297,8 +322,8 @@ function enumerateBundleSymbols(paths, readText) {
       viewBox: "0 0 24 24",
       advance,
       box: [12 - advance / 2, 12 - tall / 2, advance, tall],
-      layers: d.map((path5) => ({
-        d: (0, import_svgpath.default)(path5).abs().scale(scale).translate(translateX, translateY).round(3).toString()
+      layers: d.map((path6) => ({
+        d: (0, import_svgpath.default)(path6).abs().scale(scale).translate(translateX, translateY).round(3).toString()
       }))
     };
   }
@@ -308,7 +333,7 @@ function enumerateBundleJson(paths) {
   const found = [];
   const seen = /* @__PURE__ */ new Set();
   const ordered = [...paths].filter(
-    (path5) => path5.split("/").includes("Resources") && path5.split("/").every((segment) => segment !== "" && segment !== "..") && (extOf(path5) === ".json" || extOf(path5) === ".xcstrings")
+    (path6) => path6.split("/").includes("Resources") && path6.split("/").every((segment) => segment !== "" && segment !== "..") && (extOf(path6) === ".json" || extOf(path6) === ".xcstrings")
   ).sort((a, b) => {
     const aDepth = a.split("/").length;
     const bDepth = b.split("/").length;
@@ -323,27 +348,6 @@ function enumerateBundleJson(paths) {
   return found;
 }
 
-// ../sootsim-swift/src/entryModule.ts
-function nativeExportLines(args, commonjs) {
-  const native = args.native;
-  if (!native) return [];
-  return Object.entries(native.modules).map(([name, methods]) => {
-    const calls = methods.map(
-      (method) => `${method}: (...args) => callSwiftModule(options, ${JSON.stringify(`${native.packageId}.${name}`)}, ${JSON.stringify(method)}, args, ${JSON.stringify(native.contractHash)})`
-    ).join(", ");
-    return commonjs ? `module.exports.${name} = Object.freeze({ ${calls} })` : `export const ${name} = Object.freeze({ ${calls} })`;
-  });
-}
-function swiftEntryModuleEsm(args) {
-  return [
-    `import { createSwiftEntry, callSwiftModule } from 'peachsim/swift'`,
-    `const options = ${JSON.stringify({ url: args.url, hash: args.hash, icuUrl: args.icuUrl, rootId: args.rootId, resources: args.resources, bundleFiles: args.bundleFiles, colors: args.colors, symbols: args.symbols })}`,
-    ...!args.native || args.native.defaultView ? ["export default createSwiftEntry(options)"] : [],
-    ...nativeExportLines(args, false),
-    ""
-  ].join("\n");
-}
-
 // src/auth/shared-session.ts
 var import_node_fs = require("node:fs");
 var import_node_path2 = require("node:path");
@@ -817,7 +821,7 @@ var ONE_IMPLICIT_FLAGS = ', "-Xfrontend", "-import-module", "-Xfrontend", "One"'
 var MULTI_MANIFEST_VERSION = 5;
 function swiftArtifactHash(input, release, moduleRoot) {
   const hash = (0, import_node_crypto2.createHash)("sha256");
-  hash.update(`swift-compile/v2
+  hash.update(`swift-compile/v3
 ${release}
 `);
   if (input.oneModule) hash.update("one-module\n");
@@ -917,13 +921,95 @@ function syncSwiftTree(base, files) {
     (0, import_node_fs3.writeFileSync)(full, contents, "utf8");
   }
 }
-var CONDITION_LINE = /^([ \t]*#(?:if|elseif)\b)(.*)$/gm;
+var DIRECTIVE = /^[ \t]*#(?:if|elseif)\b/;
 var OS_IOS = /\bos\(\s*iOS\s*\)/g;
 function swiftSourceAsIOS(source) {
-  return source.replace(
-    CONDITION_LINE,
-    (_, directive, condition) => directive + condition.replace(OS_IOS, (match) => "true".padEnd(match.length))
-  );
+  const code = swiftCodeLineStarts(source);
+  let offset = 0;
+  return source.split("\n").map((line) => {
+    const start = offset;
+    offset += line.length + 1;
+    if (!code.has(start) || !DIRECTIVE.test(line)) return line;
+    return line.replace(OS_IOS, (match) => "true".padEnd(match.length));
+  }).join("\n");
+}
+function swiftCodeLineStarts(source) {
+  const starts = /* @__PURE__ */ new Set();
+  const stack = [{ kind: "code", parens: 0 }];
+  const hashesAt = (at) => {
+    let end = at;
+    while (source[end] === "#") end++;
+    return end - at;
+  };
+  const closes = (at, hashes) => source.startsWith("#".repeat(hashes), at);
+  let i = 0;
+  while (i < source.length) {
+    const top = stack[stack.length - 1];
+    if ((i === 0 || source[i - 1] === "\n") && top.kind === "code" && stack.length === 1)
+      starts.add(i);
+    const char = source[i];
+    if (top.kind === "block") {
+      if (source.startsWith("/*", i)) {
+        top.depth++;
+        i += 2;
+      } else if (source.startsWith("*/", i)) {
+        if (--top.depth === 0) stack.pop();
+        i += 2;
+      } else i++;
+      continue;
+    }
+    if (top.kind === "string") {
+      if (char === "\\" && closes(i + 1, top.hashes)) {
+        const after = i + 1 + top.hashes;
+        if (source[after] === "(") {
+          stack.push({ kind: "code", parens: 0 });
+          i = after + 1;
+        } else i = after + 1;
+        continue;
+      }
+      const quote = top.multiline ? '"""' : '"';
+      if (source.startsWith(quote, i) && closes(i + quote.length, top.hashes)) {
+        stack.pop();
+        i += quote.length + top.hashes;
+      } else i++;
+      continue;
+    }
+    if (top.kind === "regex") {
+      if (char === "/" && closes(i + 1, top.hashes)) {
+        stack.pop();
+        i += 1 + top.hashes;
+      } else i++;
+      continue;
+    }
+    if (source.startsWith("//", i)) {
+      const end = source.indexOf("\n", i);
+      i = end === -1 ? source.length : end;
+    } else if (source.startsWith("/*", i)) {
+      stack.push({ kind: "block", depth: 1 });
+      i += 2;
+    } else if (char === '"' || char === "#") {
+      const hashes = hashesAt(i);
+      const at = i + hashes;
+      if (source.startsWith('"""', at)) {
+        stack.push({ kind: "string", hashes, multiline: true });
+        i = at + 3;
+      } else if (source[at] === '"') {
+        stack.push({ kind: "string", hashes, multiline: false });
+        i = at + 1;
+      } else if (hashes > 0 && source[at] === "/") {
+        stack.push({ kind: "regex", hashes });
+        i = at + 1;
+      } else i = Math.max(at, i + 1);
+    } else if (char === "(") {
+      top.parens++;
+      i++;
+    } else if (char === ")") {
+      if (top.parens === 0 && stack.length > 1) stack.pop();
+      else top.parens--;
+      i++;
+    } else i++;
+  }
+  return starts;
 }
 var compiledSource = (file, contents) => file.endsWith(".swift") ? swiftSourceAsIOS(contents) : contents;
 function writeSwiftProject(layout, input, moduleRoot) {
@@ -1073,7 +1159,15 @@ function compileSwiftProjectUnit(input, options) {
 
 // src/swift-submit.ts
 var SWIFT_COMPILE_PATH = "/api/swift-compile";
-var SWIFT_HOST_ABI = 1;
+var MAX_SWIFT_COMPILE_FILES = 256;
+var MAX_SWIFT_COMPILE_SOURCE_BYTES = 2 * 1024 * 1024;
+var MAX_SWIFT_COMPILE_RESOURCES = 128;
+var MAX_SWIFT_COMPILE_RESOURCE_BYTES = 2 * 1024 * 1024;
+var MAX_SWIFT_COMPILE_RESOURCE_TOTAL_BYTES = 8 * 1024 * 1024;
+var MAX_SWIFT_COMPILE_IMAGES = 128;
+var MAX_SWIFT_COMPILE_IMAGE_BYTES = 4 * 1024 * 1024;
+var MAX_SWIFT_COMPILE_IMAGE_TOTAL_BYTES = 16 * 1024 * 1024;
+var SWIFT_HOST_ABI = 2;
 var POLL_INTERVAL_MS = 1500;
 function swiftNativeEntry(native, file) {
   return {
@@ -1094,6 +1188,7 @@ function httpSwiftCompileSubmit(context) {
     try {
       response = await fetch(url, {
         method: "POST",
+        signal: context.signal,
         headers: {
           "content-type": "application/json",
           ...authorization ? { authorization } : {}
@@ -1116,30 +1211,78 @@ function httpSwiftCompileSubmit(context) {
         `contrast-bundler: the swift compile for ${work.entry} answered ${response.status}${detail ? `: ${detail}` : ""}`
       );
     }
-    return await response.json();
+    const outcome = await response.json();
+    if (!isSwiftCompileOutcome(outcome)) {
+      throw new Error("swift compile: the service returned invalid artifact metadata");
+    }
+    return outcome;
   };
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSwiftNativeModules(value) {
+  return isRecord(value) && typeof value.packageId === "string" && typeof value.hash === "string" && isRecord(value.files) && isRecord(value.modules) && [...Object.values(value.files), ...Object.values(value.modules)].every(
+    (names) => Array.isArray(names) && names.every((name) => typeof name === "string")
+  ) && Array.isArray(value.defaultViewFiles) && value.defaultViewFiles.every((file) => typeof file === "string");
+}
+function isSwiftCompileOutcome(value) {
+  if (!isRecord(value)) return false;
+  switch (value.status) {
+    case "published":
+      return typeof value.artifactUrl === "string" && typeof value.icuUrl === "string" && typeof value.hash === "string" && /^[a-f0-9]{64}$/.test(value.hash) && (value.imageUrls === void 0 || isRecord(value.imageUrls) && Object.values(value.imageUrls).every((url) => typeof url === "string")) && (value.native === void 0 || isSwiftNativeModules(value.native));
+    case "compiling":
+      return typeof value.hash === "string" && /^[a-f0-9]{64}$/.test(value.hash);
+    case "refused":
+    case "failed":
+      return typeof value.detail === "string";
+    default:
+      return false;
+  }
+}
+function compileAssetUrl(value, origin) {
+  const url = new URL(value, origin);
+  if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password || url.origin !== new URL(origin).origin) {
+    throw new Error("swift compile: artifact address escapes the compile origin");
+  }
+  return url.href;
+}
 function resolveImageUrls(urls, origin) {
   const resolved = {};
   for (const [name, url] of Object.entries(urls)) {
-    resolved[name] = new URL(url, origin).href;
+    resolved[name] = compileAssetUrl(url, origin);
   }
   return resolved;
 }
-async function compileSwiftProject(submit, work, origin) {
+async function compileSwiftProject(submit, work, origin, signal) {
   while (true) {
+    signal?.throwIfAborted();
     const outcome = await submit(work);
     switch (outcome.status) {
       case "published":
         return {
-          url: new URL(outcome.artifactUrl, origin).href,
+          url: compileAssetUrl(outcome.artifactUrl, origin),
           hash: outcome.hash,
-          icuUrl: new URL(outcome.icuUrl, origin).href,
+          icuUrl: compileAssetUrl(outcome.icuUrl, origin),
           ...outcome.imageUrls === void 0 ? {} : { imageUrls: resolveImageUrls(outcome.imageUrls, origin) },
           ...outcome.native === void 0 ? {} : { native: outcome.native }
         };
       case "compiling":
-        await new Promise((resolve2) => setTimeout(resolve2, POLL_INTERVAL_MS));
+        await new Promise((resolve2, reject) => {
+          const finish = () => {
+            signal?.removeEventListener("abort", abort);
+            resolve2();
+          };
+          const timer = setTimeout(finish, POLL_INTERVAL_MS);
+          const abort = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", abort);
+            const reason = signal?.reason;
+            reject(reason instanceof Error ? reason : new Error(String(reason)));
+          };
+          signal?.addEventListener("abort", abort, { once: true });
+          if (signal?.aborted) abort();
+        });
         continue;
       case "refused":
       case "failed":
@@ -1150,11 +1293,10 @@ async function compileSwiftProject(submit, work, origin) {
   }
 }
 
-// src/vite-plugin-swift.ts
+// src/swift-host.ts
 var ARTIFACT_PATH = "/__peach/swift/";
 var RESOURCE_PATH = "/__peach/swift-res/";
 var ICU_PATH = "/__peach/swift-icu/";
-var VIRTUAL_PREFIX = "\0peach-swift:";
 var SKIP_SOURCE_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   "ios",
@@ -1169,89 +1311,124 @@ function swiftPackageId(packagePath) {
   return import_node_path5.default.basename(packagePath).replace(/[^A-Za-z0-9_]/g, "_").replace(/^(\d)/, "_$1");
 }
 function nativeSourceDescriptor(packagePath) {
+  packagePath = import_node_fs4.default.realpathSync(packagePath);
   const file = import_node_path5.default.join(packagePath, NATIVE_DESCRIPTOR);
   if (!import_node_fs4.default.existsSync(file)) return null;
-  const value = JSON.parse(import_node_fs4.default.readFileSync(file, "utf8"));
+  const value = JSON.parse(
+    readPackageFile(packagePath, file, MAX_SWIFT_COMPILE_SOURCE_BYTES).toString("utf8")
+  );
   const invalid = () => new Error(`${file}: invalid One native source descriptor; run one typegen`);
   if (!value || typeof value !== "object" || Reflect.get(value, "generatedBy") !== "one typegen" || !import_node_fs4.default.existsSync(import_node_path5.default.join(packagePath, NATIVE_GLUE))) {
     throw invalid();
   }
-  const packageId = Reflect.get(value, "packageId");
-  const hash = Reflect.get(value, "hash");
-  const rawFiles = Reflect.get(value, "files");
-  const rawModules = Reflect.get(value, "modules");
-  const rawDefaults = Reflect.get(value, "defaultViewFiles");
-  if (typeof packageId !== "string" || typeof hash !== "string" || !rawFiles || typeof rawFiles !== "object" || !rawModules || typeof rawModules !== "object" || !Array.isArray(rawDefaults) || !rawDefaults.every((name) => typeof name === "string")) {
+  if (!isSwiftNativeModules(value) || value.packageId !== swiftPackageId(packagePath)) {
     throw invalid();
   }
-  const files = {};
-  const modules = {};
-  for (const [key, names] of Object.entries(rawFiles)) {
-    if (!Array.isArray(names) || !names.every((name) => typeof name === "string"))
-      throw invalid();
-    files[key] = names;
-  }
-  for (const [key, names] of Object.entries(rawModules)) {
-    if (!Array.isArray(names) || !names.every((name) => typeof name === "string"))
-      throw invalid();
-    modules[key] = names;
-  }
-  if (packageId !== swiftPackageId(packagePath)) {
-    throw new Error(`${file}: invalid One native source descriptor; run one typegen`);
-  }
-  return { packageId, hash, files, modules, defaultViewFiles: rawDefaults };
+  return value;
 }
 function nativeSourceFiles(packagePath) {
+  packagePath = import_node_fs4.default.realpathSync(packagePath);
   return [NATIVE_DESCRIPTOR, NATIVE_GLUE].map((name) => import_node_path5.default.join(packagePath, name)).filter((file) => import_node_fs4.default.existsSync(file));
 }
 var projects = /* @__PURE__ */ new Map();
-var devServer;
-function projectFor(packagePath) {
+function projectFor(packagePath, hosted) {
+  packagePath = import_node_fs4.default.realpathSync(packagePath);
   const existing = projects.get(packagePath);
-  if (existing) return existing;
+  if (existing) {
+    if (hosted && !existing.hosted) {
+      throw new Error("a Swift package cannot share local and hosted compile ownership");
+    }
+    return existing;
+  }
   const created = {
     packagePath,
     artifact: null,
     building: null,
-    resourceFiles: /* @__PURE__ */ new Map()
+    resourceFiles: /* @__PURE__ */ new Map(),
+    resourcesPrevious: /* @__PURE__ */ new Map(),
+    artifacts: [],
+    hosted
   };
   projects.set(packagePath, created);
   return created;
 }
-function sourceFiles(root) {
-  const found = [];
-  const walk = (dir) => {
-    for (const entry of import_node_fs4.default.readdirSync(dir, { withFileTypes: true })) {
-      if (entry.name.startsWith(".") || SKIP_SOURCE_DIRS.has(entry.name)) continue;
-      const full = import_node_path5.default.join(dir, entry.name);
-      if (entry.isDirectory()) {
-        if (full !== root && import_node_fs4.default.existsSync(import_node_path5.default.join(full, "Package.swift"))) continue;
-        walk(full);
-      } else if (entry.name.endsWith(".swift") && (entry.isFile() || entry.isSymbolicLink() && import_node_fs4.default.statSync(full).isFile()))
-        found.push(full);
-    }
-  };
-  walk(root);
-  return found;
-}
-function resourceCandidateFiles(root) {
+function packageFiles(root) {
+  const canonicalRoot = import_node_fs4.default.realpathSync(root);
   const found = [];
   const walk = (dir) => {
-    for (const entry of import_node_fs4.default.readdirSync(dir, { withFileTypes: true })) {
-      if (entry.name.startsWith(".") || SKIP_SOURCE_DIRS.has(entry.name) || entry.name === ".build")
+    for (const entry of import_node_fs4.default.readdirSync(dir, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+      if (entry.name.startsWith(".") && entry.name !== NATIVE_DESCRIPTOR && entry.name !== NATIVE_GLUE || SKIP_SOURCE_DIRS.has(entry.name))
         continue;
       const full = import_node_path5.default.join(dir, entry.name);
+      if (entry.isSymbolicLink()) throw new Error(`swift input is a symlink: ${full}`);
+      const real = import_node_fs4.default.realpathSync(full);
+      const relative = import_node_path5.default.relative(canonicalRoot, real);
+      if (relative.startsWith(`..${import_node_path5.default.sep}`) || relative === ".." || import_node_path5.default.isAbsolute(relative)) {
+        throw new Error(`swift input escapes the selected package: ${full}`);
+      }
       if (entry.isDirectory()) {
-        if (full !== root && import_node_fs4.default.existsSync(import_node_path5.default.join(full, "Package.swift"))) continue;
+        if (import_node_fs4.default.existsSync(import_node_path5.default.join(full, "Package.swift"))) continue;
         walk(full);
-      } else {
+      } else if (entry.isFile()) {
         found.push(full);
+        if (found.length > 4096) throw new Error("swift package exceeds 4096 input files");
       }
     }
   };
-  walk(root);
+  walk(canonicalRoot);
   return found;
 }
+function readPackageFile(root, file, maxBytes) {
+  const canonicalRoot = import_node_fs4.default.realpathSync(root);
+  const relative = import_node_path5.default.relative(canonicalRoot, import_node_fs4.default.realpathSync(file));
+  if (relative === ".." || relative.startsWith(`..${import_node_path5.default.sep}`) || import_node_path5.default.isAbsolute(relative)) {
+    throw new Error(`swift input escapes the selected package: ${file}`);
+  }
+  let ancestor = import_node_path5.default.resolve(file);
+  while (ancestor !== canonicalRoot) {
+    if (import_node_fs4.default.lstatSync(ancestor).isSymbolicLink()) {
+      throw new Error(`swift input is a symlink: ${ancestor}`);
+    }
+    const parent = import_node_path5.default.dirname(ancestor);
+    if (parent === ancestor)
+      throw new Error(`swift input escapes the selected package: ${file}`);
+    ancestor = parent;
+  }
+  const expected = import_node_fs4.default.statSync(file);
+  const fd = import_node_fs4.default.openSync(file, import_node_fs4.default.constants.O_RDONLY | import_node_fs4.default.constants.O_NOFOLLOW);
+  try {
+    const stat = import_node_fs4.default.fstatSync(fd);
+    if (stat.dev !== expected.dev || stat.ino !== expected.ino) {
+      throw new Error(`swift input changed while opening: ${file}`);
+    }
+    if (!stat.isFile() || stat.size > maxBytes) {
+      throw new Error(`swift input exceeds ${maxBytes} bytes: ${file}`);
+    }
+    const bytes = Buffer.alloc(stat.size + 1);
+    let offset = 0;
+    while (offset < bytes.length) {
+      const count = import_node_fs4.default.readSync(fd, bytes, offset, bytes.length - offset, null);
+      if (count === 0) break;
+      offset += count;
+    }
+    if (offset !== stat.size || import_node_fs4.default.fstatSync(fd).size !== stat.size) {
+      throw new Error(`swift input changed while reading: ${file}`);
+    }
+    return bytes.subarray(0, offset);
+  } finally {
+    import_node_fs4.default.closeSync(fd);
+  }
+}
+function sourceFiles(root) {
+  const files = packageFiles(root).filter((file) => file.endsWith(".swift"));
+  if (files.length > MAX_SWIFT_COMPILE_FILES || files.reduce((total, file) => total + import_node_fs4.default.statSync(file).size, 0) > MAX_SWIFT_COMPILE_SOURCE_BYTES) {
+    throw new Error("swift sources exceed the compile service caps");
+  }
+  return files;
+}
+function resourceCandidateFiles(root) {
+  return packageFiles(root).filter((file) => !file.endsWith(".swift"));
+}
 var RESOURCE_CONTENT_TYPES = {
   ".avif": "image/avif",
   ".bmp": "image/bmp",
@@ -1272,11 +1449,11 @@ function buildSwiftResourceTable(project, baseUrl) {
     const file = byRelative.get(candidate);
     if (!file || !/(^|\/)Contents\.json$|\.symbolset\/[^/]+\.svg$/.test(candidate))
       return null;
-    try {
-      return import_node_fs4.default.readFileSync(file, "utf8");
-    } catch {
-      return null;
-    }
+    return readPackageFile(
+      project.packagePath,
+      file,
+      MAX_SWIFT_COMPILE_RESOURCE_BYTES
+    ).toString("utf8");
   };
   const found = enumerateBundleImages(relative, readContents);
   const colors = enumerateBundleColors(relative, readContents);
@@ -1285,15 +1462,19 @@ function buildSwiftResourceTable(project, baseUrl) {
   const images = {};
   const watched = [];
   const registered = /* @__PURE__ */ new Map();
+  let imageBytes = 0;
   for (const { name, file, scale } of found) {
     const disk = byRelative.get(file);
     if (!disk) continue;
-    let bytes;
-    try {
-      bytes = import_node_fs4.default.readFileSync(disk);
-    } catch {
-      continue;
+    if (Object.keys(images).length >= MAX_SWIFT_COMPILE_IMAGES || imageBytes + import_node_fs4.default.statSync(disk).size > MAX_SWIFT_COMPILE_IMAGE_TOTAL_BYTES) {
+      throw new Error("swift image pack exceeds the compile service caps");
     }
+    const bytes = readPackageFile(
+      project.packagePath,
+      disk,
+      MAX_SWIFT_COMPILE_IMAGE_BYTES
+    );
+    imageBytes += bytes.length;
     const hash = (0, import_node_crypto3.createHash)("sha256").update(bytes).digest("hex").slice(0, 16);
     const ext = import_node_path5.default.posix.extname(file).toLowerCase();
     table[name] = { uri: `${baseUrl}${RESOURCE_PATH}${hash}${ext}`, scale };
@@ -1304,65 +1485,60 @@ function buildSwiftResourceTable(project, baseUrl) {
     watched.push(file);
     const contents = file.replace(/\/[^/]+$/, "/Contents.json");
     if (byRelative.has(contents)) watched.push(contents);
-    registered.set(`${hash}${ext}`, disk);
+    registered.set(`${hash}${ext}`, {
+      bytes,
+      contentType: RESOURCE_CONTENT_TYPES[ext] ?? "application/octet-stream"
+    });
   }
   for (const file of relative) {
     if (file.endsWith(".colorset/Contents.json") || file.includes(".symbolset/"))
       watched.push(file);
   }
-  project.resourceFiles = registered;
+  if (registered.size !== project.resourceFiles.size || [...registered].some(
+    ([key, value]) => !project.resourceFiles.get(key)?.bytes.equals(value.bytes)
+  )) {
+    project.resourcesPrevious = project.resourceFiles;
+    project.resourceFiles = registered;
+  }
   return { table, images, colors, symbols, watched };
 }
-var BUNDLE_MAX_FILES = 128;
-var BUNDLE_MAX_FILE_BYTES = 4 * 1024 * 1024;
-var BUNDLE_MAX_TOTAL_BYTES = 8 * 1024 * 1024;
+var BUNDLE_MAX_FILES = MAX_SWIFT_COMPILE_RESOURCES;
+var BUNDLE_MAX_FILE_BYTES = MAX_SWIFT_COMPILE_RESOURCE_BYTES;
+var BUNDLE_MAX_TOTAL_BYTES = MAX_SWIFT_COMPILE_RESOURCE_TOTAL_BYTES;
 function buildSwiftBundleFiles(packagePath) {
+  packagePath = import_node_fs4.default.realpathSync(packagePath);
   const relative = resourceCandidateFiles(packagePath).map(
     (file) => import_node_path5.default.relative(packagePath, file).split(import_node_path5.default.sep).join(import_node_path5.default.posix.sep)
   );
   const files = {};
   const watched = [];
-  const skipped = [];
   let total = 0;
   for (const { base, file } of enumerateBundleJson(relative)) {
     watched.push(file);
-    let bytes;
-    try {
-      bytes = import_node_fs4.default.readFileSync(import_node_path5.default.join(packagePath, ...file.split("/")));
-    } catch {
-      continue;
-    }
-    if (bytes.length > BUNDLE_MAX_FILE_BYTES) {
-      skipped.push(`${file} (${bytes.length} bytes past the per-file cap)`);
-      continue;
-    }
-    if (Object.keys(files).length >= BUNDLE_MAX_FILES || total + bytes.length > BUNDLE_MAX_TOTAL_BYTES) {
-      skipped.push(
-        `${file} (pack caps: ${BUNDLE_MAX_FILES} files / ${BUNDLE_MAX_TOTAL_BYTES} bytes)`
+    const disk = import_node_path5.default.join(packagePath, ...file.split("/"));
+    if (Object.keys(files).length >= BUNDLE_MAX_FILES || total + import_node_fs4.default.statSync(disk).size > BUNDLE_MAX_TOTAL_BYTES) {
+      throw new Error(
+        `swift bundle pack exceeds ${BUNDLE_MAX_FILES} files / ${BUNDLE_MAX_TOTAL_BYTES} bytes`
       );
-      continue;
     }
+    const bytes = readPackageFile(packagePath, disk, BUNDLE_MAX_FILE_BYTES);
     files[base] = bytes.toString("base64");
     total += bytes.length;
   }
-  return { files, watched, skipped };
+  return { files, watched };
 }
 function serveSwiftResource(project, key) {
-  const disk = project.resourceFiles.get(key);
-  if (!disk) return null;
-  try {
-    return {
-      bytes: import_node_fs4.default.readFileSync(disk),
-      contentType: RESOURCE_CONTENT_TYPES[import_node_path5.default.extname(disk).toLowerCase()] ?? "application/octet-stream"
-    };
-  } catch {
-    return null;
-  }
+  return project.resourceFiles.get(key) ?? project.resourcesPrevious.get(key) ?? null;
 }
 function linkedModuleRoots(packagePath) {
+  packagePath = import_node_fs4.default.realpathSync(packagePath);
   let manifest;
   try {
-    manifest = import_node_fs4.default.readFileSync(import_node_path5.default.join(packagePath, "Package.swift"), "utf8");
+    manifest = readPackageFile(
+      packagePath,
+      import_node_path5.default.join(packagePath, "Package.swift"),
+      MAX_SWIFT_COMPILE_SOURCE_BYTES
+    ).toString("utf8");
   } catch {
     return [];
   }
@@ -1374,25 +1550,16 @@ function linkedModuleRoots(packagePath) {
   }
   return [...roots].sort();
 }
-function sourceStamp(packagePath, moduleRootOverride) {
+function sourceStamp(packagePath, moduleRootOverride, hosted = false) {
   const hash = (0, import_node_crypto3.createHash)("sha256");
   hash.update(packagePath);
-  const projectInputs = /* @__PURE__ */ new Set([
-    import_node_path5.default.join(packagePath, "Package.swift"),
-    ...sourceFiles(packagePath),
-    ...nativeSourceFiles(packagePath),
-    ...buildSwiftBundleFiles(packagePath).watched.map(
-      (file) => import_node_path5.default.join(packagePath, ...file.split(import_node_path5.default.posix.sep))
-    ),
-    ...buildSwiftResourceTable(projectFor(packagePath), "").watched.map(
-      (file) => import_node_path5.default.join(packagePath, ...file.split(import_node_path5.default.posix.sep))
-    )
-  ]);
+  const projectInputs = new Set(packageFiles(packagePath));
   for (const file of [...projectInputs].sort()) {
     hash.update(import_node_path5.default.relative(packagePath, file));
-    hash.update(String(import_node_fs4.default.statSync(file).mtimeMs));
+    const stat = import_node_fs4.default.statSync(file);
+    hash.update(`${stat.mtimeMs}/${stat.ctimeMs}/${stat.size}`);
   }
-  const moduleRoot = moduleRootOverride ?? linkedModuleRoots(packagePath).find(
+  const moduleRoot = hosted ? void 0 : moduleRootOverride ?? linkedModuleRoots(packagePath).find(
     (root) => import_node_fs4.default.existsSync(import_node_path5.default.join(root, "toolchain.json"))
   );
   if (moduleRoot) {
@@ -1408,46 +1575,85 @@ function entryRootId(packagePath, file) {
   const relative = import_node_path5.default.relative(packagePath, file).split(import_node_path5.default.sep).join(import_node_path5.default.posix.sep);
   return `${import_node_path5.default.basename(packagePath)}${import_node_path5.default.posix.sep}${relative}`;
 }
-function serverOrigin() {
-  const address = devServer?.httpServer?.address();
-  const port = address && typeof address === "object" ? address.port : devServer?.config.server.port;
-  if (!port) throw new Error("the swift urls need the dev server port");
-  return `http://localhost:${port}`;
-}
-function artifactUrl(project, artifact) {
-  return `${serverOrigin()}${ARTIFACT_PATH}${artifact.hash}.wasm`;
-}
 function icuUrl(origin, artifact) {
   return "url" in artifact.icu ? artifact.icu.url : `${origin}${ICU_PATH}${artifact.icu.sha256}`;
 }
 function packageSources(packagePath) {
+  const sources = sourceFiles(packagePath);
+  if (sources.length > MAX_SWIFT_COMPILE_FILES)
+    throw new Error("swift source file cap exceeded");
+  let total = 0;
+  for (const file of sources) total += import_node_fs4.default.statSync(file).size;
+  if (total > MAX_SWIFT_COMPILE_SOURCE_BYTES)
+    throw new Error("swift source byte cap exceeded");
   const files = {};
-  for (const file of sourceFiles(packagePath)) {
+  for (const file of sources) {
     const relative = import_node_path5.default.relative(packagePath, file).split(import_node_path5.default.sep).join(import_node_path5.default.posix.sep);
-    files[relative] = import_node_fs4.default.readFileSync(file, "utf8");
+    files[relative] = readPackageFile(
+      packagePath,
+      file,
+      MAX_SWIFT_COMPILE_SOURCE_BYTES
+    ).toString("utf8");
   }
-  const manifest = import_node_path5.default.join(packagePath, "Package.swift");
-  if (import_node_fs4.default.existsSync(manifest)) files["Package.swift"] = import_node_fs4.default.readFileSync(manifest, "utf8");
   return files;
 }
-function compileInput(packagePath, entry) {
+function packageSnapshot(project) {
+  const files = packageSources(project.packagePath);
+  const native = nativeSourceDescriptor(project.packagePath);
+  return {
+    files,
+    resources: buildSwiftResourceTable(project, ""),
+    bundleFiles: buildSwiftBundleFiles(project.packagePath),
+    native,
+    ...native ? {
+      glue: readPackageFile(
+        project.packagePath,
+        import_node_path5.default.join(project.packagePath, NATIVE_GLUE),
+        MAX_SWIFT_COMPILE_SOURCE_BYTES
+      ).toString("utf8")
+    } : {}
+  };
+}
+function snapshotCompileInput(snapshot, entry) {
   const input = {
-    files: packageSources(packagePath),
-    resources: buildSwiftBundleFiles(packagePath).files,
-    images: buildSwiftResourceTable(projectFor(packagePath), "").images,
+    files: snapshot.files,
+    resources: snapshot.bundleFiles.files,
+    images: snapshot.resources.images,
     entry,
     oneModule: true
   };
-  return nativeSourceDescriptor(packagePath) ? withNativeSourceGlue(
-    input,
-    import_node_fs4.default.readFileSync(import_node_path5.default.join(packagePath, NATIVE_GLUE), "utf8")
-  ) : input;
+  return snapshot.glue ? withNativeSourceGlue(input, snapshot.glue) : input;
 }
-async function compile(packagePath, entry, stamp, moduleRootOverride) {
+function compileInput(packagePath, entry) {
+  return snapshotCompileInput(packageSnapshot(projectFor(packagePath)), entry);
+}
+async function compile(packagePath, entry, stamp, moduleRootOverride, hosted, snapshot) {
+  const resources = {
+    table: snapshot.resources.table,
+    colors: snapshot.resources.colors,
+    symbols: snapshot.resources.symbols,
+    watched: snapshot.resources.watched
+  };
+  const content = {
+    resources,
+    bundleFiles: snapshot.bundleFiles,
+    native: snapshot.native
+  };
+  if (hosted)
+    return {
+      ...await compileRemote(packagePath, entry, snapshot, hosted),
+      stamp,
+      package: content
+    };
   const moduleRoot = moduleRootOverride ?? linkedModuleRoots(packagePath).find(
     (root) => import_node_fs4.default.existsSync(import_node_path5.default.join(root, "toolchain.json"))
   );
-  if (!moduleRoot) return { ...await compileRemote(packagePath, entry), stamp };
+  if (!moduleRoot)
+    return {
+      ...await compileRemote(packagePath, entry, snapshot),
+      stamp,
+      package: content
+    };
   const toolchain = JSON.parse(
     import_node_fs4.default.readFileSync(import_node_path5.default.join(moduleRoot, "toolchain.json"), "utf8")
   );
@@ -1455,7 +1661,7 @@ async function compile(packagePath, entry, stamp, moduleRootOverride) {
   if (typeof release !== "string") {
     throw new Error(`swift toolchain manifest at ${moduleRoot} has no release`);
   }
-  const artifact = await compileSwiftProjectUnit(compileInput(packagePath, entry), {
+  const artifact = await compileSwiftProjectUnit(snapshotCompileInput(snapshot, entry), {
     // the compile rewrites Sources/App in its root before swiftpm builds, and
     // its lock orders one process only: two vites on one root (a lane's dev
     // server and a capture, or two checkouts) build each other's sources. so
@@ -1473,50 +1679,75 @@ async function compile(packagePath, entry, stamp, moduleRootOverride) {
       `Library/Developer/Toolchains/${release}.xctoolchain/usr/bin`
     )
   });
-  return { ...artifact, stamp };
+  return { ...artifact, stamp, package: content };
 }
-async function compileRemote(packagePath, entry) {
-  const auth = resolveCliAuth();
-  if (!auth || auth.kind === "github") {
+async function compileRemote(packagePath, entry, snapshot, hosted) {
+  const auth = hosted ? null : resolveCliAuth();
+  if (!hosted && (!auth || auth.kind === "github")) {
     throw new Error(
       `compiling ${import_node_path5.default.basename(packagePath)} for Peach needs \`peach login\` or PEACH_API_KEY: this peachsim has no local SwiftUI module, so Contrast compiles it`
     );
   }
-  const origin = resolveContrastBackendOrigin(
-    auth.kind === "session" ? auth.origin : null
-  );
+  const origin = hosted?.origin ?? resolveContrastBackendOrigin(auth?.kind === "session" ? auth.origin : null);
+  const authorization = hosted?.authorization ?? (auth ? authHeaderValue(auth) : void 0);
+  const signal = AbortSignal.any([
+    ...hosted ? [hosted.signal] : [],
+    AbortSignal.timeout(5 * 6e4)
+  ]);
   const submit = httpSwiftCompileSubmit({
     endpoint: origin,
-    authorization: authHeaderValue(auth)
+    authorization,
+    signal
   });
   if (!submit) throw new Error("swift compile: no credential to submit with");
-  const descriptor = nativeSourceDescriptor(packagePath);
+  const descriptor = snapshot.native;
   const address = await compileSwiftProject(
     submit,
     {
-      files: packageSources(packagePath),
+      files: snapshot.files,
+      resources: snapshot.bundleFiles.files,
+      images: snapshot.resources.images,
       entry,
       packageId: descriptor?.packageId ?? swiftPackageId(packagePath)
     },
-    origin
+    origin,
+    signal
   );
   if (descriptor && address.native?.hash !== descriptor.hash) {
     throw new Error(
       `${import_node_path5.default.basename(packagePath)}: Contrast compiled native contract ${address.native?.hash ?? "none"} but one typegen wrote ${descriptor.hash}; the app's One and the compile host's differ, or the compile host is older than this peachsim`
     );
   }
-  const response = await fetch(address.url);
+  const response = await fetch(address.url, { signal });
   if (!response.ok) {
     throw new Error(`swift compile: ${address.url} answered ${response.status}`);
   }
+  const maxArtifactBytes = 64 * 1024 * 1024;
+  if (Number(response.headers.get("content-length")) > maxArtifactBytes || !response.body) {
+    throw new Error("swift compile: artifact exceeds 64 MiB or has no body");
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    signal.throwIfAborted();
+    const next = await reader.read();
+    if (next.done) break;
+    total += next.value.byteLength;
+    if (total > maxArtifactBytes) {
+      await reader.cancel();
+      throw new Error("swift compile: artifact exceeds 64 MiB");
+    }
+    chunks.push(next.value);
+  }
   return {
     hash: address.hash,
-    bytes: Buffer.from(await response.arrayBuffer()),
+    bytes: Buffer.concat(chunks),
     icu: { url: address.icuUrl }
   };
 }
 function artifactFor(project, entry, moduleRoot) {
-  const stamp = sourceStamp(project.packagePath, moduleRoot);
+  const stamp = sourceStamp(project.packagePath, moduleRoot, Boolean(project.hosted));
   if (project.artifact?.stamp === stamp) return Promise.resolve(project.artifact);
   if (project.building) {
     const running = project.building;
@@ -1524,9 +1755,24 @@ function artifactFor(project, entry, moduleRoot) {
     const again = () => artifactFor(project, entry, moduleRoot);
     return running.promise.then(again, again);
   }
-  const promise = compile(project.packagePath, entry, stamp, moduleRoot).then(
+  const snapshot = packageSnapshot(project);
+  if (sourceStamp(project.packagePath, moduleRoot, Boolean(project.hosted)) !== stamp) {
+    return artifactFor(project, entry, moduleRoot);
+  }
+  const promise = compile(
+    project.packagePath,
+    entry,
+    stamp,
+    moduleRoot,
+    project.hosted,
+    snapshot
+  ).then(
     (artifact) => {
       project.artifact = artifact;
+      project.artifacts = [
+        artifact,
+        ...project.artifacts.filter((old) => old.hash !== artifact.hash)
+      ].slice(0, 2);
       project.building = null;
       return artifact;
     },
@@ -1535,10 +1781,14 @@ function artifactFor(project, entry, moduleRoot) {
       throw error;
     }
   );
-  project.building = { stamp, promise };
-  return promise;
+  const fresh = promise.then(
+    (artifact) => sourceStamp(project.packagePath, moduleRoot, Boolean(project.hosted)) === artifact.stamp ? artifact : artifactFor(project, entry, moduleRoot)
+  );
+  project.building = { stamp, promise: fresh };
+  return fresh;
 }
 function swiftPackageWatchFiles(packagePath, moduleRoot) {
+  packagePath = import_node_fs4.default.realpathSync(packagePath);
   return [
     import_node_path5.default.join(packagePath, "Package.swift"),
     ...sourceFiles(packagePath),
@@ -1547,9 +1797,12 @@ function swiftPackageWatchFiles(packagePath, moduleRoot) {
     ...moduleRoot ? swiftModuleInputFiles(moduleRoot).map((file) => import_node_path5.default.join(moduleRoot, file)) : []
   ];
 }
-async function swiftPackageMetadata(packagePath, packageName, moduleRoot, origin) {
+async function swiftPackageMetadata(packagePath, packageName, moduleRoot, origin, hosted) {
+  packagePath = import_node_fs4.default.realpathSync(packagePath);
   const mains = sourceFiles(packagePath).filter(
-    (file) => /@main\s+(?:public\s+)?struct\s+\w+\s*:/.test(import_node_fs4.default.readFileSync(file, "utf8"))
+    (file) => /@main\s+(?:public\s+)?struct\s+\w+\s*:/.test(
+      readPackageFile(packagePath, file, MAX_SWIFT_COMPILE_SOURCE_BYTES).toString("utf8")
+    )
   );
   const native = nativeSourceDescriptor(packagePath);
   if (mains.length > 1 || mains.length === 0 && !native) {
@@ -1557,27 +1810,32 @@ async function swiftPackageMetadata(packagePath, packageName, moduleRoot, origin
       `swift package ${packageName} needs exactly one @main source or generated native modules; found ${mains.length}`
     );
   }
-  const project = projectFor(packagePath);
+  const project = projectFor(packagePath, hosted);
   const entry = mains.length === 1 ? import_node_path5.default.relative(packagePath, mains[0]).split(import_node_path5.default.sep).join(import_node_path5.default.posix.sep) : Object.entries(native?.files ?? {}).find(
     ([_file, names]) => names.length > 0
   )?.[0];
   if (!entry) throw new Error(`swift package ${packageName} has no native module source`);
   const artifact = await artifactFor(project, entry, moduleRoot);
-  const resources = buildSwiftResourceTable(project, origin);
-  const bundleFiles = buildSwiftBundleFiles(packagePath);
+  const resources = artifact.package.resources;
+  const bundleFiles = artifact.package.bundleFiles;
   return {
     url: `${origin}${ARTIFACT_PATH}${artifact.hash}.wasm`,
     hash: artifact.hash,
     icuUrl: icuUrl(origin, artifact),
     rootId: `${packageName}/${entry}`,
-    resources: resources.table,
+    resources: Object.fromEntries(
+      Object.entries(resources.table).map(([name, image]) => [
+        name,
+        { ...image, uri: `${origin}${image.uri}` }
+      ])
+    ),
     bundleFiles: bundleFiles.files,
     colors: resources.colors,
     symbols: resources.symbols,
-    native: native ? {
-      packageId: native.packageId,
-      contractHash: native.hash,
-      modules: native.modules,
+    native: artifact.package.native ? {
+      packageId: artifact.package.native.packageId,
+      contractHash: artifact.package.native.hash,
+      modules: artifact.package.native.modules,
       defaultView: mains.length === 1
     } : void 0
   };
@@ -1598,7 +1856,9 @@ function serveSwiftPackageAsset(pathname, res) {
   }
   if (pathname.startsWith(ICU_PATH)) {
     for (const project of projects.values()) {
-      const icu = project.artifact?.icu;
+      const icu = project.artifacts.find(
+        (artifact) => "sha256" in artifact.icu && pathname === `${ICU_PATH}${artifact.icu.sha256}`
+      )?.icu;
       if (!icu || "url" in icu || pathname !== `${ICU_PATH}${icu.sha256}`) continue;
       res.setHeader("access-control-allow-origin", "*");
       res.setHeader("content-type", "application/gzip");
@@ -1612,7 +1872,9 @@ function serveSwiftPackageAsset(pathname, res) {
   }
   if (!pathname.startsWith(ARTIFACT_PATH)) return false;
   for (const project of projects.values()) {
-    const artifact = project.artifact;
+    const artifact = project.artifacts.find(
+      (artifact2) => pathname === `${ARTIFACT_PATH}${artifact2.hash}.wasm`
+    );
     if (!artifact || pathname !== `${ARTIFACT_PATH}${artifact.hash}.wasm`) continue;
     res.setHeader("access-control-allow-origin", "*");
     res.setHeader("content-type", "application/wasm");
@@ -1623,13 +1885,27 @@ function serveSwiftPackageAsset(pathname, res) {
   res.end("swift artifact is stale");
   return true;
 }
+
+// src/vite-plugin-swift.ts
+var ARTIFACT_PATH2 = "/__peach/swift/";
+var VIRTUAL_PREFIX = "\0peach-swift:";
+var devServer;
+function serverOrigin() {
+  const address = devServer?.httpServer?.address();
+  const port = address && typeof address === "object" ? address.port : devServer?.config.server.port;
+  if (!port) throw new Error("the swift urls need the dev server port");
+  return `http://localhost:${port}`;
+}
+function artifactUrl(project, artifact) {
+  return `${serverOrigin()}${ARTIFACT_PATH2}${artifact.hash}.wasm`;
+}
 function packageFor(file) {
-  let dir = import_node_path5.default.dirname(file);
+  let dir = import_node_path6.default.dirname(file);
   const stop = devServer?.config.root;
   for (; ; ) {
-    if (import_node_fs4.default.existsSync(import_node_path5.default.join(dir, "Package.swift"))) return dir;
-    if (stop !== void 0 && dir === stop || import_node_path5.default.dirname(dir) === dir) break;
-    dir = import_node_path5.default.dirname(dir);
+    if (import_node_fs5.default.existsSync(import_node_path6.default.join(dir, "Package.swift"))) return dir;
+    if (stop !== void 0 && dir === stop || import_node_path6.default.dirname(dir) === dir) break;
+    dir = import_node_path6.default.dirname(dir);
   }
   throw new Error(
     `no Package.swift above ${file}${stop === void 0 ? "" : ` (searched up to ${stop})`}; a .swift import needs a swiftpm package like the one in packages/sootsim-swift/example`
@@ -1650,9 +1926,9 @@ function swiftPlugin(options = {}) {
       if (!resolved) throw new Error(`cannot resolve swift source ${source}`);
       let id = resolved.id;
       if (importer && (source.startsWith("./") || source.startsWith("../"))) {
-        const raw2 = import_node_path5.default.resolve(import_node_path5.default.dirname(importer.split("?")[0] ?? importer), source);
+        const raw2 = import_node_path6.default.resolve(import_node_path6.default.dirname(importer.split("?")[0] ?? importer), source);
         try {
-          if (import_node_fs4.default.realpathSync(raw2) === import_node_fs4.default.realpathSync(resolved.id)) id = raw2;
+          if (import_node_fs5.default.realpathSync(raw2) === import_node_fs5.default.realpathSync(resolved.id)) id = raw2;
         } catch {
         }
       }
@@ -1661,16 +1937,16 @@ function swiftPlugin(options = {}) {
     async load(id) {
       if (!id.startsWith(VIRTUAL_PREFIX)) return null;
       const file = id.slice(VIRTUAL_PREFIX.length);
-      if (!import_node_fs4.default.existsSync(file)) throw new Error(`swift source ${file} no longer exists`);
+      if (!import_node_fs5.default.existsSync(file)) throw new Error(`swift source ${file} no longer exists`);
       const packagePath = options.packagePath ?? packageFor(file);
       const project = projectFor(packagePath);
-      const entry = import_node_path5.default.relative(packagePath, file).split(import_node_path5.default.sep).join(import_node_path5.default.posix.sep);
+      const entry = import_node_path6.default.relative(packagePath, file).split(import_node_path6.default.sep).join(import_node_path6.default.posix.sep);
       for (const source of [
         ...sourceFiles(packagePath),
         ...nativeSourceFiles(packagePath)
       ])
         this.addWatchFile(source);
-      this.addWatchFile(import_node_path5.default.join(packagePath, "Package.swift"));
+      this.addWatchFile(import_node_path6.default.join(packagePath, "Package.swift"));
       for (const root of linkedModuleRoots(packagePath)) {
         for (const source of sourceFiles(root)) this.addWatchFile(source);
       }
@@ -1682,39 +1958,20 @@ function swiftPlugin(options = {}) {
         this.warn(error instanceof Error ? error.message : String(error));
         artifact = project.artifact;
       }
-      let resources = {};
-      let colors = {};
-      let symbols = {};
-      try {
-        const built = buildSwiftResourceTable(project, serverOrigin());
-        resources = built.table;
-        colors = built.colors;
-        symbols = built.symbols;
-        for (const watched of built.watched) {
-          this.addWatchFile(import_node_path5.default.join(packagePath, ...watched.split(import_node_path5.default.posix.sep)));
-        }
-      } catch (error) {
-        this.warn(
-          `swift resources for ${packagePath}: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-      let bundleFiles = {};
-      try {
-        const packed = buildSwiftBundleFiles(packagePath);
-        bundleFiles = packed.files;
-        for (const watched of packed.watched) {
-          this.addWatchFile(import_node_path5.default.join(packagePath, ...watched.split(import_node_path5.default.posix.sep)));
-        }
-        if (packed.skipped.length > 0) {
-          this.warn(
-            `swift bundle files skipped for ${packagePath}: ${packed.skipped.join("; ")}`
-          );
-        }
-      } catch (error) {
-        this.warn(
-          `swift bundle files for ${packagePath}: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
+      const resources = Object.fromEntries(
+        Object.entries(artifact.package.resources.table).map(([name, image]) => [
+          name,
+          { ...image, uri: `${serverOrigin()}${image.uri}` }
+        ])
+      );
+      for (const watched of [
+        ...artifact.package.resources.watched,
+        ...artifact.package.bundleFiles.watched
+      ])
+        this.addWatchFile(import_node_path6.default.join(packagePath, ...watched.split(import_node_path6.default.posix.sep)));
+      const colors = artifact.package.resources.colors;
+      const symbols = artifact.package.resources.symbols;
+      const bundleFiles = artifact.package.bundleFiles.files;
       const native = nativeSourceDescriptor(packagePath);
       return swiftEntryModuleEsm({
         url: artifactUrl(project, artifact),