@appshell/react 1.0.0-alpha.10 → 1.0.0-alpha.100

package/dist/types/config/src/publish.d.ts

@@ -1,7 +1,15 @@
-import { AppshellManifest, Metadata } from './types';
+import { AppshellManifest, Metadata, ModuleFederationLoader } from './types';
 export type PublishOptions = {
     registry: string;
     token?: string;
+    /**
+     * Where this package belongs, when the package name declares it.
+     *
+     * Omitted means the publisher's own namespace, which is how every publish worked before
+     * this existed. The registry refuses a scope the caller does not own, so declaring one
+     * is a statement of fact rather than a request.
+     */
+    scopeId?: string;
     name: string;
     version: string;
     manifest: AppshellManifest;
@@ -11,19 +19,93 @@ export type PublishOptions = {
     force?: boolean;
 };
 export type PublishResult = {
-    /** `scope/name@version`. The scope comes from the token, not the caller. */
+    /** `scope/name@version`. From the package name where it declares one, else the token. */
     id: string;
     created: boolean;
+    /** Empty unless a shared block was sent. See `openOverlay`. */
+    divergence: SharedDivergence[];
 };
 /**
  * Publishing the same content twice is a no-op; publishing different content
  * under a version that already exists is rejected by the registry, unless
  * `force` is set and the registry is configured to honor it (dev registries).
  */
-export declare const publish: ({ registry, token, name, version, manifest, visibility, metadata, force, }: PublishOptions) => Promise<PublishResult>;
+export declare const publish: ({ registry, token, scopeId, name, version, manifest, visibility, metadata, force, }: PublishOptions) => Promise<PublishResult>;
 /**
- * Activating a newer version of an already active app upgrades it in place.
- * @param environment `scope/name`
+ * Activating a newer version of an already active package upgrades it in place.
+ * @param application `scope/name`
  */
-export declare const activate: (registry: string, environment: string, appId: string, token?: string) => Promise<void>;
-//# sourceMappingURL=publish.d.ts.map
+export declare const activate: (registry: string, application: string, packageId: string, token?: string) => Promise<void>;
+/** What an overlay redirects a single remote to, or introduces one as. */
+export type OverlayRemotePatch = {
+    remoteEntryUrl: string;
+    manifestUrl?: string;
+    /**
+     * How to load this build's copy, from the Module Federation config that emits it.
+     *
+     * Sent because the loader describes the code being loaded, and an overlay points at
+     * this build rather than the published one. Without it a redirect addresses a dev
+     * server's bundle by whatever container name the last publish happened to have, so
+     * renaming the container locally resolves to a container the browser cannot find.
+     *
+     * It is also what lets an overlay introduce a component that is not published yet: a
+     * redirect inherits the published loader, an addition has no published anything.
+     */
+    loader?: ModuleFederationLoader;
+    /**
+     * The remote's `metadata` as this build declares it.
+     *
+     * Sent because a developer iterating on `appshell.config.yaml` is editing metadata as
+     * much as code; without it an overlay serves their new bundle beside the published
+     * route, displayName and icon. The registry replaces rather than merges, so a key
+     * removed from the yaml disappears rather than standing.
+     */
+    metadata?: Metadata;
+};
+/** One shared dependency where a local build and the published version disagree. */
+export type SharedDivergence = {
+    packageId: string;
+    shareScope: string;
+    packageName: string;
+    published?: string;
+    local?: string;
+    singleton: {
+        published: boolean;
+        local: boolean;
+    };
+};
+export type OpenedOverlay = {
+    id: string;
+    confirmUrl: string;
+    url: string;
+    remotes: string[];
+    expiresAt: string;
+    /**
+     * False when an overlay was already open for this developer and this one extended it.
+     * A browser carries a single overlay id, so an extended overlay is one some browser has
+     * already confirmed — nothing needs sending back to the confirmation page.
+     */
+    created: boolean;
+    /**
+     * What this build declares that the published version does not. Empty unless a shared
+     * block was sent — see `openOverlay`.
+     */
+    divergence: SharedDivergence[];
+};
+/**
+ * Points some of an application's remotes at a developer's own machine, for that
+ * developer only.
+ *
+ * This is what a local dev loop does instead of republishing. A published version is
+ * immutable and content-addressed; overwriting one on every rebuild makes the digest
+ * describe whoever built last, and two developers sharing a registry overwrite each
+ * other. An overlay is per-developer, per-browser and expiring, so neither happens.
+ *
+ * Extending is the normal case rather than the exception: the registry merges remotes
+ * into whatever overlay this developer already holds, so serving two micro-frontends
+ * locally redirects both without minting a second overlay or asking for confirmation
+ * twice.
+ *
+ * @param application `scope/name`
+ */
+export declare const openOverlay: (registry: string, application: string, remotes: Record<string, OverlayRemotePatch>, token?: string, shared?: Record<string, unknown>, shellFlavor?: "prod" | "dev") => Promise<OpenedOverlay>;

package/dist/types/config/src/sync.d.ts

@@ -18,4 +18,3 @@ export declare const groupByBaselineModule: (conflicts: Record<string, Compariso
  */
 declare const _default: (workingDir: string, registry: string, conflicts: Record<string, ComparisonResult>, resolutionStrategy?: ResolutionStrategy, packageManager?: PackageManager, dryRun?: boolean) => Promise<void>;
 export default _default;
-//# sourceMappingURL=sync.d.ts.map

package/dist/types/config/src/tls.d.ts

@@ -0,0 +1,11 @@
+import https from 'https';
+export declare const caFile: () => string | undefined;
+/**
+ * The agent to use for registry and issuer requests, or undefined when no CA is
+ * configured and Node's defaults apply.
+ *
+ * A configured file that does not exist throws rather than being skipped: falling back
+ * silently would reproduce the original certificate error, having been told exactly how
+ * to avoid it.
+ */
+export declare const httpsAgent: () => https.Agent | undefined;

package/dist/types/config/src/types.d.ts

@@ -1,4 +1,6 @@
+import type { AppshellIndex, AppshellRemote, Metadata, RemoteLoader } from '@appshell/runtime';
 import { JSONSchema4, JSONSchema6, JSONSchema7 } from 'json-schema';
+export type { AppshellIndex, AppshellRemote, Metadata, ModuleFederationLoader, RemoteLoader, } from '@appshell/runtime';
 export type Schema = JSONSchema4 | JSONSchema6 | JSONSchema7;
 export type ConfigValidator = {
     validate: <T>(...config: T[]) => void;
@@ -43,58 +45,184 @@ export type ComparisonTarget = {
     name: string;
     dependencies: Record<string, string | undefined>;
 };
+/**
+ * Every key `appshell config set` accepts, kept adjacent to the type it must agree with.
+ *
+ * It used to live in the set handler, and adding `caFile` to CliConfig without touching it
+ * produced a setting the cli could read and refuse to write.
+ */
+export declare const CLI_SETTINGS: readonly ["registry", "application", "defaultScope", "authIssuer", "clientId", "apiKey", "apiKeyHeader", "caFile", "api"];
+export type CliSetting = (typeof CLI_SETTINGS)[number];
 export type CliConfig = Record<string, string> & {
     apiKey: string;
+    /**
+     * PEM bundle to trust in addition to Node's built-ins, for a registry behind a private
+     * CA. Optional, and absent from `config init` output: an empty path is not a default
+     * worth writing, and its absence means "use Node's defaults".
+     */
+    caFile?: string;
+    /**
+     * The platform api the registry's organizations live on, e.g. https://api.appshell.org.
+     * Optional: absent, `appshell org` derives it from the auth issuer's host (auth.<domain> →
+     * api.<domain>), and a registry run without a platform behind it has no organizations.
+     */
+    api?: string;
     registry: string;
-    environment: string;
-    scopeId: string;
+    application: string;
+    /**
+     * Which namespace an unqualified name belongs to, absent anything better.
+     *
+     * Addressing only, and named for it. It was `scope-id`, which read as *the scope this
+     * account has* — identity — and it is not: the registry takes a caller's scope from the
+     * token, and this value never reaches it. Publishing takes it from the package name.
+     * So a `scope-id` here decided where names resolved while something else decided where
+     * writes landed, and the two could disagree without anything saying so.
+     *
+     * It earns its place all the same: `resolveScopeId` falls back to the account's own
+     * scope and deliberately refuses to guess when an account owns several, and this is how
+     * that is settled without passing a flag to every command.
+     */
+    defaultScope: string;
     authIssuer: string;
     clientId: string;
 };
+/**
+ * Neither `url` nor `filename`.
+ *
+ * `url` is an origin, and an origin belongs to a deployment: a package is published once
+ * and deployed many times, so a url here would freeze one environment's answer into an
+ * immutable version and make the artifact's digest depend on where it was built.
+ *
+ * `filename` was a hand-written copy of the Module Federation `filename`, which is what
+ * actually decides the file webpack emits. Two statements of one fact, and only one of
+ * them is enforced by anything.
+ */
 export type AppshellConfigRemote<TMetadata = Metadata> = {
     id: string;
-    url: string;
-    filename: string;
     metadata: TMetadata;
 };
 export type AppshellConfig<TMetadata = Metadata> = {
     name?: string;
-    remotes?: Record<string, AppshellConfigRemote<TMetadata>>;
-    environment?: Record<string, unknown>;
+    /**
+     * What the registry should publish this package as. `--visibility` overrides it.
+     *
+     * Declared here but deliberately absent from the manifest, as `name` already is: the
+     * manifest is hashed into the package digest, and visibility is not a property of the
+     * artifact. Keeping it out is what lets a package be made public later without its
+     * content changing identity.
+     */
+    visibility?: 'public' | 'private';
+    /**
+     * What this package publishes, keyed by federation entrypoint.
+     *
+     * Appshell's own word rather than a framework's. It was `remotes`, which is MF's word
+     * for the opposite — what a package consumes — so the file read inverted to anyone who
+     * knew the framework. `exposes` would fix that and put MF's vocabulary at the top level
+     * of appshell's model, which is what the loader recipe exists to prevent.
+     */
+    components?: Record<string, AppshellConfigRemote<TMetadata>>;
+    /**
+     * What this package consumes, by the name it refers to them by.
+     *
+     * A flat list because a referenced remote is required by definition: unbound, the region
+     * renders an error. `RemoteSlot`'s `fallback` is a loading placeholder — it shows while
+     * the remote arrives, not when it is absent — so unlike a design token's `var()`
+     * fallback it describes no degraded-but-working state.
+     *
+     * The application binds each name to a registry address, so a package never states the
+     * scope its siblings were published into — which it cannot know, since scope is assigned
+     * by whoever publishes.
+     */
+    remotes?: string[];
+    vars?: Record<string, unknown>;
     overrides?: AppshellOverrides;
 };
 export type AppshellTemplate<TMetadata = Metadata> = {
     name?: string;
-    remotes?: Record<string, AppshellConfigRemote<TMetadata>>;
+    /** Carried from the yaml for publish to read; never mapped into the manifest. */
+    visibility?: 'public' | 'private';
+    components?: Record<string, AppshellConfigRemote<TMetadata>>;
+    remotes?: string[];
     module: ModuleFederationPluginOptions;
-    environment?: Record<string, unknown>;
+    vars?: Record<string, unknown>;
+    tokens?: Record<string, AppshellTokenUsage>;
     overrides?: AppshellOverrides;
 };
 /** Appshell manifest types */
-export type AppshellRemote<TMetadata = Metadata> = {
-    id: string;
-    manifestUrl: string;
-    remoteEntryUrl: string;
-    scope: string;
-    module: string;
-    shareScope?: string;
-    metadata: TMetadata;
+/** The parts of a remote an application may point somewhere else. */
+export type RemoteOverride = {
+    remoteEntryUrl?: string;
+    manifestUrl?: string;
 };
 export type AppshellOverrides = {
-    environment: Record<string, Record<string, string | number | undefined>>;
+    vars: Record<string, Record<string, string | number | undefined>>;
+    /**
+     * Where an application loads a remote from, keyed by registry address.
+     *
+     * A package is published once; an application is deployed many times, per environment.
+     * The origin a bundle is served from is a property of a deployment, so it belongs to
+     * whoever deploys rather than being frozen into an immutable artifact at publish — which
+     * is also what makes adopting someone else's package and serving it yourself a spec edit
+     * rather than a republish.
+     *
+     * `filename` stays in the manifest: `remoteEntry.js` is genuinely build output. Only the
+     * origin varies by environment.
+     */
+    remotes?: Record<string, RemoteOverride>;
+};
+/**
+ * Which design tokens a package's own output reaches for. Observed from the emitted
+ * assets rather than declared: the CSS already says it, and a hand-kept list is a copy
+ * that drifts the first time someone adds a token and forgets the yaml.
+ *
+ * `required` is a reference with no fallback — the package has no plan B. `optional` is
+ * `var(--appshell-x, something)`, which degrades on its own. That split is read off what
+ * the author wrote rather than asked of them.
+ */
+export type AppshellTokenUsage = {
+    required: string[];
+    optional: string[];
+};
+/** A shared-dependency contract, named as one framework's model among possible models. */
+export type SharedContract = {
+    apiVersion: 'federation.appshell.org/v1';
+    kind: 'ModuleFederation';
+    /** Keyed by share scope, as Module Federation groups them. */
+    scopes: Record<string, SharedObject>;
 };
 export type AppshellManifest<TMetadata = Metadata> = {
-    remotes: Record<string, AppshellRemote<TMetadata>>;
-    modules: Record<string, ModuleFederationPluginOptions>;
-    environment: Record<string, Record<string, string | number | undefined>>;
+    /** What this package publishes, keyed by federation entrypoint. */
+    components: Record<string, PublishedRemote<TMetadata>>;
+    /** What it consumes, by local name; the application binds each to an address. */
+    remotes?: string[];
+    /**
+     * The shared-dependency contract this package was built against.
+     *
+     * Tagged like the loader recipe, and for the same reason: share scopes, singletons and
+     * version ranges are Module Federation's model of the problem, which single-spa and
+     * import maps solve differently. This replaced `modules`, which stored MF's plugin
+     * options verbatim — one reader took two fields from it, while its source paths and
+     * type-generation flags sat inside the package digest.
+     */
+    shared?: SharedContract;
+    vars: Record<string, Record<string, string | number | undefined>>;
+    /** Keyed by federation scope, so a merged manifest still says which package needs what. */
+    tokens?: Record<string, AppshellTokenUsage>;
     overrides?: AppshellOverrides;
 };
-export type AppshellIndex = Record<string, string>;
-export type Metadata = Record<string, unknown>;
-export type AppshellGlobalConfig<TMetadata = Metadata> = {
-    index: AppshellIndex;
-    metadata?: Record<string, TMetadata>;
-    overrides?: AppshellOverrides;
+/**
+ * A remote as a package publishes it: what the build knows about itself, and nothing
+ * about where it ends up.
+ *
+ * Distinct from `AppshellRemote`, which is the same remote after the registry has
+ * resolved it for the browser. They were one type, which is why the origin ended up in
+ * the artifact: the browser genuinely needs a url, so the published form appeared to as
+ * well. The registry supplies it at composition, from the address and its serving plane.
+ */
+export type PublishedRemote<TMetadata = Metadata> = {
+    id: string;
+    loader: RemoteLoader;
+    metadata: TMetadata;
 };
 /** An `AppshellRemote` the registry already resolved, so the browser needs no manifest fetch. */
 export type ResolvedRemote<TMetadata = Metadata> = AppshellRemote<TMetadata>;
@@ -102,19 +230,45 @@ export type ResolvedRemote<TMetadata = Metadata> = AppshellRemote<TMetadata>;
  * The wire contract for `window.__appshell_config__`. Deliberately not an
  * `AppshellManifest`: that is a build artifact, and reusing it left it unclear
  * which fields the browser actually needs. `modules` is build-time webpack
- * config and never crosses the wire; `environment` arrives already merged with
- * the environment's overrides, leaving the browser only local overrides to apply.
+ * config and never crosses the wire; `vars` arrives already merged with the
+ * application's overrides, leaving the browser only local overrides to apply.
  */
 export type AppshellComposition<TMetadata = Metadata> = {
     /** `scope/name` — makes the payload self-describing for fetch-on-miss and for `env diff`. */
-    environmentId: string;
+    applicationId: string;
     revision: number;
     /** The remote key the host mounts at the root, and the props it is given. */
     root: string;
     rootProps: Record<string, unknown>;
     index: AppshellIndex;
     remotes: Record<string, ResolvedRemote<TMetadata>>;
-    environment: Record<string, Record<string, string | number | undefined>>;
+    vars: Record<string, Record<string, string | number | undefined>>;
+    /**
+     * Present whenever a per-developer overlay changed anything about this render — a
+     * redirected remote, a different shell bundle, a substituted theme, or any combination.
+     * The shell is expected to surface it: a page that quietly runs code from somewhere
+     * else is the one thing this feature must never be, and swapping the shell or the theme
+     * out counts.
+     *
+     * `shellFlavor` is what was actually served, not what was asked for. `theme` is the ref
+     * the overlay substituted, present only when it substituted one.
+     */
+    overlay?: {
+        id: string;
+        remotes: string[];
+        /**
+         * Those of `remotes` the overlay introduced rather than redirected — components the
+         * application does not publish, running for this developer and nobody else.
+         *
+         * Separate from `remotes` because the two are not the same claim. A redirected
+         * component exists for everyone and this browser runs a different copy of it; an
+         * added one does not exist outside this overlay at all, so a feature built on top of
+         * one works here and is absent everywhere else.
+         */
+        added?: string[];
+        shellFlavor: 'prod' | 'dev';
+        theme?: string;
+    };
 };
 /**
  * Advanced configuration for modules that should be exposed by this container.
@@ -293,4 +447,3 @@ export interface ModuleFederationPluginOptions {
      */
     shared?: (string | SharedObject)[] | SharedObject;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/types/config/src/utils/blur.d.ts

@@ -1,3 +1,2 @@
 declare const _default: (token?: string, chars?: number) => string;
 export default _default;
-//# sourceMappingURL=blur.d.ts.map

package/dist/types/config/src/utils/compare.d.ts

@@ -5,4 +5,3 @@ export declare const compareDependencies: (sample: ComparisonTarget, baseline: C
 export declare const compareSharedDependencies: (packageSpec: PackageSpec, sharedModule: SharedModuleSpec) => ComparisonResults;
 export declare const compareSharedModules: (sampleSpec: SharedModuleSpec, baselineSpec: SharedModuleSpec) => ComparisonResults;
 export declare const printResults: (results: ComparisonResults) => void;
-//# sourceMappingURL=compare.d.ts.map

package/dist/types/config/src/utils/config.d.ts

@@ -1,6 +1,20 @@
 import yargs from 'yargs';
 import { CliConfig } from '../types';
+/**
+ * The addressing default: which namespace an unqualified name resolves to.
+ *
+ * Named `default-scope` and not `scope-id`, because the old name described identity —
+ * *the scope this account has* — and the value has never been that. The registry takes a
+ * caller's scope from the token and publishing takes it from the package name; this
+ * reaches neither. A `scope-id` deciding where names resolved while something else decided
+ * where writes landed is how the two came to disagree without anything saying so.
+ *
+ * Stated once because the cli and the webpack plugin both need the answer, and two
+ * precedence chains for one setting is how they drift apart.
+ */
+export declare const resolveDefaultScope: (config: {
+    defaultScope?: string;
+}, env?: NodeJS.ProcessEnv) => string | undefined;
 export declare const readConfig: (configPath: string) => CliConfig;
 export declare const writeConfig: (configPath: string, config: CliConfig) => void;
 export declare const mergeConfigWithArgs: (config: CliConfig, argv: yargs.ArgumentsCamelCase<unknown>) => void;
-//# sourceMappingURL=config.d.ts.map

package/dist/types/config/src/utils/copy.d.ts

@@ -8,4 +8,3 @@ declare const _default: (pattern: {
     to: string;
 }) => void;
 export default _default;
-//# sourceMappingURL=copy.d.ts.map

package/dist/types/config/src/utils/dump.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Serialises a value to YAML.
+ *
+ * The counterpart to `load`, and here rather than at each call site so the YAML library
+ * stays in one package. `appshell theme init` writes a file an author then edits, so the
+ * output is line-wrapped generously — a colour value broken across lines is technically
+ * valid and horrible to read.
+ */
+declare const dump: (value: unknown) => string;
+export default dump;

package/dist/types/config/src/utils/index.d.ts

@@ -1,10 +1,7 @@
 export { default as blur } from './blur';
 export { compareDependencies, compareDependency, compareSharedDependencies, compareSharedModules, extractDependencies, printResults, } from './compare';
-export { mergeConfigWithArgs, readConfig, writeConfig } from './config';
+export { mergeConfigWithArgs, readConfig, resolveDefaultScope, writeConfig } from './config';
 export { default as copy } from './copy';
-export { default as isValidUrl } from './isValidUrl';
+export { default as dump } from './dump';
 export { default as list } from './list';
 export { default as load, loadAll } from './load';
-export { default as loadJson } from './loadJson';
-export { default as merge } from './merge';
-//# sourceMappingURL=index.d.ts.map

package/dist/types/config/src/utils/list.d.ts

@@ -7,4 +7,3 @@
  */
 declare const list: (dirPath: string, depth?: number, target?: string | RegExp) => string[];
 export default list;
-//# sourceMappingURL=list.d.ts.map

package/dist/types/config/src/utils/load.d.ts

@@ -11,4 +11,3 @@ declare const load: <TSchema>(configPath: string) => TSchema;
  */
 export declare const loadAll: <TSchema>(...paths: string[]) => TSchema[];
 export default load;
-//# sourceMappingURL=load.d.ts.map

package/dist/types/config/src/validators/AppshellTemplateValidator.d.ts

@@ -1,4 +1,3 @@
 import { ConfigValidator } from '../types';
 declare const _default: ConfigValidator;
 export default _default;
-//# sourceMappingURL=AppshellTemplateValidator.d.ts.map

package/dist/types/config/src/validators/index.d.ts

@@ -1,4 +1 @@
-export { default as AppshellGlobalConfigValidator } from './AppshellGlobalConfigValidator';
-export { default as AppshellManifestValidator } from './AppshellManifestValidator';
 export { default as AppshellTemplateValidator } from './AppshellTemplateValidator';
-//# sourceMappingURL=index.d.ts.map

package/dist/types/loader/src/index.d.ts

@@ -3,4 +3,3 @@ export type { RemoteLoaderOptions } from './remoteLoader';
 export * from './resolvers';
 export * from './types';
 export default remoteLoader;
-//# sourceMappingURL=index.d.ts.map

package/dist/types/loader/src/loadAppshellComponent.d.ts

@@ -1,14 +1,13 @@
-import { ShareScope } from './types';
-declare global {
-    function __webpack_init_sharing__(id: string): Promise<void>;
-    const __webpack_share_scopes__: {
-        default: ShareScope;
-    };
-    interface Window {
-        [key: string]: unknown;
-        __webpack_share_scopes__: Record<string, ShareScope>;
-    }
-}
-declare const _default: <TComponent>(scope: string, module: string, shareScope?: string) => Promise<TComponent>;
-export default _default;
-//# sourceMappingURL=loadAppshellComponent.d.ts.map
+import type { RemoteLoader } from '@appshell/runtime';
+/**
+ * Dispatches on the loader's kind rather than assuming federation.
+ *
+ * There is one kind today. Naming it is what lets a second — single-spa, import maps —
+ * arrive without reinterpreting manifests already published, and what stops federation's
+ * vocabulary reading as though it were appshell's.
+ */
+export declare const load: <TComponent>(remote: {
+    loader: RemoteLoader;
+    remoteEntryUrl: string;
+}) => Promise<TComponent>;
+export default load;

package/dist/types/loader/src/remoteLoader.d.ts

@@ -1,4 +1,4 @@
-import type { AppshellComposition, AppshellGlobalConfig } from '@appshell/config';
+import type { AppshellComposition } from '@appshell/config';
 import { type RemoteResolver } from './resolvers';
 declare global {
     interface Window {
@@ -10,6 +10,5 @@ export type RemoteLoaderOptions = {
     /** Replaces the resolver chain outright; a seam for tests and embedders. */
     resolver?: RemoteResolver;
 };
-declare const _default: (config: AppshellGlobalConfig, options?: RemoteLoaderOptions) => <TComponent>(key: string) => Promise<readonly [null, null] | readonly [Awaited<TComponent>, import("@appshell/config").AppshellManifest]>;
+declare const _default: (options?: RemoteLoaderOptions) => <TComponent>(key: string) => Promise<readonly [Awaited<TComponent>, import("@appshell/config").ResolvedRemote]>;
 export default _default;
-//# sourceMappingURL=remoteLoader.d.ts.map

package/dist/types/loader/src/resolvers.d.ts

@@ -1,20 +1,12 @@
-import type { AppshellComposition, AppshellGlobalConfig, AppshellManifest, ResolvedRemote } from '@appshell/config';
+import type { AppshellComposition, ResolvedRemote } from '@appshell/config';
 export type RemoteResolution = {
     remote: ResolvedRemote;
-    /** Already merged with the environment's overrides — nothing left for the browser to layer on. */
-    environment: Record<string, string | number | undefined>;
-    /** Back-compat payload for `ManifestProvider`; synthesized when the source was a composition. */
-    manifest: AppshellManifest;
+    /** Already merged with the application's overrides — nothing left for the browser to layer on. */
+    vars: Record<string, string | number | undefined>;
 };
 export type RemoteResolver = (key: string) => Promise<RemoteResolution | undefined>;
 /** The registry inlined the composition into the page, so no network call is needed. */
 export declare const inlineResolver: (composition?: AppshellComposition) => RemoteResolver;
-/** Fetch-on-miss: covers an app activated after this page was served. */
+/** Fetch-on-miss: covers a package activated after this page was served. */
 export declare const registryResolver: (composition?: AppshellComposition, origin?: string) => RemoteResolver;
-/**
- * Pre-registry hosts: follow `index[key]` to the app's own manifest. The override
- * merge stays here because in this mode no server has done it.
- */
-export declare const legacyManifestResolver: (config: AppshellGlobalConfig) => RemoteResolver;
 export declare const chainResolvers: (...resolvers: RemoteResolver[]) => RemoteResolver;
-//# sourceMappingURL=resolvers.d.ts.map

package/dist/types/loader/src/types.d.ts

@@ -8,4 +8,3 @@ export interface ModuleContainer<TComponent> {
     init(shareScope: ShareScope<TComponent>): Promise<void>;
     get(module: string): Promise<() => Record<string, TComponent>>;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/types/react/src/components/LoadingError.d.ts

@@ -5,4 +5,3 @@ type ErrorProps = {
 };
 declare const LoadingError: FC<ErrorProps>;
 export default LoadingError;
-//# sourceMappingURL=LoadingError.d.ts.map

package/dist/types/react/src/components/RemoteSlot.d.ts

@@ -0,0 +1,28 @@
+import { ReactElement, ReactNode } from 'react';
+export type ExtendedProps = Record<string, unknown>;
+export type RemoteSlotProps<TProps extends ExtendedProps = ExtendedProps> = {
+    remote: string;
+    fallback?: ReactNode;
+} & TProps;
+/**
+ * Loads a remote once and leaves it alone.
+ *
+ * Keeping a remote current while it is being developed is not this component's job.
+ * A remote served by a dev server ships webpack's HMR runtime and a dev-server client
+ * inside its own `remoteEntry`, so it applies its own edits in place and React Fast
+ * Refresh swaps the component implementations underneath this tree — no reload, and no
+ * remount that would discard state this component never owned.
+ *
+ * Watching the remote's socket from here and reloading the page was strictly worse: it
+ * raced the remote's own update, and it threw away the entire composed app to deliver a
+ * change to one subtree. When webpack genuinely cannot apply an update, the remote's own
+ * client still falls back to a full reload — which is the right place for that decision,
+ * because it is the only side that knows whether the update applied.
+ */
+declare const RemoteSlot: {
+    <TProps extends ExtendedProps>({ remote, fallback, ...rest }: RemoteSlotProps<TProps>): ReactElement<TProps>;
+    defaultProps: {
+        fallback: undefined;
+    };
+};
+export default RemoteSlot;

package/dist/types/react/src/contexts/RemoteContext.d.ts

@@ -1,12 +1,10 @@
 import { AppshellRemote } from '@appshell/config';
 import type { FC, ReactNode } from 'react';
-import React from 'react';
 interface RemoteProviderProps {
     remote?: AppshellRemote;
     children: ReactNode;
 }
-export declare const RemoteContext: React.Context<AppshellRemote | undefined>;
+export declare const RemoteContext: import("react").Context<AppshellRemote | undefined>;
 export declare const RemoteProvider: FC<RemoteProviderProps>;
-export declare const RemoteConsumer: React.Consumer<AppshellRemote | undefined>;
+export declare const RemoteConsumer: import("react").Consumer<AppshellRemote | undefined>;
 export default RemoteContext;
-//# sourceMappingURL=RemoteContext.d.ts.map

package/dist/types/react/src/hooks/useRemote.d.ts

@@ -1,5 +1,4 @@
 import { AppshellRemote } from '@appshell/config';
-/** The remote backing the nearest `AppshellComponent` — it already knows its own key. */
+/** The remote backing the nearest `RemoteSlot` — it already knows its own key. */
 declare const _default: () => AppshellRemote | undefined;
 export default _default;
-//# sourceMappingURL=useRemote.d.ts.map