@colixsystems/widget-sdk 0.188.0 → 0.189.0

package/src/dev-shims.js

@@ -19,6 +19,8 @@
 // runtime-enumerates the host's namespace). Imports of these packages from a
 // sibling .jsx file return `422` from the dev server with a clear message.
 
+import { CONTRACT } from "./contract.js";
+
 // React named exports the Studio re-exposes through the shim. Mirrors the
 // browser's `react` named-export surface. Adding a new hook in a React minor
 // release means appending it here.
@@ -61,81 +63,16 @@ export const REACT_NAMED_EXPORTS = [
 // React's automatic JSX runtime: jsx / jsxs / Fragment, plus the dev variant.
 export const REACT_JSX_RUNTIME_EXPORTS = ["jsx", "jsxs", "Fragment", "jsxDEV"];
 
-// REQ-WSDK-PLATFORM bundle (sc-1064): the canonical list of bare specifiers the
-// runtime web host RESOLVES for a loaded widget — i.e. the ones the Studio's
-// `widgetLoader.buildShims()` re-exports from `globalThis.__appstudioWidgetHost__`
-// rather than letting a bundle inline a second copy. The web-entry bundler
-// (`webbundle.bundleWebEntry`, used by both the publish packer and the dev
-// server) marks EXACTLY these `external`, so everything else the entry imports
-// (`react-leaflet`, `leaflet`, CSS, PNG assets, …) gets inlined.
-//
-// This is the SINGLE source of truth (CLAUDE.md §3). It MUST stay in lockstep
-// with the frontend's `widgetLoader._hostVettedModules()` + the core React/SDK
-// shims it builds. Two backstops enforce the equality: (1) this list's
-// contents are pinned by the SDK-side importable test
-// (`packages/widget-sdk/src/__tests__/host-externals.test.js`), and (2) the
-// loader's own module-load guard in `frontend/src/services/widgetLoader.js`
-// throws at import time if `hostShimmedSpecifiers()` drifts from
-// `hostExternalSpecifiers()` — the loader's shimmed set can't be asserted from
-// a Node test (it imports `react-dom` etc.), so that equality is enforced by
-// the load-time guard rather than a separate frontend test.
-//
-// Why each entry is host-resolved (NOT bundled):
-//   * `react`, `react/jsx-runtime`, `react/jsx-dev-runtime` — the widget MUST
-//     share the host's ONE React instance (hooks + context); a bundled second
-//     React breaks both.
-//   * `react-dom`, `react-dom/client` — `react-leaflet`'s Popup/Pane render
-//     through `createPortal` from `react-dom`. A bundled second react-dom
-//     paired with the host's external React is a mismatched renderer and
-//     crashes. The Studio is a React-DOM app, so it shims its own react-dom.
-//     On React 19 the two specifiers expose DIFFERENT surfaces — createPortal /
-//     flushSync / version live on `react-dom`, createRoot / hydrateRoot on
-//     `react-dom/client` — so the loader stashes + shims each from its own real
-//     host namespace (sc-1064).
-//   * `@colixsystems/widget-sdk` — the widget must route hooks through the SAME
-//     SDK instance the host built (datastore/theme/navigation live there).
-//   * `lucide-react-native`, `react-native-svg`, `date-fns`,
-//     `react-native-qrcode-svg` — vetted packages the host already bundles +
-//     shims (`_hostVettedModules`); sharing the host copy keeps icons/SVG on
-//     the host's react-native-web instance. qrcode-svg draws through
-//     react-native-svg, so externalising it keeps the QR on that same
-//     instance instead of a bundle inlining a second one (sc-6105).
-const HOST_EXTERNAL_SPECIFIERS = [
-  "react",
-  "react/jsx-runtime",
-  "react/jsx-dev-runtime",
-  "react-dom",
-  "react-dom/client",
-  "@colixsystems/widget-sdk",
-  "lucide-react-native",
-  "react-native-svg",
-  "date-fns",
-  "react-native-qrcode-svg",
-  // sc-1265: a bundled widget (and any vetted RN package it inlines, e.g.
-  // react-native-gesture-handler) imports `react-native`; the host resolves it
-  // to its OWN single react-native-web instance through a blob shim, so the
-  // bundle shares one RN-web (StyleSheet/context) instead of inlining a second
-  // copy. On native, Metro resolves the real react-native in the export.
-  "react-native",
-  // sc-7191: the vetted pure-JS maths set. Externalised for the same reason as
-  // date-fns — an AI-agent widget is transpiled, never bundled, so the host
-  // must resolve the bare import at runtime.
-  "decimal.js",
-  "d3-scale",
-  "d3-shape",
-  "d3-array",
-  "simple-statistics",
-];
-
 /**
  * The canonical "host-resolved at runtime" bare-specifier set — the externals
- * the web-entry bundler must NOT inline. Returns a fresh array each call so a
- * caller can't mutate the source of truth.
+ * the web-entry bundler must NOT inline. Sourced from
+ * `CONTRACT.hostExternalSpecifiers`, which documents each entry. Returns a
+ * fresh array each call so a caller can't mutate the source of truth.
  *
  * @returns {string[]}
  */
 export function hostExternalSpecifiers() {
-  return [...HOST_EXTERNAL_SPECIFIERS];
+  return [...CONTRACT.hostExternalSpecifiers];
 }
 
 function reactShimSrc() {