@ic-reactor/mcp 0.0.0-stage → 0.0.0

package/scripts/release.test.mjs

@@ -0,0 +1,347 @@
+/**
+ * Tests of the release script (#969): it makes the release commit and stops.
+ * It never tags, pushes or publishes, and writes no root `llms.txt`. It
+ * refuses the `--dry-run` and `--publish` it used to take before it changes
+ * anything, and it ends by printing the release pull request's steps.
+ *
+ * Each run is of a copy of the script and the scripts it loads, in a
+ * repository of its own whose packages, AI-context files and example are
+ * stand-ins, marked private. First on the PATH are a `pnpm` that records its
+ * arguments and makes the change the real command would make to a file the
+ * release commits (`version:sync` rewrites `packages/core/src/version.ts`,
+ * `install` the lockfile), and an `npm` that only records them. So a run never
+ * touches this repository or reaches npm.
+ *
+ * Run by `pnpm test:scripts`; it needs `git` and `sh` on the PATH.
+ */
+import assert from "node:assert/strict"
+import { execFileSync, spawnSync } from "node:child_process"
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs"
+import { tmpdir } from "node:os"
+import { delimiter, dirname, join } from "node:path"
+import { after, describe, it } from "node:test"
+import { fileURLToPath } from "node:url"
+import { releasePrSteps } from "./lib/release-pr-steps.mjs"
+import { LANE_PACKAGES } from "./release-tag.mjs"
+
+const scriptsDir = dirname(fileURLToPath(import.meta.url))
+const repoRoot = join(scriptsDir, "..")
+
+/** The script and every module it loads or runs, under `scripts/`. */
+const SCRIPTS = [
+  "release.js",
+  "ai-context-files.js",
+  "sync-ai-context-versions.js",
+  "sync-example-versions.js",
+  "lib/release-pr-steps.mjs",
+  "release-tag.mjs",
+]
+
+const PREVIOUS = "4.0.0-beta.6"
+const NEXT = "4.0.0-beta.7"
+
+// A GIT_DIR or GIT_INDEX_FILE inherited from a git hook would point the
+// script's `git add` and `git commit` at this repository.
+const env = Object.fromEntries(
+  Object.entries(process.env).filter(([name]) => !name.startsWith("GIT_"))
+)
+
+const temps = []
+function temp(prefix) {
+  const dir = mkdtempSync(join(tmpdir(), prefix))
+  temps.push(dir)
+  return dir
+}
+after(() => {
+  for (const dir of temps) rmSync(dir, { recursive: true, force: true })
+})
+
+const json = (value) => JSON.stringify(value, null, 2) + "\n"
+
+/**
+ * `git init` on `main` in `root`, with a committer, no signing and no hooks, and
+ * a runner of git there.
+ */
+function gitRepository(root) {
+  const git = (...args) =>
+    execFileSync("git", args, { cwd: root, env, encoding: "utf8" }).trim()
+  git("init", "-q", "-b", "main")
+  git("config", "user.name", "Release Test")
+  git("config", "user.email", "release-test@example.invalid")
+  git("config", "commit.gpgsign", "false")
+  git("config", "tag.gpgsign", "false")
+  git("config", "core.hooksPath", temp("release-hooks-"))
+  return git
+}
+
+/** A committed repository on `main` at {@link PREVIOUS}, and recording package managers. */
+function repository() {
+  const root = temp("release-repo-")
+  const write = (path, text) => {
+    mkdirSync(dirname(join(root, path)), { recursive: true })
+    writeFileSync(join(root, path), text)
+  }
+  for (const script of SCRIPTS) {
+    mkdirSync(dirname(join(root, "scripts", script)), { recursive: true })
+    copyFileSync(join(scriptsDir, script), join(root, "scripts", script))
+  }
+  write(
+    "package.json",
+    json({
+      name: "ic-reactor",
+      private: true,
+      type: "module",
+      version: PREVIOUS,
+    })
+  )
+  for (const pkg of LANE_PACKAGES) {
+    write(
+      `packages/${pkg}/package.json`,
+      json({ name: `@ic-reactor/${pkg}`, private: true, version: PREVIOUS })
+    )
+  }
+  write(
+    "packages/core/src/version.ts",
+    `export const VERSION = "${PREVIOUS}"\n`
+  )
+  write("packages/core/llms.txt", `Applies to @ic-reactor/core ${PREVIOUS}\n`)
+  write("AGENTS.md", `| \`@ic-reactor/core\` | \`${PREVIOUS}\` |\n`)
+  write("CLAUDE.md", `- \`@ic-reactor/react\` (\`${PREVIOUS}\`)\n`)
+  write("pnpm-lock.yaml", "lockfileVersion: '9.0'\n")
+  write(
+    "examples/app/package.json",
+    json({ name: "app", dependencies: { "@ic-reactor/react": `^${PREVIOUS}` } })
+  )
+
+  const bin = temp("release-bin-")
+  const stub = (name, body = "") => {
+    writeFileSync(
+      join(bin, name),
+      `#!/bin/sh\necho "$*" >> "${join(bin, `${name}.log`)}"\n${body}`
+    )
+    chmodSync(join(bin, name), 0o755)
+  }
+  // Run in the repository root, as release.js runs it.
+  stub(
+    "pnpm",
+    `case "$*" in
+  *version:sync)
+    version=$(node -p 'require("./packages/core/package.json").version')
+    printf 'export const VERSION = "%s"\\n' "$version" > packages/core/src/version.ts ;;
+  install*) echo "# installed" >> pnpm-lock.yaml ;;
+esac
+`
+  )
+  stub("npm")
+  const calls = (name) => {
+    const log = join(bin, `${name}.log`)
+    return existsSync(log) ? readFileSync(log, "utf8").trim().split("\n") : []
+  }
+
+  const git = gitRepository(root)
+  git("add", "-A")
+  git("commit", "-q", "-m", "base")
+  // Untracked, so it must stay out of the release commit.
+  write("examples/app/notes.txt", "scratch\n")
+
+  const release = (...args) =>
+    spawnSync(
+      process.execPath,
+      [join(root, "scripts", "release.js"), ...args],
+      {
+        cwd: root,
+        encoding: "utf8",
+        env: {
+          ...env,
+          PATH: [bin, dirname(process.execPath), env.PATH].join(delimiter),
+        },
+      }
+    )
+  return { root, git, release, calls }
+}
+
+describe("release.js", () => {
+  // A stable 4.x version too: it publishes under `latest` from main.
+  for (const version of [NEXT, "4.0.0"]) {
+    it(`commits the release of ${version}, tags nothing, publishes nothing and prints the release-PR steps`, () => {
+      const { root, git, release, calls } = repository()
+      const run = release(version)
+      const output = run.stdout + run.stderr
+
+      assert.equal(run.status, 0, output)
+      // The llms.txt step it dropped failed on every run, as main has no root one.
+      assert.deepEqual(
+        output.split("\n").filter((line) => line.includes("❌")),
+        []
+      )
+      assert.equal(existsSync(join(root, "llms.txt")), false)
+
+      assert.deepEqual(git("log", "--format=%s").split("\n"), [
+        `chore: release v${version}`,
+        "base",
+      ])
+      assert.deepEqual(
+        git("diff", "--name-only", "HEAD~1", "HEAD").split("\n").sort(),
+        [
+          "AGENTS.md",
+          "CLAUDE.md",
+          "examples/app/package.json",
+          "package.json",
+          "packages/core/llms.txt",
+          "packages/core/package.json",
+          "packages/core/src/version.ts",
+          "packages/mcp/package.json",
+          "packages/react/package.json",
+          "packages/vite-plugin/package.json",
+          "pnpm-lock.yaml",
+        ]
+      )
+      assert.equal(git("status", "--porcelain"), "?? examples/app/notes.txt")
+      assert.equal(git("tag", "--list"), "")
+      assert.deepEqual(calls("pnpm"), [
+        "--filter @ic-reactor/core version:sync",
+        "install --no-frozen-lockfile",
+      ])
+      assert.deepEqual(calls("npm"), [])
+
+      assert.ok(
+        run.stdout.endsWith(`${releasePrSteps(version)}\n`),
+        `expected the release-PR steps at the end:\n${run.stdout}`
+      )
+    })
+  }
+
+  for (const flag of ["--dry-run", "--publish"]) {
+    it(`refuses ${flag} before it changes anything`, () => {
+      const { git, release, calls } = repository()
+      const run = release(NEXT, flag)
+
+      assert.equal(run.status, 1, run.stdout + run.stderr)
+      assert.match(
+        run.stderr,
+        new RegExp(`^Refusing ${flag}: release\\.js takes only a version\\.`)
+      )
+      assert.equal(git("log", "--format=%s"), "base")
+      assert.equal(git("status", "--porcelain"), "?? examples/app/notes.txt")
+      assert.equal(git("tag", "--list"), "")
+      assert.deepEqual(calls("pnpm"), [])
+      assert.deepEqual(calls("npm"), [])
+    })
+  }
+})
+
+describe("releasePrSteps", () => {
+  const steps = releasePrSteps(NEXT)
+  const lines = steps.split("\n").map((line) => line.trim())
+  const at = (command) => {
+    const index = lines.indexOf(command)
+    assert.notEqual(index, -1, `missing \`${command}\` in:\n${steps}`)
+    return index
+  }
+
+  const lookup = lines.find((line) => line.startsWith("git log origin/main "))
+
+  it("pushes the release branch, and tags the merge commit after the merge", () => {
+    const push = at(`git push origin HEAD:refs/heads/release/v${NEXT}`)
+    const fetch = at("git fetch origin main")
+    const find = at(lookup)
+    const tag = at(`git tag -a v${NEXT} -m "ic-reactor ${NEXT}" <merge-commit>`)
+    const pushTag = at(`git push origin v${NEXT}`)
+    assert.ok(
+      push < fetch && fetch < find && find < tag && tag < pushTag,
+      steps
+    )
+  })
+
+  it("finds the release pull request's merge commit, not main's head", () => {
+    const root = temp("release-merges-")
+    const git = gitRepository(root)
+    const commit = (file) => {
+      writeFileSync(join(root, file), `${file}\n`)
+      git("add", file)
+      git("commit", "-q", "-m", file)
+    }
+    // Merge `branch` into main with the message GitHub gives a pull request.
+    const merge = (number, branch) => {
+      git("switch", "-q", "-c", branch)
+      commit(branch.replaceAll("/", "-"))
+      git("switch", "-q", "main")
+      git(
+        "merge",
+        "-q",
+        "--no-ff",
+        "-m",
+        `Merge pull request #${number} from B3Pay/${branch}`,
+        branch
+      )
+      return git("rev-parse", "HEAD")
+    }
+    commit("base")
+    const released = merge(1, `release/v${NEXT}`)
+    // Merged after it: a release whose version starts with this one's, and a
+    // branch whose name differs only where this one has a dot.
+    merge(2, `release/v${NEXT}0`)
+    merge(3, `release/v${NEXT.replace(/\.(?=[^.]*$)/, "x")}`)
+    git("update-ref", "refs/remotes/origin/main", "main")
+
+    const found = execFileSync("sh", ["-c", lookup], {
+      cwd: root,
+      env,
+      encoding: "utf8",
+    })
+    assert.equal(
+      found.trim(),
+      `${released} Merge pull request #1 from B3Pay/release/v${NEXT}`
+    )
+  })
+
+  it("pushes one ref at a time, and never main itself or every tag", () => {
+    const pushes = lines.filter((line) => line.startsWith("git push"))
+    assert.deepEqual(pushes, [
+      `git push origin HEAD:refs/heads/release/v${NEXT}`,
+      `git push origin v${NEXT}`,
+    ])
+    assert.doesNotMatch(steps, /--tags|--publish|--dry-run|npm publish/)
+  })
+
+  it("opens the pull request against main", () => {
+    at(
+      `https://github.com/B3Pay/ic-reactor/compare/main...release/v${NEXT}?expand=1`
+    )
+  })
+
+  it("names the dist-tag release.yml publishes the version under", () => {
+    assert.ok(steps.includes("under the beta dist-tag."), steps)
+    assert.ok(
+      releasePrSteps("4.0.0").includes("under the latest dist-tag."),
+      releasePrSteps("4.0.0")
+    )
+  })
+
+  it("names the CHANGELOG section the way the released ones are named", () => {
+    // A released section names the packages it released, then the version:
+    // "## core, react, vite-plugin 4.1.1". The lane only grows, so the newest
+    // released section names a start of the lane, and the next one names it
+    // all.
+    const changelog = readFileSync(join(repoRoot, "CHANGELOG.md"), "utf8")
+    const [, names] =
+      changelog.match(/^## ((?:[a-z-]+, )*[a-z-]+) 4\.\S+$/m) ?? []
+    assert.ok(names, "CHANGELOG.md has no released 4.x section")
+    const released = names.split(", ")
+    assert.deepEqual(released, LANE_PACKAGES.slice(0, released.length))
+    const expected = `## ${LANE_PACKAGES.join(", ")} ${NEXT}`
+    assert.ok(
+      steps.includes(`"${expected}"`),
+      `expected "${expected}" in:\n${steps}`
+    )
+  })
+})

package/scripts/removed-v3-names.js

@@ -0,0 +1,125 @@
+/**
+ * The 34 names ic-reactor 3 exported that 4.0 removes, each with what to use
+ * instead. It is the "Removed in 4.0" table of the migration page (DX2, #789)
+ * as data, so `check-ai-context.js` can keep the 4.x guides from teaching a
+ * name that no longer exists.
+ *
+ * The names are those imported from `@ic-reactor/core` and `@ic-reactor/react`
+ * by the hand-written files of the 3.x examples: the v1 to v3 memory an agent
+ * or a person brings to the package. (`@ic-reactor/candid` stays at 3.x, and
+ * `icReactor` of the Vite plugin is kept, so neither is listed.)
+ *
+ * A name is stale in a guide wherever it appears outside a section headed
+ * "Removed in 4.0". Two names need care in how they are found, and say so:
+ *
+ * - `Reactor` is a name in code and also the name of the product, "IC Reactor".
+ *   The product name is not a mention.
+ * - `skipToken` is a name that survives, from `@tanstack/react-query`: it is
+ *   removed from `@ic-reactor/react`, so only importing it from there (or a
+ *   sentence naming both) is stale.
+ *
+ * @type {{ name: string, use: string, fromTanStack?: boolean }[]}
+ */
+export const REMOVED_V3_NAMES = [
+  { name: "ClientManager", use: "createClient({ network, identity | auth })" },
+  {
+    name: "formatTokenAmount",
+    use: "formatUnits(value, decimals, { maxFractionDigits })",
+  },
+  {
+    name: "AuthenticationManager",
+    use: "auth: (network) => new AuthClient(network) from @icp-sdk/auth 10",
+  },
+  { name: "createAuthHooks", use: "useAuth()" },
+  {
+    name: "createMutation",
+    use: "useMutation(client.mutationOptions(canister, method))",
+  },
+  {
+    name: "createQuery",
+    use: "useQuery(client.queryOptions(canister, method, arg))",
+  },
+  {
+    name: "createActorHooks",
+    use: "useClient().canister<Actor>(actor, { id }) and TanStack hooks",
+  },
+  {
+    name: "createSuspenseQuery",
+    use: "useSuspenseQuery over client.queryOptions(...) (docs: Reads, Suspense)",
+  },
+  {
+    name: "DisplayReactor",
+    use: "@meantjs/schema values, and formatUnits/parseUnits",
+  },
+  { name: "Reactor", use: "client.canister<Actor>(actor, { id })" },
+  {
+    name: "createReactorProvider",
+    use: "<ReactorProvider client={() => createClient(...)}>",
+  },
+  { name: "parseTokenAmount", use: "parseUnits(text, decimals)" },
+  { name: "defineReactor", use: "createClient and client.canister" },
+  { name: "isPrincipalText", use: "isPrincipal from @meantjs/schema" },
+  {
+    name: "generateKey",
+    use: "client.queryKey(canister, method?, arg?)",
+  },
+  { name: "createQueryFactory", use: "client.queryOptions" },
+  {
+    name: "CanisterError",
+    use: "isReactorError(e) && e.kind === 'canister_err' (ReactorError is a type, not a class)",
+  },
+  {
+    name: "createSuspenseQueryFactory",
+    use: "useSuspenseQuery over client.queryOptions(...) (docs: Reads, Suspense)",
+  },
+  {
+    name: "isCanisterError",
+    use: "isReactorError(e) && e.kind === 'canister_err'",
+  },
+  {
+    name: "createInfiniteQuery",
+    use: "useInfiniteQuery with a key extending client.queryKey and direct calls (docs: Reads, Infinite queries)",
+  },
+  { name: "DisplayOf", use: "nothing: there is one value shape" },
+  { name: "ReactorArgs", use: "Parameters<Actor['method']>" },
+  {
+    name: "identityAttributeKeys",
+    use: "scopedKeys({ openIdProvider, keys }) from @icp-sdk/auth/client",
+  },
+  {
+    name: "IdentityAttributeOpenIdProvider",
+    use: "OpenIdProvider from @icp-sdk/auth/client",
+  },
+  {
+    name: "IdentityAttributesManager",
+    use: "authClient.requestAttributes({ keys, nonce }), then decode data (docs: Auth, Identity attributes)",
+  },
+  {
+    name: "createIdentityAttributeHooks",
+    use: "authClient.requestAttributes({ keys, nonce }), then decode data (docs: Auth, Identity attributes)",
+  },
+  {
+    name: "skipToken",
+    use: "skipToken from @tanstack/react-query",
+    fromTanStack: true,
+  },
+  { name: "reactorRetry", use: "built into client.queryOptions" },
+  { name: "ReactorArgsOf", use: "Parameters<Actor[M]>" },
+  {
+    name: "defineDisplayReactor",
+    use: "createClient and client.canister",
+  },
+  {
+    name: "createSuspenseInfiniteQueryFactory",
+    use: "useSuspenseInfiniteQuery with a key extending client.queryKey (docs: Reads, Infinite queries)",
+  },
+  {
+    name: "isCallError",
+    use: "isReactorError(e) && e.kind !== 'canister_err'",
+  },
+  { name: "ReactorErrorOf", use: "ReactorError<E>" },
+  {
+    name: "jsonToString",
+    use: "JSON.stringify (principals are text; a bigint needs a replacer)",
+  },
+]

package/scripts/size-app/.size-limit.js

@@ -0,0 +1,90 @@
+// What an app pays for ic-reactor, gzipped, with the peers included.
+//
+// The checks in packages/core and packages/react measure each package's own
+// code only: size-limit adds every `peerDependencies` entry of the package it
+// runs in to each check's `ignore`, and an `ignore: []` does not stop it. So a
+// change in what core pulls from its peers (`@icp-sdk/core`,
+// `@meantjs/schema`, `@noble/curves`, `@tanstack/query-core`) is invisible
+// there. This private workspace package declares no peers, so nothing is left
+// out here but what a check names in `ignore`. Core resolves its peers from its
+// own devDependencies, the versions the lockfile pins.
+//
+// Both limits are tight on purpose, as core's and react's are. A pull request
+// that moves either number states the delta and raises the limit deliberately,
+// including a dependency bump that changes a peer's size. `pnpm size` runs these
+// with the packages' own checks; run `pnpm build` first.
+export default [
+  {
+    // Measured 90,169 B with the builders refusing another copy's skipToken
+    // (#873; 89,949 B before that, +220 B; 89,746 B before client.resendOf()
+    // was held to the bytes and the canister ids a write went out with;
+    // 89,484 B before resendOf; 89,363 B on 4.0.0-beta.3): the limit leaves
+    // 31 B.
+    name: "App: { createClient } from @ic-reactor/core, peers included",
+    path: "core.js",
+    // With client.time() (#885) on top of v4: measured 90,472 B, so the limit moved from 90,200 B to 90.53 kB.
+    // With expiresAt (#888) on top of v4: measured 90,619 B, so the limit moved from 90,530 B to 90.67 kB.
+    // With client.encode() (#887) on top of v4: measured 90,767 B, so the limit moved from 90,670 B to 90.82 kB.
+    // With client.canisterId() (#890) on top of v4: measured 90,795 B, so the limit moved from 90,820 B to 90.85 kB.
+    // With maxElements (#932) on top of v4: measured 90,897 B, so the limit moved from 90,850 B to 90.95 kB.
+    // With timeoutMs (#875) on top of v4: measured 91,291 B, so the limit moved from 90,950 B to 91.34 kB.
+    // With strict createClient options (#938) on top of v4: measured 91,519 B, so the limit moved from 91,340 B to 91.57 kB.
+    // With TanStack retries kept for app queries (#937) on top of v4: measured 91,589 B, so the limit moved from 91,570 B to 91.64 kB.
+    // With a held-back write sent as its caller (#936) on top of v4: measured 92,096 B, so the limit moved from 91,640 B to 92.15 kB.
+    // With a view per useClient() caller (#935) on top of v4: measured 92,248 B, so the limit moved from 92,150 B to 92.3 kB.
+    // With #939 on top of v4: measured 92,590 B, so the limit moved from 92,300 B to 92.64 kB.
+    // With #940 on top of v4: measured 92,761 B, so the limit moved from 92,640 B to 92.82 kB.
+    // With #941 on top of v4: measured 92,915 B, so the limit moved from 92,820 B to 92.97 kB.
+    // With #942 on top of v4: measured 93,050 B, so the limit moved from 92,970 B to 93.1 kB.
+    // With #960 on top of v4: measured 93,213 B, so the limit moved from 93,100 B to 93.27 kB.
+    // With #963 on top of v4: measured 93,409 B, so the limit moved from 93,270 B to 93.47 kB.
+    // With #961 on top of v4: measured 93,426 B, so the limit moved from 93,470 B to 93.49 kB.
+    // With #962 on top of v4: measured 93,497 B, so the limit moved from 93,490 B to 93.57 kB.
+    // With #975 on top of v4: measured 93,542 B, so the limit moved from 93,570 B to 93.62 kB.
+    // With #973 on top of v4: measured 93,657 B, so the limit moved from 93,620 B to 93.74 kB.
+    // With #974 on top of v4: measured 93,757 B, so the limit moved from 93,740 B to 93.84 kB.
+    // With #976 on top of v4: measured 93,775 B, so the limit moved from 93,840 B to 93.86 kB.
+    // With #949 on top of v4: measured 93,777 B, so the limit moved from 93,860 B to 93.87 kB.
+    // With #913 on top of v4: measured 93,924 B, so the limit moved from 93,870 B to 94.07 kB.
+    limit: "94.07 kB",
+    gzip: true,
+  },
+  {
+    // Measured 91,453 B with the builders and the provider checking for two
+    // copies of @tanstack/query-core (#873; 91,155 B before that, +298 B;
+    // 90,960 B before client.resendOf() was held to the bytes and the
+    // canister ids a write went out with; 90,692 B before resendOf; 90,566 B
+    // on 4.0.0-beta.3): the limit leaves 47 B. React itself is left out: the
+    // app ships it with or without ic-reactor.
+    name: "App: createClient, ReactorProvider and useClient, peers included, React left out",
+    path: "react.js",
+    // With client.time() (#885) on top of v4: measured 91,763 B, so the limit moved from 91,500 B to 91.82 kB.
+    // With expiresAt (#888) on top of v4: measured 91,916 B, so the limit moved from 91,820 B to 91.97 kB.
+    // With client.encode() (#887) on top of v4: measured 92,053 B, so the limit moved from 91,970 B to 92.11 kB.
+    // With client.canisterId() (#890) on top of v4: measured 92,083 B, so the limit moved from 92,110 B to 92.14 kB.
+    // With maxElements (#932) on top of v4: measured 92,162 B, so the limit moved from 92,140 B to 92.22 kB.
+    // With timeoutMs (#875) on top of v4: measured 92,561 B, so the limit moved from 92,220 B to 92.61 kB.
+    // With strict createClient options (#938) on top of v4: measured 92,830 B, so the limit moved from 92,610 B to 92.88 kB.
+    // With TanStack retries kept for app queries (#937) on top of v4: measured 92,899 B, so the limit moved from 92,880 B to 92.95 kB.
+    // With a held-back write sent as its caller (#936) on top of v4: measured 93,393 B, so the limit moved from 92,950 B to 93.45 kB.
+    // With a view per useClient() caller (#935) on top of v4: measured 93,575 B, so the limit moved from 93,450 B to 93.63 kB.
+    // With #939 on top of v4: measured 93,873 B, so the limit moved from 93,630 B to 93.93 kB.
+    // With #940 on top of v4: measured 94,043 B, so the limit moved from 93,930 B to 94.1 kB.
+    // With #941 on top of v4: measured 94,202 B, so the limit moved from 94,100 B to 94.26 kB.
+    // With #942 on top of v4: measured 94,335 B, so the limit moved from 94,260 B to 94.39 kB.
+    // With #960 on top of v4: measured 94,506 B, so the limit moved from 94,390 B to 94.56 kB.
+    // With #963 on top of v4: measured 94,712 B, so the limit moved from 94,560 B to 94.77 kB.
+    // With #961 on top of v4: measured 94,733 B, so the limit moved from 94,770 B to 94.79 kB.
+    // With #962 on top of v4: measured 94,818 B, so the limit moved from 94,790 B to 94.88 kB.
+    // With #975 on top of v4: measured 94,847 B, so the limit moved from 94,880 B to 94.91 kB.
+    // With #972 on top of v4: measured 94,849 B, so the limit moved from 94,910 B to 94.92 kB.
+    // With #973 on top of v4: measured 94,952 B, so the limit moved from 94,920 B to 95.03 kB.
+    // With #974 on top of v4: measured 95,069 B, so the limit moved from 95,030 B to 95.15 kB.
+    // With #976 on top of v4: measured 95,091 B, so the limit moved from 95,150 B to 95.18 kB.
+    // With #949 on top of v4: measured 95,092 B, so the limit moved from 95,180 B to 95.19 kB.
+    // With #913 on top of v4: measured 95,239 B, so the limit moved from 95,190 B to 95.38 kB.
+    limit: "95.38 kB",
+    gzip: true,
+    ignore: ["react", "react/jsx-runtime"],
+  },
+]

package/scripts/size-app/core.js

@@ -0,0 +1,3 @@
+// The import of an app that uses core alone. `.size-limit.js` measures it with
+// everything it pulls in, peers included.
+export { createClient } from "@ic-reactor/core"

package/scripts/size-app/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "size-app",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "description": "What an app pays for @ic-reactor/core and @ic-reactor/react with their peers included. Declares no peerDependencies on purpose: size-limit adds the peers of the package it runs in to every check's ignore.",
+  "scripts": {
+    "size": "size-limit"
+  },
+  "dependencies": {
+    "@meantjs/schema": "0.6.0",
+    "@ic-reactor/core": "workspace:*",
+    "@ic-reactor/react": "workspace:*",
+    "@icp-sdk/core": "^6.1.0",
+    "@noble/curves": "^2.2.0",
+    "@tanstack/query-core": "^5.102.8",
+    "@tanstack/react-query": "^5.102.8",
+    "react": "^19.3.0"
+  },
+  "devDependencies": {
+    "@size-limit/preset-small-lib": "^13.0.3",
+    "size-limit": "^13.0.3"
+  }
+}

package/scripts/size-app/react.js

@@ -0,0 +1,4 @@
+// The imports of a React app: a client, its provider and the hook that reads
+// it. `.size-limit.js` measures them with every peer but React itself.
+export { createClient } from "@ic-reactor/core"
+export { ReactorProvider, useClient } from "@ic-reactor/react"

package/scripts/size-app.test.mjs

@@ -0,0 +1,73 @@
+/**
+ * Tests of the peers-included size checks in `scripts/size-app/`: that they
+ * measure what they say, and that `pnpm size` and CI run them.
+ *
+ * size-limit adds every `peerDependencies` entry of the package it runs in to
+ * each check's `ignore`. A peer added to the fixture would drop that peer from
+ * both checks without failing either, so the first test guards it.
+ *
+ * Run by `pnpm test:scripts`.
+ */
+import assert from "node:assert/strict"
+import { readFileSync } from "node:fs"
+import { dirname, join } from "node:path"
+import { describe, it } from "node:test"
+import { fileURLToPath, pathToFileURL } from "node:url"
+
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..")
+const fixtureDir = join(repoRoot, "scripts", "size-app")
+const readJson = (path) => JSON.parse(readFileSync(path, "utf8"))
+
+describe("the size-app fixture", () => {
+  it("declares no peers, so size-limit ignores none of them", () => {
+    const manifest = readJson(join(fixtureDir, "package.json"))
+    assert.equal(manifest.private, true)
+    assert.deepEqual(manifest.peerDependencies ?? {}, {})
+    assert.deepEqual(manifest.peerDependenciesMeta ?? {}, {})
+  })
+
+  it("measures { createClient } with core's peers, ignoring nothing", async () => {
+    const { default: checks } = await import(
+      pathToFileURL(join(fixtureDir, ".size-limit.js")).href
+    )
+    const core = checks.find((check) => check.path === "core.js")
+    assert.ok(core, "no check of core.js")
+    assert.ok(core.limit, "the core.js check has no limit")
+    assert.deepEqual(core.ignore ?? [], [])
+    assert.match(
+      readFileSync(join(fixtureDir, "core.js"), "utf8"),
+      /^export \{ createClient \} from "@ic-reactor\/core"$/m
+    )
+  })
+
+  it("leaves only React itself out of the React path", async () => {
+    const { default: checks } = await import(
+      pathToFileURL(join(fixtureDir, ".size-limit.js")).href
+    )
+    const react = checks.find((check) => check.path === "react.js")
+    assert.ok(react, "no check of react.js")
+    assert.ok(react.limit, "the react.js check has no limit")
+    assert.deepEqual(react.ignore, ["react", "react/jsx-runtime"])
+  })
+
+  it("runs in `pnpm size`, which CI's build job runs after the build", () => {
+    const { scripts } = readJson(join(repoRoot, "package.json"))
+    assert.match(scripts.size, /--filter \.\/scripts\/size-app\b/)
+    const ci = readFileSync(
+      join(repoRoot, ".github", "workflows", "ci.yml"),
+      "utf8"
+    )
+    // Only the build job: the lint job also runs `pnpm build`, earlier in the file.
+    const start = ci.indexOf("\n  build:\n")
+    assert.ok(start !== -1, "ci.yml has no build job")
+    const next = ci.slice(start + 1).search(/\n  [a-z][a-z-]*:\n/)
+    const job =
+      next === -1 ? ci.slice(start) : ci.slice(start, start + 1 + next)
+    const build = job.indexOf("run: pnpm build\n")
+    const size = job.indexOf("run: pnpm size\n")
+    assert.ok(
+      build !== -1 && size > build,
+      "ci.yml's build job runs no `pnpm size` after `pnpm build`"
+    )
+  })
+})