@impetik/xeer-mcp 0.2.17 → 0.2.18

package/vendor/spec/schema-plan.js

@@ -8,6 +8,10 @@ export const SCHEMA_PROTOCOL = 'xeer.schema.v0';
 export const FIELD_ATTRIBUTES = Object.freeze([
     'collate', 'default', 'enum', 'generated', 'onDelete', 'onUpdate', 'table', 'unique',
 ]);
+/** The default a table that says nothing about its ids gets, in the one place the plan reads it. */
+export function tableIdSource(table) {
+    return table.idSource ?? 'runtime';
+}
 export class SchemaPlanningError extends Error {
     code;
     constructor(code, message) {
@@ -61,6 +65,13 @@ function tableSteps(tableName, from, to) {
         steps.push({ kind: 'table.constraint', table: tableName, constraint,
             from: from[constraint] ?? null, to: to[constraint] ?? null });
     }
+    // Read through the default, so declaring `"runtime"` on a table that had said nothing is the same
+    // table rather than a change — the same reading the hash takes when it omits the defaulted value.
+    const beforeIdSource = tableIdSource(from);
+    const afterIdSource = tableIdSource(to);
+    if (beforeIdSource !== afterIdSource) {
+        steps.push({ kind: 'table.idSource', table: tableName, from: beforeIdSource, to: afterIdSource });
+    }
     // Indexes are compared through their normalized form, so `["slug"]` and `{ columns: ["slug"] }`
     // are one index written two ways rather than a change from one to the other.
     const terms = (index) => normalizedIndex(index).columns.map(indexTermLabel);
@@ -92,12 +103,20 @@ function tableSteps(tableName, from, to) {
 }
 /**
  * Whether a step leaves the rows already stored valid. Nothing in the extended vocabulary does,
- * with one exception: a DEFAULT decides what a later insert that omits the column receives and says
- * nothing about the rows already there, so changing one cannot invalidate them.
+ * with two exceptions, and both are exceptions for the same reason: they govern what a *later* write
+ * is allowed to say and make no claim about what is already stored.
+ *
+ * A DEFAULT decides what an insert that omits the column receives, and says nothing about the rows
+ * already there. `idSource` decides who supplies the next row's id: turning it on leaves every stored
+ * uuid a valid primary key, and turning it off leaves every stored application id one too. Neither
+ * direction touches a column, an index, or a byte on disk — `id` is `TEXT PRIMARY KEY` under both —
+ * so a reset here would rewrite a table to produce the table it started with.
  */
 function isCompatible(step) {
     if (step.kind === 'table.add' || step.kind === 'index.add')
         return true;
+    if (step.kind === 'table.idSource')
+        return true;
     if (step.kind === 'field.add')
         return step.optional;
     if (step.kind === 'field.optional')
@@ -149,7 +168,7 @@ function unknownSchemaSteps(fromSchema, toSchema) {
     for (const tableName of tableNames) {
         const beforeTable = fromSchema.tables[tableName];
         const afterTable = toSchema.tables[tableName];
-        steps.push(...unknownKeySteps(`database.tables.${tableName}`, beforeTable, afterTable, ['fields', 'indexes', 'unique', 'checks']));
+        steps.push(...unknownKeySteps(`database.tables.${tableName}`, beforeTable, afterTable, ['fields', 'indexes', 'unique', 'checks', 'idSource']));
         const beforeFields = beforeTable?.fields ?? {};
         const afterFields = afterTable?.fields ?? {};
         const fieldNames = [...new Set([...Object.keys(beforeFields), ...Object.keys(afterFields)])].sort();

package/vendor/spec/schema.d.ts

@@ -62,6 +62,10 @@ export declare const normalizedDatabaseSchema: z.ZodObject<{
         }, z.core.$strict>]>>>;
         unique: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
         checks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        idSource: z.ZodOptional<z.ZodEnum<{
+            runtime: "runtime";
+            application: "application";
+        }>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export declare const applicationManifestSchema: z.ZodObject<{
@@ -140,6 +144,10 @@ export declare const applicationManifestSchema: z.ZodObject<{
             }, z.core.$strict>]>>>;
             unique: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
             checks: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            idSource: z.ZodOptional<z.ZodEnum<{
+                runtime: "runtime";
+                application: "application";
+            }>>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
     storage: z.ZodOptional<z.ZodObject<{
@@ -164,6 +172,7 @@ export declare const applicationManifestSchema: z.ZodObject<{
         responseBytes: z.ZodOptional<z.ZodNumber>;
         clientBundleBytes: z.ZodOptional<z.ZodNumber>;
         liveConnections: z.ZodOptional<z.ZodNumber>;
+        streamedBytes: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 /** Stable editor-facing schema location emitted into every scaffolded `xeer.app.json`. */

package/vendor/spec/schema.js

@@ -138,6 +138,9 @@ const tableSchema = z.strictObject({
     indexes: z.record(identifier, indexSchema).optional(),
     unique: z.array(z.array(identifier).min(1)).optional(),
     checks: z.record(identifier, expression).optional(),
+    // Who supplies a row's id. Absent means `"runtime"`, and absent is how it stays written: the
+    // normalized schema omits the default, so declaring it explicitly is accepted but changes nothing.
+    idSource: z.enum(['runtime', 'application']).optional(),
 }).superRefine((table, ctx) => {
     for (const [indexName, definition] of Object.entries(table.indexes ?? {})) {
         const seen = new Set();
@@ -295,6 +298,10 @@ export const applicationManifestSchema = z.strictObject({
         // and the runtime answers `live_disabled` for it rather than a retryable budget refusal. The
         // bound is `min(0)` and not `positive()` so the editor schema publishes `minimum: 0`.
         liveConnections: z.number().int().min(0).max(1_000).optional(),
+        // Deliberately above `responseBytes`' 4 MiB ceiling: a streamed body that had to fit inside the
+        // buffered one would give an author no reason to stream. It is still declared and still bounded —
+        // an unbudgeted server→client channel is not something this platform ships (decision 0007).
+        streamedBytes: z.number().int().positive().max(64 * 1024 * 1024).optional(),
     }).optional(),
 }).superRefine((manifest, ctx) => {
     // Caught here, at `xeer check` time, rather than as a failure when the schema is applied.
@@ -423,6 +430,19 @@ export function normalizeApplicationManifest(manifest) {
             // application's Durable Object continuously, so a positive default charged every application
             // for a feature most never used. Declare a positive value to turn it on.
             liveConnections: manifest.budgets?.liveConnections ?? 0,
+            // Present only when declared, mirroring `clientBundleBytes` below. The normalized budgets go
+            // into the artifact payload verbatim, so materializing the platform default here would move
+            // the `artifactId` of every application that never asked for a streamed response — the exact
+            // identity invariant `storage` and `clientBundleBytes` exist to hold. The runtime applies
+            // {@link STREAMED_BYTES_DEFAULT} where it reads the budget instead.
+            //
+            // A positive default is safe here in a way `liveConnections` is not: this ceiling only ever
+            // applies to a stream `liveConnections` already admitted, so the default cannot open a channel
+            // on its own. It matches `responseBytes` so that turning an endpoint from buffered to streamed
+            // does not silently change how many bytes it may send.
+            ...(manifest.budgets?.streamedBytes !== undefined
+                ? { streamedBytes: manifest.budgets.streamedBytes }
+                : {}),
             // Present only when declared, mirroring `storage`: the platform default is applied at build
             // time, so an application that never declares the budget hashes exactly as before (#212).
             ...(manifest.budgets?.clientBundleBytes !== undefined

package/vendor/spec/state-export.d.ts

@@ -100,6 +100,28 @@ export declare class StateTransferError extends Error {
     /** JSON shape shared by the runtime response, the control-plane envelope, and CLI diagnostics. */
     toDiagnostic(): StateTransferDiagnostic;
 }
+/** The longest a row id may be, in UTF-16 code units. */
+export declare const RECORD_ID_MAX_LENGTH = 256;
+export type RecordIdRefusal = 'record_id_empty' | 'record_id_too_long' | 'record_id_invalid';
+/**
+ * Why a row id is refused, or `null` when it is acceptable.
+ *
+ * Until `idSource: "application"` this rule had one caller and lived inside it, because the only ids
+ * an application could produce came from `crypto.randomUUID()` and the only ones a human could were
+ * the admin editor's. Both of those are now joined by ids an application chooses on `insert`, so the
+ * rule is stated once here and read by all three — the alternative being three spellings of "a row
+ * id" that agree until one of them is edited.
+ *
+ * Bounded and quotable, and no more. The bound is what stops an id becoming an unbounded key in
+ * every index and error message that carries one; control characters are refused because an id is
+ * quoted back in diagnostics, admin listings and URLs, and a newline or a NUL inside one turns a
+ * message into two. Nothing narrower would be honest: these ids come from identity providers and
+ * other outside systems, and refusing a charset that a provider legitimately issues would make the
+ * capability unusable for exactly the case it exists for.
+ */
+export declare function recordIdRefusal(id: unknown): RecordIdRefusal | null;
+/** The human wording for each refusal, shared so the runtime and the editor say the same thing. */
+export declare function recordIdMessage(refusal: RecordIdRefusal, id: unknown): string;
 /**
  * Whether a decoded value satisfies a declared field. Shared with the runtime so an imported record
  * is held to exactly the same rule a handler-written record is.

package/vendor/spec/state-export.js

@@ -110,6 +110,42 @@ function validEncodedValue(value, path) {
     }
     throw malformed(`Unknown encoded value tag at ${path}.`, { tag: typeof tag === 'string' ? tag : null });
 }
+/** The longest a row id may be, in UTF-16 code units. */
+export const RECORD_ID_MAX_LENGTH = 256;
+/**
+ * Why a row id is refused, or `null` when it is acceptable.
+ *
+ * Until `idSource: "application"` this rule had one caller and lived inside it, because the only ids
+ * an application could produce came from `crypto.randomUUID()` and the only ones a human could were
+ * the admin editor's. Both of those are now joined by ids an application chooses on `insert`, so the
+ * rule is stated once here and read by all three — the alternative being three spellings of "a row
+ * id" that agree until one of them is edited.
+ *
+ * Bounded and quotable, and no more. The bound is what stops an id becoming an unbounded key in
+ * every index and error message that carries one; control characters are refused because an id is
+ * quoted back in diagnostics, admin listings and URLs, and a newline or a NUL inside one turns a
+ * message into two. Nothing narrower would be honest: these ids come from identity providers and
+ * other outside systems, and refusing a charset that a provider legitimately issues would make the
+ * capability unusable for exactly the case it exists for.
+ */
+export function recordIdRefusal(id) {
+    if (typeof id !== 'string' || id.length === 0)
+        return 'record_id_empty';
+    if (id.length > RECORD_ID_MAX_LENGTH)
+        return 'record_id_too_long';
+    return /[\u0000-\u001f\u007f-\u009f]/u.test(id) ? 'record_id_invalid' : null;
+}
+/** The human wording for each refusal, shared so the runtime and the editor say the same thing. */
+export function recordIdMessage(refusal, id) {
+    switch (refusal) {
+        case 'record_id_empty':
+            return 'A row id must be a non-empty string.';
+        case 'record_id_too_long':
+            return `A row id may not exceed ${RECORD_ID_MAX_LENGTH} characters; received ${id.length}.`;
+        default:
+            return `A row id may not contain control characters: ${JSON.stringify(id.slice(0, 80))}`;
+    }
+}
 /**
  * Whether a decoded value satisfies a declared field. Shared with the runtime so an imported record
  * is held to exactly the same rule a handler-written record is.
@@ -156,8 +192,12 @@ function parseRecord(table, index, value) {
     const row = plainObject(value);
     if (!row)
         throw malformed(`Row ${index} of table ${table} is not an object.`);
-    if (typeof row.id !== 'string' || row.id.length === 0 || row.id.length > 256) {
-        throw malformed(`Row ${index} of table ${table} has no usable id.`);
+    // The same rule an application `insert` and the admin editor are held to. An imported row is a row
+    // like any other, and a document carrying an id no live write could have produced would restore an
+    // application into a state it had no way to reach on its own.
+    const idRefusal = recordIdRefusal(row.id);
+    if (idRefusal) {
+        throw malformed(`Row ${index} of table ${table} has no usable id. ${recordIdMessage(idRefusal, row.id)}`);
     }
     if (!isoTimestamp(row.createdAt) || !isoTimestamp(row.updatedAt)) {
         throw malformed(`Row ${row.id} of table ${table} has non-ISO timestamps.`);

package/vendor/spec/type-check-profile.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The platform TypeScript profile, in the spelling a `tsconfig.json` uses.
+ *
+ * `xeer check` type-checks an application with its own compiler options rather than the project's
+ * `tsconfig.json`, because the answer must not depend on a file the author can edit. The editor,
+ * however, reads only the `tsconfig.json` — so anything the platform enforces and the scaffold omits
+ * shows up as a green editor and a red CLI, which is what `exactOptionalPropertyTypes` did (#248).
+ *
+ * The repair is not to copy the flags into the scaffold: a copy is a thing that drifts. This module
+ * is the one declaration. The compiler converts it into `ts.CompilerOptions` for the check, and the
+ * scaffold writes it into `tsconfig.json` verbatim, so the two cannot disagree without this file
+ * changing. It lives in the spec package rather than the compiler so that writing a scaffold does
+ * not require loading TypeScript.
+ *
+ * Values are the JSON spellings TypeScript accepts in a `tsconfig.json` (`"esnext"`, `"bundler"`,
+ * `"react-jsx"`, `lib` without the `lib.`/`.d.ts` affixes), which is what
+ * `ts.convertCompilerOptionsFromJson` reads.
+ */
+export declare const PLATFORM_TYPE_CHECK_COMPILER_OPTIONS: Readonly<{
+    readonly allowJs: true;
+    readonly allowArbitraryExtensions: true;
+    readonly checkJs: true;
+    readonly exactOptionalPropertyTypes: true;
+    readonly jsx: "react-jsx";
+    readonly jsxImportSource: "@impetik/xeer";
+    readonly lib: readonly string[];
+    readonly module: "esnext";
+    readonly moduleResolution: "bundler";
+    readonly noEmit: true;
+    readonly noUncheckedIndexedAccess: true;
+    readonly skipLibCheck: true;
+    readonly strict: true;
+    readonly target: "es2022";
+    readonly types: readonly never[];
+    readonly verbatimModuleSyntax: true;
+}>;
+/**
+ * The React-family editor mappings every scaffolded and template `tsconfig.json` carries. Each
+ * target is a shim inside the installed platform package that re-exports the platform's
+ * `preact/compat` surface, so the mapping resolves under npm hoisting and pnpm strictness alike.
+ *
+ * Not part of {@link PLATFORM_TYPE_CHECK_COMPILER_OPTIONS}: the platform check answers the same
+ * question through its module-resolution host instead, so this is the editor's half of one rule
+ * rather than a second rule.
+ */
+export declare const REACT_COMPAT_TSCONFIG_PATHS: Readonly<Record<string, readonly string[]>>;
+/**
+ * The files an application's `tsconfig.json` type-checks: sources, TypeScript tests, and the
+ * generated contract.
+ *
+ * `tests/**\/*.ts` rather than `tests`, because the profile enables `checkJs` and the two sides build
+ * their file sets differently. The platform checks the entrypoint graph plus `tests/**\/*.test.ts`,
+ * so a `.js` file it reaches is a file it judges; a tsconfig's set is a directory glob, and `tests`
+ * would additionally drag in a `.mjs` harness written for Node — a file neither side is judging the
+ * same way. Restricting the glob to TypeScript keeps the two sets comparable without weakening any
+ * rule that decides how a checked file is judged.
+ */
+export declare const APPLICATION_TSCONFIG_INCLUDE: readonly string[];
+/**
+ * The `tsconfig.json` document an application carries, as a serialized file body.
+ *
+ * One function so the scaffold, the checked-in templates, and any conformance test all name the same
+ * bytes. Serialized here rather than returned as an object because "the file the editor reads" is
+ * what has to match, and two callers stringifying the same object with different options would
+ * produce two different files.
+ */
+export declare function applicationTsconfigDocument(): string;

package/vendor/spec/type-check-profile.js

@@ -0,0 +1,78 @@
+/**
+ * The platform TypeScript profile, in the spelling a `tsconfig.json` uses.
+ *
+ * `xeer check` type-checks an application with its own compiler options rather than the project's
+ * `tsconfig.json`, because the answer must not depend on a file the author can edit. The editor,
+ * however, reads only the `tsconfig.json` — so anything the platform enforces and the scaffold omits
+ * shows up as a green editor and a red CLI, which is what `exactOptionalPropertyTypes` did (#248).
+ *
+ * The repair is not to copy the flags into the scaffold: a copy is a thing that drifts. This module
+ * is the one declaration. The compiler converts it into `ts.CompilerOptions` for the check, and the
+ * scaffold writes it into `tsconfig.json` verbatim, so the two cannot disagree without this file
+ * changing. It lives in the spec package rather than the compiler so that writing a scaffold does
+ * not require loading TypeScript.
+ *
+ * Values are the JSON spellings TypeScript accepts in a `tsconfig.json` (`"esnext"`, `"bundler"`,
+ * `"react-jsx"`, `lib` without the `lib.`/`.d.ts` affixes), which is what
+ * `ts.convertCompilerOptionsFromJson` reads.
+ */
+export const PLATFORM_TYPE_CHECK_COMPILER_OPTIONS = Object.freeze({
+    allowJs: true,
+    allowArbitraryExtensions: true,
+    checkJs: true,
+    exactOptionalPropertyTypes: true,
+    jsx: 'react-jsx',
+    jsxImportSource: '@impetik/xeer',
+    lib: Object.freeze(['es2022', 'dom', 'dom.iterable']),
+    module: 'esnext',
+    moduleResolution: 'bundler',
+    noEmit: true,
+    noUncheckedIndexedAccess: true,
+    skipLibCheck: true,
+    strict: true,
+    target: 'es2022',
+    types: Object.freeze([]),
+    verbatimModuleSyntax: true,
+});
+/**
+ * The React-family editor mappings every scaffolded and template `tsconfig.json` carries. Each
+ * target is a shim inside the installed platform package that re-exports the platform's
+ * `preact/compat` surface, so the mapping resolves under npm hoisting and pnpm strictness alike.
+ *
+ * Not part of {@link PLATFORM_TYPE_CHECK_COMPILER_OPTIONS}: the platform check answers the same
+ * question through its module-resolution host instead, so this is the editor's half of one rule
+ * rather than a second rule.
+ */
+export const REACT_COMPAT_TSCONFIG_PATHS = Object.freeze({
+    'react': ['./node_modules/@impetik/xeer/dist/compat/react'],
+    'react-dom': ['./node_modules/@impetik/xeer/dist/compat/react-dom'],
+    'react-dom/client': ['./node_modules/@impetik/xeer/dist/compat/react-dom-client'],
+    'react/jsx-runtime': ['./node_modules/@impetik/xeer/dist/compat/react-jsx-runtime'],
+    'react/jsx-dev-runtime': ['./node_modules/@impetik/xeer/dist/compat/react-jsx-dev-runtime'],
+});
+/**
+ * The files an application's `tsconfig.json` type-checks: sources, TypeScript tests, and the
+ * generated contract.
+ *
+ * `tests/**\/*.ts` rather than `tests`, because the profile enables `checkJs` and the two sides build
+ * their file sets differently. The platform checks the entrypoint graph plus `tests/**\/*.test.ts`,
+ * so a `.js` file it reaches is a file it judges; a tsconfig's set is a directory glob, and `tests`
+ * would additionally drag in a `.mjs` harness written for Node — a file neither side is judging the
+ * same way. Restricting the glob to TypeScript keeps the two sets comparable without weakening any
+ * rule that decides how a checked file is judged.
+ */
+export const APPLICATION_TSCONFIG_INCLUDE = Object.freeze(['src', 'tests/**/*.ts', '.xeer/generated/**/*.d.ts']);
+/**
+ * The `tsconfig.json` document an application carries, as a serialized file body.
+ *
+ * One function so the scaffold, the checked-in templates, and any conformance test all name the same
+ * bytes. Serialized here rather than returned as an object because "the file the editor reads" is
+ * what has to match, and two callers stringifying the same object with different options would
+ * produce two different files.
+ */
+export function applicationTsconfigDocument() {
+    return `${JSON.stringify({
+        compilerOptions: { ...PLATFORM_TYPE_CHECK_COMPILER_OPTIONS, paths: REACT_COMPAT_TSCONFIG_PATHS },
+        include: APPLICATION_TSCONFIG_INCLUDE,
+    }, null, 2)}\n`;
+}

package/vendor/spec/types.d.ts

@@ -16,6 +16,20 @@ export interface Diagnostic {
     file?: string;
     span?: SourceSpan;
     hint?: string;
+    /**
+     * Set on a diagnostic that invalidated the generated contract: the compiler could not describe the
+     * application's operations, so every type derived from them is wrong downstream. Absent means
+     * "nothing is known", not "not primary" — a consumer that ignores the field reads the envelope
+     * exactly as it did before the field existed.
+     */
+    primary?: true;
+    /**
+     * The `code` of the contract-invalidating diagnostic this one is a consequence of. Present only
+     * when the causal link is structural — the file consumes the contract the primary diagnostic
+     * broke — and never on a diagnostic in a file that carries a primary. Repair the primaries and
+     * re-run: a `causedBy` diagnostic that survives is a real error carrying its own location.
+     */
+    causedBy?: string;
 }
 /**
  * `ref` is a scalar in the only sense that matters here: it is one TEXT column holding one row id.
@@ -92,6 +106,22 @@ export interface TableDefinition {
     unique?: string[][];
     /** Table-level CHECK expressions by name. The name is what SQLite reports when one fails. */
     checks?: Record<string, string>;
+    /**
+     * Who chooses a row's `id`. Defaults to `"runtime"`, which mints an unguessable uuid and refuses
+     * an `id` on insert.
+     *
+     * `"application"` makes `insert({ id, … })` required for this table and this table only, so a row
+     * can *be* the thing an outside system already names — the case this exists for is a `workspaces`
+     * row whose id is the identity provider's workspace id, which makes `ref` and
+     * `workspaceTable({ workspaceField: 'id' })` work against it without a second column to join
+     * through (decision 0006).
+     *
+     * Opt-in per table so the default stays the safe one: an application that does not ask for this
+     * cannot accidentally accept a client-chosen id. Nothing about the column changes — `id` is
+     * `TEXT PRIMARY KEY` either way — so a collision is the primary key's own constraint rather than
+     * new machinery, and turning this on or off is physically compatible with the rows already stored.
+     */
+    idSource?: 'runtime' | 'application';
 }
 /**
  * The capabilities an application may declare. A capability name in `capabilities[]` and its config
@@ -101,6 +131,16 @@ export interface TableDefinition {
  */
 export declare const CAPABILITIES: readonly ["database", "storage"];
 export type Capability = (typeof CAPABILITIES)[number];
+/**
+ * Bytes one streamed endpoint response may pump when `budgets.streamedBytes` is not declared.
+ *
+ * Applied where the budget is *read* rather than where the manifest is normalized, because
+ * normalized budgets go into the artifact payload verbatim: materializing this default would move
+ * the `artifactId` of every application that never asked for a streamed response. It matches the
+ * `responseBytes` default so that turning an endpoint from buffered to streamed does not silently
+ * change how many bytes it may send.
+ */
+export declare const STREAMED_BYTES_DEFAULT = 1048576;
 /**
  * The `storage` capability's declared limits. Every field is optional and normalized to a default,
  * and every one is a *logical* limit — a byte count the runtime enforces at call time. Nothing here
@@ -164,6 +204,15 @@ export interface ApplicationManifestV0 {
          * runtime answers a terminal `live_disabled` without waking the state object.
          */
         liveConnections?: number;
+        /**
+         * Bytes one streamed endpoint response may pump through the platform.
+         *
+         * A streamed body is bounded, not exempt: `responseBytes` bounds a body the platform buffered and
+         * can still refuse as a whole, and this bounds one the platform has already begun sending and can
+         * only terminate. They are different failures, so they are different ceilings. Exceeding this one
+         * aborts the stream mid-body, which the client observes as a failed read rather than a refusal.
+         */
+        streamedBytes?: number;
         /**
          * Error-tier byte budget for the minified pre-gzip client JavaScript bundle. Defaults to the
          * platform's 1 MiB when omitted; bounded above by the 10 MiB module ceiling. The advisory tier
@@ -206,8 +255,23 @@ export interface NormalizedApplicationManifestV0 {
         mutationWrites: number;
         requestBytes: number;
         responseBytes: number;
-        /** `0` means server push is off for this application; see {@link ApplicationManifestV0}. */
+        /**
+         * `0` means server push is off for this application; see {@link ApplicationManifestV0}.
+         *
+         * It is the ceiling on **every** server→client byte channel the state object holds open, not on
+         * live invalidation alone: an SSE subscription and a streamed endpoint response occupy the same
+         * pool. Two separately-bounded pools would add up to an unbounded total, which is the one answer
+         * decision 0007 refused.
+         */
         liveConnections: number;
+        /**
+         * Bytes one streamed endpoint response may pump; see {@link ApplicationManifestV0}.
+         *
+         * Present only when the manifest declares it, mirroring `clientBundleBytes` below: an
+         * application on the platform default hashes exactly as it did before the budget existed.
+         * Read it as `streamedBytes ?? STREAMED_BYTES_DEFAULT`.
+         */
+        streamedBytes?: number;
         /**
          * Present only when the manifest declares it, mirroring `storage`: an application on the
          * platform default hashes exactly as it did before the budget was declarable.
@@ -221,9 +285,14 @@ export interface SourceReceipt {
     hash: `sha256:${string}`;
 }
 /**
- * Provenance for one npm package the client bundle consumed (#212). `files` receipts the exact
+ * Provenance for one npm package a zone bundle consumed (#212, #244). `files` receipts the exact
  * bytes the bundler read — strictly stronger than lockfile integrity, which pins tarballs rather
  * than the post-install state a patch or postinstall script left on disk.
+ *
+ * Deliberately not keyed by zone. A package both bundles consume is one dependency of one
+ * application at one version, and receipting it twice would say the artifact used two. The receipt
+ * is the union of the files either bundle read, so the same package contributing different modules
+ * to each zone is still one entry covering every byte that entered the artifact.
  */
 export interface BundledDependencyReceiptV0 {
     name: string;
@@ -278,9 +347,10 @@ export interface ApplicationArtifactV0 {
      */
     storage?: NormalizedStorageConfigV0;
     /**
-     * The normalized client runtime, recorded when the application declares `client` or the bundle
-     * consumed open dependencies. Present-only-then for the same reason as `storage`: an untouched
-     * application keeps its `artifactId` (#212).
+     * The normalized client runtime, recorded when the application declares `client` or the *client*
+     * bundle consumed open dependencies. Present-only-then for the same reason as `storage`: an
+     * untouched application keeps its `artifactId` (#212). A server-only dependency does not record
+     * it — nothing about the renderer was chosen by importing one (#244).
      */
     clientRuntime?: NormalizedApplicationManifestV0['client']['runtime'];
     budgets: NormalizedApplicationManifestV0['budgets'];

package/vendor/spec/types.js

@@ -9,3 +9,13 @@ export const INSPECT_PROTOCOL = 'xeer.inspect.v0';
  * Cloudflare-primitive-backed capability to follow it (#29, design in #51).
  */
 export const CAPABILITIES = Object.freeze(['database', 'storage']);
+/**
+ * Bytes one streamed endpoint response may pump when `budgets.streamedBytes` is not declared.
+ *
+ * Applied where the budget is *read* rather than where the manifest is normalized, because
+ * normalized budgets go into the artifact payload verbatim: materializing this default would move
+ * the `artifactId` of every application that never asked for a streamed response. It matches the
+ * `responseBytes` default so that turning an endpoint from buffered to streamed does not silently
+ * change how many bytes it may send.
+ */
+export const STREAMED_BYTES_DEFAULT = 1_048_576;