@impetik/xeer-mcp 0.2.18 → 0.2.20

package/vendor/spec/import-policy.js

@@ -15,15 +15,33 @@
  * source, and vendoring folds it into the published tarball with everything else.
  */
 /**
- * The normalized client runtime: the only implemented provider/source combination. `client.runtime`
- * in the manifest is optional and omission normalizes to exactly this value, so declaring it is a
- * statement of the default rather than a choice.
+ * The UI providers the platform implements, in the spelling `client.runtime.provider` uses.
+ *
+ * A provider is a whole renderer family — packages, entrypoint classification, JSX runtimes, and
+ * the compat aliases the family does or does not offer — and the client zone's policy is a pure
+ * function of which one the manifest declares ({@link clientImportPolicy}). Adding a provider is
+ * adding a family and a case, never a flag threaded through the consumers: what a specifier means
+ * on the client has exactly one answer per provider, stated here.
+ */
+export const CLIENT_RUNTIME_PROVIDERS = Object.freeze(['preact', 'react']);
+/**
+ * The default client runtime. `client.runtime` in the manifest is optional and omission normalizes
+ * to exactly this value, so an application that says nothing gets the Preact provider it always
+ * had — byte-for-byte, down to the artifact identity.
+ *
+ * The *normalized* runtime of a given application is whatever its manifest declares; this is only
+ * the value omission means. Provenance and compiler facts must derive from the manifest's own
+ * runtime through {@link clientRuntimeId}, never from this constant.
  */
 export const NORMALIZED_CLIENT_RUNTIME = Object.freeze({
     provider: 'preact',
     source: 'platform',
 });
-/** The normalized client runtime as compiler facts and artifact provenance spell it. */
+/** How a client runtime is spelled in compiler facts and artifact provenance. */
+export function clientRuntimeId(runtime) {
+    return `${runtime.provider}/${runtime.source}`;
+}
+/** The default client runtime as compiler facts and artifact provenance spell it. */
 export const CLIENT_RUNTIME_ID = `${NORMALIZED_CLIENT_RUNTIME.provider}/${NORMALIZED_CLIENT_RUNTIME.source}`;
 /**
  * Default and advisory budgets for the open client bundle, minified pre-gzip bytes of the single
@@ -33,38 +51,57 @@ export const CLIENT_RUNTIME_ID = `${NORMALIZED_CLIENT_RUNTIME.provider}/${NORMAL
  */
 export const CLIENT_BUNDLE_ERROR_BUDGET_BYTES = 1024 * 1024;
 export const CLIENT_BUNDLE_ADVISORY_BUDGET_BYTES = 400 * 1024;
+/** An entrypoint the anchor package ships declarations for, through its own `types` condition. */
+function selfTyped(classification) {
+    return { classification, types: { kind: 'anchor' } };
+}
+/** An entrypoint whose declarations a `@types/*` package publishes, at `specifier`. */
+function typedBy(classification, specifier) {
+    return { classification, types: { kind: 'types-package', specifier } };
+}
+/** An entrypoint no package publishes declarations for. */
+function untyped(classification) {
+    return { classification, types: { kind: 'none' } };
+}
 /**
- * Every public entrypoint of the platform Preact package, classified. The compiler's conformance
- * test compares this map against the installed package's `exports` map in both directions, so a
- * Preact upgrade that adds, removes, or renames an entrypoint fails until it is deliberately
- * classified here.
+ * Every public entrypoint of the platform Preact package: what it is for, and where its declarations
+ * live. The compiler's conformance test compares this map against the installed package's `exports`
+ * map in both directions, so a Preact upgrade that adds, removes, or renames an entrypoint fails
+ * until it is deliberately classified here — and a second test resolves every declared types source,
+ * so an upgrade that *moves* the declarations fails here rather than silently in an editor.
+ *
+ * Preact ships its own declarations, so almost every entrypoint is `anchor`. The exceptions are
+ * facts about the published package rather than judgements: `compat/server` and `compat/scheduler`
+ * publish no `types` condition at all, and `compat/server.browser` publishes one naming
+ * `./compat/server.d.ts`, a file the package does not contain. All three are `none`, which is why
+ * neither `xeer check` nor an editor answers them — the same refusal, from the same declaration.
  */
 const PREACT_ENTRYPOINTS = new Map([
-    ['preact', 'runtime'],
-    ['preact/hooks', 'runtime'],
-    ['preact/jsx-runtime', 'runtime'],
-    ['preact/jsx-dev-runtime', 'runtime'],
-    ['preact/compat', 'runtime'],
-    ['preact/compat/client', 'runtime'],
+    ['preact', selfTyped('runtime')],
+    ['preact/hooks', selfTyped('runtime')],
+    ['preact/jsx-runtime', selfTyped('runtime')],
+    ['preact/jsx-dev-runtime', selfTyped('runtime')],
+    ['preact/compat', selfTyped('runtime')],
+    ['preact/compat/client', selfTyped('runtime')],
     // Browser-safe server rendering: both resolve to the browser build under the client conditions.
-    ['preact/compat/server', 'runtime'],
-    ['preact/compat/server.browser', 'runtime'],
-    ['preact/compat/jsx-runtime', 'runtime'],
-    ['preact/compat/jsx-dev-runtime', 'runtime'],
-    ['preact/compat/scheduler', 'runtime'],
+    ['preact/compat/server', untyped('runtime')],
+    ['preact/compat/server.browser', untyped('runtime')],
+    ['preact/compat/jsx-runtime', selfTyped('runtime')],
+    ['preact/compat/jsx-dev-runtime', selfTyped('runtime')],
+    ['preact/compat/scheduler', untyped('runtime')],
     // Side-effectful development surfaces: they mutate the shared renderer options, which is exactly
     // why they must be pinned to the same singleton as everything else.
-    ['preact/debug', 'development'],
-    ['preact/devtools', 'development'],
-    ['preact/test-utils', 'test'],
-    ['preact/compat/test-utils', 'test'],
-    ['preact/package.json', 'metadata'],
-    ['preact/compat/package.json', 'metadata'],
-    ['preact/debug/package.json', 'metadata'],
-    ['preact/devtools/package.json', 'metadata'],
-    ['preact/hooks/package.json', 'metadata'],
-    ['preact/test-utils/package.json', 'metadata'],
-    ['preact/jsx-runtime/package.json', 'metadata'],
+    ['preact/debug', selfTyped('development')],
+    ['preact/devtools', selfTyped('development')],
+    ['preact/test-utils', selfTyped('test')],
+    ['preact/compat/test-utils', selfTyped('test')],
+    ['preact/package.json', untyped('metadata')],
+    ['preact/compat/package.json', untyped('metadata')],
+    ['preact/debug/package.json', untyped('metadata')],
+    ['preact/devtools/package.json', untyped('metadata')],
+    ['preact/hooks/package.json', untyped('metadata')],
+    ['preact/test-utils/package.json', untyped('metadata')],
+    ['preact/jsx-runtime/package.json', untyped('metadata')],
 ]);
 /**
  * The complete per-subpath React-family alias table. Every key is pinned to its target for every
@@ -85,7 +122,8 @@ const REACT_COMPAT_ALIASES = new Map([
 ]);
 /** The client renderer family under the Preact provider. */
 export const PREACT_RENDERER_FAMILY = Object.freeze({
-    anchorPackage: 'preact',
+    provider: 'preact',
+    anchorPackages: Object.freeze(['preact']),
     packages: Object.freeze(['preact', 'react', 'react-dom', 'scheduler']),
     entrypoints: PREACT_ENTRYPOINTS,
     compatAliases: REACT_COMPAT_ALIASES,
@@ -95,8 +133,98 @@ export const PREACT_RENDERER_FAMILY = Object.freeze({
         devRuntime: 'preact/jsx-dev-runtime',
     }),
 });
+/**
+ * Every public entrypoint of the platform React packages, classified — the same hand-maintained
+ * statement `PREACT_ENTRYPOINTS` makes, across the three packages React ships its client surface in,
+ * and gated by the same bidirectional conformance test per package.
+ *
+ * Two things are decided here that Preact never had to decide. The first is the `react-server`
+ * condition: every subpath publishes one, and the client zone is not a React Server Components
+ * environment, so resolution under `browser`/`import`/`module` deliberately never selects it. The
+ * second is that React publishes one subpath per *host runtime* — `server.node`, `server.bun`,
+ * `server.edge` and their `static` counterparts. Those are real, supported entrypoints holding bytes
+ * for a runtime the browser is not, so they are classified `other-runtime` rather than left
+ * unclassified: the difference is a diagnostic that explains itself against one that misinforms.
+ * The condition-switched `react-dom/server` and `react-dom/static` resolve to the browser build here
+ * and are admitted, exactly as `preact/compat/server` is.
+ *
+ * `scheduler` publishes no `exports` map at all, so nothing gates its classification the way the
+ * other two are gated; its conformance test pins the absence instead.
+ *
+ * React ships no declarations of its own, so every types source here is a `@types/*` subpath — and
+ * the two entrypoints DefinitelyTyped does not cover are stated as such rather than left out.
+ * `react-dom/profiling` has no `@types/react-dom` subpath and `scheduler` has no types package
+ * installed at all, which is why both tools refuse them and both are right.
+ */
+const REACT_ENTRYPOINTS = new Map([
+    ['react', typedBy('runtime', '@types/react')],
+    ['react/jsx-runtime', typedBy('runtime', '@types/react/jsx-runtime')],
+    ['react/jsx-dev-runtime', typedBy('runtime', '@types/react/jsx-dev-runtime')],
+    // Emitted by the React Compiler in place of the hooks it rewrites; part of the runtime surface
+    // whether or not this application runs the compiler, because a dependency's build may have.
+    ['react/compiler-runtime', typedBy('runtime', '@types/react/compiler-runtime')],
+    ['react-dom', typedBy('runtime', '@types/react-dom')],
+    ['react-dom/client', typedBy('runtime', '@types/react-dom/client')],
+    // Browser-safe server rendering: both resolve to the browser build under the client conditions.
+    ['react-dom/server', typedBy('runtime', '@types/react-dom/server')],
+    ['react-dom/server.browser', typedBy('runtime', '@types/react-dom/server.browser')],
+    ['react-dom/static', typedBy('runtime', '@types/react-dom/static')],
+    ['react-dom/static.browser', typedBy('runtime', '@types/react-dom/static.browser')],
+    ['react-dom/server.bun', typedBy('other-runtime', '@types/react-dom/server.bun')],
+    ['react-dom/server.edge', typedBy('other-runtime', '@types/react-dom/server.edge')],
+    ['react-dom/server.node', typedBy('other-runtime', '@types/react-dom/server.node')],
+    ['react-dom/static.edge', typedBy('other-runtime', '@types/react-dom/static.edge')],
+    ['react-dom/static.node', typedBy('other-runtime', '@types/react-dom/static.node')],
+    // The profiling build swaps in an instrumented reconciler, which is exactly the kind of
+    // whole-renderer substitution that must stay pinned to the one instance.
+    ['react-dom/profiling', untyped('development')],
+    ['react-dom/test-utils', typedBy('test', '@types/react-dom/test-utils')],
+    ['scheduler', untyped('runtime')],
+    ['react/package.json', untyped('metadata')],
+    ['react-dom/package.json', untyped('metadata')],
+    ['scheduler/package.json', untyped('metadata')],
+]);
+/**
+ * The client renderer family under the React provider: React itself, not a compatibility layer.
+ *
+ * No `compatAliases`, and the omission is the point. Under Preact the React-ecosystem specifiers are
+ * aliases onto `preact/compat` so a React library and the renderer stay one instance; under React
+ * they *are* the renderer, and an alias table would be a second name for the same file.
+ */
+export const REACT_RENDERER_FAMILY = Object.freeze({
+    provider: 'react',
+    anchorPackages: Object.freeze(['react', 'react-dom', 'scheduler']),
+    packages: Object.freeze(['react', 'react-dom', 'scheduler']),
+    entrypoints: REACT_ENTRYPOINTS,
+    compatAliases: new Map(),
+    jsx: Object.freeze({
+        importSource: '@impetik/xeer',
+        runtime: 'react/jsx-runtime',
+        devRuntime: 'react/jsx-dev-runtime',
+    }),
+});
+/**
+ * The client facade, and the provider-specific subpaths it resolves to.
+ *
+ * The platform publishes one adapter subpath per provider beside `@impetik/xeer/client`, so that
+ * the facade has a physical module to resolve to and a packed install can be verified against the
+ * adapter directly. `./client/preact` is an alias of `./client` rather than a module of its own —
+ * the Preact adapter has always been what the facade resolves to by default, and giving it a name
+ * moves nothing about how it resolves or what a build produces. Every provider being addressable is
+ * what makes this set derivable from {@link CLIENT_RUNTIME_PROVIDERS} instead of hand-listed, and
+ * what keeps the refusal below able to say the adapter exists.
+ *
+ * Naming an adapter is not an application's business under either provider: it would pin one
+ * renderer into sources whose entire contract is that `client.runtime.provider` picks the renderer
+ * and the sources do not change. So the targets are published and inadmissible everywhere — but the
+ * *reason* they are refused is per zone, because the repair is. Where the facade is admitted, the
+ * repair is to write the facade; where it is not, the module is in the wrong zone and is told so,
+ * which is the same thing `@impetik/xeer/client` itself is told there.
+ */
+const CLIENT_FACADE_MODULE = '@impetik/xeer/client';
+const CLIENT_FACADE_TARGETS = Object.freeze(new Set(CLIENT_RUNTIME_PROVIDERS.map((provider) => `${CLIENT_FACADE_MODULE}/${provider}`)));
 const CLIENT_PLATFORM_MODULES = Object.freeze([
-    '@impetik/xeer/client',
+    CLIENT_FACADE_MODULE,
     '@impetik/xeer/client/core',
     '@impetik/xeer/shared',
     '@impetik/xeer/jsx-runtime',
@@ -106,21 +234,58 @@ const SERVER_PLATFORM_MODULES = Object.freeze([
     '@impetik/xeer/server',
     '@impetik/xeer/shared',
 ]);
+/**
+ * What the client zone admits *besides* the renderer, which is the same under every provider: the
+ * open application-dependency set, its resolution conditions, its compile-time defines, and its byte
+ * budgets. Shared by identity across the provider policies so that choosing a renderer cannot
+ * silently change the byte budget an application is held to.
+ */
+const CLIENT_APPLICATION_DEPENDENCIES = Object.freeze({
+    mode: 'open',
+    conditions: Object.freeze(['browser', 'import']),
+    defines: Object.freeze({ 'process.env.NODE_ENV': '"production"' }),
+    bundleBudget: Object.freeze({
+        errorBytes: CLIENT_BUNDLE_ERROR_BUDGET_BYTES,
+        advisoryBytes: CLIENT_BUNDLE_ADVISORY_BUDGET_BYTES,
+    }),
+});
 export const CLIENT_IMPORT_POLICY = Object.freeze({
     zone: 'client',
+    provider: 'preact',
     platformModules: CLIENT_PLATFORM_MODULES,
     managedFamilies: Object.freeze([PREACT_RENDERER_FAMILY]),
     foreignFamilies: Object.freeze([]),
-    applicationDependencies: Object.freeze({
-        mode: 'open',
-        conditions: Object.freeze(['browser', 'import']),
-        defines: Object.freeze({ 'process.env.NODE_ENV': '"production"' }),
-        bundleBudget: Object.freeze({
-            errorBytes: CLIENT_BUNDLE_ERROR_BUDGET_BYTES,
-            advisoryBytes: CLIENT_BUNDLE_ADVISORY_BUDGET_BYTES,
-        }),
-    }),
+    applicationDependencies: CLIENT_APPLICATION_DEPENDENCIES,
+});
+/**
+ * The client zone under the React provider.
+ *
+ * The Preact family is *foreign* here for the same reason the renderer is foreign on the server: it
+ * is declared and installed by the platform whatever the application chose, so nothing but an
+ * explicit rule keeps it out of a React bundle — and a bundle holding both renderers has two
+ * reconcilers rendering into one tree. The two families name overlapping packages (`react` and
+ * friends are Preact's alias keys and React's own entrypoints), which is resolved by precedence
+ * rather than by trimming either list: {@link admitBareImport} asks the managed families first, so
+ * under this policy `react` is the renderer and only `preact*` is left for the foreign rule to
+ * refuse. {@link foreignPackageFamily} is that precedence, shared with every other consumer.
+ */
+const REACT_CLIENT_IMPORT_POLICY = Object.freeze({
+    zone: 'client',
+    provider: 'react',
+    platformModules: CLIENT_PLATFORM_MODULES,
+    managedFamilies: Object.freeze([REACT_RENDERER_FAMILY]),
+    foreignFamilies: Object.freeze([PREACT_RENDERER_FAMILY]),
+    applicationDependencies: CLIENT_APPLICATION_DEPENDENCIES,
 });
+/**
+ * The client zone's policy under one UI provider — a pure function of the normalized manifest's
+ * `client.runtime.provider`, with no state and no first-caller latching. The Preact instance is
+ * returned by identity so consumers that still read {@link CLIENT_IMPORT_POLICY} and consumers that
+ * ask for the default share one object, and so the resolver caches keyed on it stay shared.
+ */
+export function clientImportPolicy(provider) {
+    return provider === 'react' ? REACT_CLIENT_IMPORT_POLICY : CLIENT_IMPORT_POLICY;
+}
 /**
  * The server zone, open to application dependencies since ADR 0005 was accepted (#244).
  *
@@ -141,6 +306,7 @@ export const CLIENT_IMPORT_POLICY = Object.freeze({
  */
 export const SERVER_IMPORT_POLICY = Object.freeze({
     zone: 'server',
+    provider: null,
     platformModules: SERVER_PLATFORM_MODULES,
     managedFamilies: Object.freeze([]),
     foreignFamilies: Object.freeze([PREACT_RENDERER_FAMILY]),
@@ -151,14 +317,38 @@ export const SERVER_IMPORT_POLICY = Object.freeze({
         bundleBudget: null,
     }),
 });
-export function zoneImportPolicy(zone) {
-    return zone === 'client' ? CLIENT_IMPORT_POLICY : SERVER_IMPORT_POLICY;
+/**
+ * One zone's policy. The provider only reaches the client zone — the server has no renderer to
+ * choose — and defaults to the manifest default so a caller with no manifest in hand (documentation,
+ * the server zone) reads exactly what it read before.
+ */
+export function zoneImportPolicy(zone, provider = NORMALIZED_CLIENT_RUNTIME.provider) {
+    return zone === 'client' ? clientImportPolicy(provider) : SERVER_IMPORT_POLICY;
 }
 /** The bare package name of a specifier: the first segment, or the first two for a scope. */
 export function packageNameOfSpecifier(specifier) {
     const segments = specifier.split('/');
     return specifier.startsWith('@') ? segments.slice(0, 2).join('/') : segments[0];
 }
+/**
+ * DefinitelyTyped's name for a package's declarations.
+ *
+ * A naming rule rather than a lookup, and one nobody guesses correctly for a scoped package: the
+ * scope is *flattened into* the name rather than kept, so `@acme/widget` publishes as
+ * `@types/acme__widget`. Computed here, beside the specifier-naming rule it is a sibling of, so the
+ * two places that need it — the repair for a package with no declarations, and the check for whether
+ * an acknowledgment is still true — cannot disagree.
+ *
+ * Computed rather than read out of TypeScript's own TS7016 message, which carries the same name in
+ * English prose. That prose is not contract and has been reworded across releases; a rule this short
+ * is cheaper to state than to parse.
+ *
+ * Whether the package actually exists on the registry is unknowable offline, and nothing in the
+ * compiler contacts one at check time — so a caller quoting this must say it as the convention it is.
+ */
+export function definitelyTypedPackage(packageName) {
+    return `@types/${packageName.replace(/^@/, '').replace('/', '__')}`;
+}
 /**
  * Classifies one bare specifier under a zone's policy. Node builtins and native addons are the
  * caller's concern (the analyzer already owns those, and they are refused in every zone); everything
@@ -168,33 +358,67 @@ export function packageNameOfSpecifier(specifier) {
 export function admitBareImport(policy, specifier) {
     if (policy.platformModules.includes(specifier))
         return { kind: 'platform' };
+    // Only where the facade is admitted is "import the facade instead" the repair; a server module
+    // naming a client adapter is in the wrong zone, and gets told that instead.
+    if (CLIENT_FACADE_TARGETS.has(specifier) && policy.platformModules.includes(CLIENT_FACADE_MODULE)) {
+        return { kind: 'rejected', reason: 'provider-facade' };
+    }
     if (specifier === '@impetik/xeer' || specifier.startsWith('@impetik/xeer/')) {
         return { kind: 'rejected', reason: 'platform-subpath' };
     }
     const packageName = packageNameOfSpecifier(specifier);
-    for (const family of policy.managedFamilies) {
-        if (!family.packages.includes(packageName))
-            continue;
-        const target = family.compatAliases.get(specifier) ?? specifier;
-        const classification = family.entrypoints.get(target);
+    const managed = managedPackageFamily(policy, packageName);
+    if (managed) {
+        const target = managed.compatAliases.get(specifier) ?? specifier;
+        const classification = managed.entrypoints.get(target)?.classification;
         if (!classification)
             return { kind: 'managed-rejected', reason: 'unknown-entrypoint' };
         if (classification === 'test')
             return { kind: 'managed-rejected', reason: 'test-only' };
         if (classification === 'metadata')
             return { kind: 'managed-rejected', reason: 'metadata' };
+        if (classification === 'other-runtime')
+            return { kind: 'managed-rejected', reason: 'other-runtime' };
         return { kind: 'managed', classification, target };
     }
     // Before the open set, or an installed renderer would be admitted by the declaration invariant it
     // satisfies in every application that has a client.
-    for (const family of policy.foreignFamilies) {
-        if (family.packages.includes(packageName))
-            return { kind: 'rejected', reason: 'foreign-family' };
-    }
+    if (foreignPackageFamily(policy, packageName))
+        return { kind: 'rejected', reason: 'foreign-family' };
     if (policy.applicationDependencies.mode === 'open')
         return { kind: 'open' };
     return { kind: 'rejected', reason: 'closed' };
 }
+/** The managed family that owns a bare package name in a zone, or null. */
+export function managedPackageFamily(policy, packageName) {
+    return policy.managedFamilies.find((family) => family.packages.includes(packageName)) ?? null;
+}
+/**
+ * The foreign family that refuses a bare package name in a zone, or null.
+ *
+ * Managed ownership wins, and that precedence is the whole reason this is a function rather than a
+ * lookup each caller writes: under the React provider the foreign Preact family names `react`,
+ * `react-dom`, and `scheduler` among its own compat-alias territory, and those are precisely the
+ * packages the managed React family *is*. Asking managed-first is what lets the two descriptors stay
+ * complete statements about themselves instead of being trimmed to avoid each other.
+ */
+export function foreignPackageFamily(policy, packageName) {
+    if (managedPackageFamily(policy, packageName))
+        return null;
+    return policy.foreignFamilies.find((family) => family.packages.includes(packageName)) ?? null;
+}
+/**
+ * The package whose installed root one classified entrypoint resolves from. Derived from the
+ * specifier rather than declared a second time, so a family cannot claim an entrypoint it does not
+ * anchor — which is what keeps `entrypoints` and `anchorPackages` from drifting apart.
+ */
+export function entrypointAnchorPackage(family, specifier) {
+    const packageName = packageNameOfSpecifier(specifier);
+    if (!family.anchorPackages.includes(packageName)) {
+        throw new Error(`${specifier} names no package this renderer family anchors.`);
+    }
+    return packageName;
+}
 /**
  * The admitted managed-family surface of a zone, alias keys included — what bundling and the dev
  * server must pin to the anchor, and what documentation lists as the renderer surface.
@@ -202,15 +426,19 @@ export function admitBareImport(policy, specifier) {
 export function managedImportSpecifiers(policy) {
     const result = new Map();
     for (const family of policy.managedFamilies) {
-        for (const [specifier, classification] of family.entrypoints) {
-            if (classification === 'runtime' || classification === 'development')
+        for (const [specifier, entrypoint] of family.entrypoints) {
+            if (isImportableClassification(entrypoint.classification))
                 result.set(specifier, specifier);
         }
         for (const [alias, target] of family.compatAliases) {
-            const classification = family.entrypoints.get(target);
-            if (classification === 'runtime' || classification === 'development')
+            const entrypoint = family.entrypoints.get(target);
+            if (entrypoint && isImportableClassification(entrypoint.classification))
                 result.set(alias, target);
         }
     }
     return result;
 }
+/** Whether client application code may import an entrypoint with this classification. */
+export function isImportableClassification(classification) {
+    return classification === 'runtime' || classification === 'development';
+}

package/vendor/spec/index.d.ts

@@ -20,5 +20,7 @@ export * from './admin-sql.js';
 export * from './network-policy.js';
 export * from './review.js';
 export * from './template.js';
+export * from './template-distribution.js';
 export * from './tunnel.js';
 export * from './type-check-profile.js';
+export * from './editor-settings.js';

package/vendor/spec/index.js

@@ -20,5 +20,7 @@ export * from './admin-sql.js';
 export * from './network-policy.js';
 export * from './review.js';
 export * from './template.js';
+export * from './template-distribution.js';
 export * from './tunnel.js';
 export * from './type-check-profile.js';
+export * from './editor-settings.js';

package/vendor/spec/schema.d.ts

@@ -159,9 +159,13 @@ export declare const applicationManifestSchema: z.ZodObject<{
         database: "database";
         storage: "storage";
     }>>>;
+    untypedDependencies: z.ZodOptional<z.ZodArray<z.ZodString>>;
     client: z.ZodOptional<z.ZodObject<{
         runtime: z.ZodOptional<z.ZodObject<{
-            provider: z.ZodLiteral<"preact">;
+            provider: z.ZodEnum<{
+                preact: "preact";
+                react: "react";
+            }>;
             source: z.ZodOptional<z.ZodLiteral<"platform">>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;

package/vendor/spec/schema.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { CAPABILITIES, SOURCE_FORMAT, } from './types.js';
+import { CLIENT_RUNTIME_PROVIDERS, NORMALIZED_CLIENT_RUNTIME } from './import-policy.js';
 import { STORAGE_DEFAULT_READ_BYTES, STORAGE_DEFAULT_WRITE_BYTES, STORAGE_MAX_OBJECT_BYTES, STORAGE_MAX_READ_BYTES, STORAGE_MAX_WRITE_BYTES, } from './storage.js';
 import { SQL_EXPRESSION_MAX_LENGTH } from './sql-expression.js';
 import { databaseDdl, indexColumns, referenceCycle, RESERVED_TABLE_PREFIXES, reservedTableName } from './table-ddl.js';
@@ -23,6 +24,13 @@ const favicon = z.string().min(2).max(256)
  * table and manifest refinements below run the real check by generating the DDL.
  */
 const expression = z.string().min(1).max(SQL_EXPRESSION_MAX_LENGTH);
+/**
+ * An npm package name, as the registry defines one: optionally scoped, lowercase, and with no
+ * subpath. Bounded at npm's own 214 characters.
+ */
+const packageName = z.string()
+    .regex(/^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/, 'must be an npm package name')
+    .max(214);
 const collation = z.enum(['binary', 'nocase', 'rtrim']);
 const referentialAction = z.enum(['noAction', 'restrict', 'cascade', 'setNull', 'setDefault']);
 const LOWERCASE_HEX = /^(?:[0-9a-f]{2})*$/;
@@ -275,13 +283,34 @@ export const applicationManifestSchema = z.strictObject({
     }).optional(),
     capabilities: z.array(z.enum(CAPABILITIES)).optional(),
     /**
-     * The client runtime selection (#212). Closed: only implemented provider/source combinations are
-     * accepted, and omitting any level of it normalizes to the platform-managed Preact runtime with
-     * identical semantics and build output.
+     * Dependencies the application accepts having no TypeScript declarations for.
+     *
+     * The one legal thing the open client zone could not express. A package that is declared,
+     * installed, and simply ships no declarations is not a mistake — plenty of working JavaScript never
+     * grew types — but it stops `xeer check` with a type error the application did not cause, and the
+     * repair used to be a hand-written declaration file plus a triple-slash reference, per package and
+     * per subpath. Naming the package here is that whole ritual: the compiler derives the ambient
+     * declarations, subpaths included, into the generated contract both tools read.
+     *
+     * Explicit and checked in, deliberately. What it buys is that the named package's exports are
+     * `any`, which is a hole in the guarantee every other rule here exists to make — so it belongs in a
+     * diff someone reviews, not in an inference. The compiler warns about an entry whose package does
+     * ship declarations, because an acknowledgment nobody removes is how this list would rot into a
+     * standing exemption.
+     *
+     * Package names rather than specifiers: one entry covers the package and everything under it, so
+     * there is nothing to add when an import reaches a new subpath.
+     */
+    untypedDependencies: z.array(packageName).optional(),
+    /**
+     * The client runtime selection (#212, #214). Closed: only implemented provider/source
+     * combinations are accepted, and omitting any level of it normalizes to the platform-managed
+     * Preact runtime with identical semantics and build output. A provider the platform has no
+     * renderer family for is refused here rather than surfacing later as an unresolvable JSX runtime.
      */
     client: z.strictObject({
         runtime: z.strictObject({
-            provider: z.literal('preact'),
+            provider: z.enum(CLIENT_RUNTIME_PROVIDERS),
             source: z.literal('platform').optional(),
         }).optional(),
     }).optional(),
@@ -363,6 +392,12 @@ export const applicationManifestJsonSchema = Object.freeze({
             ...describeProperty('capabilities', 'Powers granted to the application. Duplicate names are invalid.'),
             uniqueItems: true,
         },
+        untypedDependencies: {
+            ...describeProperty('untypedDependencies', 'Installed dependencies that ship no TypeScript declarations, acknowledged by name. Xeer '
+                + 'generates ambient declarations for each one and its subpaths, typed as any. Duplicate '
+                + 'names are invalid.'),
+            uniqueItems: true,
+        },
         budgets: describeProperty('budgets', 'Per-operation resource ceilings, each lowerable from platform defaults.'),
     },
     allOf: [
@@ -418,9 +453,25 @@ export function normalizeApplicationManifest(manifest) {
             }
             : null,
         capabilities: [...(manifest.capabilities ?? [])].sort(),
+        // Total, like `capabilities` and unlike `storage`: sorted, deduplicated, and `[]` when the
+        // manifest declares nothing, so every reader gets an array rather than a `?? []` of its own.
+        //
+        // The present-only-when-declared shape next door exists to protect `artifactId`, and that
+        // concern does not reach here: the artifact payload enumerates the manifest fields it carries
+        // rather than spreading the manifest, and this one is deliberately not among them. An
+        // acknowledgment is type-space only — it changes no byte of the bundle — so moving the artifact
+        // id of a bundle-identical application would be a plain lie about what shipped.
+        untypedDependencies: [...new Set(manifest.untypedDependencies ?? [])].sort(),
         // Always normalized: omission and the explicit default are the same statement, and everything
-        // downstream (compiler facts, artifact provenance) reads one canonical value.
-        client: { runtime: { provider: 'preact', source: 'platform' } },
+        // downstream (import policy, type resolution, artifact provenance) reads one canonical value.
+        // The declared provider is *carried*, not defaulted away — returning the default unconditionally
+        // is what let a declared React application build as Preact with no diagnostic anywhere (#214).
+        client: {
+            runtime: {
+                provider: manifest.client?.runtime?.provider ?? NORMALIZED_CLIENT_RUNTIME.provider,
+                source: manifest.client?.runtime?.source ?? NORMALIZED_CLIENT_RUNTIME.source,
+            },
+        },
         budgets: {
             queryRows: manifest.budgets?.queryRows ?? 1_000,
             mutationWrites: manifest.budgets?.mutationWrites ?? 100,