@impetik/xeer-mcp 0.2.18 → 0.2.20

package/vendor/spec/template-distribution.d.ts

@@ -0,0 +1,101 @@
+import { z } from 'zod';
+export declare const TEMPLATE_DISTRIBUTION_CATALOG_FORMAT: "xeer.template-distribution-catalog.v0";
+export declare const TEMPLATE_DISTRIBUTION_CATALOG_SCHEMA_URL: "https://docs.xeer.run/template-distribution-catalog-v0.schema.json";
+/** Exact semantic version: no range operator, no `v` prefix, no wildcard. */
+export declare const EXACT_VERSION_PATTERN: string;
+export declare const TEMPLATE_ARCHIVE_CHECKSUM_PATTERN: "^sha256:[a-f0-9]{64}$";
+/**
+ * One published template. The authored metadata is copied verbatim from `template.json`; everything
+ * else is produced by the release job that packed, deployed, and verified this exact artifact.
+ *
+ * `platformVersion` is the `@impetik/xeer` release the artifact was built and verified against, and
+ * it is pinned exactly rather than as a range so a consumer reproduces the template's inputs. It may
+ * trail the catalog's own `platformVersion`: when a template fails to republish, the catalog keeps
+ * serving that template's last-known-good entry instead of dropping it. It is never ahead of the
+ * catalog, because an entry cannot be built from a release the catalog has not reached.
+ */
+export declare const templateDistributionEntrySchema: z.ZodObject<{
+    previewUrl: z.ZodString;
+    platformVersion: z.ZodString;
+    artifactVersion: z.ZodString;
+    sourceArchive: z.ZodObject<{
+        url: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>;
+    author: z.ZodObject<{
+        name: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        database: "database";
+        storage: "storage";
+    }>>;
+    requiredSecrets: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodString;
+    }, z.core.$strict>>;
+    previewAppId: z.ZodString;
+    screenshots: z.ZodArray<z.ZodObject<{
+        url: z.ZodString;
+        alt: z.ZodString;
+    }, z.core.$strict>>;
+    title: z.ZodString;
+    description: z.ZodString;
+    category: z.ZodString;
+    tags: z.ZodArray<z.ZodString>;
+    keyHighlights: z.ZodArray<z.ZodString>;
+    id: z.ZodString;
+}, z.core.$strict>;
+export type TemplateDistributionEntryV0 = z.infer<typeof templateDistributionEntrySchema>;
+/**
+ * Versioned distribution catalog published atomically after a platform release. Entries are keyed by
+ * template id, sorted by codepoint so a regenerated catalog is byte-stable, and a template with no
+ * successful publication is simply absent. Quarantine and failure reporting stay in the release
+ * pipeline; the catalog only ever describes artifacts that were verified.
+ */
+export declare const templateDistributionCatalogSchema: z.ZodObject<{
+    format: z.ZodLiteral<"xeer.template-distribution-catalog.v0">;
+    platformVersion: z.ZodString;
+    generatedAt: z.ZodISODateTime;
+    templates: z.ZodArray<z.ZodObject<{
+        previewUrl: z.ZodString;
+        platformVersion: z.ZodString;
+        artifactVersion: z.ZodString;
+        sourceArchive: z.ZodObject<{
+            url: z.ZodString;
+            sha256: z.ZodString;
+        }, z.core.$strict>;
+        author: z.ZodObject<{
+            name: z.ZodString;
+            url: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        capabilities: z.ZodArray<z.ZodEnum<{
+            database: "database";
+            storage: "storage";
+        }>>;
+        requiredSecrets: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            description: z.ZodString;
+        }, z.core.$strict>>;
+        previewAppId: z.ZodString;
+        screenshots: z.ZodArray<z.ZodObject<{
+            url: z.ZodString;
+            alt: z.ZodString;
+        }, z.core.$strict>>;
+        title: z.ZodString;
+        description: z.ZodString;
+        category: z.ZodString;
+        tags: z.ZodArray<z.ZodString>;
+        keyHighlights: z.ZodArray<z.ZodString>;
+        id: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type TemplateDistributionCatalogV0 = z.infer<typeof templateDistributionCatalogSchema>;
+/**
+ * Orders two exact semantic versions by precedence. Build metadata is ignored and a prerelease sorts
+ * before its own release, so `1.0.0-rc.1 < 1.0.0`. Inputs must already satisfy `EXACT_VERSION_PATTERN`.
+ */
+export declare function compareExactVersions(left: string, right: string): number;
+export declare const templateDistributionCatalogJsonSchema: Readonly<Record<string, unknown>>;
+export declare function parseTemplateDistributionEntry(value: unknown): TemplateDistributionEntryV0;
+export declare function parseTemplateDistributionCatalog(value: unknown): TemplateDistributionCatalogV0;

package/vendor/spec/template-distribution.js

@@ -0,0 +1,158 @@
+import { z } from 'zod';
+import { checkTemplateMetadataUniqueness, templateAltTextSchema, templateIdentityShape, templateMetadataShape, templateSlugSchema, } from './template.js';
+export const TEMPLATE_DISTRIBUTION_CATALOG_FORMAT = 'xeer.template-distribution-catalog.v0';
+export const TEMPLATE_DISTRIBUTION_CATALOG_SCHEMA_URL = 'https://docs.xeer.run/template-distribution-catalog-v0.schema.json';
+/** Exact semantic version: no range operator, no `v` prefix, no wildcard. */
+export const EXACT_VERSION_PATTERN = '^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)'
+    + '(?:-(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*)?'
+    + '(?:\\+[0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*)?$';
+export const TEMPLATE_ARCHIVE_CHECKSUM_PATTERN = '^sha256:[a-f0-9]{64}$';
+const exactVersion = z.string().regex(new RegExp(EXACT_VERSION_PATTERN, 'u'), 'must be an exact semantic version, not a range');
+const httpsUrl = z.string().url().refine((value) => URL.parse(value)?.protocol === 'https:', 'must be an absolute https URL');
+const archiveChecksum = z.string().regex(new RegExp(TEMPLATE_ARCHIVE_CHECKSUM_PATTERN, 'u'), 'must be a sha256: digest with 64 lowercase hexadecimal characters');
+const distributedScreenshotSchema = z.strictObject({
+    url: httpsUrl,
+    alt: templateAltTextSchema,
+});
+const sourceArchiveSchema = z.strictObject({
+    url: httpsUrl,
+    sha256: archiveChecksum,
+});
+/**
+ * One published template. The authored metadata is copied verbatim from `template.json`; everything
+ * else is produced by the release job that packed, deployed, and verified this exact artifact.
+ *
+ * `platformVersion` is the `@impetik/xeer` release the artifact was built and verified against, and
+ * it is pinned exactly rather than as a range so a consumer reproduces the template's inputs. It may
+ * trail the catalog's own `platformVersion`: when a template fails to republish, the catalog keeps
+ * serving that template's last-known-good entry instead of dropping it. It is never ahead of the
+ * catalog, because an entry cannot be built from a release the catalog has not reached.
+ */
+export const templateDistributionEntrySchema = z.strictObject({
+    id: templateSlugSchema,
+    ...templateMetadataShape,
+    screenshots: z.array(distributedScreenshotSchema).min(1).max(8),
+    ...templateIdentityShape,
+    /** Live preview served by the first-party deployment of `previewAppId`, verified during release. */
+    previewUrl: httpsUrl,
+    platformVersion: exactVersion,
+    /** Release version of the template artifact itself, independent of the platform version. */
+    artifactVersion: exactVersion,
+    sourceArchive: sourceArchiveSchema,
+}).superRefine(checkTemplateMetadataUniqueness);
+/**
+ * Versioned distribution catalog published atomically after a platform release. Entries are keyed by
+ * template id, sorted by codepoint so a regenerated catalog is byte-stable, and a template with no
+ * successful publication is simply absent. Quarantine and failure reporting stay in the release
+ * pipeline; the catalog only ever describes artifacts that were verified.
+ */
+export const templateDistributionCatalogSchema = z.strictObject({
+    format: z.literal(TEMPLATE_DISTRIBUTION_CATALOG_FORMAT),
+    /** Platform release this catalog was published for; individual entries may still trail it. */
+    platformVersion: exactVersion,
+    generatedAt: z.iso.datetime(),
+    templates: z.array(templateDistributionEntrySchema).min(1).max(512),
+}).superRefine((catalog, ctx) => {
+    const previewIdentities = new Map();
+    for (const [index, entry] of catalog.templates.entries()) {
+        const previous = catalog.templates[index - 1];
+        if (previous?.id === entry.id) {
+            ctx.addIssue({ code: 'custom', path: ['templates', index, 'id'], message: 'template id is declared twice' });
+        }
+        else if (previous && entry.id < previous.id) {
+            ctx.addIssue({ code: 'custom', path: ['templates', index, 'id'], message: 'templates must be sorted by id' });
+        }
+        const owner = previewIdentities.get(entry.previewAppId);
+        if (owner !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['templates', index, 'previewAppId'],
+                message: `previewAppId is declared twice; templates[${owner}] already claims it`,
+            });
+        }
+        previewIdentities.set(entry.previewAppId, index);
+        if (compareExactVersions(entry.platformVersion, catalog.platformVersion) > 0) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['templates', index, 'platformVersion'],
+                message: 'must not be newer than the catalog platform version',
+            });
+        }
+    }
+});
+const identifiers = (prerelease) => (prerelease === '' ? [] : prerelease.split('.'));
+/**
+ * Orders two exact semantic versions by precedence. Build metadata is ignored and a prerelease sorts
+ * before its own release, so `1.0.0-rc.1 < 1.0.0`. Inputs must already satisfy `EXACT_VERSION_PATTERN`.
+ */
+export function compareExactVersions(left, right) {
+    const split = (version) => {
+        const withoutBuild = version.split('+', 1)[0];
+        const dash = withoutBuild.indexOf('-');
+        const core = dash === -1 ? withoutBuild : withoutBuild.slice(0, dash);
+        return {
+            core: core.split('.').map(Number),
+            prerelease: identifiers(dash === -1 ? '' : withoutBuild.slice(dash + 1)),
+        };
+    };
+    const a = split(left);
+    const b = split(right);
+    for (let index = 0; index < 3; index += 1) {
+        if (a.core[index] !== b.core[index])
+            return (a.core[index] ?? 0) < (b.core[index] ?? 0) ? -1 : 1;
+    }
+    if (a.prerelease.length === 0 || b.prerelease.length === 0) {
+        if (a.prerelease.length === b.prerelease.length)
+            return 0;
+        return a.prerelease.length === 0 ? 1 : -1;
+    }
+    for (let index = 0; index < Math.max(a.prerelease.length, b.prerelease.length); index += 1) {
+        const one = a.prerelease[index];
+        const other = b.prerelease[index];
+        if (one === undefined || other === undefined)
+            return one === undefined ? -1 : 1;
+        if (one === other)
+            continue;
+        const numeric = /^\d+$/u;
+        if (numeric.test(one) && numeric.test(other))
+            return Number(one) < Number(other) ? -1 : 1;
+        if (numeric.test(one) !== numeric.test(other))
+            return numeric.test(one) ? -1 : 1;
+        return one < other ? -1 : 1;
+    }
+    return 0;
+}
+const generatedCatalogJsonSchema = z.toJSONSchema(templateDistributionCatalogSchema);
+const generatedProperties = generatedCatalogJsonSchema.properties;
+export const templateDistributionCatalogJsonSchema = Object.freeze({
+    ...generatedCatalogJsonSchema,
+    $id: TEMPLATE_DISTRIBUTION_CATALOG_SCHEMA_URL,
+    title: 'Xeer template distribution catalog v0',
+    description: 'Released, verified template artifacts a consumer can download, verify, and deploy.',
+    properties: {
+        ...generatedProperties,
+        format: {
+            ...generatedProperties.format,
+            description: `Distribution protocol discriminator; exactly ${TEMPLATE_DISTRIBUTION_CATALOG_FORMAT}.`,
+        },
+        platformVersion: {
+            ...generatedProperties.platformVersion,
+            description: 'Exact @impetik/xeer release this catalog was published for.',
+        },
+        generatedAt: {
+            ...generatedProperties.generatedAt,
+            description: 'UTC instant the release job assembled this catalog.',
+        },
+        templates: {
+            ...generatedProperties.templates,
+            description: 'Verified entries sorted by template id; an entry may trail the catalog platform version.',
+            uniqueItems: true,
+        },
+    },
+});
+export function parseTemplateDistributionEntry(value) {
+    return templateDistributionEntrySchema.parse(value);
+}
+export function parseTemplateDistributionCatalog(value) {
+    return templateDistributionCatalogSchema.parse(value);
+}

package/vendor/spec/template.d.ts

@@ -1,18 +1,55 @@
 import { z } from 'zod';
 export declare const TEMPLATE_FORMAT: "xeer.template.v0";
 export declare const TEMPLATE_MANIFEST_SCHEMA_URL: "https://docs.xeer.run/template-v0.schema.json";
-export declare const templateManifestSchema: z.ZodObject<{
-    $schema: z.ZodOptional<z.ZodString>;
-    format: z.ZodLiteral<"xeer.template.v0">;
+/** Catalog identifier shape shared by template directory names and categories. */
+export declare const templateSlugSchema: z.ZodString;
+/** Alt text carried by a gallery image in either the source or the distribution catalog. */
+export declare const templateAltTextSchema: z.ZodString;
+/**
+ * Presentation metadata an author writes once and both catalogs repeat verbatim. Spread it ahead of
+ * the gallery so the source manifest and a distribution entry keep the same field order.
+ */
+export declare const templateMetadataShape: {
     title: z.ZodString;
     description: z.ZodString;
     category: z.ZodString;
     tags: z.ZodArray<z.ZodString>;
     keyHighlights: z.ZodArray<z.ZodString>;
-    screenshots: z.ZodArray<z.ZodObject<{
-        path: z.ZodString;
-        alt: z.ZodString;
+};
+/** Attribution, capability, and preview identity metadata that follows the gallery in both catalogs. */
+export declare const templateIdentityShape: {
+    author: z.ZodObject<{
+        name: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        database: "database";
+        storage: "storage";
+    }>>;
+    requiredSecrets: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodString;
     }, z.core.$strict>>;
+    previewAppId: z.ZodString;
+};
+/**
+ * Rejects facets an author repeated inside one template. Distribution entries reuse it so a
+ * duplicate reads identically whether it is caught at authoring time or at release time; the
+ * gallery is keyed by `path` in the source catalog and by `url` once screenshots are uploaded.
+ */
+export declare function checkTemplateMetadataUniqueness(metadata: {
+    readonly tags: readonly string[];
+    readonly keyHighlights: readonly string[];
+    readonly screenshots: readonly {
+        readonly path?: string;
+        readonly url?: string;
+    }[];
+    readonly capabilities: readonly string[];
+    readonly requiredSecrets: readonly {
+        readonly name: string;
+    }[];
+}, ctx: z.RefinementCtx): void;
+export declare const templateManifestSchema: z.ZodObject<{
     author: z.ZodObject<{
         name: z.ZodString;
         url: z.ZodOptional<z.ZodString>;
@@ -26,6 +63,17 @@ export declare const templateManifestSchema: z.ZodObject<{
         description: z.ZodString;
     }, z.core.$strict>>;
     previewAppId: z.ZodString;
+    screenshots: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        alt: z.ZodString;
+    }, z.core.$strict>>;
+    title: z.ZodString;
+    description: z.ZodString;
+    category: z.ZodString;
+    tags: z.ZodArray<z.ZodString>;
+    keyHighlights: z.ZodArray<z.ZodString>;
+    $schema: z.ZodOptional<z.ZodString>;
+    format: z.ZodLiteral<"xeer.template.v0">;
 }, z.core.$strict>;
 export type TemplateManifestV0 = z.infer<typeof templateManifestSchema>;
 export declare const templateManifestJsonSchema: Readonly<Record<string, unknown>>;

package/vendor/spec/template.js

@@ -5,7 +5,8 @@ export const TEMPLATE_MANIFEST_SCHEMA_URL = 'https://docs.xeer.run/template-v0.s
 const trimmed = (maximum) => z.string().min(1).max(maximum)
     .refine((value) => value === value.trim(), 'must not have leading or trailing whitespace')
     .refine((value) => !/[\u0000-\u001f\u007f]/u.test(value), 'must not contain control characters');
-const slug = z.string().regex(/^[a-z][a-z0-9-]{1,62}$/u, 'must be a lowercase slug between 2 and 63 characters');
+/** Catalog identifier shape shared by template directory names and categories. */
+export const templateSlugSchema = z.string().regex(/^[a-z][a-z0-9-]{1,62}$/u, 'must be a lowercase slug between 2 and 63 characters');
 const environmentName = z.string().regex(/^[A-Z][A-Z0-9_]{0,63}$/u, 'must be an uppercase environment variable name');
 const appId = z.string().regex(/^app_[A-Za-z0-9_-]{8,96}$/u, 'must be a valid Xeer appId');
 const screenshotPath = z.string().regex(/^screenshots\/(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*[A-Za-z0-9][A-Za-z0-9._-]*\.(?:avif|jpe?g|png|webp)$/u, 'must be a repository-local AVIF, JPEG, PNG, or WebP path under screenshots/');
@@ -17,24 +18,36 @@ const requiredSecretSchema = z.strictObject({
     name: environmentName,
     description: trimmed(200),
 });
+/** Alt text carried by a gallery image in either the source or the distribution catalog. */
+export const templateAltTextSchema = trimmed(200);
 const screenshotSchema = z.strictObject({
     path: screenshotPath,
-    alt: trimmed(200),
+    alt: templateAltTextSchema,
 });
-export const templateManifestSchema = z.strictObject({
-    $schema: z.string().url().optional(),
-    format: z.literal(TEMPLATE_FORMAT),
+/**
+ * Presentation metadata an author writes once and both catalogs repeat verbatim. Spread it ahead of
+ * the gallery so the source manifest and a distribution entry keep the same field order.
+ */
+export const templateMetadataShape = {
     title: trimmed(120),
     description: trimmed(300),
-    category: slug,
+    category: templateSlugSchema,
     tags: z.array(trimmed(40)).min(1).max(16),
     keyHighlights: z.array(trimmed(120)).min(1).max(8),
-    screenshots: z.array(screenshotSchema).min(1).max(8),
+};
+/** Attribution, capability, and preview identity metadata that follows the gallery in both catalogs. */
+export const templateIdentityShape = {
     author: authorSchema,
     capabilities: z.array(z.enum(CAPABILITIES)).max(CAPABILITIES.length),
     requiredSecrets: z.array(requiredSecretSchema).max(16),
     previewAppId: appId,
-}).superRefine((manifest, ctx) => {
+};
+/**
+ * Rejects facets an author repeated inside one template. Distribution entries reuse it so a
+ * duplicate reads identically whether it is caught at authoring time or at release time; the
+ * gallery is keyed by `path` in the source catalog and by `url` once screenshots are uploaded.
+ */
+export function checkTemplateMetadataUniqueness(metadata, ctx) {
     const unique = (values, path, label) => {
         const seen = new Set();
         for (const [index, value] of values.entries()) {
@@ -45,12 +58,19 @@ export const templateManifestSchema = z.strictObject({
             seen.add(normalized);
         }
     };
-    unique(manifest.tags, 'tags', 'tag');
-    unique(manifest.keyHighlights, 'keyHighlights', 'highlight');
-    unique(manifest.screenshots.map((screenshot) => screenshot.path), 'screenshots', 'screenshot');
-    unique(manifest.capabilities, 'capabilities', 'capability');
-    unique(manifest.requiredSecrets.map((secret) => secret.name), 'requiredSecrets', 'secret');
-});
+    unique(metadata.tags, 'tags', 'tag');
+    unique(metadata.keyHighlights, 'keyHighlights', 'highlight');
+    unique(metadata.screenshots.map((screenshot) => screenshot.path ?? screenshot.url ?? ''), 'screenshots', 'screenshot');
+    unique(metadata.capabilities, 'capabilities', 'capability');
+    unique(metadata.requiredSecrets.map((secret) => secret.name), 'requiredSecrets', 'secret');
+}
+export const templateManifestSchema = z.strictObject({
+    $schema: z.string().url().optional(),
+    format: z.literal(TEMPLATE_FORMAT),
+    ...templateMetadataShape,
+    screenshots: z.array(screenshotSchema).min(1).max(8),
+    ...templateIdentityShape,
+}).superRefine(checkTemplateMetadataUniqueness);
 const generatedTemplateManifestJsonSchema = z.toJSONSchema(templateManifestSchema);
 const generatedProperties = generatedTemplateManifestJsonSchema.properties;
 export const templateManifestJsonSchema = Object.freeze({

package/vendor/spec/tunnel.d.ts

@@ -7,6 +7,9 @@ export declare const TUNNEL_TICKET_HEADER: "x-xeer-tunnel-ticket";
 export declare const TUNNEL_CONTROL_HEADER: "x-xeer-tunnel-control";
 export declare const TUNNEL_SHARED_HEADER: "x-xeer-shared-dev";
 export declare const TUNNEL_SHARED_HOST_HEADER: "x-xeer-shared-host";
+/** Builder-only routes that a public shared-dev tunnel must hide at the relay boundary. */
+export declare const TUNNEL_SHARED_BLOCKED_PREFIXES: readonly ["/__admin", "/__xeer/admin", "/__xeer/manifest", "/__xeer/state", "/__xeer/logs", "/__xeer/export", "/__xeer/import", "/__open-in-editor", "/_xeer/auth/sign-in", "/_xeer/auth/sign-out", "/__vite", "/__inspect"];
+export declare function tunnelSharedPathBlocked(pathname: string): boolean;
 export declare const TUNNEL_PROFILES: readonly ["shared-dev", "raw-http"];
 export type TunnelProfile = (typeof TUNNEL_PROFILES)[number];
 export declare const TUNNEL_BINARY_HEADER_BYTES = 12;

package/vendor/spec/tunnel.js

@@ -7,6 +7,24 @@ export const TUNNEL_TICKET_HEADER = 'x-xeer-tunnel-ticket';
 export const TUNNEL_CONTROL_HEADER = 'x-xeer-tunnel-control';
 export const TUNNEL_SHARED_HEADER = 'x-xeer-shared-dev';
 export const TUNNEL_SHARED_HOST_HEADER = 'x-xeer-shared-host';
+/** Builder-only routes that a public shared-dev tunnel must hide at the relay boundary. */
+export const TUNNEL_SHARED_BLOCKED_PREFIXES = Object.freeze([
+    '/__admin',
+    '/__xeer/admin',
+    '/__xeer/manifest',
+    '/__xeer/state',
+    '/__xeer/logs',
+    '/__xeer/export',
+    '/__xeer/import',
+    '/__open-in-editor',
+    '/_xeer/auth/sign-in',
+    '/_xeer/auth/sign-out',
+    '/__vite',
+    '/__inspect',
+]);
+export function tunnelSharedPathBlocked(pathname) {
+    return TUNNEL_SHARED_BLOCKED_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+}
 export const TUNNEL_PROFILES = ['shared-dev', 'raw-http'];
 export const TUNNEL_BINARY_HEADER_BYTES = 12;
 export const TUNNEL_MAX_FRAME_PAYLOAD = 65_536;

package/vendor/spec/type-check-profile.d.ts

@@ -16,6 +16,7 @@
  * `"react-jsx"`, `lib` without the `lib.`/`.d.ts` affixes), which is what
  * `ts.convertCompilerOptionsFromJson` reads.
  */
+import { type ClientRuntimeProvider, type EntrypointTypesSource } from './import-policy.js';
 export declare const PLATFORM_TYPE_CHECK_COMPILER_OPTIONS: Readonly<{
     readonly allowJs: true;
     readonly allowArbitraryExtensions: true;
@@ -35,15 +36,71 @@ export declare const PLATFORM_TYPE_CHECK_COMPILER_OPTIONS: Readonly<{
     readonly verbatimModuleSyntax: true;
 }>;
 /**
- * The React-family editor mappings every scaffolded and template `tsconfig.json` carries. Each
- * target is a shim inside the installed platform package that re-exports the platform's
- * `preact/compat` surface, so the mapping resolves under npm hoisting and pnpm strictness alike.
+ * One editor mapping the platform generates a file for: the specifier an application writes, the
+ * classified anchor entrypoint whose declarations answer it, where those declarations live, and the
+ * module inside the platform package the row points at.
+ *
+ * The shim generator in the CLI package consumes exactly this. Everything it needs beyond the row is
+ * resolution — turning a types source into a file on disk — which is why the row carries the fact
+ * and not the path.
+ */
+export interface EditorResolutionRow {
+    readonly specifier: string;
+    readonly entrypoint: string;
+    readonly types: Exclude<EntrypointTypesSource, {
+        kind: 'none';
+    }>;
+    /** Relative to the platform package's `dist/`, without an extension. */
+    readonly module: string;
+}
+/**
+ * Every renderer mapping one provider's editor needs, derived from the family descriptor.
+ *
+ * Two rules, and both are the descriptor's rather than anyone's memory. **Completeness**: every
+ * specifier the import policy admits from the renderer family gets a row, alias keys included,
+ * because the policy is what decides whether an application may write the import and this table is
+ * what decides whether its editor can read it. Five hand-kept rows against twelve admitted
+ * specifiers is how `react-dom/server` came to be a clean `xeer check` beside a TS2307 in the same
+ * file, and ten unmapped `preact/*` entrypoints were the same defect one provider over (#277).
+ * **Honesty**: an entrypoint whose declarations exist nowhere gets no row, so both tools refuse it
+ * by construction — `scheduler` and `react-dom/profiling` under React, `preact/compat/scheduler` and
+ * the two `compat/server` spellings under Preact. A row inventing types for one of those would make
+ * an editor accept what `xeer check` rejects, which is the same divergence pointed the other way.
+ */
+export declare function rendererEditorRows(provider: ClientRuntimeProvider): readonly EditorResolutionRow[];
+/**
+ * The editor's resolution table for one UI provider — the `paths` block of a scaffolded
+ * `tsconfig.json`.
  *
  * Not part of {@link PLATFORM_TYPE_CHECK_COMPILER_OPTIONS}: the platform check answers the same
  * question through its module-resolution host instead, so this is the editor's half of one rule
  * rather than a second rule.
+ *
+ * Every target is a module *inside* the installed platform package, because both renderers are
+ * platform-sourced: applications never declare them, and only a path inside the installed package
+ * resolves under npm hoisting and pnpm strictness alike. One rule binds a row to the file it names —
+ * a mapping rewrites *every* matching specifier in the program, including the ones written in the
+ * file it points at, so the file a row names may never import that row's own specifier. It would
+ * resolve back onto itself and answer with an empty module: an editor with no renderer types at all.
+ * The generator in the CLI package is what keeps that true, and `editor-resolution.test.ts` there
+ * type-checks a scaffolded project through its own `tsconfig.json` to prove it.
+ *
+ * Keys are sorted, so the file's bytes depend on which rows exist rather than on the order two
+ * declarations happen to be written in.
+ */
+export declare function tsconfigPathsFor(provider: ClientRuntimeProvider): Readonly<Record<string, readonly string[]>>;
+/**
+ * The editor mappings a `tsconfig.json` carries under the **Preact** provider: the React-family
+ * names an application may write, aliased onto the platform's `preact/compat` surface, and Preact's
+ * own admitted entrypoints, which an application may equally write and whose editor rows were
+ * missing until #277.
  */
 export declare const REACT_COMPAT_TSCONFIG_PATHS: Readonly<Record<string, readonly string[]>>;
+/**
+ * The same mappings under the **React** provider, pointed at the renderer itself rather than at a
+ * compatibility layer — which is the whole point of selecting the provider.
+ */
+export declare const REACT_PROVIDER_TSCONFIG_PATHS: Readonly<Record<string, readonly string[]>>;
 /**
  * The files an application's `tsconfig.json` type-checks: sources, TypeScript tests, and the
  * generated contract.
@@ -63,5 +120,9 @@ export declare const APPLICATION_TSCONFIG_INCLUDE: readonly string[];
  * bytes. Serialized here rather than returned as an object because "the file the editor reads" is
  * what has to match, and two callers stringifying the same object with different options would
  * produce two different files.
+ *
+ * The provider changes `paths` and nothing else. Every rule the platform enforces is identical
+ * across providers — the choice is about which renderer a name resolves to, never about how strictly
+ * the code is judged — and the default keeps a Preact application's file byte-for-byte what it was.
  */
-export declare function applicationTsconfigDocument(): string;
+export declare function applicationTsconfigDocument(provider?: ClientRuntimeProvider): string;