@weft-js/cli 0.1.0 → 0.1.2

package/README.md

@@ -1,9 +1,9 @@
 # @weft-js/cli
 
-> **Early release (0.1.0).** APIs will change between minor versions.
+> **Early release (0.1.x).** APIs can change between minor versions.
 
-The `weft` command. It runs an app (`dev`, `build`, `start`), checks it (`check`, `tsc`, `fix`), serves its docs to people
-and agents (`docs`, `agents-md`, `mcp`) and manages plugins (`add`, `plugins`). An app made with `npm create @weft-js`
+The `weft` command. It runs an app (`dev`, `build`, `start`), checks it (`check`, `tsc`, `fix`, `audit`), ships it
+(`deploy`), serves its docs to people and agents (`docs`, `agents-md`, `mcp`) and manages plugins (`add`, `plugins`). An app made with `npm create @weft-js`
 already has it.
 
 ```bash
@@ -25,22 +25,28 @@ files, errors and warnings.
 | `fix [files…]` | Applies the safe autofixes |
 | `doctor` | Which compiler this install uses, whether Rust is around (it's optional), and what live data does on the target |
 | `dev [--port <n>]` | The dev server, for an app with `src/routes` |
-| `build [--runtime node\|bun\|deno] [--preset <p>]` | The production build, into `.output/` |
+| `build [--runtime node\|bun\|deno] [--preset <p>]` | The production build, into `.output/`. The built pages are then audited (L-codes), and an error fails the build |
 | `start [--runtime <r>]` | Runs the build |
+| `audit [routes…] [--url <u>]` | The built pages, or a running site, in a clean Chrome at phone and desktop widths: axe-core's WCAG rules, console errors, the head, sideways scroll and layout shift |
+| `deploy hosts` | Which hosts can run this app, why not, what each costs, and the one Weft suggests |
+| `deploy init [target]` | The host's files (`netlify.toml`, `fly.toml` and a Dockerfile…) and a GitHub workflow that checks and deploys on push |
+| `deploy [--prod] [--yes]` | Checks the fit, builds for the target and runs the host's own CLI: Netlify, Vercel, Cloudflare, Fly or Render. Without `--yes` it's a dry run |
 | `db generate [name]`, `db live`, `db listen` | A migration for schema changes; one with change triggers; the change feed as its own process |
 | `routes [--meta]` | The route table; `--meta` adds each route's metadata and H-diagnostics |
+| `surfaces` | The canvas and WebGL surfaces the project already defines |
 | `test --gate` | The test gate on the diff: fail-before, mutants on changed lines and no weakened tests |
 | `browser <cmd>` | Drives the running app: open, snapshot, act, assert and more (`weft browser help`) |
 | `docs [topic\|code]` | Prints a docs page or a diagnostic (`weft docs props`, `weft docs W014`) |
-| `agents-md [--check]` | Writes AGENTS.md from the installed weft; `--check` exits 1 when it's stale |
+| `agents-md [--check]` | Writes AGENTS.md from the installed Weft; `--check` exits 1 when it's stale |
 | `map [--stdout]` | Writes `.weft/map.md`: what to call in this app |
+| `icons publish <dir>` | Every icon and variant as static `.svg` files with a `manifest.json`, for a CDN |
 | `tasks`, `run <task>` | Lists commands and project tasks; runs a task from `weft.config.ts` |
 | `add <feature>` | Installs a plugin and wires it into the config; also `tailwind`, `auth`, `db` and `rust` |
 | `plugins [list\|explain\|sync\|audit\|approve]` | Plugins, their slots and permissions |
 | `style find\|explain\|matrix` | Style groups |
-| `tokens` | warp's resolved tokens as DTCG, in `.weft/tokens/` |
+| `tokens` | Warp's resolved tokens as DTCG, in `.weft/tokens/` |
 | `lsp` | A language server for editors, with inferred props |
-| `mcp` | These commands as MCP tools, on stdio |
+| `mcp` | An MCP server on stdio: `docs`, `check`, `audit`, `routes_meta`, `map`, `tasks`, `surfaces`, `style_find`, `style_explain`, `test_gate` and the `browser_*` tools |
 
 Every command takes `--root <dir>` (the working directory by default) and `--json`. JSON goes to stdout and text for
 people to stderr. Exit codes: 0 ok, 1 errors found (or a stale AGENTS.md under `--check`), 2 a usage or internal error.
@@ -48,8 +54,9 @@ people to stderr. Exit codes: 0 ok, 1 errors found (or a stale AGENTS.md under `
 ## Docs
 
 - `weft docs config`: `weft.config.ts` and every key in it.
-- `weft docs diagnostics`: every code, and which ones the installed weft reports.
+- `weft docs diagnostics`: every code, and which ones the installed Weft reports.
 - `weft docs verify`: `weft browser` and the test gate.
+- `weft docs deploy`: hosts, `weft deploy` and the E-codes.
 - `weft docs plugins`: writing a plugin.
 
 The source of each page is in [docs/](docs). Adding a diagnostic is in [CONTRIBUTING.md](../../CONTRIBUTING.md).
@@ -59,13 +66,23 @@ The source of each page is in [docs/](docs). Adding a diagnostic is in [CONTRIBU
 `check`, `tasks` and the MCP tools report the same shape:
 
 ```json
-{ "code": "W014", "severity": "error", "owner": "core", "file": "src/App.tsx",
-  "span": [21, 44, 21, 117], "offset": [867, 940],
-  "why": "`.map(p => ({ ...p, … }))` gives every item a new identity on each update…",
-  "fix": { "text": "Keep items stable … or replace only the item that changed." },
+{
+  "code": "W014",
+  "severity": "error",
+  "owner": "core",
+  "file": "src/App.tsx",
+  "span": [21, 44, 21, 117],
+  "offset": [867, 940],
+  "why": "Copying every item gives each a new identity.",
+  "fix": { "text": "Keep unchanged items stable." },
   "project": true,
-  "related": [{ "file": "src/components/ProductList.tsx", "span": [29, 10, 29, 10], "why": "rendered here as a keyed list" }],
-  "docs": "weft docs W014" }
+  "related": [{
+    "file": "src/components/ProductList.tsx",
+    "span": [29, 10, 29, 10],
+    "why": "rendered here as a keyed list"
+  }],
+  "docs": "weft docs W014"
+}
 ```
 
 - `span` is 1-based `[line, col, endLine, endCol]`, with columns in UTF-16 units. `offset` is UTF-16 indices into the
@@ -73,3 +90,10 @@ The source of each page is in [docs/](docs). Adding a diagnostic is in [CONTRIBU
 - `fix.edits` (`{ file, span, offset, text }`) is there when there's a mechanical change, and `fix.safe` says whether
   `weft fix` applies it without asking.
 - `project: true` marks a result that needed more than one file to find.
+
+## Links
+
+- [Source](https://github.com/Ravonus/weft/tree/main/packages/cli)
+- [Weft on GitHub](https://github.com/Ravonus/weft): the framework, the docs and every package
+- [Changelog](https://github.com/Ravonus/weft/blob/main/CHANGELOG.md)
+- [Issues](https://github.com/Ravonus/weft/issues)

package/bin/weft.mjs

@@ -4,5 +4,12 @@ import { main } from '../src/cli.mjs'
 // Not `exitCode`: an app's module can leave a pool open, and a finished command must still end.
 const code = await main(process.argv.slice(2))
 // A pipe holds about 64 KB: exiting first would cut off long --json output.
-await Promise.all([process.stdout, process.stderr].map(out => new Promise(done => { out.write('', done) })))
+await Promise.all(
+  [process.stdout, process.stderr].map(
+    (out) =>
+      new Promise((done) => {
+        out.write('', done)
+      }),
+  ),
+)
 process.exit(code)

package/docs/async.md

@@ -6,16 +6,26 @@ import { resource, Boundary } from '@weft-js/core'
 type User = { name: string }
 
 function Name({ id }: { id: string }) {
-  // `id` is read before the first `await`, so a new id fetches again and aborts the old request.
-  const user = resource(signal => fetch(`/api/users/${id}`, { signal }).then(r => r.json() as Promise<User>))
-  // `pending` is also true on a refetch, while the old value is still here: dim it rather than replace it (X033).
-  return <h1 aria-busy={user.pending ? 'true' : 'false'}>{user.value?.name}</h1>
+  // A new id refetches and aborts the old request.
+  const user = resource(signal =>
+    fetch(`/api/users/${id}`, { signal })
+      .then(r => r.json() as Promise<User>),
+  )
+  // On a refetch, dim the old value rather than replace it (X033).
+  return (
+    <h1 aria-busy={user.pending ? 'true' : 'false'}>
+      {user.value?.name}
+    </h1>
+  )
 }
 
-// The resource is made inside the Boundary (in Name), so the Boundary waits for it.
+// Name makes the resource inside the Boundary, which waits for it.
 export function Profile({ id }: { id: string }) {
   return (
-    <Boundary pending={<p>Loading…</p>} error={(e, retry) => <button onClick={retry}>Retry</button>}>
+    <Boundary
+      pending={<p>Loading…</p>}
+      error={(e, retry) => <button onClick={retry}>Retry</button>}
+    >
       <Name id={id} />
     </Boundary>
   )

package/docs/browser.md

@@ -2,20 +2,34 @@
 
 ```tsx
 import { state } from '@weft-js/core'
-import { online, visible, lifecycle, media, on, interval } from '@weft-js/core/browser'
+import {
+  online,
+  visible,
+  lifecycle,
+  media,
+  on,
+  interval,
+} from '@weft-js/core/browser'
 
 export function Toolbar() {
-  const isOnline = online()                                         // Derived<boolean>; server: true
-  const shown = visible()                                           // Derived<boolean>; server: true
-  const page = lifecycle()                                          // 'active' | 'passive' | 'hidden' | 'frozen' | 'terminated'
-  const dark = media('(prefers-color-scheme: dark)', { ssr: false }) // server renders `ssr`
+  const isOnline = online() // Derived<boolean>; server: true
+  const shown = visible() // Derived<boolean>; server: true
+  // 'active' | 'passive' | 'hidden' | 'frozen' | 'terminated'
+  const page = lifecycle()
+  // Server renders `ssr`.
+  const dark = media('(prefers-color-scheme: dark)', { ssr: false })
   const open = state(true)
   const now = state(Date.now())
-  on(window, 'keydown', e => { if (e.key === 'Escape') open.value = false })  // e: KeyboardEvent
-  interval('1s', () => { now.value = Date.now() })                  // also '500ms', '5m', '1h', or a number of ms
+  on(window, 'keydown', e => { // e: KeyboardEvent
+    if (e.key === 'Escape') open.value = false
+  })
+  // Also '500ms', '5m', '1h', or a number of ms.
+  interval('1s', () => { now.value = Date.now() })
   return (
     <p hidden={!open.value}>
-      {isOnline.value ? 'online' : 'offline'}, {dark.value ? 'dark' : 'light'}, {shown.value ? page.value : 'hidden'},
+      {isOnline.value ? 'online' : 'offline'}{', '}
+      {dark.value ? 'dark' : 'light'}{', '}
+      {shown.value ? page.value : 'hidden'},
       {new Date(now.value).toLocaleTimeString()}
     </p>
   )

package/docs/config.md

@@ -12,24 +12,41 @@ import { dialScript, warp } from '@weft-js/warp/plugin'
 export default defineConfig({
   scope: { write: ['src/**', 'test/**'], forbid: ['.env*'] },
   tasks: {
-    seed: { run: 'node scripts/seed.mjs', description: 'Load demo products into the dev db', sideEffects: ['db'], env: ['dev'] },
+    seed: {
+      run: 'node scripts/seed.mjs',
+      description: 'Load demo products into the dev db',
+      sideEffects: ['db'], env: ['dev'],
+    },
   },
   environments: { dev: { url: 'http://localhost:5173' } },
-  site: {        // page metadata defaults: static tags in the server's first response (weft docs meta)
+  // Metadata defaults: static tags in the first response.
+  // See weft docs meta.
+  site: {
     name: 'Acme',
     url: 'https://acme.dev',
     title: '%s · Acme',
     description: 'Tools for builders.',
     locale: 'en_US',
-    image: { url: '/og.png', width: 1200, height: 630 },   // default 'auto': a generated card (weft docs meta); false: none
+    // Default 'auto': generated card; false: none (weft docs meta).
+    image: { url: '/og.png', width: 1200, height: 630 },
     twitter: { card: 'summary_large_image', site: '@acme' },
-    inlineCss: false, // default true: each page carries what its first paint needs; false keeps plain links
-    criticalCss: false, // default true: one hashed sheet plus a first-paint part; false splits by chunk and inlines up to 48 KB
-    criticalKeep: ['theme-x'], // words of selectors a first paint keeps, for classes a head script sets
-    head: dialScript, // raw HTML in every page's head, before the stylesheets: dialScript from @weft-js/warp/plugin restores `setDial(…, { persist: true })` before the first paint
+    // Default true: first-paint CSS. False keeps plain links,
+    // as a strict CSP needs (D012).
+    inlineCss: false,
+    // Default true: one hashed sheet and first-paint CSS.
+    // False splits by chunk and inlines up to 48 KB.
+    criticalCss: false,
+    // Selector words to keep for classes set by a head script.
+    criticalKeep: ['theme-x'],
+    // Raw HTML before stylesheets on every page. dialScript from
+    // @weft-js/warp/plugin restores setDial(…, { persist: true })
+    // before the first paint.
+    head: dialScript,
   },
-  plugins: [warp()],   // plugin factories (@weft-js/core/plugin); a plain `{ name, provides }` entry is data only
-  slots: {},           // names the winner when two plugins provide one slot
+  // Plugin factories; plain { name, provides } entries are data.
+  plugins: [warp()],
+  // Names the winner when two plugins provide one slot.
+  slots: {},
 })
 ```
 
@@ -91,3 +108,16 @@ that hides itself or code in dependencies (your package manager's lockfile pins
 fixed code to hash, so it's audited on every check instead. A plugin defined in the config file is your own code:
 only its permissions are compared. A plugin is matched to its package by name, so one that claims another's name is
 hashed as that package.
+
+
+## Indexing intent
+
+For a site intended for public search, declare
+`build: { audit: { indexing: 'public' } }`. L024 then fails the build or audit if
+robots metadata or an HTTP X-Robots-Tag header says noindex. `private` or the
+backward-compatible `auto` leaves this a warning; neither removes a directive.
+After deployment, run `weft audit --url https://your-site.example --indexing public`:
+a host or proxy may add a header that a local build cannot see. Preserve intentional
+preview/private exclusions. A noindex finding is an indexing policy issue, not
+chat-agent traffic; use a clean profile before attributing other audit failures
+to application or framework code.

package/docs/core.md

@@ -0,0 +1,30 @@
+# Core entrypoints
+
+Import application APIs such as `state`, `derived`, `watch`, `context` and `createRoot`
+from `@weft-js/core`. Use the `State<T>` and `Derived<T>` types for boxes.
+
+`memo(fn)` returns a cached accessor, `() => T`. Call it to read the current value.
+It tracks the same dependencies as `derived(fn)` and recomputes when they change.
+
+```ts
+import { memo, state } from '@weft-js/core'
+
+const count = state(1)
+const twice = memo(() => count.value * 2)
+console.log(twice()) // 2
+```
+
+Compiler output and framework integrations use `@weft-js/core/internal`. This
+entrypoint re-exports the runtime's existing implementations and shares its graph,
+box constructors and server state. It does not create another runtime instance.
+
+The root no longer exports `DIRTY`, `rt`, `listener`, `read`, `reach`, `clean`,
+`setFlat`, `flat`, `collecting`, `runMounts`, `setKeyed`, `NONE`, `stats`,
+`devComponent` or `Box`. Integrations that require these use the internal entrypoint.
+Applications create boxes with `state` rather than constructing `Box`.
+
+`hole`, `localProps` and `restOf` also live under the internal entrypoint. `hole`
+tracks a renderer's child binding. `localProps` implements writable prop locals.
+`restOf` takes the prop snapshot used by a compiled native-element spread. These
+are compiler and renderer contracts, rather than application APIs. The `hole`
+export of `@weft-js/core/ssr` is a separate server-rendering helper.

package/docs/deploy.md

@@ -0,0 +1,108 @@
+# Deploy: from `weft build` to a live URL
+
+weft reads what the app uses and says which hosts can run it, before a build and before an account exists. Then it
+writes the host's files and a workflow, and `weft deploy` runs the host's own CLI and reports the URL.
+
+```bash
+# Host fit, cost and suggestion
+weft deploy hosts
+# Host files, GitHub workflow and deploy config
+weft deploy init
+# Dry run: build and commands that --yes would run
+weft deploy
+# Preview; add --prod for production
+weft deploy --yes
+```
+
+`weft deploy` without `--yes` runs nothing. An agent runs the dry run on its own, and asks before `--yes`: a deploy
+publishes, and a host may bill for it. Nothing in weft creates a site, an app, a volume or a DNS record; `init` prints the
+one command per host that does, for you to run.
+
+## Which host
+
+| The app uses | Netlify / Vercel | Cloudflare | Fly / Render |
+|---|---|---|---|
+| pages, queries, mutations, forms, `stream()` | ✓ | ✓ | ✓ |
+| `channel`, `sharedState`, `realtime({ share })` | ✗ E001 | ✓ (Durable Objects) | ✓ |
+| `.live({ required })`, `remote()` sidecars | ✗ E002 | ✗ E002 | ✓ |
+| a SQLite file, media uploads | ✗ E003 | ✗ E003 | with a volume or disk (billed) |
+| `changes` without an external listener | degraded (R014) | degraded | ✓ |
+
+The suggestion: Netlify when nothing needs a server that stays up (a CDN with functions is the cheapest and fastest
+host), Cloudflare when channels are all that need one, Fly when data must last on disk, else Fly or Render.
+
+A function host blocked by a channel has a third way, the split: pages on the function host, realtime on a small server.
+It needs a second origin and a cookie both can read, and is designed (research 46 §10), not built.
+
+## `deploy` in weft.config.ts
+
+```ts
+deploy: {
+  // netlify | vercel | cloudflare | fly | render
+  target: 'fly',
+  fly: {
+    app: 'shop',
+    region: 'iad',
+    volume: { name: 'data', sizeGb: 1 },
+  },
+  ci: 'github', // the workflow; false for none
+  branch: 'main',
+  cdn: {
+    proxy: 'cloudflare',
+    images: { provider: 'cloudinary', cloud: 'shop' },
+  },
+}
+```
+
+Names, regions and sizes only. Every token comes from the environment, and one written into the config, a host file or a
+workflow is **E008**. With `deploy.target` set, `weft build` builds for it, and `weft check` reports E001–E003 for it.
+
+A volume or disk mounts at `/app/.data`: SQLite's default `file:.data/app.db` is already there, and uploads go to
+`.data/media` (`WEFT_MEDIA_DIR`).
+
+## What each target writes and runs
+
+| Target | Files | `weft deploy --yes` runs | Reads |
+|---|---|---|---|
+| netlify | `netlify.toml` | `weft build --preset netlify`, `netlify deploy --dir dist --functions .netlify/functions-internal --json` | `NETLIFY_AUTH_TOKEN`, `NETLIFY_SITE_ID` |
+| vercel | `vercel.json` | `weft build --preset vercel`, `vercel deploy --prebuilt` | `VERCEL_TOKEN`, `VERCEL_ORG_ID`, `VERCEL_PROJECT_ID` |
+| cloudflare | `wrangler.toml` | `weft build --preset cloudflare_durable`, `wrangler deploy` in `.output/` | `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID` |
+| fly | `fly.toml`, `Dockerfile`, `.dockerignore` | `flyctl deploy --remote-only` (Fly builds the image) | `FLY_API_TOKEN` |
+| render | `render.yaml`, `Dockerfile`, `.dockerignore` | the deploy hook (Render builds the pushed commit) | `RENDER_DEPLOY_HOOK_URL` |
+
+Every target also gets `.github/workflows/weft-deploy.yml`: on push to `branch`, install, `weft check`, then `weft deploy
+--yes --prod`; on a pull request, a preview where the host has them. Add the variables as repository secrets (`gh secret
+set NAME`). Netlify, Vercel and Cloudflare deploy what was built, so build where the host runs: the workflow builds on
+Linux, and a native addon built on a Mac is **E004**.
+
+Each written file starts with `# weft deploy init <target>, sha <hash>`. Change the config and `weft check` reports the
+file as stale (**E006**); `init` rewrites it. A file you edited keeps its old hash, and `init` leaves it alone unless
+`--force`.
+
+## CDN and media
+
+- **Cloudflare in front of a server host** (`cdn.proxy: 'cloudflare'`): proxy the domain to the Fly or Render origin.
+  Hashed assets are already `immutable`, and pages are `private` unless a route caches, so the proxy can't serve one
+  user's page to another. E010: `site.url` is still the host's own domain. E011: a proxy in front of a CDN host.
+- **Cloudinary for uploads** (`cdn.images`): checked (E012 without `@weft-js/plugin-media`, E013 without a cloud or with
+  two), not yet wired: uploads still go to the media server's disk (E014). `?media` imports never need it: the build
+  already makes sized AVIF and WebP files that any CDN serves.
+
+## Codes
+
+E001 sockets on a function host, E002 a held process or a sidecar, E003 data on a disk that doesn't last, E004 a native
+addon deployed from another OS, E005 no target (with the suggestion), E006 a stale host file, E007 an unset variable,
+E008 a written credential, E009 the memory bus on many instances, E010–E014 CDN and media. `weft docs E003` explains one.
+
+
+## Indexing intent
+
+For a site intended for public search, declare
+`build: { audit: { indexing: 'public' } }`. L024 then fails the build or audit if
+robots metadata or an HTTP X-Robots-Tag header says noindex. `private` or the
+backward-compatible `auto` leaves this a warning; neither removes a directive.
+After deployment, run `weft audit --url https://your-site.example --indexing public`:
+a host or proxy may add a header that a local build cannot see. Preserve intentional
+preview/private exclusions. A noindex finding is an indexing policy issue, not
+chat-agent traffic; use a clean profile before attributing other audit failures
+to application or framework code.

package/docs/design.md

@@ -4,7 +4,15 @@ An app with warp has one design language: `@weft-js/warp`'s primitives and compo
 is, and the look follows the theme, the dials and the density.
 
 ```tsx
-import { Button, Card, Heading, Input, Row, Stack, Text } from '@weft-js/warp'
+import {
+  Button,
+  Card,
+  Heading,
+  Input,
+  Row,
+  Stack,
+  Text,
+} from '@weft-js/warp'
 
 export function Billing() {
   return (
@@ -85,13 +93,14 @@ In every app:
 | D038 | Two solid Buttons side by side | One primary action per region |
 | D039 | `<html>` with no `lang` | Set it |
 
-D010 is warp's contrast gate on the seed and tokens. D020–D025 are style groups.
+D010 is warp's contrast gate on the seed and tokens: `weft build` stops on it. D012 is a CSP that blocks the inlined CSS. D020–D025 are style groups.
 
 `// weft-allow D001: <reason>` on the line above keeps one site; the reason is required. `check: { design: false }` in
 the config turns these off.
 
 ## Tokens
 
-The theme is `warp({ seed, dials, radius, fonts, tokens })`: every value goes through the contrast check. `weft tokens`
+The theme is `warp({ seed, dials, fields, radius, fonts, tokens })`: every value goes through the contrast check. `weft docs theme`
+has worked looks and the button channels. `weft tokens`
 writes the resolved tokens to `.weft/tokens/` as DTCG 2025.10, one file per theme × expression plus a resolver, for
 Figma, Style Dictionary or Terrazzo.

package/docs/entrypoints.md

@@ -0,0 +1,79 @@
+# Core and Start entrypoints
+
+These paths are retained package exports. Node tooling must not enter a browser bundle.
+The snapshots cover export paths, targets and conditions, not names or signatures.
+
+## @weft-js/core
+
+- `@weft-js/core`: Application reactive runtime and components.
+- `@weft-js/core/internal`: Compiler and renderer contract; shares the runtime graph, not an app API.
+- `@weft-js/core/keyed`: Keyed state helpers.
+- `@weft-js/core/jsx-runtime`: JSX types for compiler output; types only.
+- `@weft-js/core/dom`: Browser DOM rendering and hydration; other helpers serve compiler output.
+- `@weft-js/core/ssr`: Server rendering and compiler helpers.
+- `@weft-js/core/head`: Browser route metadata updates.
+- `@weft-js/core/test`: Test utilities; requires the test peers.
+- `@weft-js/core/test/plugins`: Plugin conformance test suites; browser layout tests need a browser.
+- `@weft-js/core/persist`: State persistence.
+- `@weft-js/core/history`: State history.
+- `@weft-js/core/sync`: State synchronization.
+- `@weft-js/core/interaction`: Interaction state.
+- `@weft-js/core/browser`: Browser APIs and browser state.
+- `@weft-js/core/style`: Style groups and styling helpers.
+- `@weft-js/core/ds`: Design system primitives.
+- `@weft-js/core/media`: Media components and helpers.
+- `@weft-js/core/shape`: Shape components and helpers.
+- `@weft-js/core/text`: Text components and helpers.
+- `@weft-js/core/surface`: Surface components and helpers.
+- `@weft-js/core/media-probe`: Media probing for tooling; Node entry.
+- `@weft-js/core/client`: Client type declarations only; no runtime condition.
+- `@weft-js/core/style/matrix`: Style matrix tooling; Node entry.
+- `@weft-js/core/hydration`: Hydration tooling; Node entry.
+- `@weft-js/core/markup`: Shared markup helpers and types.
+- `@weft-js/core/node-purge`: Node cache purge tooling.
+- `@weft-js/core/hmr`: Compiler-generated development hot updates.
+- `@weft-js/core/plugin`: Plugin declarations and runtime helpers.
+- `@weft-js/core/devtools`: Development tools.
+- `@weft-js/core/agent`: In-page development agent; requires testing peers.
+- `@weft-js/core/config`: Configuration declarations and runtime helpers.
+- `@weft-js/core/vite`: Vite plugin; Node tooling.
+- `@weft-js/core/compiler`: Compiler binding; Node tooling and native or WASM compiler.
+
+## @weft-js/start
+
+- `@weft-js/start`: Application server functions, forms and routing APIs.
+- `@weft-js/start/data`: Server function and data primitives.
+- `@weft-js/start/derive`: Server-side page metadata derivation.
+- `@weft-js/start/media`: Media schema and asset types.
+- `@weft-js/start/hub`: Realtime hub and topics; server.
+- `@weft-js/start/live`: Streams and live queries.
+- `@weft-js/start/bus`: Realtime bus interfaces.
+- `@weft-js/start/changes`: Database change feeds; server.
+- `@weft-js/start/changes-sql`: SQL for database change triggers; server tooling.
+- `@weft-js/start/live-target`: Live target capability checks; Node tooling.
+- `@weft-js/start/listen`: Database change listener; server.
+- `@weft-js/start/verify`: Live verification; server tooling.
+- `@weft-js/start/bus/postgres`: Postgres realtime bus; server, requires Postgres.
+- `@weft-js/start/list`: List queries and helpers.
+- `@weft-js/start/list/drizzle`: Drizzle list integration; requires Drizzle.
+- `@weft-js/start/channel`: Realtime channels.
+- `@weft-js/start/share`: Shared state.
+- `@weft-js/start/db`: Drizzle schema helpers; requires Drizzle.
+- `@weft-js/start/db/core`: Database interfaces and core helpers.
+- `@weft-js/start/db/sqlite`: SQLite database adapter.
+- `@weft-js/start/db/postgres`: Postgres database adapter; requires Postgres driver.
+- `@weft-js/start/db/mysql`: MySQL database adapter; requires MySQL driver.
+- `@weft-js/start/auth`: Authentication provider interface.
+- `@weft-js/start/auth/better-auth`: Better Auth integration; requires Better Auth.
+- `@weft-js/start/auth/drizzle`: Drizzle authentication integration; requires Drizzle.
+- `@weft-js/start/extension`: Server extension contract.
+- `@weft-js/start/client`: Client application bootstrap; browser.
+- `@weft-js/start/server`: Server application rendering and request handling.
+- `@weft-js/start/vite`: Start Vite plugin; Node tooling.
+- `@weft-js/start/routes`: Route manifest tooling.
+- `@weft-js/start/og`: Open Graph image tooling; server.
+- `@weft-js/start/app`: Development and build application tooling; Node.
+- `@weft-js/start/inspect`: Route metadata inspection; Node tooling.
+- `@weft-js/start/contract`: Server function contract generation; Node tooling.
+- `@weft-js/start/rust`: Rust remote function support.
+- `@weft-js/start/sidecar`: Rust sidecar supervisor; Node tooling.

package/docs/fonts.md

@@ -10,8 +10,18 @@ export default defineConfig({
   plugins: [
     text({
       fonts: {
-        body: { family: 'Inter', src: 'assets/fonts/inter.woff2', fallback: 'Arial', axes: { wght: [100, 900] } },
-        display: { family: 'Fraunces', src: 'assets/fonts/fraunces.woff2', fallback: 'Georgia', weight: 700 },
+        body: {
+          family: 'Inter',
+          src: 'assets/fonts/inter.woff2',
+          fallback: 'Arial',
+          axes: { wght: [100, 900] },
+        },
+        display: {
+          family: 'Fraunces',
+          src: 'assets/fonts/fraunces.woff2',
+          fallback: 'Georgia',
+          weight: 700,
+        },
       },
     }),
   ],

package/docs/icons.md

@@ -12,20 +12,24 @@ Three forms, and all three build to the same bytes:
 import { CheckIcon } from '@weft-js/warp-icons'
 <CheckIcon />
 
-import Icons from '@weft-js/warp-icons'           // or: import * as Icons
+// Or: import * as Icons
+import Icons from '@weft-js/warp-icons'
 <Icons.Check />
 
-import { Icon } from '@weft-js/warp'         // or: '@weft-js/warp-icons/icon'
+// Or import from '@weft-js/warp-icons/icon'.
+import { Icon } from '@weft-js/warp'
 <Icon name="check" />
 ```
 
 Props on any of them:
 
 ```tsx
-<CheckIcon />                 // decorative: aria-hidden, focusable="false"
+// Decorative: aria-hidden, focusable="false"
+<CheckIcon />
 <CheckIcon label="Saved" />   // role="img" with that name
 <CheckIcon size={24} />       // otherwise warp's icon sizes apply
-<CheckIcon tier="vivid" />    // this tier whatever the page's expression is
+// This tier regardless of the page's expression.
+<CheckIcon tier="vivid" />
 ```
 
 An icon you don't use costs nothing. One adds about 164 B of brotli with all tiers in. `sideEffects` lists only CSS, so a named import ships that icon.
@@ -41,7 +45,7 @@ One scheme, generated from the art with its types:
 | `BellIconSolid` | `Icons.BellSolid` | `solid` | the solid form |
 | `BellIconAction` | `Icons.BellAction` | `action` | has a built-in animation |
 
-The tier is a prop, never a name. An open mark, like an arrow, has a notched badge as its solid, with the mark cut out. Pick it on the sheet: `npm run sheet` in the package writes `contact-sheet.html`, with tier, variant, size, theme and search. `dither-sheet.html` compares the treatments.
+The tier is a prop, never a name. Hollow and solid describe the object: an open mark like an arrow is an outlined arrow in hollow and a filled one in solid, never a badge. Pick it on the sheet: `npm run sheet` in the package writes `contact-sheet.html`, with tier, variant, size, theme and search. `dither-sheet.html` compares the treatments.
 
 ## A wrong name
 
@@ -69,9 +73,11 @@ A remote icon renders an empty `<svg data-icon data-loading>` of the right size
 Five icons have a built-in animation: `trash` (the lid lifts), `bell` (it rings), `check` (it draws on), `refresh` (it spins), `copy` (the sheet stacks).
 
 ```tsx
-<Icon name="trash" action />          // hover, focus and press, on the icon or its parent
+// Hover, focus and press on the icon or its parent.
+<Icon name="trash" action />
 <Icon name="refresh" action="on" />   // now; refresh keeps spinning
-<TrashIconAction action="press" />    // 'hover' | 'focus' | 'press' | 'on'
+// 'hover' | 'focus' | 'press' | 'on'
+<TrashIconAction action="press" />
 ```
 
 It's CSS alone, and each one's stylesheet ships only if that icon is used (about 230 B of CSS and 50 B of JS, brotli). Outlines ease; pixels move in whole cells, in frames. warp's motion dial and `prefers-reduced-motion` turn it off. An action on another icon is I001.

package/docs/lists.md

@@ -11,7 +11,9 @@
   every row re-runs on every change (1 DOM write, hundreds of re-runs). Replace only what changed:
 
   ```ts
-  products.value = products.value.map(p => (p.id === id ? { ...p, price } : p))
+  products.value = products.value.map(p =>
+    p.id === id ? { ...p, price } : p,
+  )
   ```
 
   The compiler sees this inside one file; `weft check` follows the box through props into other files.

package/docs/meta.md

@@ -11,7 +11,11 @@ on what the reader gets, from what is on the page:
 ```tsx
 import type { Meta } from '@weft-js/start'
 
-export const meta: Meta = { title: 'Pricing', description: 'Three plans, billed monthly, and what each one includes.' }
+export const meta: Meta = {
+  title: 'Pricing',
+  description: 'Three plans, billed monthly, ' +
+    'and what each one includes.',
+}
 ```
 
 On a param route, build it from `data` and `params`, so each page says what it is:
@@ -22,8 +26,14 @@ On a param route, build it from `data` and `params`, so each page says what it i
 import { notFound, type LoadArgs, type Meta } from '@weft-js/start'
 import { getUser } from '#/server/users'
 
-export const load = async ({ params }: LoadArgs<'/users/[id]'>) => (await getUser.fetch({ id: params.id })) ?? notFound()
-export const meta: Meta<typeof load> = ({ data }) => ({ title: data.name, description: data.bio })
+export const load = async ({ params }: LoadArgs<'/users/[id]'>) => {
+  const user = await getUser.fetch({ id: params.id })
+  return user ?? notFound()
+}
+export const meta: Meta<typeof load> = ({ data }) => ({
+  title: data.name,
+  description: data.bio,
+})
 ```
 
 `meta` is plain data: it runs once per request after the loaders and before the first byte. It can't read a box (H006)