vitral 0.3.0 → 0.4.0

package/dist/react.d.ts

@@ -1,9 +1,9 @@
 import { ReactNode, ComponentType } from 'react';
 import { L as Loading, P as Prefetch } from './host-slot-Cz6EiGsB.js';
 import * as JSXRuntime from 'react/jsx-runtime';
-import { P as Props, I as Isolation, C as CheckedProps, a as RemoteModule, S as Shared, R as RemoteContext } from './types-Czvm-siZ.js';
-export { E as EventBus } from './types-Czvm-siZ.js';
-export { e as events } from './events-D5gs7rff.js';
+import { P as Props, I as Isolation, C as CheckedProps, a as RemoteModule, S as Shared, R as RemoteContext } from './types-CA2p9KHC.js';
+export { E as EventBus } from './types-CA2p9KHC.js';
+export { e as events } from './events-Dkpkw_Sv.js';
 import './errors-kjBv6IH_.js';
 
 /**

package/dist/react.js

@@ -1,18 +1,18 @@
 "use client";
 import {
   hostSlot
-} from "./chunk-IHTUM6LT.js";
+} from "./chunk-W6322KGP.js";
 import {
   defineRemote,
   events,
   memoSelect,
   same,
   shared
-} from "./chunk-I3VSKSAZ.js";
-import "./chunk-TD4S3IHA.js";
-import "./chunk-ZAC6QQI6.js";
-import "./chunk-GNHCZRQP.js";
-import "./chunk-AKNNHQ2H.js";
+} from "./chunk-WD4CDGDZ.js";
+import "./chunk-EMSB2NVX.js";
+import "./chunk-6EX5KYT5.js";
+import "./chunk-TW7KYJQ6.js";
+import "./chunk-463H6B56.js";
 import {
   protocol
 } from "./chunk-GNPFWISJ.js";

package/dist/routes.d.ts

@@ -1,5 +1,5 @@
-import { P as Props } from './types-Czvm-siZ.js';
-import { S as SlotStatus } from './slot-DqXTwGbs.js';
+import { P as Props } from './types-CA2p9KHC.js';
+import { S as SlotStatus } from './slot-UPg6ob9v.js';
 import './errors-kjBv6IH_.js';
 
 /** Padrão de URL → nome do remote. A primeira rota que bate vence. */

package/dist/routes.js

@@ -1,11 +1,11 @@
 import {
   createSlot,
   navigate
-} from "./chunk-I3VSKSAZ.js";
-import "./chunk-TD4S3IHA.js";
-import "./chunk-ZAC6QQI6.js";
-import "./chunk-GNHCZRQP.js";
-import "./chunk-AKNNHQ2H.js";
+} from "./chunk-WD4CDGDZ.js";
+import "./chunk-EMSB2NVX.js";
+import "./chunk-6EX5KYT5.js";
+import "./chunk-TW7KYJQ6.js";
+import "./chunk-463H6B56.js";
 import "./chunk-GNPFWISJ.js";
 
 // src/routes.ts

package/dist/{shadow-6HELCHCJ.js → shadow-PVSETNMZ.js}

@@ -1,9 +1,9 @@
 import {
   fetchCssText,
   injectCss
-} from "./chunk-ZAC6QQI6.js";
-import "./chunk-GNHCZRQP.js";
-import "./chunk-AKNNHQ2H.js";
+} from "./chunk-6EX5KYT5.js";
+import "./chunk-TW7KYJQ6.js";
+import "./chunk-463H6B56.js";
 import "./chunk-GNPFWISJ.js";
 
 // src/core/shadow.ts
@@ -23,6 +23,66 @@ function prefetch(r, priority) {
   for (const u of urls) fetchCssText(u, r.sri?.[u], priority).catch(noop);
   injectCss(global, null, r.sri);
 }
+async function attachShadowRoot(target, make, r, global = {}, local = {}) {
+  const name = make().getAttribute("data-vitral-root");
+  let registry = registryFor(name);
+  let root = target.shadowRoot;
+  if (!root && !fake(registry))
+    try {
+      root = target.attachShadow({ mode: "open", customElementRegistry: registry });
+    } catch {
+      broken = true;
+      registries.delete(name);
+      registry = registryFor(name);
+    }
+  root ??= target.attachShadow({ mode: "open" });
+  const own = root.customElementRegistry ?? registry;
+  let el = make();
+  if (!fake(own))
+    try {
+      el = make({ customElementRegistry: own });
+    } catch {
+    }
+  root.appendChild(el);
+  return [...await attachStyles(root, el, r, global, local), root, own, el];
+}
+var registries = /* @__PURE__ */ new Map();
+var broken = false;
+var fake = (registry) => Object.getPrototypeOf(registry) === customElements;
+var owners = /* @__PURE__ */ new Map();
+function registryFor(name) {
+  let registry = registries.get(name);
+  if (registry) return registry;
+  let real = customElements;
+  if (!broken && "initialize" in CustomElementRegistry.prototype)
+    try {
+      real = new CustomElementRegistry();
+    } catch {
+      broken = true;
+    }
+  const shared = real === customElements;
+  const own = registry = shared ? Object.create(real) : real;
+  if (shared) {
+    for (const k of ["get", "getName", "upgrade", "whenDefined"]) if (k in real) own[k] = real[k].bind(real);
+  }
+  const define = real.define;
+  own.define = (tag, ctor, options) => {
+    const had = real.get(tag);
+    const owner = owners.get(tag);
+    if (!had) return shared && owners.set(tag, name), define.call(real, tag, ctor, options);
+    if (shared && had !== ctor && owner !== name && dev())
+      console.warn(`[vitral] ${name}: <${tag}> j\xE1 foi definido por ${owner ?? "outro c\xF3digo"}; fica essa defini\xE7\xE3o. Sem Scoped Custom Element Registries, os remotes dividem o registro global.`);
+  };
+  registries.set(name, registry);
+  return registry;
+}
+function dev() {
+  try {
+    return process.env.NODE_ENV !== "production";
+  } catch {
+    return false;
+  }
+}
 async function attachStyles(root, el, r, global = {}, local = {}) {
   const sri = r.sri ?? {};
   const [css, ready, up] = plan(r);
@@ -93,6 +153,7 @@ function mirrorTheme(el) {
   return () => observer.disconnect();
 }
 export {
-  attachStyles,
-  prefetch
+  attachShadowRoot,
+  prefetch,
+  registryFor
 };

package/dist/single-spa.d.ts

@@ -0,0 +1,40 @@
+import { P as Props, a as RemoteModule } from './types-CA2p9KHC.js';
+import './errors-kjBv6IH_.js';
+
+/**
+ * App do single-spa como remote do vitral, sem reescrever o app:
+ *
+ *   // src/vitral-remote.js
+ *   import { singleSpaRemote } from 'vitral/single-spa'
+ *   import * as lifecycles from './main' // exporta bootstrap, mount e unmount
+ *
+ *   export default singleSpaRemote(lifecycles)
+ *
+ * Funciona com os lifecycles de `single-spa-react`, `single-spa-vue`,
+ * `single-spa-angular` etc. e com lifecycles escritos à mão. Os lifecycles
+ * recebem as props do host mais `name` e `domElement` (o elemento do remote).
+ */
+
+/** Um lifecycle do single-spa: uma função ou uma lista delas, em sequência. */
+type SingleSpaLifecycle = ((props: any) => unknown) | ((props: any) => unknown)[];
+/** O que um app ou parcel do single-spa exporta. */
+interface SingleSpaLifecycles {
+    bootstrap?: SingleSpaLifecycle;
+    mount: SingleSpaLifecycle;
+    unmount: SingleSpaLifecycle;
+    update?: SingleSpaLifecycle;
+}
+/**
+ * Embrulha os lifecycles de um app do single-spa no contrato `mount`.
+ *
+ * - `bootstrap` roda uma vez, antes do primeiro `mount`.
+ * - Os lifecycles nunca se sobrepõem: um `mount` espera o `unmount` anterior.
+ * - `update(props)` chama o `update` do app (parcels); sem ele, o app é
+ *   desmontado e montado de novo com as props novas.
+ * - Duas instâncias ao mesmo tempo recebem `name` diferentes (`conta`, `conta-2`).
+ */
+declare function singleSpaRemote<P extends Props = Props>(lifecycles: SingleSpaLifecycles | {
+    default: SingleSpaLifecycles;
+}): RemoteModule<P>;
+
+export { type SingleSpaLifecycle, type SingleSpaLifecycles, singleSpaRemote };

package/dist/single-spa.js

@@ -0,0 +1,52 @@
+// src/single-spa.ts
+async function run(fns, props) {
+  for (const fn of [fns ?? []].flat()) await fn(props);
+}
+function singleSpaRemote(lifecycles) {
+  const l = "mount" in lifecycles ? lifecycles : lifecycles.default;
+  if (typeof l?.mount == "undefined" || typeof l.unmount == "undefined") throw new Error("[vitral] singleSpaRemote: faltam os lifecycles mount e unmount");
+  let booted;
+  let queue = Promise.resolve();
+  const used = /* @__PURE__ */ new Set();
+  const step = (fn) => queue = queue.then(fn, fn);
+  const boot = (props) => booted ??= run(l.bootstrap, props).catch((e) => {
+    booted = void 0;
+    throw e;
+  });
+  return {
+    async mount(el, props, ctx) {
+      let name = ctx.name;
+      for (let i = 2; used.has(name); i++) name = `${ctx.name}-${i}`;
+      used.add(name);
+      let current = { ...props, name, domElement: el };
+      try {
+        await step(async () => {
+          await boot(current);
+          await run(l.mount, current);
+        });
+      } catch (e) {
+        used.delete(name);
+        throw e;
+      }
+      const report = (e) => ctx.reportError(e);
+      return {
+        update(next) {
+          const before = current;
+          current = { ...next, name, domElement: el };
+          const job = l.update ? step(() => run(l.update, current)) : step(async () => {
+            await run(l.unmount, before);
+            await run(l.mount, current);
+          });
+          job.catch(report);
+        },
+        unmount() {
+          used.delete(name);
+          step(() => run(l.unmount, current)).catch(report);
+        }
+      };
+    }
+  };
+}
+export {
+  singleSpaRemote
+};

package/dist/{slot-DqXTwGbs.d.ts → slot-UPg6ob9v.d.ts}

@@ -1,5 +1,5 @@
 import { R as RemoteError } from './errors-kjBv6IH_.js';
-import { P as Props, I as Isolation, b as StyleOptions } from './types-Czvm-siZ.js';
+import { P as Props, I as Isolation, d as StyleOptions } from './types-CA2p9KHC.js';
 
 type SlotStatus = 'loading' | 'ready' | 'error';
 interface SlotOptions<P extends Props = Props> {

package/dist/solid.d.ts

@@ -1,8 +1,8 @@
 import { JSX, Component, Accessor } from 'solid-js';
-import { P as Props, I as Isolation, C as CheckedProps, a as RemoteModule, S as Shared } from './types-Czvm-siZ.js';
-export { R as RemoteContext } from './types-Czvm-siZ.js';
+import { P as Props, I as Isolation, C as CheckedProps, a as RemoteModule, S as Shared } from './types-CA2p9KHC.js';
+export { R as RemoteContext } from './types-CA2p9KHC.js';
 import { R as RemoteError } from './errors-kjBv6IH_.js';
-export { e as events } from './events-D5gs7rff.js';
+export { e as events } from './events-Dkpkw_Sv.js';
 export { n as navigate } from './navigate-BRG1WJUM.js';
 import { L as Loading, P as Prefetch } from './host-slot-Cz6EiGsB.js';
 

package/dist/solid.js

@@ -1,6 +1,6 @@
 import {
   hostSlot
-} from "./chunk-IHTUM6LT.js";
+} from "./chunk-W6322KGP.js";
 import {
   defineRemote,
   events,
@@ -8,11 +8,11 @@ import {
   navigate,
   same,
   shared
-} from "./chunk-I3VSKSAZ.js";
-import "./chunk-TD4S3IHA.js";
-import "./chunk-ZAC6QQI6.js";
-import "./chunk-GNHCZRQP.js";
-import "./chunk-AKNNHQ2H.js";
+} from "./chunk-WD4CDGDZ.js";
+import "./chunk-EMSB2NVX.js";
+import "./chunk-6EX5KYT5.js";
+import "./chunk-TW7KYJQ6.js";
+import "./chunk-463H6B56.js";
 import "./chunk-GNPFWISJ.js";
 
 // src/solid.ts

package/dist/{sri-JMX6JLQP.js → sri-M7ZRU57G.js}

@@ -1,14 +1,14 @@
 import {
   verifyIntegrity
-} from "./chunk-AH7KNMBW.js";
+} from "./chunk-UYOPJ4XQ.js";
 import {
   addLink,
   fetchBytes,
   withTimeout
-} from "./chunk-GNHCZRQP.js";
+} from "./chunk-TW7KYJQ6.js";
 import {
   RemoteError
-} from "./chunk-AKNNHQ2H.js";
+} from "./chunk-463H6B56.js";
 import "./chunk-GNPFWISJ.js";
 
 // src/core/sri.ts
@@ -41,7 +41,24 @@ var STRICT = /^(sha(256|384|512)-[A-Za-z0-9+/]+={0,2}( +|$))+$/;
 var PROBE = "data:text/javascript,export{}";
 var PROBE_SRI = "sha256-d3bjIZdvLjBurwdLwkSVOnEBPFFly+T1SR9r3VVHBGg=";
 var maps;
+var probing;
 var preloads;
+var KEY = "vitral:sri-map";
+async function useMap(sri) {
+  if (probing) return await probing && addMap(sri, false);
+  let seen = false;
+  try {
+    seen = localStorage[KEY] === navigator.userAgent;
+  } catch {
+  }
+  const ok = await (probing = addMap(sri, !seen));
+  if (ok && !seen)
+    try {
+      localStorage[KEY] = navigator.userAgent;
+    } catch {
+    }
+  return ok;
+}
 var tick = () => new Promise((resolve) => {
   const c = new MessageChannel();
   c.port1.onmessage = () => resolve();
@@ -65,7 +82,7 @@ async function verified(build, run) {
         }
       });
   };
-  if (maps !== false && (maps = await addMap(sri))) {
+  if (maps !== false && (maps = await useMap(sri))) {
     await share();
     for (const u of chunks) fetch(u, { priority }).catch(() => {
     });
@@ -78,7 +95,12 @@ async function verified(build, run) {
     return entry;
   }
 }
-async function addMap(integrity) {
+async function addMap(sri, probe) {
+  if (!HTMLScriptElement.supports?.("importmap")) return false;
+  const integrity = {};
+  for (const u in sri) if (!/\.css([?#]|$)/.test(u)) integrity[u] = sri[u];
+  const urls = probe ? ["export{}", "export{}//"].map((c) => URL.createObjectURL(new Blob([c], { type: "text/javascript" }))) : [];
+  for (const u of urls) integrity[u] = PROBE_SRI;
   let ok = true;
   try {
     const s = document.createElement("script");
@@ -88,11 +110,17 @@ async function addMap(integrity) {
     s.addEventListener("securitypolicyviolation", () => ok = false);
     s.textContent = JSON.stringify({ integrity });
     document.head.append(s);
+    await tick();
+    await tick();
+    if (ok && probe) ok = await check((u) => import(
+      /* @vite-ignore */
+      /* webpackIgnore: true */
+      u
+    ), urls[0], urls[1]);
   } catch {
-    return false;
+    ok = false;
   }
-  await tick();
-  await tick();
+  for (const u of urls) URL.revokeObjectURL(u);
   return ok;
 }
 function preload(href, integrity, fetchPriority = "auto") {
@@ -104,9 +132,11 @@ function preload(href, integrity, fetchPriority = "auto") {
 }
 function checkPreloads() {
   if (!document.createElement("link").relList.supports("modulepreload")) return Promise.resolve(false);
-  const run = (href, good) => preload(href, PROBE_SRI).then(() => good, () => !good);
+  return check((href) => preload(href, PROBE_SRI), PROBE, PROBE + "//");
+}
+function check(load, good, bad) {
   return Promise.race([
-    Promise.all([run(PROBE, true), run(PROBE + "//", false)]).then(([a, b]) => a && b),
+    Promise.all([load(good).then(() => true, () => false), load(bad).then(() => false, () => true)]).then(([a, b]) => a && b),
     new Promise((resolve) => setTimeout(resolve, 3e3, false))
   ]);
 }

package/dist/svelte.d.ts

@@ -1,9 +1,9 @@
 import { Component } from 'svelte';
-import { P as Props, I as Isolation, a as RemoteModule } from './types-Czvm-siZ.js';
-export { R as RemoteContext } from './types-Czvm-siZ.js';
+import { P as Props, I as Isolation, a as RemoteModule } from './types-CA2p9KHC.js';
+export { R as RemoteContext } from './types-CA2p9KHC.js';
 import { R as RemoteError } from './errors-kjBv6IH_.js';
-import { S as SlotStatus } from './slot-DqXTwGbs.js';
-export { e as events } from './events-D5gs7rff.js';
+import { S as SlotStatus } from './slot-UPg6ob9v.js';
+export { e as events } from './events-Dkpkw_Sv.js';
 export { n as navigate } from './navigate-BRG1WJUM.js';
 import { L as Loading, P as Prefetch } from './host-slot-Cz6EiGsB.js';
 

package/dist/svelte.js

@@ -1,15 +1,15 @@
 import {
   hostSlot
-} from "./chunk-IHTUM6LT.js";
+} from "./chunk-W6322KGP.js";
 import {
   defineRemote,
   events,
   navigate
-} from "./chunk-I3VSKSAZ.js";
-import "./chunk-TD4S3IHA.js";
-import "./chunk-ZAC6QQI6.js";
-import "./chunk-GNHCZRQP.js";
-import "./chunk-AKNNHQ2H.js";
+} from "./chunk-WD4CDGDZ.js";
+import "./chunk-EMSB2NVX.js";
+import "./chunk-6EX5KYT5.js";
+import "./chunk-TW7KYJQ6.js";
+import "./chunk-463H6B56.js";
 import "./chunk-GNPFWISJ.js";
 
 // src/svelte.ts

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { P as Props, R as RemoteContext } from './types-Czvm-siZ.js';
+import { P as Props, R as RemoteContext } from './types-CA2p9KHC.js';
 export { r as resetVitral } from './state-BDdCwc21.js';
 import './errors-kjBv6IH_.js';
 

package/dist/testing.js

@@ -1,10 +1,10 @@
-import "./chunk-I3VSKSAZ.js";
+import "./chunk-WD4CDGDZ.js";
 import {
   register
-} from "./chunk-TD4S3IHA.js";
-import "./chunk-ZAC6QQI6.js";
-import "./chunk-GNHCZRQP.js";
-import "./chunk-AKNNHQ2H.js";
+} from "./chunk-EMSB2NVX.js";
+import "./chunk-6EX5KYT5.js";
+import "./chunk-TW7KYJQ6.js";
+import "./chunk-463H6B56.js";
 import {
   resetProtocol
 } from "./chunk-GNPFWISJ.js";

package/dist/{types-Czvm-siZ.d.ts → types-CA2p9KHC.d.ts}

@@ -99,6 +99,17 @@ interface RemoteContext {
      * Hosts antigos não mandam este campo.
      */
     portalContainer?: HTMLElement;
+    /**
+     * Registro de custom elements do remote. No Shadow DOM, onde o navegador
+     * tem Scoped Custom Element Registries (Chrome 146+, Safari 26+), é um
+     * registro só deste remote, usado pelo shadow root e pelo elemento `el`:
+     * dois remotes podem definir `<ds-button>` de versões diferentes. Sem
+     * suporte, e fora do Shadow DOM, é o `customElements` global. No Shadow
+     * DOM, `define` de uma tag já definida não lança: fica a definição que já
+     * existe, com um aviso em dev quando ela veio de outro remote. Hosts
+     * antigos não mandam este campo: use `ctx.customElements ?? customElements`.
+     */
+    customElements?: CustomElementRegistry;
     /** Avisa o host de um erro em tempo de execução (os adaptadores já chamam). */
     reportError(error: unknown): void;
     /** Navega a página inteira (host e todos os roteadores) para `url`. */
@@ -124,6 +135,21 @@ interface RemoteContext {
      * (`provide`, `shared` ou um hook); senão, importe `shared` de 'vitral'.
      */
     shared?: SharedApi;
+    /**
+     * Só quando o remote roda como MCP App (`vitral({ target: 'mcp-app' })`):
+     * fala JSON-RPC direto com o host MCP, para o que `events` não cobre
+     * (`tools/call`, `resources/read`, `ui/request-display-mode`…).
+     */
+    mcp?: McpAppBridge;
+}
+/** `ctx.mcp` de um remote empacotado como MCP App. */
+interface McpAppBridge {
+    /** Pedido ao host; resolve com `result` ou rejeita com `error.message`. */
+    request<T = unknown>(method: string, params?: Record<string, unknown>): Promise<T>;
+    /** Notificação ao host (sem resposta). */
+    notify(method: string, params?: Record<string, unknown>): void;
+    /** O `hostContext` atual (tema, idioma, tamanho do container…), já com as mudanças. */
+    hostContext(): Record<string, unknown> | undefined;
 }
 interface MountedRemote<P extends Props = Props> {
     update?(props: P): void;
@@ -149,7 +175,7 @@ interface RemoteEntry {
     /** Isolamento padrão para este remote. */
     isolate?: Isolation;
     /**
-     * O `vitral.json` já baixado (ex.: por `vitral registry`), para não buscá-lo
+     * O `vitral.json` já baixado (ex.: no build do host), para não buscá-lo
      * na hora. Os caminhos dele são relativos a `url`, e os hashes ficam fixos
      * no host.
      */
@@ -159,6 +185,60 @@ interface RemoteEntry {
      * Vence a de `configure`. Veja `VitralConfig.contract`.
      */
     contract?: string;
+    /**
+     * Com `url` apontando para um canal (`canal.json`): escolhe a versão deste
+     * usuário. Devolve a versão (`'1.5.0'`) ou a URL de um `vitral.json`;
+     * `undefined` usa a regra padrão (`canary.percent`). Veja `Channel`.
+     */
+    resolve?: (channel: Channel, ctx: ChannelContext) => string | undefined | Promise<string | undefined>;
+    /**
+     * Volta para a estável, até o fim da sessão, quando a versão que não é a
+     * estável gera `errors` erros numa janela de `mounts` montagens. Padrão
+     * `{ errors: 3, mounts: 20 }`. `false` desliga.
+     */
+    rollback?: {
+        errors?: number;
+        mounts?: number;
+    } | false;
+}
+/**
+ * Arquivo-ponteiro de um remote (o canal, ex.: `canal.json`): diz que versão
+ * cada usuário recebe. Cada versão fica na própria pasta, ao lado do canal
+ * (`'1.4.0'` → `1.4.0/vitral.json`), ou é a URL de um `vitral.json`.
+ *
+ *   { "stable": "1.4.0", "canary": { "version": "1.5.0", "percent": 10 } }
+ */
+interface Channel {
+    /** Versão de todos os usuários fora da canary. */
+    stable: string;
+    /** Versão nova para `percent`% dos usuários (0 a 100). */
+    canary?: {
+        version: string;
+        percent: number;
+    };
+    /** Campos próprios, para o `resolve` do host ler (ex.: `"beta": "1.6.0"`). */
+    [key: string]: unknown;
+}
+/** O que o `resolve` de um canal recebe além do canal. */
+interface ChannelContext {
+    /** Nome do remote. */
+    name: string;
+    /**
+     * Número de 0 a 99, sempre o mesmo para este navegador (ou para
+     * `canaryKey`) e este remote. A regra padrão dá a canary a quem tem
+     * `bucket < percent`.
+     */
+    bucket: number;
+}
+/** Aviso de rollback automático, para `configure({ onRollback })`. */
+interface RollbackInfo {
+    name: string;
+    /** Versão abandonada (como o canal ou o `resolve` a escreveram). */
+    from: string;
+    /** Versão estável, usada daqui até o fim da sessão. */
+    to: string;
+    errors: number;
+    mounts: number;
 }
 /**
  * `none`: CSS com escopo. `shadow`: Shadow DOM. `iframe`: iframe com
@@ -178,6 +258,15 @@ interface StyleOptions {
      */
     mirrorTheme?: boolean;
 }
+/** Opções de `configure({ devOverrides })`. */
+interface DevOverrides {
+    /**
+     * Modelo da URL de um apelido: `?vitral=checkout@pr-123` com
+     * `'https://{name}-{ref}.preview.empresa.com'` vira
+     * `https://checkout-pr-123.preview.empresa.com/vitral.json`.
+     */
+    preview?: string;
+}
 interface VitralConfig {
     /** Mapa nome → URL (ou entrada completa), ou a URL de um JSON com esse mapa. */
     remotes?: Record<string, string | RemoteEntry> | string;
@@ -196,9 +285,10 @@ interface VitralConfig {
      * Liga os overrides de desenvolvimento (`?vitral=nome@url` e
      * `localStorage['vitral:overrides']`) fora de localhost. Em localhost já
      * valem. Nunca ligue em produção: um link com `?vitral=` executaria código
-     * de qualquer origem.
+     * de qualquer origem. O objeto também liga e aceita `preview`, o modelo de
+     * URL dos apelidos (`?vitral=checkout@pr-123`).
      */
-    devOverrides?: boolean;
+    devOverrides?: boolean | DevOverrides;
     /** Estilos do host no Shadow DOM: `{ inherit: ['/assets/base.css'] }`. */
     styles?: StyleOptions;
     /** Recebe o tempo de cada etapa do carregamento (para RUM). */
@@ -232,6 +322,16 @@ interface VitralConfig {
      * conferido. `'*'` confere só as dependências.
      */
     contract?: string;
+    /**
+     * Chave estável do usuário (ex.: o id dele) para sortear quem recebe a
+     * canary de um canal. Padrão: um id aleatório guardado no `localStorage`.
+     */
+    canaryKey?: string;
+    /**
+     * Chamado quando a versão canary de um canal passa do limite de erros e o
+     * host volta para a estável (veja `RemoteEntry.rollback`).
+     */
+    onRollback?: (info: RollbackInfo) => void;
 }
 /** Módulos de um grupo de `dedupe`, por especificador (`'react-dom/client'`). */
 type SharedModules = Record<string, unknown>;
@@ -294,6 +394,14 @@ interface RemoteManifest {
      * antigos), o runtime faz esse trabalho em cada página.
      */
     shadow?: ShadowCss;
+    /**
+     * SBOM CycloneDX do remote (opção `sbom` do plugin): o arquivo, relativo
+     * ao manifesto, e o hash dele. O runtime não usa; é para auditoria.
+     */
+    sbom?: {
+        file: string;
+        integrity: string;
+    };
 }
 /** Contrato do remote no `vitral.json`. */
 interface RemoteContract {
@@ -324,4 +432,4 @@ interface EventBus {
     last<T = unknown>(type: string): T | undefined;
 }
 
-export { type CheckedProps as C, type EventBus as E, type Handler as H, type Isolation as I, type MountedRemote as M, type Props as P, type RemoteContext as R, type Shared as S, type VitralConfig as V, type RemoteModule as a, type StyleOptions as b, type RemoteEntry as c, type SharedValue as d, type PropsOf as e, type ProvideOptions as f, type ProvidedValue as g, type RemoteContract as h, type RemoteManifest as i, type RemoteMetric as j, type Remotes as k, type SharedApi as l, type SharedModules as m, type SharedType as n, batch as o, provide as p, shared as s };
+export { type CheckedProps as C, type DevOverrides as D, type EventBus as E, type Handler as H, type Isolation as I, type MountedRemote as M, type Props as P, type RemoteContext as R, type Shared as S, type VitralConfig as V, type RemoteModule as a, type SharedModules as b, type RemoteEntry as c, type StyleOptions as d, type SharedValue as e, type Channel as f, type ChannelContext as g, type McpAppBridge as h, type PropsOf as i, type ProvideOptions as j, type ProvidedValue as k, type RemoteContract as l, type RemoteManifest as m, type RemoteMetric as n, type Remotes as o, type RollbackInfo as p, type SharedApi as q, type SharedType as r, batch as s, provide as t, shared as u };

package/dist/vite.d.ts

@@ -80,6 +80,24 @@ interface VitralViteOptions extends CssBuildOptions {
     contract?: {
         version?: string;
     };
+    /**
+     * Gera `sbom.cdx.json` (CycloneDX 1.6) com os pacotes npm que entraram no
+     * bundle, e o `vitral.json` aponta para ele em `sbom`. Padrão: false.
+     */
+    sbom?: boolean;
+    /**
+     * `'mcp-app'`: o build gera só `mcp-app.html`, um HTML único com o JS e o
+     * CSS inline, para um servidor MCP servir como recurso `ui://` (MCP Apps).
+     * As notificações do host viram props e `ctx.events.emit` vira mensagem
+     * para o host. Não combina com `exposes`, `dedupe` nem `shared`.
+     */
+    target?: 'mcp-app';
+    /**
+     * Grava o build em uma pasta por versão (`dist/1.5.0/`), para publicar
+     * cada versão sem apagar as anteriores e escolher qual vale num canal
+     * (`canal.json`). Usa `version` (ou a do package.json). Padrão: false.
+     */
+    versionDir?: boolean;
 }
 declare function vitral(options?: VitralViteOptions): Plugin;