diff --git a/docs/decisions/0001-stack.md b/docs/decisions/0001-stack.md new file mode 100644 index 0000000..227e7c7 --- /dev/null +++ b/docs/decisions/0001-stack.md @@ -0,0 +1,77 @@ +# ADR 0001: Framework and build runtime for Luma Web + +- Status: proposed — awaits independent security review of S00-002. +- Task / requirement: S00-002 / NFR-007. +- Date: 2026-10-15. +- Decision owner: auto-orchestrator-68a05c587e33 (orchestrator). +- Reviewer: assigned security role; acceptance and reviewer ID are not yet recorded. + +## Context and required capabilities + +Input: immutable NFR-007, accepted ADR 0000, architecture/contract registry and reviewed S00-011 registry remediation. Output: this bounded stack decision and one isolated rendering spike in `experiments/0001-stack`. Acceptance is exact versions, lockfile, actual clean install/build and documented license/runtime/browser limits. This selects browser UI and its build tooling, without selecting XMPP/OMEMO/media libraries, backend providers, routing/state libraries or shared schemas. + +Luma needs a client-rendered UI, typed application/adapter boundaries, static deployment and eventual browser workers. An SSR application server is unnecessary for this experiment: secrets and OMEMO remain in their separately defined client boundaries. A UI library does not validate those boundaries or guarantee encrypted interoperability. S01 still owns exact contracts; S00-003…010 retain their existing decisions. + +## Candidates and primary sources + +Primary documentation and public registry metadata read on 2026-10-15. Versions below were retrieved with `npm view`; only the selected stack was installed/built. No performance comparison is claimed. + +| Criterion | React + TypeScript + Vite | Vue + TypeScript + Vite | +| --- | --- | --- | +| Candidate UI | React / React DOM 19.3.1, MIT | Vue 3.5.44, MIT | +| Typed UI | TSX, `react-jsx`, native TypeScript JSX checking; React types 19.3.0 | Composition API / SFC; official Vite plugin 6.0.10 and vue-tsc 3.3.13, both MIT | +| Build / language | Vite 8.3.4, TypeScript 7.0.2 | Same Vite/TypeScript candidates; plugin peer range includes Vite 8 and Vue 3.5 | +| Application model | Explicit state updates and render functions; suitable for future typed commands/view models | Reactive refs and templates; also compatible with the architecture | +| Tooling tradeoff | One TypeScript checker for `.ts` and `.tsx`; plain Vite can build this spike without a React plugin | SFC compilation and template checking add separate tooling; Vue can also use render functions | +| Static hosting | Client bundle, no runtime Node server required | Client bundle, no runtime Node server required | +| Browser limits | Modern ESM browser target inherited from Vite; API support needs feature checks | Vue 3 targets modern browsers and excludes IE11; Vite limits also apply | +| Actual experiment | Clean install and strict typecheck/production build completed | Documentation/metadata comparison only; not installed or benchmarked | + +Sources: + +- [React's from-scratch setup](https://react.dev/learn/build-a-react-app-from-scratch) documents Vite as a build option and the additional application responsibilities of that approach. [createRoot](https://react.dev/reference/react-dom/client/createRoot) defines the DOM mounting API used here. +- [Vue quick start](https://vuejs.org/guide/quick-start.html) documents a Vite-based SPA, SFCs and optional TypeScript. [Vue FAQ](https://vuejs.org/about/faq.html) covers MIT licensing and modern-browser constraints. [Vue TypeScript tooling](https://vuejs.org/guide/typescript/overview.html) describes vue-tsc/template checking. +- [TypeScript JSX](https://www.typescriptlang.org/docs/handbook/jsx.html) defines TSX and automatic JSX runtime/type checking. +- [Vite getting started](https://vite.dev/guide/) documents framework templates and Node requirements. [Production build](https://vite.dev/guide/build.html) documents static output, browser targets and absence of automatic API polyfills. +- [Node release lifecycle](https://nodejs.org/en/about/previous-releases) identifies Node 24 as LTS and Node 26 as Current on this date. [Official Node 24.21.0 distribution](https://nodejs.org/dist/v24.21.0/) supplies runtime and checksums. +- [npm ci](https://docs.npmjs.com/cli/v11/commands/npm-ci/) defines lockfile-based clean installation, mismatch failure and removal of existing node_modules. +- Exact primary registry records: [React](https://registry.npmjs.org/react/19.3.1), [React DOM](https://registry.npmjs.org/react-dom/19.3.1), [Vue](https://registry.npmjs.org/vue/3.5.44), [Vite](https://registry.npmjs.org/vite/8.3.4), [TypeScript](https://registry.npmjs.org/typescript/7.0.2), [npm](https://registry.npmjs.org/npm/11.19.0), [Vue plugin](https://registry.npmjs.org/@vitejs%2fplugin-vue/6.0.10), [vue-tsc](https://registry.npmjs.org/vue-tsc/3.3.13). React type packages are pinned and their licenses recorded in the inventory. + +## Decision + +Propose React 19.3.1 / React DOM 19.3.1, TypeScript 7.0.2 and Vite 8.3.4, built with Node 24.21.0 LTS and its bundled npm 11.19.0. Use `.ts` for non-UI typed modules and `.tsx` for React UI; ESM imports and strict TypeScript checking. This is a project engineering choice, not a requirement imposed by the product specification. TSX keeps ordinary typed module imports and UI checks on the same compiler path, fitting the existing domain/application/ports boundaries. Vue is viable; no claim of React performance/security superiority is made. + +The six direct dependencies have exact versions, with no range operators. `package-lock.json` version 3 locks transitive/optional platform packages with registry URLs and integrity. `.nvmrc`, exact engines, packageManager and the build runtime guard establish tool pins; `.npmrc` requires strict engines and verified HTTPS. Node and npm are build tools; they are not a browser runtime or a selected push gateway stack. Lockfile updates require explicit review, not automatic floating upgrades. + +No React Compiler, Babel, React refresh plugin, router, state store, service worker or polyfill is introduced. Vite's built-in TSX transform is sufficient for this spike, as verified by the build. Production development tooling and CI are subsequent scoped tasks; adding plugins requires license/API/browser checks. TypeScript 7 installs a platform compiler package; unsupported build-host platforms need a separate verified runtime/tooling decision. + +## Focused experiment and actual result + +The spike mounts a heading, an explicit local-experiment notice, an Increment button and a live counter through createRoot/useState. It contains no account fixture or transport and has no external runtime asset/CDN requests. See its README for exact reproduction and manual browser procedure. + +Verified on macOS ARM64 using the official Node tarball downloaded over normal HTTPS and matched against SHASUMS256.txt. The tarball SHA-256 is `bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057`. This is checksum verification against the same vendor HTTPS origin, not detached-signature verification. Node was unpacked only under `/private/tmp`; system tools/configuration were unchanged. + +- `npm install --ignore-scripts --no-audit --no-fund` generated the lockfile (24 installed packages). +- `npm ci --ignore-scripts --no-audit --no-fund` with a new empty cache performed the actual clean install; exit 0, 24 packages. Existing node_modules was replaced by npm ci. Optional native packages supplied prebuilt binaries; lifecycle scripts stayed disabled. +- `npm run build` with the exact pinned tools performed strict `tsc --noEmit` and Vite production build; exit 0 before and after clean install. Output: 14 transformed modules; index HTML 0.29 kB, JavaScript 219.87 kB (68.75 kB gzip). These sizes describe this spike, not a product budget. +- The two build outputs and lockfile had identical SHA-256 hashes on this host. This demonstrates a local repeated build, not cross-OS bit-for-bit reproducibility. +- Loopback `npm run preview` served HTML and the byte-matching JavaScript artifact with HTTP 200; this was an HTTP smoke check, not browser execution. The preview process was stopped. +- `make check`: exit 0, 276 tasks / 22 stages / 221 requirements / 211 Web requirements; 66 tooling tests passed. It verifies the foundation, not the application. + +No browser was available: in-app browser creation returned unavailable and browser inventory was empty. Interactive DOM rendering/click behavior is therefore an external check, not reported as passed. The card's mandatory clean install/build checks passed; release browser functionality still needs actual browser evidence in its assigned tasks. No XMPP/crypto/media/provider interoperability is implied. + +## License / security / browser constraints + +React, React DOM, their type packages and Vite use MIT; TypeScript uses Apache-2.0; Node uses MIT with bundled third-party notices; npm uses Artistic-2.0 with its own dependency licenses. React DOM requires React ^19.3.1; the selected exact version satisfies it. Vite 8.3.4 requires Node ^20.19.0 or >=22.12.0, TypeScript requires >=16.20.0, and npm 11.19.0 requires ^20.17.0 or >=22.9.0. Node 24.21.0 meets all selected requirements; do not choose EOL Node 20 merely because an engine range permits it. + +The full locked inventory is in `experiments/0001-stack/LICENSE_INVENTORY.md`, including uninstalled optional platforms. Transitives include ISC, BSD-3-Clause, Apache-2.0 and MPL-2.0 (Lightning CSS build-time binaries). Build tools are not browser runtime dependencies; modified MPL-covered files would require their applicable source obligations on distribution. Browser-bundled React/React DOM/Scheduler copyright/license texts are preserved in `THIRD_PARTY_NOTICES.md`. Runtime distributions retain their original Node/npm notices. Future release packaging must collect notices for its actual full dependency graph; this inventory is not a license approval for future libraries. + +The explicit syntax target is Chrome/Edge 111, Firefox 114, Safari 16.4, matching the documented Vite 8 baseline. These are compiler floors, not the accepted product test matrix (S00-006). There are no API polyfills: ESM/dynamic import/import.meta, DOM and appropriate JS built-ins must be available. WebCrypto/IndexedDB/WebRTC/notifications/permissions/storage quota must be checked independently; HTTPS/WSS and secure contexts remain mandatory in deployed use. Neither UI library makes closed-tab sockets or continuous media possible. + +The loopback HTTP dev/preview server serves only this synthetic local UI. It does not connect to production endpoints and is not a workaround for TLS, certificates, crypto or CORS. No unsafe HTML insertion, secrets, environment credentials, analytics or real conversation data is present. Lock integrity does not prove provenance or absence of vulnerabilities; dependency monitoring/advisory review remains a continuing release responsibility. + +## Consequences and migration triggers + +After separate acceptance, downstream tasks may create stack-specific `.ts`/`.tsx` modules within their own cards, establish application CI/build and implement reviewed S01 contracts. No other module, plan definition, requirement snapshot or shared contract is changed here. The reviewed registry-access probe is retained unchanged. + +A need for validated older browsers, unavailable native build-host packages, an incompatible required crypto/protocol dependency, or unacceptable measured UI behavior triggers a new bounded ADR/plan change and experiment. Do not replace this stack or introduce plaintext/stub fallbacks silently. A future revision may select Vue after real evidence; the unbuilt candidate is not represented as tested. Reviewer should verify exact pins/lock integrity/license notices, reproduce clean install/build, assess stated limits and record acceptance before consumers treat this ADR as accepted. diff --git a/experiments/0001-stack/.gitignore b/experiments/0001-stack/.gitignore new file mode 100644 index 0000000..b947077 --- /dev/null +++ b/experiments/0001-stack/.gitignore @@ -0,0 +1,2 @@ +node_modules/ +dist/ diff --git a/experiments/0001-stack/.npmrc b/experiments/0001-stack/.npmrc new file mode 100644 index 0000000..88dff60 --- /dev/null +++ b/experiments/0001-stack/.npmrc @@ -0,0 +1,4 @@ +engine-strict=true +save-exact=true +registry=https://registry.npmjs.org/ +strict-ssl=true diff --git a/experiments/0001-stack/.nvmrc b/experiments/0001-stack/.nvmrc new file mode 100644 index 0000000..df6ae33 --- /dev/null +++ b/experiments/0001-stack/.nvmrc @@ -0,0 +1 @@ +24.21.0 diff --git a/experiments/0001-stack/LICENSE_INVENTORY.md b/experiments/0001-stack/LICENSE_INVENTORY.md new file mode 100644 index 0000000..52482bd --- /dev/null +++ b/experiments/0001-stack/LICENSE_INVENTORY.md @@ -0,0 +1,73 @@ +# Locked dependency license inventory + +Registry/package metadata inspected on 2026-10-15. Exact versions and integrity are in package-lock.json. Optional platform packages are included here even when not installed on macOS ARM64. + +| Package | Version | SPDX license | +| --- | --- | --- | +| @oxc-project/types | 0.154.0 | MIT | +| @rolldown/binding-android-arm-eabi | 1.2.14 | MIT | +| @rolldown/binding-android-arm64 | 1.2.14 | MIT | +| @rolldown/binding-darwin-arm64 | 1.2.14 | MIT | +| @rolldown/binding-darwin-x64 | 1.2.14 | MIT | +| @rolldown/binding-freebsd-x64 | 1.2.14 | MIT | +| @rolldown/binding-linux-arm-gnueabihf | 1.2.14 | MIT | +| @rolldown/binding-linux-arm64-gnu | 1.2.14 | MIT | +| @rolldown/binding-linux-arm64-musl | 1.2.14 | MIT | +| @rolldown/binding-linux-ppc64-gnu | 1.2.14 | MIT | +| @rolldown/binding-linux-s390x-gnu | 1.2.14 | MIT | +| @rolldown/binding-linux-x64-gnu | 1.2.14 | MIT | +| @rolldown/binding-linux-x64-musl | 1.2.14 | MIT | +| @rolldown/binding-openharmony-arm64 | 1.2.14 | MIT | +| @rolldown/binding-win32-arm64-msvc | 1.2.14 | MIT | +| @rolldown/binding-win32-x64-msvc | 1.2.14 | MIT | +| @rolldown/pluginutils | 1.0.1 | MIT | +| @types/react | 19.3.0 | MIT | +| @types/react-dom | 19.3.0 | MIT | +| @typescript/typescript-aix-ppc64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-darwin-arm64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-darwin-x64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-freebsd-arm64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-freebsd-x64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-linux-arm | 7.0.2 | Apache-2.0 | +| @typescript/typescript-linux-arm64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-linux-loong64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-linux-mips64el | 7.0.2 | Apache-2.0 | +| @typescript/typescript-linux-ppc64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-linux-riscv64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-linux-s390x | 7.0.2 | Apache-2.0 | +| @typescript/typescript-linux-x64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-netbsd-arm64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-netbsd-x64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-openbsd-arm64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-openbsd-x64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-sunos-x64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-win32-arm64 | 7.0.2 | Apache-2.0 | +| @typescript/typescript-win32-x64 | 7.0.2 | Apache-2.0 | +| csstype | 3.2.3 | MIT | +| detect-libc | 2.1.2 | Apache-2.0 | +| fdir | 6.5.0 | MIT | +| fsevents | 2.3.3 | MIT | +| lightningcss | 1.33.0 | MPL-2.0 | +| lightningcss-android-arm64 | 1.33.0 | MPL-2.0 | +| lightningcss-darwin-arm64 | 1.33.0 | MPL-2.0 | +| lightningcss-darwin-x64 | 1.33.0 | MPL-2.0 | +| lightningcss-freebsd-x64 | 1.33.0 | MPL-2.0 | +| lightningcss-linux-arm-gnueabihf | 1.33.0 | MPL-2.0 | +| lightningcss-linux-arm64-gnu | 1.33.0 | MPL-2.0 | +| lightningcss-linux-arm64-musl | 1.33.0 | MPL-2.0 | +| lightningcss-linux-x64-gnu | 1.33.0 | MPL-2.0 | +| lightningcss-linux-x64-musl | 1.33.0 | MPL-2.0 | +| lightningcss-win32-arm64-msvc | 1.33.0 | MPL-2.0 | +| lightningcss-win32-x64-msvc | 1.33.0 | MPL-2.0 | +| nanoid | 3.3.20 | MIT | +| picocolors | 1.1.1 | ISC | +| picomatch | 4.0.7 | MIT | +| postcss | 8.5.30 | MIT | +| react | 19.3.1 | MIT | +| react-dom | 19.3.1 | MIT | +| rolldown | 1.2.14 | MIT | +| scheduler | 0.28.0 | MIT | +| source-map-js | 1.2.2 | BSD-3-Clause | +| tinyglobby | 0.2.17 | MIT | +| typescript | 7.0.2 | Apache-2.0 | +| vite | 8.3.4 | MIT | diff --git a/experiments/0001-stack/README.md b/experiments/0001-stack/README.md new file mode 100644 index 0000000..47cb4f4 --- /dev/null +++ b/experiments/0001-stack/README.md @@ -0,0 +1,45 @@ +# S00-002 rendering spike + +One local React/TypeScript/Vite experiment for ADR 0001. The registry-access/ +subdirectory belongs to the reviewed S00-011 probe and is retained unchanged. +No account, network messaging, crypto, media, service worker or application +scaffold is implemented here. + +## Reproduce + +Use Node **24.21.0** with bundled npm **11.19.0**. `.nvmrc` is a pin for an +existing version manager; installing the spike never changes system runtimes. +Official binaries: https://nodejs.org/dist/v24.21.0/ — verify the selected archive +against SHASUMS256.txt with normal TLS trust. On this executor, the verified +macOS ARM64 runtime was unpacked at +`/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64`. + +From this directory with the pinned runtime's bin directory first on PATH: + +```sh +node --version +npm --version +npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-review-cache --fetch-retries=0 --fetch-timeout=15000 +npm run build +npm run preview -- --port 4173 --strictPort +``` + +Use a new cache path for a network/clean-cache check. npm ci itself removes old +node_modules and fails on lock/manifest mismatch. Keep optional platform packages +enabled; TypeScript/Vite use platform binaries and build succeeds without +lifecycle scripts. TLS verification and exact engine checks remain enabled. +The private package is not published. npm install is only for explicitly reviewed +lockfile updates, not normal reproduction. + +Open `http://127.0.0.1:4173` locally: expect “Luma rendering spike” and “Count: 0”. +Click Increment twice: expect Count: 2. This is the manual DOM/interaction check; +it was **not run** because this harness exposes no browsers. Build/typechecking +were run successfully. Stop the server with Ctrl-C. `npm run dev` is available +for source development; no React refresh plugin is installed. + +Build output/node_modules are ignored. The browser bundle is static and requires +no Node server. Explicit compiler floors: Chrome/Edge 111, Firefox 114, Safari +16.4, with no API polyfills; the product browser matrix is a later decision. +Preserve THIRD_PARTY_NOTICES.md when distributing this bundle; full lock graph +licenses are in LICENSE_INVENTORY.md. CI, release notice automation, app tests +and cryptographic/protocol compatibility remain subsequent tasks. diff --git a/experiments/0001-stack/THIRD_PARTY_NOTICES.md b/experiments/0001-stack/THIRD_PARTY_NOTICES.md new file mode 100644 index 0000000..bf8839f --- /dev/null +++ b/experiments/0001-stack/THIRD_PARTY_NOTICES.md @@ -0,0 +1,78 @@ +# Third-party notices for the rendering bundle + +The browser bundle contains React, React DOM and Scheduler. Build-tool licenses are listed in LICENSE_INVENTORY.md; installed packages retain their license files. No build tool is shipped as a browser runtime. Preserve these notices when distributing this spike. + +## react 19.3.1 + +MIT License + +Copyright (c) Meta Platforms, Inc. and affiliates. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + +## react-dom 19.3.1 + +MIT License + +Copyright (c) Meta Platforms, Inc. and affiliates. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + +## scheduler 0.28.0 + +MIT License + +Copyright (c) Meta Platforms, Inc. and affiliates. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + diff --git a/experiments/0001-stack/index.html b/experiments/0001-stack/index.html new file mode 100644 index 0000000..9b55978 --- /dev/null +++ b/experiments/0001-stack/index.html @@ -0,0 +1,5 @@ + + + Luma stack spike +
+ diff --git a/experiments/0001-stack/package-lock.json b/experiments/0001-stack/package-lock.json new file mode 100644 index 0000000..448bfd9 --- /dev/null +++ b/experiments/0001-stack/package-lock.json @@ -0,0 +1,1268 @@ +{ + "name": "luma-stack-rendering-spike", + "version": "0.0.0", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "luma-stack-rendering-spike", + "version": "0.0.0", + "dependencies": { + "react": "19.3.1", + "react-dom": "19.3.1" + }, + "devDependencies": { + "@types/react": "19.3.0", + "@types/react-dom": "19.3.0", + "typescript": "7.0.2", + "vite": "8.3.4" + }, + "engines": { + "node": "24.21.0", + "npm": "11.19.0" + } + }, + "node_modules/@oxc-project/types": { + "version": "0.154.0", + "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.154.0.tgz", + "integrity": "sha512-KYOUGQFlLWR+s4QMV2Q9ko38TZm7EdO87Qm7rvZLqk/webse/cDjtyxKhg/47l0byCbs/k46LT8qc4PKjAikzA==", + "dev": true, + "license": "MIT", + "funding": { + "url": "https://github.com/sponsors/oxc-project" + } + }, + "node_modules/@rolldown/binding-android-arm-eabi": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.14.tgz", + "integrity": "sha512-aWR+XKH9+rW7m5fWq/5360J3mHycrx/o6xZM2DQFdJnTMdyP7/WzxPjhtLbVWdKo2y612/4U1bWqb3HQhiF7vg==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-android-arm64": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.14.tgz", + "integrity": "sha512-QiVxHofl6A8lQU7WAtOUY4QMVZXohxwz7WJJoeh8NBEUyKfIkMRKhYyq8az/1RypNiIXzNTtiS6KwHz0erxYRQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-darwin-arm64": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.14.tgz", + "integrity": "sha512-lTQOzHuBIooh3jIr5XINQkjPGEuGy+Dsy0meXDr6Sjty0b99kYgGh4uBC/8mJX1T0kC8d6S0aPP1Y+bHkh6aBw==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-darwin-x64": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.14.tgz", + "integrity": "sha512-hyMKEGatjmBYCs/Q4sbIcL/GqpFEqsX3wc+HYVQ/85A4rxc1o7rPm4DUI4GV4k/h0ITddwFSGpqQunI14GXjTA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-freebsd-x64": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.14.tgz", + "integrity": "sha512-u371GbXoVXrEgP20PwzoGNOdAOqAMhzo19JzzY+V4YmmnC+DTOoqdbMu+O+54emM59Mik/UdrtWgcuEDKWRPKA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-arm-gnueabihf": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.14.tgz", + "integrity": "sha512-BqwKsdZQf6EqVWr8fv2MrDYzAvOZ7+NYFSJESRGs87fkseEhs0TU9TXgRJTkZoRRkxTizyEg1LKUXfU3/78uqg==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-arm64-gnu": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.14.tgz", + "integrity": "sha512-SD9kY8M009x/7s57Z1dgUVlP5+uYBgKQK0Tkr1WIWngrtUJmRCW1RJFMY7QDla2khXhmg2i5Io7MUjcmZNZ/KQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "libc": [ + "glibc" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-arm64-musl": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.14.tgz", + "integrity": "sha512-BJ2CL19M6uuWesMgnqJzgxoI+N+eV7b0A9O9vLV42y+gitC41fNa8KElau1tHVzuLWX5GzEuxMPhAO0tQXQMkg==", + "cpu": [ + "arm64" + ], + "dev": true, + "libc": [ + "musl" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-ppc64-gnu": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.14.tgz", + "integrity": "sha512-4+Kl8daPV8NDHaD7mfCcc1pRM+Qg7ab8DyMm5FG5WoZgv4h2i3KFN1CybYBNbQqmuYm7ftJLvmMI1eHYJ22S/Q==", + "cpu": [ + "ppc64" + ], + "dev": true, + "libc": [ + "glibc" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-s390x-gnu": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.14.tgz", + "integrity": "sha512-V/h8ePq1fKDrmtFMz6xcCN3DKvuvMRrwwD1q0PkBeeo4DpK64biaKvqWGVxqCeYKqeRk7gE7/iKPxLCn08O97A==", + "cpu": [ + "s390x" + ], + "dev": true, + "libc": [ + "glibc" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-x64-gnu": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.14.tgz", + "integrity": "sha512-WxalXzgrLVpKC93xfpaJ3gCXUWzeCr+FRCbDVD2mUAy4L6Vo3lNVz0epUEUpxPWJkLNYUwM4OSIikv36OJ9mLg==", + "cpu": [ + "x64" + ], + "dev": true, + "libc": [ + "glibc" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-linux-x64-musl": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.14.tgz", + "integrity": "sha512-3G3tnAmTpdk9jO3GQtyHXqeFD2SlecfTws/Y3M2mmj9nMBwwuLT4kur8sZKeu7ENUHSpVO3cIsm5A52LEWWwlg==", + "cpu": [ + "x64" + ], + "dev": true, + "libc": [ + "musl" + ], + "license": "MIT", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-openharmony-arm64": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.14.tgz", + "integrity": "sha512-qyr5XiNGxm2ytx17vvtcJ9nXn6v1gENETi503bJx3OGwZ1tSonj7BosxbMa/xeAfSl5iS9X6KjEWYXLu6v1L7Q==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "openharmony" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-win32-arm64-msvc": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.14.tgz", + "integrity": "sha512-oA4o5o0S2yB199YyYXDzKUv1Z56Rc+mgOjwm7Z/vJ9Z8igiDPYvoOuDyo6g7AK/ZaF09nPhDKVnGBcYHO11GXA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/binding-win32-x64-msvc": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.14.tgz", + "integrity": "sha512-9mE94bf2GZUaR/fUSXCMpBoWkctu421Mi0ORpm4zqfbkjKep7RxzPFa5etcGs5h+2KApoWBOA/hAJa/7saGgEQ==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MIT", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": "^20.19.0 || >=22.12.0" + } + }, + "node_modules/@rolldown/pluginutils": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz", + "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==", + "dev": true, + "license": "MIT" + }, + "node_modules/@types/react": { + "version": "19.3.0", + "resolved": "https://registry.npmjs.org/@types/react/-/react-19.3.0.tgz", + "integrity": "sha512-N0rFCuH9YoxG9/m61l9MfpJKfmLOVU0em7ipIz6TRgSSkvReLB9vL85GB+yr8Bs5leqpvg96JSwF4ZS1s4viQg==", + "dev": true, + "license": "MIT", + "dependencies": { + "csstype": "^3.2.2" + } + }, + "node_modules/@types/react-dom": { + "version": "19.3.0", + "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.3.0.tgz", + "integrity": "sha512-ZI7bU42mZXXKHn/qNLEw2IrbiINU7X5+vfgdixBHkCNpYWXjKgfQ/P+uyGb5CjOLB9UcnTeg3rylQtV2hym44Q==", + "dev": true, + "license": "MIT", + "peerDependencies": { + "@types/react": "^19.3.0" + } + }, + "node_modules/@typescript/typescript-aix-ppc64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz", + "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==", + "cpu": [ + "ppc64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "aix" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-darwin-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz", + "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-darwin-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz", + "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-freebsd-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz", + "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-freebsd-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz", + "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-arm": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz", + "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz", + "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-loong64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz", + "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==", + "cpu": [ + "loong64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-mips64el": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz", + "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==", + "cpu": [ + "mips64el" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-ppc64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz", + "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==", + "cpu": [ + "ppc64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-riscv64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz", + "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==", + "cpu": [ + "riscv64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-s390x": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz", + "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==", + "cpu": [ + "s390x" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-linux-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz", + "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-netbsd-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz", + "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "netbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-netbsd-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz", + "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "netbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-openbsd-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz", + "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "openbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-openbsd-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz", + "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "openbsd" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-sunos-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz", + "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "sunos" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-win32-arm64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz", + "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/@typescript/typescript-win32-x64": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz", + "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">=16.20.0" + } + }, + "node_modules/csstype": { + "version": "3.2.3", + "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz", + "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==", + "dev": true, + "license": "MIT" + }, + "node_modules/detect-libc": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz", + "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==", + "dev": true, + "license": "Apache-2.0", + "engines": { + "node": ">=8" + } + }, + "node_modules/fdir": { + "version": "6.5.0", + "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", + "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12.0.0" + }, + "peerDependencies": { + "picomatch": "^3 || ^4" + }, + "peerDependenciesMeta": { + "picomatch": { + "optional": true + } + } + }, + "node_modules/fsevents": { + "version": "2.3.3", + "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz", + "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==", + "dev": true, + "hasInstallScript": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": "^8.16.0 || ^10.6.0 || >=11.0.0" + } + }, + "node_modules/lightningcss": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz", + "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==", + "dev": true, + "license": "MPL-2.0", + "dependencies": { + "detect-libc": "^2.0.3" + }, + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + }, + "optionalDependencies": { + "lightningcss-android-arm64": "1.33.0", + "lightningcss-darwin-arm64": "1.33.0", + "lightningcss-darwin-x64": "1.33.0", + "lightningcss-freebsd-x64": "1.33.0", + "lightningcss-linux-arm-gnueabihf": "1.33.0", + "lightningcss-linux-arm64-gnu": "1.33.0", + "lightningcss-linux-arm64-musl": "1.33.0", + "lightningcss-linux-x64-gnu": "1.33.0", + "lightningcss-linux-x64-musl": "1.33.0", + "lightningcss-win32-arm64-msvc": "1.33.0", + "lightningcss-win32-x64-msvc": "1.33.0" + } + }, + "node_modules/lightningcss-android-arm64": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz", + "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "android" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-darwin-arm64": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz", + "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-darwin-x64": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz", + "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-freebsd-x64": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz", + "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "freebsd" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-arm-gnueabihf": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz", + "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==", + "cpu": [ + "arm" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-arm64-gnu": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz", + "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==", + "cpu": [ + "arm64" + ], + "dev": true, + "libc": [ + "glibc" + ], + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-arm64-musl": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz", + "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "libc": [ + "musl" + ], + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-x64-gnu": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz", + "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==", + "cpu": [ + "x64" + ], + "dev": true, + "libc": [ + "glibc" + ], + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-linux-x64-musl": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz", + "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==", + "cpu": [ + "x64" + ], + "dev": true, + "libc": [ + "musl" + ], + "license": "MPL-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-win32-arm64-msvc": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz", + "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/lightningcss-win32-x64-msvc": { + "version": "1.33.0", + "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz", + "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "MPL-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">= 12.0.0" + }, + "funding": { + "type": "opencollective", + "url": "https://opencollective.com/parcel" + } + }, + "node_modules/nanoid": { + "version": "3.3.20", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.20.tgz", + "integrity": "sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==", + "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "bin": { + "nanoid": "bin/nanoid.cjs" + }, + "engines": { + "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1" + } + }, + "node_modules/picocolors": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz", + "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==", + "dev": true, + "license": "ISC" + }, + "node_modules/picomatch": { + "version": "4.0.7", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", + "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" + } + }, + "node_modules/postcss": { + "version": "8.5.30", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.30.tgz", + "integrity": "sha512-zkd+e9S1AQHhmaBKye9zlFHWjOwVgqXl1q3ECYy8561K7qxR2cREf/STLskulBFd78k6AOFeA+ff1TtEzk9bAA==", + "dev": true, + "funding": [ + { + "type": "opencollective", + "url": "https://opencollective.com/postcss/" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/postcss" + }, + { + "type": "github", + "url": "https://github.com/sponsors/ai" + } + ], + "license": "MIT", + "dependencies": { + "nanoid": "^3.3.20", + "picocolors": "^1.1.1", + "source-map-js": "^1.2.2" + }, + "engines": { + "node": "^10 || ^12 || >=14" + } + }, + "node_modules/react": { + "version": "19.3.1", + "resolved": "https://registry.npmjs.org/react/-/react-19.3.1.tgz", + "integrity": "sha512-QNhWdt7nrgVWWQG58QuGsAR3jv3Hbe4mb4vz7w2csnHavciZJgda1CPNaldF6eVxv90ud3jUXpKlHL69gO38yw==", + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/react-dom": { + "version": "19.3.1", + "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.3.1.tgz", + "integrity": "sha512-Y0bARz53lhEC1NMCASs0/j+faB/zqt3R8hpvg1e8+61ZVJ4UL0UdC4cBbXfZMcIuhrfgeILTLe+ZeBCavQPtKQ==", + "license": "MIT", + "dependencies": { + "scheduler": "^0.28.0" + }, + "peerDependencies": { + "react": "^19.3.1" + } + }, + "node_modules/rolldown": { + "version": "1.2.14", + "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.14.tgz", + "integrity": "sha512-eTBTTqMR6uHKLgcUqpJP8ntzDI6V4LYA8negAMBEI7gkgVvOdrx6VsvS2Ym+83KhOPdLCHWJu0w7UQFJZhHKNw==", + "dev": true, + "license": "MIT", + "dependencies": { + "@oxc-project/types": "=0.154.0", + "@rolldown/pluginutils": "^1.0.0" + }, + "bin": { + "rolldown": "bin/cli.mjs" + }, + "engines": { + "node": "^20.19.0 || >=22.12.0" + }, + "optionalDependencies": { + "@rolldown/binding-android-arm-eabi": "1.2.14", + "@rolldown/binding-android-arm64": "1.2.14", + "@rolldown/binding-darwin-arm64": "1.2.14", + "@rolldown/binding-darwin-x64": "1.2.14", + "@rolldown/binding-freebsd-x64": "1.2.14", + "@rolldown/binding-linux-arm-gnueabihf": "1.2.14", + "@rolldown/binding-linux-arm64-gnu": "1.2.14", + "@rolldown/binding-linux-arm64-musl": "1.2.14", + "@rolldown/binding-linux-ppc64-gnu": "1.2.14", + "@rolldown/binding-linux-s390x-gnu": "1.2.14", + "@rolldown/binding-linux-x64-gnu": "1.2.14", + "@rolldown/binding-linux-x64-musl": "1.2.14", + "@rolldown/binding-openharmony-arm64": "1.2.14", + "@rolldown/binding-win32-arm64-msvc": "1.2.14", + "@rolldown/binding-win32-x64-msvc": "1.2.14" + } + }, + "node_modules/scheduler": { + "version": "0.28.0", + "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.28.0.tgz", + "integrity": "sha512-juorfCmIkIw8tT+p5BXSm6PJjQF/ycEYmKyzURCIt/RaZIhL+PulbQ9Yu2z1HdOJDdqDTlxA1+xKBmHXJsczAw==", + "license": "MIT" + }, + "node_modules/source-map-js": { + "version": "1.2.2", + "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz", + "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==", + "dev": true, + "license": "BSD-3-Clause", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/tinyglobby": { + "version": "0.2.17", + "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz", + "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==", + "dev": true, + "license": "MIT", + "dependencies": { + "fdir": "^6.5.0", + "picomatch": "^4.0.4" + }, + "engines": { + "node": ">=12.0.0" + }, + "funding": { + "url": "https://github.com/sponsors/SuperchupuDev" + } + }, + "node_modules/typescript": { + "version": "7.0.2", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz", + "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==", + "dev": true, + "license": "Apache-2.0", + "bin": { + "tsc": "bin/tsc" + }, + "engines": { + "node": ">=16.20.0" + }, + "optionalDependencies": { + "@typescript/typescript-aix-ppc64": "7.0.2", + "@typescript/typescript-darwin-arm64": "7.0.2", + "@typescript/typescript-darwin-x64": "7.0.2", + "@typescript/typescript-freebsd-arm64": "7.0.2", + "@typescript/typescript-freebsd-x64": "7.0.2", + "@typescript/typescript-linux-arm": "7.0.2", + "@typescript/typescript-linux-arm64": "7.0.2", + "@typescript/typescript-linux-loong64": "7.0.2", + "@typescript/typescript-linux-mips64el": "7.0.2", + "@typescript/typescript-linux-ppc64": "7.0.2", + "@typescript/typescript-linux-riscv64": "7.0.2", + "@typescript/typescript-linux-s390x": "7.0.2", + "@typescript/typescript-linux-x64": "7.0.2", + "@typescript/typescript-netbsd-arm64": "7.0.2", + "@typescript/typescript-netbsd-x64": "7.0.2", + "@typescript/typescript-openbsd-arm64": "7.0.2", + "@typescript/typescript-openbsd-x64": "7.0.2", + "@typescript/typescript-sunos-x64": "7.0.2", + "@typescript/typescript-win32-arm64": "7.0.2", + "@typescript/typescript-win32-x64": "7.0.2" + } + }, + "node_modules/vite": { + "version": "8.3.4", + "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.4.tgz", + "integrity": "sha512-IftLE8phJhdNRIGNEV4JCCvfNScoZQVfcXaN8TQropWGJtOHcu+iAB9pHcuGvmEb/kddw0LBe/jS8ztdC6xdiQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "lightningcss": "^1.33.0", + "picomatch": "^4.0.7", + "postcss": "^8.5.29", + "rolldown": "~1.2.12", + "tinyglobby": "^0.2.17" + }, + "bin": { + "vite": "bin/vite.js" + }, + "engines": { + "node": "^20.19.0 || >=22.12.0" + }, + "funding": { + "url": "https://github.com/vitejs/vite?sponsor=1" + }, + "optionalDependencies": { + "fsevents": "~2.3.3" + }, + "peerDependencies": { + "@types/node": "^20.19.0 || >=22.12.0", + "@vitejs/devtools": "^0.7.1", + "esbuild": "^0.27.0 || ^0.28.0", + "jiti": ">=1.21.0", + "less": "^4.0.0", + "sass": "^1.70.0", + "sass-embedded": "^1.70.0", + "stylus": ">=0.54.8", + "sugarss": "^5.0.0", + "terser": "^5.16.0", + "tsx": "^4.8.1", + "yaml": "^2.4.2" + }, + "peerDependenciesMeta": { + "@types/node": { + "optional": true + }, + "@vitejs/devtools": { + "optional": true + }, + "esbuild": { + "optional": true + }, + "jiti": { + "optional": true + }, + "less": { + "optional": true + }, + "sass": { + "optional": true + }, + "sass-embedded": { + "optional": true + }, + "stylus": { + "optional": true + }, + "sugarss": { + "optional": true + }, + "terser": { + "optional": true + }, + "tsx": { + "optional": true + }, + "yaml": { + "optional": true + } + } + } + } +} diff --git a/experiments/0001-stack/package.json b/experiments/0001-stack/package.json new file mode 100644 index 0000000..6351379 --- /dev/null +++ b/experiments/0001-stack/package.json @@ -0,0 +1,26 @@ +{ + "name": "luma-stack-rendering-spike", + "version": "0.0.0", + "private": true, + "type": "module", + "engines": { + "node": "24.21.0", + "npm": "11.19.0" + }, + "packageManager": "npm@11.19.0", + "scripts": { + "build": "node tools/check-runtime.mjs && tsc --noEmit && vite build", + "dev": "vite --host 127.0.0.1", + "preview": "vite preview --host 127.0.0.1" + }, + "dependencies": { + "react": "19.3.1", + "react-dom": "19.3.1" + }, + "devDependencies": { + "@types/react": "19.3.0", + "@types/react-dom": "19.3.0", + "typescript": "7.0.2", + "vite": "8.3.4" + } +} diff --git a/experiments/0001-stack/src/main.tsx b/experiments/0001-stack/src/main.tsx new file mode 100644 index 0000000..ada3f57 --- /dev/null +++ b/experiments/0001-stack/src/main.tsx @@ -0,0 +1,20 @@ +import { useState } from 'react'; +import { createRoot } from 'react-dom/client'; + +function RenderingSpike() { + const [count, setCount] = useState(0); + return ( +
+

Luma rendering spike

+

Local UI experiment; no account or transport.

+ + Count: {count} +
+ ); +} + +const root = document.getElementById('root'); +if (!root) throw new Error('Missing rendering root'); +createRoot(root).render(); diff --git a/experiments/0001-stack/tools/check-runtime.mjs b/experiments/0001-stack/tools/check-runtime.mjs new file mode 100644 index 0000000..a623ba2 --- /dev/null +++ b/experiments/0001-stack/tools/check-runtime.mjs @@ -0,0 +1,6 @@ +if (process.versions.node !== '24.21.0') { + throw new Error(`Expected Node 24.21.0, got ${process.versions.node}`); +} +if (!process.env.npm_config_user_agent?.startsWith('npm/11.19.0 ')) { + throw new Error('Run build with npm 11.19.0'); +} diff --git a/experiments/0001-stack/tsconfig.json b/experiments/0001-stack/tsconfig.json new file mode 100644 index 0000000..e138fc4 --- /dev/null +++ b/experiments/0001-stack/tsconfig.json @@ -0,0 +1,19 @@ +{ + "compilerOptions": { + "target": "ES2022", + "lib": [ + "ES2022", + "DOM", + "DOM.Iterable" + ], + "module": "ESNext", + "moduleResolution": "Bundler", + "jsx": "react-jsx", + "strict": true, + "noEmit": true, + "skipLibCheck": false + }, + "include": [ + "src" + ] +} diff --git a/experiments/0001-stack/vite.config.js b/experiments/0001-stack/vite.config.js new file mode 100644 index 0000000..37e830f --- /dev/null +++ b/experiments/0001-stack/vite.config.js @@ -0,0 +1 @@ +export default { build: { target: ['chrome111', 'edge111', 'firefox114', 'safari16.4'] } }; diff --git a/planning/TASK_MATRIX.md b/planning/TASK_MATRIX.md index bebf839..5f60c0b 100644 --- a/planning/TASK_MATRIX.md +++ b/planning/TASK_MATRIX.md @@ -1,11 +1,11 @@ # Матрица задач -Generated; state revision **9**. Canonical status: state/tasks.json. +Generated; state revision **11**. Canonical status: state/tasks.json. | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача | | --- | --- | --- | --- | --- | --- | --- | --- | | [S00-001](tasks/S00-001.md) | S00 | orchestrator | security | done | auto-orchestrator-48aab142ecde | | Утвердить Web-профиль | -| [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | todo | | S00-001, S00-011 | Выбрать framework и build runtime | +| [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | review | auto-orchestrator-68a05c587e33 | S00-001, S00-011 | Выбрать framework и build runtime | | [S00-003](tasks/S00-003.md) | S00 | protocol | qa | todo | | S00-001, S00-002 | Проверить XMPP WSS/auth библиотеку | | [S00-004](tasks/S00-004.md) | S00 | crypto | security | todo | | S00-001, S00-002 | Проверить browser OMEMO backend | | [S00-005](tasks/S00-005.md) | S00 | storage | qa | todo | | S00-002 | Выбрать IndexedDB wrapper и migration policy | diff --git a/planning/stages/S00.md b/planning/stages/S00.md index fb4fa60..4fc1583 100644 --- a/planning/stages/S00.md +++ b/planning/stages/S00.md @@ -7,7 +7,7 @@ ## Задачи - [S00-001](../tasks/S00-001.md): Утвердить Web-профиль — orchestrator; done. -- [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; todo. +- [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; review. - [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; todo. - [S00-004](../tasks/S00-004.md): Проверить browser OMEMO backend — crypto; todo. - [S00-005](../tasks/S00-005.md): Выбрать IndexedDB wrapper и migration policy — storage; todo. diff --git a/planning/task_matrix.csv b/planning/task_matrix.csv index 7d1697e..f5b21cb 100644 --- a/planning/task_matrix.csv +++ b/planning/task_matrix.csv @@ -1,6 +1,6 @@ id,stage,operator,reviewer,status,owner,depends_on,title S00-001,S00,orchestrator,security,done,auto-orchestrator-48aab142ecde,,Утвердить Web-профиль -S00-002,S00,orchestrator,security,todo,,"S00-001, S00-011",Выбрать framework и build runtime +S00-002,S00,orchestrator,security,review,auto-orchestrator-68a05c587e33,"S00-001, S00-011",Выбрать framework и build runtime S00-003,S00,protocol,qa,todo,,"S00-001, S00-002",Проверить XMPP WSS/auth библиотеку S00-004,S00,crypto,security,todo,,"S00-001, S00-002",Проверить browser OMEMO backend S00-005,S00,storage,qa,todo,,S00-002,Выбрать IndexedDB wrapper и migration policy diff --git a/state/commit_messages/auto-orchestrator-68a05c587e33.txt b/state/commit_messages/auto-orchestrator-68a05c587e33.txt new file mode 100644 index 0000000..fdd6b80 --- /dev/null +++ b/state/commit_messages/auto-orchestrator-68a05c587e33.txt @@ -0,0 +1,4 @@ +Propose a pinned React stack with a reproducible rendering spike + +Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review. +Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed. diff --git a/state/evidence/S00-002-auto-orchestrator-68a05c587e33.md b/state/evidence/S00-002-auto-orchestrator-68a05c587e33.md new file mode 100644 index 0000000..363d10a --- /dev/null +++ b/state/evidence/S00-002-auto-orchestrator-68a05c587e33.md @@ -0,0 +1,60 @@ +# S00-002 executor evidence + +Agent: auto-orchestrator-68a05c587e33 (orchestrator). Date: 2026-10-15. +Result: proposed stack ADR and one rendering spike, awaiting independent security review. + +## Actual changes and scope + +- docs/decisions/0001-stack.md compares React/TypeScript/Vite and Vue/TypeScript/Vite, proposes exact selected pins, records sources, licenses, browser/runtime constraints and verification limits. +- experiments/0001-stack: exact manifest/lockfile, runtime/engine/TLS pins, strict TSX counter, Vite target, build guard, reproduction instructions, locked license inventory and browser-runtime notices. +- Existing reviewed registry-access/ probe unchanged. Application modules, shared contracts, immutable specifications, plan definitions and system/Git configuration unchanged. Initial git status showed only coordinator claim change in state/tasks.json. +- No secrets, real accounts/conversations or production transports. No encryption/CORS/certificate workaround. Source scope is only the two card paths; evidence/handoff/commit message are workflow metadata. + +Read master prompt, role and workflow documents; assigned resume/show/packet; previous blocker handoff; exact NFR-007; accepted ADR 0000 and S00-001/S00-011 executor/review evidence and handoffs. S01 schemas are not yet accepted and this spike requires no new shared interface. + +## Commands and actual results + +All npm install/build commands below ran from experiments/0001-stack with: +`PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH`. +This uses the downloaded isolated LTS runtime, not the system Node 26. + +| Command/check | Exit | Actual result | +| --- | --- | --- | +| `python3 scripts/tasks.py resume --agent auto-orchestrator-68a05c587e33` | 0 | S00-002 assigned in_progress; no repeat claim. | +| `python3 scripts/tasks.py show S00-002` and `packet S00-002 --agent auto-orchestrator-68a05c587e33` | 0 each | Correct scope/requirements and reviewed prerequisites read. | +| Python subprocess batch of `npm view version license engines peerDependencies --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000 --registry=https://registry.npmjs.org/ --strict-ssl=true` | 0, all children 0 | React/React DOM 19.3.1 MIT; Vue 3.5.44 MIT; Vite 8.3.4 MIT; TypeScript 7.0.2 Apache-2.0; both React types 19.3.0 MIT; available Node 24 releases and npm 12.2.0 inspected. Latest npm was not selected. | +| `npm view npm@11.19.0 version license engines --json --cache /private/tmp/luma-stack-npm-cache --strict-ssl=true` | 0 | Bundled npm verified: 11.19.0, Artistic-2.0, node ^20.17.0 or >=22.9.0. | +| Same metadata batch for `@vitejs/plugin-vue`, `vue-tsc` | 0, both children 0 | 6.0.10 / 3.3.13, MIT; plugin peer ranges permit candidate Vue/Vite. Candidate not installed/built. | +| Python urllib download and hashlib SHA256 verification of official Node v24.21.0 darwin-arm64 archive / checked-path extraction under /private/tmp | 0 on final extraction | HTTPS download matched vendor SHASUMS256.txt; exact node/npm commands returned v24.21.0 / 11.19.0. See setup attempts below. | +| `npm install --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000` | 0 | Initial manifest resolution/lockfile creation, 24 installed packages. | +| `npm run build` | 0 | Runtime guard + strict tsc --noEmit + Vite 8.3.4; 14 modules, HTML 0.29 kB, JS 219.87 kB / gzip 68.75 kB. | +| `npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-clean-cache-68a05c587e33 --fetch-retries=0 --fetch-timeout=15000` | 0 | Actual clean install with newly created empty cache, 24 packages; lifecycle scripts disabled. | +| `npm run build` after npm ci | 0 | Same strict check/build and same output sizes. | +| Python hashlib comparison of lockfile and both emitted files against first-build digests | 0 | Lock and both artifacts unchanged after clean install/rebuild. | +| Python JSON inspection of lock graph | 0 | All 67 locked package entries have HTTPS public-registry URL, SHA512 integrity and license; includes optional uninstalled platforms. | +| Python subprocess wrapper: `npm run preview -- --port 4173 --strictPort`, urllib HTML/JS fetch and digest assertion | 0 wrapper | Both HTTP 200; served JS byte-matches build artifact. Preview process group terminated in finally. No DOM/JavaScript execution claimed. | +| `make check` | 0 | 276 tasks, 22 stages, 221 requirements, 211 Web requirements, revision 10; 66 tooling tests passed in 10.205s. Foundation integrity only. | +| `git diff --check`, `git status --short --untracked-files=all` | 0 each | No tracked whitespace errors; only scoped source files plus claim/workflow metadata. Authored untracked contents separately inspected. | + +Setup attempts, not successful checks: the first Python extraction attempt failed (exit 1) because this host Python's tarfile does not support the `filter` keyword. The download/checksum had already succeeded. A second path guard rejected normal relative symlinks (exit 1) before extracting anything. Final extraction resolved each member/symlink/hardlink target, required containment in the task temporary root, and succeeded (exit 0). No system install or permission changes. An exploratory `rg --files ... .agents .codex` returned exit 2 for absent optional directories; no task context was missing. + +## Digests + +Official Node archive SHA256: +`bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057`. +Downloaded from https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-arm64.tar.gz +and compared with the official same-origin SHASUMS256.txt. No detached signature verification claimed. + +- package-lock.json: `7b2dee5e231629c30501194fa40346ba9f0752cea32a4eb9d91e8f5d4b5ab47f` +- dist/index.html: `67962911c9b0bcb45d6a13f9d0e5877cfa0164c09d2e2128407db84889026a73` +- dist/assets/index-PZnFDfAT.js: `3cbf3f9adf300aeb52b465fe9e78530103fa5b23fb22e6beae768faa3a8b0f04` + +Artifacts/node_modules remain ignored. Local same-host hashes do not prove cross-platform reproducibility. + +## Sources and limitations + +Primary pages opened through web tool: React from-scratch/createRoot; Vue quick-start/FAQ/TypeScript overview; TypeScript JSX; Vite getting-started/production; Node release lifecycle; npm ci. Exact links and inspection date are in ADR. Version/license/engine/peer fields obtained through real npm registry queries; installed package LICENSE texts inspected for runtime notices. Optional platforms are inventory-only. Web tool could not fetch versioned GitHub license pages or Node checksum URL; actual HTTPS Node checksum retrieval and local package license inspection supplied those facts instead. + +Browser external check: `cua.createBrowserTab('iab', 'about:blank', {visible:false})` returned Browser is not available; `cua.listBrowsers()` returned []. DOM mounting/counter clicks/visual layout have not been verified and are explicitly left as an external check. Card mandatory checks are clean install/build and recorded licenses/constraints, both completed. No browser product matrix, real encrypted/protocol/media/provider interoperability, production hosting, vulnerability audit, package provenance or release readiness is claimed. npm audit was disabled for the bounded install; this is not a security clearance. + +ADR remains proposed. Separate security reviewer should reproduce exact clean install/build, inspect stack justification, licenses, pin/lock/runtime guards and scope, then record acceptance or rejection via CLI. Coordinator alone commits and launches the next fresh process. diff --git a/state/handoffs/S00-002.md b/state/handoffs/S00-002.md index 9452f43..f339234 100644 --- a/state/handoffs/S00-002.md +++ b/state/handoffs/S00-002.md @@ -1,10 +1,10 @@ -# S00-002 blocker handoff +# S00-002 handoff for independent security review -Executor: auto-orchestrator-3a4f07103316, orchestrator. -Outcome reached: required instructions, task packet, NFR-007, accepted ADR 0000 and S00-001 evidence/review read. React/Vite and Vue/Vite primary documentation opened for comparison; no selection made. No source changes, stack ADR, package.json or lockfile authored. +Executor: auto-orchestrator-68a05c587e33 (orchestrator), 2026-10-15. +Outcome: proposed ADR 0001 compares React and Vue, selects exact React/TypeScript/Vite pins and Node 24.21.0 LTS / bundled npm 11.19.0. One isolated TSX rendering spike, lockfile, runtime/TLS guards, license inventory and runtime notices created in experiments/0001-stack. Registry-access probe retained unchanged. No blocker; prior registry failure did not recur. -Blocker: local npm metadata lookup fails with `getaddrinfo ENOTFOUND registry.npmjs.org`; cannot verify package versions/licenses or perform required clean install/build. Reproduce with `npm view react version license engines --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000` (actual exit 1). Node v26.3.0 and npm 11.16.0 observed; not accepted runtime choices. Evidence: state/evidence/S00-002-auto-orchestrator-3a4f07103316.md. +Actual checks: clean npm ci with fresh empty cache, strict TypeScript/Vite build before/after ci, identical local artifact/lock SHA256, HTTP preview HTML and byte-matching JS, make check (66 tests) all exit 0. Full commands, pins, digests, setup failures and limits: state/evidence/S00-002-auto-orchestrator-68a05c587e33.md. -One external remediation requests an execution environment with working DNS/HTTPS to the public npm registry and package tarballs. Keep TLS validation and project write sandbox. No credentials or secret values requested. Resolver must verify metadata and one integrity-checked tarball retrieval, document the safe runner configuration/action, and obtain independent review. Resolver must not choose stack or implement rendering; those remain S00-002. +Next step belongs only to separate assigned security reviewer. Read ADR/card/evidence and executor commit/message. From experiments/0001-stack with Node 24.21.0 / npm 11.19.0, run the README's clean npm ci and npm run build. Existing verified macOS ARM64 runtime is at /private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64, or retrieve the official exact runtime with verified HTTPS/checksum. Inspect exact manifest/lock pins, licenses including build-only MPL-2.0, runtime notices, no production transport/secrets and no source changes outside card scope. Record acceptance and reviewer metadata in ADR only if warranted, then approve/reject through tasks.py. -After reviewed remediation, coordinator launches a fresh S00-002 executor. Continue candidate comparison from primary sources, choose and pin supported runtime/tool versions, create one minimal rendering spike only within experiments/0001-stack, perform actual clean install/build and record license/browser limits in docs/decisions/0001-stack.md. Current reporter exits after escalate and must not resume or resolve remediation. +DOM rendering/counter interaction is an external check: no browser is exposed by this harness. README gives manual steps; do not label them passed. Current compiler floors are not the product browser matrix. Vue was not built or benchmarked. Crypto/XMPP compatibility, full app CI, notices for future libraries, other build-host platforms, provider integration and release readiness remain subsequent cards. Shared contracts/specs/plan definitions unchanged. ADR remains proposed; executor does not set done or perform Git mutations. Coordinator commits this submission and launches the reviewer. diff --git a/state/tasks.json b/state/tasks.json index 508f4c5..d24d866 100644 --- a/state/tasks.json +++ b/state/tasks.json @@ -1,6 +1,6 @@ { "schema_version": 1, - "revision": 9, + "revision": 11, "tasks": { "S00-001": { "status": "done", @@ -15,17 +15,18 @@ "completed_at": "2026-10-14T18:03:56+00:00" }, "S00-002": { - "status": "todo", - "owner": null, - "started_at": "2026-10-14T18:03:56+00:00", + "status": "review", + "owner": "auto-orchestrator-68a05c587e33", + "started_at": "2026-10-14T18:11:33+00:00", "reason": null, - "updated_at": "2026-10-14T18:11:33+00:00", + "updated_at": "2026-10-14T18:18:53+00:00", "blocked_by": [], "resume_status": "in_progress", "blocker_report": "state/blockers/S00-011.md", "handoff": "state/handoffs/S00-002.md", "previous_owner": "auto-orchestrator-3a4f07103316", - "resumed_after_blocker": true + "resumed_after_blocker": true, + "evidence": "state/evidence/S00-002-auto-orchestrator-68a05c587e33.md" }, "S00-003": { "status": "todo", @@ -1243,6 +1244,29 @@ "to": "done", "reason": null, "evidence": "state/evidence/S00-011-review.md" + }, + { + "revision": 10, + "at": "2026-10-14T18:11:33+00:00", + "action": "claim", + "task": "S00-002", + "agent": "auto-orchestrator-68a05c587e33", + "role": "orchestrator", + "from": "todo", + "to": "in_progress", + "reason": null + }, + { + "revision": 11, + "at": "2026-10-14T18:18:53+00:00", + "action": "submit", + "task": "S00-002", + "agent": "auto-orchestrator-68a05c587e33", + "role": null, + "from": "in_progress", + "to": "review", + "reason": null, + "evidence": "state/evidence/S00-002-auto-orchestrator-68a05c587e33.md" } ], "retired_agents": [