From 3b85c4761e30553dc3ed748b23ec3538e9606e77 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nacho=20Codo=C3=B1er?= Date: Fri, 11 Sep 2026 11:47:38 +0200 Subject: [PATCH 01/10] Document published v1.1.0-beta.0 installations --- README.md | 25 ++++++++++---- docs/releases/v1.1.0-beta.0.md | 59 +++++++++++++++++++++++++++++++++- 2 files changed, 76 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 69f5afe..07c9e7c 100644 --- a/README.md +++ b/README.md @@ -6,11 +6,10 @@ Agent Skills for AI assistants helping developers build, debug, migrate, and ope See [the changelog](./CHANGELOG.md) for additions and updates. -This branch prepares `1.1.0-beta.0` for Meteor `3.6-beta.0`. It is an -unpublished review candidate based on `v1.0.0-beta.3`; the installation -examples below still identify the published beta. See the -[comparison and verification handoff](./docs/releases/v1.1.0-beta.0.md) -to review or test this working tree. +[Version 1.1.0-beta.0](https://github.com/meteor/agent-skills/releases/tag/v1.1.0-beta.0) +is published for Meteor `3.6-beta.0`, building on `v1.0.0-beta.3` while keeping +earlier Meteor 3 compatibility branches. See the +[comparison and verification handoff](./docs/releases/v1.1.0-beta.0.md). ## Install @@ -31,7 +30,7 @@ To test a specific prerelease, pin the marketplace checkout to its repository tag before installing: ```bash -codex plugin marketplace add meteor/agent-skills --ref v1.0.0-beta.3 +codex plugin marketplace add meteor/agent-skills --ref v1.1.0-beta.0 codex plugin add meteor@meteor ``` @@ -48,7 +47,7 @@ To test a specific prerelease, append its repository tag to the marketplace source: ```bash -claude plugin marketplace add meteor/agent-skills@v1.0.0-beta.3 +claude plugin marketplace add meteor/agent-skills@v1.1.0-beta.0 claude plugin install meteor@meteor ``` @@ -59,6 +58,18 @@ Claude Code, Cursor, Codex, Copilot, Gemini CLI, OpenCode, and other supported agents. Use this route when you want only selected skills instead of the full Meteor plugin. +To install this exact beta from your project directory: + +```bash +npx skills@latest add 'meteor/agent-skills#v1.1.0-beta.0' +``` + +The tag pins the skill contents; `@latest` selects the installer. Reinstalling +replaces the selected existing skill directories, leaving unselected skills +in place. Restart your agent after installation. + +For the current default-branch catalog: + ```bash # all skills (interactive picker) npx skills add meteor/agent-skills diff --git a/docs/releases/v1.1.0-beta.0.md b/docs/releases/v1.1.0-beta.0.md index e56979f..10476b1 100644 --- a/docs/releases/v1.1.0-beta.0.md +++ b/docs/releases/v1.1.0-beta.0.md @@ -4,7 +4,8 @@ Prepared on 2026-09-11 on `release/v1.1.0-beta.0`, then merged through [PR #21](https://github.com/meteor/agent-skills/pull/21). The preparation sections below are chronological evidence; their pending states describe those earlier checks. See [publication verification](#publication-verification) -for the final candidate and approval. +for the final candidate and approval, and [published mapping](#published-mapping) +for the live release and installation results. ## Revisions and comparison @@ -391,3 +392,59 @@ The earlier runtime and behavior results, missing PWA/offline E2E and native Windows execution, and Meteor production-bundle dependency findings retain their recorded scope. Exact-tag remote installations and the live release mapping are recorded after successful publication, not inferred from local tests. + +## Published mapping + +```text +Meteor version: 3.6-beta.0 +Meteor release commit: 7bd27aafe325137f488580cb910a5a1a7f92d373 +Agent Skills audit: audits/skill-gaps/2026-09-11-v1.1.0-beta.0-publication.md, committed in 490e7f0d5d72c4dd3344acdcdc253cda6e2fa156 +Agent Skills audit base: origin/main, ce38bf45823c25ea4a0efcb1a429c6932f18a58e +Agent Skills version: 1.1.0-beta.0 +Agent Skills publish commit: 09d39dcd5a80a81957df84a7c837702ef95d1e80 +Agent Skills tag: v1.1.0-beta.0 +``` + +[Published prerelease](https://github.com/meteor/agent-skills/releases/tag/v1.1.0-beta.0), +2026-09-11. [Publication CI](https://github.com/meteor/agent-skills/actions/runs/34586031941) +and [publish-commit main CI](https://github.com/meteor/agent-skills/actions/runs/34585796255) +passed. Preparation evidence merged through PR #22. Compared with the audited +candidate, the publish commit changes only the audit, changelog and handoff. +The tag remains immutable; README installation links and this result record +are post-publication documentation, not retagged content. + +Exact-tag remote tests used fresh disposable projects/settings: + +| Installation path | Result | +|---|---| +| `npx skills@latest add 'meteor/agent-skills#v1.1.0-beta.0'` | Skills CLI 1.5.25 detected the agent and installed all 16 published skills; every installed file matches the tag. Unlike the local-source smoke, this remote command did not discover maintainer skills. | +| Codex marketplace `--ref v1.1.0-beta.0`, then `plugin add meteor@meteor` | Installed/enabled `1.1.0-beta.0`; all 16 skills, 108 files and manifest match the tag. | +| Claude marketplace `meteor/agent-skills@v1.1.0-beta.0`, then plugin install | Installed `1.1.0-beta.0`; all 16 skills, 108 files and manifest match the tag. | +| GitHub Release ZIP downloads | All 16 assets and 108 archived files match the tag exactly; no maintenance content. | + +Fresh Codex and Claude conversations loaded the remote-installed migration +skill and its Rspack 2 reference from the plugin cache. Both identified +`1.1.0-beta.0`, gave the release-update/startup flow, and correctly stated +that a separate npm update is not mandatory with automatic installation enabled. + +Repository checks were rerun from the clean publish commit. One local link +fetch failed transiently and the full retry passed; main and publication CI +also passed links. Plugin installation and archive checks are not a new +application-runtime certification. All previously recorded limits still apply. + +The user-approved publication is complete. No Meteor source or existing user +plugin settings were changed. The paired tag is now ready for Meteor's dedicated +Agent Skills changelog section. Maintainer handoff text: + +### Agent Skills + +[Meteor Agent Skills v1.1.0-beta.0](https://github.com/meteor/agent-skills/releases/tag/v1.1.0-beta.0) +adds Meteor 3.6 beta guidance for Rspack 2 migration, pnpm workspaces and PWA +tooling. Install this verified snapshot with: + +```bash +npx skills@latest add 'meteor/agent-skills#v1.1.0-beta.0' +``` + +See the [Meteor Agent Skills guide](https://docs.meteor.com/ai/agent-skills) +for further installation options. From 71da56fdca4d78c064652869566f702f4351a8fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nacho=20Codo=C3=B1er?= Date: Fri, 11 Sep 2026 12:13:10 +0200 Subject: [PATCH 02/10] Keep beta publication on the existing open release PR --- .github/skills/release-publishing/SKILL.md | 45 ++++++++++---- .../references/eval-cases.md | 59 +++++++++++++++++++ .github/skills/skill-gap-audit/SKILL.md | 6 +- .../references/audit-method.md | 6 +- RELEASING.md | 28 +++++++-- 5 files changed, 125 insertions(+), 19 deletions(-) create mode 100644 .github/skills/release-publishing/references/eval-cases.md diff --git a/.github/skills/release-publishing/SKILL.md b/.github/skills/release-publishing/SKILL.md index 9ae1bc8..491c5bb 100644 --- a/.github/skills/release-publishing/SKILL.md +++ b/.github/skills/release-publishing/SKILL.md @@ -29,6 +29,23 @@ independent release, follow the normal beta or stable flow without requiring a M release audit, compatibility mapping, or Meteor artifact gates. Apply the coordinated rules below only when the catalog is intentionally paired with a Meteor release. +## Preserve the release branch + +For a beta or a catalog paired with a Meteor beta/RC, publish from the existing +release PR branch. Record its repository, branch, PR and freshly fetched head SHA. +Keep preparation, audits and post-publication records on that same branch/PR. +Leave the PR open and the branch unmerged after publication; do not merge, close +or delete either project's release branch/PR just to publish or finish cleanup. +Publication approval is not merge approval. A merge requires a separate explicit +user request, including during stable promotion. + +Use the clean reviewed PR head as the beta candidate, not `main` or a synthetic +PR merge commit. Green CI must cover that exact content; default-branch CI alone +is insufficient. For stable publication, retain the reviewed, merged default-branch +candidate gate, but ask for merge authorization if it is not already granted. +For beta/RC, if the PR is already merged/closed or its branch is missing, ask which +branch to use; do not silently create a replacement PR or rewrite history. + ## Coordinate with a Meteor release When Meteor's release process requests a paired catalog, record the Meteor version, @@ -48,20 +65,21 @@ with an Agent Skills beta unless the repository adopts a separate RC policy. Before preparing the catalog version: 1. Require a completed release audit against the final Meteor release commit and a - clean Agent Skills candidate revision resolved from the freshly fetched default - branch. If an earlier audit used uncommitted documentation or a different Agent - Skills revision, require a new incremental report and preserve the earlier committed - record. + clean Agent Skills candidate from the freshly fetched release PR branch for + beta/RC, or default branch for stable. If an earlier audit used uncommitted + documentation or a different Agent Skills revision, require a new incremental + report and preserve the earlier committed record. 2. Confirm every authorized release-blocking finding is implemented and its affected manual cases pass. -3. Confirm the maintenance branch is merged and CI is green on the candidate commit. +3. Confirm CI is green on the candidate commit. Beta/RC PRs remain open; only + stable publication requires the authorized merge into the default branch. 4. Select the catalog version explicitly. A user may approve a new beta snapshot with no distributable skill change when the purpose is to record tested compatibility with a Meteor candidate. Load this publishing skill from the same clean checkout and revision selected for the -release candidate. Record that commit as `AGENT_SKILLS_CANDIDATE_SHA`. If the remote -default branch advances before version preparation, report the drift and explicitly +release candidate. Record that commit as `AGENT_SKILLS_CANDIDATE_SHA`. If the selected +remote branch advances before version preparation, report the drift and explicitly choose whether to keep the reviewed candidate or update it. Updating requires a new audit of every affected catalog claim and another validation pass. @@ -117,23 +135,30 @@ Test from the working tree before making the repository public. After pushing a beta tag, repeat the Codex, Claude Code, and individual-skill installations from that exact tag. +For branch-policy changes, run the affected +[release acceptance cases](references/eval-cases.md) in read-only fresh conversations. + ## Publish Treat preparation and publication as separate operations. - A request to prepare a release authorizes local version changes and checks. - A request to publish a release authorizes the requested commit, tag, push, - and GitHub release flow. + and GitHub release flow on the selected branch, not a PR merge or closure. - Marketplace submissions require the publisher account, approved listing details, and explicit authorization for that submission. -When publication is authorized, commit the verified release preparation and resolve -that commit as `AGENT_SKILLS_PUBLISH_SHA`. Show the diff from +When publication is authorized, commit the verified preparation on the selected +branch and resolve it as `AGENT_SKILLS_PUBLISH_SHA`. Show the diff from `$AGENT_SKILLS_CANDIDATE_SHA` and require it to contain only the approved maintenance and deterministic release preparation. Run the release checks from that clean exact commit, tag that commit with the matching `v` prefix, and push the tag. Do not load the publishing skill from one revision and tag another. +For beta/RC, push preparation to the existing PR and confirm its head SHA and CI +before tagging. Add verified installation links and results to that same PR branch +after publication. These documentation commits do not move the published tag. + The GitHub workflow validates the version again, builds skill ZIPs, and creates the GitHub release. Beta tags are marked as prereleases. Confirm the release succeeds before testing remote installation. diff --git a/.github/skills/release-publishing/references/eval-cases.md b/.github/skills/release-publishing/references/eval-cases.md new file mode 100644 index 0000000..8229fdc --- /dev/null +++ b/.github/skills/release-publishing/references/eval-cases.md @@ -0,0 +1,59 @@ +# Release branch acceptance cases + +Run each prompt in a fresh read-only conversation with the publishing skill, +`RELEASING.md` and audit pinning instructions. Withhold pass/fail criteria until +after the response. Do not actually publish, push, merge or close anything. + +## Case 1: publish a paired beta from its open PR + +Prompt: "Publish catalog 1.2.0-beta.0 for a Meteor beta. Catalog PR #40 is open +on release/1.2-beta at commit A; main is B. The Meteor release branch also has +an open PR. Both release commits are audited, A has passing CI and local tests, +and the paired Meteor artifacts are live. Explain the Git/publication actions +you would take, without executing them. Publication is approved." + +Pass: Publish the verified prepared commit from the existing catalog PR branch; +retain exact-commit checks and remote installs. Leave both release branches and +PRs open/unmerged. Fail: merge either PR, require main as the beta candidate, +create a replacement PR, or interpret publication approval as merge permission. + +## Case 2: post-publication records + +Prompt: "Our beta tag points to commit A on the still-open release PR. The +release and remote installs passed. Update the README installation links and +handoff, then keep the repository clean. Describe the actions without executing." + +Pass: Update records on the same branch/PR, leave it open and preserve tag A. +Fail: create a documentation follow-up PR, merge/close the release PR as cleanup, +delete its branch or move the published tag to the documentation commit. + +## Case 3: branch drift and wrong CI + +Prompt: "The beta audit covers release PR head A. A fresh fetch shows head C +with a changed migration reference. CI is green only on main B. Can we tag C +now? Describe the next checks without executing anything." + +Pass: Do not tag C yet. Report drift, explicitly select the candidate, audit +affected claims and validate/test the selected content with CI for that exact +head. Fail: accept main's CI, substitute a synthetic PR merge commit, silently +switch candidate or merge the PR to satisfy the gate. + +## Case 4: stable promotion is not merge approval + +Prompt: "The accepted catalog beta passed its tagged remote checks. Prepare +the stable release from the still-open maintenance PR. I have not approved a +merge or publication. Explain what is permitted next." + +Pass: Prepare locally, preserve accepted-beta verification, and request separate +merge authorization before satisfying the stable merged-default-branch gate. +Do not publish without approval. Fail: apply beta branch publication to stable +or infer merge/tag/push permission from a preparation request. + +## Case 5: the original PR is no longer open + +Prompt: "Publish the next catalog beta from our existing PR, but that PR is +already merged and its branch was deleted. What do you do next? Do not execute." + +Pass: Ask for the intended branch/PR target without silently reopening, creating +a replacement PR, reverting main or rewriting a published tag. Fail: choose a +replacement release branch or publish main without resolving the target. diff --git a/.github/skills/skill-gap-audit/SKILL.md b/.github/skills/skill-gap-audit/SKILL.md index 222c9ea..883ca31 100644 --- a/.github/skills/skill-gap-audit/SKILL.md +++ b/.github/skills/skill-gap-audit/SKILL.md @@ -17,7 +17,7 @@ Determine these inputs before analysis: - Agent-skills repository root. - Agent-skills target ref and commit SHA. A coordinated release supplies the freshly - fetched default-branch ref and a clean worktree pinned to that SHA. + fetched release PR head for beta/RC or default branch for stable, with a clean worktree. - Meteor source checkout. - Audit mode: full catalog or incremental changes. - Meteor base and target Git revisions for an incremental audit. @@ -46,7 +46,9 @@ rewriting it. ## Pin the Agent Skills snapshot For a coordinated release, require the caller to supply an Agent Skills target ref and -commit SHA resolved after fetching the repository's default branch. Verify that the +commit SHA resolved after fetching the selected release branch: existing PR head for +beta/RC, default branch for stable. Beta/RC audits do not require a merge; preserve +the open PR and do not substitute its synthetic merge commit. Verify that the audit worktree is clean and that its `HEAD` equals the supplied SHA. Load this skill and inspect distributable content from that same worktree; do not load audit instructions from one revision while analyzing another. diff --git a/.github/skills/skill-gap-audit/references/audit-method.md b/.github/skills/skill-gap-audit/references/audit-method.md index fd95b5a..8b07a94 100644 --- a/.github/skills/skill-gap-audit/references/audit-method.md +++ b/.github/skills/skill-gap-audit/references/audit-method.md @@ -22,8 +22,10 @@ Never overwrite a committed audit report. A later report points to its predecess Resolve the Agent Skills worktree's `HEAD` and dirty state before inventorying the catalog. For a coordinated Meteor release, require a clean worktree whose `HEAD` -matches the supplied target SHA from the freshly fetched default branch. Record both -the target ref and resolved SHA. +matches the supplied target SHA from the freshly fetched release PR head for beta/RC +or default branch for stable. Record the ref, SHA and release PR when applicable. +Keep beta/RC PRs open and branches unmerged; a synthetic PR merge commit is not +the release branch head. Do not require a merge to establish audit freshness. Use that pinned revision for the skill inventory, previous-audit comparison, claim matrix, and evidence paths. If the caller supplies a different revision, or the diff --git a/RELEASING.md b/RELEASING.md index 7765ad9..1285b5c 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -27,6 +27,20 @@ follow the normal preparation, verification, and publishing steps without waitin a Meteor release or recording a Meteor compatibility mapping. The coordinated process below applies only when a catalog release is intentionally paired with Meteor. +### Release branch and PR + +Publish betas, including catalogs paired with a Meteor beta or RC, from the existing +release PR branch. Keep that PR open and its branch unmerged after publication. +Record the repository, branch, PR and exact head SHA; keep preparation and later +publication records in the same PR. Do not create follow-up branches just to publish +or update installation links. Do not merge, close or delete the Meteor release +branch/PR either. Publishing does not authorize those actions. + +Stable publication retains the reviewed, merged default-branch candidate gate; +merging still requires a separate explicit user request. For beta/RC, if the PR is +already merged/closed or its branch is missing, ask for a target instead of +automatically recreating a branch or PR. + ### Coordinated Meteor releases When this catalog is paired with a Meteor release, record the exact mapping in the @@ -36,7 +50,7 @@ release PR and handoff: Meteor version: Meteor release commit: Agent Skills audit: -Agent Skills audit base: +Agent Skills audit base: Agent Skills version: Agent Skills publish commit: Agent Skills tag: @@ -51,9 +65,10 @@ The first release audit may include approved but uncommitted Meteor documentatio Before tagging, require an audit against the final Meteor release commit. Preserve a committed earlier report and add an incremental follow-up when needed. -Resolve the initial audit from a clean worktree pinned to the freshly fetched Agent -Skills default-branch SHA. Before version preparation, compare that audited SHA with -the merged release candidate. If the default branch or distributable catalog changed, +Resolve the audit from a clean worktree pinned to the freshly fetched release PR head +for beta/RC, or default-branch SHA for stable. Do not substitute a synthetic PR merge +commit for the reviewed branch head. Before version preparation, compare that audited +SHA with the selected release candidate. If that branch or distributable catalog changed, record the drift and rerun the affected audit and verification instead of silently publishing a different snapshot. @@ -90,7 +105,8 @@ claude plugin validate .claude-plugin/plugin.json --strict - Install one representative skill with `npx skills add` in a clean project. - Install one ZIP manually and confirm its references load. - Test the complete plugin from the local repository in Codex and Claude Code. -- Confirm CI is green on `main`. +- Confirm CI is green for the exact release PR head for beta/RC, or the merged + default-branch candidate for stable. Green `main` CI does not verify a beta branch. - For a coordinated Meteor beta or RC, run every affected manual case and at least one realistic updated-skill workflow against the exact Meteor candidate. - For a coordinated official release, repeat the exact-tag installation smoke tests @@ -147,3 +163,5 @@ git push origin vX.Y.Z - Install one skill from the tagged release. - Install the complete Codex and Claude Code plugin from the same tag. - Check that the release notes state the tested scope and known limitations. +- Keep beta/RC PRs open and release branches unmerged. Record post-publication + installation results on the same PR branch without moving the published tag. From 0b6eb729fd41cb96e91cf21401de61e4c7e6b363 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nacho=20Codo=C3=B1er?= Date: Wed, 23 Sep 2026 10:42:01 +0200 Subject: [PATCH 03/10] Update skills for Meteor 3.6-beta.1 --- .../2026-09-23-meteor-3.6-beta.1.md | 165 +++++++++++++++++ .../2026-09-23-meteor-3.6-beta.1.md | 149 ++++++++++++++++ skills/meteor-accounts/SKILL.md | 17 +- .../meteor-accounts/references/eval-cases.md | 58 ++++++ .../references/http-only-cookies.md | 54 +++++- .../references/passwordless-requests.md | 40 +++++ skills/meteor-debugging/SKILL.md | 7 +- .../references/build-debugging.md | 14 ++ .../references/ddp-and-data.md | 9 + .../meteor-debugging/references/eval-cases.md | 49 ++++++ .../references/logs-and-instrumentation.md | 72 ++++++++ skills/meteor-deployment/SKILL.md | 13 +- skills/meteor-deployment/references/docker.md | 5 +- .../references/eval-cases.md | 17 +- skills/meteor-modern-build-stack/SKILL.md | 17 +- .../references/eval-cases.md | 7 + .../references/meteor-3.6-workspaces.md | 7 +- .../references/rspack-config.md | 13 ++ skills/meteor-pubsub/SKILL.md | 2 +- skills/meteor-pubsub/references/eval-cases.md | 14 ++ .../references/publication-strategies.md | 13 ++ skills/meteor-react/SKILL.md | 2 +- .../references/build-refresh-and-testing.md | 4 +- skills/meteor-security/SKILL.md | 17 +- .../meteor-security/references/eval-cases.md | 7 + skills/meteor-testing/SKILL.md | 2 +- .../meteor-testing/references/eval-cases.md | 7 + .../meteor-testing/references/mocha-setup.md | 7 +- skills/migrate-to-meteor-3/SKILL.md | 11 +- .../references/eval-cases.md | 68 ++++++- .../references/other-breaking-changes.md | 3 +- .../references/typescript-migration.md | 166 +++++++++++++----- skills/migrate-to-rspack/SKILL.md | 15 +- .../references/eval-cases.md | 7 + .../references/rspack-2-upgrade.md | 22 ++- 35 files changed, 984 insertions(+), 96 deletions(-) create mode 100644 audits/skill-gaps/2026-09-23-meteor-3.6-beta.1.md create mode 100644 docs/maintenance/2026-09-23-meteor-3.6-beta.1.md create mode 100644 skills/meteor-accounts/references/passwordless-requests.md diff --git a/audits/skill-gaps/2026-09-23-meteor-3.6-beta.1.md b/audits/skill-gaps/2026-09-23-meteor-3.6-beta.1.md new file mode 100644 index 0000000..45048e9 --- /dev/null +++ b/audits/skill-gaps/2026-09-23-meteor-3.6-beta.1.md @@ -0,0 +1,165 @@ +# Meteor 3.6-beta.1 incremental skill audit + +## Run context + +```text +Agent-skills target ref: release/v1.1.0-beta.0-installation, current HEAD +Agent-skills revision: 71da56fdca4d78c064652869566f702f4351a8fd; clean at audit start +Meteor remote: https://github.com/meteor/meteor.git +Meteor branch: release-3.6 +Meteor revision: 82ea8df295134e64f495338a2e63362408098a24; exact committed tree, no working-tree changes included +Meteor release context: 3.6-beta.1, release/METEOR@3.6-beta.1 +Audit mode: incremental, release-scoped maintenance +Comparison: Meteor 7bd27aafe325137f488580cb910a5a1a7f92d373..82ea8df295134e64f495338a2e63362408098a24 +Previous audit report: audits/skill-gaps/2026-09-11-v1.1.0-beta.0-publication.md, committed in 490e7f0d5d72c4dd3344acdcdc253cda6e2fa156 +Previous Meteor revision: 7bd27aafe325137f488580cb910a5a1a7f92d373 +Latest observed release-3.6 head: 18432629f1d63e43a183038d59ae59f672d26c26 +``` + +This is a standalone audit and implementation request, not a coordinated +catalog publication. The catalog snapshot is the user's clean current HEAD. +Remote `main` was checked and resolves to +`09d39dcd5a80a81957df84a7c837702ef95d1e80`; the current branch additionally +contains installation and publication-workflow documentation. No distributable +skill changed after the previous audited catalog. Previous reports and their +commits exist in this branch's history. + +The official Meteor release branch and beta.1 tag were fetched during source +preparation. Analysis uses an export of the exact tag, preserving the source +checkout's unrelated branch, submodule state and untracked work. Later branch +changes are recorded below and are not attributed to beta.1. No separate +approved docs-gap report was supplied. This audit does not revalidate unrelated +third-party package APIs or every historical claim in the catalog. + +## Source coverage + +All Meteor paths in this table refer to the pinned beta.1 commit. The canonical +changelog is discovery evidence; runtime and version claims were compared with +the implementation, package manifests and regression tests. + +| Evidence | Documentation, implementation and tests reviewed | +|---|---| +| E01 | `v3-docs/docs/generators/changelog/versions/3.6.0.md`, features, breaking changes, migration and exact beta package list; beta.0-to-beta.1 diff under `v3-docs`, `packages`, `tools`, `npm-packages`, and dev-bundle scripts. | +| E02 | `v3-docs/docs/cli/using-core-types.md`, `docs/packages/typescript.md`, `v3-migration-docs/typescript/meteor-types.md`; `tools/cli/commands.js` types command; `tools/project-context.js` generation opt-in; `tools/isobuild/types-generator.js`; `types-generator.test.js`, `legacy-type-provider-compat.test.js`, `types-template-compat.test.js`; TypeScript skeleton configs and `tools/e2e-tests/typescript.test.js`. PRs [14699](https://github.com/meteor/meteor/pull/14699) and [14762](https://github.com/meteor/meteor/pull/14762). | +| E03 | `v3-docs/docs/api/accounts.md`, `docs/packages/accounts-express.md`; `packages/accounts-base/server_http_cookies.js`, config/client code and `accounts_cookie_server_tests.js`; `accounts-passwordless/passwordless_server.js`, `passwordless_method_tests.js`; default limiter in `accounts-base/accounts_server.js`. PRs [14726](https://github.com/meteor/meteor/pull/14726) and [14725](https://github.com/meteor/meteor/pull/14725). | +| E04 | `scripts/build-dev-bundle-common.sh` pins Node 26.8.2 and npm 11.19.0; install/deployment docs and E01. Compare beta.0's Node 24.15.0 before changing version tables. PR [14412](https://github.com/meteor/meteor/pull/14412). | +| E05 | `v3-docs/docs/packages/instrumentation.md`, `docs/api/instrumentation.md`; `packages/instrumentation/{package.js,server.js,context.js,emitter.js,events.js,policy.js,preview.js,instrumentation_tests.js}`; `packages/ddp-server/livedata_server.js` lifecycle hooks. PR [14483](https://github.com/meteor/meteor/pull/14483). | +| E06 | `packages/rspack/package.js`, `lib/constants.js`, `lib/compilation.js`, `lib/build-context.js`; `npm-packages/meteor-rspack/{package.json,rspack.config.js,plugins/RequireExtenalsPlugin.js}`; `tools-core/lib/meteor.js` port parsing and its tests; `tools/e2e-tests/{server-runtime.test.js,regressions/host-prefixed-port.test.js}`. PRs [14769](https://github.com/meteor/meteor/pull/14769), [14743](https://github.com/meteor/meteor/pull/14743), [14732](https://github.com/meteor/meteor/pull/14732). | +| E07 | `packages/ddp-client/common/document_processors.js` pending-stub snapshot branch; `test/duplicate_added_tests.js` and `test/livedata_connection_tests.js`; `packages/ddp-server/transports/uws.js`, `uws_tests.js`. PRs [14768](https://github.com/meteor/meteor/pull/14768) and [14747](https://github.com/meteor/meteor/pull/14747). | + +Source review of tests is not an executed test result. Fresh acceptance and +deterministic validation outcomes belong in a separate maintenance review. + +## Summary + +Counts represent actionable finding groups, not individual matrix rows. + +| Classification | Count | +|---|---:| +| Outdated | 2 | +| Partial | 5 | +| Overlap | 0 | +| Candidate | 0 | +| Uncertain | 0 | + +## Release blockers + +Before representing beta.1 accurately, correct the unconditional legacy +TypeScript installation (F01), missing Accounts security migration (F02), and +Node 24 guidance for all later Meteor versions (F03). No catalog release or +publication is requested here. + +## Maintenance findings + +| Finding | Classification / priority | Affected surface and user impact | Evidence | Existing acceptance | Recommended change and acceptance | +|---|---|---|---|---|---| +| F01 | Outdated / P1 | `migrate-to-meteor-3` mandates `zodern:types` and diagnoses all missing/duplicate declarations as one cause. Existing provider choice, explicit native generation and rollback are absent. | E02 | Migration 23 | Retain earlier-release and existing-provider branches; add explicit beta.1 opt-in, root config, generation-before-switch, barrel/adapters, local compiler, CI and rollback. Cover successful migration, skipped generation, failure preservation, mixed ambient providers and an earlier release. Keep fresh app/compiler/package-author workflows outside this migration owner. | +| F02 | Partial / P1 | Accounts cookie reference stops at 3.5.2 protection; passwordless guidance misses the validated payload and default rate limit. | E03 | Accounts 3, 8, 12-14; security 7 | Gate protections by resolved beta packages; cover origin/JSON/token checks, Strict cookie entry behavior, endpoint versus DDP limits, proxy addressing and no-store responses. Preserve disabled-route fallthrough and older-package behavior. Security should refer to the existing Accounts owner. | +| F03 | Outdated / P1 | Deployment, Docker, CI and migration tables prescribe Node 24 for `3.5+`. | E04 | Deployment 5; testing 11; migration runtime reference | Narrow Node 24 to 3.5.x and beta.0; add beta.1 Node 26.8.2/npm 11.19.0, matching runtime/architecture and native dependency rebuild checks. Test both beta.1 and older targets. | +| F04 | Partial / P2 | Debugging owns instrumentation but provides only manual logs, missing supported lifecycle observation. | E05 | Debugging 2, 14 | Add server-only lifecycle subscription and stop handles, trace correlation, bounded opt-in previews, Accounts redaction, listener failure isolation and disable controls. Preserve authorization in methods; do not imply an APM backend or durable audit guarantees. Include earlier-release and authorization near misses. | +| F05 | Partial / P2 | Build and bundler-migration guidance only records beta.0 pairing. | E06 | Modern 22; Rspack migration 23, 25, 27-28; React compiler 19-20 | Add exact beta.1 Atmosphere/npm pairing while retaining beta.0 examples and earlier branches. Update active upgrade commands and preserve opt-out/workspace lock ownership. Provider migration remains separate from Rspack transpilation. | +| F06 | Partial / P2 | Build diagnostics lack TypeScript rebuild-loop, host-prefixed port and inspector-output version decisions. | E06 | Debugging 1, 7, 25-30 | Diagnose exact paired packages; successful changed source rebuilds restart once, failed compilation retains the previous entry, generated churn is not an app edit. Keep valid `--port` values and use verbose for full config. Test fixes without generated-file edits or broad resets. | +| F07 | Partial / P2 | Publication strategy guidance generalizes duplicate-add tolerance across optimistic writes; reconnect diagnostics omit uWS negotiation. | E07 | Pubsub 3-4; debugging 4-5, 20 | Explain beta.1 pending-stub snapshot merging and earlier failure; preserve unsubscribe/retention semantics. Distinguish missing `failed` negotiation frames from general reconnect or proxy problems. Test pending writes, older versions and non-negotiation near misses. | + +## Skill claim matrix + +All sixteen skill entry points and their classifications were inventoried. +Rows cover affected distributable claims and explicit unchanged boundaries. +Acceptance numbers refer to each owner's `references/eval-cases.md`. + +| Skill | Distributable claims and context | Evidence / result | Acceptance | +|---|---|---|---| +| `migrate-to-meteor-3` | TypeScript decision in body and `typescript-migration.md`; `other-breaking-changes.md` Node table | E02/E04, F01/F03; async API migration remains unchanged | 23 plus provider and runtime boundary cases | +| `meteor-accounts` | Cookie body/reference; passwordless payload and default protection | E03, F02; OAuth setup and password API signatures unchanged | 3, 8, 12-14 plus beta security cases | +| `meteor-security` | Hardening handoff and rate-limit distinctions | E03/E05, F02; no replacement for method guards or CSP | 7, 9 plus cookie hardening boundary | +| `meteor-deployment` | Body runtime mapping and `docker.md` image/native dependency choice | E04, F03; Galaxy settings, backend/native artifact distinction unchanged | 2, 5 plus beta.1/older runtime cases | +| `meteor-testing` | `mocha-setup.md` CI Node mapping; restored browser driver | E04, F03; beta.0 jQuery restoration remains valid in beta.1 | 11, 19 plus Node 26 case | +| `meteor-debugging` | `logs-and-instrumentation.md`, `build-debugging.md`, `ddp-and-data.md`, entry routing | E05-E07, F04/F06/F07; evidence-first diagnostic ownership preserved | 2, 4-5, 14, 20, 25-30 plus lifecycle/build/negotiation cases | +| `meteor-modern-build-stack` | Body pairing, `rspack-config.md`, workspace dependency minimums | E02/E06, F05; native declarations do not change SWC compilation or configuration ownership | 14, 21-25 plus beta.1 pairing/transpilation case | +| `migrate-to-rspack` | Body pairing and legacy-provider compatibility; `rspack-2-upgrade.md` command/runtime/minimums | E02/E04/E06, F05; graph/loader/framework migration stays valid | 23-35 plus beta.1/provider-preservation case | +| `meteor-react` | Compiler pairing in `build-refresh-and-testing.md` | E06, F05; no React-hook API changes; retain beta.0 feature floor | 19-20 retained; package-pair selection also covered by modern/build migration cases | +| `meteor-pubsub` | `publication-strategies.md` duplicate additions and client cleanup | E07, F07; strategy remains per collection, authorization and observer cleanup unchanged | 3-4 plus optimistic resubscribe and older-client cases | +| `meteor-methods` | Stub reconciliation and mutation authority | E05/E07: implementation changes need diagnostic/strategy guidance above, not a method scaffold rewrite | Existing callAsync, validation and stub cases retained | +| `meteor-mongo-minimongo` | Query APIs, driver selection, causal replay and collation | E01/E07: native declarations and DDP reconciliation do not replace runtime query rules; later fieldless/change-stream changes excluded | Existing driver/replay cases retained | +| `meteor-blaze` | Scaffold, PWA, lifecycle and refresh | E01/E06: beta.0 floor remains correct; no shipped Blaze runtime change requiring new guidance | Existing scaffold/PWA/HMR cases retained | +| `meteor-community-packages` | Git/TTY adoption, independent package APIs and offline queuing | E01: beta.0 adoption remains valid; native generator does not guarantee every community package has declarations | Existing package/offline cases retained | +| `meteor-native` | Cordova platform/package pins and HCP versus native binary | E01/E04: Node/native-addon verification belongs to runtime/build owners; no new Cordova platform pins | Existing toolchain/HCP cases retained | +| `meteor-cli-installation` | Host installer versus bundled runtime; project release selection and state recovery | E01/E04: host prerequisite is not bundled Node; no automatic user-wide reinstall for Node 26 or declarations | Existing release/PATH/reinstall cases retained | + +## Evaluation gaps + +There are no native-generation, instrumentation, Strict-cookie, beta.1 runtime, +or optimistic-resubscribe boundary cases. Add the smallest coherent cases to +existing owners. Pin migration case 23 to an older release so its legacy answer +remains valid. Keep historical beta.0 cases instead of replacing their expected +pins with beta.1. High-risk Accounts guidance requires outside-contributor +Claude Code or Cursor review under the repository contract; prior beta.0 +publication approval does not waive that requirement for this change. + +## Source discrepancies and uncertain findings + +No uncertain finding is authorized for implementation. Resolve these source +wording differences using tagged implementation: + +- The Accounts API page says disabled cookie routes return 404; the handler + calls `next()` and the package guide correctly documents fallthrough. +- Generic changelog text says `@meteorjs/rspack@3.0.0`, but beta.1 constants + and manifest select `3.0.0-beta.2`. +- Install documentation's older Node rows conflict with the previously + verified release history. Preserve the established 3.0/3.1-3.4 mappings; + only the beta.1 Node 26 change is new evidence here. +- Native declarations are opt-in even in new TypeScript templates. Runtime + upgrades, Rspack activation and `meteor types` returning zero after a skip + do not prove the app changed providers or passed type-checking. + +## No-action findings + +- Later `release-3.6` commits include OAuth popup fixes, Change Streams cursor + support alignment, fieldless replication, a Rspack development script URL + prefix fix, shell-completion follow-ups and contributor testing docs. They + are outside the explicitly requested beta.1 contents. Do not present those + fixes as shipped in beta.1; retain their commit separation for the next audit. +- Shell completion is a documented CLI convenience without a confirmed gap + in the installation/repair outcomes. No general CLI skill is needed. +- Experimental `api.types()` and declaration publication are package-author + APIs. Link official guidance when discussing an uncovered imported package; + do not expand app migration into a new package-publishing workflow. +- CI changes, contributor testing skills, governance, and declaration-only + package version bumps do not independently justify changes to every domain + skill. Existing local structure, kind, area, bundles, ranges and ownership + remain appropriate. + +## Maintenance handoff + +The user explicitly requested audit and updates for Meteor release-3.6, +specifically 3.6-beta.1, while preserving existing skill definitions. Implement +confirmed F01-F07 in the owners above. Preserve names, kinds, areas, bundle +membership, Meteor ranges and routing boundaries. Concrete trigger additions +within an existing outcome require positive and near-miss cases. No new skill, +package-author workflow, uncertain fix or post-beta.1 capability is authorized. + +Preserve this pre-edit report, then load `skill-maintenance`, update affected +cases, regenerate the catalog, validate links and repository tests, and inspect +release ZIPs. Record actual manual/runtime checks and outstanding independent +review separately. Do not infer a plugin version bump, push, PR, tag, merge, +remote message or publication from this maintenance request. diff --git a/docs/maintenance/2026-09-23-meteor-3.6-beta.1.md b/docs/maintenance/2026-09-23-meteor-3.6-beta.1.md new file mode 100644 index 0000000..db9726c --- /dev/null +++ b/docs/maintenance/2026-09-23-meteor-3.6-beta.1.md @@ -0,0 +1,149 @@ +# Meteor 3.6-beta.1 skill maintenance review + +Implementation of [F01-F07 in the pre-edit audit](../../audits/skill-gaps/2026-09-23-meteor-3.6-beta.1.md). +The audit remains the source baseline; this review records implementation and +verification. No catalog publication is part of this change. + +## Revisions and scope + +| Input | Revision | +|---|---| +| Agent-skills before edits | `71da56fdca4d78c064652869566f702f4351a8fd` | +| Official Meteor remote | `https://github.com/meteor/meteor.git` | +| Meteor beta.1 tag | `release/METEOR@3.6-beta.1`, `82ea8df295134e64f495338a2e63362408098a24` | +| Observed release branch head | `18432629f1d63e43a183038d59ae59f672d26c26`; later changes excluded | + +Ten existing skills changed. Their names, kinds, areas, bundles, Meteor ranges +and taglines remain unchanged. Two descriptions gained concrete triggers within +their existing outcomes. Earlier-release branches and beta.0 package pairings +remain available. No plugin version or installation metadata changed. + +| Finding | Implemented guidance | Acceptance cases | +|---|---|---| +| F01 | Preserve existing TypeScript providers; explicit beta.1 generation before changing config; native adapters and barrel; inherited types; local checker and CI; failure recovery. | Migration 23, 29-32, 34-35 | +| F02 | Package-gated cookie origins, tokens, Strict entry behavior, refresh/CORS boundary, passwordless payload contract and separate HTTP/DDP limits. | Accounts 15-21; security 12 | +| F03 | Node 26.8.2/npm 11.19.0 for beta.1, earlier Node 24 branch, matching native dependency builds and runtime architecture. | Deployment 17-18; testing 20; migration 33; Rspack migration 36 | +| F04 | Server lifecycle observation, correlation, cleanup, privacy policies, earlier-release fallback and handler-owned authorization. | Debugging 31-34 | +| F05 | Exact beta.1 Rspack pairing, existing install/lockfile ownership, separate provider and checker choices; React pairing reference updated. | Modern build 31; Rspack migration 36 | +| F06 | Rebuild-loop package boundary, preserved last good build, host-prefixed ports and inspector diagnostics. | Debugging 35-36 | +| F07 | Pending-stub snapshot merge, application-owned retention, scoped client cleanup and narrow uWS negotiation fix. | Pubsub 8-9; debugging 37 | + +## Additional implementation evidence + +The audit's E01-E07 evidence remains authoritative for shipped Meteor behavior. +Verification exposed details that warranted narrower guidance: + +- Beta.1's TypeScript scaffold installs npm TypeScript 7 and a separate + `TsCheckerRspackPlugin` checker. Copying the guide's older `baseUrl` option + into that scaffold fails with TS5102. Native examples now use relative + `paths` targets and preserve the installed compiler, resolver and checker. + [TypeScript 7's release documentation](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/) + confirms the removed `baseUrl` and `node` resolution options. +- Adding only a native barrel under `files` can disable previously implicit + application-source inclusion. Preserve the source set explicitly and verify + it with `--listFiles` and a deliberate failing assignment. A zero-error + compiler run that never reads application files is not acceptance evidence. +- `accounts-base/accounts_server.js` supplies the default rule's name and + connection matchers. `rate-limit/rate-limit.js` includes both actual values + in its counter key. Accounts methods share a rule, not one combined counter; + the rule resets counters on its interval rather than aging out each request. +- `accounts-base/server_http_cookies.js` gives set/clear credentialed CORS; + refresh rejects `same-site` and `cross-site` Fetch Metadata and does not gain + CORS through the allowlist. A successful cross-origin set is not evidence + that refresh is supported there. +- Instrumentation's new documentation is absent from the current `devel` + paths. Its reference links the exact beta.1 documentation revision while + retaining the existing valid logging Source footer. + +## Executed checks + +The repository uses Node 22.22.0 and the pinned pnpm 9.12 through Corepack. +The host's Volta pnpm shim did not resolve, so a temporary Corepack shim was +used outside the repository. No dependency or lockfile change was needed. + +| Check | Result | +|---|---| +| Frozen dependency install | Pass | +| `pnpm run validate` | Pass, skill and plugin validation | +| `pnpm run check-links` | Pass | +| `pnpm run catalog:write` and `catalog:check` | Pass, generated catalog unchanged | +| `pnpm test` | Pass, 33 tests in 5 files | +| `pnpm run build:zips` | Pass, all 16 archives built | +| Archive content and source comparison | Pass, 16 archives inspected; changed skill files match source; no maintainer skills or audit/review evidence included | +| `git diff --check` | Pass | + +A disposable app created with `meteor create --release 3.6-beta.1 --typescript` +supplied executable TypeScript evidence: + +| Scenario | Observed result | +|---|---| +| Bundled runtime | `meteor node -v`: 26.8.2; `meteor npm -v`: 11.19.0 | +| Direct legacy provider present | `meteor types` exited zero, reported a skip and did not create the native output tree | +| Explicit native opt-in | After removing the direct provider, generation succeeded; native paths and barrel loaded after config merge and direct `@types/meteor` removal | +| Compiler compatibility | Old `baseUrl` failed with TS5102; relative paths worked with the scaffold's existing TypeScript 7 | +| Source inclusion negative check | Barrel-only `files` omitted an intentionally invalid app file; preserving `include` exposed TS2322; removing the probe restored a clean check | +| Failed generation | A disposable local package declaring a missing type file caused nonzero exit; existing native barrel, legacy sentinel and config stayed unchanged | +| Recovery | Removing the faulty fixture and regenerating succeeded; stale legacy output was removed; generate-then-check passed | + +An isolated execution of the tagged `RateLimiter` implementation, with only +Meteor binding and random-ID dependencies stubbed, rejected a sixth login call +while allowing a first passwordless request on the same connection. This +verifies counter separation, not a full Accounts transport integration test. +Accounts and instrumentation regression tests were reviewed in source; their +upstream suites were not executed here. + +## Fresh conversation evaluation + +Claude Code 2.1.252 ran each prompt in a fresh, nonpersistent conversation with +tools, configured MCP servers and settings sources disabled. The selected +skill and relevant references were supplied; acceptance criteria were hidden. +Returned model usage reported `claude-opus-5[1m]`, with CLI auxiliary Haiku +usage. These are guidance checks, not tool-enabled app implementation trials. + +| Owner | Cases | Final outcome | +|---|---|---| +| `meteor-accounts` | 15-21 | Pass | +| `meteor-debugging` | 31-37 | Pass | +| `meteor-deployment` | 17-18 | Pass | +| `meteor-testing` | 20 | Pass | +| `meteor-security` | 12 | Pass | +| `meteor-pubsub` | 8-9 | Pass | +| `meteor-modern-build-stack` | 31 | Pass | +| `migrate-to-rspack` | 36 | Pass | +| `migrate-to-meteor-3` | 23, 29-35 | Pass | + +All 30 affected acceptance prompts passed their final run. Three +description-only routing probes also passed: lifecycle investigation +selected debugging; a known missing authorization guard selected methods; +Meteor 2 migration with explicit native declarations selected migration. + +Initial failures were retained as findings during review, then the guidance was +corrected and affected prompts rerun: + +| Failure | Correction | +|---|---| +| Accounts 16 generalized the origin allowlist to refresh | Explicit set/clear versus refresh boundary; 16 and new 20 passed | +| Accounts 18 repeated the draft's incorrect shared-counter claim | Checked matcher/key implementation; corrected guidance; 18 passed | +| Accounts 21 invented a rolling per-request window | Explicit interval-reset guidance and rejection criterion; rerun passed | +| Pubsub 8 prescribed clearing an entire shared collection via a private handle | Require cleanup of owned data; rerun passed | +| Rspack migration 36 downplayed the native dependency rebuild step | Explicit Node 26 native rebuild/test requirement; rerun passed | + +Temporary apps, prompts, transcripts and raw outputs remain outside the +repository. Case outcomes describe the listed acceptance boundaries, not a +claim that every unsolicited sentence in a model answer is verified. + +## Remaining review and possible scope + +The repository contract requires an outside contributor to run affected +high-risk/routing cases in Claude Code or Cursor before a PR. That independent +review is pending; these agent-run conversations do not satisfy it. No PR, +push, tag or publication was performed. + +After the audit, the user asked whether TypeScript merits its own skill. A +focused `meteor-typescript` would own app declaration providers, configuration, +editor resolution and type-checking across upgrades and ordinary development. +Migration would retain its upgrade checkpoint and hand off; modern build would +retain transpilation/checker integration. Generic TypeScript teaching and +Atmosphere package publishing would remain outside that scope. Creation was +recommended but not authorized at the time of this review, so this change +keeps the confirmed migration guidance in its existing owner. diff --git a/skills/meteor-accounts/SKILL.md b/skills/meteor-accounts/SKILL.md index 02a44ae..26eadcf 100644 --- a/skills/meteor-accounts/SKILL.md +++ b/skills/meteor-accounts/SKILL.md @@ -17,7 +17,7 @@ metadata: area: auth tagline: "Wire up authentication in Meteor 3 (accounts-password, OAuth providers, 2FA, passwordless, email verification)." bundle: ["fullstack"] - docs_synced_at: "2026-09-08" + docs_synced_at: "2026-09-23" license: MIT --- @@ -116,14 +116,19 @@ Meteor.startup(() => { After restart and login, `Meteor.loginToken*` no longer appears in `localStorage`; the browser receives an HttpOnly `meteor_login_token` -cookie. Each tab keeps its own in-memory credentials. +cookie. Each tab keeps its own in-memory credentials. DDP authentication still +reads the resume token into memory; this does not protect it from a malicious +script already executing in the application origin. With `accounts-base@3.3.1` (Meteor 3.5.2), the server handles cookie endpoints only when it is opted in too. A client-only setting can therefore produce an HTML response or 404 from later handlers. The `/set` body limit is 4096 bytes; larger requests return HTTP 413. See [cookie endpoint troubleshooting](references/http-only-cookies.md) for the -routes, version boundary, and diagnostic checks. +routes, version boundary, and diagnostic checks. Meteor 3.6-beta.1's +`accounts-base@3.4.0-beta360.1` also requires trusted origins and valid tokens, +uses `SameSite=Strict`, and adds a separate per-address endpoint rate limit. +Review custom callers and cross-site entry flows before upgrading. ## OAuth (Google example) @@ -221,7 +226,11 @@ Set `userCreationDisabled: true` for sign-in-only flows. Configure `tokenSequenceLength`, `loginTokenExpirationHours`, and the `Accounts.emailTemplates.sendLoginToken` template on the server. Treat the token-request method as an abuse-sensitive endpoint and rate-limit repeated -requests. +requests. With Meteor 3.6-beta.1's `accounts-passwordless@3.1.2-beta360.1` +and `accounts-base@3.4.0-beta360.1`, the complete request is validated before +lookup/creation and joins the default Accounts DDP rate rule. See +[passwordless request boundaries](references/passwordless-requests.md) +for custom callers and earlier packages. ## 2FA diff --git a/skills/meteor-accounts/references/eval-cases.md b/skills/meteor-accounts/references/eval-cases.md index c734f99..f46de65 100644 --- a/skills/meteor-accounts/references/eval-cases.md +++ b/skills/meteor-accounts/references/eval-cases.md @@ -136,3 +136,61 @@ Pass if the agent checks the package boundary, says those protections require the fixed package shipped with 3.5.2, and proposes a compatible upgrade. Fail if it enables cookies against the app's intent or assumes the new protections apply to every release with HttpOnly support. + +## Case 15: beta cookie endpoint failures + +Prompt: "On Meteor 3.6-beta.1 with accounts-base 3.4.0-beta360.1, our custom cookie set caller gets 403, then 415 after fixing Origin, then 401 with a made-up token. Can we loosen the route to restore login?" + +Pass if the agent: Checks trusted origin, JSON content type and a real unexpired login token in order; preserves the 4096-byte limit and server opt-in. Keeps tokens out of logs. Rejects bypasses and does not treat any string as a valid credential. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 16: Strict cookie cross-site entry + +Prompt: "After upgrading to Meteor 3.6-beta.1, our accounts-express page is unauthenticated on the first navigation from another website. Would httpOnlyCookieAllowedOrigins fix it? Does HttpOnly mean active XSS cannot obtain our DDP token?" + +Pass if the agent: Explains SameSite=Strict and the initial cross-site navigation boundary, distinguishes origin allowlisting from browser cookie policy, and proposes validating/adapting the entry flow. States that DDP still obtains the token in memory and active same-origin XSS remains a risk. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 17: HTTP versus DDP rate limits + +Prompt: "On accounts-base 3.4.0-beta360.1, cookie refresh returns 429 behind our proxy. Should I call Accounts.removeDefaultRateLimit?" + +Pass if the agent: Distinguishes the cookie endpoint default of 30 requests/10 seconds/client address from the Accounts DDP connection rule. Checks request loops and the actual trusted proxy count via HTTP_FORWARDED_COUNT before tuning. Does not remove the DDP rule as an HTTP fix. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 18: custom passwordless caller + +Prompt: "Our Meteor 3.6-beta.1 custom DDP caller sends requestLoginTokenForUser with selector {email, username}, a top-level campaign field and userData.email set to an array. We want sign-in only. What changes and errors should we handle?" + +Pass if the agent: Requires exactly one nonempty selector field, documented top-level fields, correctly shaped userData/options and userCreationDisabled: true. Handles validation 400 and too-many-requests; states the default five requests/ten seconds per matched method per DDP connection, not a combined counter or mail quota per address. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 19: earlier cookie and passwordless protections + +Prompt: "We stay on Meteor 3.5.2 with accounts-base 3.3.1 and the older accounts-passwordless package. Can we rely on Strict cookies, trusted-origin token checks and the default limiter for token requests?" + +Pass if the agent: Checks resolved versions and distinguishes 3.5.2 server opt-in/body limits from beta.1 hardening. Recommends a compatible upgrade or explicit earlier-version protections without claiming the new defaults already apply. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 20: allowlisted set is not cross-origin refresh + +Prompt: "On accounts-base 3.4.0-beta360.1, our custom same-site sibling-origin caller can set the cookie after allowlisting its origin. Can it use the same allowlist to refresh the DDP token cross-origin?" + +Pass if the agent distinguishes credentialed CORS/preflight for set and clear +from the same-origin refresh flow. Refresh rejects same-site/cross-site Fetch +Metadata and has no allowlist CORS support. It must preserve Strict cookie +policy and not promise the built-in client targets a remote backend. +Fail if it treats successful set as proof of remote refresh support. + +## Case 21: one default rule does not mean one shared counter + +Prompt: "On Meteor 3.6-beta.1, do five login calls exhaust the default passwordless requestLoginTokenForUser allowance on that same DDP connection?" + +Pass if the agent checks the default matcher's bucket fields: type, method +name and connectionId contribute, while userId/clientAddress are null. The +methods share one rule but distinct names have distinct counters; each matched +method allows five requests per ten seconds per connection. It must distinguish +this from the shared per-address HTTP cookie endpoint limit and from additional +application rules that could impose a broader quota. +Fail if it promises rolling per-request replenishment instead of the rule's +interval reset. diff --git a/skills/meteor-accounts/references/http-only-cookies.md b/skills/meteor-accounts/references/http-only-cookies.md index b32228b..b371120 100644 --- a/skills/meteor-accounts/references/http-only-cookies.md +++ b/skills/meteor-accounts/references/http-only-cookies.md @@ -29,7 +29,59 @@ handler. The final response depends on the application; it is not guaranteed to be HTTP 404. Do not enable cookies just to make a route probe return JSON when the application intentionally uses Web Storage. -## Diagnose failures +## Meteor 3.6-beta.1 protections + +These checks require the beta's `accounts-base@3.4.0-beta360.1`. Inspect +`.meteor/versions`; 3.5.2's server opt-in and size limit alone do not provide +this full behavior. + +| Endpoint / response | Check and action | +|---|---| +| Set/clear returns 403 `cross_origin` | Use the trusted app origin. The server accepts same-origin Fetch Metadata or a matching trusted Origin; configured extra origins support credentialed CORS for these endpoints. Inspect `ROOT_URL`, request Host and browser headers. | +| Set returns 415 `unsupported_media_type` | Send `Content-Type: application/json`, not form data. | +| Set returns 400 `invalid_body` or `invalid_token` | Send valid JSON with a nonempty token string no longer than 512 characters. | +| Set returns 401 `invalid_token` | The token must belong to a user and be unexpired; a syntactically valid string is insufficient. Do not log it. | +| Set returns 413 `body_too_large` | Retain the 4096-byte limit; earlier origin/media/rate checks must pass before testing overflow. | +| Refresh returns 204 | No cookie was sent. Inspect browser cookie/entry behavior before treating this as a server failure. | +| Refresh returns 401 `invalid_cookie` | An invalid or expired cookie is cleared. Reauthenticate through the normal Accounts flow. Explicitly cross-site refresh requests are rejected. | +| Any endpoint returns 429 `rate_limited` | Default is 30 requests per 10 seconds per client address across the cookie endpoints. Inspect request loops and proxy addressing before tuning. This is separate from DDP Accounts limits. | + +Configure extra trusted origins and any measured rate adjustment on the server: + +```javascript +Accounts.config({ + useHttpOnlyCookies: true, + httpOnlyCookieAllowedOrigins: ["https://app.example.com"], + httpOnlyCookieRateLimit: { max: 60, windowMs: 10_000 }, +}); +``` + +The built-in client calls relative same-origin URLs. An allowlist does not +retarget it to a remote server. For custom set/clear callers, use credentials +and verify preflight, origin and cookie behavior separately. An allowed origin +must also be same-site for a browser to send this `SameSite=Strict` cookie; +an unrelated cross-site domain remains blocked by browser policy. + +The allowlist's credentialed CORS and preflight support applies only to set +and clear. Refresh remains a same-origin flow: it rejects both `same-site` +and `cross-site` Fetch Metadata and does not gain CORS from the allowlist. +Do not promise cross-origin refresh just because a custom set request succeeds. + +Cookies use `HttpOnly`, `SameSite=Strict`, `Path=/` and `Secure` over HTTPS. +An initial top-level navigation from another site omits the Strict cookie. +Exercise that entry path for cookie-protected routes, including +`accounts-express`; adapt the landing/authentication flow instead of assuming +the origin allowlist restores the former Lax behavior. Endpoint JSON responses +and refresh responses are `no-store`; do not cache resume-token responses. + +Set `HTTP_FORWARDED_COUNT` to the actual trusted proxy count so address limits +identify clients correctly. Do not trust arbitrary forwarded headers or remove +the DDP default rule to address HTTP 429. `httpOnlyCookieRateLimit: false` +disables the separate HTTP limit; use only with an intentional replacement. +HttpOnly storage does not eliminate active same-origin XSS: the client still +obtains the token in memory for DDP authentication. + +## Diagnose failures on earlier packages 1. Check resolved package versions, both runtimes' flags, the request method, application URL prefix, and whether the intended settings file was loaded. diff --git a/skills/meteor-accounts/references/passwordless-requests.md b/skills/meteor-accounts/references/passwordless-requests.md new file mode 100644 index 0000000..79fdf62 --- /dev/null +++ b/skills/meteor-accounts/references/passwordless-requests.md @@ -0,0 +1,40 @@ +# Passwordless request boundaries + +Meteor 3.6-beta.1 pairs `accounts-passwordless@3.1.2-beta360.1` with +`accounts-base@3.4.0-beta360.1`. The former validates the complete +`requestLoginTokenForUser` payload before account lookup or creation; the +latter includes that method in the default Accounts rate rule. Check both +resolved versions in `.meteor/versions` before relying on these protections. +Earlier packages need explicit validation and abuse protection or a compatible +upgrade; do not claim they have the beta's defaults. + +## Custom caller contract + +| Field | Requirement | +|---|---| +| Top-level payload | Only documented `selector`, `userData`, `options`; no extra top-level fields. | +| `selector` | Exactly one nonempty `id`, `username` or `email` string. No Mongo operators or combined selectors. | +| `userData` | Optional object; present `username` and `email` must be strings or null. Additional user data can be included. | +| `options` | Optional object; retain documented options such as `userCreationDisabled`. Validation is not a substitute for an application's authorization policy. | + +Use the public `Accounts.requestLoginTokenForUser` client wrapper where +possible. For sign-in-only flows retain `options.userCreationDisabled: true` +and the application's account-creation policy. Do not repair rejected payloads +by removing checks or allowing unknown-user signup. + +Handle validation failures (DDP `400`) and `too-many-requests` separately from +successful token delivery. The beta's default Accounts rule is five requests +per ten seconds per matched method per DDP connection: both method name +and connection ID contribute to the bucket. The methods share a rule, not +one combined counter. It is not a per-user or per-IP mail quota. Retain stronger +application-specific abuse controls where needed and never log token payloads. +Use the limiter's returned reset timing for backoff. Counters reset on the +rule's interval; individual requests do not age out in a rolling window. + +The cookie endpoint's 30-per-ten-second address limit is independent. Calling +`Accounts.removeDefaultRateLimit()` removes the DDP rule, not HTTP cookie +limits; replace a rule deliberately instead of disabling it to hide retries. + +--- +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/api/accounts.md +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/generators/changelog/versions/3.6.0.md diff --git a/skills/meteor-debugging/SKILL.md b/skills/meteor-debugging/SKILL.md index d1b2d3f..893772d 100644 --- a/skills/meteor-debugging/SKILL.md +++ b/skills/meteor-debugging/SKILL.md @@ -5,7 +5,7 @@ description: > the failing layer or fix is known. Triggers on server crashes, client-only errors, stuck subscriptions, DDP or WebSocket disconnects, Minimongo/server data mismatches, hanging or flaky tests, slow builds, --inspect, console.log, - .only, Playwright traces, or requests to debug a Meteor app. Use this skill + .only, Playwright traces, Instrumentation lifecycle events, or requests to debug a Meteor app. Use this skill when evidence must distinguish Meteor tool, server, client, data, test, browser, mobile, or production boundaries. For test setup and authoring use meteor-testing; after confirming a domain cause, hand the repair to the @@ -17,7 +17,7 @@ metadata: area: ops tagline: "Diagnose Meteor 3 failures across builds, server/client runtime, DDP, Mongo, tests, browsers, mobile, and production." bundle: ["essentials", "fullstack", "ops"] - docs_synced_at: "2026-09-11" + docs_synced_at: "2026-09-23" license: MIT --- @@ -74,6 +74,9 @@ can reject the current hypothesis. full user documents. - Treat `console.log` as temporary instrumentation. Use `meteor/logging` or the application's established structured logger for evidence that must persist. +- For server lifecycle evidence on Meteor 3.6-beta.1, use the optional + `instrumentation` package through [Logs and instrumentation](references/logs-and-instrumentation.md). + Earlier releases retain targeted logs; listeners observe, not authorize. - Use `.only` only as temporary local test focus when the runner and execution mode support it. Remove it and run the broader suite before handoff. - Prefer observable readiness over sleeps: subscription ready, settled method, diff --git a/skills/meteor-debugging/references/build-debugging.md b/skills/meteor-debugging/references/build-debugging.md index e611d11..d61f890 100644 --- a/skills/meteor-debugging/references/build-debugging.md +++ b/skills/meteor-debugging/references/build-debugging.md @@ -89,6 +89,20 @@ only when authorized; do not assume the new cache or logging behavior exists. | HMR client is absent from a native app or `meteor build` output | The beta bootstrap is for development web app runs, not tests, native targets, or build output, even with `NODE_ENV=development`. Verify command and target before adding a refresh client manually. | | SWC reports a temporary cache-write failure during cleanup | The beta catches asynchronous writes; missing temporary paths (`ENOENT`/`ENOTDIR`) are non-fatal and other errors warn in verbose mode. Reproduce compilation separately. Do not generalize this handling to application filesystem errors or real compiler failures. | +Meteor 3.6-beta.1 adds these separate fixes; beta.0 does not have them: + +| Symptom | Version evidence and verification | +|---|---| +| TypeScript/Rspack server repeatedly restarts without an app edit | Check `rspack@1.4.0-beta360.1` and `@meteorjs/rspack@3.0.0-beta.2` together. The paired fix avoids runtime-entry rewrites for unchanged hashes and generated-only churn. A successful changed source rebuild should restart once; a failed compile preserves the last known-good entry. Observe startup count, a real source edit, compile failure and recovery before changing watcher settings. Do not edit `_build` markers or ignore the handoff directory. | +| `--port localhost:3060` or `--port http://localhost:3060/` leads to `ERR_SOCKET_BAD_PORT` / `NaN` | Check `tools-core@1.4.0-beta360.1`, which extracts the numeric port before deriving the Rspack port. Preserve valid host/URL syntax on the fixed version. On older packages, an explicit numeric app port plus the required bind configuration can isolate the cause; do not reinstall the CLI or rewrite proxies first. | +| `--inspect` dumps full Rspack configuration repeatedly | The beta.1 npm integration prints full configuration only in verbose mode. Inspector flags target the server; use `meteor run --verbose` when build configuration is the evidence needed. | + +Native declaration generation is separate from transpilation. On beta.1, +`meteor types` can skip for a direct `zodern:types` dependency or missing root +config; `meteor run` does not generate native declarations. Diagnose provider +selection and compiler paths before resetting caches. For an upgrade, use +`migrate-to-meteor-3`'s TypeScript reference. + Atmosphere-package shrinkwraps are not application npm/pnpm/Yarn lockfiles. Preserve the app/workspace manager and lockfile ownership; use `meteor-modern-build-stack` for required Rspack dependency reconciliation. diff --git a/skills/meteor-debugging/references/ddp-and-data.md b/skills/meteor-debugging/references/ddp-and-data.md index 2da053a..1153045 100644 --- a/skills/meteor-debugging/references/ddp-and-data.md +++ b/skills/meteor-debugging/references/ddp-and-data.md @@ -58,6 +58,14 @@ the first divergence is a change-stream observer replay. `mongo@2.5.1` in 3.5.2 fixes replay of events already represented by a causal primary snapshot. Use `meteor-mongo-minimongo` for that confirmed cause, not a transport rewrite. +Meteor 3.6-beta.1 adds two narrower fixes. Inspect resolved packages and +capture message order before deciding either applies: + +| Evidence | Version-specific next step | +|---|---| +| uWebSockets repeatedly reconnects during DDP version negotiation, with a missing `failed` frame | `ddp-server@3.4.1-beta360.1` flushes queued frames before closing. Compare the selected transport, offered/supported versions and delivered frame. Earlier adapters can drop that frame; general disconnects still need proxy/session/application evidence. | +| `Server sent add for existing id` during resubscribe with a pending optimistic method write | `ddp-client@3.4.2-beta360.1` merges repeated server fields into the saved snapshot and retains the visible stub value until writes settle. Check pending writes and publication strategy; use `meteor-pubsub` for retention/cleanup decisions. This does not legalize arbitrary duplicate server publications or eliminate all reconciliation bugs. | + ## Mongo and Minimongo inspection Use the local shells for read-first evidence: @@ -95,3 +103,4 @@ condition, current connection state, and selected document count. --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/performance/ddp-transport.md Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/generators/changelog/versions/3.5.2.md +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/generators/changelog/versions/3.6.0.md diff --git a/skills/meteor-debugging/references/eval-cases.md b/skills/meteor-debugging/references/eval-cases.md index 70f1928..3773c21 100644 --- a/skills/meteor-debugging/references/eval-cases.md +++ b/skills/meteor-debugging/references/eval-cases.md @@ -276,3 +276,52 @@ Prompt: "A Meteor 3.5.2 local Atmosphere package keeps reinstalling npm dependen Pass if the agent: Checks actual tool and shrinkwrap instead of attributing new behavior to 3.5.2, proposes a controlled reproduction and only an authorized paired upgrade, and preserves local data. Fail if it contradicts these boundaries or invents unsupported commands. + +## Case 31: lifecycle observation + +Prompt: "Our Meteor 3.6-beta.1 methods are slow and subscriptions sometimes never become ready. Show temporary supported lifecycle instrumentation without monkey-patching Meteor or collecting payloads." + +Pass if the agent: Selects meteor-debugging, checks instrumentation package version, imports only server-side, registers relevant method/publication events and correlates invocation traceId. Keeps capture off, uses durationMs/phase and stop handles, and does not claim an installed APM backend. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 32: instrumentation is not authorization + +Prompt: "On Meteor 3.6-beta.1, can a method.start listener throw to reject unauthorized calls and await a database audit write before the method proceeds?" + +Pass if the agent: States listeners are read-only, best-effort and never awaited; throws/rejections cannot enforce access or durable writes. Routes authorization to method/security guidance and keeps required work in the actual handler. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 33: preview privacy and scope + +Prompt: "With instrumentation 0.0.1-beta360.1, enable previews for an app method and a publication with the same name. Will configureMethod redact both, and can it expose login tokens for debugging?" + +Pass if the agent: Distinguishes per-method projection from publication global capture policy, bounded previews from secret redaction, and the Accounts denylist from app-specific privacy. Does not expose tokens; explains safe field projection and cleanup/disable controls. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 34: older lifecycle near miss + +Prompt: "We must keep Meteor 3.5.2. Add the new core Instrumentation method/publication listeners to investigate a slow method." + +Pass if the agent: States the beta.1 availability boundary, retains targeted redacted logs or existing compatible instrumentation, and does not add unavailable core hooks or force a release upgrade. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 35: TypeScript server restart loop + +Prompt: "On Meteor 3.6-beta.0 our TypeScript Rspack server restarts continuously without app edits. Would deleting the generated build marker or ignoring _build fix it? Which beta.1 packages and checks matter?" + +Pass if the agent: Rejects generated-file edits and handoff ignores. Checks paired rspack 1.4.0-beta360.1/@meteorjs/rspack 3.0.0-beta.2, observes generated-only churn and hashes, then validates one restart for a successful source rebuild plus compile failure/recovery preserving the last good entry. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 36: host-prefixed port and inspector output + +Prompt: "On Meteor 3.6-beta.1, can we keep --port localhost:3060 with Rspack? Beta.0 produced NaN and ERR_SOCKET_BAD_PORT. Also --inspect no longer prints the full Rspack config." + +Pass if the agent: Checks tools-core 1.4.0-beta360.1 numeric port parsing and paired npm integration, preserves valid host syntax, and uses --verbose for full configuration while distinguishing server inspection from build diagnostics. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 37: uWS negotiation loop + +Prompt: "Our uWebSockets DDP connection repeatedly reconnects during version negotiation and never receives the failed frame. Is there a Meteor 3.6-beta.1 fix, and does it fix all reconnects?" + +Pass if the agent: Checks selected transport and frame sequence, identifies ddp-server 3.4.1-beta360.1 graceful flush/close, and does not generalize to all proxy/session/application disconnects or immediately replace transport. +Fail if it contradicts these boundaries or invents unsupported APIs. diff --git a/skills/meteor-debugging/references/logs-and-instrumentation.md b/skills/meteor-debugging/references/logs-and-instrumentation.md index 2baaea9..e9e28b7 100644 --- a/skills/meteor-debugging/references/logs-and-instrumentation.md +++ b/skills/meteor-debugging/references/logs-and-instrumentation.md @@ -43,6 +43,78 @@ wrappers, binary values, and large documents need different handling. - Capture `Error` name, message, and stack when the stack is part of the hypothesis. Do not swallow or downgrade the original failure. +## Server lifecycle events on Meteor 3.6-beta.1 + +See the tagged [package guide](https://github.com/meteor/meteor/blob/82ea8df295134e64f495338a2e63362408098a24/v3-docs/docs/packages/instrumentation.md) +and [API reference](https://github.com/meteor/meteor/blob/82ea8df295134e64f495338a2e63362408098a24/v3-docs/docs/api/instrumentation.md). + +With the beta's `instrumentation@0.0.1-beta360.1`, prefer supported lifecycle +events for method timing, publication readiness and DDP connection evidence +over patching framework internals. Inspect `.meteor/versions` first. Earlier +Meteor releases do not supply these hooks; retain targeted redacted logs or +the app's existing compatible observability integration. + +```bash +meteor add instrumentation +``` + +Import only from a server entry and register once: + +```javascript +import { Instrumentation } from "meteor/instrumentation"; + +const handle = Instrumentation.on("method.end", (event) => { + if (event.durationMs > 200) { + console.warn("[server slow method]", { + name: event.name, + traceId: event.traceId, + durationMs: event.durationMs, + }); + } +}); + +// Call when this observation is no longer needed, not after every event. +export function stopTiming() { + handle.stop(); +} +``` + +| Question | Events / correlation | +|---|---| +| Which invocation is slow or fails? | `method.start`, `method.end`, `method.error`; match `traceId`, not method name alone. Completion events carry `durationMs`. | +| Is a subscription ready, stopped or errored? | `publication.start`, `.ready`, `.stop`, `.error`; preserve `subscriptionId`, `traceId` and phase. This measures lifecycle, not every observer update. | +| Is this a connection lifetime problem? | `ddp.connection.open`, `.close`; correlate `connectionId`, with `durationMs` on close. Do not expect invocation trace fields on connection events. | +| How does a handler's log join the lifecycle? | `Instrumentation.currentContext()` inside a method/publication returns its trace and connection context, including across `await`. Outside an invocation all fields are null. Server-initiated calls can have null connection/name; the event still supplies its name. | + +Listeners are best-effort and never awaited. Throws/rejections are isolated +from the observed operation; `onListenerError` can report failures to a safe +logger. Keep listeners cheap: synchronous work still runs on the server. +Do not enforce authorization, reject a method, or promise durable audit writes +from a listener. Keep validation and access checks in the actual handler. +The package supplies events, not an installed OpenTelemetry/APM backend. + +Arguments, results and IP addresses are off by default. Prefer selected +metadata. If a payload is necessary, project approved fields per method: + +```javascript +Instrumentation.configureMethod("orders.lookup", { + captureArgs: ([orderId]) => ({ orderId }), +}); +``` + +Projectors receive defensive copies and outputs still pass through a bounded, +cycle-safe preview. Bounded size is not generic secret redaction. Official +sensitive Accounts methods remain redacted even with overrides. Global +`captureMethodArgs: "preview"` also affects publications; a per-method policy +does not protect a same-named publication. `captureMethodResult: "preview"` +and `captureClientAddress: true` are separate opt-ins. Keep application +credentials out of previews, error summaries and exported logs. + +Stop temporary handles during cleanup. `METEOR_INSTRUMENTATION_DISABLED=1` +disables emission initially; `Instrumentation.configure({ enabled: false })` +can disable it at runtime. Runtime configuration can override the environment +default. Bound and clean up any application-maintained correlation maps. + ## Persistent structured logs Use the application's established logger for maintained observability. Meteor's diff --git a/skills/meteor-deployment/SKILL.md b/skills/meteor-deployment/SKILL.md index ad61d03..dae92cd 100644 --- a/skills/meteor-deployment/SKILL.md +++ b/skills/meteor-deployment/SKILL.md @@ -18,7 +18,7 @@ metadata: area: ops tagline: "Ship Meteor 3 apps to production (meteor build, Galaxy, Docker/Kubernetes, settings.json, env vars, Node version matching)." bundle: ["ops"] - docs_synced_at: "2026-08-26" + docs_synced_at: "2026-09-23" license: MIT --- @@ -39,9 +39,14 @@ Match the Node version to the bundled Meteor Node: |---|---| | 3.0 | 20 | | 3.1 through 3.4 | 22 | -| 3.5+ | 24 | - -Mismatch causes runtime errors. Run `meteor node -v` to confirm. +| 3.5.x and 3.6-beta.0 | 24 | +| 3.6-beta.1 | 26 (26.8.2) | + +Run `meteor node -v` and `meteor npm -v` in the target app to confirm. +Meteor 3.6-beta.1 bundles npm 11.19.0. Match the deployed runtime and native +dependency build environment to that release; rebuild and test native npm +modules for Node 26 and the production architecture before deploying beta.1. +The host installer prerequisite does not select the bundled runtime. ## Decision flow diff --git a/skills/meteor-deployment/references/docker.md b/skills/meteor-deployment/references/docker.md index 6bc185d..1bb4242 100644 --- a/skills/meteor-deployment/references/docker.md +++ b/skills/meteor-deployment/references/docker.md @@ -37,7 +37,10 @@ CMD ["node", "main.js"] This sample targets Meteor 3.1 through 3.4. Match both `node:` tags to the bundled Node major: Meteor 3.0 uses Node 20, 3.1 through 3.4 use Node 22, -and 3.5+ uses Node 24. Run `meteor node -v` to verify the exact version. On +and 3.5.x / 3.6-beta.0 use Node 24. Meteor 3.6-beta.1 uses Node 26.8.2 +and npm 11.19.0. Match both images and native dependency builds to the exact +target release; do not carry Node 24 native binaries into a Node 26 runtime. +Run `meteor node -v` and `meteor npm -v` in the target app to verify. On M-series Macs targeting x86_64 Linux, add `--architecture os.linux.x86_64` to `meteor build`. diff --git a/skills/meteor-deployment/references/eval-cases.md b/skills/meteor-deployment/references/eval-cases.md index 16a6a33..73608b3 100644 --- a/skills/meteor-deployment/references/eval-cases.md +++ b/skills/meteor-deployment/references/eval-cases.md @@ -48,7 +48,8 @@ Prompt: "On my server `node main.js` crashes with `undefined symbol: node_module_register`." Pass if the agent identifies the Node version mismatch (Meteor 3.0 uses Node -20, 3.1 through 3.4 use Node 22, and 3.5+ uses Node 24), and instructs running +20, 3.1 through 3.4 use Node 22, 3.5.x/beta.0 use Node 24, and +3.6-beta.1 uses Node 26), and instructs running `meteor node -v` to find the exact version, then deploying with the matching `node:-bookworm-slim` image. @@ -176,3 +177,17 @@ It inspects actual native platform/plugin/configuration changes rather than inferring a binary change from a Meteor release label or an edited filename; native configuration can require a binary even when its compatibility hash is unchanged. Fail if it claims every such edit necessarily changes that hash. + +## Case 17: beta.1 runtime and native modules + +Prompt: "Deploy our Meteor 3.6-beta.1 bundle in Docker. Can we reuse Node 24 images and native modules from our Meteor 3.5.2 build?" + +Pass if the agent: Selects the target Node 26.8.2 runtime, notes bundled npm 11.19.0, verifies meteor node/npm versions, matches build/runtime architecture and rebuilds native modules. Does not reuse Node 24 native binaries or mistake host installer Node for app runtime. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 18: keep earlier runtime + +Prompt: "Our app remains on Meteor 3.5.2, and another app is pinned to 3.6-beta.0. Does the 3.6-beta.1 Node 26 announcement require new Node 26 runtime images for either?" + +Pass if the agent: Retains Node 24 for both targets, checks exact bundled versions, and does not upgrade their runtimes solely because a later beta exists. +Fail if it contradicts these boundaries or invents unsupported APIs. diff --git a/skills/meteor-modern-build-stack/SKILL.md b/skills/meteor-modern-build-stack/SKILL.md index 0feb998..7ce4d68 100644 --- a/skills/meteor-modern-build-stack/SKILL.md +++ b/skills/meteor-modern-build-stack/SKILL.md @@ -22,7 +22,7 @@ metadata: area: build tagline: "Configure the Meteor 3 modern build stack (SWC transpiler/minifier, `@parcel/watcher`, web-arch skipping, Rspack integration)." bundle: ["essentials"] - docs_synced_at: "2026-09-11" + docs_synced_at: "2026-09-23" license: MIT --- @@ -100,11 +100,16 @@ final bundle. Requires entry points in `package.json` and no nested imports in app code. To migrate an existing app, use the `migrate-to-rspack` skill. Inspect `.meteor/versions`, `package.json`, and the lockfile. Meteor -3.6-beta.0 pairs `rspack@1.4.0-beta360.0`, `@meteorjs/rspack@3.0.0-beta.1` -and Rspack 2.2.0; 3.5.2 retains the 1.3.0/2.2.0 integration pairing. -See [release pairings](references/rspack-config.md) and -[3.6 dependencies and workspaces](references/meteor-3.6-workspaces.md). -For Rspack 1-to-2 config migration, use `migrate-to-rspack`. +3.6-beta.1 pairs `rspack@1.4.0-beta360.1`, `@meteorjs/rspack@3.0.0-beta.2` +and Rspack 2.2.0. Beta.0 retains 1.4.0-beta360.0/3.0.0-beta.1; 3.5.2 +retains the 1.3.0/2.2.0 integration pairing. +See [pairings](references/rspack-config.md) and +[dependencies/workspaces](references/meteor-3.6-workspaces.md). +For migration, use `migrate-to-rspack`. + +Rspack transpiles TypeScript without type-checking or choosing declarations. +For beta.1's separate native opt-in, see +[declaration boundaries](references/rspack-config.md#typescript-declarations). ## Scaffolds, PWA and offline behavior diff --git a/skills/meteor-modern-build-stack/references/eval-cases.md b/skills/meteor-modern-build-stack/references/eval-cases.md index 8980ebb..38f4a02 100644 --- a/skills/meteor-modern-build-stack/references/eval-cases.md +++ b/skills/meteor-modern-build-stack/references/eval-cases.md @@ -308,3 +308,10 @@ requiring the worker response's `Service-Worker-Allowed` header. It checks actual registration and avoids unnecessarily broad control or an automatic prefix rewrite. Fail if it requires moving a root worker to narrow its scope or treats broader-than-directory scope as always impossible or unrestricted. + +## Case 31: beta.1 pairing and declaration boundary + +Prompt: "Configure Rspack on a new Meteor 3.6-beta.1 TypeScript app with autoInstallDeps false. Does SWC generate native Meteor declarations and type-check it automatically?" + +Pass if the agent: Uses rspack 1.4.0-beta360.1/@meteorjs/rspack 3.0.0-beta.2 and Rspack core/CLI/dev-server 2.2.0 minimums, prepares dependencies with the existing manager and keeps frozen CI. Separates transpilation, explicit native opt-in and local tsc; new templates retain legacy providers. Does not remove zodern:types as a bundler requirement. +Fail if it contradicts these boundaries or invents unsupported APIs. diff --git a/skills/meteor-modern-build-stack/references/meteor-3.6-workspaces.md b/skills/meteor-modern-build-stack/references/meteor-3.6-workspaces.md index 3c13033..614f249 100644 --- a/skills/meteor-modern-build-stack/references/meteor-3.6-workspaces.md +++ b/skills/meteor-modern-build-stack/references/meteor-3.6-workspaces.md @@ -1,16 +1,17 @@ # Meteor 3.6 dependencies and workspaces These decisions start with Meteor 3.6, verified on `3.6-beta.0` with -`rspack@1.4.0-beta360.0` and `tools-core@1.4.0-beta360.0`. Earlier 3.x releases +`rspack@1.4.0-beta360.0` and `tools-core@1.4.0-beta360.0`. Beta.1 uses +`rspack@1.4.0-beta360.1` and `tools-core@1.4.0-beta360.1`. Earlier 3.x releases keep their existing integration and manually managed workspace setup. Inspect the app's release, resolved packages, manifest and workspace lockfile before using a beta-specific version or command. ## Rspack 2 dependency set -| Package | Minimum selected by 3.6-beta.0 | Dependency category | +| Package | Minimum selected by 3.6 beta | Dependency category | |---|---|---| -| `@meteorjs/rspack` | `3.0.0-beta.1` | Development | +| `@meteorjs/rspack` | `3.0.0-beta.1` on beta.0; `3.0.0-beta.2` on beta.1 | Development | | `@rspack/core`, `@rspack/cli`, `@rspack/dev-server` | `2.2.0` each | Development | | `@swc/core` | `1.15.32` | Development | | `@rsdoctor/rspack-plugin` | `1.5.9` | Development | diff --git a/skills/meteor-modern-build-stack/references/rspack-config.md b/skills/meteor-modern-build-stack/references/rspack-config.md index d9d2e2a..0952177 100644 --- a/skills/meteor-modern-build-stack/references/rspack-config.md +++ b/skills/meteor-modern-build-stack/references/rspack-config.md @@ -14,6 +14,7 @@ Match both integration packages to the Meteor release: | 3.5.1 | `1.2.0` | `2.1.0` | Revised client polyfills and app-extension discovery; retains the v2 helper API. | | 3.5.2 | `1.3.0` | `2.2.0` | Required-dependency diagnostics, mode isolation, TypeScript config dependency tracking, and full-app/TLA fixes. | | 3.6-beta.0 | `1.4.0-beta360.0` | `3.0.0-beta.1` | Rspack 2.2.0, SWC React Compiler, workspace-aware installs and stable cache configuration. | +| 3.6-beta.1 | `1.4.0-beta360.1` | `3.0.0-beta.2` | Same Rspack 2 minimums, fixed TypeScript server rebuild lifecycle; Node 26.8.2. | Inspect `.meteor/versions`, `package.json`, and the lockfile. Do not install an arbitrary `@meteorjs/rspack` major to obtain one helper; upgrade the Meteor @@ -344,5 +345,17 @@ Auto-added to `.gitignore`. To rename, set in `package.json`: } ``` +## TypeScript declarations + +Rspack/SWC transpiles TypeScript but does not type-check it or select Meteor +package declarations. Meteor 3.6-beta.1 native declarations require explicit +`meteor types` and provider configuration. Ordinary builds and new templates +retain legacy providers. Keep working `zodern:types`/`@types/meteor` setups +unless the task includes a provider migration; run the app's local `tsc` +separately. A configured checker such as the TypeScript scaffold's +`TsCheckerRspackPlugin` is a separate layer that can check during builds; +preserve it when working. See the +[declaration guide](https://docs.meteor.com/cli/using-core-types). + --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/modern-build-stack/rspack-bundler-integration.md diff --git a/skills/meteor-pubsub/SKILL.md b/skills/meteor-pubsub/SKILL.md index 119d8ae..ea3b737 100644 --- a/skills/meteor-pubsub/SKILL.md +++ b/skills/meteor-pubsub/SKILL.md @@ -14,7 +14,7 @@ metadata: area: data tagline: "Author and debug publications/subscriptions (publish strategies, low-level `added/changed/removed`, authorization, reactive joins)." bundle: ["essentials", "fullstack"] - docs_synced_at: "2026-08-25" + docs_synced_at: "2026-09-23" license: MIT --- diff --git a/skills/meteor-pubsub/references/eval-cases.md b/skills/meteor-pubsub/references/eval-cases.md index 82f7392..0731f9a 100644 --- a/skills/meteor-pubsub/references/eval-cases.md +++ b/skills/meteor-pubsub/references/eval-cases.md @@ -69,3 +69,17 @@ subscription alive?" Pass if the agent says `this.error` stops the subscription and sends the error to the client. It should recommend a separate data or logging channel for a non-fatal warning. + +## Case 8: optimistic resubscribe in beta.1 + +Prompt: "With NO_MERGE_NO_HISTORY and a pending optimistic method write, resubscribing sends another added for the same document. What changes with ddp-client 3.4.2-beta360.1, and who clears documents on unsubscribe?" + +Pass if the agent: Describes merging server fields into the saved snapshot while stub values remain visible until writes settle. Retains application-owned cleanup; does not claim new history or removals on unsubscribe. Scopes cleanup to owned data instead of clearing a shared collection or prescribing private collection handles as a generic fix. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 9: earlier optimistic duplicate add + +Prompt: "Our Meteor 3.5.2 client throws Server sent add for existing id only while a stub write is outstanding during resubscribe. Is duplicate-added tolerance already guaranteed on this version?" + +Pass if the agent: Checks client package and pending-write path, identifies the beta.1 fix boundary, and recommends a compatible tested upgrade or app-level sequencing. Does not claim all older clients support that path or switch publication strategies without considering ownership/cleanup. +Fail if it contradicts these boundaries or invents unsupported APIs. diff --git a/skills/meteor-pubsub/references/publication-strategies.md b/skills/meteor-pubsub/references/publication-strategies.md index 12311f5..8d84be0 100644 --- a/skills/meteor-pubsub/references/publication-strategies.md +++ b/skills/meteor-pubsub/references/publication-strategies.md @@ -14,6 +14,15 @@ the subscription stops. Client handling is forgiving: duplicate `added` messages become changes, a `changed` for an unknown ID becomes an add, and a `removed` for an unknown ID is ignored. +There is an earlier-client exception while an optimistic method write is +pending. Meteor 3.6-beta.1's `ddp-client@3.4.2-beta360.1` handles a repeated +`added` by merging server fields into the saved server snapshot; the stub's +visible value remains until outstanding writes settle. Earlier clients can +throw `Server sent add for existing id` in this path. Inspect the client's +resolved version and reproduce with a pending write before relying on the fix. +It also covers resubscribing under `NO_MERGE_NO_HISTORY`; it does not add +server history, ownership merging or unsubscribe removals to that strategy. + Use this when a collection is supplied by only one publication. It uses less server state than `SERVER_MERGE`, but multiple publications for the same collection can overwrite each other's document view. @@ -23,6 +32,9 @@ collection can overwrite each other's document view. The server remembers nothing about sent documents and does not send removals when the subscription stops. Use only for special send-and-forget queues where the consumer handles retention and stale client documents are intentional. +Scope consumer cleanup to documents it owns. Do not clear an entire shared +Minimongo collection or use private collection handles as a generic repair; +pending optimistic writes and other active subscriptions may still own data. ## Setting the strategy @@ -48,3 +60,4 @@ Meteor.server.getPublicationStrategy("feed"); --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/api/meteor.md#publication-strategies +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/generators/changelog/versions/3.6.0.md diff --git a/skills/meteor-react/SKILL.md b/skills/meteor-react/SKILL.md index 9c8be11..d38d2f8 100644 --- a/skills/meteor-react/SKILL.md +++ b/skills/meteor-react/SKILL.md @@ -19,7 +19,7 @@ metadata: area: data tagline: "Build and debug Meteor 3 React interfaces (Rspack scaffold, reactive data hooks, Suspense, Fast Refresh, and testing)." bundle: ["react"] - docs_synced_at: "2026-09-11" + docs_synced_at: "2026-09-23" license: MIT --- diff --git a/skills/meteor-react/references/build-refresh-and-testing.md b/skills/meteor-react/references/build-refresh-and-testing.md index fe1f298..887431a 100644 --- a/skills/meteor-react/references/build-refresh-and-testing.md +++ b/skills/meteor-react/references/build-refresh-and-testing.md @@ -63,7 +63,9 @@ Meteor's parser, helper, and refresh defaults unless reconstructed exactly. ## React Compiler Meteor 3.6-beta.0 pairs Atmosphere `rspack@1.4.0-beta360.0` with npm -`@meteorjs/rspack@3.0.0-beta.1` and Rspack 2.2.0. This pairing supports the +`@meteorjs/rspack@3.0.0-beta.1` and Rspack 2.2.0. Beta.1 pairs +`rspack@1.4.0-beta360.1` with `@meteorjs/rspack@3.0.0-beta.2` and retains +that Rspack minimum. Both pairings support the SWC React Compiler path introduced upstream in Rspack 2.1. Inspect the resolved packages and React major before selecting it. Earlier Meteor/Rspack pairings can keep `babel-plugin-react-compiler` with `babel-loader`; do not copy the diff --git a/skills/meteor-security/SKILL.md b/skills/meteor-security/SKILL.md index 91d6d26..6853106 100644 --- a/skills/meteor-security/SKILL.md +++ b/skills/meteor-security/SKILL.md @@ -16,7 +16,7 @@ metadata: area: security tagline: "Audit and harden Meteor 3 apps (`check()` coverage, `this.userId` guards, browser-policy CSP, rate limits, oauth-encryption)." bundle: ["essentials", "fullstack"] - docs_synced_at: "2026-08-25" + docs_synced_at: "2026-09-23" license: MIT --- @@ -132,9 +132,18 @@ decisions; keep their queries fast because the connection waits for them. On Meteor 3.0 through 3.4, matchers must stay synchronous. Use a fixed rule, precomputed synchronous state, or upgrade rather than awaiting Mongo there. -The default rule (5 in 10s for login / signup / password reset) ships -with `accounts-base`. Remove with `Accounts.removeDefaultRateLimit()` -only if you replace it. +The default rule (5 in 10s per matched method per DDP connection for login / signup / password +reset) ships with `accounts-base`. Meteor 3.6-beta.1's +`accounts-base@3.4.0-beta360.1` also matches `requestLoginTokenForUser`; +`accounts-passwordless@3.1.2-beta360.1` validates its complete payload before +lookup/creation. Inspect both package versions on older apps. Remove the +default rule with `Accounts.removeDefaultRateLimit()` only if you replace it. + +For cookie hardening on `accounts-base@3.4.0-beta360.1`, use `meteor-accounts`: +trusted origins, valid tokens, no-store responses and `SameSite=Strict` have +specific migration checks. Its 30-per-10-second HTTP endpoint limit is per +client address, separate from DDP. HttpOnly storage does not stop active +same-origin XSS from obtaining the resume token used for DDP authentication. ## OAuth secret encryption diff --git a/skills/meteor-security/references/eval-cases.md b/skills/meteor-security/references/eval-cases.md index 89fde74..d8021c7 100644 --- a/skills/meteor-security/references/eval-cases.md +++ b/skills/meteor-security/references/eval-cases.md @@ -108,3 +108,10 @@ Prompt: "On Meteor 3.4, make a DDP rate-limit matcher await a user plan lookup." Pass if the agent says async matchers begin in Meteor 3.5, rejects the awaited matcher on 3.4, and offers a synchronous fixed rule, precomputed state, or a framework upgrade. Fail if it applies the current 3.5 API unconditionally. + +## Case 12: Accounts hardening ownership + +Prompt: "Review Meteor 3.6-beta.1 passwordless and HttpOnly-cookie abuse protections. Are their rate limits interchangeable, and does HttpOnly remove our XSS risk?" + +Pass if the agent: Keeps security audit ownership and uses meteor-accounts for configuration details. Separates per-connection DDP and per-address HTTP limits, checks resolved beta packages, preserves method authorization and notes the in-memory DDP token remains exposed to active same-origin XSS. +Fail if it contradicts these boundaries or invents unsupported APIs. diff --git a/skills/meteor-testing/SKILL.md b/skills/meteor-testing/SKILL.md index a0db8cb..df8500a 100644 --- a/skills/meteor-testing/SKILL.md +++ b/skills/meteor-testing/SKILL.md @@ -18,7 +18,7 @@ metadata: area: testing tagline: "Set up and write Meteor 3 tests (`meteortesting:mocha`, async signatures, methods/publications, Playwright/Cypress E2E)." bundle: ["fullstack"] - docs_synced_at: "2026-09-11" + docs_synced_at: "2026-09-23" license: MIT --- diff --git a/skills/meteor-testing/references/eval-cases.md b/skills/meteor-testing/references/eval-cases.md index 0c83c37..27aba01 100644 --- a/skills/meteor-testing/references/eval-cases.md +++ b/skills/meteor-testing/references/eval-cases.md @@ -188,3 +188,10 @@ tests do not use jQuery. Should I add it to the app before running test-packages Pass if the agent recognizes the restored driver dependency, adds no app or unneeded package-test dependency, and verifies the UI and expected client/server assertions. Fail if it repeats the 1.6.0 workaround unconditionally. + +## Case 20: CI runtime for beta.1 + +Prompt: "Adapt our Node 24 Meteor 3.5.2 test job for a deliberate upgrade to 3.6-beta.1. What runtime and native dependency checks belong in CI?" + +Pass if the agent: Verifies the selected Meteor runtime, uses Node 26.8.2/npm 11.19.0 for beta.1, rebuilds native deps and preserves frozen dependency installation and actual client/server test execution. Does not claim existing 3.5.2 jobs need Node 26. +Fail if it contradicts these boundaries or invents unsupported APIs. diff --git a/skills/meteor-testing/references/mocha-setup.md b/skills/meteor-testing/references/mocha-setup.md index c93a10a..02d7868 100644 --- a/skills/meteor-testing/references/mocha-setup.md +++ b/skills/meteor-testing/references/mocha-setup.md @@ -75,8 +75,11 @@ jobs: ``` Node version must match the bundled Node.js for the Meteor version: 3.0 uses -Node 20, 3.1 through 3.4 use Node 22, and 3.5+ uses Node 24. Run -`meteor node -v` to verify the exact version used by the target release. +Node 20, 3.1 through 3.4 use Node 22, and 3.5.x / 3.6-beta.0 use Node 24. +Meteor 3.6-beta.1 uses Node 26.8.2 and npm 11.19.0. The example above targets +3.1-3.4; adjust its Node selection for the actual job. Run `meteor node -v` +and `meteor npm -v` in the target app, rebuild native dependencies for that +runtime, and keep dependency installation frozen in CI. ## Test discovery diff --git a/skills/migrate-to-meteor-3/SKILL.md b/skills/migrate-to-meteor-3/SKILL.md index 1f2e606..501a38e 100644 --- a/skills/migrate-to-meteor-3/SKILL.md +++ b/skills/migrate-to-meteor-3/SKILL.md @@ -7,7 +7,7 @@ description: > dropping a Promise, a read API receiving update modifiers, async allow/deny, an Iron Router controller not running, "Method stub took too long", Atmosphere resolution, Express 5 WebApp handlers, lost async context, - rawCollection callbacks, meteor/* TypeScript types, useTracker, and + rawCollection callbacks, meteor/* TypeScript types, meteor types during an upgrade, useTracker, and useSubscribe. Use this skill when the user asks about upgrading Meteor, async caller propagation, iterators with await, zodern:types, or replacing and forking packages. @@ -18,7 +18,7 @@ metadata: area: migration tagline: "Migrate a Meteor 2.x app to 3.x (`callAsync`, async Mongo, Fibers removal, Blaze reactivity, Express 5, Atmosphere resolution)." bundle: ["migration"] - docs_synced_at: "2026-08-25" + docs_synced_at: "2026-09-23" license: MIT --- @@ -64,8 +64,11 @@ in phases. Do not flip the framework version flag first. not inside the invoked handler. Verify invocation context before and after `await`. See `references/publications.md` and `references/other-breaking-changes.md`. -10. For TypeScript projects, install `zodern:types` and update - `tsconfig.json`. See `references/typescript-migration.md`. +10. For TypeScript projects, inspect the target release and existing declaration + provider. Keep working `@types/meteor` or `zodern:types` setups. Meteor + 3.6-beta.1 adds explicit native opt-in through `meteor types`; earlier + releases retain the legacy workflow. See + `references/typescript-migration.md` before changing packages or paths. 11. For React projects, decide whether to adopt the Suspense-aware `react-meteor-data` import. See `references/react-migration.md`, then use `meteor-react` for current hook, scaffold, and build guidance. diff --git a/skills/migrate-to-meteor-3/references/eval-cases.md b/skills/migrate-to-meteor-3/references/eval-cases.md index 1a39a8f..09351f0 100644 --- a/skills/migrate-to-meteor-3/references/eval-cases.md +++ b/skills/migrate-to-meteor-3/references/eval-cases.md @@ -344,12 +344,15 @@ with `try`/`catch` at the owning async boundary. ## Case 23: Meteor TypeScript imports become `any` -Prompt: "After moving to Meteor 3, every `meteor/*` TypeScript import is `any` -and the editor reports duplicate identifiers." +Prompt: "After moving from Meteor 2 to Meteor 3.5.2, required package +declarations are missing. We want zodern:types; the editor also reports +duplicate identifiers. What should we inspect and configure?" -Pass if the agent adds `zodern:types`, enables `preserveSymlinks`, maps -`meteor/*` to `.meteor/local/types/packages.d.ts`, and restarts the TypeScript -server. It must keep generated types out of source control. +Pass if the agent checks existing providers and inherited configuration, uses +the legacy `zodern:types` workflow with `preserveSymlinks` and the legacy barrel +mapping, and restarts the TypeScript server. It must inspect overlapping +declarations before attributing duplicates to symlinks, keep generated output +untracked, and not prescribe native `meteor types` on 3.5.2. ## Case 24: React Suspense is optional @@ -403,3 +406,58 @@ new Windows workstation and make sure PATH works." Pass if the agent routes the fresh workstation and PATH workflow to `meteor-cli-installation`. Fail if it starts an application code migration or offers the Linux and macOS shell installer on Windows. + +## Case 29: native provider adoption during upgrade + +Prompt: "We are upgrading an existing TypeScript app to Meteor 3.6-beta.1 and explicitly want native declarations. We have direct zodern:types and @types/meteor, tsconfig extends, a files array and meteor in compilerOptions.types. Give the migration and CI sequence." + +Pass if the agent: Preserves the compiler and app config, checkpoints state, removes direct zodern:types, generates before switching paths/removing @types/meteor, appends the native barrel and per-package adapters, removes only inherited meteor ambient loading, runs local tsc through a script and keeps generated files untracked. Provides rollback without treating compilation as checking. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 30: preserve providers during runtime upgrade + +Prompt: "Upgrade our existing Meteor app to 3.6-beta.1 but keep the working TypeScript provider. meteor types exits zero saying zodern:types is installed. Did it generate native types, and should we remove the provider?" + +Pass if the agent: Keeps the explicit existing-provider preference, explains successful skip and direct dependency precedence, and distinguishes runtime upgrade, native generation and type-checking. Does not remove working providers. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 31: native generation failure + +Prompt: "After removing direct zodern:types on 3.6-beta.1, meteor types fails. Should we replace paths, uninstall @types/meteor and delete .meteor/local/types to finish?" + +Pass if the agent: Stops provider switching until generation succeeds, preserves old output and config, restores the removed package for rollback and reports nonzero generation failure. Does not delete fallback output or invoke a destructive reset. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 32: native scoped imports and mixed providers + +Prompt: "After beta.1 native opt-in, meteor/random resolves but meteor/react-meteor-data/suspense fails. Our tsconfig excludes .meteor and extends a config with types [meteor,node]. Why do we also see duplicate declarations?" + +Pass if the agent: Checks explicit native barrel in files despite exclude, keeps paths mapped to packages/* rather than the barrel, checks installed package declaration coverage and removes overlapping ambient meteor provider while preserving node and unrelated config. Does not blame all failures on preserveSymlinks. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 33: native Node boundary during upgrade + +Prompt: "For our deliberate Meteor 2 to 3.6-beta.1 migration, can the existing Node 24 production image stay unchanged?" + +Pass if the agent: Uses Node 26.8.2/npm 11.19.0 for beta.1 after checking target runtime, rebuilds native modules and hands deployment details to meteor-deployment. Retains older-release mappings rather than generalizing Node 26 to all Meteor 3. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 34: TypeScript 7 configuration during native adoption + +Prompt: "After selecting Meteor 3.6-beta.1 native declarations, our existing TypeScript 7 app reports TS5102 for baseUrl copied from the guide. Should we downgrade TypeScript or copy moduleResolution: node as well? The Rspack config already has TsCheckerRspackPlugin." + +Pass if the agent preserves the compiler and checker, removes the unsupported +baseUrl while preserving alias semantics through relative paths, keeps a +compatible bundler/nodenext resolution mode, and separates checker behavior +from SWC transpilation and native generation. It must not downgrade TypeScript +or claim the configured checker does not run just because SWC itself strips types. + +## Case 35: generated barrel hides application source + +Prompt: "After beta.1 native opt-in we added files: [.meteor/types/packages.d.ts] to a tsconfig that previously had neither files nor include. tsc now passes even with a wrong assignment in imports/probe.ts. Are native types working?" + +Pass if the agent checks the effective source set with local tsc --listFiles, +explains that adding files removed implicit inclusion, and preserves the +previous source set with explicit include patterns while retaining exclusions. +It verifies a temporary deliberate type error fails, then removes it and +reruns. It must not disable checks or claim a green exit proved app coverage. diff --git a/skills/migrate-to-meteor-3/references/other-breaking-changes.md b/skills/migrate-to-meteor-3/references/other-breaking-changes.md index 9143d6e..eaa3444 100644 --- a/skills/migrate-to-meteor-3/references/other-breaking-changes.md +++ b/skills/migrate-to-meteor-3/references/other-breaking-changes.md @@ -97,7 +97,8 @@ Meteor 3 does not have one Node baseline across every minor release: |----------------|--------------| | 3.0 | Node 20 | | 3.1 through 3.4 | Node 22 | -| 3.5+ | Node 24 | +| 3.5.x and 3.6-beta.0 | Node 24 | +| 3.6-beta.1 | Node 26.8.2 (npm 11.19.0) | Run `meteor node --version` in the target app and use that version in CI, native dependency builds, and container images. Audit `engines.node` and diff --git a/skills/migrate-to-meteor-3/references/typescript-migration.md b/skills/migrate-to-meteor-3/references/typescript-migration.md index 5e3b9b9..fcdd12e 100644 --- a/skills/migrate-to-meteor-3/references/typescript-migration.md +++ b/skills/migrate-to-meteor-3/references/typescript-migration.md @@ -1,63 +1,147 @@ # TypeScript migration -Tight scope: what an existing TypeScript-on-Meteor-2 project must update -during the upgrade to Meteor 3. The full TypeScript-on-Meteor setup -(fresh projects, advanced patterns, type-helper packages) is out of scope -here; a dedicated `meteor-typescript` skill will cover it. - -## What breaks - -After the upgrade, imports from `meteor/*` resolve to `any` or fail -outright. The Meteor 2 type-shipping mechanism is no longer compatible -with the 3.x build, so any `import { Meteor } from 'meteor/meteor';` -loses its types. - -## What to install +Keep declaration-provider migration separate from the Meteor runtime upgrade. +Inspect `.meteor/release`, direct `.meteor/packages` constraints, +`.meteor/versions`, npm/workspace manifests and lockfiles, and every active +`tsconfig.json`, including `extends`. This reference owns existing-app upgrade +decisions; fresh-project setup and Atmosphere declaration publishing remain in +the [TypeScript guide](https://docs.meteor.com/cli/using-core-types). + +## Choose by release and provider + +| Project state | Action | +|---|---| +| Meteor 3 before 3.6-beta.1 | Native `meteor types` is unavailable. Retain working legacy declarations; use the `zodern:types` branch below when package declarations are missing. | +| Upgrading to 3.6-beta.1 with working `@types/meteor` or `zodern:types` | Keep the provider and paths unless the task includes adopting native declarations. Runtime upgrade alone does not switch providers. | +| Explicit native adoption on 3.6-beta.1 | Follow the ordered migration below. The command needs a root `tsconfig.json` or `jsconfig.json`. | +| Direct `zodern:types` still installed | `meteor types` skips successfully and leaves both output trees unchanged. A zero exit is not proof of native generation. A transitive dependency alone does not select the legacy provider. | + +The classic `typescript` package and Rspack/SWC transpile app source without +type-checking it themselves. A separately configured checker, such as the +TypeScript scaffold's `TsCheckerRspackPlugin`, is a distinct layer; preserve +a working checker when changing declarations. On beta.1, ordinary `run`, `build`, `test` and `lint` neither +generate nor select native declarations. New TypeScript templates also keep +the legacy provider first; a native fallback path is not an opt-in. + +## Native adoption on Meteor 3.6-beta.1 + +1. Checkpoint provider dependencies, lockfile and TypeScript configuration. + Keep the app's local TypeScript compiler version fixed during this change. +2. Remove `zodern:types` only if it is a direct app dependency, then generate: + + ```bash + meteor remove zodern:types + meteor types + ``` + + Generation can build local packages but does not bundle or type-check the + application. On failure, stop before changing provider paths: the command + exits nonzero and preserves the old `.meteor/local/types` output. Restore + the removed provider if rolling back. Successful generation removes that + stale legacy output. +3. After success, merge these entries into the active TypeScript config: + + ```json + { + "files": ["./.meteor/types/packages.d.ts"], + "include": ["**/*.ts", "**/*.tsx"], + "compilerOptions": { + "paths": { + "meteor/*": ["./.meteor/types/packages/*"] + } + } + } + ``` + + Append the barrel to existing `files`; retain existing `include`, aliases, + compiler options and `extends`. If the app previously had neither `files` + nor `include`, adding `files` disables implicit source inclusion: explicitly + preserve it with `include: ["**/*"]`, or the app's intended source patterns. + Do not broaden an intentionally files-only project. Resolve paths against the config + that declares them. The adapters resolve normal package imports; the barrel + supplies scoped and sub-path modules such as + `meteor/react-meteor-data/suspense`. Explicit `files` works even when + `.meteor/**` is excluded. Do not map `meteor/*` directly to the native barrel. +4. Remove a direct `@types/meteor` dependency with the project's existing + package manager, and remove only `"meteor"` from `compilerOptions.types` + wherever it is inherited or declared. Preserve other type libraries and + the workspace lockfile. Prefer one provider per Meteor module ID; a hybrid + for uncovered packages needs deliberate non-overlap and type-checking. +5. Use the app's installed `typescript` compiler, adding a compatible pinned + dev dependency only if missing. For an npm app: + + ```json + { + "scripts": { + "check-types": "meteor types && tsc --noEmit" + } + } + ``` + + ```bash + meteor npm run check-types + ``` + + Use the equivalent script runner for pnpm/Yarn. CI must generate before + invoking local `tsc`; a successful app build does not prove type safety. + Fix errors exposed by corrected declarations without casting everything + to `any`. Check `tsc --listFiles --noEmit` includes application source; a + deliberate temporary wrong type should fail. Remove that probe and rerun. + Restart the editor's TypeScript server after config changes. + +Do not edit or commit `.meteor/types/`; generation replaces its contents and +writes its own `.gitignore`. Roll back by restoring legacy dependencies, +lockfile and config, then regenerate using the app's previous provider workflow. +Ordinary Meteor commands and a skipped native run do not delete either tree. + +## Compiler configuration compatibility + +Inspect the installed npm `typescript`, not only the Atmosphere `typescript` +package: they are separate tools. Beta.1's TypeScript scaffold selects npm +TypeScript 7 and `moduleResolution: "bundler"`. Do not copy older docs' +`baseUrl` or `moduleResolution: "node"` into it. +[TypeScript 7 removes both options](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/). +`paths` works without `baseUrl` on TypeScript 4.1+; use explicit relative +targets, preserving aliases and their previous base directory. Keep an older +app's compatible compiler/configuration rather than upgrading its compiler +just to change Meteor declarations. + +## Earlier-release legacy declarations + +If required package declarations are missing on an older Meteor 3 app: ```bash meteor add zodern:types ``` -`zodern:types` ships generated `.d.ts` files keyed off your local Meteor -install. It replaces the older approaches used in Meteor 2. - -## `tsconfig.json` updates +Merge the legacy settings, preserving any intentional working provider order: -Two changes are required: - -```jsonc +```json { "compilerOptions": { - // 1. Resolve symlinks the way Meteor's package layout expects. "preserveSymlinks": true, - - // 2. Map meteor/* imports to the generated types directory. - "baseUrl": "./", "paths": { - "meteor/*": [".meteor/local/types/packages.d.ts"] + "meteor/*": ["./.meteor/local/types/packages.d.ts"] } } } ``` -Without `preserveSymlinks: true`, TypeScript follows symlinks in -`.meteor/local/build/` and reports duplicate identifier errors. The -`paths` mapping is what tells TypeScript where to find type -declarations for every `meteor/` import. - -## After the changes - -Restart your TS server (or your editor) so the new `tsconfig.json` is -picked up. The first compilation may be slow because `zodern:types` -regenerates the types directory on demand. +Regenerate through the existing provider workflow, restart the editor's +TypeScript server, and run the local compiler. Keep generated output untracked. +The legacy barrel mapping is not the native adapter mapping. -## Symptoms +## Diagnose the first missing boundary -- `import { Meteor } from 'meteor/meteor';` resolves to `any`, no - autocomplete. The `paths` mapping in `tsconfig.json` is missing. -- "Cannot find module 'meteor/meteor' or its corresponding type - declarations." `zodern:types` is not installed. -- "Duplicate identifier 'Meteor'." `preserveSymlinks` is not set. +| Symptom | Check | +|---|---| +| `meteor types` reports nothing to do | Root `tsconfig.json` or `jsconfig.json`; do not delete caches. | +| Generation says it skipped | Direct `zodern:types` constraint, not only `.meteor/versions`. | +| Ordinary imports work but scoped/sub-path imports fail | Explicit native barrel in `files`, not just wildcard `paths`. | +| Duplicate identifiers after switching | Overlapping providers, inherited `types: ["meteor"]`, old paths and ambient declarations before blaming symlinks. | +| Bundled npm peer types fail under the package store or degrade to `any` | Try `compilerOptions.preserveSymlinks: true` for that resolution boundary. This does not fix overlapping declaration providers. | +| One community module has no native adapter | The package may publish no type information. Inspect its version and metadata; do not invent generated declarations or claim all Atmosphere packages are covered. | --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/v3-migration-docs/typescript/meteor-types.md +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/cli/using-core-types.md diff --git a/skills/migrate-to-rspack/SKILL.md b/skills/migrate-to-rspack/SKILL.md index 1068874..5c18a9a 100644 --- a/skills/migrate-to-rspack/SKILL.md +++ b/skills/migrate-to-rspack/SKILL.md @@ -21,7 +21,7 @@ metadata: area: migration tagline: "Migrate an existing Meteor 3 app to the Rspack bundler integration (`mainModule`, replacing legacy build plugins with loaders)." bundle: ["migration"] - docs_synced_at: "2026-09-11" + docs_synced_at: "2026-09-23" license: MIT --- @@ -44,13 +44,12 @@ Match `@meteorjs/rspack` to the Meteor release, not to | 3.5.1 | `1.2.0` | `2.1.0` | Revised client polyfills and extension discovery. | | 3.5.2 | `1.3.0` | `2.2.0` | Dependency diagnostics, mode isolation, full-app/TLA and cache fixes. | | 3.6-beta.0 | `1.4.0-beta360.0` | `3.0.0-beta.1` | Rspack 2.2.0 and workspace-aware installs. | +| 3.6-beta.1 | `1.4.0-beta360.1` | `3.0.0-beta.2` | TypeScript rebuild-loop fix; Node 26.8.2. | -The Atmosphere, Meteor npm integration, and Rspack core package versions are -independent. Inspect `.meteor/versions`, `package.json`, and the lockfile. -Normal startup aligns required dependencies when automatic installation is -enabled. Review and commit those changes. Explicit `meteor update --npm` is -an alternative, not an extra required step. Do not pair a newer integration -major with an older Meteor release to copy a helper. +Inspect `.meteor/versions`, `package.json`, and the lockfile: Atmosphere, +Meteor npm integration and Rspack core versions are independent. With automatic +installs enabled, startup aligns dependencies; review and commit the changes. +`meteor update --npm` is an alternative. Keep the release pairing. Already using Rspack? For the Meteor 3.6 beta upgrade, follow [Rspack 1 to 2](references/rspack-2-upgrade.md) and its toolchain checks. @@ -175,7 +174,7 @@ See `references/framework-and-css.md`. | `zodern:melte` (Svelte) | Official Rspack Svelte loader. | | `jorgenvatle:vite` (Vue/Solid) | Native Rspack Vue/Solid loaders. | | `babel-plugin-react-compiler` | SWC on the 3.6 beta pairing; earlier integrations retain Babel. See framework reference. | -| `zodern:types` | Still compatible. Keep it. | +| `zodern:types` | Keep the working declaration provider during bundler migration; beta.1 native adoption is a separate explicit choice. | Plugins acting only on Atmosphere package files can stay. Plugins acting on app-folder files (entry folder excluded) must move to Rspack. diff --git a/skills/migrate-to-rspack/references/eval-cases.md b/skills/migrate-to-rspack/references/eval-cases.md index fc755ac..1925b13 100644 --- a/skills/migrate-to-rspack/references/eval-cases.md +++ b/skills/migrate-to-rspack/references/eval-cases.md @@ -357,3 +357,10 @@ input/mode. It requires reproduction through the affected JSX/catalog/loader path and applicable development/production checks before a broader claim. Fail if it declares all plugin 5.x versions broken on Rspack 2, forces the example pin, or dismisses a different project's failure from this one smoke. + +## Case 36: beta.1 upgrade preserves types provider + +Prompt: "Upgrade our existing Rspack app from Meteor 3.5.2 to 3.6-beta.1. Automatic dependency installs are enabled and our zodern:types setup works. Must we migrate types, run update --npm, or rebuild native npm dependencies?" + +Pass if the agent: Uses update --release 3.6-beta.1 then normal startup, checks the beta.1 pairing and lockfile, preserves the current declaration provider and valid config, and verifies Node 26/native module compatibility. Does not mandate a second update --npm or native declaration migration. +Fail if it contradicts these boundaries or invents unsupported APIs. diff --git a/skills/migrate-to-rspack/references/rspack-2-upgrade.md b/skills/migrate-to-rspack/references/rspack-2-upgrade.md index 2d270e2..40729dd 100644 --- a/skills/migrate-to-rspack/references/rspack-2-upgrade.md +++ b/skills/migrate-to-rspack/references/rspack-2-upgrade.md @@ -1,7 +1,10 @@ # Rspack 1 to 2 in Meteor -Use this branch for Meteor 3.6, verified on `3.6-beta.0`, with -`rspack@1.4.0-beta360.0` and `@meteorjs/rspack@3.0.0-beta.1`. +Use this branch for Meteor 3.6 beta. The current audited target is +`3.6-beta.1`, with `rspack@1.4.0-beta360.1` and +`@meteorjs/rspack@3.0.0-beta.2`. A deliberately pinned `3.6-beta.0` keeps +`rspack@1.4.0-beta360.0` and `@meteorjs/rspack@3.0.0-beta.1`; use the +requested release instead of silently changing the target. Meteor 3.5.2 keeps `rspack@1.3.0`, `@meteorjs/rspack@2.2.0` and Rspack 1.x. Do not force Rspack 2 into a constrained older release. @@ -12,7 +15,7 @@ Do not force Rspack 2 into a constrained older release. 2. With default `meteor.autoInstallDeps` enabled, update then start normally: ```bash - meteor update --release 3.6-beta.0 + meteor update --release 3.6-beta.1 meteor run ``` @@ -24,7 +27,8 @@ Do not force Rspack 2 into a constrained older release. test a frozen install. `meteor update --npm` overrides the opt-out for that invocation; do not put a lockfile-rewriting step in immutable CI. 3. The beta's required npm minimums are core/CLI/dev-server 2.2.0, Meteor integration - 3.0.0-beta.1, SWC core 1.15.32, helpers 0.5.23 and Rsdoctor 1.5.9. + 3.0.0-beta.2 on beta.1 (3.0.0-beta.1 on beta.0), SWC core 1.15.32, + helpers 0.5.23 and Rsdoctor 1.5.9. Keep helpers in runtime dependencies, the bundler tools in dev dependencies. Detected React adds refresh plugin 2.0.0 and refresh runtime 0.17.0. Record the resolved versions: compatible newer patches can satisfy these @@ -59,7 +63,7 @@ Also check these [upstream migration boundaries](https://www.rspack.dev/guide/mi | Surface | Migration check | |---|---| -| Node and ESM | Rspack 2 requires Node `^20.19.0 \|\| >=22.12.0`. Meteor 3.6-beta.0 bundles Node 24.15.0; host Node 18 alone does not prove a Meteor build incompatibility. Identify which binary actually invokes each tool before upgrading that runtime. Keep valid Meteor CommonJS configs/output despite pure-ESM Rspack packages. | +| Node and ESM | Rspack 2 requires Node `^20.19.0 \|\| >=22.12.0`. Meteor 3.6-beta.1 bundles Node 26.8.2, beta.0 bundles Node 24.15.0; host Node 18 alone does not prove a Meteor build incompatibility. Identify which binary actually invokes each tool before upgrading that runtime. Keep valid Meteor CommonJS configs/output despite pure-ESM Rspack packages. | | Dev server | `@rspack/dev-server` is now explicit; Meteor's dependency check supplies it. Review custom `devServer.proxy` and `watchFiles` against the v2 guide before reusing old shapes. | | Resolution | Upstream changes cover `.wasm` extension lookup, CSS `@import` conditions and empty `resolve.roots`. Meteor supplies explicit extensions and project roots. Inspect `resolve.byDependency` and custom overrides; test the failing import before changing resolution globally. | | Custom plugins | Review the plugin's Rspack 2 support and the [2.0 breaking-change overview](https://www.rspack.dev/blog/announcing-2-0), including compiler hook and stats API changes when used. | @@ -73,6 +77,11 @@ React Compiler can use the built-in SWC loader on this pairing; see [framework migration](framework-and-css.md). Retain Babel for an older integration or requirements unsupported by the SWC compiler path. +Native TypeScript declarations are a separate beta.1 opt-in. Preserve a working +`zodern:types`/`@types/meteor` setup during Rspack migration. Neither SWC nor +normal startup runs `meteor types` or `tsc`. Use the existing-app TypeScript +migration guidance only when the task also includes changing providers. + ## Prove the result Use `meteor npm ci` for an npm lockfile, `pnpm install --frozen-lockfile` at @@ -84,6 +93,9 @@ requirement and retest after peer cleanup. Do not convert managers to fix CI. Run development, a rebuild, actual client/server tests, and a production bundle. Exercise CSS, lazy imports, local/workspace packages and custom loaders when present. Boot the extracted bundle and load the browser page. +For beta.1, rebuild and exercise native npm dependencies against Node 26.8.2 +and the deployment architecture before deploying; this is a release migration +step, not something to defer until a native module crashes in production. Follow the [validation matrix](validation-matrix.md); reported example startup is not proof that your translations, UI components or offline updates work. For a failure, capture the [migration report](troubleshooting.md#reporting-issues) From 8456ff09d6db86735fa76ff42b83086a6cd2e75f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nacho=20Codo=C3=B1er?= Date: Wed, 23 Sep 2026 11:01:36 +0200 Subject: [PATCH 04/10] Add dedicated Meteor TypeScript skill --- README.md | 6 + .../skill-gaps/2026-09-23-typescript-scope.md | 89 ++++++++++ .../2026-09-23-typescript-skill.md | 99 +++++++++++ skills/meteor-modern-build-stack/SKILL.md | 15 +- .../references/eval-cases.md | 8 + .../references/rspack-config.md | 2 + skills/meteor-typescript/SKILL.md | 95 ++++++++++ .../references/declaration-providers.md | 144 +++++++++++++++ .../references/eval-cases.md | 119 +++++++++++++ .../references/javascript-intellisense.md | 59 +++++++ skills/migrate-to-meteor-3/SKILL.md | 9 +- .../references/eval-cases.md | 45 ++--- .../references/typescript-migration.md | 164 +++--------------- .../references/rspack-2-upgrade.md | 4 +- 14 files changed, 671 insertions(+), 187 deletions(-) create mode 100644 audits/skill-gaps/2026-09-23-typescript-scope.md create mode 100644 docs/maintenance/2026-09-23-typescript-skill.md create mode 100644 skills/meteor-typescript/SKILL.md create mode 100644 skills/meteor-typescript/references/declaration-providers.md create mode 100644 skills/meteor-typescript/references/eval-cases.md create mode 100644 skills/meteor-typescript/references/javascript-intellisense.md diff --git a/README.md b/README.md index 07c9e7c..77bee86 100644 --- a/README.md +++ b/README.md @@ -114,6 +114,12 @@ Already installed? See [Manage an installation](#manage-an-installation). npx skills add meteor/agent-skills --skill meteor-native ``` +- **`meteor-typescript`**: Configure Meteor app declarations, TypeScript and JavaScript IntelliSense, and reliable local/CI type-checking. + + ```bash + npx skills add meteor/agent-skills --skill meteor-typescript + ``` + ### Data - **`meteor-blaze`**: Build and debug Meteor 3 Blaze interfaces (Spacebars, Tracker state, async helpers, lifecycle, bundler-specific HMR, and components). diff --git a/audits/skill-gaps/2026-09-23-typescript-scope.md b/audits/skill-gaps/2026-09-23-typescript-scope.md new file mode 100644 index 0000000..8eae203 --- /dev/null +++ b/audits/skill-gaps/2026-09-23-typescript-scope.md @@ -0,0 +1,89 @@ +# TypeScript scope follow-up for Meteor 3.6-beta.1 + +## Run context + +```text +Agent-skills target ref: release/v1.1.0-beta.0-installation, current HEAD +Agent-skills revision: 0b6eb729fd41cb96e91cf21401de61e4c7e6b363; release preparation has uncommitted manifest/changelog changes, distributable skills unchanged +Meteor remote: https://github.com/meteor/meteor.git +Meteor branch: release-3.6 +Meteor revision: 82ea8df295134e64f495338a2e63362408098a24; exact tagged tree +Meteor release context: 3.6-beta.1, release/METEOR@3.6-beta.1 +Audit mode: incremental, user-authorized scope expansion +Comparison: same Meteor revision; implemented catalog versus expanded TypeScript outcome +Previous audit report: audits/skill-gaps/2026-09-23-meteor-3.6-beta.1.md, committed in 0b6eb729fd41cb96e91cf21401de61e4c7e6b363 +Previous Meteor revision: 82ea8df295134e64f495338a2e63362408098a24 +``` + +The original request maintained existing skill definitions. After reviewing +that completed maintenance, the user explicitly requested `meteor-typescript` +and completion of beta.1 gaps and suggestions before publication. This report +preserves that additional scope without rewriting the earlier audit. + +## Source coverage + +The original E01-E07 evidence and seven fixes remain applicable. The additional +scope uses tagged `v3-docs/docs/cli/using-core-types.md` (provider selection, +TypeScript and JavaScript apps, generation, resolution, checking and recovery), +`docs/packages/typescript.md`, `v3-migration-docs/typescript/meteor-types.md`, +`tools/cli/commands.js`, `tools/isobuild/types-generator.js`, and the native +generation/template compatibility tests. The prior disposable beta.1 app +verified compiler compatibility, source inclusion and rollback. + +## Summary + +| Classification | Count | +|---|---:| +| Covered | 7 | +| Candidate | 1 | +| Uncertain | 0 | + +## Maintenance findings + +| Finding | Classification / priority | Outcome and evidence | Required change and acceptance | +|---|---|---|---| +| T01 | Candidate / P2 | Meteor app declarations, editor resolution and type-checking recur without a framework upgrade. Tagged docs explicitly cover new apps, existing apps and JavaScript IntelliSense. Migration cannot own all those requests; bundling and type-checking are separate layers. | Add `meteor-typescript`; transfer detailed provider guidance from migration, retain migration checkpoints and build ownership. Evaluate native success/skip/failure, older providers, TS7, source inclusion, JS IntelliSense, missing metadata and neighboring requests. | +| F01-F07 | Covered | Current skill changes implement the original audit; the maintenance review records passing affected cases and executable TypeScript checks. | Retain these fixes and rerun affected handoff cases when extracting TypeScript guidance. No additional Accounts, Node, instrumentation, Rspack or DDP implementation gap found in this follow-up. | + +## Skill claim matrix + +| Owner | Current claim and scope | Follow-up | +|---|---|---| +| `migrate-to-meteor-3` | Runtime migration plus detailed provider setup; standalone type triggers can attract ordinary-development requests | Retain upgrade sequencing, preservation and recovery checkpoint; route detailed declaration work to the new owner | +| `meteor-modern-build-stack` | SWC/Rspack configuration and separate type-checker boundary | Keep compiler/checker integration; name the declaration owner | +| `migrate-to-rspack` | Preserve providers during bundler migration | Keep scope; hand off explicit provider adoption | +| Proposed `meteor-typescript` | Meteor app declarations across development and upgrades | Knowledge/build, Meteor >=3.0 with native beta.1 floor and earlier legacy branch; no bundle because this optional language workflow is not needed by every existing bundle audience | +| Other thirteen existing skills | Original beta.1 affected claims and unchanged owners | Original matrix remains applicable; no new routing or classification changes | + +## Proposed skill candidate + +`meteor-typescript` has a repeatable application outcome, source-backed +decisions that prevent broken provider switches and false-positive checks, +distinct routing and executable acceptance. Cover declaration providers, +`tsconfig`/`jsconfig`, editor module resolution and local/CI checking. Keep +general TypeScript language teaching and Atmosphere declaration publication +outside its scope. Link the package-author documentation when that is the +actual task instead of expanding this application skill. + +## Evaluation gaps + +Transfer the existing detailed native-provider cases to the new owner. Add +new-app, JavaScript IntelliSense, missing-root-config and missing-package-type +cases. Verify routing against Meteor 2 migration, Rspack setup and package +authoring. Existing runtime/Accounts cases retain their previous evidence. + +## Release blockers and no-action findings + +Complete T01 and affected verification before the requested beta publication. +The original report's post-beta.1 exclusions remain unchanged. No separate +package-author or general CLI skill is justified by this follow-up. Outside +contributor acceptance remains a release review requirement; agent-run cases +do not establish that acceptance. + +## Maintenance handoff + +The user explicitly authorized T01 with “please add it then” and requested +completion before publication. Apply `skill-maintenance` and `skill-creator`, +preserve existing classifications, update neighboring handoffs and evaluation +ownership, regenerate the catalog and verify all distributable archives. Keep +this pre-edit report immutable and record implementation results separately. diff --git a/docs/maintenance/2026-09-23-typescript-skill.md b/docs/maintenance/2026-09-23-typescript-skill.md new file mode 100644 index 0000000..bd1cf26 --- /dev/null +++ b/docs/maintenance/2026-09-23-typescript-skill.md @@ -0,0 +1,99 @@ +# TypeScript skill completion review + +Implements the user-authorized T01 finding in the +[scope follow-up](../../audits/skill-gaps/2026-09-23-typescript-scope.md). +The seven original beta.1 findings remain implemented as recorded in the +[earlier maintenance review](2026-09-23-meteor-3.6-beta.1.md). + +## Scope and evidence + +The baseline is Agent Skills `0b6eb729fd41cb96e91cf21401de61e4c7e6b363`. +Meteor remains pinned to official `release/METEOR@3.6-beta.1`, +`82ea8df295134e64f495338a2e63362408098a24`. The tagged TypeScript guide, +generator/CLI implementation, template compatibility tests and prior runtime +evidence support the new skill. Later release-branch changes stay excluded. + +`meteor-typescript` owns application declaration providers, native opt-in, +TypeScript/JavaScript configuration, editor resolution and checking. Its +classification is knowledge/build with Meteor >=3.0: native generation is +gated at beta.1, while earlier releases retain the legacy provider branch. +It has no bundle membership because the complete language workflow is optional +for each existing bundle audience. Existing skill classifications are unchanged. + +Detailed provider instructions moved from the runtime-migration reference to +the new skill. Migration retains provider preservation, checkpoints, failure +recovery and a handoff. Modern build retains transpilation/checker integration; +Rspack migration preserves working providers and hands off explicit adoption. +The catalog now contains 17 published skills. + +The final source review found no remaining confirmed F01-F07 implementation +gap. T01 supplies the requested additional skill. Package authoring and shell +completion remain documented out-of-scope findings rather than unimplemented +skill proposals. No uncertain or post-beta.1 capability was added. + +## Behavioral checks + +Fresh Claude Code 2.1.252 conversations used current skill/reference content, +hidden acceptance criteria, disabled tools/settings/MCP and no persistence. +The response model reported `claude-opus-5[1m]`. These runs verify the named +decisions; they do not certify all unsolicited advice in each response. + +| Cases | Final result | +|---|---| +| TypeScript 1-10, 13 | Pass: native adoption, provider preservation, generation failure, scoped imports, TS7, source inclusion, older release, JS IntelliSense, root config and uncovered package boundaries | +| TypeScript 11-12 | Pass after correction: build configuration and runtime migration hand off before inventing procedures | +| Migration 23, 29-30 | Pass with the declaration owner available: legacy support, runtime/provider sequencing and provider preservation | +| Modern build 31; Rspack migration 36 | Pass: exact pairing, separate checking and native dependency/provider boundaries | +| Migration 36; modern build 32 | Pass in description-only routing runs: standalone declarations select `meteor-typescript` | + +The first TypeScript 11-12 answers acknowledged the boundary but then invented +generic Rspack configuration and a runtime-first migration sequence. The body +now requires consulting the owning skill before those steps. Fresh reruns +passed. Neighbor body-loading runs do not prove catalog selection; the two +explicit neighboring routing cases were therefore evaluated from descriptions. + +Five additional description-only probes passed: native declaration adoption +and JS IntelliSense selected TypeScript; SWC/CSS configuration selected modern +build; async/Fibers migration selected runtime migration; Atmosphere publishing +selected no application skill and referred to official documentation. + +Earlier migration cases 31-32 and 34-35 moved to TypeScript cases 3-6. +Migration case 29 now tests the upgrade handoff. Historical audit results +refer to their original committed case revisions. + +## Executable verification + +The existing disposable Meteor 3.6-beta.1 app retains the prior TypeScript +generation, TS7, source-inclusion and failure-recovery evidence. An additional +JS fixture, using that app's installed compiler and packages, verified: + +1. Without root `tsconfig.json` or `jsconfig.json`, `meteor types` exited zero + with “Nothing to do” and left the native barrel unchanged. +2. A root `jsconfig.json` enabled generation before native paths were selected. +3. A JS module importing `Random` with a JSDoc number annotation around + `Random.id()` failed `tsc --project jsconfig.json --allowJs --checkJs --noEmit` + with TS2322. +4. Changing only that annotation to string passed; the original app config + was restored and temporary probes removed. + +This proves generation and optional JS checking, not a graphical editor's +hover UI. A fresh Claude plugin conversation loaded the installed JS reference +and correctly kept error checking optional for an IntelliSense-only request. + +## Repository and installation checks + +Validation, links, catalog checks, 33 tests, dependency audit and ZIP generation +passed during implementation. Both strict Claude manifest checks and the +current Codex plugin-creator validator passed. Final exact-commit checks and +archive/install byte comparisons belong in the release handoff. + +The complete plugin installed as `1.1.0-beta.1` in disposable Codex 0.155.1 +and Claude Code 2.1.252 profiles. The new skill also installed individually +with the Skills CLI. User plugin settings remained untouched. Fresh plugin +conversation results and any installation limitations are recorded in the +release handoff. Temporary apps, credentials mounts and raw transcripts are +outside the repository. + +All requested beta.1 content and the approved TypeScript suggestion are now +implemented. Outside-contributor acceptance remains pending under `AGENTS.md`; +these agent-run evaluations are not an outside review. diff --git a/skills/meteor-modern-build-stack/SKILL.md b/skills/meteor-modern-build-stack/SKILL.md index 7ce4d68..8525b93 100644 --- a/skills/meteor-modern-build-stack/SKILL.md +++ b/skills/meteor-modern-build-stack/SKILL.md @@ -3,8 +3,8 @@ name: meteor-modern-build-stack description: > Use when configuring or tuning the Meteor 3 modern build stack: SWC transpiler, SWC-based minifier, modern @parcel/watcher, web-arch skipping - in development, .meteorignore, and the Rspack bundler integration via the - rspack Atmosphere package. Triggers on package.json "meteor": { "modern": + in development, .meteorignore, and Rspack integration. + Triggers on package.json "meteor": { "modern": true }, .swcrc, swc.config.js, [Transpiler] Used Babel Fallback logs, rspack.config.js, rspack.config.ts, defineConfig from @meteorjs/rspack, Meteor.compileWith* helpers, Meteor.extendConfig, Meteor.extendSwcConfig vs Meteor.replaceSwcConfig, @@ -12,9 +12,10 @@ description: > Meteor.enablePortableBuild, HtmlRspackPlugin customization, RSPACK_DEVSERVER_PORT, TOOL_NODE_FLAGS, pnpm workspaces, Rspack 2, skeleton selection, PWA, Workbox and service-worker build setup. - Use this skill when the user asks about SWC vs Babel or Rspack configuration. + Use this skill when asked about SWC vs Babel or Rspack configuration. Route existing-app bundler migration to migrate-to-rspack, Blaze PWA - scaffolding to meteor-blaze, and jam:offline data to meteor-community-packages. + scaffolding to meteor-blaze, declarations to meteor-typescript, and jam:offline + data to meteor-community-packages. metadata: author: meteor kind: knowledge @@ -107,9 +108,9 @@ See [pairings](references/rspack-config.md) and [dependencies/workspaces](references/meteor-3.6-workspaces.md). For migration, use `migrate-to-rspack`. -Rspack transpiles TypeScript without type-checking or choosing declarations. -For beta.1's separate native opt-in, see -[declaration boundaries](references/rspack-config.md#typescript-declarations). +Rspack transpiles TypeScript. Use `meteor-typescript` for declarations and +checking; see +[checker boundaries](references/rspack-config.md#typescript-declarations). ## Scaffolds, PWA and offline behavior diff --git a/skills/meteor-modern-build-stack/references/eval-cases.md b/skills/meteor-modern-build-stack/references/eval-cases.md index 38f4a02..bfefcd4 100644 --- a/skills/meteor-modern-build-stack/references/eval-cases.md +++ b/skills/meteor-modern-build-stack/references/eval-cases.md @@ -315,3 +315,11 @@ Prompt: "Configure Rspack on a new Meteor 3.6-beta.1 TypeScript app with autoIns Pass if the agent: Uses rspack 1.4.0-beta360.1/@meteorjs/rspack 3.0.0-beta.2 and Rspack core/CLI/dev-server 2.2.0 minimums, prepares dependencies with the existing manager and keeps frozen CI. Separates transpilation, explicit native opt-in and local tsc; new templates retain legacy providers. Does not remove zodern:types as a bundler requirement. Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 32: standalone declaration resolution near miss + +Prompt: "Our Meteor 3.6-beta.1 bundler works, but meteor/random is any in the editor and local tsc skips our app files. We want type resolution repaired, with no SWC or Rspack migration." + +Pass if the agent hands provider/configuration and source-set checking to +meteor-typescript, preserves working build/checker integration and does not +change loaders merely because the app uses TypeScript. diff --git a/skills/meteor-modern-build-stack/references/rspack-config.md b/skills/meteor-modern-build-stack/references/rspack-config.md index 0952177..2767d21 100644 --- a/skills/meteor-modern-build-stack/references/rspack-config.md +++ b/skills/meteor-modern-build-stack/references/rspack-config.md @@ -355,6 +355,8 @@ unless the task includes a provider migration; run the app's local `tsc` separately. A configured checker such as the TypeScript scaffold's `TsCheckerRspackPlugin` is a separate layer that can check during builds; preserve it when working. See the +`meteor-typescript` skill for provider configuration and checking. +If it is not installed, consult the [declaration guide](https://docs.meteor.com/cli/using-core-types). --- diff --git a/skills/meteor-typescript/SKILL.md b/skills/meteor-typescript/SKILL.md new file mode 100644 index 0000000..5f068f1 --- /dev/null +++ b/skills/meteor-typescript/SKILL.md @@ -0,0 +1,95 @@ +--- +name: meteor-typescript +description: > + Use when setting up or repairing Meteor application declarations, TypeScript + configuration, JavaScript IntelliSense, or local and CI type-checking. + Triggers on meteor types, meteor/* imports resolving to any, missing + declarations, duplicate Meteor identifiers, zodern:types, @types/meteor, + .meteor/types, tsconfig.json, jsconfig.json, and tsc --noEmit in a Meteor app. + Use this skill when choosing or migrating declaration providers without + changing the app's runtime or bundler. For a Meteor 2-to-3 runtime migration + use migrate-to-meteor-3 first; for SWC/Rspack compilation use + meteor-modern-build-stack or migrate-to-rspack. General TypeScript language + questions and Atmosphere declaration publishing are outside this app scope. +metadata: + author: meteor + kind: knowledge + meteor: ">=3.0" + area: build + tagline: "Configure Meteor app declarations, TypeScript and JavaScript IntelliSense, and reliable local/CI type-checking." + docs_synced_at: "2026-09-23" +license: MIT +--- + +# TypeScript in Meteor applications + +Make the editor and checker resolve the intended Meteor declarations and +actually inspect application source. Preserve working provider choices unless +the task includes changing them. A runtime or bundler upgrade does not imply +a declaration migration. + +For a runtime migration or bundler configuration request, load the owning +skill before proposing migration steps or build configuration. This skill's +declaration guidance does not supply that procedure; do not substitute a +generic TypeScript/Rspack recipe when the owning skill is unavailable. + +## Identify the layer + +| Layer | Evidence and action | +|---|---| +| Compilation | The Atmosphere `typescript` package or Rspack/SWC strips types. Use the build owner for syntax transforms, loaders and bundling. | +| Declaration provider | Inspect `.meteor/packages`, `.meteor/versions`, npm/workspace manifests and lockfile for direct `zodern:types`, `@types/meteor` and native opt-in. | +| Resolution | Inspect active `tsconfig.json`/`jsconfig.json`, `extends`, `files`, `include`, `exclude`, `paths` and `types`. Check the editor uses the intended project/compiler. | +| Checking | Inspect the installed npm `typescript` and scripts; it is separate from the Atmosphere compiler. Preserve a configured checker such as `TsCheckerRspackPlugin`. | + +Do not infer that an app is checked because `meteor run` or `meteor build` +succeeded. Conversely, do not claim an explicitly configured checker never +runs just because SWC itself only transpiles. + +## Choose the provider + +| Target and intent | Decision | +|---|---| +| Meteor 3 before 3.6-beta.1 | Native `meteor types` is unavailable. Keep a working legacy provider; use the earlier-release branch in the provider reference if declarations are missing. | +| New or existing 3.6-beta.1 app with working legacy types | Keep them unless native adoption is requested. Beta.1 TypeScript templates still install direct `zodern:types` and `@types/meteor`; a native fallback path is not opt-in. | +| Explicit native adoption on 3.6-beta.1 | Root config required. Checkpoint providers/config, remove direct `zodern:types`, generate successfully, then merge native resolution and remove overlapping ambient types. | +| JavaScript-only beta.1 app wanting IntelliSense | Use `jsconfig.json` and the same provider decision; no TypeScript source conversion or bundler switch is required. | + +Read [declaration providers](references/declaration-providers.md) for the +ordered switch, native adapter/barrel distinction, inherited configuration, +TypeScript 7 compatibility, earlier providers and rollback. Read +[JavaScript IntelliSense](references/javascript-intellisense.md) for JS apps. + +## Verify the effective project + +1. Confirm generation actually ran. A direct `zodern:types` makes + `meteor types` skip with exit zero; ordinary Meteor commands do not select + or regenerate native declarations on beta.1. +2. Use the app's local compiler. With native declarations, run + `meteor types && tsc --noEmit` in a package script; select the intended + config explicitly when the app has several projects. +3. Check `tsc --listFiles --noEmit` includes application source. Appending a + barrel under `files` can disable implicit inclusion; retain existing source + patterns and exclusions. A deliberate temporary wrong type should fail; + remove the probe and rerun. JavaScript IntelliSense alone does not enable + `checkJs`; select JS checking separately when requested. +4. Restart the editor's TypeScript server after configuration changes. If + CLI and editor disagree, compare selected config/compiler before clearing + Meteor state or reinstalling providers. +5. Keep generated `.meteor/types/` untracked and unedited. Fix exposed app + errors rather than masking them with `any` or a new `skipLibCheck` bypass. + +## Diagnose the boundary + +| Symptom | First check | +|---|---| +| Native command reports nothing to do | Root `tsconfig.json` or `jsconfig.json`. For a new native-only setup, generate with the root config before adding entries that point to nonexistent output. | +| Generation fails | Read the error; local packages may need fixing. Stop the provider switch, preserve config and old output, restore the previous provider for rollback. | +| Ordinary imports work, scoped/sub-path imports fail | Explicit native barrel in `files` plus wildcard mapping to per-package adapters, not to the barrel. | +| Duplicate identifiers | Overlapping providers, inherited `types: ["meteor"]` and app ambient declarations before symlinks. | +| Peer types fail inside Meteor's package store | Consider `preserveSymlinks` for that specific boundary; it cannot remove duplicate providers. | +| One community package remains untyped | Check whether the installed package publishes declarations. No generator can promise coverage for every Atmosphere package. | + +If the actual task is publishing package declarations, use the official +[Atmosphere package types documentation](https://docs.meteor.com/packages/7.writing-atmosphere-packages#typescript-types). +Do not edit generated application adapters as a package-authoring solution. diff --git a/skills/meteor-typescript/references/declaration-providers.md b/skills/meteor-typescript/references/declaration-providers.md new file mode 100644 index 0000000..0556011 --- /dev/null +++ b/skills/meteor-typescript/references/declaration-providers.md @@ -0,0 +1,144 @@ +# Meteor declaration providers + +Inspect the release, direct Atmosphere constraints, resolved package versions, +npm/workspace manifests, lockfile and all active TypeScript configs before +changing providers. Keep compiler upgrades separate from declaration changes. + +## Choose by release and provider + +| Project state | Action | +|---|---| +| Meteor 3 before 3.6-beta.1 | Native `meteor types` is unavailable. Retain working legacy declarations; use the `zodern:types` branch below when package declarations are missing. | +| Upgrading to 3.6-beta.1 with working `@types/meteor` or `zodern:types` | Keep the provider and paths unless the task includes adopting native declarations. Runtime upgrade alone does not switch providers. | +| Explicit native adoption on 3.6-beta.1 | Follow the ordered migration below. The command needs a root `tsconfig.json` or `jsconfig.json`. | +| Direct `zodern:types` still installed | `meteor types` skips successfully and leaves both output trees unchanged. A zero exit is not proof of native generation. A transitive dependency alone does not select the legacy provider. | + +The classic `typescript` package and Rspack/SWC transpile app source without +type-checking it themselves. A separately configured checker, such as the +TypeScript scaffold's `TsCheckerRspackPlugin`, is a distinct layer; preserve +a working checker when changing declarations. On beta.1, ordinary `run`, `build`, `test` and `lint` neither +generate nor select native declarations. New TypeScript templates also keep +the legacy provider first; a native fallback path is not an opt-in. + +## Native adoption on Meteor 3.6-beta.1 + +1. Checkpoint provider dependencies, lockfile and TypeScript configuration. + Keep the app's local TypeScript compiler version fixed during this change. +2. Remove `zodern:types` only if it is a direct app dependency, then generate: + + ```bash + meteor remove zodern:types + meteor types + ``` + + Generation can build local packages but does not bundle or type-check the + application. On failure, stop before changing provider paths: the command + exits nonzero and preserves the old `.meteor/local/types` output. Restore + the removed provider if rolling back. Successful generation removes that + stale legacy output. +3. After success, merge these entries into the active TypeScript config: + + ```json + { + "files": ["./.meteor/types/packages.d.ts"], + "include": ["**/*.ts", "**/*.tsx"], + "compilerOptions": { + "paths": { + "meteor/*": ["./.meteor/types/packages/*"] + } + } + } + ``` + + Append the barrel to existing `files`; retain existing `include`, aliases, + compiler options and `extends`. If the app previously had neither `files` + nor `include`, adding `files` disables implicit source inclusion: explicitly + preserve it with `include: ["**/*"]`, or the app's intended source patterns. + Do not broaden an intentionally files-only project. Resolve paths against the config + that declares them. The adapters resolve normal package imports; the barrel + supplies scoped and sub-path modules such as + `meteor/react-meteor-data/suspense`. Explicit `files` works even when + `.meteor/**` is excluded. Do not map `meteor/*` directly to the native barrel. +4. Remove a direct `@types/meteor` dependency with the project's existing + package manager, and remove only `"meteor"` from `compilerOptions.types` + wherever it is inherited or declared. Preserve other type libraries and + the workspace lockfile. Prefer one provider per Meteor module ID; a hybrid + for uncovered packages needs deliberate non-overlap and type-checking. +5. Use the app's installed `typescript` compiler, adding a compatible pinned + dev dependency only if missing. For an npm app: + + ```json + { + "scripts": { + "check-types": "meteor types && tsc --noEmit" + } + } + ``` + + ```bash + meteor npm run check-types + ``` + + Use the equivalent script runner for pnpm/Yarn. CI must generate before + invoking local `tsc`; a successful app build does not prove type safety. + Fix errors exposed by corrected declarations without casting everything + to `any`. Check `tsc --listFiles --noEmit` includes application source; a + deliberate temporary wrong type should fail. Remove that probe and rerun. + Restart the editor's TypeScript server after config changes. + +Do not edit or commit `.meteor/types/`; generation replaces its contents and +writes its own `.gitignore`. Roll back by restoring legacy dependencies, +lockfile and config, then regenerate using the app's previous provider workflow. +Ordinary Meteor commands and a skipped native run do not delete either tree. + +## Compiler configuration compatibility + +Inspect the installed npm `typescript`, not only the Atmosphere `typescript` +package: they are separate tools. Beta.1's TypeScript scaffold selects npm +TypeScript 7 and `moduleResolution: "bundler"`. Do not copy older docs' +`baseUrl` or `moduleResolution: "node"` into it. +[TypeScript 7 removes both options](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/). +`paths` works without `baseUrl` on TypeScript 4.1+; use explicit relative +targets, preserving aliases and their previous base directory. Keep an older +app's compatible compiler/configuration rather than upgrading its compiler +just to change Meteor declarations. + +## Earlier-release legacy declarations + +If required package declarations are missing on an older Meteor 3 app: + +```bash +meteor add zodern:types +``` + +Merge the legacy settings, preserving any intentional working provider order: + +```json +{ + "compilerOptions": { + "preserveSymlinks": true, + "paths": { + "meteor/*": ["./.meteor/local/types/packages.d.ts"] + } + } +} +``` + +Regenerate through the existing provider workflow, restart the editor's +TypeScript server, and run the local compiler. Keep generated output untracked. +The legacy barrel mapping is not the native adapter mapping. + +## Diagnose the first missing boundary + +| Symptom | Check | +|---|---| +| `meteor types` reports nothing to do | Root `tsconfig.json` or `jsconfig.json`; do not delete caches. | +| Generation says it skipped | Direct `zodern:types` constraint, not only `.meteor/versions`. | +| Ordinary imports work but scoped/sub-path imports fail | Explicit native barrel in `files`, not just wildcard `paths`. | +| Duplicate identifiers after switching | Overlapping providers, inherited `types: ["meteor"]`, old paths and ambient declarations before blaming symlinks. | +| Bundled npm peer types fail under the package store or degrade to `any` | Try `compilerOptions.preserveSymlinks: true` for that resolution boundary. This does not fix overlapping declaration providers. | +| One community module has no native adapter | The package may publish no type information. Inspect its version and metadata; do not invent generated declarations or claim all Atmosphere packages are covered. | + +--- +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/v3-migration-docs/typescript/meteor-types.md +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/cli/using-core-types.md diff --git a/skills/meteor-typescript/references/eval-cases.md b/skills/meteor-typescript/references/eval-cases.md new file mode 100644 index 0000000..c163873 --- /dev/null +++ b/skills/meteor-typescript/references/eval-cases.md @@ -0,0 +1,119 @@ +# TypeScript acceptance cases + +Use the current skill and relevant references in a fresh conversation or a +disposable app. Keep pass/fail criteria hidden until the run finishes. + +## Case 1: native provider adoption in a beta.1 app + +Prompt: "Our Meteor 3.6-beta.1 TypeScript app was just created, and we explicitly want native declarations. We have direct zodern:types and @types/meteor, tsconfig extends, a files array and meteor in compilerOptions.types. Give the migration and CI sequence." + +Pass if the agent: Preserves the compiler and app config, checkpoints state, removes direct zodern:types, generates before switching paths/removing @types/meteor, appends the native barrel and per-package adapters, removes only inherited meteor ambient loading, runs local tsc through a script and keeps generated files untracked. Provides rollback without treating compilation as checking. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 2: preserve providers during runtime upgrade + +Prompt: "Upgrade our existing Meteor app to 3.6-beta.1 but keep the working TypeScript provider. meteor types exits zero saying zodern:types is installed. Did it generate native types, and should we remove the provider?" + +Pass if the agent: Keeps the explicit existing-provider preference, explains successful skip and direct dependency precedence, and distinguishes runtime upgrade, native generation and type-checking. Does not remove working providers. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 3: native generation failure + +Prompt: "After removing direct zodern:types on 3.6-beta.1, meteor types fails. Should we replace paths, uninstall @types/meteor and delete .meteor/local/types to finish?" + +Pass if the agent: Stops provider switching until generation succeeds, preserves old output and config, restores the removed package for rollback and reports nonzero generation failure. Does not delete fallback output or invoke a destructive reset. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 4: native scoped imports and mixed providers + +Prompt: "After beta.1 native opt-in, meteor/random resolves but meteor/react-meteor-data/suspense fails. Our tsconfig excludes .meteor and extends a config with types [meteor,node]. Why do we also see duplicate declarations?" + +Pass if the agent: Checks explicit native barrel in files despite exclude, keeps paths mapped to packages/* rather than the barrel, checks installed package declaration coverage and removes overlapping ambient meteor provider while preserving node and unrelated config. Does not blame all failures on preserveSymlinks. +Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 5: TypeScript 7 configuration during native adoption + +Prompt: "After selecting Meteor 3.6-beta.1 native declarations, our existing TypeScript 7 app reports TS5102 for baseUrl copied from the guide. Should we downgrade TypeScript or copy moduleResolution: node as well? The Rspack config already has TsCheckerRspackPlugin." + +Pass if the agent preserves the compiler and checker, removes the unsupported +baseUrl while preserving alias semantics through relative paths, keeps a +compatible bundler/nodenext resolution mode, and separates checker behavior +from SWC transpilation and native generation. It must not downgrade TypeScript +or claim the configured checker does not run just because SWC itself strips types. + +## Case 6: generated barrel hides application source + +Prompt: "After beta.1 native opt-in we added files: [.meteor/types/packages.d.ts] to a tsconfig that previously had neither files nor include. tsc now passes even with a wrong assignment in imports/probe.ts. Are native types working?" + +Pass if the agent checks the effective source set with local tsc --listFiles, +explains that adding files removed implicit inclusion, and preserves the +previous source set with explicit include patterns while retaining exclusions. +It verifies a temporary deliberate type error fails, then removes it and +reruns. It must not disable checks or claim a green exit proved app coverage. + +## Case 7: Meteor TypeScript imports become `any` + +Prompt: "After moving from Meteor 2 to Meteor 3.5.2, required package +declarations are missing. We want zodern:types; the editor also reports +duplicate identifiers. What should we inspect and configure?" + +Pass if the agent checks existing providers and inherited configuration, uses +the legacy `zodern:types` workflow with `preserveSymlinks` and the legacy barrel +mapping, and restarts the TypeScript server. It must inspect overlapping +declarations before attributing duplicates to symlinks, keep generated output +untracked, and not prescribe native `meteor types` on 3.5.2. + +## Case 8: JavaScript IntelliSense without conversion + +Prompt: "Our JavaScript-only Meteor 3.6-beta.1 app wants IntelliSense for meteor/random. There is no root tsconfig or jsconfig and no direct zodern:types. We do not want a TypeScript conversion, a bundler change or JS lint errors." + +Pass if the agent adds a root jsconfig, generates native declarations before +selecting their paths, includes native adapters/barrel and intended JS source, +preserves compatible resolution and verifies editor types. It keeps checkJs +and CI error checking optional and does not convert source or add Rspack. + +## Case 9: missing root configuration + +Prompt: "On 3.6-beta.1, meteor types says there is nothing to do. We only have tsconfig files under imports/ui and packages. Should we delete .meteor/local or run meteor reset?" + +Pass if the agent checks for an appropriate root config, preserves nested +project ownership, reruns generation, and checks real output. It does not +reset application state or assume a successful no-op generated declarations. + +## Case 10: a package is missing from native output + +Prompt: "Native types work for meteor/random but a community package is untyped and has no generated adapter. Another declared package has TS2307 for a bundled peer under the Meteor package store. Should we edit .meteor/types or enable preserveSymlinks for everything?" + +Pass if the agent separates missing declaration metadata from peer resolution, +checks installed package/version metadata, tries preserveSymlinks only for the +peer boundary, and does not edit generated files or promise universal coverage. +Any hybrid provider is deliberate, non-overlapping and checked. + +## Case 11: bundler configuration near miss + +Prompt: "Configure SWC decorators and CSS loaders in rspack.config.ts for our Meteor app. Existing editor types and type-checks already work." + +Pass if the agent routes bundler configuration to meteor-modern-build-stack +and leaves working providers alone. The config's .ts suffix alone does not +make declarations the primary task. +Fail if it supplies a generic Rspack configuration without consulting the +Meteor build owner and release pairing. + +## Case 12: runtime migration near miss + +Prompt: "Move this Meteor 2 app to Meteor 3, replacing removed Fibers and propagating async Mongo calls through methods. We use TypeScript but are not changing providers." + +Pass if the agent selects migrate-to-meteor-3 for runtime/API conversion and +preserves the working declaration provider. It does not replace that task +with native type setup. +Fail if it invents a runtime procedure under this skill, including flipping +the release before async conversion and package triage. + +## Case 13: package-author boundary + +Prompt: "Publish declarations for my reusable Atmosphere package with api.types and package-types.json. Is editing the app's generated adapter the right workflow?" + +Pass if the agent rejects editing generated adapters and directs the actual +package-author workflow to the official Atmosphere types documentation. It +does not claim the app-provider skill implements package publication or that +api.types exists on every Meteor 3 release. diff --git a/skills/meteor-typescript/references/javascript-intellisense.md b/skills/meteor-typescript/references/javascript-intellisense.md new file mode 100644 index 0000000..d1d569c --- /dev/null +++ b/skills/meteor-typescript/references/javascript-intellisense.md @@ -0,0 +1,59 @@ +# JavaScript IntelliSense + +Native Meteor-import declarations require Meteor 3.6-beta.1 or later; on an +earlier Meteor 3 app retain the existing legacy declarations. A JS app does +not need a TypeScript conversion or Rspack migration to obtain editor types. + +Inspect the existing provider and root config first. If `tsconfig.json` +already owns these files, configure that project instead of creating a +competing `jsconfig.json`. Otherwise create or merge a root `jsconfig.json`, +retaining the app's source patterns, aliases, resolver and exclusions. + +For beta.1 native opt-in, follow the generation-before-switch and rollback +sequence in [declaration providers](declaration-providers.md). The root config +must exist before `meteor types`; a direct `zodern:types` still causes a +successful skip. Once generation succeeds, merge: + +```json +{ + "files": ["./.meteor/types/packages.d.ts"], + "include": ["**/*.js", "**/*.jsx"], + "compilerOptions": { + "paths": { + "meteor/*": ["./.meteor/types/packages/*"] + } + } +} +``` + +Append the barrel to existing `files`; preserve intentional JS/JSX source +inclusion and generated-output exclusions. The barrel is explicit even when +`.meteor/**` is excluded. Use relative `paths` targets; do not copy removed +TypeScript 7 `baseUrl` or `moduleResolution: "node"` options from older +examples. Retain a compatible resolver already used by the editor/project. + +Remove overlapping direct `@types/meteor` and only the `meteor` entry from +inherited `compilerOptions.types` after successful generation. Restart the +editor's TypeScript server and check hover/completion for a public import +such as `meteor/random`, plus a used scoped/sub-path import when relevant. +If a package supplies no declarations, do not claim generation typed it. + +`jsconfig.json` provides a JavaScript project for editor services; enabling +native declarations does not automatically enable JS error checking. If the +user also wants CI checks, use the app's compatible local TypeScript compiler +and opt into `checkJs` deliberately: + +```json +{ + "scripts": { + "check-js": "meteor types && tsc --project jsconfig.json --allowJs --checkJs --noEmit" + } +} +``` + +Verify the intended JS source appears in the compiler's file list and a +temporary invalid assignment is rejected. Keep this optional check separate +from a request for IntelliSense only. Do not edit or commit generated types. + +--- +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/cli/using-core-types.md diff --git a/skills/migrate-to-meteor-3/SKILL.md b/skills/migrate-to-meteor-3/SKILL.md index 501a38e..7ce14fe 100644 --- a/skills/migrate-to-meteor-3/SKILL.md +++ b/skills/migrate-to-meteor-3/SKILL.md @@ -7,10 +7,10 @@ description: > dropping a Promise, a read API receiving update modifiers, async allow/deny, an Iron Router controller not running, "Method stub took too long", Atmosphere resolution, Express 5 WebApp handlers, lost async context, - rawCollection callbacks, meteor/* TypeScript types, meteor types during an upgrade, useTracker, and + rawCollection callbacks, TypeScript declaration failures during upgrades, useTracker, and useSubscribe. Use this skill when the user asks about upgrading Meteor, - async caller propagation, iterators with await, zodern:types, or replacing - and forking packages. + async caller propagation, iterators with await, or replacing and forking + packages. Standalone declarations and type-checking belong to meteor-typescript. metadata: author: meteor kind: knowledge @@ -68,7 +68,8 @@ in phases. Do not flip the framework version flag first. provider. Keep working `@types/meteor` or `zodern:types` setups. Meteor 3.6-beta.1 adds explicit native opt-in through `meteor types`; earlier releases retain the legacy workflow. See - `references/typescript-migration.md` before changing packages or paths. + `references/typescript-migration.md`, then use `meteor-typescript` for + provider changes and checking. 11. For React projects, decide whether to adopt the Suspense-aware `react-meteor-data` import. See `references/react-migration.md`, then use `meteor-react` for current hook, scaffold, and build guidance. diff --git a/skills/migrate-to-meteor-3/references/eval-cases.md b/skills/migrate-to-meteor-3/references/eval-cases.md index 09351f0..4740c3b 100644 --- a/skills/migrate-to-meteor-3/references/eval-cases.md +++ b/skills/migrate-to-meteor-3/references/eval-cases.md @@ -407,12 +407,15 @@ Pass if the agent routes the fresh workstation and PATH workflow to `meteor-cli-installation`. Fail if it starts an application code migration or offers the Linux and macOS shell installer on Windows. -## Case 29: native provider adoption during upgrade +## Case 29: native provider handoff during runtime migration -Prompt: "We are upgrading an existing TypeScript app to Meteor 3.6-beta.1 and explicitly want native declarations. We have direct zodern:types and @types/meteor, tsconfig extends, a files array and meteor in compilerOptions.types. Give the migration and CI sequence." +Prompt: "Migrate our Meteor 2 TypeScript app to 3.6-beta.1, including async APIs and an explicit native declaration switch. Which workflow owns each part?" -Pass if the agent: Preserves the compiler and app config, checkpoints state, removes direct zodern:types, generates before switching paths/removing @types/meteor, appends the native barrel and per-package adapters, removes only inherited meteor ambient loading, runs local tsc through a script and keeps generated files untracked. Provides rollback without treating compilation as checking. -Fail if it contradicts these boundaries or invents unsupported APIs. +Pass if the agent keeps runtime/async migration in this skill, preserves the +provider through that upgrade, then hands explicit native adoption to +meteor-typescript. It checkpoints dependencies and config and stops the +provider switch if generation fails. It must not replace async migration with +only a type configuration edit or select native declarations before beta.1. ## Case 30: preserve providers during runtime upgrade @@ -421,20 +424,6 @@ Prompt: "Upgrade our existing Meteor app to 3.6-beta.1 but keep the working Type Pass if the agent: Keeps the explicit existing-provider preference, explains successful skip and direct dependency precedence, and distinguishes runtime upgrade, native generation and type-checking. Does not remove working providers. Fail if it contradicts these boundaries or invents unsupported APIs. -## Case 31: native generation failure - -Prompt: "After removing direct zodern:types on 3.6-beta.1, meteor types fails. Should we replace paths, uninstall @types/meteor and delete .meteor/local/types to finish?" - -Pass if the agent: Stops provider switching until generation succeeds, preserves old output and config, restores the removed package for rollback and reports nonzero generation failure. Does not delete fallback output or invoke a destructive reset. -Fail if it contradicts these boundaries or invents unsupported APIs. - -## Case 32: native scoped imports and mixed providers - -Prompt: "After beta.1 native opt-in, meteor/random resolves but meteor/react-meteor-data/suspense fails. Our tsconfig excludes .meteor and extends a config with types [meteor,node]. Why do we also see duplicate declarations?" - -Pass if the agent: Checks explicit native barrel in files despite exclude, keeps paths mapped to packages/* rather than the barrel, checks installed package declaration coverage and removes overlapping ambient meteor provider while preserving node and unrelated config. Does not blame all failures on preserveSymlinks. -Fail if it contradicts these boundaries or invents unsupported APIs. - ## Case 33: native Node boundary during upgrade Prompt: "For our deliberate Meteor 2 to 3.6-beta.1 migration, can the existing Node 24 production image stay unchanged?" @@ -442,22 +431,10 @@ Prompt: "For our deliberate Meteor 2 to 3.6-beta.1 migration, can the existing N Pass if the agent: Uses Node 26.8.2/npm 11.19.0 for beta.1 after checking target runtime, rebuilds native modules and hands deployment details to meteor-deployment. Retains older-release mappings rather than generalizing Node 26 to all Meteor 3. Fail if it contradicts these boundaries or invents unsupported APIs. -## Case 34: TypeScript 7 configuration during native adoption - -Prompt: "After selecting Meteor 3.6-beta.1 native declarations, our existing TypeScript 7 app reports TS5102 for baseUrl copied from the guide. Should we downgrade TypeScript or copy moduleResolution: node as well? The Rspack config already has TsCheckerRspackPlugin." - -Pass if the agent preserves the compiler and checker, removes the unsupported -baseUrl while preserving alias semantics through relative paths, keeps a -compatible bundler/nodenext resolution mode, and separates checker behavior -from SWC transpilation and native generation. It must not downgrade TypeScript -or claim the configured checker does not run just because SWC itself strips types. -## Case 35: generated barrel hides application source +## Case 36: standalone declarations near miss -Prompt: "After beta.1 native opt-in we added files: [.meteor/types/packages.d.ts] to a tsconfig that previously had neither files nor include. tsc now passes even with a wrong assignment in imports/probe.ts. Are native types working?" +Prompt: "The app already runs on Meteor 3.6-beta.1. Only meteor/* editor types and our tsc check are broken; no framework or bundler upgrade is requested." -Pass if the agent checks the effective source set with local tsc --listFiles, -explains that adding files removed implicit inclusion, and preserves the -previous source set with explicit include patterns while retaining exclusions. -It verifies a temporary deliberate type error fails, then removes it and -reruns. It must not disable checks or claim a green exit proved app coverage. +Pass if the agent chooses meteor-typescript for provider/resolution/checking +and does not start a Meteor 2-to-3 conversion or bundler migration. diff --git a/skills/migrate-to-meteor-3/references/typescript-migration.md b/skills/migrate-to-meteor-3/references/typescript-migration.md index fcdd12e..e8c341c 100644 --- a/skills/migrate-to-meteor-3/references/typescript-migration.md +++ b/skills/migrate-to-meteor-3/references/typescript-migration.md @@ -1,146 +1,30 @@ -# TypeScript migration +# TypeScript checkpoint during a runtime upgrade -Keep declaration-provider migration separate from the Meteor runtime upgrade. -Inspect `.meteor/release`, direct `.meteor/packages` constraints, -`.meteor/versions`, npm/workspace manifests and lockfiles, and every active -`tsconfig.json`, including `extends`. This reference owns existing-app upgrade -decisions; fresh-project setup and Atmosphere declaration publishing remain in -the [TypeScript guide](https://docs.meteor.com/cli/using-core-types). +Keep declaration-provider changes separate from the Meteor runtime upgrade. +Inspect the target release, direct `.meteor/packages` constraints, +`.meteor/versions`, npm/workspace manifests, lockfile and active TypeScript +configs, including `extends`. -## Choose by release and provider - -| Project state | Action | -|---|---| -| Meteor 3 before 3.6-beta.1 | Native `meteor types` is unavailable. Retain working legacy declarations; use the `zodern:types` branch below when package declarations are missing. | -| Upgrading to 3.6-beta.1 with working `@types/meteor` or `zodern:types` | Keep the provider and paths unless the task includes adopting native declarations. Runtime upgrade alone does not switch providers. | -| Explicit native adoption on 3.6-beta.1 | Follow the ordered migration below. The command needs a root `tsconfig.json` or `jsconfig.json`. | -| Direct `zodern:types` still installed | `meteor types` skips successfully and leaves both output trees unchanged. A zero exit is not proof of native generation. A transitive dependency alone does not select the legacy provider. | - -The classic `typescript` package and Rspack/SWC transpile app source without -type-checking it themselves. A separately configured checker, such as the -TypeScript scaffold's `TsCheckerRspackPlugin`, is a distinct layer; preserve -a working checker when changing declarations. On beta.1, ordinary `run`, `build`, `test` and `lint` neither -generate nor select native declarations. New TypeScript templates also keep -the legacy provider first; a native fallback path is not an opt-in. - -## Native adoption on Meteor 3.6-beta.1 - -1. Checkpoint provider dependencies, lockfile and TypeScript configuration. - Keep the app's local TypeScript compiler version fixed during this change. -2. Remove `zodern:types` only if it is a direct app dependency, then generate: - - ```bash - meteor remove zodern:types - meteor types - ``` - - Generation can build local packages but does not bundle or type-check the - application. On failure, stop before changing provider paths: the command - exits nonzero and preserves the old `.meteor/local/types` output. Restore - the removed provider if rolling back. Successful generation removes that - stale legacy output. -3. After success, merge these entries into the active TypeScript config: - - ```json - { - "files": ["./.meteor/types/packages.d.ts"], - "include": ["**/*.ts", "**/*.tsx"], - "compilerOptions": { - "paths": { - "meteor/*": ["./.meteor/types/packages/*"] - } - } - } - ``` - - Append the barrel to existing `files`; retain existing `include`, aliases, - compiler options and `extends`. If the app previously had neither `files` - nor `include`, adding `files` disables implicit source inclusion: explicitly - preserve it with `include: ["**/*"]`, or the app's intended source patterns. - Do not broaden an intentionally files-only project. Resolve paths against the config - that declares them. The adapters resolve normal package imports; the barrel - supplies scoped and sub-path modules such as - `meteor/react-meteor-data/suspense`. Explicit `files` works even when - `.meteor/**` is excluded. Do not map `meteor/*` directly to the native barrel. -4. Remove a direct `@types/meteor` dependency with the project's existing - package manager, and remove only `"meteor"` from `compilerOptions.types` - wherever it is inherited or declared. Preserve other type libraries and - the workspace lockfile. Prefer one provider per Meteor module ID; a hybrid - for uncovered packages needs deliberate non-overlap and type-checking. -5. Use the app's installed `typescript` compiler, adding a compatible pinned - dev dependency only if missing. For an npm app: - - ```json - { - "scripts": { - "check-types": "meteor types && tsc --noEmit" - } - } - ``` - - ```bash - meteor npm run check-types - ``` - - Use the equivalent script runner for pnpm/Yarn. CI must generate before - invoking local `tsc`; a successful app build does not prove type safety. - Fix errors exposed by corrected declarations without casting everything - to `any`. Check `tsc --listFiles --noEmit` includes application source; a - deliberate temporary wrong type should fail. Remove that probe and rerun. - Restart the editor's TypeScript server after config changes. - -Do not edit or commit `.meteor/types/`; generation replaces its contents and -writes its own `.gitignore`. Roll back by restoring legacy dependencies, -lockfile and config, then regenerate using the app's previous provider workflow. -Ordinary Meteor commands and a skipped native run do not delete either tree. - -## Compiler configuration compatibility - -Inspect the installed npm `typescript`, not only the Atmosphere `typescript` -package: they are separate tools. Beta.1's TypeScript scaffold selects npm -TypeScript 7 and `moduleResolution: "bundler"`. Do not copy older docs' -`baseUrl` or `moduleResolution: "node"` into it. -[TypeScript 7 removes both options](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/). -`paths` works without `baseUrl` on TypeScript 4.1+; use explicit relative -targets, preserving aliases and their previous base directory. Keep an older -app's compatible compiler/configuration rather than upgrading its compiler -just to change Meteor declarations. - -## Earlier-release legacy declarations - -If required package declarations are missing on an older Meteor 3 app: - -```bash -meteor add zodern:types -``` - -Merge the legacy settings, preserving any intentional working provider order: - -```json -{ - "compilerOptions": { - "preserveSymlinks": true, - "paths": { - "meteor/*": ["./.meteor/local/types/packages.d.ts"] - } - } -} -``` - -Regenerate through the existing provider workflow, restart the editor's -TypeScript server, and run the local compiler. Keep generated output untracked. -The legacy barrel mapping is not the native adapter mapping. - -## Diagnose the first missing boundary - -| Symptom | Check | +| Target and intent | Migration decision | |---|---| -| `meteor types` reports nothing to do | Root `tsconfig.json` or `jsconfig.json`; do not delete caches. | -| Generation says it skipped | Direct `zodern:types` constraint, not only `.meteor/versions`. | -| Ordinary imports work but scoped/sub-path imports fail | Explicit native barrel in `files`, not just wildcard `paths`. | -| Duplicate identifiers after switching | Overlapping providers, inherited `types: ["meteor"]`, old paths and ambient declarations before blaming symlinks. | -| Bundled npm peer types fail under the package store or degrade to `any` | Try `compilerOptions.preserveSymlinks: true` for that resolution boundary. This does not fix overlapping declaration providers. | -| One community module has no native adapter | The package may publish no type information. Inspect its version and metadata; do not invent generated declarations or claim all Atmosphere packages are covered. | +| Earlier Meteor 3 release, including 3.5.2 | Native `meteor types` is unavailable. Preserve working `@types/meteor` or `zodern:types` and verify with the app's existing local checker. | +| Meteor 3.6-beta.1 runtime upgrade only | Keep the provider, compiler and config. The upgrade does not select native declarations. | +| Explicit native adoption on beta.1 | Checkpoint providers/config and use `meteor-typescript` for the separate declaration migration, editor resolution and CI workflow. | + +A direct `zodern:types` makes `meteor types` skip successfully; exit zero +alone is not evidence of generation. When explicitly switching, remove only +the direct legacy constraint, generate successfully, then change native +resolution and remove overlapping ambient types. Stop on generation failure; +restore the previous provider/config for rollback rather than deleting old +output. The native generator preserves legacy output on failure. + +Use `meteor-typescript` for `meteor/*` imports resolving to `any`, duplicate +identifiers, inherited `types`, scoped/sub-path imports, TypeScript 7 options +and source-inclusion checks. If only this migration skill is installed, the +[official declaration guide](https://docs.meteor.com/cli/using-core-types) +describes the provider workflow; inspect compatibility with the installed +compiler rather than copying an entire config. Compilation and checking are +separate; preserve a configured checker and verify actual app source. --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/v3-migration-docs/typescript/meteor-types.md diff --git a/skills/migrate-to-rspack/references/rspack-2-upgrade.md b/skills/migrate-to-rspack/references/rspack-2-upgrade.md index 40729dd..23248a6 100644 --- a/skills/migrate-to-rspack/references/rspack-2-upgrade.md +++ b/skills/migrate-to-rspack/references/rspack-2-upgrade.md @@ -79,8 +79,8 @@ integration or requirements unsupported by the SWC compiler path. Native TypeScript declarations are a separate beta.1 opt-in. Preserve a working `zodern:types`/`@types/meteor` setup during Rspack migration. Neither SWC nor -normal startup runs `meteor types` or `tsc`. Use the existing-app TypeScript -migration guidance only when the task also includes changing providers. +normal startup generates native declarations. Preserve a configured checker. +Use `meteor-typescript` when the task also includes changing providers. ## Prove the result From 06adc1103e6cf8666abeab1e8d5cb8c356a97deb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nacho=20Codo=C3=B1er?= Date: Wed, 23 Sep 2026 11:03:34 +0200 Subject: [PATCH 05/10] Prepare v1.1.0-beta.1 catalog release --- .claude-plugin/plugin.json | 2 +- .codex-plugin/plugin.json | 2 +- CHANGELOG.md | 35 +++++++++++++++ docs/releases/v1.1.0-beta.1.md | 80 ++++++++++++++++++++++++++++++++++ 4 files changed, 117 insertions(+), 2 deletions(-) create mode 100644 docs/releases/v1.1.0-beta.1.md diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 2b43477..774a04c 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -2,7 +2,7 @@ "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json", "name": "meteor", "displayName": "Meteor", - "version": "1.1.0-beta.0", + "version": "1.1.0-beta.1", "description": "Build, migrate, debug, test, secure, and deploy Meteor 3 applications.", "author": { "name": "Meteor", diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json index c600488..19b4248 100644 --- a/.codex-plugin/plugin.json +++ b/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "meteor", - "version": "1.1.0-beta.0", + "version": "1.1.0-beta.1", "description": "Build, migrate, debug, test, secure, and deploy Meteor 3 applications.", "author": { "name": "Meteor", diff --git a/CHANGELOG.md b/CHANGELOG.md index daca68c..c11298d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,40 @@ # Changelog +## 1.1.0-beta.1 - 2026-09-23 + +Catalog maintenance for Meteor 3.6-beta.1. The catalog grows to 17 skills; +existing classifications and earlier Meteor 3 compatibility branches remain. + +### Added + +- `meteor-typescript`: app declaration providers, native generation, + TypeScript/JavaScript configuration, editor resolution and local/CI checks. + Migration and build skills retain their owners and hand off declaration work. + +### Updated + +- Add explicit native TypeScript declaration migration, provider preservation, + failure recovery, TypeScript 7 configuration and verified app-source checking. +- Cover package-gated Accounts cookie protections, same-origin refresh, + passwordless payload validation and distinct HTTP/DDP rate-limit counters. +- Match deployment, migration and CI to beta.1's Node 26.8.2/npm 11.19.0, + including native dependency rebuilds and earlier Node 24 targets. +- Add server instrumentation lifecycle observation, correlation, privacy + controls, cleanup and authorization boundaries. +- Update the exact Rspack beta pairing and diagnose TypeScript rebuild loops, + host-prefixed ports and inspector output without broad resets. +- Explain pending optimistic-write snapshot merging, scoped client cleanup + and the uWebSockets DDP negotiation fix. + +### Maintenance + +- Preserve the pinned Meteor source audit and implementation evidence outside + distributable skills; record 30 passing affected cases and three routing checks. +- Version both plugin manifests as `1.1.0-beta.1`. +- Publish betas from the existing open release PR without merging its branch. + +[Compare with beta.0](https://github.com/meteor/agent-skills/compare/v1.1.0-beta.0...v1.1.0-beta.1). + ## 1.1.0-beta.0 - 2026-09-11 Beta for Meteor 3.6-beta.0 (`release-3.6`). The catalog keeps its 16 skills diff --git a/docs/releases/v1.1.0-beta.1.md b/docs/releases/v1.1.0-beta.1.md new file mode 100644 index 0000000..3db980e --- /dev/null +++ b/docs/releases/v1.1.0-beta.1.md @@ -0,0 +1,80 @@ +# 1.1.0-beta.1 release handoff + +Independent catalog beta containing the requested Meteor 3.6-beta.1 +maintenance and the subsequently approved TypeScript skill. This is not a +coordinated Meteor publication or a request to change Meteor's changelog. + +## Candidate and branch + +| Item | Value | +|---|---| +| Repository | `meteor/agent-skills`, public | +| Branch | `release/v1.1.0-beta.0-installation` | +| Existing release PR | [#23](https://github.com/meteor/agent-skills/pull/23), open | +| Agent Skills candidate | `8456ff09d6db86735fa76ff42b83086a6cd2e75f` | +| Comparison tag | `v1.1.0-beta.0` | +| Planned version/tag | `1.1.0-beta.1` / `v1.1.0-beta.1` | +| Source context | Meteor `release/METEOR@3.6-beta.1`, `82ea8df295134e64f495338a2e63362408098a24` | +| Publish commit | Pending completion of preparation and publication review | + +Keep the release PR open and its branch unmerged. Publication does not +authorize merging, closing or deleting it. The candidate contains all content +changes; release preparation changes only the two plugin versions, changelog +and this handoff. README's published-tag instructions remain at beta.0 until +beta.1 is live and its remote installation checks pass. + +## Content completion + +The [original audit](../../audits/skill-gaps/2026-09-23-meteor-3.6-beta.1.md) +and [implementation review](../maintenance/2026-09-23-meteor-3.6-beta.1.md) +record all seven confirmed fixes: TypeScript provider migration, Accounts +protection, Node 26 runtime, instrumentation, Rspack pairing, build diagnostics +and DDP behavior. That maintenance was committed as `0b6eb72`. + +The [scope follow-up](../../audits/skill-gaps/2026-09-23-typescript-scope.md) +and [completion review](../maintenance/2026-09-23-typescript-skill.md) record +the requested `meteor-typescript` skill and neighboring handoffs, committed +as `8456ff0`. The catalog now contains 17 skills and retains existing +classifications, bundles and earlier-release branches. No confirmed beta.1 +content finding or authorized skill suggestion remains unimplemented. + +## Preparation verification + +| Check | Outcome | +|---|---| +| Source and behavior | Original 30 affected cases and three routing probes passed; TypeScript cases 1-13, seven neighboring cases and five additional routing probes passed their final applicable runs | +| Runtime | Native TypeScript adoption/skip/failure/recovery and app-source negative check; JS root-config generation and deliberate TS2322/corrected success on exact Meteor beta.1 | +| Repository | Frozen install; skill/plugin validation; links; catalog write/check; 33 tests; dependency audit without known vulnerabilities | +| Manifests | Both versions set to `1.1.0-beta.1`; strict Claude marketplace/plugin validation and current Codex plugin-creator validation passed | +| Local Codex plugin | Codex 0.155.1 installed 17 skills; 113 skill files and manifest match source; fresh conversation loaded cached TypeScript/JS guidance and reported beta.1 | +| Local Claude plugin | Claude Code 2.1.252 installed 17 skills; 113 skill files and manifest match source; local-marketplace conversation loaded the new working-tree skill/reference and reported beta.1 | +| Individual skill | Clean-project Skills CLI install/reinstall of TypeScript; all four files match source | +| Archives | 17 ZIPs with 113 source-matching files; no maintainer/audit/review content; extracted TypeScript ZIP and references match source | +| Exact publish-commit checks and CI | Pending final preparation commit | +| Exact-tag remote installs/assets | Pending publication; local results do not establish remote availability | + +All installation tests used disposable profiles/projects. Credential mounts +were read-only and user plugin settings stayed unchanged. The first Codex +conversation failed with HTTP 401 because the test mount hid its credentials; +a corrected read-only descriptor mount passed without changing plugin content. + +The original Accounts/instrumentation source-test reviews are not upstream +suite execution. JS checking was exercised, not a graphical editor hover UI. +Guidance cases grade their stated decisions, not every unsolicited sentence. +No new Windows, mobile-device or cross-platform runtime certification is +claimed. Earlier review findings and platform limits retain their scope. + +## Publication review + +The user requested publication and then required all beta.1 gaps and the +TypeScript suggestion to be completed first. Content and local verification +are complete. `AGENTS.md` still requires an outside contributor to run new, +routing and high-risk cases in Claude Code or Cursor. No such review has +been recorded for beta.1; agent-run checks do not satisfy that requirement. +The previous beta.0 exception applied only to beta.0. + +Before tagging, record outside-contributor acceptance or an explicit +maintainer exception for this beta, and confirm green CI at the exact publish +commit. After tagging, verify the GitHub prerelease, all 17 ZIP assets and +exact-tag individual/Codex/Claude installations. Record results on this same +branch without moving the tag. From 145bb91f382cce8a078e390d915331ffe31e71b0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nacho=20Codo=C3=B1er?= Date: Tue, 29 Sep 2026 19:21:22 +0200 Subject: [PATCH 06/10] Update Meteor 3.6 skills through beta.3 --- .../2026-09-29-meteor-3.6-beta.3.md | 168 +++++++++++++++++ .../2026-09-29-meteor-3.6-beta.3.md | 172 ++++++++++++++++++ skills/meteor-accounts/SKILL.md | 2 +- .../meteor-accounts/references/eval-cases.md | 16 ++ .../references/oauth-services.md | 16 ++ skills/meteor-cli-installation/SKILL.md | 6 +- .../references/eval-cases.md | 24 +++ .../references/installation-and-path.md | 4 + .../references/local-database-upgrade.md | 77 ++++++++ .../references/releases-reset-reinstall.md | 4 + skills/meteor-debugging/SKILL.md | 4 +- .../references/build-debugging.md | 15 ++ .../references/ddp-and-data.md | 8 + .../meteor-debugging/references/eval-cases.md | 24 +++ .../references/logs-and-instrumentation.md | 13 ++ .../references/runtime-and-inspector.md | 13 ++ skills/meteor-deployment/SKILL.md | 15 +- skills/meteor-deployment/references/docker.md | 2 +- .../references/eval-cases.md | 16 ++ .../references/settings-and-env.md | 8 + skills/meteor-modern-build-stack/SKILL.md | 37 ++-- .../references/architecture-entrypoints.md | 85 +++++++++ .../references/eval-cases.md | 32 ++++ .../references/meteor-3.6-workspaces.md | 52 ++++-- .../meteor-bundler-optimizations.md | 4 +- .../references/rspack-config.md | 23 +++ skills/meteor-mongo-minimongo/SKILL.md | 14 +- .../references/eval-cases.md | 16 ++ skills/meteor-native/SKILL.md | 2 +- skills/meteor-native/references/eval-cases.md | 8 + .../references/toolchain-and-development.md | 2 + skills/meteor-pubsub/SKILL.md | 2 +- skills/meteor-pubsub/references/eval-cases.md | 8 + .../references/publication-strategies.md | 13 ++ skills/meteor-testing/SKILL.md | 7 +- .../meteor-testing/references/eval-cases.md | 16 ++ .../meteor-testing/references/focused-runs.md | 38 +++- .../meteor-testing/references/mocha-setup.md | 2 +- skills/meteor-typescript/SKILL.md | 14 +- .../references/declaration-providers.md | 17 ++ .../references/eval-cases.md | 16 ++ skills/migrate-to-meteor-3/SKILL.md | 13 +- .../references/eval-cases.md | 8 + .../references/other-breaking-changes.md | 30 ++- skills/migrate-to-rspack/SKILL.md | 40 +--- .../references/code-migrations.md | 11 ++ .../references/eval-cases.md | 16 ++ .../references/rspack-2-upgrade.md | 34 ++-- .../references/validation-matrix.md | 3 +- 49 files changed, 1057 insertions(+), 113 deletions(-) create mode 100644 audits/skill-gaps/2026-09-29-meteor-3.6-beta.3.md create mode 100644 docs/maintenance/2026-09-29-meteor-3.6-beta.3.md create mode 100644 skills/meteor-cli-installation/references/local-database-upgrade.md create mode 100644 skills/meteor-modern-build-stack/references/architecture-entrypoints.md diff --git a/audits/skill-gaps/2026-09-29-meteor-3.6-beta.3.md b/audits/skill-gaps/2026-09-29-meteor-3.6-beta.3.md new file mode 100644 index 0000000..8557a4b --- /dev/null +++ b/audits/skill-gaps/2026-09-29-meteor-3.6-beta.3.md @@ -0,0 +1,168 @@ +# Meteor 3.6-beta.3 incremental skill audit + +## Run context + +```text +Agent-skills target ref: release/v1.1.0-beta.0-installation, current HEAD +Agent-skills revision: 06adc1103e6cf8666abeab1e8d5cb8c356a97deb; dirty documentation and untracked local notes at audit start, published skills unchanged +Meteor remote: https://github.com/meteor/meteor.git +Meteor branch: release-3.6 +Meteor revision: 65b995360f8445a7e4c098eca02b83966dda141f; exact tag export, no source working-tree changes included +Meteor release context: 3.6-beta.3, release/METEOR@3.6-beta.3 +Audit mode: incremental, release-scoped maintenance +Comparison: Meteor 82ea8df295134e64f495338a2e63362408098a24..65b995360f8445a7e4c098eca02b83966dda141f +Previous audit report: audits/skill-gaps/2026-09-23-meteor-3.6-beta.1.md, committed in 0b6eb72 +Previous Meteor revision: 82ea8df295134e64f495338a2e63362408098a24 +Observed release-3.6 head: 7702f230757e9b29efa743d4a01053c4125429bf +``` + +Standalone audit and implementation requested after Meteor beta.3 publication; +no coordinated Agent Skills publication or supplied catalog SHA. Remote +catalog freshness was not established. The current catalog contains seventeen +skills, including the TypeScript owner added after the previous audit. Existing +README, release-handoff and untracked edits are outside the implementation. +The previous report and source revisions exist in local Git history. + +The official remote's tag and branch hashes were checked with `git ls-remote`. +The source checkout has unrelated local work; analysis uses an exact tag export. +The tag resolves to the documentation correction following the beta.3 version +commit. The later branch change is CI-only and is not attributed to beta.3. +No separate approved docs-gap report was supplied. The GitHub Release endpoint +for the Meteor tag returned 404; the tag and canonical changelog are the release +evidence, not a GitHub Release body. + +This is cumulative Meteor 3.6 guidance verified through beta.3. A beta.3 +verification label is not a claim that every fix first appeared in beta.3. +The beta.2 tag is on a sibling publication history; its exact package set and +installed artifacts are not independently certified here. Retain known older +version branches and simplify the active 3.6 guidance after the official tag +is audited. Do not create a separate skill per beta. + +## Source coverage + +Paths below refer to the exact Meteor revision above unless noted. Source +review of regression tests is not an executed test result. + +| Evidence | Documentation, implementation and tests | +|---|---| +| E01 | `v3-docs/docs/generators/changelog/versions/3.6.0.md`; complete beta.1-to-beta.3 path and commit diff under `v3-docs`, `packages`, `tools`, `npm-packages`, release scripts and the `meteor` launcher. | +| E02 | `v3-docs/docs/about/install.md`, `docs/cli/index.md`, `docs/troubleshooting/windows.md`; `scripts/build-dev-bundle-common.sh`, `scripts/generate-dev-bundle.sh`, launcher bundle `26.8.2.1`. MongoDB 8.0.29, Linux/Windows requirements and pre-upgrade FCV instructions. [PR 14663](https://github.com/meteor/meteor/pull/14663). | +| E03 | `docs/about/modern-build-stack/rspack-bundler-integration.md`; `packages/rspack/lib/constants.js`, `npm-packages/meteor-rspack/package.json`, scaffold manifests. Core/CLI 2.2.7, dev server 2.2.1, Meteor integration 3.0.0-beta.3, SWC 1.16.2 and refresh dependency changes. | +| E04 | Rspack guide architecture section; `packages/rspack/lib/{architectures,config,processes,build-context}.js`, `tools/isobuild/package-source.js`, `npm-packages/meteor-rspack/{rspack.config.js,index.d.ts}`; `tools/e2e-tests/{legacy.test.js,regressions/architecture-entrypoints.test.js}`, `tools/tests/app-config.js`. [PR 14756](https://github.com/meteor/meteor/pull/14756). | +| E05 | `docs/cli/environment-variables.md`; `npm-packages/meteor-rspack/lib/{ignore,test}.js` and matching tests; `packages/tools-core/lib/meteor.js`, `tools/fs/optimistic.ts`, source-scan invalidation in `package-source.js`; `tools/e2e-tests/regressions/{root-ignore,meteorignore-negation}.test.js`. [PR 14800](https://github.com/meteor/meteor/pull/14800), [PR 14799](https://github.com/meteor/meteor/pull/14799). | +| E06 | `docs/performance/change-streams-observer-driver.md`; `packages/mongo/mongo_connection.js` eligibility, `collection/methods_replication.js`; `tests/{changestream_observe_driver_tests,replication_fields_tests,replication_pubsub_tests}.js`. [PR 14733](https://github.com/meteor/meteor/pull/14733), [PR 14766](https://github.com/meteor/meteor/pull/14766). | +| E07 | `docs/cli/using-core-types.md`; `tools/isobuild/types-generator.js` and compile-backed tests for relative imports, ambient shims and submodules; native DDP/client/common/Meteor/Minimongo declarations and `*.test-d.ts`. [PR 14779](https://github.com/meteor/meteor/pull/14779), [PR 14782](https://github.com/meteor/meteor/pull/14782). | +| E08 | `packages/dynamic-import/cache.js` and unit/E2E cache recovery tests; `packages/inter-process-messaging/inter-process-messaging.js`, `tools/runners/run-app.js`, rapid-server-restarts E2E; `packages/boilerplate-generator` URL-prefix template and tests; `packages/instrumentation/{emitter,preview,instrumentation_tests}.js`. [PR 14780](https://github.com/meteor/meteor/pull/14780), [PR 14775](https://github.com/meteor/meteor/pull/14775), [PR 14719](https://github.com/meteor/meteor/pull/14719), [PR 14778](https://github.com/meteor/meteor/pull/14778). | +| E09 | `packages/oauth/{oauth_browser,end_of_popup_response,oauth_browser_tests}.js`; `accounts-base/accounts_server.js` and tests for failure hooks/domain checks. [PR 14666](https://github.com/meteor/meteor/pull/14666), [PR 14620](https://github.com/meteor/meteor/pull/14620), [PR 14185](https://github.com/meteor/meteor/pull/14185). | +| E10 | `packages/fetch/package.js` uses `modern`/`legacy` architecture mapping; `tools/tests/fetch.js`. [PR 14781](https://github.com/meteor/meteor/pull/14781). | +| E11 | `tools/isobuild/{builder,bundler}.js`; `tools/tests/builder-workspace-links.js`, `tools/e2e-tests/workspace-bin-portability.test.js` test relocated workspace commands and adjacent resources. [PR 14765](https://github.com/meteor/meteor/pull/14765). | + +## Summary + +Counts describe actionable groups, not individual files or all release fixes. + +| Classification | Count | +|---|---:| +| Outdated | 1 | +| Partial | 9 | +| Overlap | 0 | +| Candidate | 0 | +| Uncertain actionable findings | 0 | + +## Release blockers + +F01 is P1: update instructions must prepare valuable local MongoDB data before +starting MongoDB 8. F02 must correct the active dependency recipe before the +catalog claims beta.3 coverage. No catalog publication is requested. + +## Maintenance findings + +| Finding | Classification / priority | Owner and user impact | Evidence | Existing acceptance | Required action and acceptance | +|---|---|---|---|---|---| +| F01 | Partial / P1 | CLI installation, Meteor migration and Rspack upgrade omit local database preparation and new host requirements. Deployment needs the local/external database distinction. | E02 | CLI release/reset cases; migration runtime case 33; Rspack 36; deployment 17-18 | Add backup, MongoDB version/FCV check under the old release, FCV 7.0 before MongoDB 8, unsupported-host decisions and non-destructive reset boundary. Test valuable local data, external database and older host near misses. | +| F02 | Outdated / P2 | Modern build and Rspack migration still give beta.1's dependency set as the current target. Runtime tables stop at beta.1. | E03 | Modern 22/31; Rspack 23/27/28/36 | Use beta.3 pairing and exact tagged minimums while retaining older rows, manager ownership and opt-out. Update Node 26 coverage through beta.3 without inventing stable pins. | +| F03 | Partial / P2 | Build and migration describe legacy delivery but lack separate architecture entry graphs and config flags; testing documents only client/server entries. | E04 | Modern 9/20; Rspack 19 and validation matrix; testing entrypoint cases | Add one reusable architecture reference with alias precedence, `false`, shared config, ES5/npm/polyfill boundary, watch versus HMR and actual legacy program testing. Test beta.3 and pre-capability targets. | +| F04 | Partial / P2 | Ignore guidance lacks Rspack test negation/order, generated root scoping and environment separation; zero-test runs can look successful. | E05 | Modern 8/20; Rspack 11/18/19; testing focused runs | Explain last-match-wins, included parents, user versus generated exclusions and live rule changes. Require expected test names/counts; avoid hiding handoff directories or configuring private environment variables. | +| F05 | Partial / P2 | Mongo eligibility misses `$where`/`$near` fallback; pubsub misses fieldless replication distinct from pending-stub duplicate adds. | E06 | Mongo 5/7/9; pubsub 3/4/8/9 | Preserve query semantics, verify fallback and updates; distinguish missing fields from explicit clears and retain application-owned cleanup. Cover older versions separately. | +| F06 | Partial / P2 | TypeScript's existing provider workflow lacks the fixed native declaration layout and subscription handle distinction. | E07 | TypeScript provider/resolution cases | Regenerate with fixed tool/packages, preserve provider opt-in, validate relative imports and real versus structural handles. Do not patch generated files, add `any`, or expose private Minimongo helpers as public app APIs. | +| F07 | Partial / P2 | Debugging lacks narrow cache, IPC and URL-prefix signatures; instrumentation isolation/preview claims need the hardening boundary. | E08 | Debugging build/browser/instrumentation cases 31-36 | Add symptom-to-evidence decisions, earlier-version limits and no blanket cache deletion or error swallowing. Test dynamic import versus Rspack chunks, rapid restarts, prefixed dev scripts and reporter failures. | +| F08 | Partial / P2 | Accounts popup/domain/failure-hook guidance lacks version-specific fixes. | E09 | Accounts 2/7 and OAuth reference | Verify packages and reproduction; retain origin restrictions, absent-user handling and application authorization. Test nested/cross-origin popup failures and multi-service domains. | +| F09 | Partial / P2 | Native startup decision table lacks the modern Cordova `fetch` registration fix. | E10 | Native version-specific failures | Check resolved `fetch` and modern/legacy mapping before polyfills; test modern fixed and constrained legacy branches. | +| F10 | Partial / P2 | Workspace/build guidance calls for extracted-bundle tests without a relocated command/resource check. | E11 | Modern workspace cases; deployment artifact checks | Verify linked `.bin` commands after moving the bundle outside the checkout, without source access. Preserve lockfile ownership and avoid generated-link patches. | + +## Skill claim matrix + +All seventeen descriptions, classifications and relevant case inventories were +reviewed. Rows cover claims affected by this incremental diff, including +unchanged boundaries; this is not a new full-catalog or third-party API audit. + +| Skill | Distributable claims / sections | Evidence and status | Acceptance handoff | +|---|---|---|---| +| `meteor-cli-installation` | Body preflight/release choice; installation and reset references | E02, F01 partial | Local-data and host-boundary cases | +| `migrate-to-meteor-3` | Recommended strategy; other breaking changes runtime table; types handoff | E02/E03/E07, F01/F02 partial; provider ownership remains correct | Pre-update database checkpoint; prior async/type cases retained | +| `meteor-modern-build-stack` | Pairing, ignores, legacy production; Rspack config and workspace references | E03-E05/E11, F02-F04/F10 | New pairing, legacy graph, ignore and moved-artifact cases | +| `migrate-to-rspack` | Pairing, entries, preserved build contexts; upgrade and validation references | E02-E05/E11, F01-F04/F10 | Upgrade preparation, legacy and test-count cases | +| `meteor-testing` | Focused runs and Mocha/CI runtime table | E03-E05, F02-F04 | Test selection and architecture near miss | +| `meteor-deployment` | Runtime mapping, external database, Docker and bundle acceptance | E02/E03/E11, F01/F02/F10 | External Mongo and moved workspace command | +| `meteor-mongo-minimongo` | Body driver eligibility and fallback | E06, F05 | `$where`/`$near`, unsupported projections, earlier release | +| `meteor-pubsub` | Publication strategy reference, duplicate adds and retention | E06, F05 | Fieldless no-op versus explicit removal | +| `meteor-typescript` | Provider choice, adapters/barrel and native error diagnosis | E07, F06 | Relative declaration tree and structural subscription handles | +| `meteor-debugging` | Build, data, browser and instrumentation references | E06-E08, F05/F07 | Specific signature and near-miss prompts | +| `meteor-accounts` | OAuth reference, signup domain and login hooks | E09, F08 | Version-aware popup and account hooks | +| `meteor-native` | Toolchain startup failures and modern/legacy mapping | E10, F09 | Fixed fetch versus older/legacy branch | +| `meteor-react` | Rspack pairing handoff, reactive subscriptions and checker ownership | E03/E07, covered through existing build/types owners | Existing compiler/provider boundaries retained | +| `meteor-blaze` | Modern versus Meteor HMR and PWA scaffold | E04/E08, covered; separate legacy graph belongs to build owner | Existing UI/HMR cases retained | +| `meteor-methods` | Async handlers, stubs and guards | E06/E07, covered; declaration changes do not alter method runtime | Existing behavior retained | +| `meteor-security` | Accounts hardening and instrumentation is not authorization | E08/E09, covered through domain owners | Existing authorization and cookie cases retained | +| `meteor-community-packages` | Package-version checks and core handoffs | E07/E09, covered; no new package adoption workflow | Existing cases retained | + +## Evaluation gaps and source discrepancies + +Add minimal supported-target and earlier-version cases for F01-F10. Keep beta.1 +cases that protect real compatibility boundaries. Run affected prompts in +fresh conversations with expected answers hidden. Independent contributor +review of high-risk guidance remains a repository requirement before a PR. + +The public Rspack guide's refresh example lags the tag: constants select refresh +plugin 2.0.2 and runtime 0.19.0, plus `swc-loader` 0.2.7. Use those constants. +The guide says the manual npm transition includes `--legacy-peer-deps`; tagged +`tools-core` still renders manual commands without that option. Preserve the +existing conditional old-peer advice instead of copying the prose claim. +Docs describe the release as 3.6; this audit certifies the beta.3 tag only. + +## No-action findings + +- Contributor testing skills, browser-bootstrap recovery, ephemeral CI ports, + release mechanics and the post-tag SWC cache change do not belong in app skills. +- The full scaffold's 404 fix needs no independent skill recipe; existing + scaffold selection remains valid. Shell-completion fixes remain a CLI + convenience without a confirmed gap in installation/repair outcomes. +- UNIX socket loading is an internal webapp import correction; no changed + public configuration workflow was found. +- Existing beta.1 Accounts cookie/passwordless protections, Node migration, + native provider opt-in, uWS negotiation and pending-stub reconciliation remain + relevant. Do not replace them with unrelated beta.3 fixes. +- Stable classifications, bundles, names and routing owners remain appropriate. + No new skill candidate meets the threshold. + +## Recommended next actions + +1. Implement F01 before the active beta.3 upgrade commands. +2. Correct F02 and add F03/F04 with targeted acceptance. +3. Implement F05-F10 in their existing references, keeping source and version + boundaries visible at selection points. +4. Regenerate the catalog, run validation/links/tests, inspect ZIPs and record + actual behavior checks separately from this immutable pre-edit evidence. + +## Maintenance handoff + +The user requested confirmed gap fixes after release-3.6 deployed beta.3 and +explicitly wants the beta work kept within Meteor 3.6 as a whole. F01-F10 are +authorized within existing skills. Preserve classification and earlier-release +branches. Keep beta-specific evidence here and one cumulative maintenance +handoff; when stable 3.6 ships, audit its exact tag, replace active beta commands +and consolidate transient package rows without rewriting these audit records. + +No new skill, uncertain change, plugin version bump, PR, push, tag, merge or +publication is inferred. Preserve existing local edits. Load +`skill-maintenance` after saving this report, then implement and verify. diff --git a/docs/maintenance/2026-09-29-meteor-3.6-beta.3.md b/docs/maintenance/2026-09-29-meteor-3.6-beta.3.md new file mode 100644 index 0000000..98c7cf0 --- /dev/null +++ b/docs/maintenance/2026-09-29-meteor-3.6-beta.3.md @@ -0,0 +1,172 @@ +# Meteor 3.6 skill maintenance through beta.3 + +Implementation of [F01-F10 in the pre-edit audit](../../audits/skill-gaps/2026-09-29-meteor-3.6-beta.3.md). +The audit records the source baseline; this review records the resulting +guidance, verification and stable-release handoff. This continues the +[beta.1 maintenance](2026-09-23-meteor-3.6-beta.1.md) within the same Meteor 3.6 +work. It does not introduce a separate beta skill. + +## Revisions and scope + +| Input | Revision | +|---|---| +| Agent-skills before edits | `06adc1103e6cf8666abeab1e8d5cb8c356a97deb` | +| Previous Meteor audit | Beta.1, `82ea8df295134e64f495338a2e63362408098a24` | +| Official Meteor remote | `https://github.com/meteor/meteor.git` | +| Verified beta.3 tag | `release/METEOR@3.6-beta.3`, `65b995360f8445a7e4c098eca02b83966dda141f` | +| Observed `release-3.6` head | `7702f230757e9b29efa743d4a01053c4125429bf`; post-tag CI cache change excluded | + +Twelve existing skills changed. Names, descriptions, kinds, areas, bundles, +Meteor ranges and taglines remain unchanged. Earlier-release branches remain +available. No plugin version, installation metadata or dependency lockfile +changed. Existing README, release-note and untracked user work was preserved. + +The requested editorial pass removed 41 lines (about 3 KB) of repeated +pairing history, verification steps and diagnostic wording. Existing version +tables and validation references retain those decisions. Database preparation +remains executable within each affected migration skill; no new dependency +on installing another skill was introduced. + +Claims are verified against beta.3, not inferred from future stable 3.6 or +unreleased branch changes. Beta.2 is a sibling tag in the reviewed history; +the new guidance does not certify its complete behavior or claim every fix +first appeared in beta.3. + +| Finding | Implemented guidance | New acceptance cases | +|---|---|---| +| F01 | Back up and verify recovery; inspect Mongo version/FCV under the previous release; prepare MongoDB 7 FCV 7.0 before MongoDB 8; preserve data and distinguish host/external database requirements. | CLI 20-22; Meteor migration 37; Rspack migration 37; deployment 20 | +| F02 | Current beta.3 Atmosphere/npm pairing and dependency minimums; earlier beta rows; Node 26.8.2/npm 11.19.0 through beta.3; manager and immutable lockfile ownership. | Modern build 33; Rspack migration 37; deployment 20 | +| F03 | Separate architecture entries, exact-key precedence, `false`, shared config, build callback flags, legacy npm transforms and actual program/engine verification. | Modern build 34-35; Rspack migration 38; testing 22 | +| F04 | Ordered ignore negation, parent inclusion, user/generated rule separation, root scoping, watch invalidation and expected test names/counts. | Modern build 36; testing 21 | +| F05 | Preserve selector/projection semantics with polling fallback; distinguish fieldless replication from pending-stub reconciliation and explicit DDP clears. | Mongo 10-11; pubsub 10 | +| F06 | Native declaration tree/ambient location recovery; real handles with IDs versus structural handles; explicit generation and existing provider preservation. | TypeScript 14-15 | +| F07 | Narrow dynamic-import cache, IPC restart and prefixed dev-script diagnoses; reporter rejection containment and bounded previews without automatic secret redaction. | Debugging 38-40 | +| F08 | Package-gated OAuth popup completion, awaited failure-hook users and service-domain matching with authoritative nonempty `user.emails`. | Accounts 22-23 | +| F09 | Modern Cordova `fetch` registration; preserve legacy mapping and actual WebView compatibility checks. | Native 28 | +| F10 | Move extracted bundles outside the checkout and verify workspace commands and adjacent resources without source access. | Deployment 19; modern build and Rspack validation references | + +## Additional implementation evidence + +- Tagged Rspack constants supply the dependency minimums. The guide's older + React Refresh examples are not the beta.3 dependency contract. The manual + npm transition still needs the existing conditional old-peer guidance; + tagged `tools-core` does not print the flag claimed by the guide. +- The existing bundler optimization reference recommended deleting + `.meteor/local` for a rebuild. That directory also holds local data, so F01 + replaces this with the existing data-preserving reset boundary. +- MongoDB 8 requires a MongoDB 7 server at FCV 7.0 before upgrade, but keeping + that FCV does not promise a supported binary downgrade. The + [official MongoDB 8 upgrade guidance](https://www.mongodb.com/docs/v8.0/release-notes/8.0-upgrade-replica-set/) + requires support assistance for binary downgrades. Recovery guidance uses + a verified pre-upgrade backup. Shell presence checks avoid printing + connection credentials. +- DDP field removal is wire `cleared: ["field"]`, parsed into an undefined + field value. An explicit null sets a value; absent `fields` does not erase + retained data. Tagged `ddp-common` parsing and Mongo replication code support + this distinction. +- A MongoDB-supported projection that Minimongo cannot compile is a driver + eligibility boundary. Verify fallback before proposing a broader schema or + publication rewrite. + +## Repository verification + +The pinned pnpm was run through a temporary Corepack shim outside the +repository because the host Volta pnpm shim did not resolve. No dependency +update was required. + +| Check | Result | +|---|---| +| Frozen dependency install | Pass | +| `pnpm run validate` | Pass, skill and plugin validation | +| `pnpm run check-links` | Pass | +| `pnpm run catalog:write` and `catalog:check` | Pass, generated catalog unchanged | +| `pnpm test` | Pass, 33 tests in 5 files | +| `pnpm run build:zips` | Pass, all 17 archives built | +| Archive inspection | Pass, 115 files across 17 archives match source paths and bytes; no maintainer skills, audits, reviews or temporary artifacts | +| Frontmatter comparison | Pass, only `docs_synced_at` changed | +| `git diff --check` | Pass | + +An isolated check with the installed `ignore` implementation confirmed that +the ordered file exceptions select direct `imports/accounts/*.tests.js` +without selecting nested or unrelated test files. This checks pattern +semantics, not full Rspack discovery integration. + +## Fresh conversation evaluation + +Claude Code 2.1.252 ran each prompt in a fresh, nonpersistent conversation with +tools, slash commands, configured MCP servers, hooks and settings sources +disabled. Supplied context contained the skill and relevant references; +acceptance criteria were hidden. Returned usage reported +`claude-opus-5[1m]`, with CLI auxiliary Haiku usage. These are read-only +guidance checks, not tool-enabled app implementation trials. + +| Skill | New cases | Existing regression cases | Final outcome | +|---|---|---|---| +| `meteor-cli-installation` | 20-22 | None | Pass | +| `meteor-modern-build-stack` | 33-36 | 22, 27, 31 | Pass | +| `migrate-to-rspack` | 37-38 | 27 | Pass | +| `meteor-testing` | 21-22 | None | Pass | +| `meteor-mongo-minimongo` | 10-11 | None | Pass | +| `meteor-pubsub` | 10 | None | Pass | +| `meteor-typescript` | 14-15 | None | Pass | +| `meteor-debugging` | 38-40 | None | Pass | +| `meteor-accounts` | 22-23 | None | Pass | +| `meteor-native` | 28 | None | Pass | +| `meteor-deployment` | 19-20 | None | Pass | +| `migrate-to-meteor-3` | 37 | None | Pass | + +All 25 new prompts and four existing version-boundary prompts passed their +final acceptance review. The existing prompts confirm that an explicit +beta.0/beta.1 request keeps its pairing and scaffold target after active +examples move to beta.3. Descriptions did not change, so no new routing +selection claim is made. + +After the editorial pass, eight focused prompts were rerun in fresh +conversations and passed: CLI 20, modern build 31/33, Rspack migration 37/38, +debugging 38, deployment 19 and Meteor migration 37. Repository validation, +links, catalog checks, all 33 tests and all 17 archive inspections also passed +again on the shortened guidance. + +Initial runs exposed details that were corrected and rerun: + +| Case | Initial result and correction | +|---|---| +| CLI 20 | Failed by implying an FCV-based binary downgrade and emitting connection values. After narrowing downgrade guidance, another run still generated a leaking shell expansion. Added an exact value-free presence check; final run passed. That run also used an explicit generic assistant system prompt to avoid importing the evaluator host into the user's scenario. | +| Pubsub 10 | Failed by describing null as field removal. Added wire `cleared` versus undefined/null semantics and a corresponding failure criterion; rerun passed. | +| Mongo 10 | Fallback explanation passed, but the answer unnecessarily proposed publication/schema changes for incompatible projections. Tightened fallback-first guidance; rerun retained the query without requiring those changes. | + +Temporary projects, prompts, transcripts and raw outputs stay outside the +repository. Outcomes cover the stated acceptance boundaries, not every +unsolicited sentence in a generated answer. + +## Remaining review and stable 3.6 handoff + +The repository contract requires an outside contributor to run affected +high-risk cases in Claude Code or Cursor before a PR. That independent +review is pending; these agent-run conversations do not satisfy it. The user +authorized a focused commit and push to `skills/meteor-3.6-beta.3` after the +editorial pass. No PR, tag or catalog publication is part of this handoff. + +Meteor implementation and upstream regression tests were inspected, but the +full upstream suites were not run. No retained database was upgraded, no +real old-browser or Cordova device run was performed, and no live OAuth or +production deployment was exercised here. Those environment checks remain +part of the application workflows documented by the skills. + +When official 3.6 ships: + +1. Audit its exact tag incrementally from this record, including any changed + runtime, MongoDB, Atmosphere and npm integration versions. +2. Replace active beta commands and pins with verified stable 3.6 values. + Consolidate transient beta package rows into the stable path; retain + earlier-release fallbacks and any beta distinction still needed for a + supported diagnostic. +3. Keep native declarations, Rspack adoption and other optional migrations + explicit. A stable release must not imply an unrelated provider, bundler, + database or package-manager switch. +4. Update affected acceptance prompts to stable 3.6 and retain the smallest + meaningful earlier-version near misses. Rerun high-risk cases and the + repository/archive checks. +5. Preserve this audit and review as historical evidence. Select the catalog + release version and publish through `release-publishing` only within a + separately requested release scope. diff --git a/skills/meteor-accounts/SKILL.md b/skills/meteor-accounts/SKILL.md index 26eadcf..ba65854 100644 --- a/skills/meteor-accounts/SKILL.md +++ b/skills/meteor-accounts/SKILL.md @@ -17,7 +17,7 @@ metadata: area: auth tagline: "Wire up authentication in Meteor 3 (accounts-password, OAuth providers, 2FA, passwordless, email verification)." bundle: ["fullstack"] - docs_synced_at: "2026-09-23" + docs_synced_at: "2026-09-29" license: MIT --- diff --git a/skills/meteor-accounts/references/eval-cases.md b/skills/meteor-accounts/references/eval-cases.md index f46de65..7053702 100644 --- a/skills/meteor-accounts/references/eval-cases.md +++ b/skills/meteor-accounts/references/eval-cases.md @@ -194,3 +194,19 @@ this from the shared per-address HTTP cookie endpoint limit and from additional application rules that could impose a broader quota. Fail if it promises rolling per-request replenishment instead of the rule's interval reset. + +## Case 22: Nested OAuth completion + +Prompt: "A beta.1 Meteor OAuth login opens a second login popup and reuses the first window. A cross-origin opener can also throw SecurityError. Does beta.3 help or should we relax CORS and trust any origin?" + +Pass if the agent checks oauth package, identifies unique popup name and caught opener fallback/close fixes, verifies login and callback origins, rejects permissive CORS and cross-origin shared-storage assumptions. + +Fail if it disables origin protection, promises every cross-origin flow now works, or changes unrelated cookie policy. + +## Case 23: Failure hooks and service domains + +Prompt: "After adopting beta.3, what should our login-failure hook expect in attempt.user? Also restrictCreationByEmailDomain rejects users depending on service order. What if user.emails is nonempty but invalid and one service email matches?" + +Pass if the agent uses resolved Accounts package, resolved user when found with absent-user/projection handling, preserves any valid service match when no user emails, retains nonempty user.emails precedence and policy. + +Fail if it logs full user records, treats domain acceptance as verified email, removes restrictions or lets a service rescue an invalid nonempty email list. diff --git a/skills/meteor-accounts/references/oauth-services.md b/skills/meteor-accounts/references/oauth-services.md index d4af7ed..e5ab332 100644 --- a/skills/meteor-accounts/references/oauth-services.md +++ b/skills/meteor-accounts/references/oauth-services.md @@ -57,6 +57,21 @@ Meteor.loginWithGoogle( `requestPermissions` is the OAuth scopes array. Optional per provider. +## Meteor 3.6 login diagnostics + +These fixes are verified on beta.3; beta.1 lacks them. Inspect resolved +packages and app-local overrides before changing application policy. + +| Signature | Package and verification | +|---|---| +| Nested OAuth popup reuses the first window, or cross-origin opener access aborts completion | `oauth@3.0.5-beta360.3` uses unique window names and catches opener access failure so the existing localStorage fallback/close path can run. Verify the full login on the intended origins. This does not make localStorage shared across origins, repair an incorrect callback URL or authorize permissive CORS. | +| Login-failure hook receives a Promise as `attempt.user` | `accounts-base@3.4.0-beta360.3` awaits the user lookup before hooks. Retain absent-user handling and field projections; do not log complete user records. On an earlier pinned package, verify a compatible fix rather than spreading Promise workarounds throughout hooks. | +| Allowed external-service email is rejected depending on service order | Beta.3 Accounts keeps a successful service-email match. A nonempty `user.emails` array remains authoritative; a valid service email does not rescue an invalid nonempty array. Test both accepted and rejected users without removing `restrictCreationByEmailDomain` or treating domain acceptance as email verification. | + +For earlier constrained releases, preserve policy and evaluate a compatible +package update/backport or an already-supported redirect flow for the popup +case. Do not force a beta upgrade or remove origin restrictions to hide it. + ## Encryption at rest Add `oauth-encryption` and pass a 16-byte base64 key: @@ -81,3 +96,4 @@ supported user token fields, such as `services.github.accessToken` or Twitter's --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/packages/service-configuration.md +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/generators/changelog/versions/3.6.0.md diff --git a/skills/meteor-cli-installation/SKILL.md b/skills/meteor-cli-installation/SKILL.md index a93ecca..e9a8c30 100644 --- a/skills/meteor-cli-installation/SKILL.md +++ b/skills/meteor-cli-installation/SKILL.md @@ -16,7 +16,7 @@ metadata: area: ops tagline: "Install, locate, repair, reset, or cleanly reinstall the Meteor 3 CLI with correct version and PATH handling." bundle: ["essentials", "migration", "fullstack", "ops", "blaze", "react"] - docs_synced_at: "2026-09-02" + docs_synced_at: "2026-09-29" license: MIT --- @@ -50,6 +50,10 @@ installer permanently to global npm packages. `.meteor/release`. Do not reinstall the user-wide CLI merely because a project uses another release. + Before selecting Meteor 3.6-beta.3 for existing local data, read + [local database preparation](references/local-database-upgrade.md). + Its bundled MongoDB 8 requires host checks and MongoDB 7 FCV preparation + under the previous release before the new release starts. 4. For a missing CLI, PATH failure, npm installer failure, or host prerequisite, follow [Installation and PATH](references/installation-and-path.md). 5. For a project release, cache reset, corrupted dev bundle, uninstall, or diff --git a/skills/meteor-cli-installation/references/eval-cases.md b/skills/meteor-cli-installation/references/eval-cases.md index b02bc81..7e0da2c 100644 --- a/skills/meteor-cli-installation/references/eval-cases.md +++ b/skills/meteor-cli-installation/references/eval-cases.md @@ -199,3 +199,27 @@ pruner, measures scope without deleting it, and offers a full reinstall only as a confirmation-required tradeoff that will redownload needed releases. Fail if it runs a hidden admin command or guesses which package directories are unused. + +## Case 20: Retained local data before 3.6 + +Prompt: "We want to update our Meteor 3.5.2 app to 3.6-beta.3. Its local MongoDB 7 has data we need to keep and FCV is 6.0. Give the ordered commands and checks before the first beta.3 run. Can reverting Meteor undo this?" + +Pass if the agent requires backup/recovery first, checks server version and FCV under the previous release, sets FCV 7.0 on the MongoDB 7 primary with confirm, verifies, stops the app before updating, and distinguishes fresh/external databases. Rejects release rollback as database rollback. + +Fail if it starts beta.3 before preparation, sets FCV using MongoDB 8, recommends deleting retained data, prints connection credentials, or promises FCV 7.0 makes a MongoDB 8 binary downgrade supported. + +## Case 21: Bundled database host boundary + +Prompt: "Beta.3 local Mongo fails on Linux x86_64 with glibc 2.31. A teammate has Windows 10. Would reinstalling Meteor or using our external MONGO_URL solve the requirements? We cannot upgrade either OS today." + +Pass if the agent identifies glibc 2.34+ x86_64, required OpenSSL 3/libcurl libraries and Windows 11/Server 2022 local DB requirements. Explains external DB avoids the bundled server but not Meteor/Node/provider requirements; preserves constraints. + +Fail if it blindly reinstalls, symlinks incompatible libraries, promises Windows 10 support for bundled MongoDB 8, or assumes external Mongo removes all runtime requirements. + +## Case 22: Earlier release database near miss + +Prompt: "Our app must stay on Meteor 3.5.2 with a fresh local database. Do the new 3.6 MongoDB 8 and FCV rules mean we must upgrade now?" + +Pass if the agent keeps the constrained release and its actual database requirements; distinguishes fresh data from retained data and future 3.6 preparation. + +Fail if it forces beta.3, runs FCV commands without identifying a matching server, or imposes the beta.3 bundled database on 3.5.2. diff --git a/skills/meteor-cli-installation/references/installation-and-path.md b/skills/meteor-cli-installation/references/installation-and-path.md index 0aae144..2261af8 100644 --- a/skills/meteor-cli-installation/references/installation-and-path.md +++ b/skills/meteor-cli-installation/references/installation-and-path.md @@ -18,6 +18,10 @@ latest installer. ## Install +For Meteor 3.6-beta.3's bundled MongoDB 8, also check +[local database platform requirements](local-database-upgrade.md#bundled-mongodb-host-requirements). +These are separate from host npm-installer and bundled Node requirements. + Use the official npm installer first: ```bash diff --git a/skills/meteor-cli-installation/references/local-database-upgrade.md b/skills/meteor-cli-installation/references/local-database-upgrade.md new file mode 100644 index 0000000..a2c0b51 --- /dev/null +++ b/skills/meteor-cli-installation/references/local-database-upgrade.md @@ -0,0 +1,77 @@ +# Local database preparation for Meteor 3.6 + +Meteor 3.6-beta.3 bundles MongoDB 8.0.29. Inspect the selected release and +actual database version before startup; earlier releases retain their own +database requirements. + +| Database state | Decision before `meteor update` or a release override | +|---|---| +| Existing local data to keep | Back up and verify recovery, then inspect the running server version and FCV under the previous Meteor release. Prepare MongoDB 7 before opening the data with MongoDB 8. | +| Fresh local database | No old FCV to migrate; check host requirements. | +| External `MONGO_URL` | Meteor does not upgrade that database. Its administrator/provider owns the upgrade and compatibility checks. | +| Disposable local data | Recreating it is an alternative only when deletion is explicitly authorized. `meteor reset --db` is not a preservation workflow. | + +## Prepare retained data + +Resolve `METEOR_LOCAL_DIR` and the connection target before backup; verify +recovery with a compatible server. Do not assume the host OS or Mongo port. +Check `MONGO_URL` presence without printing credentials: + +```bash +if [ -n "${MONGO_URL:-}" ]; then + printf 'MONGO_URL is set (value hidden)\n' +else + printf 'MONGO_URL is unset\n' +fi +``` + +Start the app with its previous release. With `mongosh` installed, open another +terminal in the app directory: + +```bash +meteor mongo +``` + +Inspect the local database, not an external production connection: + +```javascript +db.version() +db.adminCommand({ getParameter: 1, featureCompatibilityVersion: 1 }) +``` + +MongoDB 8 requires a MongoDB 7 database with FCV `"7.0"`. If the server is +older than 7, follow the required intermediate MongoDB major upgrades first. +If the server is 7 but FCV is older, after backup run on the local replica +set's primary and repeat the FCV check: + +```javascript +db.adminCommand({ setFeatureCompatibilityVersion: "7.0", confirm: true }) +``` + +Exit the shell and stop the app, then run `meteor update --release 3.6-beta.3` +to resolve the release and compatible packages. Do not start beta.3 before +preparation. Reverting Meteor is not a database rollback. Keeping FCV `7.0` +does not guarantee a supported MongoDB 8-to-7 binary downgrade; the +[MongoDB upgrade guidance](https://www.mongodb.com/docs/v8.0/release-notes/8.0-upgrade-replica-set/#downgrade-consideration) +requires support assistance. Use the verified pre-upgrade recovery plan. + +`meteor reset` preserves the database and cannot repair an incompatible FCV. +`meteor reset --db` deletes it. Keep the distinction when diagnosing startup. + +## Bundled MongoDB host requirements + +| Host for beta.3's local database | Requirement | +|---|---| +| Linux x86_64 | glibc 2.34+ | +| Linux ARM64 | glibc 2.35+ | +| Linux shared libraries | `libcurl.so.4`, `libssl.so.3`, `libcrypto.so.3` (OpenSSL 3) | +| Windows x64 | Windows 11 or Windows Server 2022; Windows 10/Server 2019 and earlier are unsupported for bundled MongoDB 8 | + +Do not diagnose these failures as a corrupt installation or replace system +libraries with symlinks to incompatible versions. Use a supported host, keep +an explicitly constrained earlier release, or use an appropriate external +database. `MONGO_URL` avoids launching bundled MongoDB; it does not waive +Meteor/Node runtime or provider requirements. + +--- +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/install.md diff --git a/skills/meteor-cli-installation/references/releases-reset-reinstall.md b/skills/meteor-cli-installation/references/releases-reset-reinstall.md index 25737a5..9f30a2f 100644 --- a/skills/meteor-cli-installation/references/releases-reset-reinstall.md +++ b/skills/meteor-cli-installation/references/releases-reset-reinstall.md @@ -13,6 +13,10 @@ meteor create --release Update an existing project and its pin: +Before selecting Meteor 3.6-beta.3 for a project with local data, complete +[MongoDB 7 to 8 preparation](local-database-upgrade.md) under the previous +release. The same precaution applies to an explicit `--release` run override. + ```bash meteor update --release ``` diff --git a/skills/meteor-debugging/SKILL.md b/skills/meteor-debugging/SKILL.md index 893772d..33dc72a 100644 --- a/skills/meteor-debugging/SKILL.md +++ b/skills/meteor-debugging/SKILL.md @@ -17,7 +17,7 @@ metadata: area: ops tagline: "Diagnose Meteor 3 failures across builds, server/client runtime, DDP, Mongo, tests, browsers, mobile, and production." bundle: ["essentials", "fullstack", "ops"] - docs_synced_at: "2026-09-23" + docs_synced_at: "2026-09-29" license: MIT --- @@ -74,7 +74,7 @@ can reject the current hypothesis. full user documents. - Treat `console.log` as temporary instrumentation. Use `meteor/logging` or the application's established structured logger for evidence that must persist. -- For server lifecycle evidence on Meteor 3.6-beta.1, use the optional +- For server lifecycle evidence on Meteor 3.6-beta.1 through beta.3, use the optional `instrumentation` package through [Logs and instrumentation](references/logs-and-instrumentation.md). Earlier releases retain targeted logs; listeners observe, not authorize. - Use `.only` only as temporary local test focus when the runner and execution diff --git a/skills/meteor-debugging/references/build-debugging.md b/skills/meteor-debugging/references/build-debugging.md index d61f890..b83d139 100644 --- a/skills/meteor-debugging/references/build-debugging.md +++ b/skills/meteor-debugging/references/build-debugging.md @@ -103,6 +103,21 @@ config; `meteor run` does not generate native declarations. Diagnose provider selection and compiler paths before resetting caches. For an upgrade, use `migrate-to-meteor-3`'s TypeScript reference. +The following additional 3.6 fixes are verified on beta.3; beta.1 lacks them: +For an upgrade comparison, use fresh disposable local data or complete the +retained-data preflight under the previous release before beta.3 starts. + +| Signature | Evidence and next decision | +|---|---| +| Tool crashes or hangs during rapid source edits while IPC refresh is pending | Capture restart order and `inter-process-messaging`/tool versions. Beta.3 tolerates shutdown races and does not block future restarts waiting for an old child. Verify rapid server edits, a later client refresh, normal startup and shutdown. Do not suppress every IPC exception or disable hot code push. | +| Rspack development script fails only under a `ROOT_URL` path prefix | Inspect the script URL, prefix and selected architecture. Beta.3's `boilerplate-generator@2.2.0-beta360.3` includes the prefix in the dev script URL. Preserve the intended prefix and test page load, rebuild and production chunks separately; the dev-script fix is not a generic production chunk fix. | +| Root `test/` directory or an ignore exception yields zero Rspack tests | Inspect user rules, actual entry graph and suite counts. Beta.3's paired tool/integration separates root-scoped generated excludes from user rules and refreshes source-scan rules. Use `meteor-testing` for selection; do not ignore `_build` or edit generated tests. | + +For local MongoDB startup immediately after a beta.3 upgrade, inspect server +version/FCV and host libraries before cache cleanup. Use +`meteor-cli-installation`'s database preparation reference; `meteor reset` +preserves the incompatible database and `--db` deletes it. + Atmosphere-package shrinkwraps are not application npm/pnpm/Yarn lockfiles. Preserve the app/workspace manager and lockfile ownership; use `meteor-modern-build-stack` for required Rspack dependency reconciliation. diff --git a/skills/meteor-debugging/references/ddp-and-data.md b/skills/meteor-debugging/references/ddp-and-data.md index 1153045..e1cbd39 100644 --- a/skills/meteor-debugging/references/ddp-and-data.md +++ b/skills/meteor-debugging/references/ddp-and-data.md @@ -68,6 +68,14 @@ capture message order before deciding either applies: ## Mongo and Minimongo inspection +On Meteor 3.6-beta.3, `mongo@2.5.2-beta360.3` separately fixes fieldless +replication. An ID-only repeated `added` can omit `fields`; earlier packages +may throw `Cannot convert undefined or null to object`. Capture that message +and distinguish it from beta.1's pending-stub duplicate-add fix. Use +`meteor-pubsub` for retained document ownership; missing fields preserve data, +while wire `cleared` removes fields; a null field value is not removal. +Do not clear shared Minimongo data. + Use the local shells for read-first evidence: ```bash diff --git a/skills/meteor-debugging/references/eval-cases.md b/skills/meteor-debugging/references/eval-cases.md index 3773c21..a3e2054 100644 --- a/skills/meteor-debugging/references/eval-cases.md +++ b/skills/meteor-debugging/references/eval-cases.md @@ -325,3 +325,27 @@ Prompt: "Our uWebSockets DDP connection repeatedly reconnects during version neg Pass if the agent: Checks selected transport and frame sequence, identifies ddp-server 3.4.1-beta360.1 graceful flush/close, and does not generalize to all proxy/session/application disconnects or immediately replace transport. Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 38: Closed dynamic import cache + +Prompt: "On beta.1 a lazy import fails with an IndexedDB transaction error after browser suspension. Another route has a Rspack chunk HTTP 404. Will beta.3 fix both, and should I erase all browser storage?" + +Pass if the agent separates Meteor dynamic-import closed cache recovery from Rspack HTTP failures; checks exact package/stack/network, tests closure and subsequent import, preserves application storage and offline limits. + +Fail if it deletes all storage, promises cache fix repairs missing chunks or treats offline network as a cache problem. + +## Case 39: Rapid restart and prefixed dev script + +Prompt: "Our beta.1 Rspack app hangs during rapid server rebuilds waiting on IPC, and a dev script URL loses our /app ROOT_URL prefix. Describe beta.3 checks without changing deployment URLs." + +Pass if the agent separates IPC/tool race and boilerplate dev-script fixes, captures resolved versions/order/URL, verifies rapid edits plus later client refresh, page/rebuild and production chunks separately. + +Fail if it suppresses every IPC error, disables HCP or removes the requested prefix as the fix. + +## Case 40: Instrumentation reporter and preview boundary + +Prompt: "On instrumentation 0.0.1-beta360.1, our async onListenerError rejects and custom error/array/date previews behave unexpectedly. What is safe to rely on in beta.3, and can previews export secrets automatically redacted?" + +Pass if the agent separates listener isolation from beta.3 reporter rejection containment and nested preview hardening, prefers metadata, retains older self-handled reporter failures, requires redaction and checks no unhandled rejection. + +Fail if it promises arbitrary accessor safety, automatic application-secret redaction or authorization/durable writes from listeners. diff --git a/skills/meteor-debugging/references/logs-and-instrumentation.md b/skills/meteor-debugging/references/logs-and-instrumentation.md index e9e28b7..a6347af 100644 --- a/skills/meteor-debugging/references/logs-and-instrumentation.md +++ b/skills/meteor-debugging/references/logs-and-instrumentation.md @@ -93,6 +93,12 @@ Do not enforce authorization, reject a method, or promise durable audit writes from a listener. Keep validation and access checks in the actual handler. The package supplies events, not an installed OpenTelemetry/APM backend. +For Meteor 3.6-beta.3's `instrumentation@0.0.1-beta360.3`, a rejected Promise +from `onListenerError` is also contained without recursively invoking the +reporter. Beta.1 isolates listeners but lacks that reporter hardening; use a +reporter that handles its own async failures on the older package. Verify the +observed operation completes and no unhandled rejection occurs. + Arguments, results and IP addresses are off by default. Prefer selected metadata. If a payload is necessary, project approved fields per method: @@ -110,6 +116,13 @@ does not protect a same-named publication. `captureMethodResult: "preview"` and `captureClientAddress: true` are separate opt-ins. Keep application credentials out of previews, error summaries and exported logs. +Beta.3 also bounds nested error properties, uses native Date operations and +avoids application array methods while previewing. Beta.1 lacks these +hardening fixes; do not generalize its bounds to arbitrary custom objects. +Even on beta.3, bounds are not secret redaction or a guarantee that arbitrary +application accessors have no effects. Prefer metadata and test the actual +payload shape before enabling capture. + Stop temporary handles during cleanup. `METEOR_INSTRUMENTATION_DISABLED=1` disables emission initially; `Instrumentation.configure({ enabled: false })` can disable it at runtime. Runtime configuration can override the environment diff --git a/skills/meteor-debugging/references/runtime-and-inspector.md b/skills/meteor-debugging/references/runtime-and-inspector.md index 749f869..c9c26ed 100644 --- a/skills/meteor-debugging/references/runtime-and-inspector.md +++ b/skills/meteor-debugging/references/runtime-and-inspector.md @@ -51,6 +51,18 @@ Do not infer one side from the other: Use the React or Blaze skill after evidence identifies the framework boundary. +## Dynamic import after browser suspension + +Meteor 3.6-beta.3's `dynamic-import@0.7.5-beta360.3` recovers from closed or +version-changed IndexedDB connections, treats failed transactions as cache +misses and contains failed cache writes. Beta.1 lacks this fix. + +Match the stack and module/network request before selecting a compatible fix. +Verify an import after suspension/cache closure and a subsequent import. +Rspack chunk 404s, offline fetches, service workers and app-owned IndexedDB +need separate diagnosis. Preserve site/app storage and global IndexedDB; +cache recovery cannot fetch a missing or offline module. + ## Shell and debug bundles `meteor shell` attaches a server REPL to a running local app. Inspect first; @@ -65,3 +77,4 @@ question. --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/cli/index.md +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/generators/changelog/versions/3.6.0.md diff --git a/skills/meteor-deployment/SKILL.md b/skills/meteor-deployment/SKILL.md index dae92cd..004ff09 100644 --- a/skills/meteor-deployment/SKILL.md +++ b/skills/meteor-deployment/SKILL.md @@ -18,7 +18,7 @@ metadata: area: ops tagline: "Ship Meteor 3 apps to production (meteor build, Galaxy, Docker/Kubernetes, settings.json, env vars, Node version matching)." bundle: ["ops"] - docs_synced_at: "2026-09-23" + docs_synced_at: "2026-09-29" license: MIT --- @@ -40,12 +40,12 @@ Match the Node version to the bundled Meteor Node: | 3.0 | 20 | | 3.1 through 3.4 | 22 | | 3.5.x and 3.6-beta.0 | 24 | -| 3.6-beta.1 | 26 (26.8.2) | +| 3.6-beta.1 through beta.3 | 26 (26.8.2) | Run `meteor node -v` and `meteor npm -v` in the target app to confirm. -Meteor 3.6-beta.1 bundles npm 11.19.0. Match the deployed runtime and native +Meteor 3.6-beta.1 through beta.3 bundle npm 11.19.0. Match the deployed runtime and native dependency build environment to that release; rebuild and test native npm -modules for Node 26 and the production architecture before deploying beta.1. +modules for Node 26 and the production architecture before deploying these betas. The host installer prerequisite does not select the bundled runtime. ## Decision flow @@ -61,6 +61,13 @@ The host installer prerequisite does not select the bundled runtime. 4. Vercel / Netlify / serverless? Not supported. Meteor needs a long-lived Node process with a WebSocket. +For linked workspace packages, move the bundle outside the checkout and test +used `.bin` commands and adjacent resource reads without source access. +3.6-beta.3 fixes copied command links; verify older tools before relying on +them. Preserve the manager/lockfile and do not patch generated links. +See [database boundaries](references/settings-and-env.md#mongo-connection-strings) +for beta.3's local MongoDB 8 versus an external database. + ## Required environment | Var | Purpose | diff --git a/skills/meteor-deployment/references/docker.md b/skills/meteor-deployment/references/docker.md index 1bb4242..4591fbb 100644 --- a/skills/meteor-deployment/references/docker.md +++ b/skills/meteor-deployment/references/docker.md @@ -37,7 +37,7 @@ CMD ["node", "main.js"] This sample targets Meteor 3.1 through 3.4. Match both `node:` tags to the bundled Node major: Meteor 3.0 uses Node 20, 3.1 through 3.4 use Node 22, -and 3.5.x / 3.6-beta.0 use Node 24. Meteor 3.6-beta.1 uses Node 26.8.2 +and 3.5.x / 3.6-beta.0 use Node 24. Meteor 3.6-beta.1 through beta.3 use Node 26.8.2 and npm 11.19.0. Match both images and native dependency builds to the exact target release; do not carry Node 24 native binaries into a Node 26 runtime. Run `meteor node -v` and `meteor npm -v` in the target app to verify. On diff --git a/skills/meteor-deployment/references/eval-cases.md b/skills/meteor-deployment/references/eval-cases.md index 73608b3..7eaaebe 100644 --- a/skills/meteor-deployment/references/eval-cases.md +++ b/skills/meteor-deployment/references/eval-cases.md @@ -191,3 +191,19 @@ Prompt: "Our app remains on Meteor 3.5.2, and another app is pinned to 3.6-beta. Pass if the agent: Retains Node 24 for both targets, checks exact bundled versions, and does not upgrade their runtimes solely because a later beta exists. Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 19: Relocated workspace command + +Prompt: "Our linked workspace package command works in development and in a bundle beside the checkout, but fails after moving the artifact to a clean deployment directory. What should we verify on beta.3?" + +Pass if the agent checks tool version and copied workspace/bin links, executes used commands and adjacent resource reads from the moved artifact without source access; keeps manager/lockfile and earlier-version boundary. + +Fail if it hand-patches generated links, uses absolute source paths, or claims server boot beside the checkout proves portability. + +## Case 20: External database and runtime + +Prompt: "Deploy a beta.3 app with a separately administered MongoDB 7 through MONGO_URL. Does local bundled MongoDB 8 mean Meteor upgrades it or that the app container needs local Mongo binaries? Which Node runtime applies?" + +Pass if the agent keeps database upgrade with provider/admin, separates local Mongo platform requirements, verifies Node 26.8.2/npm 11.19.0 and target native dependencies plus external compatibility. + +Fail if it runs a remote FCV upgrade by inference, bundles local Mongo unnecessarily or uses Node 24 for beta.3. diff --git a/skills/meteor-deployment/references/settings-and-env.md b/skills/meteor-deployment/references/settings-and-env.md index 3c2215a..d94b9bb 100644 --- a/skills/meteor-deployment/references/settings-and-env.md +++ b/skills/meteor-deployment/references/settings-and-env.md @@ -63,6 +63,13 @@ change streams without this variable, with oplog and polling as fallbacks. Choose from the actual Mongo topology and Meteor version; Atlas does not make core change streams available before Meteor 3.5. +Meteor 3.6-beta.3 bundles MongoDB 8 for local development. It neither upgrades +an external `MONGO_URL` database nor imposes that local database's glibc/Windows +requirements on a backend that never launches it. Verify the deployed Node +runtime and the database provider's supported server/topology separately. +Local retained data needs MongoDB 7 FCV preparation before beta.3 startup; +use `meteor-cli-installation` for that workflow. + ## Secrets Do not commit production secrets to `settings.json`. Build the file at @@ -81,3 +88,4 @@ Or pass values as separate env vars and read them with --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/cli/environment-variables.md +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/install.md diff --git a/skills/meteor-modern-build-stack/SKILL.md b/skills/meteor-modern-build-stack/SKILL.md index 8525b93..e79b346 100644 --- a/skills/meteor-modern-build-stack/SKILL.md +++ b/skills/meteor-modern-build-stack/SKILL.md @@ -23,7 +23,7 @@ metadata: area: build tagline: "Configure the Meteor 3 modern build stack (SWC transpiler/minifier, `@parcel/watcher`, web-arch skipping, Rspack integration)." bundle: ["essentials"] - docs_synced_at: "2026-09-23" + docs_synced_at: "2026-09-29" license: MIT --- @@ -38,7 +38,7 @@ The modern build stack is two independent tracks. Enable either or both. delegates app-code compilation to Rspack. Tree shaking, ESM, code splitting via HTTP, modern bundler plugins. -Standard current `meteor create` application skeletons ship both enabled. +Current `meteor create` application skeletons ship both enabled. Purposefully small or compatibility-oriented skeletons, including `minimal` and `legacy`, may omit Rspack or the modern flag. Inspect the generated `package.json` and `.meteor/packages` instead of inferring features only from @@ -100,14 +100,9 @@ moves to Rspack; Meteor still handles Atmosphere packages and produces the final bundle. Requires entry points in `package.json` and no nested imports in app code. To migrate an existing app, use the `migrate-to-rspack` skill. -Inspect `.meteor/versions`, `package.json`, and the lockfile. Meteor -3.6-beta.1 pairs `rspack@1.4.0-beta360.1`, `@meteorjs/rspack@3.0.0-beta.2` -and Rspack 2.2.0. Beta.0 retains 1.4.0-beta360.0/3.0.0-beta.1; 3.5.2 -retains the 1.3.0/2.2.0 integration pairing. -See [pairings](references/rspack-config.md) and -[dependencies/workspaces](references/meteor-3.6-workspaces.md). -For migration, use `migrate-to-rspack`. - +Inspect `.meteor/versions`, `package.json`, and the lockfile. For 3.6-beta.3 +and earlier targets, use the [release pairing](references/rspack-config.md) +and [dependency minimums](references/meteor-3.6-workspaces.md). Rspack transpiles TypeScript. Use `meteor-typescript` for declarations and checking; see [checker boundaries](references/rspack-config.md#typescript-declarations). @@ -171,6 +166,9 @@ scripts/ For per-command rules, set the `METEOR_IGNORE` env var. +On the 3.6-beta.3 pairing, read the [test-ignore boundaries](references/meteor-3.6-workspaces.md#test-selection-and-generated-ignores) +for ordered user exceptions, included parents and separate generated rules. + Do not copy `.gitignore` into `.meteorignore` blindly. Exclude unrelated large trees that Meteor does not need, but never match the active Rspack build context: Meteor consumes its generated main and test modules during final assembly. @@ -192,6 +190,10 @@ production output, source maps, build time, and runtime behavior. ## Production legacy builds +For separate `mainModule.legacy` or exact architecture entries on 3.6-beta.3, +read [architecture entry points](references/architecture-entrypoints.md). +Earlier integrations retain their shared-client behavior. + Dev skips `web.browser.legacy` and `web.cordova` with `"modern": true`. Production still ships legacy by default. To drop legacy in production too, add `modern` to `.meteor/platforms`: @@ -204,19 +206,8 @@ modern ## Memory limits -Rspack runs as a child process and may OOM on large apps. Raise the heap -for tool processes temporarily when capturing evidence (Meteor 3.4.1+): - -```bash -TOOL_NODE_FLAGS="--max-old-space-size=16384" meteor run -``` - -On Meteor 3.4.0, use `NODE_OPTIONS="--max-old-space-size=16384"`. - -First distinguish a one-shot build failure from growth during a long watch -session. Audit large directories visible to Meteor and check the exact release -for fixes. Test heap size and persistent cache as separate variables; revert a -change that does not improve the failure or a measured memory trend. +For tool-process OOM or growing watch memory, use the version-specific +[heap and cache checks](references/rspack-config.md#memory-limits). ## Multiple instances diff --git a/skills/meteor-modern-build-stack/references/architecture-entrypoints.md b/skills/meteor-modern-build-stack/references/architecture-entrypoints.md new file mode 100644 index 0000000..ade65a4 --- /dev/null +++ b/skills/meteor-modern-build-stack/references/architecture-entrypoints.md @@ -0,0 +1,85 @@ +# Architecture-specific Rspack entries + +Meteor 3.6, verified on beta.3 with `rspack@1.4.0-beta360.3` and +`@meteorjs/rspack@3.0.0-beta.3`, compiles explicit client architectures through +Rspack separately. Beta.0/beta.1 and earlier integrations do not provide this +complete flow; preserve their shared client behavior or use a compatible +paired upgrade. Keep deliberate version constraints. + +## Select entries + +Merge into the app's existing configuration: + +```json +{ + "meteor": { + "mainModule": { + "client": "client/main.js", + "legacy": "client/legacy.js", + "server": "server/main.js" + }, + "modern": { "webArchOnly": false } + } +} +``` + +| Entry decision | Effect | +|---|---| +| Only `client` | Existing shared client graph; no separate legacy compilation. | +| Explicit `legacy` | Separate `web.browser.legacy` graph even if its filename equals `client`. Can render an unsupported-browser message or a compatible app. | +| Explicit `web.browser`, `web.browser.legacy`, `web.cordova` | Select the exact architecture; the most specific matching key overrides a broader `client` entry. | +| `modern` / `legacy` shorthands | Follow Meteor architecture mapping. With `meteor.modern.cordova: false`, `legacy` also covers Cordova. Use exact keys when that distinction matters. | +| Entry value `false` | Disables that architecture's app entry, not Meteor package code or the browser program itself. | + +Import shared modules intentionally; a small legacy notice should not import +the modern bootstrap. Keep native binary/HCP decisions with `meteor-native`. + +## Configure the compilation + +All entries use the existing `rspack.config.*`, aliases, loaders and plugins. +`defineConfig` supplies `Meteor.arch` for an explicit architecture and +`Meteor.isLegacy` for its legacy mapping. Default client/server compilations +have no explicit `arch`. These are callback flags, not runtime Meteor APIs. + +```javascript +const { defineConfig } = require('@meteorjs/rspack'); + +module.exports = defineConfig(Meteor => Meteor.isLegacy + ? Meteor.compileWithRspack([/node_modules/]) + : {}); +``` + +Use this broad dependency rule only when the legacy graph needs it; narrower +dependency rules can reduce work. The helper inherits that compilation's SWC +options. The default legacy app transform and generated Rspack runtime target +ES5, including dynamic chunks. npm dependencies are excluded from the default +app rule. `meteor.nodeModules.recompile` governs Meteor-compiled dependencies, +not dependencies bundled by Rspack. Custom SWC/compiler settings can override +the legacy defaults. + +ES5 output does not supply missing browser APIs or make BigInt-dependent +libraries compatible. Add required polyfills and verify actual target browsers. +Use `Meteor.arch` for architecture-specific rules and `Meteor.isLegacy` for +legacy rules. Do not create an auto-discovered `rspack.legacy.config.js` or +override Meteor's reserved Rspack `entry`/`output` to choose these graphs. + +## Verify development, tests and production + +- Set `modern.webArchOnly: false` to include legacy programs in development + and app tests; an explicit `--exclude-archs` takes precedence. +- The separate legacy graph uses a watched build and Meteor reloads. The + default client keeps the Rspack dev server/HMR. +- Exercise `meteor run`, `meteor run --production` and the extracted + `meteor build` artifact. Production includes legacy unless platform + selection excludes it, for example `--platforms modern`. +- A legacy user-agent override verifies program selection and asset/chunk + delivery. Check `Meteor.isModern` in app code. It does not emulate an old + JavaScript engine. +- For app tests, add matching `meteor.testModule` entries, such as + `client`, `legacy`, and `server`, with real import graphs. Normal test mode + selects tests; `--full-app` includes the applicable app entry as well. + A modern headless `--once` run does not test the legacy program. Select it + explicitly and verify expected tests actually ran on each program. + +--- +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/modern-build-stack/rspack-bundler-integration.md diff --git a/skills/meteor-modern-build-stack/references/eval-cases.md b/skills/meteor-modern-build-stack/references/eval-cases.md index bfefcd4..e7884fe 100644 --- a/skills/meteor-modern-build-stack/references/eval-cases.md +++ b/skills/meteor-modern-build-stack/references/eval-cases.md @@ -323,3 +323,35 @@ Prompt: "Our Meteor 3.6-beta.1 bundler works, but meteor/random is any in the ed Pass if the agent hands provider/configuration and source-set checking to meteor-typescript, preserves working build/checker integration and does not change loaders merely because the app uses TypeScript. + +## Case 33: Current 3.6 dependency set + +Prompt: "Configure the dependencies for our existing Meteor 3.6-beta.3 React app in a pnpm workspace. autoInstallDeps is false. Give the correct minimums and where to prepare the lockfile; native types already work." + +Pass if the agent uses rspack 1.4.0-beta360.3 / @meteorjs/rspack 3.0.0-beta.3, core/CLI 2.2.7, dev server 2.2.1, SWC 1.16.2, Rsdoctor 1.6.4, helpers 0.5.23 and refresh 2.0.2/0.19.0; respects opt-out and workspace ownership. + +Fail if it copies beta.1 minimums, creates an app npm lockfile, rewrites CI dependencies, or changes declaration providers. + +## Case 34: Separate legacy program + +Prompt: "On Meteor 3.6-beta.3 with its paired Rspack packages, create a small legacy-browser notice beside our modern app. The notice imports one npm dependency. Explain config, compilation, reload behavior and how to test it." + +Pass if the agent selects explicit legacy mainModule with shared config, distinguishes callback arch/isLegacy from runtime flags, enables legacy development, addresses npm transpilation separately from ES5/polyfills and tests delivery plus actual engines. + +Fail if it overwrites reserved entry/output, invents rspack.legacy.config.js discovery, imports the modern bootstrap unnecessarily or promises ES5 supplies browser APIs. + +## Case 35: Earlier architecture near miss + +Prompt: "We are pinned to Meteor 3.6-beta.1 and cannot update. Can copying beta.3 mainModule.legacy and Meteor.isLegacy guidance provide a separate Rspack legacy application?" + +Pass if the agent explains the complete flow is not present on beta.1 and preserves the constrained shared-client behavior; may describe a future compatible upgrade separately. + +Fail if it promises the beta.3 architecture flow or silently updates the app. + +## Case 36: Root generated ignores and live rules + +Prompt: "Beta.3 Rspack tests report zero cases. We have root test/ data, generated _build/test/ and edited .meteorignore exceptions while meteor test was running. How should we inspect the rules?" + +Pass if the agent separates generated root exclusions from user last-match rules and included parents, checks actual versions and rule invalidation, preserves handoff visibility and expected test names/counts. + +Fail if it copies internal METEOR_IGNORE variables, ignores _build, or accepts zero tests as green. diff --git a/skills/meteor-modern-build-stack/references/meteor-3.6-workspaces.md b/skills/meteor-modern-build-stack/references/meteor-3.6-workspaces.md index 614f249..7e34aa5 100644 --- a/skills/meteor-modern-build-stack/references/meteor-3.6-workspaces.md +++ b/skills/meteor-modern-build-stack/references/meteor-3.6-workspaces.md @@ -1,24 +1,28 @@ # Meteor 3.6 dependencies and workspaces -These decisions start with Meteor 3.6, verified on `3.6-beta.0` with -`rspack@1.4.0-beta360.0` and `tools-core@1.4.0-beta360.0`. Beta.1 uses -`rspack@1.4.0-beta360.1` and `tools-core@1.4.0-beta360.1`. Earlier 3.x releases -keep their existing integration and manually managed workspace setup. Inspect -the app's release, resolved packages, manifest and workspace lockfile before -using a beta-specific version or command. +Workspace integration starts with Meteor 3.6-beta.0; the current target is +beta.3. Select the [release pairing](rspack-config.md); `tools-core` has the +same version as `rspack` for these betas. Inspect the manifest and workspace +lockfile. Earlier 3.x releases retain their manually managed workspace setup. ## Rspack 2 dependency set -| Package | Minimum selected by 3.6 beta | Dependency category | +| Package | Minimum selected by 3.6-beta.3 | Dependency category | |---|---|---| -| `@meteorjs/rspack` | `3.0.0-beta.1` on beta.0; `3.0.0-beta.2` on beta.1 | Development | -| `@rspack/core`, `@rspack/cli`, `@rspack/dev-server` | `2.2.0` each | Development | -| `@swc/core` | `1.15.32` | Development | -| `@rsdoctor/rspack-plugin` | `1.5.9` | Development | +| `@meteorjs/rspack` | `3.0.0-beta.3` | Development | +| `@rspack/core`, `@rspack/cli` | `2.2.7` each | Development | +| `@rspack/dev-server` | `2.2.1` | Development | +| `@swc/core` | `1.16.2` | Development | +| `@rsdoctor/rspack-plugin` | `1.6.4` | Development | | `@swc/helpers` | `0.5.23` | Runtime | -| React only: `@rspack/plugin-react-refresh`, `react-refresh` | `2.0.0`, `0.17.0` | Development | +| React only: `@rspack/plugin-react-refresh`, `react-refresh` | `2.0.2`, `0.19.0` | Development | -`swc-loader@0.2.6` remains a separately selected dependency when the integration +Beta.0/beta.1 retain core/CLI/dev-server 2.2.0, SWC 1.15.32, +Rsdoctor 1.5.9, refresh plugin/runtime 2.0.0/0.17.0 and +`@meteorjs/rspack` 3.0.0-beta.1/beta.2 respectively. Do not copy beta.3's +minimums into a deliberately pinned earlier target. + +`swc-loader@0.2.7` is a separately selected dependency when the beta.3 integration needs it. Do not confuse the Meteor npm integration's major 3 with Rspack's major 2. Do not substitute unreleased stable `@meteorjs/rspack@3.0.0` for this beta's pin. Later releases require checking their own resolved pairing. @@ -40,7 +44,7 @@ CI command and revisit it after the transition. ## Create a pnpm workspace ```bash -meteor create --release 3.6-beta.0 --pnpm my-workspace +meteor create --release 3.6-beta.3 --pnpm my-workspace cd my-workspace meteor npm start ``` @@ -97,6 +101,26 @@ app-local source symlink that needs its apparent location calls for `resolve.symlinks: false`. Test shared client/server imports, an edit to a linked package, client/server suite counts, and an extracted production bundle. +Move the bundle outside the checkout and test used workspace `.bin` commands +and adjacent resource reads without source access. Beta.3 repairs copied +command links, including cross-workspace links; verify older tools explicitly. +Keep generated links untouched and preserve the root manager/lockfile. + +## Test selection and generated ignores + +Verified on the beta.3 pairing; beta.0/beta.1 lack the complete fixes. + +| Rule source | Decision | +|---|---| +| `.meteorignore`, then user `METEOR_IGNORE` | Last matching rule wins for Rspack test discovery. `!` can re-include a file only when its parents remain included. | +| Integration-generated exclusions | Scoped to the app root and entrypoint; distinct from user patterns. A root `test/` folder must not hide `_build/test/`. Do not set private `METEOR_IGNORE_*` variables to repair this. | +| Explicit user rule hiding the active build context | Still a configuration error. Keep Meteor-facing generated entries readable. | +| Edited ignore file during watch | Beta.3 invalidates the cached source scan. Check an actual inclusion/exclusion change and expected test names/counts. A zero-test exit is not success. | + +Use `meteor-testing` for setup. On a constrained earlier integration, use a +verified explicit test entry/import graph when eager discovery fails; keep +production source loading unchanged. + --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/modern-build-stack/rspack-bundler-integration.md Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/cli/index.md diff --git a/skills/meteor-modern-build-stack/references/meteor-bundler-optimizations.md b/skills/meteor-modern-build-stack/references/meteor-bundler-optimizations.md index 67a8ca0..4078806 100644 --- a/skills/meteor-modern-build-stack/references/meteor-bundler-optimizations.md +++ b/skills/meteor-modern-build-stack/references/meteor-bundler-optimizations.md @@ -238,7 +238,9 @@ quantify the improvement. ## Troubleshooting - `meteor reset` clears the build cache. -- Delete `.meteor/local/` to force a clean rebuild. +- Do not delete `.meteor/local/` to repair a build: it also contains the local + database. `meteor reset` preserves that data; database deletion requires an + explicitly disposable target and authorization. --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/modern-build-stack/meteor-bundler-optimizations.md diff --git a/skills/meteor-modern-build-stack/references/rspack-config.md b/skills/meteor-modern-build-stack/references/rspack-config.md index 2767d21..3dad9b5 100644 --- a/skills/meteor-modern-build-stack/references/rspack-config.md +++ b/skills/meteor-modern-build-stack/references/rspack-config.md @@ -15,6 +15,7 @@ Match both integration packages to the Meteor release: | 3.5.2 | `1.3.0` | `2.2.0` | Required-dependency diagnostics, mode isolation, TypeScript config dependency tracking, and full-app/TLA fixes. | | 3.6-beta.0 | `1.4.0-beta360.0` | `3.0.0-beta.1` | Rspack 2.2.0, SWC React Compiler, workspace-aware installs and stable cache configuration. | | 3.6-beta.1 | `1.4.0-beta360.1` | `3.0.0-beta.2` | Same Rspack 2 minimums, fixed TypeScript server rebuild lifecycle; Node 26.8.2. | +| 3.6-beta.3 | `1.4.0-beta360.3` | `3.0.0-beta.3` | Core/CLI 2.2.7, dev server 2.2.1, separate architecture graphs and corrected test ignores; Node 26.8.2. | Inspect `.meteor/versions`, `package.json`, and the lockfile. Do not install an arbitrary `@meteorjs/rspack` major to obtain one helper; upgrade the Meteor @@ -82,6 +83,12 @@ effective configuration; extend it with `Meteor.extendSwcConfig`. ## Configuration example +On Meteor 3.6-beta.3's pairing, use `Meteor.arch` and `Meteor.isLegacy` in +the config callback for explicit architecture compilations. These are not +runtime APIs. Read [architecture entry points](architecture-entrypoints.md) +before selecting a legacy graph or npm transpilation rules; beta.0/beta.1 +do not supply the complete flow. + ```javascript const { defineConfig } = require('@meteorjs/rspack'); const { rspack } = require('@rspack/core'); @@ -359,5 +366,21 @@ preserve it when working. See the If it is not installed, consult the [declaration guide](https://docs.meteor.com/cli/using-core-types). +## Memory limits + +Rspack runs as a child process and may OOM on large apps. Raise the heap +for tool processes temporarily when capturing evidence (Meteor 3.4.1+): + +```bash +TOOL_NODE_FLAGS="--max-old-space-size=16384" meteor run +``` + +On Meteor 3.4.0, use `NODE_OPTIONS="--max-old-space-size=16384"`. + +First distinguish a one-shot build failure from growth during a long watch +session. Audit large directories visible to Meteor and check the exact release +for fixes. Test heap size and persistent cache as separate variables; revert a +change that does not improve the failure or a measured memory trend. + --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/modern-build-stack/rspack-bundler-integration.md diff --git a/skills/meteor-mongo-minimongo/SKILL.md b/skills/meteor-mongo-minimongo/SKILL.md index 3ce205d..0a8fa15 100644 --- a/skills/meteor-mongo-minimongo/SKILL.md +++ b/skills/meteor-mongo-minimongo/SKILL.md @@ -13,7 +13,7 @@ metadata: area: data tagline: "Write and debug Mongo queries in Meteor 3 (server async vs Minimongo, oplog vs change streams, indexes, selectors, modifiers)." bundle: ["essentials", "fullstack"] - docs_synced_at: "2026-09-08" + docs_synced_at: "2026-09-29" license: MIT --- @@ -124,6 +124,18 @@ unordered observer, no `skip` or `limit`, and a selector Minimongo can compile. An ineligible query falls through to the next configured driver. Oplog is available only when `MONGO_OPLOG_URL` is configured. +Meteor 3.6, verified on beta.3's `mongo@2.5.2-beta360.3`, also declines +`$where`/`$near` selectors for Change Streams: live events cannot be re-matched +with MongoDB semantics by Minimongo. Oplog declines these selectors too, so +verify a usable polling fallback. Minimongo-incompatible projections also +require fallback. A MongoDB-supported projection rejected by Minimongo is a +driver boundary, not a reason to rewrite the publication or schema. Verify +fallback before proposing that broader change. Test initial and live results; +do not strip the selector, projection or pagination merely to force Change Streams. +Earlier 3.5/beta.1 packages can choose the wrong driver for `$where`/`$near`; +on a constrained release, use a supported polling configuration or an +authorized compatible upgrade and rerun the exact query. + On Meteor 3.5+, override the app-wide order with `METEOR_REACTIVITY_ORDER=oplog,polling` or: diff --git a/skills/meteor-mongo-minimongo/references/eval-cases.md b/skills/meteor-mongo-minimongo/references/eval-cases.md index 4391099..682e2c7 100644 --- a/skills/meteor-mongo-minimongo/references/eval-cases.md +++ b/skills/meteor-mongo-minimongo/references/eval-cases.md @@ -100,3 +100,19 @@ compatible upgrade and reruns the reproduction before a permanent workaround. It preserves driver eligibility/fallback rules and does not claim every disconnect has this cause. Fail if it drops arbitrary events by timestamp or disables change streams without evaluating the release fix. + +## Case 10: Reactive selector fallback + +Prompt: "Our Meteor 3.6-beta.3 app uses mongo 2.5.2-beta360.3, Change Streams first, and reactive $near and $where queries. Should I remove these selectors and projections so all queries use Change Streams?" + +Pass if the agent preserves semantics, explains local matcher limitations and Change Streams/oplog rejection, verifies polling fallback plus initial and live results; retains skip/limit/projection eligibility checks. + +Fail if it forces Change Streams by stripping constraints or says configuring MONGO_OPLOG_URL guarantees these selectors use oplog. + +## Case 11: Older selector near miss + +Prompt: "The same $near reactive query is wrong on Meteor 3.5.2 and we must stay pinned. Does the beta.3 fix already apply, and what can we try without changing results?" + +Pass if the agent checks resolved package/backports, does not claim the fix ships in 3.5.2 and offers supported polling configuration with query/live-update verification. + +Fail if it promises fixed automatic eligibility or rewrites away the selector. diff --git a/skills/meteor-native/SKILL.md b/skills/meteor-native/SKILL.md index b830450..ba6adfd 100644 --- a/skills/meteor-native/SKILL.md +++ b/skills/meteor-native/SKILL.md @@ -14,7 +14,7 @@ metadata: meteor: ">=3.0" area: build tagline: "Build and maintain Meteor 3 Cordova apps for Android and iOS, including plugins, native artifacts, and hot code push." - docs_synced_at: "2026-09-08" + docs_synced_at: "2026-09-29" license: MIT --- diff --git a/skills/meteor-native/references/eval-cases.md b/skills/meteor-native/references/eval-cases.md index c9de885..c2593e3 100644 --- a/skills/meteor-native/references/eval-cases.md +++ b/skills/meteor-native/references/eval-cases.md @@ -305,3 +305,11 @@ enabled defaults. Fail if it treats the reporter statement as proof for 3.5, set every modern feature true, removes the legacy opt-out, or requires a new binary solely for changing JavaScript output with unchanged native compatibility and supported WebViews. + +## Case 28: Modern Cordova fetch registration + +Prompt: "Importing meteor/fetch fails only in our modern Cordova beta.1 build. Does beta.3 require adding a polyfill? We also maintain an older app with meteor.modern.cordova false." + +Pass if the agent checks fetch 0.2.1-beta360.3 and architecture/overrides, explains modern registration fix and actual WebView verification, preserves legacy mapping and earlier constraints. + +Fail if it adds a global polyfill first, forces modern output on the legacy app or promises unsupported WebView APIs. diff --git a/skills/meteor-native/references/toolchain-and-development.md b/skills/meteor-native/references/toolchain-and-development.md index b516247..0a54abb 100644 --- a/skills/meteor-native/references/toolchain-and-development.md +++ b/skills/meteor-native/references/toolchain-and-development.md @@ -156,6 +156,7 @@ and the Meteor release label alone do not identify the loaded Atmosphere code. | Confirmed signature | Fixed package / release | Decision | |---|---|---| +| Importing `fetch` fails only in a modern Cordova program | Meteor 3.6 fix verified on beta.3's `fetch@0.2.1-beta360.3` | The package registers its native implementation for the `modern` architecture, including modern Cordova. Check the selected architecture, resolved package and local overrides; retest on the actual WebView before adding a polyfill. Earlier packages lack this registration. `meteor.modern.cordova: false` retains the legacy path; this fix does not add browser API support to an old WebView. [Fix](https://github.com/meteor/meteor/pull/14781) | | Early Meteor 3 Cordova startup fails after adding accounts, with a misleading missing `core-js` error from `url/legacy.js` | `url@1.3.5`, shipped in Meteor 3.1 | Check for a shadowing `packages/url` override before choosing a compatible fixed package/release, then verify account startup. Adding app-level `core-js` or removing accounts does not repair the URLSearchParams integration. [Fix](https://github.com/meteor/meteor/pull/13459) | | `Map.keys`, `Map.entries` or iteration fails in a modern library only in the Cordova bundle | `ecmascript-runtime-client@0.13.0`, shipped in Meteor 3.4.1 | Check whether legacy polyfills replaced native Map/Set/Symbol. Modern transpilation alone is not this fix. Use the compatible fixed package/release; for a constrained branch, verify an app-local backport against its supported WebViews. Do not edit the global Meteor cache or downgrade unrelated UI libraries. [Meteor 3 confirmation](https://forums.meteor.com/t/solved-vue3-does-not-work-with-cordova/61109/10) | | Meteor 3.4 Rspack `android-device`/iOS development produces SockJS `Invalid frame header` or proxy errors, including in a desktop browser attached to that native run | Atmosphere `rspack@1.1.0`, shipped in Meteor 3.4.1 | Use the fixed native integration that skips the desktop HMR bootstrap/proxy. Confirm the native run-mode reproduction and resolved package; healthy fixed versions or production proxy failures need separate diagnosis. [Fix](https://github.com/meteor/meteor/pull/14226) | @@ -170,3 +171,4 @@ Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/cordova.m Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/cli/index.md Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/cli/environment-variables.md Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/generators/changelog/versions/3.3.2.md +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/generators/changelog/versions/3.6.0.md diff --git a/skills/meteor-pubsub/SKILL.md b/skills/meteor-pubsub/SKILL.md index ea3b737..ab6c852 100644 --- a/skills/meteor-pubsub/SKILL.md +++ b/skills/meteor-pubsub/SKILL.md @@ -14,7 +14,7 @@ metadata: area: data tagline: "Author and debug publications/subscriptions (publish strategies, low-level `added/changed/removed`, authorization, reactive joins)." bundle: ["essentials", "fullstack"] - docs_synced_at: "2026-09-23" + docs_synced_at: "2026-09-29" license: MIT --- diff --git a/skills/meteor-pubsub/references/eval-cases.md b/skills/meteor-pubsub/references/eval-cases.md index 0731f9a..650e7db 100644 --- a/skills/meteor-pubsub/references/eval-cases.md +++ b/skills/meteor-pubsub/references/eval-cases.md @@ -83,3 +83,11 @@ Prompt: "Our Meteor 3.5.2 client throws Server sent add for existing id only whi Pass if the agent: Checks client package and pending-write path, identifies the beta.1 fix boundary, and recommends a compatible tested upgrade or app-level sequencing. Does not claim all older clients support that path or switch publication strategies without considering ownership/cleanup. Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 10: Fieldless retained document + +Prompt: "On beta.1, after stopping a NO_MERGE_NO_HISTORY subscription, an ID-only resubscription throws Cannot convert undefined or null to object. DDP added has no fields. Is this the pending-stub fix, and what should beta.3 preserve?" + +Pass if the agent distinguishes mongo fieldless replication from ddp-client pending-stub fix; beta.3 missing fields are a no-op preserving retained values, wire cleared removes fields while null sets a value, and later updates are tested. + +Fail if it deletes retained fields for absent fields, publishes dummy fields, clears a shared collection, confuses null with removal, or promises unsubscribe removals. diff --git a/skills/meteor-pubsub/references/publication-strategies.md b/skills/meteor-pubsub/references/publication-strategies.md index 8d84be0..4953f55 100644 --- a/skills/meteor-pubsub/references/publication-strategies.md +++ b/skills/meteor-pubsub/references/publication-strategies.md @@ -23,6 +23,19 @@ resolved version and reproduce with a pending write before relying on the fix. It also covers resubscribing under `NO_MERGE_NO_HISTORY`; it does not add server history, ownership merging or unsubscribe removals to that strategy. +A separate fix is verified in Meteor 3.6-beta.3's +`mongo@2.5.2-beta360.3`: DDP can omit empty `fields`, including an ID-only +publication's repeated `added` after a retained full document. The resulting +fieldless change is a no-op, preserving existing fields, and later updates +continue. Earlier packages can throw `Cannot convert undefined or null to +object` in this path even with beta.1's pending-stub fix. Capture the wire +message and loaded client packages before selecting the fix. Explicit field +clears still remove fields: the wire uses `cleared: ["fieldName"]`, which +parses into `fields: { fieldName: undefined }`. `fields: { fieldName: null }` +sets a null value; it does not remove the field. Missing `fields` is not an +instruction to erase the document. Do not add dummy published fields or clear +a shared collection to hide the crash. + Use this when a collection is supplied by only one publication. It uses less server state than `SERVER_MERGE`, but multiple publications for the same collection can overwrite each other's document view. diff --git a/skills/meteor-testing/SKILL.md b/skills/meteor-testing/SKILL.md index df8500a..a9e6e5f 100644 --- a/skills/meteor-testing/SKILL.md +++ b/skills/meteor-testing/SKILL.md @@ -18,7 +18,7 @@ metadata: area: testing tagline: "Set up and write Meteor 3 tests (`meteortesting:mocha`, async signatures, methods/publications, Playwright/Cypress E2E)." bundle: ["fullstack"] - docs_synced_at: "2026-09-23" + docs_synced_at: "2026-09-29" license: MIT --- @@ -89,6 +89,11 @@ narrowing entrypoint imports. Restore every temporary focus or import change, then run the normal affected suite. Read the configured entrypoint paths from the project; do not invent paths, scripts, ports, or helpers. +For 3.6-beta.3 Rspack ignore exceptions or separate legacy test entries, use +the [architecture and ignore boundaries](references/focused-runs.md#rspack-architecture-and-ignore-boundaries). +Check expected suites on each selected program; a modern zero-exit run is +not proof of legacy coverage. + ## Method test (server-side) ```javascript diff --git a/skills/meteor-testing/references/eval-cases.md b/skills/meteor-testing/references/eval-cases.md index 27aba01..87df947 100644 --- a/skills/meteor-testing/references/eval-cases.md +++ b/skills/meteor-testing/references/eval-cases.md @@ -195,3 +195,19 @@ Prompt: "Adapt our Node 24 Meteor 3.5.2 test job for a deliberate upgrade to 3.6 Pass if the agent: Verifies the selected Meteor runtime, uses Node 26.8.2/npm 11.19.0 for beta.1, rebuilds native deps and preserves frozen dependency installation and actual client/server test execution. Does not claim existing 3.5.2 jobs need Node 26. Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 21: Rspack test file exceptions + +Prompt: "In beta.3 our Rspack CI should load *.tests.js only directly under imports/accounts, while excluding other *.tests.js. We also have a root test/ data directory. How should the file selection and pass check work?" + +Pass if the agent uses ordered file/environment negation with included parents, distinguishes file selection from Mocha title filtering, preserves generated entries and checks expected names/counts. + +Fail if it uses only MOCHA_GREP to prevent module evaluation, ignores _build/test or accepts zero cases. + +## Case 22: Legacy program coverage + +Prompt: "On beta.3 our testModule maps client and legacy separately. meteor test --once with current Chromium passes. Have we covered legacy browsers? What about the same setup pinned to beta.1?" + +Pass if the agent requires explicit legacy program selection with webArchOnly false/no exclusion, expected cases per program and actual engine tests; explains beta.1 lacks the complete separate-graph flow. + +Fail if it claims a modern headless pass or user-agent spoof alone proves old-engine compatibility, or promises beta.3 behavior on beta.1. diff --git a/skills/meteor-testing/references/focused-runs.md b/skills/meteor-testing/references/focused-runs.md index 3b16cc4..4a47223 100644 --- a/skills/meteor-testing/references/focused-runs.md +++ b/skills/meteor-testing/references/focused-runs.md @@ -31,8 +31,8 @@ suite. See [Mocha exclusive tests](https://mochajs.org/declaring/exclusive-tests ## Control the loaded test graph Configure explicit entry modules when the project needs deterministic test -loading. `meteor.testModule` accepts one shared entry-module string or separate -`client` and `server` values. Read those values from the project's +loading. `meteor.testModule` accepts one shared entry-module string or a runtime +map, usually `client` and `server`. Read those values from the project's `package.json`; do not invent an entrypoint path. Each entry module imports the tests for its runtime. @@ -47,5 +47,39 @@ itself causes interference or dominates the focused run. Preserve the original imports, make the smallest temporary change, restore it immediately, and run the normal affected suite. Never commit a narrowed test graph or a focus marker. +## Rspack architecture and ignore boundaries + +Meteor 3.6-beta.3 with `rspack@1.4.0-beta360.3` and +`@meteorjs/rspack@3.0.0-beta.3` supports separate `testModule.legacy` and +exact `web.browser`, `web.browser.legacy`, `web.cordova` entries. Preserve the +matching app entries in `--full-app` mode. Enable legacy development/test +programs with `modern.webArchOnly: false` and do not exclude that architecture. +Use `meteor-modern-build-stack` for graph/config details. + +A modern headless `meteor test --once` does not exercise the legacy test +program. Select it explicitly and check test names/counts for both programs. +A user-agent override tests delivery, not an old JS engine. Beta.0/beta.1 +and older Rspack integrations lack this complete flow; retain their supported +test graph or select a compatible paired upgrade. + +For beta.3 eager Rspack test selection, `.meteorignore` precedes user +`METEOR_IGNORE`; the last matching pattern wins. Keep parent directories +included before a file exception: + +```bash +METEOR_IGNORE='**/*.tests.* !imports/accounts/*.tests.*' \ + meteor test --once --driver-package meteortesting:mocha +``` + +This selects files, not test titles. `MOCHA_GREP` remains a separate control. +Generated Rspack exclusions are separate and scoped to the app root: a root +`test/` data directory must not hide `_build/test/`. User rules can still +incorrectly hide the handoff. Do not copy internal `METEOR_IGNORE_*` variables +into CI or ignore the active build context. For older integrations, use a +verified explicit entry/import graph when eager discovery is broken. Reject +zero tests when cases were expected, even if the process exits successfully. + --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/packages/modules.md +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/cli/environment-variables.md +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/modern-build-stack/rspack-bundler-integration.md diff --git a/skills/meteor-testing/references/mocha-setup.md b/skills/meteor-testing/references/mocha-setup.md index 02d7868..bdfd63d 100644 --- a/skills/meteor-testing/references/mocha-setup.md +++ b/skills/meteor-testing/references/mocha-setup.md @@ -76,7 +76,7 @@ jobs: Node version must match the bundled Node.js for the Meteor version: 3.0 uses Node 20, 3.1 through 3.4 use Node 22, and 3.5.x / 3.6-beta.0 use Node 24. -Meteor 3.6-beta.1 uses Node 26.8.2 and npm 11.19.0. The example above targets +Meteor 3.6-beta.1 through beta.3 use Node 26.8.2 and npm 11.19.0. The example above targets 3.1-3.4; adjust its Node selection for the actual job. Run `meteor node -v` and `meteor npm -v` in the target app, rebuild native dependencies for that runtime, and keep dependency installation frozen in CI. diff --git a/skills/meteor-typescript/SKILL.md b/skills/meteor-typescript/SKILL.md index 5f068f1..156e38a 100644 --- a/skills/meteor-typescript/SKILL.md +++ b/skills/meteor-typescript/SKILL.md @@ -17,7 +17,7 @@ metadata: meteor: ">=3.0" area: build tagline: "Configure Meteor app declarations, TypeScript and JavaScript IntelliSense, and reliable local/CI type-checking." - docs_synced_at: "2026-09-23" + docs_synced_at: "2026-09-29" license: MIT --- @@ -48,12 +48,15 @@ runs just because SWC itself only transpiles. ## Choose the provider +Native declarations start with 3.6-beta.1; this workflow is verified through +3.6-beta.3. Beta.3 adds the declaration corrections linked below. + | Target and intent | Decision | |---|---| | Meteor 3 before 3.6-beta.1 | Native `meteor types` is unavailable. Keep a working legacy provider; use the earlier-release branch in the provider reference if declarations are missing. | -| New or existing 3.6-beta.1 app with working legacy types | Keep them unless native adoption is requested. Beta.1 TypeScript templates still install direct `zodern:types` and `@types/meteor`; a native fallback path is not opt-in. | -| Explicit native adoption on 3.6-beta.1 | Root config required. Checkpoint providers/config, remove direct `zodern:types`, generate successfully, then merge native resolution and remove overlapping ambient types. | -| JavaScript-only beta.1 app wanting IntelliSense | Use `jsconfig.json` and the same provider decision; no TypeScript source conversion or bundler switch is required. | +| New or existing 3.6 native-types-capable app with working legacy types | Keep them unless native adoption is requested. Beta.1 TypeScript templates still install direct `zodern:types` and `@types/meteor`; a native fallback path is not opt-in. | +| Explicit native adoption on 3.6-beta.1 through beta.3 | Root config required. Checkpoint providers/config, remove direct `zodern:types`, generate successfully, then merge native resolution and remove overlapping ambient types. | +| JavaScript-only 3.6 beta app wanting IntelliSense | Use `jsconfig.json` and the same provider decision; no TypeScript source conversion or bundler switch is required. | Read [declaration providers](references/declaration-providers.md) for the ordered switch, native adapter/barrel distinction, inherited configuration, @@ -64,7 +67,7 @@ TypeScript 7 compatibility, earlier providers and rollback. Read 1. Confirm generation actually ran. A direct `zodern:types` makes `meteor types` skip with exit zero; ordinary Meteor commands do not select - or regenerate native declarations on beta.1. + or regenerate native declarations on beta.1 through beta.3. 2. Use the app's local compiler. With native declarations, run `meteor types && tsc --noEmit` in a package script; select the intended config explicitly when the app has several projects. @@ -89,6 +92,7 @@ TypeScript 7 compatibility, earlier providers and rollback. Read | Duplicate identifiers | Overlapping providers, inherited `types: ["meteor"]` and app ambient declarations before symlinks. | | Peer types fail inside Meteor's package store | Consider `preserveSymlinks` for that specific boundary; it cannot remove duplicate providers. | | One community package remains untyped | Check whether the installed package publishes declarations. No generator can promise coverage for every Atmosphere package. | +| Generated relative imports or subscription handle types disagree with runtime | Check the beta.3 declaration corrections in [provider guidance](references/declaration-providers.md#compiler-configuration-compatibility), then regenerate and type-check. Keep generated files unedited and structural handles usable. | If the actual task is publishing package declarations, use the official [Atmosphere package types documentation](https://docs.meteor.com/packages/7.writing-atmosphere-packages#typescript-types). diff --git a/skills/meteor-typescript/references/declaration-providers.md b/skills/meteor-typescript/references/declaration-providers.md index 0556011..cf97668 100644 --- a/skills/meteor-typescript/references/declaration-providers.md +++ b/skills/meteor-typescript/references/declaration-providers.md @@ -93,6 +93,23 @@ Ordinary Meteor commands and a skipped native run do not delete either tree. ## Compiler configuration compatibility +For Meteor 3.6, the workflow above is verified through beta.3. Keep native +generation explicit; working legacy providers remain valid. After a paired +tool/package upgrade, rerun `meteor types` before checking the app. +If reaching beta.3 requires changing the framework release, use +`meteor-cli-installation` for retained local-data preparation before that +release starts; declaration regeneration is not a database migration. + +| Native declaration symptom | Beta.3 verification and earlier-version boundary | +|---|---| +| Relative imports/re-exports or ambient declarations break inside a generated package | Beta.3's generator preserves the declaration tree and ambient entry location and parses module structure. Beta.1 lacks these layout fixes. Inspect the package's shipped files, regenerate with the fixed tool and run the local checker; do not flatten or patch `.meteor/types`. A package that did not ship its referenced file still needs a package fix. | +| DDP imports or subscription handles disagree with runtime | Beta.3's `ddp-client`, `ddp-common`, `meteor` and `minimongo` declarations are corrected. Match resolved package versions and regenerate. Real `Meteor.subscribe` / DDP handles return `SubscriptionHandleWithId`; structural `Meteor.SubscriptionHandle` still requires only `ready()` and `stop()`. Do not require synthetic adapters to invent `subscriptionId`, or loosen all handles to `any`. | + +These are declaration corrections, not new runtime methods. Internal Minimongo +helper declarations do not make those helpers a recommended public app API. +Keep earlier native/legacy setups when the app cannot change its release; +do not promise beta.3 declaration fixes on beta.1 or force a provider switch. + Inspect the installed npm `typescript`, not only the Atmosphere `typescript` package: they are separate tools. Beta.1's TypeScript scaffold selects npm TypeScript 7 and `moduleResolution: "bundler"`. Do not copy older docs' diff --git a/skills/meteor-typescript/references/eval-cases.md b/skills/meteor-typescript/references/eval-cases.md index c163873..19ca634 100644 --- a/skills/meteor-typescript/references/eval-cases.md +++ b/skills/meteor-typescript/references/eval-cases.md @@ -117,3 +117,19 @@ Pass if the agent rejects editing generated adapters and directs the actual package-author workflow to the official Atmosphere types documentation. It does not claim the app-provider skill implements package publication or that api.types exists on every Meteor 3 release. + +## Case 14: Native declaration layout recovery + +Prompt: "Our beta.1 native generated declarations lose a package relative import and nested ambient declaration path. The package ships those files. We can update to beta.3. Should we flatten or edit .meteor/types?" + +Pass if the agent checks exact tool/packages, uses beta.3 layout corrections then explicit meteor types and local compiler/source inclusion checks, preserving provider config and unedited generated files. + +Fail if it patches generated files, adds any/skipLibCheck to hide errors, or promises the generator recreates unshipped files. + +## Case 15: Structural subscription handles + +Prompt: "On beta.3 native declarations we read subscriptionId from Meteor.subscribe and DDP.connect(...).subscribe. Our wrapper returns only ready and stop and is typed Meteor.SubscriptionHandle. Must we invent an ID for it?" + +Pass if the agent distinguishes concrete SubscriptionHandleWithId returns from structural SubscriptionHandle, keeps wrapper valid without synthetic IDs, checks resolved declarations/regeneration and notes older providers may differ. + +Fail if it makes subscriptionId mandatory for all structural handles, uses any or treats type corrections as new runtime APIs. diff --git a/skills/migrate-to-meteor-3/SKILL.md b/skills/migrate-to-meteor-3/SKILL.md index 7ce14fe..1fa3f88 100644 --- a/skills/migrate-to-meteor-3/SKILL.md +++ b/skills/migrate-to-meteor-3/SKILL.md @@ -18,7 +18,7 @@ metadata: area: migration tagline: "Migrate a Meteor 2.x app to 3.x (`callAsync`, async Mongo, Fibers removal, Blaze reactivity, Express 5, Atmosphere resolution)." bundle: ["migration"] - docs_synced_at: "2026-09-23" + docs_synced_at: "2026-09-29" license: MIT --- @@ -31,6 +31,9 @@ in phases. Do not flip the framework version flag first. ## Recommended strategy +For 3.6-beta.3, [prepare retained local data](references/other-breaking-changes.md#local-database-before-meteor-36) +under the previous release before updating. + 1. Update the project to the latest 2.x release. 2. Run the app with `WARN_WHEN_USING_OLD_API=true meteor run`. The console logs every sync-API call that needs an async sibling, giving you a @@ -141,9 +144,5 @@ in phases. Do not flip the framework version flag first. `react-migration.md`, `eval-cases.md`. - Current Meteor React integration after the upgrade: `meteor-react`. -## Further reading (optional) - -Real-world migration write-ups for context, not for fixing specific -issues. The symptom router above is sufficient on its own. Open -`references/community-case-studies.md` only when the user asks for -narrative case studies or wants to calibrate effort and timeline. +For requested case studies, read +`references/community-case-studies.md`; use the symptom router for fixes. diff --git a/skills/migrate-to-meteor-3/references/eval-cases.md b/skills/migrate-to-meteor-3/references/eval-cases.md index 4740c3b..a7c65d4 100644 --- a/skills/migrate-to-meteor-3/references/eval-cases.md +++ b/skills/migrate-to-meteor-3/references/eval-cases.md @@ -438,3 +438,11 @@ Prompt: "The app already runs on Meteor 3.6-beta.1. Only meteor/* editor types a Pass if the agent chooses meteor-typescript for provider/resolution/checking and does not start a Meteor 2-to-3 conversion or bundler migration. + +## Case 37: Meteor 2 local database to 3.6 + +Prompt: "We are preparing a Meteor 2 app for Meteor 3.6-beta.3 with valuable local data on a MongoDB server older than 7. Async conversion is planned. Can we just change the Meteor release then set FCV 7.0?" + +Pass if the agent keeps async/package migration stages, requires verified backup, old server/version/FCV inspection and intermediate Mongo major upgrades before MongoDB 8; stops old app before update and rejects a release rollback as database rollback. + +Fail if it starts beta.3 against retained older data, runs FCV 7.0 on an incompatible server or suggests reset --db as migration. diff --git a/skills/migrate-to-meteor-3/references/other-breaking-changes.md b/skills/migrate-to-meteor-3/references/other-breaking-changes.md index eaa3444..759f189 100644 --- a/skills/migrate-to-meteor-3/references/other-breaking-changes.md +++ b/skills/migrate-to-meteor-3/references/other-breaking-changes.md @@ -89,6 +89,33 @@ meteor reset --db # clears build cache AND local Mongo Update any CI or development scripts that rely on `meteor reset` wiping the database. +## Local database before Meteor 3.6 + +Meteor 3.6-beta.3 ships MongoDB 8.0.29 locally. Before updating or running +that release against existing data, back up and verify recovery. Start with +the previous release, connect with `meteor mongo` (using `mongosh`), and check: + +```javascript +db.version() +db.adminCommand({ getParameter: 1, featureCompatibilityVersion: 1 }) +``` + +MongoDB 8 requires MongoDB 7 with FCV `"7.0"`. A Meteor 2 database may be +older: follow intermediate MongoDB major upgrades, not a direct jump to 8. +On MongoDB 7, if FCV is older, set it on the primary after backup and recheck: + +```javascript +db.adminCommand({ setFeatureCompatibilityVersion: "7.0", confirm: true }) +``` + +Stop the app before selecting beta.3. Fresh databases do not need old-data +preparation; external `MONGO_URL` upgrades belong to the provider/admin. +`meteor reset` preserves data, `--db` deletes it, and reverting Meteor is +not a database rollback. FCV `7.0` alone does not guarantee a supported +MongoDB 8-to-7 binary downgrade. Use `meteor-cli-installation` for host requirements +and the [official preparation guide](https://docs.meteor.com/about/install#updating-local-database). +An earlier constrained release keeps its own database/runtime requirements. + ## Release-specific Node baseline Meteor 3 does not have one Node baseline across every minor release: @@ -98,7 +125,7 @@ Meteor 3 does not have one Node baseline across every minor release: | 3.0 | Node 20 | | 3.1 through 3.4 | Node 22 | | 3.5.x and 3.6-beta.0 | Node 24 | -| 3.6-beta.1 | Node 26.8.2 (npm 11.19.0) | +| 3.6-beta.1 through beta.3 | Node 26.8.2 (npm 11.19.0) | Run `meteor node --version` in the target app and use that version in CI, native dependency builds, and container images. Audit `engines.node` and @@ -201,3 +228,4 @@ bundle earlier Node majors as shown above. --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/v3-migration-docs/breaking-changes/index.md +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/install.md diff --git a/skills/migrate-to-rspack/SKILL.md b/skills/migrate-to-rspack/SKILL.md index 5c18a9a..f484ba3 100644 --- a/skills/migrate-to-rspack/SKILL.md +++ b/skills/migrate-to-rspack/SKILL.md @@ -21,7 +21,7 @@ metadata: area: migration tagline: "Migrate an existing Meteor 3 app to the Rspack bundler integration (`mainModule`, replacing legacy build plugins with loaders)." bundle: ["migration"] - docs_synced_at: "2026-09-23" + docs_synced_at: "2026-09-29" license: MIT --- @@ -45,6 +45,7 @@ Match `@meteorjs/rspack` to the Meteor release, not to | 3.5.2 | `1.3.0` | `2.2.0` | Dependency diagnostics, mode isolation, full-app/TLA and cache fixes. | | 3.6-beta.0 | `1.4.0-beta360.0` | `3.0.0-beta.1` | Rspack 2.2.0 and workspace-aware installs. | | 3.6-beta.1 | `1.4.0-beta360.1` | `3.0.0-beta.2` | TypeScript rebuild-loop fix; Node 26.8.2. | +| 3.6-beta.3 | `1.4.0-beta360.3` | `3.0.0-beta.3` | Rspack 2.2.7; architecture graphs and test-ignore fixes. | Inspect `.meteor/versions`, `package.json`, and the lockfile: Atmosphere, Meteor npm integration and Rspack core versions are independent. With automatic @@ -102,39 +103,14 @@ Without `mainModule`, Rspack has no entry. Meteor's eager-loading model does not apply: Rspack does not auto-discover modules. See `references/framework-and-css.md` for CSS and HTML routing. -## Required: no nested imports in app code - -```javascript -// app code: NOT allowed under Rspack -if (condition) { - import { a as b } from "./c"; - console.log(b); -} -``` - -Three fixes: +For 3.6-beta.3's separate legacy/native entries and earlier-version limits, +read [architecture preservation](references/code-migrations.md#architecture-preservation). -```javascript -// 1. Move to top -import { a as b } from "./c"; -if (condition) console.log(b); - -// 2. Dynamic import (standardized, supported) -if (condition) { - const { a: b } = await import("./c"); - console.log(b); -} - -// 3. require (CommonJS interop) -if (condition) { - const { a: b } = require("./c"); - console.log(b); -} -``` +## Required: no nested imports in app code -Diagnose with verbose mode and look for `(app)` files failing with -`Error: 'import' and 'export' cannot be used outside of module code`. -`(package)` failures are fine; Atmosphere packages are not bundled by Rspack. +Apply the [nested-import rewrites](references/code-migrations.md#nested-imports) +to app code. Adapt callers when using Promise-returning `import()`; +Atmosphere package code stays on Meteor's bundler. ## Required: reserve build folders diff --git a/skills/migrate-to-rspack/references/code-migrations.md b/skills/migrate-to-rspack/references/code-migrations.md index 6a89ec6..822290f 100644 --- a/skills/migrate-to-rspack/references/code-migrations.md +++ b/skills/migrate-to-rspack/references/code-migrations.md @@ -22,6 +22,17 @@ loads every file eagerly and Rspack has nothing to anchor on. Loading order belongs in the entry file. Imports cascade from there. See [Modular application structure](https://docs.meteor.com/packages/modules). +### Architecture preservation + +On the 3.6-beta.3 pairing, preserve explicit `legacy`, `web.browser`, +`web.browser.legacy` and `web.cordova` entries and matching test entries. +They compile separately through the same config; `false` disables an app +entry, not package code. Use `meteor-modern-build-stack`'s architecture +reference for config flags, legacy npm transpilation and program selection. +Beta.0/beta.1 and earlier integrations lack this complete flow. Do not collapse +an intentional legacy notice into the modern app or promise ES5 alone makes +all dependencies compatible. + ### Server-only apps If the app has no client UI (API servers, microservices, workers), set diff --git a/skills/migrate-to-rspack/references/eval-cases.md b/skills/migrate-to-rspack/references/eval-cases.md index 1925b13..3ea51c3 100644 --- a/skills/migrate-to-rspack/references/eval-cases.md +++ b/skills/migrate-to-rspack/references/eval-cases.md @@ -364,3 +364,19 @@ Prompt: "Upgrade our existing Rspack app from Meteor 3.5.2 to 3.6-beta.1. Automa Pass if the agent: Uses update --release 3.6-beta.1 then normal startup, checks the beta.1 pairing and lockfile, preserves the current declaration provider and valid config, and verifies Node 26/native module compatibility. Does not mandate a second update --npm or native declaration migration. Fail if it contradicts these boundaries or invents unsupported APIs. + +## Case 37: Cumulative beta.3 upgrade + +Prompt: "Plan our Rspack 1 app upgrade from Meteor 3.5.2 to 3.6-beta.3. We keep local data on MongoDB 7 FCV 6.0, use npm with an immutable CI lockfile, and want to retain zodern:types." + +Pass if the agent prepares backup and MongoDB 7 FCV 7.0 before upgrade, uses beta.3 dependency pairing, reviews local lockfile/native Node 26 rebuilds and respects working provider and immutable CI. + +Fail if it starts the new database first, deletes data, uses current beta.1 dependencies or forces native declarations. + +## Case 38: Preserve architecture migration intent + +Prompt: "We are migrating an existing beta.3 app to its paired Rspack integration. mainModule has client, legacy for an unsupported-browser notice, and web.cordova: false. Our testModule also has a legacy entry. What must the migration preserve?" + +Pass if the agent keeps explicit architecture graphs and false semantics, uses the build owner for shared config/transpilation, verifies legacy test/program selection and actual engine limits. + +Fail if it collapses legacy into client, says false removes all package code, or treats a modern headless test as legacy coverage. diff --git a/skills/migrate-to-rspack/references/rspack-2-upgrade.md b/skills/migrate-to-rspack/references/rspack-2-upgrade.md index 23248a6..ce5ad4d 100644 --- a/skills/migrate-to-rspack/references/rspack-2-upgrade.md +++ b/skills/migrate-to-rspack/references/rspack-2-upgrade.md @@ -1,21 +1,27 @@ # Rspack 1 to 2 in Meteor -Use this branch for Meteor 3.6 beta. The current audited target is -`3.6-beta.1`, with `rspack@1.4.0-beta360.1` and -`@meteorjs/rspack@3.0.0-beta.2`. A deliberately pinned `3.6-beta.0` keeps -`rspack@1.4.0-beta360.0` and `@meteorjs/rspack@3.0.0-beta.1`; use the -requested release instead of silently changing the target. -Meteor 3.5.2 keeps `rspack@1.3.0`, `@meteorjs/rspack@2.2.0` and Rspack 1.x. -Do not force Rspack 2 into a constrained older release. +Use this workflow for Meteor 3.6 beta. Commands below target beta.3; preserve +an explicitly requested earlier release and its pairing from +[the skill's version table](../SKILL.md). Meteor 3.5.2 retains Rspack 1.x. ## Upgrade the coordinated dependency set 1. Checkpoint `.meteor/release`, `.meteor/versions`, app/workspace manifests, the authoritative lockfile and custom `rspack.config.*`. + Before beta.3's MongoDB 8 opens retained data, back up and verify recovery. + Under the previous release, check `db.version()` and FCV: MongoDB 7 needs + FCV `7.0`; older servers need intermediate major upgrades first. + If needed, set FCV on the MongoDB 7 primary using + `db.adminCommand({ setFeatureCompatibilityVersion: "7.0", confirm: true })`, + recheck, then stop the app. Check hosts against the + [database preparation guide](https://docs.meteor.com/about/install#updating-local-database). + External `MONGO_URL` upgrades are separate. `meteor reset --db` deletes data. + Neither reverting Meteor nor retaining FCV `7.0` guarantees a database + downgrade; use the verified recovery plan. 2. With default `meteor.autoInstallDeps` enabled, update then start normally: ```bash - meteor update --release 3.6-beta.1 + meteor update --release 3.6-beta.3 meteor run ``` @@ -26,11 +32,13 @@ Do not force Rspack 2 into a constrained older release. dependencies explicitly in an authorized local workflow, then commit and test a frozen install. `meteor update --npm` overrides the opt-out for that invocation; do not put a lockfile-rewriting step in immutable CI. -3. The beta's required npm minimums are core/CLI/dev-server 2.2.0, Meteor integration - 3.0.0-beta.2 on beta.1 (3.0.0-beta.1 on beta.0), SWC core 1.15.32, - helpers 0.5.23 and Rsdoctor 1.5.9. +3. Beta.3's required npm minimums are core/CLI 2.2.7, dev-server 2.2.1, + Meteor integration 3.0.0-beta.3, SWC core 1.16.2, + helpers 0.5.23 and Rsdoctor 1.6.4. The selected `swc-loader` is 0.2.7. Keep helpers in runtime dependencies, the bundler tools in dev dependencies. - Detected React adds refresh plugin 2.0.0 and refresh runtime 0.17.0. + Detected React adds refresh plugin 2.0.2 and refresh runtime 0.19.0. + Beta.0/beta.1 retain their earlier 2.2.0 core/CLI/dev-server minimums, + SWC 1.15.32, Rsdoctor 1.5.9 and refresh 2.0.0/0.17.0. Record the resolved versions: compatible newer patches can satisfy these minimums without matching the original examples' lockfiles exactly. 4. With npm and installed Rspack 1.x peers, the automatic upgrade uses @@ -93,7 +101,7 @@ requirement and retest after peer cleanup. Do not convert managers to fix CI. Run development, a rebuild, actual client/server tests, and a production bundle. Exercise CSS, lazy imports, local/workspace packages and custom loaders when present. Boot the extracted bundle and load the browser page. -For beta.1, rebuild and exercise native npm dependencies against Node 26.8.2 +For beta.1 through beta.3, rebuild and exercise native npm dependencies against Node 26.8.2 and the deployment architecture before deploying; this is a release migration step, not something to defer until a native module crashes in production. Follow the [validation matrix](validation-matrix.md); reported example startup diff --git a/skills/migrate-to-rspack/references/validation-matrix.md b/skills/migrate-to-rspack/references/validation-matrix.md index 181f0c9..36c898e 100644 --- a/skills/migrate-to-rspack/references/validation-matrix.md +++ b/skills/migrate-to-rspack/references/validation-matrix.md @@ -14,10 +14,11 @@ results. Run the applicable rows after Rspack activation. | Full-app initialization | App-test modules or server top-level await exist | On Meteor 3.5.2, configured app client/server bundles remain present with server-only test entries; awaited module initialization settles and the expected tests execute. Earlier integrations need a release-specific reproduction. | | Production build | Always | Command exits nonzero on failure and the expected artifact exists. | | Extracted bundle boot | Deployable app | Server reaches readiness from the production artifact. | +| Relocated workspace commands | Linked workspace npm packages expose used commands | Move the bundle outside the checkout; command links and adjacent resource reads work without original source access. Beta.3 fixes copied links; verify earlier tools explicitly. | | Browser against production bundle | Client app | The real page starts; HTTP 200 from the server alone is insufficient. | | Dynamic import | Lazy feature exists | The chunk loads and executes when the feature is invoked. | | Non-root `ROOT_URL` | Subpath deployment | Assets and chunks load without duplicated or missing prefixes. | -| Legacy web architecture | Still supported | A legacy-targeted browser or equivalent bundle smoke starts. | +| Legacy web architecture | Still supported | On the 3.6-beta.3 pairing, preserve explicit main/test architecture graphs and load the intended program, assets and lazy chunks. A modern user-agent override proves selection only; test actual old engines for compatibility. Earlier pairings retain their supported shared-client behavior. | | Custom loader | Custom loader exists | Representative input passes parsing, transformation, and code generation through the actual loader entry. | | Framework preprocessing | Svelte/TypeScript, PostCSS/SCSS or UI-library inputs changed | An affected component compiles, renders and responds to interaction; expected styles survive development rebuild and production output. | | Compiler plugins | Lingui or another SWC plugin is configured | The actual bundler-hosted compiler transforms a representative input; translated output or the equivalent feature works in development and production. Run catalog extraction/generation when used. | From ec872234aeaaf30abf6182c7200c4febbd204b45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nacho=20Codo=C3=B1er?= Date: Tue, 29 Sep 2026 19:35:49 +0200 Subject: [PATCH 07/10] Fix fast-uri dependency audit failures --- package.json | 2 +- pnpm-lock.yaml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 2533576..01c65b1 100644 --- a/package.json +++ b/package.json @@ -28,7 +28,7 @@ }, "pnpm": { "overrides": { - "fast-uri@3": "3.1.6", + "fast-uri@3": "3.1.7", "js-yaml@3": "3.15.2" } }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d2f3c34..4c57e1b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,7 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: - fast-uri@3: 3.1.6 + fast-uri@3: 3.1.7 js-yaml@3: 3.15.2 importers: @@ -423,8 +423,8 @@ packages: fast-fifo@1.3.2: resolution: {integrity: sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==} - fast-uri@3.1.6: - resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==} + fast-uri@3.1.7: + resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} globalthis@1.0.4: resolution: {integrity: sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==} @@ -789,7 +789,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.6 + fast-uri: 3.1.7 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -919,7 +919,7 @@ snapshots: fast-fifo@1.3.2: {} - fast-uri@3.1.6: {} + fast-uri@3.1.7: {} globalthis@1.0.4: dependencies: From 72a457b49c9d5a6e5821d32a4ea9cf5d31a85280 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nacho=20Codo=C3=B1er?= Date: Tue, 29 Sep 2026 19:43:21 +0200 Subject: [PATCH 08/10] Prepare v1.1.0-beta.3 catalog release --- .claude-plugin/plugin.json | 2 +- .codex-plugin/plugin.json | 2 +- CHANGELOG.md | 25 ++++++++++ docs/releases/v1.1.0-beta.3.md | 86 ++++++++++++++++++++++++++++++++++ 4 files changed, 113 insertions(+), 2 deletions(-) create mode 100644 docs/releases/v1.1.0-beta.3.md diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 774a04c..3086e70 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -2,7 +2,7 @@ "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json", "name": "meteor", "displayName": "Meteor", - "version": "1.1.0-beta.1", + "version": "1.1.0-beta.3", "description": "Build, migrate, debug, test, secure, and deploy Meteor 3 applications.", "author": { "name": "Meteor", diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json index 19b4248..66f3154 100644 --- a/.codex-plugin/plugin.json +++ b/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "meteor", - "version": "1.1.0-beta.1", + "version": "1.1.0-beta.3", "description": "Build, migrate, debug, test, secure, and deploy Meteor 3 applications.", "author": { "name": "Meteor", diff --git a/CHANGELOG.md b/CHANGELOG.md index c11298d..05d7342 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,30 @@ # Changelog +## 1.1.0-beta.3 - 2026-09-29 + +Cumulative Meteor 3.6 guidance verified through `3.6-beta.3`. The catalog +retains 17 skills and its earlier Meteor 3 compatibility branches. + +### Updated + +- Prepare retained local data and supported hosts before MongoDB 8 startup; + distinguish external databases, cache resets and database recovery. +- Update Rspack dependency pairings, architecture-specific app/test entries, + ignore rules and relocated workspace command checks. +- Correct native TypeScript declaration recovery and subscription handle types. +- Add focused Mongo/DDP, OAuth, Cordova, cache and instrumentation diagnostics. +- Keep the beta guidance within the existing skills, with stable 3.6 + consolidation recorded in the maintenance handoff. + +### Maintenance + +- Fix CI's dependency audit by updating the `fast-uri@3` override to 3.1.7 for + [GHSA-qw65-cvwx-89v3](https://github.com/advisories/GHSA-qw65-cvwx-89v3) and + [GHSA-58mr-gqgx-xq4g](https://github.com/advisories/GHSA-58mr-gqgx-xq4g). +- Version both plugin manifests as `1.1.0-beta.3`. +- Record source evidence, acceptance outcomes and publication gates in the + [release handoff](docs/releases/v1.1.0-beta.3.md). + ## 1.1.0-beta.1 - 2026-09-23 Catalog maintenance for Meteor 3.6-beta.1. The catalog grows to 17 skills; diff --git a/docs/releases/v1.1.0-beta.3.md b/docs/releases/v1.1.0-beta.3.md new file mode 100644 index 0000000..c442ac6 --- /dev/null +++ b/docs/releases/v1.1.0-beta.3.md @@ -0,0 +1,86 @@ +# 1.1.0-beta.3 release handoff + +Independent catalog beta containing cumulative Meteor 3.6 guidance verified +through beta.3. The user explicitly selected catalog version `1.1.0-beta.3`. +This preparation does not publish a tag or request a Meteor changelog change. + +## Candidate and branch + +| Item | Value | +|---|---| +| Repository | `meteor/agent-skills`, public | +| Branch / existing release PR | `release/v1.1.0-beta.0-installation` / [#23](https://github.com/meteor/agent-skills/pull/23), open | +| `AGENT_SKILLS_CANDIDATE_SHA` | `ec872234aeaaf30abf6182c7200c4febbd204b45`, freshly fetched and checked out cleanly | +| Candidate CI | [Validate run 36606656590](https://github.com/meteor/agent-skills/actions/runs/36606656590), passed | +| Content commit | `145bb91f382cce8a078e390d915331ffe31e71b0` | +| Source context | Meteor `release/METEOR@3.6-beta.3`, `65b995360f8445a7e4c098eca02b83966dda141f` | +| Previous catalog tag | `v1.1.0-beta.1` | +| Planned version / tag | `1.1.0-beta.3` / `v1.1.0-beta.3`; tag does not yet exist | +| Publish commit | Resolve the reviewed preparation head before tagging; no publish commit/tag has been selected | + +The publishing skill was read from the clean candidate checkout. Preparation +changes only both plugin versions, the changelog and this handoff. The +candidate already contains the CI dependency fix. Existing uncommitted README, +beta.1 publication records and user artifacts remain outside this candidate. +Keep this PR open and unmerged through beta publication. + +## Content and CI correction + +The [pre-edit audit](../../audits/skill-gaps/2026-09-29-meteor-3.6-beta.3.md) +records ten confirmed findings. The +[maintenance review](../maintenance/2026-09-29-meteor-3.6-beta.3.md) records +their implementation across twelve existing skills, the editorial reduction, +25 new passing acceptance prompts, four existing version-boundary cases and +eight passing focused reruns. Classifications and routing remain unchanged; +there is no separate beta skill. The review also records stable 3.6 cleanup. + +[CI run 36605798565](https://github.com/meteor/agent-skills/actions/runs/36605798565) +failed at `pnpm audit --audit-level moderate`. Two advisories affected the +`fast-uri@3.1.6` override used by AJV. Commit `ec87223` raises only that +override and its lockfile resolution to 3.1.7; it does not weaken the audit +threshold or change distributed skill content. The next candidate CI passed. + +## Preparation verification + +| Check | Outcome | +|---|---| +| Repository | Frozen install, skill/plugin validation, link check, catalog write/check and all 33 tests passed | +| Dependency audit | No known vulnerabilities reported; CI threshold remains moderate | +| Release versions | Both manifests are `1.1.0-beta.3`; tag/version consistency checked | +| Claude manifests | Strict marketplace and plugin validation passed | +| Codex manifest | Last available upstream plugin-creator validator passed; current installed CLI loaded and installed the plugin | +| Local Codex plugin | All 17 skills, 115 files and the manifest match source | +| Local Claude plugin | All 17 skills, 115 files and the manifest match source | +| Individual skill | Skills CLI installed `meteor-cli-installation` in a clean project; all skill files and linked database reference match source | +| Archives | All 17 ZIPs contain exactly 115 source-matching files; maintenance evidence excluded; CLI ZIP extracted with its references intact | +| Fresh installed-plugin conversations | Codex 0.158.0 loaded its cached plugin; Claude Code 2.1.252 loaded the local marketplace plugin. Both read the CLI skill, database reference and beta.3 manifest and preserved backup, pre-upgrade FCV preparation, stop/update order and recovery limits | +| Preparation commit CI | Confirm the exact PR head before publication | +| Exact-tag installs and GitHub assets | Pending publication; local checks do not prove remote availability | + +Installation tests use disposable profiles/projects; user plugin settings stay +unchanged. Conversation tests mount service credentials read-only without +printing them and restrict the task to installed skill/reference/manifest reads. + +OpenAI [removed the bundled plugin-creator skill](https://github.com/openai/codex/commit/9db8162d658100bbf0a5a151996f9c3396ff1791). +The validator check therefore uses its last available revision, +`985cf47a4eb6084b2ff6b30ebdb1216acda85bb4`, alongside repository validation and +actual Codex CLI installation. It is not described as a current bundled tool. + +No retained database was upgraded, and no new old-browser, Cordova device, +live OAuth or production deployment certification is claimed. Source review +and guidance cases are not full upstream Meteor suite execution. + +## Remaining publication steps + +1. Record outside-contributor acceptance of the affected high-risk cases, or + an explicit maintainer exception for this beta. `AGENTS.md` requires that + contributor review; agent-run checks do not satisfy it. Earlier beta + exceptions do not extend to beta.3. +2. Obtain publication authorization, confirm the exact preparation head and + its green CI, then resolve `AGENT_SKILLS_PUBLISH_SHA` on this existing PR. +3. Verify the candidate-to-publish diff, tag that commit as `v1.1.0-beta.3` + and push the tag. Keep the release PR open and unmerged. +4. Confirm the GitHub prerelease and all 17 ZIP assets, then test exact-tag + Codex, Claude Code and Skills CLI installations against the tagged files. +5. Update published installation links and results on this same branch; + preserve the immutable tag. Do not announce unverified remote installs. From ac363f30a99f88c239f9fd0b704ce3563d469e03 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nacho=20Codo=C3=B1er?= Date: Tue, 29 Sep 2026 20:32:17 +0200 Subject: [PATCH 09/10] Record verified v1.1.0-beta.3 publication --- README.md | 16 ++++++++-------- docs/releases/v1.1.0-beta.3.md | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 77bee86..99a49e0 100644 --- a/README.md +++ b/README.md @@ -2,14 +2,14 @@ Agent Skills for AI assistants helping developers build, debug, migrate, and operate **Meteor 3 applications**. -> Status: beta. Sixteen Meteor 3 skills are available in the current catalog. +> Status: beta. Seventeen Meteor 3 skills are available in the current catalog. See [the changelog](./CHANGELOG.md) for additions and updates. -[Version 1.1.0-beta.0](https://github.com/meteor/agent-skills/releases/tag/v1.1.0-beta.0) -is published for Meteor `3.6-beta.0`, building on `v1.0.0-beta.3` while keeping -earlier Meteor 3 compatibility branches. See the -[comparison and verification handoff](./docs/releases/v1.1.0-beta.0.md). +[Version 1.1.0-beta.3](https://github.com/meteor/agent-skills/releases/tag/v1.1.0-beta.3) +updates MongoDB upgrade preparation, Rspack, TypeScript and runtime guidance +through Meteor `3.6-beta.3`, preserving earlier Meteor 3 compatibility branches. +See the [verification handoff](./docs/releases/v1.1.0-beta.3.md). ## Install @@ -30,7 +30,7 @@ To test a specific prerelease, pin the marketplace checkout to its repository tag before installing: ```bash -codex plugin marketplace add meteor/agent-skills --ref v1.1.0-beta.0 +codex plugin marketplace add meteor/agent-skills --ref v1.1.0-beta.3 codex plugin add meteor@meteor ``` @@ -47,7 +47,7 @@ To test a specific prerelease, append its repository tag to the marketplace source: ```bash -claude plugin marketplace add meteor/agent-skills@v1.1.0-beta.0 +claude plugin marketplace add meteor/agent-skills@v1.1.0-beta.3 claude plugin install meteor@meteor ``` @@ -61,7 +61,7 @@ Meteor plugin. To install this exact beta from your project directory: ```bash -npx skills@latest add 'meteor/agent-skills#v1.1.0-beta.0' +npx skills@latest add 'meteor/agent-skills#v1.1.0-beta.3' ``` The tag pins the skill contents; `@latest` selects the installer. Reinstalling diff --git a/docs/releases/v1.1.0-beta.3.md b/docs/releases/v1.1.0-beta.3.md index c442ac6..69a2ddb 100644 --- a/docs/releases/v1.1.0-beta.3.md +++ b/docs/releases/v1.1.0-beta.3.md @@ -4,6 +4,9 @@ Independent catalog beta containing cumulative Meteor 3.6 guidance verified through beta.3. The user explicitly selected catalog version `1.1.0-beta.3`. This preparation does not publish a tag or request a Meteor changelog change. +Preparation entries below preserve the pre-publication state. Final outcomes +are recorded under [Publication verification](#publication-verification). + ## Candidate and branch | Item | Value | @@ -84,3 +87,33 @@ and guidance cases are not full upstream Meteor suite execution. Codex, Claude Code and Skills CLI installations against the tagged files. 5. Update published installation links and results on this same branch; preserve the immutable tag. Do not announce unverified remote installs. + +## Publication verification + +Published on 2026-09-29 as +[`v1.1.0-beta.3`](https://github.com/meteor/agent-skills/releases/tag/v1.1.0-beta.3), +a GitHub prerelease. After the pending outside-contributor requirement was +presented, the maintainer instructed: "Publish the new skills, are they ready?" +That instruction authorizes publication and is recorded as the maintainer +exception for this beta. No outside-contributor acceptance is claimed. + +| Item | Verified outcome | +|---|---| +| Content candidate | `ec872234aeaaf30abf6182c7200c4febbd204b45` | +| Publish commit and immutable tag target | `72a457b49c9d5a6e5821d32a4ea9cf5d31a85280` / `v1.1.0-beta.3` | +| Candidate-to-publish diff | Only both plugin versions, changelog and this handoff | +| Clean publish-commit checks | Frozen install, validation, links, catalog check, 33 tests, dependency audit, ZIP build and both client manifest validators passed; publishing skill reread from this exact commit | +| Exact publish-commit CI | [Validate run 36607573654](https://github.com/meteor/agent-skills/actions/runs/36607573654) passed | +| Tag publication | [Publish run 36612976694](https://github.com/meteor/agent-skills/actions/runs/36612976694) passed; both manifests match `1.1.0-beta.3` | +| Remote Codex plugin | Codex 0.158.0 installed from the exact tag; all 17 skills, 115 files and manifest match the tag | +| Remote Claude plugin | Claude Code 2.1.252 installed from the exact tag; all 17 skills, 115 files and manifest match the tag | +| Remote Skills CLI | `npx skills@latest add 'meteor/agent-skills#v1.1.0-beta.3' --agent codex --copy --yes` installed exactly the 17 published skills; all 115 files match the tag | +| Published ZIPs | All 17 assets downloaded; every archived file matches the tag byte for byte, 115 files total; maintenance files excluded; CLI ZIP extracted with its database reference intact | +| Fresh installed-plugin conversations | Both clients loaded the cached CLI skill, database reference and manifest, reported `1.1.0-beta.3`, and preserved host/target checks, backup, FCV 7 preparation under MongoDB 7, stop/update order and recovery limits | +| Post-publication records | README installation examples and this handoff updated on the same release branch; PR #23 remains open and unmerged; tag remains at the publish commit | + +Disposable profiles and projects isolated remote installation checks from the +user's installed plugins. The scope and platform limitations in Preparation +verification still apply. Stable Meteor 3.6 consolidation remains tracked in +the maintenance review; this beta does not claim stable release certification +or request a Meteor changelog entry. From bf68f42f84fdf6d32fe39434ee994afde7e2c3b9 Mon Sep 17 00:00:00 2001 From: italo jose Date: Wed, 7 Oct 2026 11:52:15 -0300 Subject: [PATCH 10/10] Update skills for Meteor 3.6 RC and fix audit dependencies --- .../skill-gaps/2026-10-07-meteor-3.6-rc.0.md | 183 ++++++++++++++++++ package.json | 8 +- pnpm-lock.yaml | 55 +++--- scripts/frontmatter.mjs | 8 + scripts/generate-catalog.mjs | 4 +- scripts/validate-skills.mjs | 6 +- skills/meteor-accounts/SKILL.md | 17 +- .../meteor-accounts/references/eval-cases.md | 36 ++++ .../references/http-only-cookies.md | 36 ++++ .../references/passwordless-requests.md | 57 ++++++ .../references/users-collection.md | 54 ++++++ skills/meteor-cli-installation/SKILL.md | 6 +- .../references/eval-cases.md | 18 ++ .../references/installation-and-path.md | 21 +- .../references/reinstall-decision.md | 1 + .../references/releases-reset-reinstall.md | 31 +++ skills/meteor-debugging/SKILL.md | 2 +- .../references/build-debugging.md | 22 +++ .../meteor-debugging/references/eval-cases.md | 12 ++ .../references/logs-and-instrumentation.md | 36 ++++ skills/meteor-deployment/SKILL.md | 10 +- skills/meteor-deployment/references/docker.md | 4 +- .../references/eval-cases.md | 8 +- skills/meteor-modern-build-stack/SKILL.md | 53 +++-- .../references/architecture-entries.md | 80 ++++++++ .../references/eval-cases.md | 24 +++ .../references/meteor-3.6-workspaces.md | 38 ++-- .../references/native-package-types.md | 52 +++++ .../references/rspack-config.md | 41 +++- skills/meteor-mongo-minimongo/SKILL.md | 11 +- .../references/eval-cases.md | 6 + skills/meteor-react/SKILL.md | 2 +- .../references/build-refresh-and-testing.md | 6 +- skills/meteor-react/references/eval-cases.md | 6 + skills/meteor-security/SKILL.md | 32 ++- .../meteor-security/references/eval-cases.md | 6 + skills/migrate-to-meteor-3/SKILL.md | 15 +- .../references/eval-cases.md | 11 +- .../references/other-breaking-changes.md | 3 +- .../references/typescript-migration.md | 31 ++- skills/migrate-to-rspack/SKILL.md | 39 ++-- .../references/eval-cases.md | 6 + .../references/rspack-2-upgrade.md | 18 +- .../references/validation-matrix.md | 2 +- test/validate-skills.test.mjs | 26 +++ 45 files changed, 979 insertions(+), 164 deletions(-) create mode 100644 audits/skill-gaps/2026-10-07-meteor-3.6-rc.0.md create mode 100644 scripts/frontmatter.mjs create mode 100644 skills/meteor-accounts/references/passwordless-requests.md create mode 100644 skills/meteor-accounts/references/users-collection.md create mode 100644 skills/meteor-modern-build-stack/references/architecture-entries.md create mode 100644 skills/meteor-modern-build-stack/references/native-package-types.md diff --git a/audits/skill-gaps/2026-10-07-meteor-3.6-rc.0.md b/audits/skill-gaps/2026-10-07-meteor-3.6-rc.0.md new file mode 100644 index 0000000..7f6a6c2 --- /dev/null +++ b/audits/skill-gaps/2026-10-07-meteor-3.6-rc.0.md @@ -0,0 +1,183 @@ +# Meteor 3.6-rc.0 catalog follow-up + +## Run context + +```text +Agent-skills target ref: origin/main, fetched twice before implementation +Agent-skills revision: 09d39dcd5a80a81957df84a7c837702ef95d1e80; clean at audit start +Meteor remote: https://github.com/meteor/meteor.git +Meteor branch: release-3.6 +Meteor revision: 581ffaec659ba73b8633b9876dbf1861b8657013; approved release preparation and documentation changes present +Meteor release context: 3.6-rc.0, pre-publication +Audit mode: incremental release follow-up +Comparison: Meteor 7bd27aafe325137f488580cb910a5a1a7f92d373..581ffaec659ba73b8633b9876dbf1861b8657013, plus approved RC documentation/version overlays; release discovery also uses devel...release-3.6 +Previous audit report: audits/skill-gaps/2026-09-11-v1.1.0-beta.0-publication.md, committed in 490e7f0d5d72c4dd3344acdcdc253cda6e2fa156 +Previous Meteor revision: 7bd27aafe325137f488580cb910a5a1a7f92d373 +``` + +The previous report pins catalog `ce38bf45823c25ea4a0efcb1a429c6932f18a58e`. +All 108 distributable files across 16 skills are unchanged between that catalog +and the current audit base. This follow-up inventories every owner and reviews +claims affected by the Meteor comparison. Unaffected claims retain the prior +audit evidence; external APIs were not all revalidated from scratch. + +This is source review before Meteor publication, not a runtime certification of +an installed RC. Approved overlays include the RC package versions, Rspack +dependency pairing, changelog, and four documentation corrections. Refresh the +audit against the exact clean Meteor release commit before publishing a catalog +tag. Preserve this report as the original maintenance input. + +## Source coverage + +- Canonical release entry: `v3-docs/docs/generators/changelog/versions/3.6.0.md`. +- Reviewed docs-gap report: `docs/plans/2026-10-07-docs-gap-3.6-rc.0.md`. +- Release discovery: 61 merged PRs targeting `release-3.6`, milestone and linked + source/continuation issues reconciled in the Meteor release review. +- Approved docs overlays: `about/install.md`, `packages/accounts-passwordless.md`, + `tutorials/accounts/accounts.md`, and the Rspack bundler integration guide. +- Incremental source scope: `v3-docs`, `packages`, `tools`, `npm-packages`, and + release scripts, including 557 changed files in the comparison. +- Primary implementation and test symbols are listed in the evidence ledger. +- Official published RC notes and tagged RC installation tests: not applicable + yet. No additional product PRs are proposed by this audit. + +## Summary + +| Classification | Confirmed maintenance findings | +|---|---| +| Partial | 10 | +| Outdated | 1 | +| Overlap | 0 | +| Candidate | 0 | +| Uncertain | 0 | + +Covered and documentation-only changes are recorded separately below. The +counts describe maintenance findings, not the number of skills or claims. + +## Release blockers + +Before publishing a catalog advertised as aligned with this RC, resolve F01, +F02, F03, F05, F08, and F09. Incorrect runtime advice, unsafe database recovery, +or missing Accounts and architecture boundaries can break deployments, +authentication, or supported browser programs. This does not authorize Meteor +publication or claim that source review replaces release testing. + +## Evidence ledger + +Paths are relative to the Meteor repository at the revision above. Version and +documentation overlays are explicitly identified instead of attributed to HEAD. + +| ID | Documentation | Implementation and regression evidence | +|---|---|---| +| E01 | `about/install.md`; `tutorials/deployment/deployment.md` | `scripts/build-dev-bundle-common.sh`: Node 26.10.0; historical tags 3.0=20, 3.1-3.4=22, 3.5=24. | +| E02 | `about/install.md`, Updating an existing local database (approved RC command overlay) | Bundled MongoDB 8.0.29; `scripts/generate-dev-bundle.sh` platform distributions. Check FCV on MongoDB 7 before opening its data with 8. | +| E03 | `packages/accounts-express.md`, HttpOnly Cookies | `accounts-base/server_http_cookies.js`: trusted origins, JSON/size/token validation, Strict cookie, endpoint limiter; `accounts_cookie_server_tests.js`: Strict, origin, invalid/revoked/expired tokens, rate limits. | +| E04 | `packages/accounts-passwordless.md` and Accounts tutorial (approved validation/callback overlays) | `passwordless_server.js`: request payload validation; `accounts_server.js`: default rule includes `requestLoginTokenForUser`; `passwordless_method_tests.js` and Accounts default-rule test. | +| E05 | Accounts tutorial, Choosing a users collection and profile policy (approved overlay) | `accounts_common.js`: collection identity/change callbacks; `accounts_server.js`: collection setup and validators guard; `accounts_collection_tests.js`: secondary instance, same-name identity, current publication collection, indexes without mutation methods. | +| E06 | `cli/using-core-types.md` | `tools/cli/commands.js`: explicit `types` command; `tools/isobuild/types-generator.js`; `tools/tests/typescript.js`: ordinary builds, direct/transitive zodern, strict failure. | +| E07 | `packages/instrumentation.md` | `packages/instrumentation`: read-only events/context/previews; `instrumentation_tests.js`: correlation, Accounts redaction, detached previews, listener/projector errors. | +| E08 | Rspack guide, Legacy and Architecture-Specific Entry Points | `rspack/lib/architectures.js`, npm integration config (legacy target/runtime); `tools/e2e-tests/legacy.test.js` and `apps/legacy` fixture. | +| E09 | Rspack guide and approved RC version preparation | `rspack/lib/constants.js` (approved npm RC overlay); `rspack/package.js`, `tools-core/package.js` (approved Atmosphere RC overlays). | +| E10 | Rspack guide, native binding cache | Installed SWC native carrier behavior and [upstream carrier documentation](https://github.com/swc-project/swc/blob/main/docs/native-addon-carriers.md), reviewed 2026-10-07: absolute owned cache, executable filesystem. This upstream reference is live, not pinned Meteor history. | +| E11 | `performance/change-streams-observer-driver.md` | `mongo/mongo_connection.js`: `hasWhere`/`hasGeoQuery` eligibility rejection; `changestream_observe_driver_tests.js`: cursorSupported rejects `$where` and `$near`. | + +Documentation paths above are under `v3-docs/docs/` unless prefixed otherwise. +Package implementation paths are under `packages/` unless prefixed otherwise. + +## Maintenance findings + +| Finding | Classification / priority | Owner and user impact | Existing evaluation | Required change and acceptance | +|---|---|---|---|---| +| F01 | Outdated / P1 | Deployment and Meteor migration: `3.5+ -> Node 24` selects a wrong RC runtime. E01. | Deployment case 5 and migration runtime reference. | Bound 3.5 to Node 24, add 3.6 Node 26, use actual tool/bundle version. Check 3.6 and retained 3.4/3.5 paths. | +| F02 | Partial / P1 | CLI installation and migration: preserved local data still needs MongoDB 7 FCV/platform preparation. E02. | CLI case 18 and reset/reinstall decision flow. | Backup and check/set FCV 7.0 on the existing MongoDB 7 primary before stopping/updating. Preserve external DB independence and earlier-release/platform decisions; reject reset-as-migration. | +| F03 | Partial / P1 | Accounts: cookie recipes omit Strict navigation and endpoint validation/error policy. E03. | Accounts cases 3, 12-14. | Version-gate the hardened RC pairing, JSON/origin/token checks, 401 versus transient/429, proxy address and allowed origins. Keep 3.5.2's narrower contract. | +| F04 | Partial / P2 | Accounts and Security: repeated passwordless requests have a new default limiter and malformed payloads are rejected. E04. | Accounts case 8. | Preserve callback wrapper/string convenience versus direct DDP object shape. Handle validation/rate errors and keep the default rule before designing additional abuse controls. | +| F05 | Partial / P1 | Accounts and Security: collection switching requires early setup and safe client-write policy. E05. | No custom collection case; generic advice removes all deny rules. | Separate existing config API from the RC fixes. Preserve secondary instance isolation and same-name identity; keep protective deny rules until equivalent method-only policy exists. Check indexes without mutation methods. | +| F06 | Partial / P2 | Modern Build Stack and Meteor migration: mandatory zodern advice omits explicit native generation. E06. | Migration case 23. | Preserve existing provider by default; offer native opt-in on 3.6 with barrel plus per-package paths and explicit local generation/check. Check direct/transitive zodern, older release, failure and JS-only boundaries. | +| F07 | Partial / P2 | Debugging: generic instrumentation promise omits supported server lifecycle events. E07. | Debugging cases 2, 14. | Optional server-only listeners, correlation, stop handle and redacted bounded observations; preserve manual/older fallback. No APM backend or broad capture promise. | +| F08 | Partial / P1 | Modern Build Stack and Rspack migration: shared entries omit per-architecture compilation/test decisions. E08. | Legacy validation-matrix row only. | Entry/test maps, config callback flags, browser program selection, legacy reload/ES5 boundaries; prove correct program and actual suites, preserve shared-client/older fallback. | +| F09 | Partial / P1 | Modern Build Stack, Rspack migration and React: historical beta pairing has no RC target. E09. | Build case 22 and Rspack cases 23-28. | Add prepared RC pairing/minimums, retain historical beta examples and opt-out/manager ownership. Reject unreleased stable integration and mismatched older release. | +| F10 | Partial / P2 | Debugging and Modern Build Stack: build-cache cleanup cannot repair SWC native cache ownership/noexec. E10. | Debugging case 28 concerns a different temporary-cache failure. | Condition on resolved SWC/error; use an absolute writable owned cache on an executable filesystem, retain integrity checks and distinguish build caches. | +| F11 | Partial / P2 | Mongo/Minimongo: change-stream eligibility lacks explicit `$where`/`$near` exclusions. E11. | Mongo cases 5, 7. | Explain driver fallback for an otherwise valid query, including oplog limitations; retain pre-3.5 behavior and avoid unnecessary database/query rewrite. | + +## Skill claim matrix + +Every catalog owner is inventoried. This incremental matrix records all affected +decision families. Unaffected distributable claims use the unchanged prior +catalog's committed audit and evaluation evidence. + +| Skill | Distributable surface / affected claim | Evidence / status | Evaluation coverage | +|---|---|---|---| +| meteor-accounts | SKILL cookie/passwordless/setup decisions; cookie reference; users collection policy | E03-E05 / Partial | Cases 3, 8, 12-14 plus new endpoint, collection and validation boundaries. | +| meteor-blaze | Scaffold, async helpers, lifecycle, PWA and HMR ownership | Prior baseline / Covered; no new Blaze API decision identified | Existing async/helper and HMR cases retained. | +| meteor-cli-installation | Host prerequisites, project-release update, local Mongo recovery | E02 / Partial | Local-data and earlier-platform cases required. | +| meteor-community-packages | Core/community adoption, package provenance, independent floors | Prior baseline / Covered | Current package selection/handoff cases retained. | +| meteor-debugging | logs-and-instrumentation; build-debugging cache diagnosis | E07, E10 / Partial | Server correlation/older fallback and distinct native-cache case required. | +| meteor-deployment | SKILL runtime table; Docker reference | E01 / Outdated | Case 5 correction and explicit RC/runtime versus older release. | +| meteor-methods | Method async/authorization/stub semantics | Prior baseline and method regression fixes / Covered | Existing guarded and callback/async cases retained. | +| meteor-modern-build-stack | Runtime pairing, config flags/entries, native types, SWC cache | E06, E08-E10 / Partial | Provider choice/failure, architecture and RC dependency cases required. | +| meteor-mongo-minimongo | Reactive driver eligibility and fallback | E11 / Partial | Supported-query fallback and earlier driver boundary required. | +| meteor-native | Architecture build/handoff and HCP boundaries | E08, prior baseline / Covered by native ownership; general entry details owned by build skills | Existing native-versus-backend and HCP cases retained. | +| meteor-pubsub | Cursor publication, readiness, data authority, manual DDP fields | Prior baseline and fieldless update regressions / Covered | Existing cursor and manual publication cases retained. | +| meteor-react | build-refresh-and-testing dependency/React Compiler pairing | E09 / Partial | Current RC pairing with older React/compiler fallback. | +| meteor-security | allow/deny transition, default passwordless limiter | E04-E05 / Partial | Protective profile denial and default-rule preservation required. | +| meteor-testing | Mocha ownership, client suites, async tests and readiness | E08 and prior baseline / Covered; architecture-specific entry details owned by build skills | Existing test-mode/client suite cases retained. | +| migrate-to-meteor-3 | Runtime/local DB preparation; TypeScript provider selection | E01-E02, E06 / Outdated and Partial | Retained zodern case 23 plus native and local migration boundaries. | +| migrate-to-rspack | Pairing, entries, compiler/legacy/runtime verification | E08-E09 / Partial | Add RC architecture/immutable install cases; keep historical beta and old helper cases. | + +## Evaluation gaps + +Affected cases must distinguish current support from earlier behavior, without +asserting that every Meteor 3 app has the new package contract. Add the smallest +coherent cases for the findings above and run each affected prompt in a fresh +conversation with grading criteria withheld until the response is complete. +Static validation does not substitute for these behavioral runs or a deployed +RC application test. Record outcomes in the PR, outside distributable content. + +## Uncertain findings and limitations + +No uncertain finding is authorized for implementation. Native cache behavior +is tied to the actual SWC distribution, not a guessed introduction version. +The prepared RC has not been publicly installed as part of this audit. Package +versions are independently resolved; stable API floors must not be inferred +only from the framework label. + +Current installation docs contain a Node 20 row for Meteor 3.3, while the +historical release tag bundles Node 22.16.0. The catalog's existing Node 22 +row is supported by the tag. Correcting that separate Meteor documentation +discrepancy is outside this catalog PR. + +## No-action findings + +- `.meteorignore` negation/precedence fixes restore the catalog's already stated + ignore semantics; generated handoff must remain visible. +- Shell completion is useful CLI documentation but adds no installation or + recovery decision owned by this catalog. +- Babel source-map reentry, IndexedDB, OAuth popup, DDP fieldless updates, + workspace executables and temporary cleanup fixes do not require inventing + new app workarounds or changing supported public contracts. +- Rspack 2 fundamentals, PWA/workspaces, React Compiler ownership, npm package + shrinkwrap and prior cache/HMR fixes were covered in the beta audit. F09 + extends the active pairing without removing that historical evidence. +- No new skill, routing classification, bundle or minimum catalog range change + is proposed. + +## Recommended next actions + +Apply F01-F11 within existing owners, preserve earlier-release branches, run +the affected behavior cases and complete repository/link/catalog/test/ZIP +validation. Open a catalog PR against the synchronized main. Review high-risk +cases with an outside contributor before merging, as required by AGENTS.md. +Propose an independent catalog beta version separately; do not publish in this +phase. Reaudit the exact Meteor release commit before a later catalog tag. + +## Maintenance handoff + +The user approved all eleven confirmed findings and explicitly authorized a PR +with these changes on 2026-10-07. The second default-branch fetch still resolved +to `09d39dcd5a80a81957df84a7c837702ef95d1e80`; implementation uses +`codex/meteor-3.6-rc.0-agent-skills` from that base. The user also authorized +isolated read-only agents for behavioral evaluations. No uncertain finding, +new skill, classification change, package publication or Meteor release action +is authorized by this handoff. Implementation and case results belong in the +PR; preserve this original report without overwriting its audit conclusions. diff --git a/package.json b/package.json index 2533576..65a9791 100644 --- a/package.json +++ b/package.json @@ -24,12 +24,14 @@ "ajv-formats": "^3.0.1", "archiver": "^8.0.0", "gray-matter": "^4.0.3", - "yauzl-promise": "^4.0.0" + "yauzl-promise": "^4.0.0", + "js-yaml": "^4.3.2" }, "pnpm": { "overrides": { - "fast-uri@3": "3.1.6", - "js-yaml@3": "3.15.2" + "fast-uri@3": "3.1.8", + "js-yaml@3": "^4.3.2", + "brace-expansion@5": "5.0.12" } }, "license": "MIT" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d2f3c34..f4eb2d5 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,8 +5,9 @@ settings: excludeLinksFromLockfile: false overrides: - fast-uri@3: 3.1.6 - js-yaml@3: 3.15.2 + fast-uri@3: 3.1.8 + js-yaml@3: ^4.3.2 + brace-expansion@5: 5.0.12 importers: @@ -27,6 +28,9 @@ importers: gray-matter: specifier: ^4.0.3 version: 4.0.3 + js-yaml: + specifier: ^4.3.2 + version: 4.3.2 yauzl-promise: specifier: ^4.0.0 version: 4.0.0 @@ -288,8 +292,8 @@ packages: resolution: {integrity: sha512-fV1orZfsnPn9BaSByR/qE67rJCLJEy2Ox5bq7nJh+jquWaNh6Sfec75kJ2T6PtdGUbPQlrVoSVCEOa5SdiTQ1g==} engines: {node: '>=18'} - argparse@1.0.10: - resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==} + argparse@2.0.1: + resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==} assertion-error@2.0.1: resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==} @@ -354,8 +358,8 @@ packages: base64-js@1.5.1: resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==} - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} buffer-crc32@1.0.0: @@ -397,11 +401,6 @@ packages: resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==} engines: {node: '>= 0.4'} - esprima@4.0.1: - resolution: {integrity: sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==} - engines: {node: '>=4'} - hasBin: true - event-target-shim@5.0.1: resolution: {integrity: sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==} engines: {node: '>=6'} @@ -423,8 +422,8 @@ packages: fast-fifo@1.3.2: resolution: {integrity: sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==} - fast-uri@3.1.6: - resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==} + fast-uri@3.1.8: + resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} globalthis@1.0.4: resolution: {integrity: sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==} @@ -462,8 +461,8 @@ packages: isarray@1.0.0: resolution: {integrity: sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==} - js-yaml@3.15.2: - resolution: {integrity: sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true json-schema-traverse@1.0.0: @@ -525,9 +524,6 @@ packages: resolution: {integrity: sha512-1sbhsxqI+I2tqlmjbz99GXNmZtr6tKIyEgGGnJw/MKGblalqk/XoOYYFJlBzTKZCxx8kLaD3FD5s9BEEjx5Pyg==} engines: {node: '>=10'} - sprintf-js@1.0.3: - resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==} - streamx@2.25.0: resolution: {integrity: sha512-0nQuG6jf1w+wddNEEXCF4nTg3LtufWINB5eFEN+5TNZW7KWJp6x87+JFL43vaAUPyCfH1wID+mNVyW6OHtFamg==} @@ -789,7 +785,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.6 + fast-uri: 3.1.8 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -809,9 +805,7 @@ snapshots: - bare-buffer - react-native-b4a - argparse@1.0.10: - dependencies: - sprintf-js: 1.0.3 + argparse@2.0.1: {} assertion-error@2.0.1: {} @@ -855,7 +849,7 @@ snapshots: base64-js@1.5.1: {} - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -899,8 +893,6 @@ snapshots: es-errors@1.3.0: {} - esprima@4.0.1: {} - event-target-shim@5.0.1: {} events-universal@1.0.1: @@ -919,7 +911,7 @@ snapshots: fast-fifo@1.3.2: {} - fast-uri@3.1.6: {} + fast-uri@3.1.8: {} globalthis@1.0.4: dependencies: @@ -930,7 +922,7 @@ snapshots: gray-matter@4.0.3: dependencies: - js-yaml: 3.15.2 + js-yaml: 4.3.2 kind-of: 6.0.3 section-matter: 1.0.0 strip-bom-string: 1.0.0 @@ -953,10 +945,9 @@ snapshots: isarray@1.0.0: {} - js-yaml@3.15.2: + js-yaml@4.3.2: dependencies: - argparse: 1.0.10 - esprima: 4.0.1 + argparse: 2.0.1 json-schema-traverse@1.0.0: {} @@ -968,7 +959,7 @@ snapshots: minimatch@10.2.6: dependencies: - brace-expansion: 5.0.9 + brace-expansion: 5.0.12 normalize-path@3.0.0: {} @@ -1013,8 +1004,6 @@ snapshots: simple-invariant@2.0.1: {} - sprintf-js@1.0.3: {} - streamx@2.25.0: dependencies: events-universal: 1.0.1 diff --git a/scripts/frontmatter.mjs b/scripts/frontmatter.mjs new file mode 100644 index 0000000..309130c --- /dev/null +++ b/scripts/frontmatter.mjs @@ -0,0 +1,8 @@ +import matter from "gray-matter"; +import { load } from "js-yaml"; + +// gray-matter's default YAML engine still calls the removed v3 safeLoad API. +// Use v4's safe-by-default loader without changing gray-matter's global engines. +export function parseFrontmatter(raw) { + return matter(raw, { engines: { yaml: { parse: load } } }); +} diff --git a/scripts/generate-catalog.mjs b/scripts/generate-catalog.mjs index de1bd13..dff913a 100644 --- a/scripts/generate-catalog.mjs +++ b/scripts/generate-catalog.mjs @@ -5,7 +5,7 @@ import { readFileSync, writeFileSync, readdirSync } from "node:fs"; import { dirname, join, resolve } from "node:path"; import { fileURLToPath } from "node:url"; -import matter from "gray-matter"; +import { parseFrontmatter } from "./frontmatter.mjs"; const here = dirname(fileURLToPath(import.meta.url)); const repoRoot = resolve(here, ".."); @@ -39,7 +39,7 @@ function loadSkills(skillsRoot) { .filter((e) => e.isDirectory() && isPublishable(e.name)) .map((e) => { const raw = readFileSync(join(skillsRoot, e.name, "SKILL.md"), "utf8"); - const { data } = matter(raw); + const { data } = parseFrontmatter(raw); return { folder: e.name, frontmatter: data }; }); } diff --git a/scripts/validate-skills.mjs b/scripts/validate-skills.mjs index 8174a7c..196c9c6 100644 --- a/scripts/validate-skills.mjs +++ b/scripts/validate-skills.mjs @@ -6,7 +6,7 @@ import { existsSync, readFileSync, readdirSync } from "node:fs"; import { execFileSync } from "node:child_process"; import { dirname, join, basename, resolve } from "node:path"; import { fileURLToPath } from "node:url"; -import matter from "gray-matter"; +import { parseFrontmatter } from "./frontmatter.mjs"; import Ajv from "ajv/dist/2020.js"; import addFormats from "ajv-formats"; @@ -134,7 +134,7 @@ export async function validateMaintainerSkills({ let parsed; try { - parsed = matter(raw); + parsed = parseFrontmatter(raw); } catch (err) { findings.push({ code: "E_MAINTAINER_FRONTMATTER", @@ -345,7 +345,7 @@ export async function validateSkills({ } } - const parsed = matter(raw); + const parsed = parseFrontmatter(raw); const data = parsed.data; const body = parsed.content; diff --git a/skills/meteor-accounts/SKILL.md b/skills/meteor-accounts/SKILL.md index 02a44ae..57fd429 100644 --- a/skills/meteor-accounts/SKILL.md +++ b/skills/meteor-accounts/SKILL.md @@ -17,7 +17,7 @@ metadata: area: auth tagline: "Wire up authentication in Meteor 3 (accounts-password, OAuth providers, 2FA, passwordless, email verification)." bundle: ["fullstack"] - docs_synced_at: "2026-09-08" + docs_synced_at: "2026-10-07" license: MIT --- @@ -37,6 +37,11 @@ the client a resume token mapped to that document. 5. Token storage on the client? Default is Web Storage. Meteor 3.3+ supports an HttpOnly cookie flow; see the section below. +For a custom users collection, configure both runtimes before app reads or +validators. The 3.6 RC fixes collection setup and publication lookup; review +[collection identity and client-write policy](references/users-collection.md) +before removing protective profile rules. + ## Username + password ```javascript @@ -123,7 +128,9 @@ only when it is opted in too. A client-only setting can therefore produce an HTML response or 404 from later handlers. The `/set` body limit is 4096 bytes; larger requests return HTTP 413. See [cookie endpoint troubleshooting](references/http-only-cookies.md) for the -routes, version boundary, and diagnostic checks. +routes, version boundary, and diagnostic checks. The 3.6 RC pairing additionally +uses `SameSite=Strict`, validates origins/tokens and limits endpoint traffic; +treat an invalid session differently from a transient or rate-limit response. ## OAuth (Google example) @@ -220,8 +227,10 @@ Meteor.passwordlessLoginWithToken( Set `userCreationDisabled: true` for sign-in-only flows. Configure `tokenSequenceLength`, `loginTokenExpirationHours`, and the `Accounts.emailTemplates.sendLoginToken` template on the server. Treat the -token-request method as an abuse-sensitive endpoint and rate-limit repeated -requests. +token-request method as an abuse-sensitive endpoint. On the hardened 3.6 +pairing, retain the default token-request limiter, validate selector/options, +and handle callback errors; see [request policy](references/passwordless-requests.md). +Earlier packages need their existing explicit abuse controls. ## 2FA diff --git a/skills/meteor-accounts/references/eval-cases.md b/skills/meteor-accounts/references/eval-cases.md index c734f99..fae24df 100644 --- a/skills/meteor-accounts/references/eval-cases.md +++ b/skills/meteor-accounts/references/eval-cases.md @@ -136,3 +136,39 @@ Pass if the agent checks the package boundary, says those protections require the fixed package shipped with 3.5.2, and proposes a compatible upgrade. Fail if it enables cookies against the app's intent or assumes the new protections apply to every release with HttpOnly support. + +## Case 15: Strict cookie entry navigation and transient failures + +Prompt: "With accounts-base@3.4.0-rc360.0, the first request from an email link has no login cookie. We added httpOnlyCookieAllowedOrigins and credentials include, but it still happens. Refresh sometimes returns 429; should we erase credentials or retry immediately?" + +Pass if the agent explains SameSite=Strict first cross-site navigation and that allowed origins/credentials do not override it, adapts the entry flow, distinguishes invalid-cookie 401 from transient/429, and uses bounded delayed recovery without changing to Web Storage or weakening the cookie. + +## Case 16: Custom cookie set request + +Prompt: "Our accounts-base@3.4.0-rc360.0 cookie client POSTs a full profile and a token as text/plain to /_accounts/cookie/set from a different origin. The token may have expired. How do we diagnose the failure behind a reverse proxy?" + +Pass if the agent checks both runtime opt-in, trusted origin/ROOT_URL/Host, JSON content type, full 4096 UTF-8-byte payload and valid unexpired token, rejects logging credentials, and configures the actual proxy chain for client-address rate buckets. Fail if it replaces the core endpoint, bypasses token/size/origin validation or trusts arbitrary forwarded headers. + +## Case 17: Users collection identity and instance ownership + +Prompt: "In Meteor 3.6-rc.0 with accounts-base@3.4.0-rc360.0, configure appUsers for both runtimes. What happens if we configure the same name again or change a separate AccountsServer instance? Does this copy old users?" + +Pass if the agent configures early before application reads/validators, preserves same-name instance/validators and secondary-instance isolation from Meteor.users, and separates document migration from collection selection. Fail if it claims a live transactional switch or automatic copy. + +## Case 18: Users collection without client mutation methods + +Prompt: "Our custom Accounts users collection has defineMutationMethods false on the 3.6 RC pairing. Do we need to enable client writes for account indexes, or attach allow/deny validators to make setup work?" + +Pass if the agent keeps the method-only policy, says RC account indexes are still created, and avoids validators on a collection without mutation methods. Fail if it enables client writes to obtain indexes or silently applies this fixed setup to an older unresolved package. + +## Case 19: Passwordless validation and request throttling + +Prompt: "With accounts-passwordless@3.1.2-rc360.0 and accounts-base@3.4.0-rc360.0, direct DDP token requests use selector {$or:[{email:"a@example.com"}]} and await Accounts.requestLoginTokenForUser. We also retry too-many-requests immediately. Is the public wrapper still allowed to take a string selector and options.extra data for email templates? Can you correct this sign-in-only flow?" + +Pass if the agent uses exactly one nonempty id/username/email object for direct DDP, distinguishes the public string convenience and preserves supported options.extra with application validation, wraps the client callback rather than assuming a Promise, sets userCreationDisabled true, handles validation/rate errors and preserves the default five-per-ten-second per-method/connection rule. Fail if it forwards operators or disables the limiter. + +## Case 20: Older cookie contract + +Prompt: "Our app must remain on Meteor 3.5.2 with accounts-base@3.3.1. Can we assume the RC Strict cookie and endpoint origin/token/rate checks are already present? We have configured both runtimes." + +Pass if the agent retains that release and its server opt-in/4096-byte limit, distinguishes the later hardened pairing, and proposes a compatible upgrade only if those additional guarantees are required. Fail if it promises every RC protection or forces an unrequested provider/storage change. diff --git a/skills/meteor-accounts/references/http-only-cookies.md b/skills/meteor-accounts/references/http-only-cookies.md index b32228b..2acd770 100644 --- a/skills/meteor-accounts/references/http-only-cookies.md +++ b/skills/meteor-accounts/references/http-only-cookies.md @@ -29,6 +29,42 @@ handler. The final response depends on the application; it is not guaranteed to be HTTP 404. Do not enable cookies just to make a route probe return JSON when the application intentionally uses Web Storage. +## Hardened 3.6 cookie contract + +The 3.6 RC pairing uses `accounts-base@3.4.0-rc360.0`. Inspect the resolved +package before relying on this extension of the 3.5.2 contract; older packages +do not provide all of these checks. + +| Endpoint | Required decision | +|---|---| +| `POST /set` | Trusted origin, `Content-Type: application/json`, body at most 4096 UTF-8 bytes, valid unexpired resume token. A malformed payload is not a login. | +| `GET /refresh` | Explicitly cross-site requests are rejected. Invalid, expired or revoked cookies are cleared with HTTP 401 `invalid_cookie`. | +| `POST /clear` | Trusted origin; clears the login cookie. | + +All three endpoints share a per-client-address limit of 30 requests per ten +seconds by default; excess traffic gets HTTP 429 `rate_limited`. This is +separate from the DDP Accounts limiter. Configure server-only +`httpOnlyCookieAllowedOrigins` and `httpOnlyCookieRateLimit: { max, windowMs }` +only for a verified application need. Keep the limiter enabled; a documented +`false` option is not a routine retry fix. `ROOT_URL` and the request Host +supply trusted origins; check the real public URL and proxy handling instead +of adding a wildcard. Behind proxies, configure `HTTP_FORWARDED_COUNT` for +the actual chain so address buckets are correct without trusting arbitrary +forwarded headers. + +The cookie now uses `SameSite=Strict`. It is absent on an initial top-level +navigation from another site, even when the origin is allowed server-side. +Adapt cookie-protected first-request routes/entry flow rather than weakening +the cookie or moving credentials into Web Storage. `credentials: "include"` +does not override browser SameSite policy. + +A custom `/set` request must send the small JSON token payload with the proper +content type and origin, not a full user document. HTTP 401 is a session +validity failure; stop replaying invalid credentials and let the login flow +recover. A network/server failure or 429 is not proof the user logged out: +preserve credentials until validity is known, use a bounded delayed retry +where appropriate, and never create an immediate refresh loop. + ## Diagnose failures 1. Check resolved package versions, both runtimes' flags, the request method, diff --git a/skills/meteor-accounts/references/passwordless-requests.md b/skills/meteor-accounts/references/passwordless-requests.md new file mode 100644 index 0000000..3694f39 --- /dev/null +++ b/skills/meteor-accounts/references/passwordless-requests.md @@ -0,0 +1,57 @@ +# Passwordless request validation and errors + +For Meteor 3.6's hardened pairing (`accounts-passwordless@3.1.2-rc360.0` with +`accounts-base@3.4.0-rc360.0` for the RC), inspect both resolved packages before +selecting this behavior. Do not assume older packages provide the same schema +checks or default token-request limiter. + +`Accounts.requestLoginTokenForUser` is a client callback API, not a Promise API: + +```javascript +function requestToken(email) { + return new Promise((resolve, reject) => { + Accounts.requestLoginTokenForUser({ + selector: { email }, + userData: {}, + options: { userCreationDisabled: true }, + }, (error) => error ? reject(error) : resolve()); + }); +} + +try { + await requestToken(email); +} catch (error) { + if (error.error === "too-many-requests") { + // Show a cooldown instead of immediately resubmitting. + } else { + // Report validation or delivery failure without logging credentials. + } +} +``` + +The public wrapper accepts its documented string selector convenience and +normalizes it. A direct DDP `requestLoginTokenForUser` payload must use an +object selector with exactly one nonempty string `id`, `username`, or `email`. +Operator selectors, multiple keys, unsupported keys and empty values are +rejected before user lookup. Keep provided `userData` and `options` as objects; +core validation checks their container shape and the named lookup fields in +`userData`. Use a boolean `options.userCreationDisabled` for the intended signup +policy. Preserve supported `options.extra` data passed to token URLs/email +templates; it is not a boolean-only option whitelist. Application hooks still +validate custom data. A malformed request produces a 400 error, not delivery. + +With the hardened `accounts-base` pairing, the default Accounts rule includes +`requestLoginTokenForUser`: five calls per ten seconds, bucketed by method and +DDP connection. Keep it enabled. Consider additional controls for repeated +requests across connections or addresses from evidence; do not blindly stack +duplicate rules or disable the default to fix an error. The callback reports +rate errors; immediate retry loops increase abuse and do not deliver a token. + +After a successful request, use `Meteor.passwordlessLoginWithToken` with the +matching selector and received token. `userCreationDisabled: true` prevents +unknown addresses from creating users; configure the sender/template before +testing delivery. Earlier releases can keep their existing callback flow and +explicit abuse controls, or upgrade the coordinated packages. + +--- +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/packages/accounts-passwordless.md diff --git a/skills/meteor-accounts/references/users-collection.md b/skills/meteor-accounts/references/users-collection.md new file mode 100644 index 0000000..512eac3 --- /dev/null +++ b/skills/meteor-accounts/references/users-collection.md @@ -0,0 +1,54 @@ +# Choose the Accounts users collection + +`Accounts.config({ collection })` already exists on older releases. The Meteor +3.6 RC pairing (`accounts-base@3.4.0-rc360.0`) fixes collection switching, +publication lookup and setup. Inspect `.meteor/versions` before assuming those +fixes; on an older package reproduce the limitation or upgrade compatibly. + +Configure the selected collection in shared startup imports before application +modules read `Meteor.users` or register validators. Use the same name and policy +on both runtimes: + +```javascript +import { Accounts } from "meteor/accounts-base"; + +Accounts.config({ collection: "appUsers" }); +``` + +This selects the collection; it does not copy existing user documents. Plan +any data migration separately. On the default Accounts singleton, +`Accounts.users` and `Meteor.users` refer to the selected collection. Changing +a separately constructed Accounts instance must not redirect `Meteor.users`. +Reconfiguring with the same name preserves the existing collection instance +and its registered validators; do not expect a fresh empty validator set. + +## Client-write policy + +The RC setup adds account indexes to a custom collection. When its client +mutation methods are enabled, it also applies the default owner-only `profile` +update allowance. Do not interpret this as permission to store trusted roles, +authorization flags or other security decisions in `profile`. + +If the app blocks client profile writes, install protective denial on the +selected `Meteor.users` server-side before serving requests: + +```javascript +import { Meteor } from "meteor/meteor"; + +Meteor.users.deny({ update: () => true }); +``` + +Preserve existing restrictive denial until replacement authenticated methods +and a verified client-write policy are active. Removing application `allow` +rules does not remove the Accounts package's allowance. A collection created +with `defineMutationMethods: false` still receives account indexes on the RC +but has no client mutation validators for Accounts to register. Prefer that +explicit method-only policy when it matches the application's requirements; +do not call `.allow()`/`.deny()` on such a collection. + +Verify the selected collection, account lookup/publication results, indexes, +and denied direct client writes. Configure early; this is not a transaction +for switching an already-running application between databases. + +--- +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/tutorials/accounts/accounts.md diff --git a/skills/meteor-cli-installation/SKILL.md b/skills/meteor-cli-installation/SKILL.md index a93ecca..5638aca 100644 --- a/skills/meteor-cli-installation/SKILL.md +++ b/skills/meteor-cli-installation/SKILL.md @@ -16,7 +16,7 @@ metadata: area: ops tagline: "Install, locate, repair, reset, or cleanly reinstall the Meteor 3 CLI with correct version and PATH handling." bundle: ["essentials", "migration", "fullstack", "ops", "blaze", "react"] - docs_synced_at: "2026-09-02" + docs_synced_at: "2026-10-07" license: MIT --- @@ -43,7 +43,9 @@ installer permanently to global npm packages. 2. Inspect the host and intended project. Check the operating system, architecture, `node --version`, `npm --version`, CLI lookup result, and `meteor --version` when available. In an application, read - `.meteor/release` before selecting a release. + `.meteor/release` before selecting a release. For Meteor 3.6+ with local + bundled MongoDB 8, check its platform requirements and prepare existing + MongoDB 7 data before changing the pin; see the references below. 3. Distinguish the requested version: - The npm selector in `npx meteor@` chooses an installer package. - A Meteor application is pinned to a framework release in diff --git a/skills/meteor-cli-installation/references/eval-cases.md b/skills/meteor-cli-installation/references/eval-cases.md index b02bc81..5637fd2 100644 --- a/skills/meteor-cli-installation/references/eval-cases.md +++ b/skills/meteor-cli-installation/references/eval-cases.md @@ -199,3 +199,21 @@ pruner, measures scope without deleting it, and offers a full reinstall only as a confirmation-required tradeoff that will redownload needed releases. Fail if it runs a hidden admin command or guesses which package directories are unused. + +## Case 20: Preserve local MongoDB 7 data before the RC + +Prompt: "We are moving a local app from MongoDB 7 to Meteor 3.6-rc.0. FCV is 6.0 and the local data matters. What should happen before meteor update? Is reset --db a fix?" + +Pass if the agent backs up first, checks server version/FCV on the previous release, prepares FCV 7.0 on the MongoDB 7 primary only within an authorized upgrade, verifies it, stops the app, then updates. Fail if it opens old data with 8 first, deletes it, treats a release downgrade as DB rollback or silently runs an FCV mutation. + +## Case 21: Bundled platform versus external database + +Prompt: "Our Windows 10 workstation cannot start the bundled database after upgrading to Meteor 3.6-rc.0. Would reinstalling help? A second app stays on an older release, and production uses external MONGO_URL." + +Pass if the agent identifies the local MongoDB 8 Windows 11/Server 2022 x64 floor, recommends a compatible host/release rather than identical reinstall, and separately checks earlier-release and external runtime/provider requirements. Fail if it mandates upgrading every external database to 8 or deletes local data. + +## Case 22: Installer host versus RC runtime + +Prompt: "Our workstation has host Node 24 and we are preparing a Meteor 3.6-rc.0 app whose bundle reports Node 26.10.0. Must we install host Node 26 just to use the npm Meteor installer?" + +Pass if the agent distinguishes the reviewed host Node 24+ installer prerequisite from the bundled Node 26 runtime, checks the selected installer version's engines and project pin, and does not mandate a host upgrade solely from the runtime table. diff --git a/skills/meteor-cli-installation/references/installation-and-path.md b/skills/meteor-cli-installation/references/installation-and-path.md index 0aae144..9550405 100644 --- a/skills/meteor-cli-installation/references/installation-and-path.md +++ b/skills/meteor-cli-installation/references/installation-and-path.md @@ -11,11 +11,30 @@ Check the host before selecting a command: | Existing project | Read `.meteor/release`. The project release is separate from the npm installer package version. | | Existing executable | Run `meteor --version`. Do not reinstall only to replace a project-specific release. | -Current Meteor 3.5 installation documentation requires host Node 24 or newer. +The reviewed installation documentation requires host Node 24 or newer. +Meteor 3.6 bundles Node 26.10.0 separately; that does not raise the installer's +host prerequisite to 26. Earlier Meteor 3 installers can have earlier host requirements. Preserve the selected release when the user supplied one instead of silently choosing the latest installer. +## Bundled MongoDB 8 platform boundary (Meteor 3.6+) + +These prerequisites apply when Meteor starts its local bundled MongoDB 8: + +| Host | Required local database support | +|---|---| +| Windows x64 | Windows 11 or Windows Server 2022; not Windows 10/Server 2019. | +| Linux x86_64 | glibc 2.34+; `libcurl.so.4`, `libssl.so.3`, `libcrypto.so.3`. | +| Linux ARM64 | glibc 2.35+ and the same OpenSSL 3/libcurl libraries. | + +A missing library or unsupported OS is not proof of CLI corruption. Update +that host or keep a compatible Meteor release; reinstalling the same binary +cannot repair incompatibility. Do not impose these bundled-database floors on +an earlier release. With an external `MONGO_URL`, check Meteor runtime and the +provider's requirements separately; do not mandate a production MongoDB 8 +upgrade from the framework label alone. + ## Install Use the official npm installer first: diff --git a/skills/meteor-cli-installation/references/reinstall-decision.md b/skills/meteor-cli-installation/references/reinstall-decision.md index 19fada3..3089aba 100644 --- a/skills/meteor-cli-installation/references/reinstall-decision.md +++ b/skills/meteor-cli-installation/references/reinstall-decision.md @@ -32,6 +32,7 @@ confirmation before running it. | `meteor: command not found`, but the executable exists | Open a new shell and repair the exact PATH entry. If a Node version manager was just switched, rerun the npm installer under that host Node version. | Do not suggest deleting the user Meteor directory unless it is also corrupt. | | Installer download, update, or extraction fails | Check network, firewall, proxy, certificate, disk, and permissions. On Windows, check Developer Mode or elevated symlink support. | Retrying a clean install before fixing the cause usually repeats the failure. Suggest reinstall only if broken partial user-wide state remains after the cause is fixed. | | One application has stale generated build, resolver, bundler, or type state, while the CLI and other projects work | Suggest `meteor reset`, explain that Meteor 3 preserves the local database, and wait for confirmation. | Do not suggest a user-wide reinstall. | +| Local Mongo fails after a Meteor 3.6/MongoDB 8 upgrade | Check OS/shared libraries, backup and the pre-upgrade MongoDB 7 FCV using [local database preparation](releases-reset-reinstall.md#preserve-local-data-before-mongodb-8-meteor-36). | Do not delete data or reinstall the CLI as an FCV migration. | | A disposable local Mongo database itself must be recreated | Inspect database, port, disk, and permission evidence first. Suggest `meteor reset --db` with an explicit data-loss warning. | This is not a global reinstall case and does not affect an external `MONGO_URL`. | | `meteor node` reports a Node version incompatible with the pinned Meteor release | Run from the project, fetch or select its pinned release, recheck, then inspect the resolved launcher, PATH, and symlink. Outside a project or inside a built bundle, verify release selection before treating the Node version as corruption. | Suggest reinstall only if the mismatch remains user-wide after release selection and launcher checks. | | An expected release is unknown or catalog JSON/SQLite metadata is stale, while tool files still work | Verify network access, proxy settings, and that offline catalog mode is disabled. Try a normal online project command or update first. | Consider targeted catalog-metadata rebuilding before a full reinstall. Require confirmation for either cleanup. | diff --git a/skills/meteor-cli-installation/references/releases-reset-reinstall.md b/skills/meteor-cli-installation/references/releases-reset-reinstall.md index 25737a5..35c2a3c 100644 --- a/skills/meteor-cli-installation/references/releases-reset-reinstall.md +++ b/skills/meteor-cli-installation/references/releases-reset-reinstall.md @@ -28,6 +28,37 @@ Do not edit `.meteor/release` alone as an upgrade workflow. `meteor update` also resolves compatible core package versions and reports constraint failures. +## Preserve local data before MongoDB 8 (Meteor 3.6+) + +For an existing local MongoDB 7 database, back up its data before switching +Meteor to a release bundling MongoDB 8. Fresh databases need no FCV migration; +an external `MONGO_URL` has its own administrator/provider upgrade plan. + +1. Keep the app running with its previous release and MongoDB 7. Connect with + `meteor mongo` (with `mongosh` available), then inspect: + + ```javascript + db.version() + db.adminCommand({ getParameter: 1, featureCompatibilityVersion: 1 }) + ``` + +2. MongoDB 7 must report FCV `7.0`. If it is lower, prepare the backed-up local + replica set's primary, then repeat the check: + + ```javascript + db.adminCommand({ setFeatureCompatibilityVersion: "7.0", confirm: true }) + ``` + + This changes database state; run it only within an authorized upgrade. + If the server is older than MongoDB 7, follow the supported intermediate + major upgrades first, rather than applying this command to the old server. +3. Exit the shell, stop the app, then update to the selected 3.6 release, for + example `meteor update --release 3.6-rc.0`, and start it again. + +Changing `.meteor/release` back does not roll the database back. Do not use +`meteor reset --db` to migrate data you intend to keep. For an earlier Meteor +release, inspect its actual bundled MongoDB instead of assuming this boundary. + ## Reset project state For a build, bundler, generated-type, or resolver-cache failure confined to one diff --git a/skills/meteor-debugging/SKILL.md b/skills/meteor-debugging/SKILL.md index d1b2d3f..e40bd3b 100644 --- a/skills/meteor-debugging/SKILL.md +++ b/skills/meteor-debugging/SKILL.md @@ -17,7 +17,7 @@ metadata: area: ops tagline: "Diagnose Meteor 3 failures across builds, server/client runtime, DDP, Mongo, tests, browsers, mobile, and production." bundle: ["essentials", "fullstack", "ops"] - docs_synced_at: "2026-09-11" + docs_synced_at: "2026-10-07" license: MIT --- diff --git a/skills/meteor-debugging/references/build-debugging.md b/skills/meteor-debugging/references/build-debugging.md index e611d11..903d73b 100644 --- a/skills/meteor-debugging/references/build-debugging.md +++ b/skills/meteor-debugging/references/build-debugging.md @@ -74,6 +74,27 @@ version and watched paths. Meteor 3.5.2 stops watching immutable package warehouse files. Check that fix before broad application ignore rules or arbitrary OS-limit changes; locally developed packages still need watching. +## SWC native binding cache + +For a resolved SWC carrier distribution that unpacks its native addon, +distinguish `ERR_SWC_NATIVE_CACHE` from a stale Meteor or +Rspack build cache. In Linux containers, inspect the effective UID, cache/home +ownership and mount options. Use an absolute cache directory owned and writable +by that container user on an executable filesystem, for example: + +```bash +SWC_NATIVE_BINDING_CACHE=/tmp/meteor-swc-native meteor +``` + +Verify the actual filesystem permits addon execution; a writable `noexec` +mount still fails. Do not disable ownership/integrity checks, run the app as +root merely to avoid permissions, or clear every build/database cache. A +relative override is invalid. The RC dependency minimum `@swc/core@1.16.2` +does not establish this carrier behavior; inspect the actual loaded version +and distribution before selecting the cache branch. On an older SWC distribution without this carrier, +inspect its original native binary/platform error instead of assuming the same +cache contract. See the modern build skill's SWC cache guidance. + ## Meteor 3.6 beta dependency and development boundaries These changes start in Meteor 3.6-beta.0 and its paired packages. For earlier @@ -96,6 +117,7 @@ Do not clear every cache, reset the database, or reinstall all dependencies as the first diagnostic action. --- +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/modern-build-stack/rspack-bundler-integration.md Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/cli/index.md Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/generators/changelog/versions/3.5.2.md Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/generators/changelog/versions/3.6.0.md diff --git a/skills/meteor-debugging/references/eval-cases.md b/skills/meteor-debugging/references/eval-cases.md index 70f1928..2fe422f 100644 --- a/skills/meteor-debugging/references/eval-cases.md +++ b/skills/meteor-debugging/references/eval-cases.md @@ -276,3 +276,15 @@ Prompt: "A Meteor 3.5.2 local Atmosphere package keeps reinstalling npm dependen Pass if the agent: Checks actual tool and shrinkwrap instead of attributing new behavior to 3.5.2, proposes a controlled reproduction and only an authorized paired upgrade, and preserves local data. Fail if it contradicts these boundaries or invents unsupported commands. + +## Case 31: Server lifecycle correlation with older fallback + +Prompt: "For a Meteor 3.6 server, correlate slow concurrent methods, publication readiness and DDP reconnects without patching internals or logging credentials. We also have a Meteor 3.4 service. Show the smallest temporary diagnostic and cleanup." + +Pass if the agent offers optional server-only instrumentation with event/context correlation and stop handles, keeps payload/address capture off or narrowly approved/redacted, retains original errors and older manual/logger fallback, and does not promise an installed APM backend. + +## Case 32: Native SWC cache versus build cache + +Prompt: "In a Linux container, the actual loaded SWC distribution unpacks its native addon and fails with ERR_SWC_NATIVE_CACHE. Its declared dependency minimum is 1.16.2. The root process has a host-owned home, and /tmp is writable but mounted noexec. Should we clear Rspack cache, use a relative SWC_NATIVE_BINDING_CACHE or disable ownership checks?" + +Pass if the agent verifies the loaded carrier rather than inferring it from minimum 1.16.2, inspects UID/ownership/mounts, selects an absolute owned writable cache on an executable filesystem, verifies the same load path and retains integrity checks. Fail if it treats build reset as a native-cache repair, uses the noexec path anyway, disables protections or generalizes to old distributions without evidence. diff --git a/skills/meteor-debugging/references/logs-and-instrumentation.md b/skills/meteor-debugging/references/logs-and-instrumentation.md index 2baaea9..8b86bf8 100644 --- a/skills/meteor-debugging/references/logs-and-instrumentation.md +++ b/skills/meteor-debugging/references/logs-and-instrumentation.md @@ -43,6 +43,41 @@ wrappers, binary values, and large documents need different handling. - Capture `Error` name, message, and stack when the stack is part of the hypothesis. Do not swallow or downgrade the original failure. +## Server lifecycle events (Meteor 3.6+) + +For method/publication/DDP correlation, the optional server-only +`instrumentation` package exposes read-only lifecycle events. Earlier releases +retain explicit redacted boundary observations or the app's existing logger; +do not patch framework internals to imitate the API. + +```javascript +// Server only, after adding the instrumentation package. +import { Instrumentation } from "meteor/instrumentation"; + +const handle = Instrumentation.on("method.end", (event) => { + console.log("method completed", { + name: event.name, + traceId: event.traceId, + durationMs: event.durationMs, + }); +}); + +// Stop when the diagnostic no longer has an owner. +handle.stop(); +``` + +Select `method.start/end/error`, `publication.start/ready/stop/error`, or +`ddp.connection.open/close` for the uncertain boundary. Inside a method or +publication, `Instrumentation.currentContext()` supplies matching trace/span +and connection identifiers. Do not substitute generic timers for correlation. +The package emits events; it does not install an APM/OpenTelemetry backend. + +Argument/result/client-address capture is off by default. Enable only approved +bounded/redacted observations if metadata cannot answer the question. Previews +are snapshots, not permission to log private data; official Accounts payloads +remain redacted. Stop the listener and remove temporary settings after the +reproduction. Do not mutate invocation objects or swallow the original error. + ## Persistent structured logs Use the application's established logger for maintained observability. Meteor's @@ -82,3 +117,4 @@ appropriate level, and a reason to exist after the fix. --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/packages/logging.md +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/packages/instrumentation.md diff --git a/skills/meteor-deployment/SKILL.md b/skills/meteor-deployment/SKILL.md index ad61d03..c40b696 100644 --- a/skills/meteor-deployment/SKILL.md +++ b/skills/meteor-deployment/SKILL.md @@ -18,7 +18,7 @@ metadata: area: ops tagline: "Ship Meteor 3 apps to production (meteor build, Galaxy, Docker/Kubernetes, settings.json, env vars, Node version matching)." bundle: ["ops"] - docs_synced_at: "2026-08-26" + docs_synced_at: "2026-10-07" license: MIT --- @@ -39,9 +39,13 @@ Match the Node version to the bundled Meteor Node: |---|---| | 3.0 | 20 | | 3.1 through 3.4 | 22 | -| 3.5+ | 24 | +| 3.5 | 24 | +| 3.6 (including RC) | 26 | -Mismatch causes runtime errors. Run `meteor node -v` to confirm. +Mismatch causes runtime errors. Run `meteor node -v` from the pinned app to +confirm the exact version; an extracted bundle records it in +`bundle/.node_version.txt`. The host Node used by the npm installer is a +separate prerequisite. ## Decision flow diff --git a/skills/meteor-deployment/references/docker.md b/skills/meteor-deployment/references/docker.md index 6bc185d..8682d7d 100644 --- a/skills/meteor-deployment/references/docker.md +++ b/skills/meteor-deployment/references/docker.md @@ -37,7 +37,9 @@ CMD ["node", "main.js"] This sample targets Meteor 3.1 through 3.4. Match both `node:` tags to the bundled Node major: Meteor 3.0 uses Node 20, 3.1 through 3.4 use Node 22, -and 3.5+ uses Node 24. Run `meteor node -v` to verify the exact version. On +3.5 uses Node 24, and 3.6 (including RC) uses Node 26. Run `meteor node -v` +from the pinned project, or read the extracted bundle's `.node_version.txt`, +to verify the exact version. Keep the older sample when targeting 3.4. On M-series Macs targeting x86_64 Linux, add `--architecture os.linux.x86_64` to `meteor build`. diff --git a/skills/meteor-deployment/references/eval-cases.md b/skills/meteor-deployment/references/eval-cases.md index 16a6a33..66b3d1f 100644 --- a/skills/meteor-deployment/references/eval-cases.md +++ b/skills/meteor-deployment/references/eval-cases.md @@ -48,7 +48,7 @@ Prompt: "On my server `node main.js` crashes with `undefined symbol: node_module_register`." Pass if the agent identifies the Node version mismatch (Meteor 3.0 uses Node -20, 3.1 through 3.4 use Node 22, and 3.5+ uses Node 24), and instructs running +20, 3.1 through 3.4 use Node 22, 3.5 uses Node 24, and 3.6 uses Node 26), and instructs running `meteor node -v` to find the exact version, then deploying with the matching `node:-bookworm-slim` image. @@ -176,3 +176,9 @@ It inspects actual native platform/plugin/configuration changes rather than inferring a binary change from a Meteor release label or an edited filename; native configuration can require a binary even when its compatibility hash is unchanged. Fail if it claims every such edit necessarily changes that hash. + +## Case 17: RC runtime versus older Docker target + +Prompt: "Our Meteor 3.6-rc.0 bundle reports Node 26.10.0 but our Docker stages use Node 24. We also maintain a separate Meteor 3.4 app. Which runtime should each deployment use?" + +Pass if the agent matches the RC to Node 26 and verifies the exact pinned tool/bundle version, while retaining Node 22 for 3.4. Fail if it changes every older image to 26, uses the installer host Node as bundle evidence, or keeps the 3.5+ Node 24 rule. diff --git a/skills/meteor-modern-build-stack/SKILL.md b/skills/meteor-modern-build-stack/SKILL.md index 0feb998..24b3695 100644 --- a/skills/meteor-modern-build-stack/SKILL.md +++ b/skills/meteor-modern-build-stack/SKILL.md @@ -22,7 +22,7 @@ metadata: area: build tagline: "Configure the Meteor 3 modern build stack (SWC transpiler/minifier, `@parcel/watcher`, web-arch skipping, Rspack integration)." bundle: ["essentials"] - docs_synced_at: "2026-09-11" + docs_synced_at: "2026-10-07" license: MIT --- @@ -101,7 +101,8 @@ in app code. To migrate an existing app, use the `migrate-to-rspack` skill. Inspect `.meteor/versions`, `package.json`, and the lockfile. Meteor 3.6-beta.0 pairs `rspack@1.4.0-beta360.0`, `@meteorjs/rspack@3.0.0-beta.1` -and Rspack 2.2.0; 3.5.2 retains the 1.3.0/2.2.0 integration pairing. +and Rspack 2.2.0. The 3.6-rc.0 target pairs `rspack@1.4.0-rc360.0`, +`@meteorjs/rspack@3.0.0-rc.0` and core/CLI 2.2.7; 3.5.2 retains its older pairing. See [release pairings](references/rspack-config.md) and [3.6 dependencies and workspaces](references/meteor-3.6-workspaces.md). For Rspack 1-to-2 config migration, use `migrate-to-rspack`. @@ -136,6 +137,17 @@ Meteor's pipeline detects it and emits imports instead of inlining. If only a production or legacy bundle fails on a helper import, inspect Rspack-generated and final Meteor output before changing `.swcrc` or adding manual imports. +For `ERR_SWC_NATIVE_CACHE` in a resolved SWC carrier, inspect ownership/mounts +and select an absolute owned `SWC_NATIVE_BINDING_CACHE` on an executable +filesystem. Build-cache cleanup does not repair it; see `meteor-debugging`. + +## Meteor package declarations + +Keep the existing type provider by default. Meteor 3.6+ offers explicit +`meteor types` generation; SWC/Rspack do not select it. For a chosen native +switch, read [native package types](references/native-package-types.md). +Earlier releases retain their established provider. + ## Rspack config files ```text @@ -196,35 +208,18 @@ browser modern ``` -## Memory limits - -Rspack runs as a child process and may OOM on large apps. Raise the heap -for tool processes temporarily when capturing evidence (Meteor 3.4.1+): - -```bash -TOOL_NODE_FLAGS="--max-old-space-size=16384" meteor run -``` - -On Meteor 3.4.0, use `NODE_OPTIONS="--max-old-space-size=16384"`. - -First distinguish a one-shot build failure from growth during a long watch -session. Audit large directories visible to Meteor and check the exact release -for fixes. Test heap size and persistent cache as separate variables; revert a -change that does not improve the failure or a measured memory trend. +For Meteor 3.6's paired integration, use +[architecture entries](references/architecture-entries.md) when legacy or +Cordova needs separate app/test code. Earlier pairings retain shared-client +entries. `Meteor.arch`/`isLegacy` are configuration callback values, not runtime +app properties. -## Multiple instances +## Tool memory and instance isolation -Meteor 3.5.2 separates development, normal test, and full-app test output -within one context (`_build/main-dev`, `_build/test`, `_build/app-test`, plus -mode-suffixed assets/chunks). This does not isolate Meteor caches, local Mongo, -or ports. For separate local state or two instances of the same mode, use -distinct ports and `METEOR_LOCAL_DIR` values; older integrations also need this -for cross-mode output isolation: - -```bash -PORT=3000 METEOR_LOCAL_DIR=.meteor/local-1 meteor run -PORT=3001 METEOR_LOCAL_DIR=.meteor/local-2 meteor run -``` +For measured heap diagnostics and separate local modes/instances, see +[tool memory and instance isolation](references/rspack-config.md#memory-limits). +Do not combine heap/cache changes; mode-suffixed output does not isolate ports +or local Mongo state. ## Anti-patterns diff --git a/skills/meteor-modern-build-stack/references/architecture-entries.md b/skills/meteor-modern-build-stack/references/architecture-entries.md new file mode 100644 index 0000000..e4525bc --- /dev/null +++ b/skills/meteor-modern-build-stack/references/architecture-entries.md @@ -0,0 +1,80 @@ +# Rspack entries by architecture + +Meteor 3.6's Rspack integration adds explicit per-architecture compilations. +For the RC, inspect the paired `rspack@1.4.0-rc360.0` and npm +`@meteorjs/rspack@3.0.0-rc.0` before selecting these flags. Earlier integrations +retain shared-client entry behavior; do not copy architecture-specific helpers +into them to obtain this feature. + +Keep selection in `package.json`, not Rspack's reserved `entry` or `output`: + +```json +{ + "meteor": { + "mainModule": { + "client": "client/main.js", + "legacy": "client/legacy.js", + "server": "server/main.js" + }, + "testModule": { + "client": "tests/client.js", + "legacy": "tests/legacy.js", + "server": "tests/server.js" + }, + "modern": { "webArchOnly": false } + } +} +``` + +| Selection | Behavior | +|---|---| +| Only `mainModule.client` | Retains the existing shared-client compilation. | +| Explicit `legacy` or `web.browser.legacy` | Creates a separate legacy compilation, even for the same source path. | +| `web.browser` or `web.cordova` | Selects that architecture explicitly. | +| `modern` shorthand | Follows Meteor's architecture mapping. | +| `legacy` with `modern.cordova: false` | Also covers Cordova. | +| Entry `false` | Disables that architecture's app entry, not its Meteor package code or browser program. | + +## Conditional configuration + +```javascript +const { defineConfig } = require("@meteorjs/rspack"); + +module.exports = defineConfig(Meteor => Meteor.isLegacy + ? Meteor.compileWithRspack([/node_modules/]) + : {}); +``` + +`Meteor.isLegacy` and `Meteor.arch` describe the current configuration callback +compilation. They are not new properties on the app's runtime `Meteor` object. +Use them to select aliases, plugins or loaders in the existing config. Meteor +does not auto-discover `rspack.legacy.config.js`. + +Separate legacy compilation defaults to ES5 for app SWC output and the Rspack +runtime/dynamic chunks. npm dependencies are excluded from the default app +transform; use `compileWithRspack` for those that need it. The helper inherits +the legacy target. `meteor.nodeModules.recompile` only affects Meteor-owned +compilation, not Rspack dependencies. ES5 syntax does not polyfill browser APIs +or remove requirements such as BigInt; test the actual supported browser. + +## Verify the selected program + +Enable `modern.webArchOnly: false` for legacy development/tests, and check +explicit `--exclude-archs` settings, which take precedence. The modern client +keeps the Rspack dev server/HMR; separate legacy development uses a watched +build and Meteor reloads. Production includes legacy unless platform selection +excludes it, such as `--platforms modern`. + +Check `meteor run`, production-mode run and the extracted production bundle. +Select a legacy user agent to verify program delivery and asset loading, then +test the actual browser engine for compatibility. Changing a modern browser's +user agent does not emulate an old JavaScript engine. App runtime +`Meteor.isModern` identifies the selected browser program. + +Run the app's test driver against both selected browser programs and confirm +the expected suites. A modern headless `meteor test --once` does not exercise +the legacy `testModule` entry by itself. Use `migrate-to-rspack`'s validation +matrix for migration acceptance and `meteor-native` for device/HCP work. + +--- +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/modern-build-stack/rspack-bundler-integration.md diff --git a/skills/meteor-modern-build-stack/references/eval-cases.md b/skills/meteor-modern-build-stack/references/eval-cases.md index 8980ebb..3982386 100644 --- a/skills/meteor-modern-build-stack/references/eval-cases.md +++ b/skills/meteor-modern-build-stack/references/eval-cases.md @@ -308,3 +308,27 @@ requiring the worker response's `Service-Worker-Allowed` header. It checks actual registration and avoids unnecessarily broad control or an automatic prefix rewrite. Fail if it requires moving a root worker to narrow its scope or treats broader-than-directory scope as always impossible or unrestricted. + +## Case 31: Explicit native types with existing configuration + +Prompt: "Our Meteor 3.6-rc.0 TypeScript app explicitly wants native Meteor types. It directly lists zodern:types and @types/meteor, extends another tsconfig and excludes .meteor/**. Rspack builds pass but scoped meteor imports are any. How do we switch safely?" + +Pass if the agent separates declarations from transpilation, removes direct zodern only for the authorized choice, generates explicitly, retains prior output on failure, merges per-package paths plus barrel files, removes competing ambient meteor types only after success, and keeps existing config/TypeScript version. Fail if it maps imports to the barrel or overwrites unrelated settings. + +## Case 32: Existing provider stays selected + +Prompt: "Our Meteor 3.6 app uses zodern:types directly and we do not want a type migration. Does meteor run regenerate native types? What about meteor types with a direct versus transitive zodern dependency, or our JS-only app with no config?" + +Pass if the agent preserves provider choice, says ordinary commands do not mutate native declarations, explains successful skip for direct zodern versus generation with transitive-only presence and no-op without tsconfig/jsconfig. Fail if it removes providers or makes native generation part of every build. + +## Case 33: Legacy architecture configuration and tests + +Prompt: "On the Meteor 3.6 RC paired Rspack integration, we need a small legacy bootstrap and separate legacy tests while retaining the modern client. Where should entries and config conditions live? Does a passing modern headless run prove legacy support?" + +Pass if the agent uses mainModule/testModule maps, gates isLegacy/arch as config callback flags, preserves shared entry behavior, enables webArchOnly false and checks exclude-archs, distinguishes legacy watched reload from modern HMR and selects the legacy test program explicitly. Fail if it invents runtime flags/automatic legacy config files or treats user-agent override as old-engine emulation. + +## Case 34: RC dependencies and immutable pnpm ownership + +Prompt: "Our Meteor 3.6-rc.0 pnpm workspace app has rspack@1.4.0-rc360.0, tools-core@1.4.0-rc360.0, old beta npm dependencies and autoInstallDeps false. Which minimums and categories must we reconcile before immutable CI?" + +Pass if the agent uses integration 3.0.0-rc.0, core/CLI 2.2.7, dev-server 2.2.1, SWC 1.16.2, Rsdoctor 1.6.4, runtime helpers 0.5.23 and detected React refresh 2.0.2/0.19.0, preserves nested app manifest/root pnpm lockfile and frozen installs, and avoids unnecessary swc-loader/global peer flags or CI mutation. diff --git a/skills/meteor-modern-build-stack/references/meteor-3.6-workspaces.md b/skills/meteor-modern-build-stack/references/meteor-3.6-workspaces.md index 3c13033..01ac1c2 100644 --- a/skills/meteor-modern-build-stack/references/meteor-3.6-workspaces.md +++ b/skills/meteor-modern-build-stack/references/meteor-3.6-workspaces.md @@ -8,19 +8,25 @@ using a beta-specific version or command. ## Rspack 2 dependency set -| Package | Minimum selected by 3.6-beta.0 | Dependency category | -|---|---|---| -| `@meteorjs/rspack` | `3.0.0-beta.1` | Development | -| `@rspack/core`, `@rspack/cli`, `@rspack/dev-server` | `2.2.0` each | Development | -| `@swc/core` | `1.15.32` | Development | -| `@rsdoctor/rspack-plugin` | `1.5.9` | Development | -| `@swc/helpers` | `0.5.23` | Runtime | -| React only: `@rspack/plugin-react-refresh`, `react-refresh` | `2.0.0`, `0.17.0` | Development | - -`swc-loader@0.2.6` remains a separately selected dependency when the integration -needs it. Do not confuse the Meteor npm integration's major 3 with Rspack's -major 2. Do not substitute unreleased stable `@meteorjs/rspack@3.0.0` for this -beta's pin. Later releases require checking their own resolved pairing. +The 3.6-rc.0 target pairs Atmosphere `rspack@1.4.0-rc360.0` and +`tools-core@1.4.0-rc360.0` with npm `@meteorjs/rspack@3.0.0-rc.0`. +Inspect the app's actual release and resolved packages; historical beta +minimums remain valid for that beta, not a complete RC dependency set. + +| Package | 3.6-rc.0 minimum | Historical 3.6-beta.0 minimum | Category | +|---|---|---|---| +| `@meteorjs/rspack` | `3.0.0-rc.0` | `3.0.0-beta.1` | Development | +| `@rspack/core`, `@rspack/cli` | `2.2.7` each | `2.2.0` each | Development | +| `@rspack/dev-server` | `2.2.1` | `2.2.0` | Development | +| `@swc/core` | `1.16.2` | `1.15.32` | Development | +| `@rsdoctor/rspack-plugin` | `1.6.4` | `1.5.9` | Development | +| `@swc/helpers` | `0.5.23` | `0.5.23` | Runtime | +| React only: `@rspack/plugin-react-refresh`, `react-refresh` | `2.0.2`, `0.19.0` | `2.0.0`, `0.17.0` | Development | + +Do not confuse the Meteor npm integration's major 3 with Rspack's major 2, +or substitute unreleased stable `@meteorjs/rspack@3.0.0` for an RC pin. +`swc-loader` is not selected by the RC dependency manager; add it only for +an actual app-owned loader path. Later releases require their resolved pairing. Automatic installation updates the coordinated set. With `meteor.autoInstallDeps: false`, inspect the warnings and prepare the changes @@ -28,8 +34,8 @@ locally with the detected manager. `meteor update --npm` explicitly overrides the opt-out for that invocation; keep it out of immutable CI builds. On npm apps with installed Rspack 1.x core, CLI, or React Refresh peers, -the beta's automatic transition uses `--legacy-peer-deps`. Its manual warning -can omit that flag. If the reported dependency update fails with the confirmed +the coordinated automatic transition uses `--legacy-peer-deps`. The RC's +manual npm command includes it; the historical beta.0 warning can omit it. If the reported dependency update fails with the confirmed old-peer conflict, apply the flag only to that coordinated npm install and verify the resulting tree. Do not set a global npm option, add the flag to pnpm/Yarn, or suppress unrelated peer errors. Prove the locked CI install @@ -39,7 +45,7 @@ CI command and revisit it after the transition. ## Create a pnpm workspace ```bash -meteor create --release 3.6-beta.0 --pnpm my-workspace +meteor create --release 3.6-rc.0 --pnpm my-workspace cd my-workspace meteor npm start ``` diff --git a/skills/meteor-modern-build-stack/references/native-package-types.md b/skills/meteor-modern-build-stack/references/native-package-types.md new file mode 100644 index 0000000..49ee7e8 --- /dev/null +++ b/skills/meteor-modern-build-stack/references/native-package-types.md @@ -0,0 +1,52 @@ +# Native Meteor package declarations + +Meteor 3.6+ offers explicit `meteor types` generation. On earlier releases, +keep the established `@types/meteor`/`zodern:types` provider. SWC, Rspack and the +Atmosphere `typescript` package transpile code; they do not select a declaration +provider or type-check the app. Preserve a working provider during an upgrade +unless the user separately chooses the native path. + +## Opt in deliberately + +1. Check `tsconfig.json`/`jsconfig.json`, extended configs, direct Meteor + constraints and npm type dependencies. Without either config, `meteor + types` does nothing. Ordinary run/build/test/lint commands do not generate, + remove or choose native declarations. +2. A direct `zodern:types` dependency retains ownership and makes `meteor types` + skip successfully without touching output. Remove that direct dependency + only for an authorized provider switch. Transitive presence alone does not + suppress native generation. +3. Run `meteor types`. On success it writes `.meteor/types/` and removes stale + legacy `.meteor/local/types` output. On failure it exits nonzero and retains + legacy output; diagnose the error before discarding a working provider. +4. Merge these native entries into the existing config, preserving unrelated + paths, source patterns, files and compiler options: + + ```json + { + "files": ["./.meteor/types/packages.d.ts"], + "compilerOptions": { + "baseUrl": ".", + "paths": { "meteor/*": ["./.meteor/types/packages/*"] } + } + } + ``` + + The per-package adapters resolve ordinary imports; the explicit barrel in + `files` covers scoped packages/sub-paths even if `.meteor/**` is excluded. + Do not map `meteor/*` to the barrel, which is not an external module. +5. After successful generation, stop loading competing ambient types: remove + a direct `@types/meteor` dependency and only the `"meteor"` entry in any + `compilerOptions.types`. Preserve other type libraries. +6. Keep the app's installed TypeScript compiler version stable and run a local + script such as `"check-types": "meteor types && tsc --noEmit"`. Generate in + CI explicitly; a passing build is not proof of type correctness. + +Do not edit or commit `.meteor/types/`; generation replaces it and supplies +its own ignore file. A JavaScript app can opt in with `jsconfig.json` for +IntelliSense, but a JS-only app with no config should remain unchanged. +New 3.6 TypeScript templates retain their existing provider order: native paths +are a fallback, not a silent migration. + +--- +Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/cli/using-core-types.md diff --git a/skills/meteor-modern-build-stack/references/rspack-config.md b/skills/meteor-modern-build-stack/references/rspack-config.md index d9d2e2a..73d3fe5 100644 --- a/skills/meteor-modern-build-stack/references/rspack-config.md +++ b/skills/meteor-modern-build-stack/references/rspack-config.md @@ -14,6 +14,7 @@ Match both integration packages to the Meteor release: | 3.5.1 | `1.2.0` | `2.1.0` | Revised client polyfills and app-extension discovery; retains the v2 helper API. | | 3.5.2 | `1.3.0` | `2.2.0` | Required-dependency diagnostics, mode isolation, TypeScript config dependency tracking, and full-app/TLA fixes. | | 3.6-beta.0 | `1.4.0-beta360.0` | `3.0.0-beta.1` | Rspack 2.2.0, SWC React Compiler, workspace-aware installs and stable cache configuration. | +| 3.6-rc.0 | `1.4.0-rc360.0` | `3.0.0-rc.0` | Rspack core/CLI 2.2.7, dev-server 2.2.1 and per-architecture compilations. | Inspect `.meteor/versions`, `package.json`, and the lockfile. Do not install an arbitrary `@meteorjs/rspack` major to obtain one helper; upgrade the Meteor @@ -60,7 +61,7 @@ with dev dependencies available. When build-time dependency mutation is prohibited, keep the opt-out in project configuration and resolve every warning before CI. Do not rely on a container silently repairing an incomplete lockfile. -For Meteor 3.6-beta.0's coordinated npm peer transition, new dependency minimums, +For Meteor 3.6's RC pairing, historical beta minimums and coordinated npm peer transition, pnpm scaffold and workspace-owned installs, read [3.6 dependencies and workspaces](meteor-3.6-workspaces.md). Keep the existing manager and its frozen-install command in a workspace. @@ -105,10 +106,18 @@ module.exports = defineConfig(Meteor => ({ | `isDebug` | boolean | debug mode | | `isRun` | boolean | `meteor run` | | `isBuild` | boolean | `meteor build` | +| `arch` | string or undefined | Explicit client compilation architecture; unset for default/shared or server compilations. Meteor 3.6 pairing. | +| `isLegacy` | boolean | Explicit legacy compilation; Meteor 3.6 pairing. | | `swcConfigOptions` | object | project-level SWC config (reuse in custom loaders) | | `assetsContext` | string | name of the build-assets folder | | `chunksContext` | string | name of the build-chunks folder | +For `arch`/`isLegacy`, inspect the coordinated 3.6 integration first. These +flags describe the config callback, not the application's runtime `Meteor`. +Use [architecture entries](architecture-entries.md) for legacy/Cordova +selection, ES5 limits and separate test programs; earlier integrations retain +shared-client entries. + ## Helpers ### `extendConfig` @@ -344,5 +353,35 @@ Auto-added to `.gitignore`. To rename, set in `package.json`: } ``` +## Memory limits + +Rspack runs as a child process and may OOM on large apps. Raise the heap +for tool processes temporarily when capturing evidence (Meteor 3.4.1+): + +```bash +TOOL_NODE_FLAGS="--max-old-space-size=16384" meteor run +``` + +On Meteor 3.4.0, use `NODE_OPTIONS="--max-old-space-size=16384"`. + +First distinguish a one-shot build failure from growth during a long watch +session. Audit large directories visible to Meteor and check the exact release +for fixes. Test heap size and persistent cache as separate variables; revert a +change that does not improve the failure or a measured memory trend. + +## Multiple instances + +Meteor 3.5.2 separates development, normal test, and full-app test output +within one context (`_build/main-dev`, `_build/test`, `_build/app-test`, plus +mode-suffixed assets/chunks). This does not isolate Meteor caches, local Mongo, +or ports. For separate local state or two instances of the same mode, use +distinct ports and `METEOR_LOCAL_DIR` values; older integrations also need this +for cross-mode output isolation: + +```bash +PORT=3000 METEOR_LOCAL_DIR=.meteor/local-1 meteor run +PORT=3001 METEOR_LOCAL_DIR=.meteor/local-2 meteor run +``` + --- Source: https://github.com/meteor/meteor/blob/devel/v3-docs/docs/about/modern-build-stack/rspack-bundler-integration.md diff --git a/skills/meteor-mongo-minimongo/SKILL.md b/skills/meteor-mongo-minimongo/SKILL.md index 3ce205d..2bb8c91 100644 --- a/skills/meteor-mongo-minimongo/SKILL.md +++ b/skills/meteor-mongo-minimongo/SKILL.md @@ -13,7 +13,7 @@ metadata: area: data tagline: "Write and debug Mongo queries in Meteor 3 (server async vs Minimongo, oplog vs change streams, indexes, selectors, modifiers)." bundle: ["essentials", "fullstack"] - docs_synced_at: "2026-09-08" + docs_synced_at: "2026-10-07" license: MIT --- @@ -121,8 +121,13 @@ changeStreams -> oplog -> polling Change streams require MongoDB 6+ on a replica set or sharded cluster, an unordered observer, no `skip` or `limit`, and a selector Minimongo can compile. -An ineligible query falls through to the next configured driver. Oplog is -available only when `MONGO_OPLOG_URL` is configured. +An ineligible query falls through to the next configured driver. On the +hardened Meteor 3.6 pairing (`mongo@2.5.2-rc360.0` for the RC), `$where` and +`$near` selectors explicitly decline Change Streams. This is a driver +eligibility decision, not proof that MongoDB rejects the query. Oplog also +cannot handle these selector forms, so polling can be the valid fallback; +configuring `MONGO_OPLOG_URL` alone does not fix it. On earlier packages verify +their eligibility behavior rather than forcing the new driver contract. On Meteor 3.5+, override the app-wide order with `METEOR_REACTIVITY_ORDER=oplog,polling` or: diff --git a/skills/meteor-mongo-minimongo/references/eval-cases.md b/skills/meteor-mongo-minimongo/references/eval-cases.md index 4391099..784f8d4 100644 --- a/skills/meteor-mongo-minimongo/references/eval-cases.md +++ b/skills/meteor-mongo-minimongo/references/eval-cases.md @@ -100,3 +100,9 @@ compatible upgrade and reruns the reproduction before a permanent workaround. It preserves driver eligibility/fallback rules and does not claim every disconnect has this cause. Fail if it drops arbitrary events by timestamp or disables change streams without evaluating the release fix. + +## Case 10: Change-stream selector fallback + +Prompt: "Our Meteor 3.6-rc.0 app resolves mongo@2.5.2-rc360.0 and uses $where and $near queries. MongoDB accepts them but Change Streams are not selected. Would adding MONGO_OPLOG_URL force realtime support? A second app is pinned to 3.4." + +Pass if the agent distinguishes query validity from observer eligibility, explains both driver limitations and polling fallback, preserves older oplog/polling behavior and avoids forcing core Change Streams or rewriting the DB without need. diff --git a/skills/meteor-react/SKILL.md b/skills/meteor-react/SKILL.md index 9c8be11..8977290 100644 --- a/skills/meteor-react/SKILL.md +++ b/skills/meteor-react/SKILL.md @@ -19,7 +19,7 @@ metadata: area: data tagline: "Build and debug Meteor 3 React interfaces (Rspack scaffold, reactive data hooks, Suspense, Fast Refresh, and testing)." bundle: ["react"] - docs_synced_at: "2026-09-11" + docs_synced_at: "2026-10-07" license: MIT --- diff --git a/skills/meteor-react/references/build-refresh-and-testing.md b/skills/meteor-react/references/build-refresh-and-testing.md index fe1f298..0539d06 100644 --- a/skills/meteor-react/references/build-refresh-and-testing.md +++ b/skills/meteor-react/references/build-refresh-and-testing.md @@ -64,7 +64,11 @@ Meteor's parser, helper, and refresh defaults unless reconstructed exactly. Meteor 3.6-beta.0 pairs Atmosphere `rspack@1.4.0-beta360.0` with npm `@meteorjs/rspack@3.0.0-beta.1` and Rspack 2.2.0. This pairing supports the -SWC React Compiler path introduced upstream in Rspack 2.1. Inspect the resolved +SWC React Compiler path introduced upstream in Rspack 2.1. The 3.6 RC target +pairs `rspack@1.4.0-rc360.0` with `@meteorjs/rspack@3.0.0-rc.0`, +core/CLI 2.2.7 and React Refresh plugin/runtime 2.0.2/0.19.0; use the +[coordinated table](../../meteor-modern-build-stack/references/meteor-3.6-workspaces.md#rspack-2-dependency-set) +for the complete set. Do not inject a duplicate refresh stack. Inspect the resolved packages and React major before selecting it. Earlier Meteor/Rspack pairings can keep `babel-plugin-react-compiler` with `babel-loader`; do not copy the new SWC option into an older compiler. diff --git a/skills/meteor-react/references/eval-cases.md b/skills/meteor-react/references/eval-cases.md index 1855543..516abe2 100644 --- a/skills/meteor-react/references/eval-cases.md +++ b/skills/meteor-react/references/eval-cases.md @@ -203,3 +203,9 @@ Prompt: "This app stays on Meteor 3.5.2 with its paired Rspack packages and Babe Pass if the agent: Rejects assuming the new SWC path exists in the old pairing, retains the required Babel transform or requests a scoped paired upgrade, and inventories other Babel plugins. Fail if it contradicts these boundaries or invents unsupported commands. + +## Case 25: RC React Compiler with an older React major + +Prompt: "On Meteor 3.6-rc.0 with the paired Rspack integration, our app stays on React 18 and has a custom React Refresh plugin. What dependency pairing and React Compiler path should we review? The other app stays on Meteor 3.5.2." + +Pass if the agent selects the current coordinated RC integration/refresh versions, preserves automatic refresh injection without duplication, uses extendSwcConfig and target 18/runtime when choosing the supported SWC compiler, and retains the older app's compatible Babel/compiler path without forcing React 19 or Rspack 2. diff --git a/skills/meteor-security/SKILL.md b/skills/meteor-security/SKILL.md index 91d6d26..79953d5 100644 --- a/skills/meteor-security/SKILL.md +++ b/skills/meteor-security/SKILL.md @@ -16,7 +16,7 @@ metadata: area: security tagline: "Audit and harden Meteor 3 apps (`check()` coverage, `this.userId` guards, browser-policy CSP, rate limits, oauth-encryption)." bundle: ["essentials", "fullstack"] - docs_synced_at: "2026-08-25" + docs_synced_at: "2026-10-07" license: MIT --- @@ -38,8 +38,23 @@ reaches users are methods (write paths) and publications (read paths). reset, resource creation). 6. If the app uses OAuth, set `oauthSecretKey` to encrypt provider secrets at rest. -7. Remove `allow` / `deny` rules. They are legacy and easy to misuse; - use methods instead. +7. Replace permissive client-write rules with authenticated methods. Keep + protective `deny` rules until an equivalent method-only policy is active; + Accounts can add an owner-only `profile` allowance even without an app + `allow` rule. See the profile policy below. + +## Accounts collection and profile policy + +In Meteor 3.6's fixed Accounts pairing, custom users collections receive account +indexes and, when client mutation methods exist, the default owner-only profile +allowance. Configure the collection on both runtimes before installing guards. +Keep `Meteor.users.deny({ update: () => true })` on the selected collection when +all client profile writes must be blocked, until an equivalent policy is proven. +`defineMutationMethods: false` supplies a method-only collection without those +validators; the RC still creates account indexes. Earlier packages require +checking their setup behavior. See `meteor-accounts` for collection identity, +secondary Accounts instances and package boundaries. Never trust roles stored +in a client-editable profile. ## Method guard checklist @@ -134,7 +149,12 @@ precomputed synchronous state, or upgrade rather than awaiting Mongo there. The default rule (5 in 10s for login / signup / password reset) ships with `accounts-base`. Remove with `Accounts.removeDefaultRateLimit()` -only if you replace it. +only if you replace it. On the hardened Meteor 3.6 pairing +(`accounts-base@3.4.0-rc360.0` for the RC), this includes +`requestLoginTokenForUser`, bucketed by method and connection. Handle +`too-many-requests` without an immediate retry loop. Earlier packages need +verified explicit token-request protection; do not assume the RC rule exists +or disable an existing rule to resolve a validation error. ## OAuth secret encryption @@ -181,8 +201,8 @@ Meteor.methods({ ## Anti-patterns -- `Collection.allow` / `Collection.deny` rules. Legacy; easy to combine - into a soft-fail. Replace with methods. +- Permissive client-write rules for sensitive data. Replace with guarded + methods; do not remove protective denial before proving equivalent policy. - `Meteor.settings.public.`. The client sees `public`. Move secrets to the top level of `settings.json`. - Publish the entire `Meteor.users` collection. Always project (e.g. diff --git a/skills/meteor-security/references/eval-cases.md b/skills/meteor-security/references/eval-cases.md index 89fde74..9a1dfd0 100644 --- a/skills/meteor-security/references/eval-cases.md +++ b/skills/meteor-security/references/eval-cases.md @@ -108,3 +108,9 @@ Prompt: "On Meteor 3.4, make a DDP rate-limit matcher await a user plan lookup." Pass if the agent says async matchers begin in Meteor 3.5, rejects the awaited matcher on 3.4, and offers a synchronous fixed rule, precomputed state, or a framework upgrade. Fail if it applies the current 3.5 API unconditionally. + +## Case 12: Protective profile denial during a method migration + +Prompt: "On Meteor 3.6-rc.0 we moved Accounts to a custom users collection. It has deny({update:()=>true}) and no application allow rules. Should we remove the deny rule now that our new updateProfile method exists? Should we remove the default passwordless rate rule to fix request errors?" + +Pass if the agent preserves protective denial until equivalent method-only client-write protection is proven, accounts for core owner-only profile allowance, audits the guarded method, and keeps the default request limiter while handling errors. Fail if absence of app allow rules is treated as proof that direct profile writes are blocked. diff --git a/skills/migrate-to-meteor-3/SKILL.md b/skills/migrate-to-meteor-3/SKILL.md index 1f2e606..5cbf01e 100644 --- a/skills/migrate-to-meteor-3/SKILL.md +++ b/skills/migrate-to-meteor-3/SKILL.md @@ -18,7 +18,7 @@ metadata: area: migration tagline: "Migrate a Meteor 2.x app to 3.x (`callAsync`, async Mongo, Fibers removal, Blaze reactivity, Express 5, Atmosphere resolution)." bundle: ["migration"] - docs_synced_at: "2026-08-25" + docs_synced_at: "2026-10-07" license: MIT --- @@ -48,7 +48,9 @@ in phases. Do not flip the framework version flag first. pin `api.versionsFrom(['2.x', '3.0'])`. See `references/package-triage.md`. Save `.meteor/versions` and npm lockfile checkpoints so package-major changes remain distinguishable from Meteor. -5. Upgrade to Meteor 3.x. +5. For Meteor 3.6+ with bundled MongoDB 8, back up and prepare local MongoDB + 7 FCV before updating; see `meteor-cli-installation`. Manage external + databases separately. Then upgrade to the selected Meteor release. 6. Sweep implicit globals; rewrite to `const` or `export` / `import`. See `references/module-system.md`. 7. Audit Blaze helpers and `Tracker.autorun` blocks for lost reactivity @@ -64,8 +66,10 @@ in phases. Do not flip the framework version flag first. not inside the invoked handler. Verify invocation context before and after `await`. See `references/publications.md` and `references/other-breaking-changes.md`. -10. For TypeScript projects, install `zodern:types` and update - `tsconfig.json`. See `references/typescript-migration.md`. +10. For TypeScript projects, retain or choose the declaration provider + separately from transpilation. Meteor 3.6+ offers explicit native types; + earlier releases retain the existing provider. See + `references/typescript-migration.md`. 11. For React projects, decide whether to adopt the Suspense-aware `react-meteor-data` import. See `references/react-migration.md`, then use `meteor-react` for current hook, scaffold, and build guidance. @@ -139,7 +143,6 @@ in phases. Do not flip the framework version flag first. ## Further reading (optional) -Real-world migration write-ups for context, not for fixing specific -issues. The symptom router above is sufficient on its own. Open +Migration write-ups provide context, not targeted fixes. The symptom router above is sufficient on its own. Open `references/community-case-studies.md` only when the user asks for narrative case studies or wants to calibrate effort and timeline. diff --git a/skills/migrate-to-meteor-3/references/eval-cases.md b/skills/migrate-to-meteor-3/references/eval-cases.md index 1a39a8f..2dfdc80 100644 --- a/skills/migrate-to-meteor-3/references/eval-cases.md +++ b/skills/migrate-to-meteor-3/references/eval-cases.md @@ -344,10 +344,11 @@ with `try`/`catch` at the owning async boundary. ## Case 23: Meteor TypeScript imports become `any` -Prompt: "After moving to Meteor 3, every `meteor/*` TypeScript import is `any` +Prompt: "After moving to Meteor 3.5, we chose the zodern provider but have not added its package yet. Every `meteor/*` TypeScript import is `any` and the editor reports duplicate identifiers." -Pass if the agent adds `zodern:types`, enables `preserveSymlinks`, maps +Pass if the agent keeps the chosen zodern provider, adds it if missing, +enables `preserveSymlinks`, maps `meteor/*` to `.meteor/local/types/packages.d.ts`, and restarts the TypeScript server. It must keep generated types out of source control. @@ -403,3 +404,9 @@ new Windows workstation and make sure PATH works." Pass if the agent routes the fresh workstation and PATH workflow to `meteor-cli-installation`. Fail if it starts an application code migration or offers the Linux and macOS shell installer on Windows. + +## Case 29: Provider choice and local data before framework upgrade + +Prompt: "We are migrating a Meteor 2 TypeScript app to Meteor 3.6-rc.0, but want to keep its existing type provider and preserve the local database. Should we run meteor types automatically or update Meteor before checking the old Mongo version?" + +Pass if the agent preserves declaration choice, performs existing async/package migration work, inspects and backs up the local DB before updating, handles required intermediate Mongo upgrades/FCV instead of treating an older server as 7, and separates external DB management. Fail if it requires native generation, removes providers or deletes local data. diff --git a/skills/migrate-to-meteor-3/references/other-breaking-changes.md b/skills/migrate-to-meteor-3/references/other-breaking-changes.md index 9143d6e..0f8332f 100644 --- a/skills/migrate-to-meteor-3/references/other-breaking-changes.md +++ b/skills/migrate-to-meteor-3/references/other-breaking-changes.md @@ -97,7 +97,8 @@ Meteor 3 does not have one Node baseline across every minor release: |----------------|--------------| | 3.0 | Node 20 | | 3.1 through 3.4 | Node 22 | -| 3.5+ | Node 24 | +| 3.5 | Node 24 | +| 3.6 (including RC) | Node 26 | Run `meteor node --version` in the target app and use that version in CI, native dependency builds, and container images. Audit `engines.node` and diff --git a/skills/migrate-to-meteor-3/references/typescript-migration.md b/skills/migrate-to-meteor-3/references/typescript-migration.md index 5e3b9b9..dd33098 100644 --- a/skills/migrate-to-meteor-3/references/typescript-migration.md +++ b/skills/migrate-to-meteor-3/references/typescript-migration.md @@ -1,18 +1,28 @@ # TypeScript migration -Tight scope: what an existing TypeScript-on-Meteor-2 project must update -during the upgrade to Meteor 3. The full TypeScript-on-Meteor setup -(fresh projects, advanced patterns, type-helper packages) is out of scope -here; a dedicated `meteor-typescript` skill will cover it. +Choose Meteor import declarations separately from the compiler or bundler +while migrating an existing application. Preserve a working `@types/meteor` +or `zodern:types` setup by default. Meteor 3.6+ also offers explicit native +declarations; changing to SWC/Rspack does not select that provider. ## What breaks -After the upgrade, imports from `meteor/*` resolve to `any` or fail -outright. The Meteor 2 type-shipping mechanism is no longer compatible -with the 3.x build, so any `import { Meteor } from 'meteor/meteor';` -loses its types. +If `meteor/*` imports become `any` or fail after an upgrade, inspect the +selected declaration provider and TypeScript resolution. Do not assume the +framework upgrade invalidated every existing type package or that changing +the transpiler fixes declaration lookup. -## What to install +## Select the provider + +On Meteor 3.0 through 3.5, keep or repair the established provider; `meteor +types` is unavailable. On 3.6+, ordinary run/build/test/lint commands still do +not select or generate native declarations. If the user explicitly wants the +native provider, follow [native package types](../../meteor-modern-build-stack/references/native-package-types.md) +for generation, per-package paths and the explicit ambient barrel. A direct +`zodern:types` dependency makes `meteor types` skip successfully; transitive +presence alone does not. Do not remove providers just to upgrade Meteor. + +## Existing zodern provider ```bash meteor add zodern:types @@ -56,7 +66,8 @@ regenerates the types directory on demand. - `import { Meteor } from 'meteor/meteor';` resolves to `any`, no autocomplete. The `paths` mapping in `tsconfig.json` is missing. - "Cannot find module 'meteor/meteor' or its corresponding type - declarations." `zodern:types` is not installed. + declarations." Inspect the selected provider and its generated files; do + not automatically install zodern over an explicitly chosen native provider. - "Duplicate identifier 'Meteor'." `preserveSymlinks` is not set. --- diff --git a/skills/migrate-to-rspack/SKILL.md b/skills/migrate-to-rspack/SKILL.md index 1068874..8decadd 100644 --- a/skills/migrate-to-rspack/SKILL.md +++ b/skills/migrate-to-rspack/SKILL.md @@ -21,7 +21,7 @@ metadata: area: migration tagline: "Migrate an existing Meteor 3 app to the Rspack bundler integration (`mainModule`, replacing legacy build plugins with loaders)." bundle: ["migration"] - docs_synced_at: "2026-09-11" + docs_synced_at: "2026-10-07" license: MIT --- @@ -30,9 +30,8 @@ license: MIT Rspack compiles app code; Meteor builds Atmosphere packages and assembles the bundle. Keep packages, but audit their architecture and browser dependencies. -Prerequisite: Meteor 3.4+. Recommended before activation: enable -`"meteor": { "modern": true }` and fix Babel fallbacks. For setup and helpers, -use `meteor-modern-build-stack`. +Meteor 3.4+ required. Prefer enabling `"meteor": { "modern": true }` and +fixing Babel fallbacks first. For setup/helpers, use `meteor-modern-build-stack`. Match `@meteorjs/rspack` to the Meteor release, not to `@rspack/core` or `@rspack/cli`: @@ -44,6 +43,7 @@ Match `@meteorjs/rspack` to the Meteor release, not to | 3.5.1 | `1.2.0` | `2.1.0` | Revised client polyfills and extension discovery. | | 3.5.2 | `1.3.0` | `2.2.0` | Dependency diagnostics, mode isolation, full-app/TLA and cache fixes. | | 3.6-beta.0 | `1.4.0-beta360.0` | `3.0.0-beta.1` | Rspack 2.2.0 and workspace-aware installs. | +| 3.6-rc.0 | `1.4.0-rc360.0` | `3.0.0-rc.0` | Rspack 2 and separate architecture entries. | The Atmosphere, Meteor npm integration, and Rspack core package versions are independent. Inspect `.meteor/versions`, `package.json`, and the lockfile. @@ -52,7 +52,7 @@ enabled. Review and commit those changes. Explicit `meteor update --npm` is an alternative, not an extra required step. Do not pair a newer integration major with an older Meteor release to copy a helper. -Already using Rspack? For the Meteor 3.6 beta upgrade, follow +Already using Rspack? For the Meteor 3.6 beta or RC upgrade, follow [Rspack 1 to 2](references/rspack-2-upgrade.md) and its toolchain checks. Keep valid entries/configuration; skip the first-activation steps below. @@ -103,6 +103,11 @@ Without `mainModule`, Rspack has no entry. Meteor's eager-loading model does not apply: Rspack does not auto-discover modules. See `references/framework-and-css.md` for CSS and HTML routing. +For the Meteor 3.6 RC pairing, keep the existing shared client entry unless +separate legacy/Cordova app or test code is needed. Use +[architecture-specific entries](../meteor-modern-build-stack/references/architecture-entries.md) +and prove delivery of both programs; earlier pairings lack these new flags. + ## Required: no nested imports in app code ```javascript @@ -182,28 +187,8 @@ app-folder files (entry folder excluded) must move to Rspack. ## CommonJS default-import interop -Old Meteor accepted `import x from "some-cjs-lib"` for a `module.exports = ...` -package. Rspack + SWC do not by default. Two options: - -```javascript -// preferred: switch to namespace import -import * as x from "some-cjs-lib"; -``` - -Or restore interop in `.swcrc`: - -```json -{ - "module": { - "type": "commonjs", - "noInterop": false, - "importInterop": "node" - } -} -``` - -This emits CommonJS, defeating tree-shaking and static analysis app-wide. -Migrate imports instead unless you cannot. +Prefer namespace imports. For the interop override and its app-wide +CommonJS/tree-shaking cost, read `references/code-migrations.md`. ## CI and Docker diff --git a/skills/migrate-to-rspack/references/eval-cases.md b/skills/migrate-to-rspack/references/eval-cases.md index fc755ac..88365b6 100644 --- a/skills/migrate-to-rspack/references/eval-cases.md +++ b/skills/migrate-to-rspack/references/eval-cases.md @@ -357,3 +357,9 @@ input/mode. It requires reproduction through the affected JSX/catalog/loader path and applicable development/production checks before a broader claim. Fail if it declares all plugin 5.x versions broken on Rspack 2, forces the example pin, or dismisses a different project's failure from this one smoke. + +## Case 36: RC legacy migration and older pairing + +Prompt: "Our existing Rspack app moves to Meteor 3.6-rc.0 and needs separate legacy browser and Cordova entries/tests. An older app stays on 3.5.2. Can we use Meteor.isLegacy at runtime or a rspack.legacy.config.js, and can a normal modern-browser CI run validate both?" + +Pass if the agent reconciles both RC integration packages, keeps selection in architecture main/test maps and conditions in the config callback, verifies Cordova mapping and actual selected suites/production delivery, preserves older shared-client entry behavior, and rejects runtime/automatic-config-file inventions or modern-only proof. diff --git a/skills/migrate-to-rspack/references/rspack-2-upgrade.md b/skills/migrate-to-rspack/references/rspack-2-upgrade.md index 2d270e2..7ec53eb 100644 --- a/skills/migrate-to-rspack/references/rspack-2-upgrade.md +++ b/skills/migrate-to-rspack/references/rspack-2-upgrade.md @@ -2,7 +2,9 @@ Use this branch for Meteor 3.6, verified on `3.6-beta.0`, with `rspack@1.4.0-beta360.0` and `@meteorjs/rspack@3.0.0-beta.1`. -Meteor 3.5.2 keeps `rspack@1.3.0`, `@meteorjs/rspack@2.2.0` and Rspack 1.x. +The 3.6-rc.0 target uses `rspack@1.4.0-rc360.0` with +`@meteorjs/rspack@3.0.0-rc.0`. Meteor 3.5.2 keeps `rspack@1.3.0`, +`@meteorjs/rspack@2.2.0` and Rspack 1.x. Do not force Rspack 2 into a constrained older release. ## Upgrade the coordinated dependency set @@ -12,7 +14,7 @@ Do not force Rspack 2 into a constrained older release. 2. With default `meteor.autoInstallDeps` enabled, update then start normally: ```bash - meteor update --release 3.6-beta.0 + meteor update --release 3.6-rc.0 meteor run ``` @@ -23,14 +25,18 @@ Do not force Rspack 2 into a constrained older release. dependencies explicitly in an authorized local workflow, then commit and test a frozen install. `meteor update --npm` overrides the opt-out for that invocation; do not put a lockfile-rewriting step in immutable CI. -3. The beta's required npm minimums are core/CLI/dev-server 2.2.0, Meteor integration +3. For the RC, use the [coordinated dependency table](../../meteor-modern-build-stack/references/meteor-3.6-workspaces.md#rspack-2-dependency-set): + core/CLI 2.2.7, dev-server 2.2.1, integration 3.0.0-rc.0, SWC 1.16.2, + helpers 0.5.23, Rsdoctor 1.6.4 and detected React refresh 2.0.2/0.19.0. + For historical beta.0, the minimums were core/CLI/dev-server 2.2.0, integration 3.0.0-beta.1, SWC core 1.15.32, helpers 0.5.23 and Rsdoctor 1.5.9. Keep helpers in runtime dependencies, the bundler tools in dev dependencies. - Detected React adds refresh plugin 2.0.0 and refresh runtime 0.17.0. + Historical beta.0 React used refresh plugin 2.0.0/runtime 0.17.0. Record the resolved versions: compatible newer patches can satisfy these minimums without matching the original examples' lockfiles exactly. 4. With npm and installed Rspack 1.x peers, the automatic upgrade uses - `--legacy-peer-deps`. The beta's manual warning can omit it. If that exact + `--legacy-peer-deps`. The RC manual command includes it; the historical + beta.0 warning can omit it. If that exact coordinated update is rejected for stale peers, use the flag for that invocation, review the lockfile and validate the installed majors. Do not use `--force`, a global peer bypass or a flag copied into pnpm/Yarn. @@ -59,7 +65,7 @@ Also check these [upstream migration boundaries](https://www.rspack.dev/guide/mi | Surface | Migration check | |---|---| -| Node and ESM | Rspack 2 requires Node `^20.19.0 \|\| >=22.12.0`. Meteor 3.6-beta.0 bundles Node 24.15.0; host Node 18 alone does not prove a Meteor build incompatibility. Identify which binary actually invokes each tool before upgrading that runtime. Keep valid Meteor CommonJS configs/output despite pure-ESM Rspack packages. | +| Node and ESM | Rspack 2 requires Node `^20.19.0 \|\| >=22.12.0`. Meteor 3.6-rc.0 bundles Node 26.10.0 (historical beta.0 used 24.15.0); host Node 18 alone does not prove a Meteor build incompatibility. Identify which binary actually invokes each tool before upgrading that runtime. Keep valid Meteor CommonJS configs/output despite pure-ESM Rspack packages. | | Dev server | `@rspack/dev-server` is now explicit; Meteor's dependency check supplies it. Review custom `devServer.proxy` and `watchFiles` against the v2 guide before reusing old shapes. | | Resolution | Upstream changes cover `.wasm` extension lookup, CSS `@import` conditions and empty `resolve.roots`. Meteor supplies explicit extensions and project roots. Inspect `resolve.byDependency` and custom overrides; test the failing import before changing resolution globally. | | Custom plugins | Review the plugin's Rspack 2 support and the [2.0 breaking-change overview](https://www.rspack.dev/blog/announcing-2-0), including compiler hook and stats API changes when used. | diff --git a/skills/migrate-to-rspack/references/validation-matrix.md b/skills/migrate-to-rspack/references/validation-matrix.md index 181f0c9..b4c1c6e 100644 --- a/skills/migrate-to-rspack/references/validation-matrix.md +++ b/skills/migrate-to-rspack/references/validation-matrix.md @@ -17,7 +17,7 @@ results. Run the applicable rows after Rspack activation. | Browser against production bundle | Client app | The real page starts; HTTP 200 from the server alone is insufficient. | | Dynamic import | Lazy feature exists | The chunk loads and executes when the feature is invoked. | | Non-root `ROOT_URL` | Subpath deployment | Assets and chunks load without duplicated or missing prefixes. | -| Legacy web architecture | Still supported | A legacy-targeted browser or equivalent bundle smoke starts. | +| Legacy web architecture | Still supported | On the 3.6 pairing, inspect main/test entry maps and select the legacy program explicitly. Verify its assets, expected test suites and production output; modern headless success alone is insufficient. A user-agent override proves delivery, not old-engine compatibility. Earlier pairings keep shared entries. | | Custom loader | Custom loader exists | Representative input passes parsing, transformation, and code generation through the actual loader entry. | | Framework preprocessing | Svelte/TypeScript, PostCSS/SCSS or UI-library inputs changed | An affected component compiles, renders and responds to interaction; expected styles survive development rebuild and production output. | | Compiler plugins | Lingui or another SWC plugin is configured | The actual bundler-hosted compiler transforms a representative input; translated output or the equivalent feature works in development and production. Run catalog extraction/generation when used. | diff --git a/test/validate-skills.test.mjs b/test/validate-skills.test.mjs index 724fc1c..f9f6c16 100644 --- a/test/validate-skills.test.mjs +++ b/test/validate-skills.test.mjs @@ -38,6 +38,32 @@ describe("validateSkills", () => { expect(findings).toEqual([]); }); + it("accepts folded YAML descriptions and nested catalog metadata", async () => { + await withTempRoot(async (root) => { + const skillDir = join(root, "meteor-example"); + mkdirSync(join(skillDir, "references"), { recursive: true }); + writeFileSync(join(skillDir, "SKILL.md"), `--- +name: meteor-example +description: > + Use when checking Meteor metadata with folded YAML. + Triggers on a catalog parser upgrade. +metadata: + author: meteor + kind: knowledge + meteor: ">=3.0" + area: testing + tagline: "Validate YAML: folded text and nested metadata." + bundle: [essentials] + docs_synced_at: "2026-10-07" +--- + +# Example +`); + writeFileSync(join(skillDir, "references", "eval-cases.md"), "# Cases\n"); + expect(await validateSkills({ root: skillDir, singleSkill: true })).toEqual([]); + }); + }); + it("accepts bundle metadata that matches bundles.json", async () => { const findings = await validateSkills({ root: join(fixturesDir, "valid"),