milestone 23 s2: react aria primitives and their cluster

licenses/inventory.zon

@@ -45,11 +45,26 @@
 // sourcemap build of a component calling stylex.props shows none of them in any
 // `sources` list.
 //
-// StyleX itself is inventoried below although nothing imports it yet, so no
-// chunk carries it today. The licence is carried now because the same sourcemap
-// build settles what the page conversion will land, and it is not the obvious
-// answer: only @stylexjs/stylex appears as a bundled package, and styleq
-// arrives inside it. The published lib/es/stylex.mjs vendors styleq's source
+// Seven more joined that list with React Aria, and the sourcemap build is again
+// what settled which: @internationalized/date, @internationalized/number,
+// @react-types/shared, @swc/helpers, aria-hidden, client-only and tslib are in
+// the runtime closure but contribute no module to any chunk. The date and number
+// packages serve the calendar and number-field components ruling 4 keeps out of
+// scope; @react-types/shared is types only and emits no runtime code;
+// client-only is a build-time marker for React Server Components; @swc/helpers
+// and tslib are downlevelling helpers the published ESM builds never reach for;
+// and aria-hidden sits behind a react-aria path the four adopted components do
+// not take. Their licences differ and are recorded one by one in
+// src/licenses_drift_test.zig rather than lumped together: @internationalized/
+// date, @internationalized/number, @react-types/shared and @swc/helpers are
+// Apache-2.0, tslib is 0BSD, aria-hidden and client-only are MIT. Keeping all
+// seven out of the bundle is a fact worth re-checking rather than assuming, so
+// the guard fails if any of them turns up in a `sources` list.
+//
+// StyleX now ships: the converted pages call stylex.props, and a sourcemap build
+// puts @stylexjs/stylex in the bundle. What that build settles is not the
+// obvious answer, though: only @stylexjs/stylex appears as a bundled package,
+// and styleq arrives inside it. The published lib/es/stylex.mjs vendors styleq's source
 // instead of importing it, so styleq's bytes ship while styleq never appears in
 // a `sources` list — no guard would raise it, which is why it is written down
 // here.
@@ -109,6 +124,18 @@
         .note = "Bundled into the admin UI JavaScript. Grouped because all five carry the identical MIT text and copyright line.",
         .file = "tanstack-mit.txt",
     },
+    .{
+        .component = "React Aria (react-aria-components, react-aria, react-stately, @internationalized/string)",
+        .version = "react-aria-components 1.20.0, react-aria 3.51.0, react-stately 3.49.0, @internationalized/string 3.2.10",
+        .note = "The dialog, alert dialog, tab and select behaviour of the admin UI, bundled into the JavaScript embedded in the binary. The first Apache-2.0 npm dependency this project has taken, and the first non-MIT one: Mokhtar Mial accepted Apache-2.0 inbound for nxdns on 2026-08-12, which is the decision that let these four ship. Apache-2.0 Section 4 attribution is satisfied by carrying the licence text in THIRD-PARTY-NOTICES, which the file below does; none of the four ships a NOTICE file, so 4(d) adds nothing. All four carry a byte-identical LICENSE. In the tarballs and in the image.",
+        .file = "react-aria-apache-2.0.txt",
+    },
+    .{
+        .component = "clsx",
+        .version = "clsx 2.1.1",
+        .note = "The class-name joiner React Aria calls when it merges a render-prop class name with its own. Bundled into the admin UI JavaScript. Separate entry from the other MIT packages: same MIT text, different copyright line.",
+        .file = "clsx-mit.txt",
+    },
     .{
         .component = "StyleX",
         .version = "@stylexjs/stylex 0.19.0",