Spike a React Native chart host

[tannerlinsley]

Depends on #8.

Summary

• add a private @tanstack/react-native-charts host proof using React Native SVG
• add a React Native 0.86 fixture, focused host tests, native-only type checks, and bundle boundary checks
• measure both host-only and full Metro bundle cost on iOS and Android
• document supported behavior, current gaps, likely breaking-change boundaries, and a production path

Compatibility

This branch adds no public API to an existing package. The native adapter remains private and source-only, while existing browser imports and behavior are unchanged. It consumes the additive /portable and /types boundaries introduced by #8.

Evidence

• shared definitions, runtime, scene generation, focus logic, and line geometry run without browser modules in the native bundle
• React Native SVG host: 28.70 kB minified / 10.75 kB gzip
• React Native line consumer: 50.67 kB minified / 19.44 kB gzip
• full Metro delta over the blank fixture: 308.63 KiB on iOS / 308.77 KiB on Android
• full Metro gzip delta: 72.29 KiB on iOS / 72.34 KiB on Android

Boundaries

• no simulator or physical-device visual/interaction validation yet
• no Hermes bytecode, startup, memory, binary-size, VoiceOver, or TalkBack measurements
• responder/scroll integration and tooltip item construction still need production policy
• typography, gradients, native theme defaults, and some transition semantics remain incomplete
• strict native declarations still encounter the known upstream @types/d3-array ImageData reference
• the adapter is intentionally not publishable in this PR

Validation

• CI=true pnpm install --frozen-lockfile
• CI=true pnpm test — 3,214 root tests plus adapter suites
• pnpm typecheck
• pnpm react-native:poc:types
• pnpm bundle:check
• pnpm react-native:poc:bundle — eight Metro builds with source-map boundary checks
• pnpm package:check
• node scripts/check-docs.mjs

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 29f1cd56-3602-47f5-94df-756c8168955c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​react-native/​metro-config@​0.86.0
	@​react-native/​typescript-config@​0.86.0
	@​react-native-community/​cli@​20.1.0
	@​babel/​runtime@​7.29.7
	@​react-native/​babel-preset@​0.86.0
	react-native-svg@​15.15.5
	react-native@​0.86.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/react-native@0.86.0 → npm/@react-native/debugger-frontend@0.86.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.86.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @react-native/debugger-frontend is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/react-native@0.86.0 → npm/@react-native/debugger-frontend@0.86.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-native/debugger-frontend@0.86.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm fast-xml-parser is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@react-native-community/cli@20.1.0 → npm/fast-xml-parser@4.5.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-xml-parser@4.5.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@react-native/babel-preset@0.86.0 → npm/@react-native/metro-config@0.86.0 → npm/react-native@0.86.0 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report