Two related asks:

1. Expand the published-Dive import allowlist to cover network-graph / 3D libraries — e.g. react-force-graph-2d/3d, three, or a sanctioned graph lib like reactflow / @visx/network. Today the runtime resolves only react,

@motherduck/react-sql-query, recharts, d3, and lucide-react.

2. Enforce the allowlist in the local preview harness (or surface it via a build/lint check), so an unsupported import fails at build time instead of at publish.

Why it matters: I built an NFL coaching-tree Dive as a force-directed graph using react-force-graph. It built and looked finished in the local .dive-preview/ Vite harness — because that harness is a normal Vite app that can npm install anything. Only at publish did I hit the fixed runtime allowlist: the graph library was unresolved and the Dive crashed. The guide says "what you preview is what gets saved," but preview doesn't actually enforce the runtime allowlist, so the failure surfaces only after the work is done. I ended up rewriting the whole renderer by with Claude by hand-rolling the force layout and projection onto a plain <canvas> using only React and the allowed d3 math.

Even without expanding the allowed libraries, enforcing the allowlist in preview would have let me know I was going down the wrong path.

Published Dive for reference: https://motherduck.com/dive-gallery/dives/nfl-coaching-tree

*Written by Claude Sonnett 4.8, verified by Will Hea