Section 2.3.2 of the specification reads (in part):
A JAX-RS application is packaged as a Web application in a .war file. The application classes are packaged in WEB-INF/classes or WEB-INF/lib and required libraries are packaged in WEB-INF/lib. See the Servlet specification for full details on packaging of web applications.
In either of the latter two cases, if both Application.getClasses and Application.getSingletons return an empty list then all root resource classes and providers packaged in the web application MUST be included in the published JAX-RS application. If either getClasses or getSingletons return a non-empty list then only those classes or singletons returned MUST be included in the published JAX-RS application.
Both cases assume that the JAX-RS application will be (can only be) assembled as a web application. But what about an enterprise application? Does the requirement that resource classes be packaged in .jar files in the lib directory of a .war file still hold? The second paragraph cited above, in particular, mixes strict packaging requirements ("all root resource classes and providers packaged in the web application") with visibility concerns (the second sentence makes no mention of where the "classes or singletons returned" may live, and therefore as long as they're visible everything should work).
Working from an old email from Paul Sandoz, I suspect that what was intended throughout the specification was a clarification of class visibility, not class location. I would appreciate it if the specification could be amended to state what is and isn't legal in an .ear packaging scenario as well as a .war scenario.
The forum discussion is here: http://java.net/projects/javaee-spec/lists/users/archive/2012-10/message/27