@mozole/cli 1.3.2 → 1.4.1

package/dist/scaffold/legacy.js

@@ -0,0 +1,139 @@
+/** Exact pre-1.4 templates, used only to recognize and migrate generator-owned text. */
+export const legacyInstructions = {
+    "AGENTS.md": "# Project guide\n\n## Commands\n\n- `npm run dev` \u2014 local app\n- `npm run verify` \u2014 lint, typecheck, tests, production build\n- `npm run qa` \u2014 deterministic browser QA (no screenshots)\n- `npm run qa:interactive` \u2014 adds safe interaction probes\n- `npm run qa:visual` \u2014 explicit screenshot review\n- `mozole cce install` \u2014 install persistent CCE and required uv runtime\n- `mozole ui` \u2014 full-screen terminal dashboard\n\n## Architecture\n\nReact Router Framework Mode lives in `app/`; routes are in `app/routes.ts`; static output is `build/client/`. Mozole settings are in `.mozole/`; Antigravity integration is in `.agents/`; deeper decisions belong in `docs/`.\n\n## Mandatory CCE contract\n\nRepository reads are forbidden by default. Allowed retrieval order:\n\n1. CCE `context_search`\n2. additional CCE search, `expand_chunk`, or `related_context`\n3. bounded line-range read only when CCE output is insufficient\n4. full-file read only after explicit escalation\n\nEditing a file is NOT sufficient justification for reading it in full. If CCE is unavailable, stop and report the blocker instead of falling back to repository reads. Prefer localized patches and inspect `git diff`. Keep narration and successful logs concise. Routine browser validation uses screenshot-free `mozole qa`; visual QA requires an explicit user request or confirmed deterministic failure. Stop after requested work, `mozole verify`, and relevant routine QA pass.\n",
+    "CLAUDE.md": "@AGENTS.md\n\n## Claude Code CCE contract\n\nRepository reads are forbidden by default. Use `context_search`, then additional CCE retrieval. Read may use a bounded line range only when CCE is insufficient; a full-file Read requires explicit escalation. Editing is not justification. If CCE is unavailable, report the blocker; do not fall back.\n",
+    "docs/design-tokens.md": "# Design tokens\n\nComplete this contract before writing UI code. Replace every TODO custom-property value in `app/styles/global.css` with a deliberate project-specific choice.\n\n## Required decisions\n\n- `--color-bg`: primary page background.\n- `--color-fg`: primary text and foreground.\n- `--color-accent`: interactive and emphasis color.\n- `--font-display`: heading/display family and fallbacks.\n- `--font-body`: body/interface family and fallbacks.\n- Record one paragraph explaining visual direction, typography, palette, spacing, and layout before generating markup for each new page.\n\n## Banned default patterns\n\nDo not use these as automatic defaults:\n\n- Warm cream background with terracotta accent palette.\n- Identical border-radius and soft grey box-shadow on every card.\n- Uppercase, tracked-out eyebrow labels.\n- En- or em-dash-joined meta labels.\n- Arrow glyphs appended to button text.\n",
+};
+export function legacyBackendTemplates(name) {
+    return {
+        "api/index.php": `<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/config.php';
+
+header('Content-Type: application/json; charset=utf-8');
+header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: DENY');
+
+$method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
+$uri = parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH) ?? '/';
+
+// Normalize URI to match route path (handles both /api/path and direct /path on dev server)
+$basePrefix = '/api';
+if (str_starts_with($uri, $basePrefix)) {
+    $route = '/' . ltrim(substr($uri, strlen($basePrefix)), '/');
+} else {
+    $route = '/' . ltrim($uri, '/');
+}
+
+switch ($route) {
+    case '/':
+    case '/health':
+        echo json_encode([
+            'status' => 'ok',
+            'app' => '${name}',
+            'runtime' => 'PHP ' . PHP_VERSION,
+            'timestamp' => time(),
+        ], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
+        break;
+
+    case '/info':
+        echo json_encode([
+            'name' => '${name}',
+            'backend' => 'PHP native API',
+            'endpoints' => [
+                'GET /api/health' => 'Service status check',
+                'GET /api/info' => 'Backend metadata',
+            ],
+        ], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
+        break;
+
+    default:
+        http_response_code(404);
+        echo json_encode([
+            'error' => 'Endpoint not found',
+            'path' => $uri,
+        ], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
+        break;
+}
+`,
+        "api/config.php": `<?php
+declare(strict_types=1);
+
+function env(string $key, ?string $default = null): ?string {
+    $value = getenv($key);
+    return $value !== false ? $value : $default;
+}
+
+// Environment configuration
+define('APP_ENV', env('APP_ENV', 'development'));
+define('APP_DEBUG', env('APP_DEBUG', 'true') === 'true');
+
+// Optional database connection helper
+function get_db_connection(): ?PDO {
+    static $pdo = null;
+    if ($pdo !== null) {
+        return $pdo;
+    }
+
+    $dsn = env('DB_DSN');
+    if (!$dsn) {
+        return null;
+    }
+
+    $user = env('DB_USER', '');
+    $pass = env('DB_PASS', '');
+
+    try {
+        $pdo = new PDO($dsn, $user, $pass, [
+            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
+            PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+            PDO::ATTR_EMULATE_PREPARES => false,
+        ]);
+        return $pdo;
+    } catch (PDOException $e) {
+        if (APP_DEBUG) {
+            throw $e;
+        }
+        return null;
+    }
+}
+`,
+        ".htaccess": `<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteBase /
+
+    # Route API requests to PHP front-controller
+    RewriteRule ^api(/.*)?$ api/index.php [QSA,L]
+
+    # Serve static assets directly if they exist
+    RewriteCond %{REQUEST_FILENAME} -f [OR]
+    RewriteCond %{REQUEST_FILENAME} -d
+    RewriteRule ^ - [L]
+
+    # Fallback to prerendered / client index for SPA routes
+    RewriteRule ^index\\.html$ - [L]
+    RewriteRule . /index.html [L]
+</IfModule>
+`,
+        "docs/backend-php.md": `# PHP Backend Architecture
+
+This project combines a **static-first React + Vite frontend** with a lightweight, native **PHP backend API**.
+
+## How It Works
+
+### Local Development
+- **Frontend (React + Vite)**: Runs via \`npm run dev\` (typically at \`http://127.0.0.1:5173\`).
+- **Backend (PHP API)**: Runs via \`npm run dev:api\` (\`php -S 127.0.0.1:8000 -t api\`).
+- **Proxy**: Vite's \`server.proxy\` automatically forwards all \`/api/*\` requests from the browser directly to the PHP dev server. Your React code calls \`fetch("/api/health")\` without dealing with CORS or port mismatches.
+
+### Production Deployment (Apache / LiteSpeed / Nginx)
+- **Zero Node.js runtime required**: Deploy the \`build/client/\` static files and the \`api/\` directory to any shared hosting or VPS.
+- **Apache / LiteSpeed**: The provided \`.htaccess\` handles routing:
+  - All \`/api/*\` calls are routed directly to \`api/index.php\`.
+  - All static HTML, CSS, JS, and image assets are served directly by the web server at maximum speed.
+- **Nginx**: Forward \`/api/\` to \`fastcgi_pass\` and serve \`try_files $uri $uri/ /index.html\`.
+`,
+    };
+}
+//# sourceMappingURL=legacy.js.map

package/dist/scaffold/legacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy.js","sourceRoot":"","sources":["../../src/scaffold/legacy.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACxD,WAAW,EACT,48CAA48C;IAC98C,WAAW,EACT,2VAA2V;IAC7V,uBAAuB,EACrB,w5BAAw5B;CAC35B,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO;QACL,eAAe,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;wBAyBG,IAAI;;;;;;;;yBAQH,IAAI;;;;;;;;;;;;;;;;;CAiB5B;QAEG,gBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCrB;QAEG,WAAW,EAAE;;;;;;;;;;;;;;;;CAgBhB;QAEG,qBAAqB,EAAE;;;;;;;;;;;;;;;;;CAiB1B;KACE,CAAC;AACJ,CAAC"}

package/dist/scaffold/routes.d.ts

@@ -0,0 +1,3 @@
+/** Discover literal React Router route/prefix calls without evaluating project code. */
+export declare function detectRoutes(source: string): string[];
+//# sourceMappingURL=routes.d.ts.map

package/dist/scaffold/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/scaffold/routes.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAqCrD"}

package/dist/scaffold/routes.js

@@ -0,0 +1,37 @@
+/** Discover literal React Router route/prefix calls without evaluating project code. */
+export function detectRoutes(source) {
+    const tokens = (source.match(/\/\*[\s\S]*?\*\/|\/\/[^\n]*|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[a-zA-Z_$][\w$]*|[^\s]/g) ?? []).filter((token) => !token.startsWith("//") && !token.startsWith("/*"));
+    const routes = new Set(["/"]);
+    function scan(start, end, base) {
+        for (let i = start; i < end; i++) {
+            const name = tokens[i];
+            if (!["route", "prefix", "layout", "index"].includes(name ?? "") ||
+                tokens[i + 1] !== "(")
+                continue;
+            let depth = 1;
+            let close = i + 2;
+            for (; close < end; close++) {
+                if (tokens[close] === "(")
+                    depth++;
+                if (tokens[close] === ")" && --depth === 0)
+                    break;
+            }
+            const literal = tokens[i + 2];
+            const value = literal && /^["']/.test(literal) ? literal.slice(1, -1) : undefined;
+            if (name === "layout")
+                scan(i + 2, close, base);
+            else if (name === "index")
+                routes.add(base || "/");
+            else if (value !== undefined && !/[:*?\\]/.test(value)) {
+                const joined = `${base}/${value}`.replace(/\/{2,}/g, "/").replace(/\/$/, "") || "/";
+                if (name === "route")
+                    routes.add(joined);
+                scan(i + 3, close, joined);
+            }
+            i = close;
+        }
+    }
+    scan(0, tokens.length, "");
+    return [...routes];
+}
+//# sourceMappingURL=routes.js.map

package/dist/scaffold/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/scaffold/routes.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,MAAM,GAAG,CACb,MAAM,CAAC,KAAK,CACV,yFAAyF,CAC1F,IAAI,EAAE,CACR,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,IAAI,CAAC,KAAa,EAAE,GAAW,EAAE,IAAY;QACpD,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACvB,IACE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC5D,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBAErB,SAAS;YACX,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC5B,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;gBACnC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,KAAK,CAAC;oBAAE,MAAM;YACpD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,MAAM,KAAK,GACT,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,IAAI,IAAI,KAAK,QAAQ;gBAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;iBAC3C,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;iBAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvD,MAAM,MAAM,GACV,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;gBACvE,IAAI,IAAI,KAAK,OAAO;oBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACzC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7B,CAAC;YACD,CAAC,GAAG,KAAK,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC"}

package/dist/scaffold/standalone.d.ts

@@ -0,0 +1,7 @@
+/** Standalone project tooling: no dependency on the generator at runtime. */
+export declare const backendCheckScript = "import { spawnSync } from \"node:child_process\";\nimport { readdir } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nfunction php(args) {\n  const result = spawnSync(\"php\", args, {\n    encoding: \"utf8\",\n    shell: false,\n    timeout: 10000,\n  });\n  if (result.error || result.status !== 0)\n    throw new Error(result.error?.message || result.stderr || result.stdout);\n  return result.stdout.trim();\n}\nasync function lint(directory) {\n  for (const entry of await readdir(directory, { withFileTypes: true })) {\n    const file = path.join(directory, entry.name);\n    if (entry.isDirectory()) await lint(file);\n    else if (entry.isFile() && entry.name.endsWith(\".php\")) php([\"-l\", file]);\n  }\n}\ntry {\n  const version = Number(php([\"-r\", \"echo PHP_VERSION_ID;\"]));\n  if (!Number.isInteger(version) || version < 80000)\n    throw new Error(\"PHP 8.0 or newer is required.\");\n  await lint(\"api\");\n  console.log(\"PHP PASS\");\n} catch (error) {\n  console.error(`PHP FAIL\\n${error.message}`);\n  process.exitCode = 1;\n}\n";
+export declare const deployScript = "import { cp, lstat, mkdir, rename, rm } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nconst target = path.resolve(\"deploy\");\nconst staging = `${target}.${process.pid}.tmp`;\nconst backup = `${target}.${process.pid}.backup`;\nlet backedUp = false;\ntry {\n  await mkdir(staging);\n  await cp(\"build/client\", staging, { recursive: true, errorOnExist: true });\n  await cp(\"api\", path.join(staging, \"api\"), { recursive: true });\n  await cp(\".htaccess\", path.join(staging, \".htaccess\"));\n  try {\n    await lstat(target);\n    await rename(target, backup);\n    backedUp = true;\n  } catch (error) {\n    if (error.code !== \"ENOENT\") throw error;\n  }\n  try {\n    await rename(staging, target);\n  } catch (error) {\n    if (backedUp) await rename(backup, target);\n    throw error;\n  }\n  if (backedUp) await rm(backup, { recursive: true });\n  console.log(\"DEPLOY READY: deploy/\");\n} finally {\n  await rm(staging, { recursive: true, force: true });\n}\n";
+export declare const qaScript = "import { spawn, spawnSync } from \"node:child_process\";\nimport { mkdir, readFile } from \"node:fs/promises\";\nimport net from \"node:net\";\nimport { chromium } from \"playwright\";\n\nconst flags = process.argv.slice(2);\nif (\n  flags.some((flag) => ![\"--visual\", \"--interactive\", \"--force\"].includes(flag))\n)\n  throw new Error(\"Unknown QA option\");\nconst config = JSON.parse(await readFile(\".mozole/project.json\", \"utf8\"));\nconst socket = net.createServer();\nawait new Promise((resolve, reject) => {\n  socket.once(\"error\", reject);\n  socket.listen(0, \"127.0.0.1\", resolve);\n});\nconst port = socket.address().port;\nawait new Promise((resolve) => socket.close(resolve));\nconst configured = config.qa.server;\nconst npmCli = process.env.npm_execpath;\nif (configured.command === \"npm\" && !npmCli) {\n  throw new Error(\n    \"Run QA through npm run qa so npm can be resolved without a shell.\",\n  );\n}\nconst command =\n  configured.command === \"npm\" ? process.execPath : configured.command;\nconst args = [\n  ...(configured.command === \"npm\" ? [npmCli] : []),\n  ...configured.args,\n  \"--port\",\n  String(port),\n  \"--strictPort\",\n];\nconst child = spawn(command, args, {\n  shell: false,\n  detached: process.platform !== \"win32\",\n  stdio: [\"ignore\", \"pipe\", \"pipe\"],\n});\nlet serverLog = \"\";\nfor (const stream of [child.stdout, child.stderr])\n  stream.on(\"data\", (data) => {\n    serverLog = (serverLog + data).slice(-4000);\n  });\nlet serverError;\nchild.on(\"error\", (error) => {\n  serverError = error;\n});\nlet browser;\nlet stopping = false;\nasync function cleanup() {\n  if (stopping) return;\n  stopping = true;\n  await browser?.close().catch(() => {});\n  if (child.pid) {\n    if (process.platform === \"win32\")\n      spawnSync(\"taskkill\", [\"/pid\", String(child.pid), \"/T\", \"/F\"], {\n        shell: false,\n        stdio: \"ignore\",\n      });\n    else {\n      try {\n        process.kill(-child.pid, \"SIGTERM\");\n      } catch {}\n    }\n  }\n}\nconst interrupted = () => {\n  void cleanup().finally(() => process.exit(130));\n};\nprocess.once(\"SIGINT\", interrupted);\nprocess.once(\"SIGTERM\", interrupted);\nconst deadline = setTimeout(() => {\n  console.error(\"QA timed out\");\n  void cleanup().finally(() => process.exit(1));\n}, 120000);\nconst base = `http://127.0.0.1:${port}`;\ntry {\n  let ready = false;\n  for (let attempt = 0; attempt < 300; attempt++) {\n    if (serverError || child.exitCode !== null)\n      throw new Error(serverError?.message || serverLog);\n    try {\n      ready = (\n        await fetch(base + config.qa.server.readinessPath, {\n          signal: AbortSignal.timeout(1000),\n        })\n      ).ok;\n    } catch {}\n    if (ready) break;\n    await new Promise((resolve) => setTimeout(resolve, 100));\n  }\n  if (!ready)\n    throw new Error(`Development server did not become ready.\\n${serverLog}`);\n  browser = await chromium.launch();\n  const failures = [];\n  for (const viewport of config.qa.viewports) {\n    const page = await browser.newPage({ viewport });\n    page.on(\"pageerror\", (error) => failures.push(error.message));\n    page.on(\"console\", (message) => {\n      if (message.type() === \"error\") failures.push(message.text());\n    });\n    page.on(\"requestfailed\", (request) => {\n      if (request.failure()?.errorText !== \"net::ERR_ABORTED\")\n        failures.push(request.url());\n    });\n    page.on(\"response\", (response) => {\n      if (response.status() >= 400)\n        failures.push(`${response.status()} ${response.url()}`);\n    });\n    for (const route of config.routes) {\n      const response = await page.goto(base + route, {\n        waitUntil: \"networkidle\",\n      });\n      if (!response?.ok()) failures.push(`${route}: HTTP failure`);\n      const issues = await page.evaluate(() => {\n        const found = [];\n        if (!document.documentElement.lang) found.push(\"missing lang\");\n        if (!document.title.trim()) found.push(\"missing title\");\n        if (!document.querySelector(\"h1\")) found.push(\"missing h1\");\n        if (document.documentElement.scrollWidth > innerWidth + 1)\n          found.push(\"horizontal overflow\");\n        for (const element of document.querySelectorAll(\n          \"a, button, input:not([type=hidden]), select, textarea\",\n        )) {\n          if (!element.getClientRects().length) continue;\n          const labelled = (element.getAttribute(\"aria-labelledby\") || \"\")\n            .split(/\\s+/)\n            .some((id) => document.getElementById(id)?.textContent?.trim());\n          if (\n            !element.textContent?.trim() &&\n            !element.getAttribute(\"aria-label\") &&\n            !labelled &&\n            !element.labels?.length &&\n            !element.getAttribute(\"title\") &&\n            !element.getAttribute(\"alt\") &&\n            !element.querySelector(\"img[alt]\")\n          )\n            found.push(\"unnamed control\");\n        }\n        return found;\n      });\n      failures.push(...issues.map((issue) => `${route}: ${issue}`));\n      const links = await page\n        .locator(\"a[href]\")\n        .evaluateAll((anchors) => anchors.map((anchor) => anchor.href));\n      for (const href of new Set(links)) {\n        if (\n          new URL(href).origin === base &&\n          !(await page.request.get(href)).ok()\n        )\n          failures.push(`broken link: ${href}`);\n      }\n      if (flags.includes(\"--interactive\")) {\n        await page.keyboard.press(\"Tab\");\n        if (\n          !(await page.evaluate(() => document.activeElement !== document.body))\n        )\n          failures.push(`${route}: keyboard focus missing`);\n      }\n      if (flags.includes(\"--visual\")) {\n        await mkdir(\".mozole/qa\", { recursive: true });\n        const name = route.replace(/[^a-z0-9_-]/gi, \"-\") || \"index\";\n        await page.screenshot({\n          path:\n            \".mozole/qa/\" +\n            viewport.width +\n            \"x\" +\n            viewport.height +\n            \"-\" +\n            name +\n            \".png\",\n          fullPage: true,\n        });\n      }\n    }\n    await page.close();\n  }\n  if (failures.length) throw new Error([...new Set(failures)].join(\"\\n\"));\n  console.log(\n    \"QA PASS: \" +\n      config.routes.length +\n      \" routes, \" +\n      config.qa.viewports.length +\n      \" viewports\",\n  );\n} catch (error) {\n  console.error(`QA FAIL\\n${error.message}`);\n  process.exitCode = 1;\n} finally {\n  clearTimeout(deadline);\n  process.removeListener(\"SIGINT\", interrupted);\n  process.removeListener(\"SIGTERM\", interrupted);\n  await cleanup();\n}\n";
+export declare function basicAgentGuide(backend: boolean): string;
+export declare const extraVerifierScript = "import { spawnSync } from \"node:child_process\";\nimport { readFile } from \"node:fs/promises\";\n\nconst config = JSON.parse(await readFile(\".mozole/project.json\", \"utf8\"));\nfor (const check of config.verifiers ?? []) {\n  if (\n    typeof check.command !== \"string\" ||\n    !Array.isArray(check.args) ||\n    !check.args.every((arg) => typeof arg === \"string\")\n  )\n    throw new Error(\"Invalid extra verifier\");\n  const npm = check.command === \"npm\";\n  if (npm && !process.env.npm_execpath)\n    throw new Error(\"Run verification through npm run verify\");\n  const result = spawnSync(\n    npm ? process.execPath : check.command,\n    npm ? [process.env.npm_execpath, ...check.args] : check.args,\n    { shell: false, stdio: \"inherit\", timeout: 600000 },\n  );\n  if (result.error || result.status !== 0) {\n    console.error(\n      \"Extra verifier failed:\",\n      check.name,\n      result.error?.message ?? result.status,\n    );\n    process.exit(result.status || 1);\n  }\n}\n";
+//# sourceMappingURL=standalone.d.ts.map

package/dist/scaffold/standalone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone.d.ts","sourceRoot":"","sources":["../../src/scaffold/standalone.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,ijCA+B9B,CAAC;AAEF,eAAO,MAAM,YAAY,q+BA8BxB,CAAC;AAEF,eAAO,MAAM,QAAQ,qlNAmMpB,CAAC;AAEF,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAExD;AAED,eAAO,MAAM,mBAAmB,q/BA4B/B,CAAC"}

package/dist/scaffold/standalone.js

@@ -0,0 +1,294 @@
+import { designGuardrails } from "./design.js";
+/** Standalone project tooling: no dependency on the generator at runtime. */
+export const backendCheckScript = `import { spawnSync } from "node:child_process";
+import { readdir } from "node:fs/promises";
+import path from "node:path";
+
+function php(args) {
+  const result = spawnSync("php", args, {
+    encoding: "utf8",
+    shell: false,
+    timeout: 10000,
+  });
+  if (result.error || result.status !== 0)
+    throw new Error(result.error?.message || result.stderr || result.stdout);
+  return result.stdout.trim();
+}
+async function lint(directory) {
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const file = path.join(directory, entry.name);
+    if (entry.isDirectory()) await lint(file);
+    else if (entry.isFile() && entry.name.endsWith(".php")) php(["-l", file]);
+  }
+}
+try {
+  const version = Number(php(["-r", "echo PHP_VERSION_ID;"]));
+  if (!Number.isInteger(version) || version < 80000)
+    throw new Error("PHP 8.0 or newer is required.");
+  await lint("api");
+  console.log("PHP PASS");
+} catch (error) {
+  console.error(\`PHP FAIL\\n\${error.message}\`);
+  process.exitCode = 1;
+}
+`;
+export const deployScript = `import { cp, lstat, mkdir, rename, rm } from "node:fs/promises";
+import path from "node:path";
+
+const target = path.resolve("deploy");
+const staging = \`\${target}.\${process.pid}.tmp\`;
+const backup = \`\${target}.\${process.pid}.backup\`;
+let backedUp = false;
+try {
+  await mkdir(staging);
+  await cp("build/client", staging, { recursive: true, errorOnExist: true });
+  await cp("api", path.join(staging, "api"), { recursive: true });
+  await cp(".htaccess", path.join(staging, ".htaccess"));
+  try {
+    await lstat(target);
+    await rename(target, backup);
+    backedUp = true;
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  try {
+    await rename(staging, target);
+  } catch (error) {
+    if (backedUp) await rename(backup, target);
+    throw error;
+  }
+  if (backedUp) await rm(backup, { recursive: true });
+  console.log("DEPLOY READY: deploy/");
+} finally {
+  await rm(staging, { recursive: true, force: true });
+}
+`;
+export const qaScript = `import { spawn, spawnSync } from "node:child_process";
+import { mkdir, readFile } from "node:fs/promises";
+import net from "node:net";
+import { chromium } from "playwright";
+
+const flags = process.argv.slice(2);
+if (
+  flags.some((flag) => !["--visual", "--interactive", "--force"].includes(flag))
+)
+  throw new Error("Unknown QA option");
+const config = JSON.parse(await readFile(".mozole/project.json", "utf8"));
+const socket = net.createServer();
+await new Promise((resolve, reject) => {
+  socket.once("error", reject);
+  socket.listen(0, "127.0.0.1", resolve);
+});
+const port = socket.address().port;
+await new Promise((resolve) => socket.close(resolve));
+const configured = config.qa.server;
+const npmCli = process.env.npm_execpath;
+if (configured.command === "npm" && !npmCli) {
+  throw new Error(
+    "Run QA through npm run qa so npm can be resolved without a shell.",
+  );
+}
+const command =
+  configured.command === "npm" ? process.execPath : configured.command;
+const args = [
+  ...(configured.command === "npm" ? [npmCli] : []),
+  ...configured.args,
+  "--port",
+  String(port),
+  "--strictPort",
+];
+const child = spawn(command, args, {
+  shell: false,
+  detached: process.platform !== "win32",
+  stdio: ["ignore", "pipe", "pipe"],
+});
+let serverLog = "";
+for (const stream of [child.stdout, child.stderr])
+  stream.on("data", (data) => {
+    serverLog = (serverLog + data).slice(-4000);
+  });
+let serverError;
+child.on("error", (error) => {
+  serverError = error;
+});
+let browser;
+let stopping = false;
+async function cleanup() {
+  if (stopping) return;
+  stopping = true;
+  await browser?.close().catch(() => {});
+  if (child.pid) {
+    if (process.platform === "win32")
+      spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+        shell: false,
+        stdio: "ignore",
+      });
+    else {
+      try {
+        process.kill(-child.pid, "SIGTERM");
+      } catch {}
+    }
+  }
+}
+const interrupted = () => {
+  void cleanup().finally(() => process.exit(130));
+};
+process.once("SIGINT", interrupted);
+process.once("SIGTERM", interrupted);
+const deadline = setTimeout(() => {
+  console.error("QA timed out");
+  void cleanup().finally(() => process.exit(1));
+}, 120000);
+const base = \`http://127.0.0.1:\${port}\`;
+try {
+  let ready = false;
+  for (let attempt = 0; attempt < 300; attempt++) {
+    if (serverError || child.exitCode !== null)
+      throw new Error(serverError?.message || serverLog);
+    try {
+      ready = (
+        await fetch(base + config.qa.server.readinessPath, {
+          signal: AbortSignal.timeout(1000),
+        })
+      ).ok;
+    } catch {}
+    if (ready) break;
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+  if (!ready)
+    throw new Error(\`Development server did not become ready.\\n\${serverLog}\`);
+  browser = await chromium.launch();
+  const failures = [];
+  for (const viewport of config.qa.viewports) {
+    const page = await browser.newPage({ viewport });
+    page.on("pageerror", (error) => failures.push(error.message));
+    page.on("console", (message) => {
+      if (message.type() === "error") failures.push(message.text());
+    });
+    page.on("requestfailed", (request) => {
+      if (request.failure()?.errorText !== "net::ERR_ABORTED")
+        failures.push(request.url());
+    });
+    page.on("response", (response) => {
+      if (response.status() >= 400)
+        failures.push(\`\${response.status()} \${response.url()}\`);
+    });
+    for (const route of config.routes) {
+      const response = await page.goto(base + route, {
+        waitUntil: "networkidle",
+      });
+      if (!response?.ok()) failures.push(\`\${route}: HTTP failure\`);
+      const issues = await page.evaluate(() => {
+        const found = [];
+        if (!document.documentElement.lang) found.push("missing lang");
+        if (!document.title.trim()) found.push("missing title");
+        if (!document.querySelector("h1")) found.push("missing h1");
+        if (document.documentElement.scrollWidth > innerWidth + 1)
+          found.push("horizontal overflow");
+        for (const element of document.querySelectorAll(
+          "a, button, input:not([type=hidden]), select, textarea",
+        )) {
+          if (!element.getClientRects().length) continue;
+          const labelled = (element.getAttribute("aria-labelledby") || "")
+            .split(/\\s+/)
+            .some((id) => document.getElementById(id)?.textContent?.trim());
+          if (
+            !element.textContent?.trim() &&
+            !element.getAttribute("aria-label") &&
+            !labelled &&
+            !element.labels?.length &&
+            !element.getAttribute("title") &&
+            !element.getAttribute("alt") &&
+            !element.querySelector("img[alt]")
+          )
+            found.push("unnamed control");
+        }
+        return found;
+      });
+      failures.push(...issues.map((issue) => \`\${route}: \${issue}\`));
+      const links = await page
+        .locator("a[href]")
+        .evaluateAll((anchors) => anchors.map((anchor) => anchor.href));
+      for (const href of new Set(links)) {
+        if (
+          new URL(href).origin === base &&
+          !(await page.request.get(href)).ok()
+        )
+          failures.push(\`broken link: \${href}\`);
+      }
+      if (flags.includes("--interactive")) {
+        await page.keyboard.press("Tab");
+        if (
+          !(await page.evaluate(() => document.activeElement !== document.body))
+        )
+          failures.push(\`\${route}: keyboard focus missing\`);
+      }
+      if (flags.includes("--visual")) {
+        await mkdir(".mozole/qa", { recursive: true });
+        const name = route.replace(/[^a-z0-9_-]/gi, "-") || "index";
+        await page.screenshot({
+          path:
+            ".mozole/qa/" +
+            viewport.width +
+            "x" +
+            viewport.height +
+            "-" +
+            name +
+            ".png",
+          fullPage: true,
+        });
+      }
+    }
+    await page.close();
+  }
+  if (failures.length) throw new Error([...new Set(failures)].join("\\n"));
+  console.log(
+    "QA PASS: " +
+      config.routes.length +
+      " routes, " +
+      config.qa.viewports.length +
+      " viewports",
+  );
+} catch (error) {
+  console.error(\`QA FAIL\\n\${error.message}\`);
+  process.exitCode = 1;
+} finally {
+  clearTimeout(deadline);
+  process.removeListener("SIGINT", interrupted);
+  process.removeListener("SIGTERM", interrupted);
+  await cleanup();
+}
+`;
+export function basicAgentGuide(backend) {
+    return `# Project guide\n\n## Commands\n\n- \`npm run dev\` — frontend development server\n- \`npm run verify\` — lint, typecheck, tests, production build\n- \`npm run qa\` — browser checks without screenshots\n- \`npm run qa:interactive\` — keyboard checks\n- \`npm run qa:visual\` — explicitly requested screenshots\n${backend ? "- `npm run dev:api` — PHP API in a separate terminal (PHP 8.0+)\n- `npm run check:php` — PHP version and syntax checks\n- `npm run build:deploy` — assemble deploy/ for Apache or LiteSpeed\n" : ""}\n## Architecture\n\nReact Router and Vite source is in \`app/\`; routes are declared in \`app/routes.ts\`. Production HTML and assets are in \`build/client/\`.${backend ? " PHP endpoints are in `api/`; the frontend uses relative `/api/` URLs through Vite's proxy. See `docs/backend-php.md`." : ""}\n\n## Working rules\n\nPreserve user changes. Inspect relevant code before editing. Run verification and relevant browser checks before handoff. Routine QA never captures screenshots; use visual QA only when requested. Report failed checks and remaining limitations.\n\n${designGuardrails}`;
+}
+export const extraVerifierScript = `import { spawnSync } from "node:child_process";
+import { readFile } from "node:fs/promises";
+
+const config = JSON.parse(await readFile(".mozole/project.json", "utf8"));
+for (const check of config.verifiers ?? []) {
+  if (
+    typeof check.command !== "string" ||
+    !Array.isArray(check.args) ||
+    !check.args.every((arg) => typeof arg === "string")
+  )
+    throw new Error("Invalid extra verifier");
+  const npm = check.command === "npm";
+  if (npm && !process.env.npm_execpath)
+    throw new Error("Run verification through npm run verify");
+  const result = spawnSync(
+    npm ? process.execPath : check.command,
+    npm ? [process.env.npm_execpath, ...check.args] : check.args,
+    { shell: false, stdio: "inherit", timeout: 600000 },
+  );
+  if (result.error || result.status !== 0) {
+    console.error(
+      "Extra verifier failed:",
+      check.name,
+      result.error?.message ?? result.status,
+    );
+    process.exit(result.status || 1);
+  }
+}
+`;
+//# sourceMappingURL=standalone.js.map

package/dist/scaffold/standalone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone.js","sourceRoot":"","sources":["../../src/scaffold/standalone.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BjC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8B3B,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmMvB,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO,0TAA0T,OAAO,CAAC,CAAC,CAAC,+LAA+L,CAAC,CAAC,CAAC,EAAE,mKAAmK,OAAO,CAAC,CAAC,CAAC,wHAAwH,CAAC,CAAC,CAAC,EAAE,kRAAkR,gBAAgB,EAAE,CAAC;AAChmC,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BlC,CAAC"}

package/dist/scaffold/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAKzD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/B;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,sBAA2B,GACnC,YAAY,CA+Cd;AAID,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,sBAA2B,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA2NxB"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/scaffold/templates.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAczD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/B;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,sBAA2B,GACnC,YAAY,CAiDd;AAID,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,sBAA2B,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0RxB"}