@reticlehq/server 2.11.0 → 2.13.0

package/dist/init/csp-check.js

@@ -30,10 +30,10 @@ function bridgeOrigins(port) {
  * Matches to the end of the directive (`;`) or the end of the enclosing quoted string, which is how
  * these are written in both a Next `headers()` value and a `<meta content="...">`.
  */
-function connectSrcSources(text) {
+function directiveSources(text, directive) {
     // Stops at the directive separator or the closing double quote of the enclosing string. Single
     // quotes are NOT terminators: `'self'` is a source, not the end of the list.
-    const match = /connect-src([^;"]*)/i.exec(text);
+    const match = new RegExp(`${directive}([^;"]*)`, 'i').exec(text);
     const list = match?.[1];
     if (list === undefined)
         return undefined;
@@ -42,6 +42,21 @@ function connectSrcSources(text) {
         .map((source) => source.trim())
         .filter((source) => source.length > 0);
 }
+/**
+ * What this policy allows a WebSocket to reach — `connect-src`, or `default-src` when it is absent.
+ *
+ * The fallback is the CSP spec's, and leaving it out made the check blind to the commonest strict
+ * policy there is. MarkText, a production Electron editor, declares
+ * `default-src 'self'; script-src 'self'; …` with NO `connect-src`: its WebSockets are restricted to
+ * 'self', the bridge is blocked, and this returned "no problem" because it was looking for a
+ * directive that was not written. Every fetch-directive falls back to `default-src`; that is what
+ * `default` means, and it is why an author does not repeat themselves.
+ *
+ * Still undefined when NEITHER is present — a policy that constrains neither is not blocking us.
+ */
+function connectSrcSources(text) {
+    return directiveSources(text, 'connect-src') ?? directiveSources(text, 'default-src');
+}
 /**
  * The problem with this app's `connect-src`, or undefined if there is not one.
  *

package/dist/init/csp-doctor.d.ts

@@ -21,5 +21,12 @@ export interface CspDiagnosis {
     /** Exactly what to add — copy-pasteable, with the port actually in use. */
     fix: string;
 }
-export declare function diagnoseWebCsp(read: ReadFile, port: number): CspDiagnosis[];
+/**
+ * The places a Content-Security-Policy gets written in a JS app.
+ *
+ * Next config and middleware cover `headers()` and the edge-middleware style; the layouts and the
+ * plain `index.html` cover the `<meta http-equiv>` style. Both reported cases were in this list.
+ */
+export declare const CSP_FILES: readonly string[];
+export declare function diagnoseWebCsp(read: ReadFile, port: number, alsoCheck?: readonly string[]): CspDiagnosis[];
 export {};

package/dist/init/csp-doctor.js

@@ -18,7 +18,7 @@ import { cspConnectSrcProblem, devCspAddition } from './csp-check.js';
  * Next config and middleware cover `headers()` and the edge-middleware style; the layouts and the
  * plain `index.html` cover the `<meta http-equiv>` style. Both reported cases were in this list.
  */
-const CSP_FILES = [
+export const CSP_FILES = [
     'next.config.js',
     'next.config.mjs',
     'next.config.ts',
@@ -31,12 +31,17 @@ const CSP_FILES = [
     'pages/_document.js',
     'index.html',
     'public/index.html',
+    // Vite puts the entry HTML at the project root; electron-vite and Tauri put the RENDERER's one
+    // under src/. MarkText declares its policy in `src/renderer/index.html`, and a desktop app is the
+    // likeliest place to meet a strict CSP at all — Electron's own security guidance asks for one.
+    'src/index.html',
+    'src/renderer/index.html',
     'vercel.json',
     'netlify.toml',
 ];
-export function diagnoseWebCsp(read, port) {
+export function diagnoseWebCsp(read, port, alsoCheck = []) {
     const findings = [];
-    for (const file of CSP_FILES) {
+    for (const file of [...alsoCheck, ...CSP_FILES]) {
         const source = read(file);
         if (source === undefined)
             continue;

package/dist/init/dev-script.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Which command starts this project, and should we start it ourselves?
+ *
+ * `init` finishes by telling the human to start or restart their dev server, in a closing
+ * paragraph, in a terminal that is about to be cleared by the client restart it also asks for.
+ * That is the second unmarked hand-off in the install, after the capabilities file, and it lands
+ * on the same surface: prose nobody re-reads.
+ *
+ * Every fact needed to remove it is already in the project. `package.json` names the script; the
+ * framework tells us the conventional port; a probe tells us whether something already answers
+ * there. Nothing here needs a human.
+ *
+ * Kept as a PURE decision, separate from spawning, because the interesting part is the judgement —
+ * which script, and whether to touch anything at all — and that is what wants testing. Spawning a
+ * process is not.
+ */
+/** Script names a JS project uses to run itself, in the order we would pick them. */
+export declare const DEV_SCRIPT_NAMES: readonly ["dev", "start", "serve"];
+export declare const DevScriptChoice: {
+    /** Something already answers on the port. Use it; never replace a server the user is running. */
+    readonly ALREADY_SERVING: "already-serving";
+    /** We know the command and nothing is listening. Start it. */
+    readonly START: "start";
+    /** No script we recognise. Say so rather than guess a command. */
+    readonly NO_SCRIPT: "no-script";
+};
+export type DevScriptChoice = (typeof DevScriptChoice)[keyof typeof DevScriptChoice];
+export interface DevScriptPlan {
+    choice: DevScriptChoice;
+    /** The npm script name, when there is one. */
+    script?: string;
+    /** What a human would type, for the line we print. */
+    command?: string;
+}
+/**
+ * Pick the script and decide whether to run it.
+ *
+ * `serving` is the probe result, passed in rather than measured here so the decision stays pure.
+ * When something is already answering we do not care which script exists: the rule is never to
+ * start a second server, because the one that is running may be the user's, with their state in it.
+ */
+export declare function planDevScript(scripts: Readonly<Record<string, string>>, packageManager: string, serving: boolean): DevScriptPlan;
+/**
+ * The command to print for this project, straight from its `package.json`.
+ *
+ * Lives here rather than in `run.ts` because it is the same judgement as `planDevScript` with the
+ * parsing attached, and `run.ts` is at its cohesion limit. Returns undefined for anything it cannot
+ * read: this phrasing decides nothing, so it must never be able to break an install.
+ */
+export declare function devCommandFrom(pkg: unknown, packageManager: string): string | undefined;

package/dist/init/dev-script.js

@@ -0,0 +1,66 @@
+/**
+ * Which command starts this project, and should we start it ourselves?
+ *
+ * `init` finishes by telling the human to start or restart their dev server, in a closing
+ * paragraph, in a terminal that is about to be cleared by the client restart it also asks for.
+ * That is the second unmarked hand-off in the install, after the capabilities file, and it lands
+ * on the same surface: prose nobody re-reads.
+ *
+ * Every fact needed to remove it is already in the project. `package.json` names the script; the
+ * framework tells us the conventional port; a probe tells us whether something already answers
+ * there. Nothing here needs a human.
+ *
+ * Kept as a PURE decision, separate from spawning, because the interesting part is the judgement —
+ * which script, and whether to touch anything at all — and that is what wants testing. Spawning a
+ * process is not.
+ */
+/** Script names a JS project uses to run itself, in the order we would pick them. */
+export const DEV_SCRIPT_NAMES = ['dev', 'start', 'serve'];
+const CANDIDATES = DEV_SCRIPT_NAMES;
+export const DevScriptChoice = {
+    /** Something already answers on the port. Use it; never replace a server the user is running. */
+    ALREADY_SERVING: 'already-serving',
+    /** We know the command and nothing is listening. Start it. */
+    START: 'start',
+    /** No script we recognise. Say so rather than guess a command. */
+    NO_SCRIPT: 'no-script',
+};
+/**
+ * Pick the script and decide whether to run it.
+ *
+ * `serving` is the probe result, passed in rather than measured here so the decision stays pure.
+ * When something is already answering we do not care which script exists: the rule is never to
+ * start a second server, because the one that is running may be the user's, with their state in it.
+ */
+export function planDevScript(scripts, packageManager, serving) {
+    if (serving)
+        return { choice: DevScriptChoice.ALREADY_SERVING };
+    const name = CANDIDATES.find((c) => 'string' === typeof scripts[c] && scripts[c] !== '');
+    if (name === undefined)
+        return { choice: DevScriptChoice.NO_SCRIPT };
+    // `npm` needs `run`; the others take the script name directly. Getting this wrong prints a
+    // command that fails, which is worse than printing nothing.
+    const command = 'npm' === packageManager ? `npm run ${name}` : `${packageManager} ${name}`;
+    return { choice: DevScriptChoice.START, script: name, command };
+}
+/**
+ * The command to print for this project, straight from its `package.json`.
+ *
+ * Lives here rather than in `run.ts` because it is the same judgement as `planDevScript` with the
+ * parsing attached, and `run.ts` is at its cohesion limit. Returns undefined for anything it cannot
+ * read: this phrasing decides nothing, so it must never be able to break an install.
+ */
+export function devCommandFrom(pkg, packageManager) {
+    try {
+        // Takes the PARSED manifest. It used to take the raw string and parse it a fourth time — the
+        // caller now reads the file once, through a guard, so there is one place a malformed manifest
+        // can be noticed and it is not this one.
+        const scripts = 'object' === typeof pkg && null !== pkg
+            ? (pkg.scripts ?? {})
+            : {};
+        return planDevScript(scripts, packageManager, false).command;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/init/format-generated.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Format a file `init` is about to write, using the project's own Prettier when it is installed.
+ *
+ * Reported from the field (#684): a clean CRA install failed the project's own lint because
+ * `src/reticle-dev.ts` was emitted as one long line. The project already had Prettier; init never
+ * asked it. Best-effort: resolve Prettier from the app (not from ours — we do not ship it), apply
+ * its config, and on any failure return the original content so init never fails because of a
+ * formatter. Sync only — `applyEffects` is sync, and Prettier 3's async `format` cannot join here.
+ */
+/** True when this write is a connect/dev module lint will treat as project source. */
+export declare function isGeneratedSourcePath(relPath: string): boolean;
+/**
+ * Format `content` for `relPath` under `projectRoot`, or return it unchanged.
+ *
+ * Only the sync Prettier API is used. Prettier 3's async `format` is skipped (returns the original)
+ * rather than holding init open on a promise `applyEffects` cannot await.
+ */
+export declare function formatGeneratedSource(content: string, relPath: string, projectRoot: string): string;

package/dist/init/format-generated.js

@@ -0,0 +1,39 @@
+/**
+ * Format a file `init` is about to write, using the project's own Prettier when it is installed.
+ *
+ * Reported from the field (#684): a clean CRA install failed the project's own lint because
+ * `src/reticle-dev.ts` was emitted as one long line. The project already had Prettier; init never
+ * asked it. Best-effort: resolve Prettier from the app (not from ours — we do not ship it), apply
+ * its config, and on any failure return the original content so init never fails because of a
+ * formatter. Sync only — `applyEffects` is sync, and Prettier 3's async `format` cannot join here.
+ */
+import { createRequire } from 'node:module';
+import { basename, join } from 'node:path';
+/** Basenames of full-file generators that a project's lint will see. */
+const GENERATED_SOURCE_NAMES = new Set(['reticle-dev.ts', 'reticle-dev.tsx', 'hooks.client.ts']);
+/** True when this write is a connect/dev module lint will treat as project source. */
+export function isGeneratedSourcePath(relPath) {
+    return GENERATED_SOURCE_NAMES.has(basename(relPath));
+}
+/**
+ * Format `content` for `relPath` under `projectRoot`, or return it unchanged.
+ *
+ * Only the sync Prettier API is used. Prettier 3's async `format` is skipped (returns the original)
+ * rather than holding init open on a promise `applyEffects` cannot await.
+ */
+export function formatGeneratedSource(content, relPath, projectRoot) {
+    if (!isGeneratedSourcePath(relPath))
+        return content;
+    try {
+        const require = createRequire(join(projectRoot, 'package.json'));
+        const prettier = require('prettier');
+        const filePath = join(projectRoot, relPath);
+        const resolved = prettier.resolveConfig.sync?.(filePath) ?? {};
+        const formatted = prettier.format(content, { ...resolved, filepath: filePath });
+        // Prettier 2 returns a string; Prettier 3 returns a Promise we cannot join from sync code.
+        return 'string' === typeof formatted ? formatted : content;
+    }
+    catch {
+        return content;
+    }
+}

package/dist/init/install-hint.d.ts

@@ -0,0 +1,9 @@
+/**
+ * What to say when the dependency install fails.
+ *
+ * Split out of plan.ts, which was at the 1000-line backstop. A cohesive unit rather than an
+ * arbitrary cut: it is prose about one step's failure modes, and the only thing it needs is which
+ * package manager was used.
+ */
+import { PackageManager } from './detect.js';
+export declare function installFailureHint(pm: PackageManager): string;

package/dist/init/install-hint.js

@@ -0,0 +1,29 @@
+/**
+ * What to say when the dependency install fails.
+ *
+ * Split out of plan.ts, which was at the 1000-line backstop. A cohesive unit rather than an
+ * arbitrary cut: it is prose about one step's failure modes, and the only thing it needs is which
+ * package manager was used.
+ */
+import { PackageManager } from './detect.js';
+/**
+ * Every package manager fetches, so every one of them can fail for a reason that is nothing to do
+ * with the project: offline, a proxy that blocks npmjs, a corporate mirror that is down.
+ *
+ * The hint used to name only version pinning and pnpm's maturity window. Both are real causes, and
+ * neither is that one — so a blocked registry sent the reader through their own dependency versions
+ * looking for a problem that was entirely about reachability.
+ */
+const REGISTRY_HINT = 'If it could not reach the registry at all (offline, a proxy, a mirror that is down), that is ' +
+    'about reachability and not about this project: check `npm config get registry` and whether this ' +
+    'machine can reach it.';
+export function installFailureHint(pm) {
+    if (pm !== PackageManager.PNPM) {
+        return `If the version was refused, install the SDK yourself. ${REGISTRY_HINT}`;
+    }
+    return ('If pnpm reported ERR_PNPM_NO_MATURE_MATCHING_VERSION, its minimumReleaseAge setting is holding ' +
+        'this release back. Either wait out the window, or allow these packages explicitly:\n' +
+        '  pnpm config set minimumReleaseAgeExclude "@reticlehq/*"\n' +
+        'Do NOT drop the version pin — unpinned, pnpm installs an older SDK against a newer daemon, and ' +
+        `that mismatch surfaces as a -32000 with nothing naming a version.\n${REGISTRY_HINT}`);
+}

package/dist/init/mcp-clients.d.ts

@@ -78,5 +78,12 @@ export declare function clientSnippet(spec: ClientSpec): string;
  * because a fresh Cursor profile has not written `~/.cursor` yet.
  */
 export declare function clientMarkerRelPath(spec: ClientSpec): string;
+/**
+ * Project-relative directory whose presence signals Cursor is in use for this repo.
+ *
+ * A fresh Cursor profile has not written `~/.cursor` yet, so the home marker alone misses real
+ * users. A project-level `.cursor/` is unambiguous evidence somebody uses Cursor here.
+ */
+export declare const CURSOR_PROJECT_MARKER = ".cursor";
 /** Clients `init` can wire by writing a file — everything but the CLI-registered one. */
 export declare function fileBackedClients(): readonly ClientSpec[];

package/dist/init/mcp-clients.js

@@ -286,6 +286,13 @@ export function clientMarkerRelPath(spec) {
     const parts = spec.relPath.split('/');
     return parts.length > 1 ? parts.slice(0, -1).join('/') : spec.relPath;
 }
+/**
+ * Project-relative directory whose presence signals Cursor is in use for this repo.
+ *
+ * A fresh Cursor profile has not written `~/.cursor` yet, so the home marker alone misses real
+ * users. A project-level `.cursor/` is unambiguous evidence somebody uses Cursor here.
+ */
+export const CURSOR_PROJECT_MARKER = '.cursor';
 /** Clients `init` can wire by writing a file — everything but the CLI-registered one. */
 export function fileBackedClients() {
     return MCP_CLIENTS.filter((spec) => spec.scope !== ConfigScope.CLI);

package/dist/init/mcp.d.ts

@@ -15,11 +15,16 @@ export { MCP_SERVER_NAME } from '@reticlehq/core';
 /**
  * The registered command is STILL bare `npx` on every platform, deliberately.
  *
- * Windows is 66% of Reticle's users (65 of 99 in a day of telemetry) and has NO CI, no fixture, and
- * nothing in this repo has ever run there. Switching the majority platform to a launch command
- * nobody can test — where `.cmd` also has its own spawn caveats in some hosts — risks breaking the
- * users it is meant to help. So the fallback is DOCUMENTED (see mcpManual) rather than defaulted,
- * until somebody can run it on Windows.
+ * Windows is most of Reticle's users and, when this was written, had no CI. There is Windows CI
+ * now, so the `cmd /c` fallback is testable. Defaulting the majority platform to that launch
+ * command is still the riskier change: `.cmd` has spawn caveats in some hosts, and a registration
+ * that works on the machines we can test can still fail in the hosts we cannot. So the fallback
+ * stays documented rather than defaulted.
+ *
+ * What DID change is when it is printed. `mcpManual` used to run only when the `claude` CLI was
+ * absent. The reported Windows install had `claude mcp add` succeed, so the one paragraph that
+ * would have unblocked zero tools never appeared. `mcpWindowsNote` is that paragraph, and init
+ * prints it on every Windows run — including the ones that look like a clean registration.
  */
 export declare const NPX = "npx";
 /**
@@ -38,7 +43,7 @@ export declare const NPX = "npx";
  *
  * So it stays unpinned, and the skew is handled where it actually shows up: the contract fingerprint
  * makes a real mismatch loud on the next tool result (see version-skew), and a stale entry of our own
- * shape is now repaired on re-run rather than reported "already registered" (see cursor.ts).
+ * shape is now repaired on re-run rather than reported "already registered" (see mcp-clients.ts).
  */
 export declare function npxServerArgs(): string[];
 /**
@@ -74,5 +79,11 @@ export declare function claudeAvailableProbe(): {
     command: string;
     args: string[];
 };
+/**
+ * The Windows `cmd /c npx` registration. Printed on every Windows init, not only when the `claude`
+ * CLI is missing — a successful `claude mcp add` of bare `npx` is exactly the failure that reported
+ * as a clean install with zero tools.
+ */
+export declare function mcpWindowsNote(): string;
 /** Printed when the `claude` CLI isn't available — register Reticle globally once, by hand. */
 export declare function mcpManual(): string;

package/dist/init/mcp.js

@@ -19,11 +19,16 @@ import { MCP_SERVER_NAME } from '@reticlehq/core';
 /**
  * The registered command is STILL bare `npx` on every platform, deliberately.
  *
- * Windows is 66% of Reticle's users (65 of 99 in a day of telemetry) and has NO CI, no fixture, and
- * nothing in this repo has ever run there. Switching the majority platform to a launch command
- * nobody can test — where `.cmd` also has its own spawn caveats in some hosts — risks breaking the
- * users it is meant to help. So the fallback is DOCUMENTED (see mcpManual) rather than defaulted,
- * until somebody can run it on Windows.
+ * Windows is most of Reticle's users and, when this was written, had no CI. There is Windows CI
+ * now, so the `cmd /c` fallback is testable. Defaulting the majority platform to that launch
+ * command is still the riskier change: `.cmd` has spawn caveats in some hosts, and a registration
+ * that works on the machines we can test can still fail in the hosts we cannot. So the fallback
+ * stays documented rather than defaulted.
+ *
+ * What DID change is when it is printed. `mcpManual` used to run only when the `claude` CLI was
+ * absent. The reported Windows install had `claude mcp add` succeed, so the one paragraph that
+ * would have unblocked zero tools never appeared. `mcpWindowsNote` is that paragraph, and init
+ * prints it on every Windows run — including the ones that look like a clean registration.
  */
 export const NPX = 'npx';
 // The `reticle` bin lives in the server package, so `npx <pkg> mcp` runs the bridge without the
@@ -31,6 +36,9 @@ export const NPX = 'npx';
 const RETICLE_PACKAGE = RETICLE_NPM_PACKAGE;
 const MCP_SUBCOMMAND = 'mcp';
 const CLAUDE_CLI = 'claude';
+/** Windows `cmd /c` — the spawn that PowerShell's execution policy does not gate. */
+const WINDOWS_SHELL = 'cmd';
+const WINDOWS_SHELL_C = '/c';
 /**
  * Args after `npx` that launch the bridge: `@reticlehq/server mcp`. Portless — the port comes from
  * the project's `.reticle.json` at runtime, so one global entry works for every project.
@@ -47,7 +55,7 @@ const CLAUDE_CLI = 'claude';
  *
  * So it stays unpinned, and the skew is handled where it actually shows up: the contract fingerprint
  * makes a real mismatch loud on the next tool result (see version-skew), and a stale entry of our own
- * shape is now repaired on re-run rather than reported "already registered" (see cursor.ts).
+ * shape is now repaired on re-run rather than reported "already registered" (see mcp-clients.ts).
  */
 export function npxServerArgs() {
     return [RETICLE_PACKAGE, MCP_SUBCOMMAND];
@@ -94,6 +102,18 @@ export function claudeExistsProbe() {
 export function claudeAvailableProbe() {
     return { command: CLAUDE_CLI, args: ['--version'] };
 }
+/**
+ * The Windows `cmd /c npx` registration. Printed on every Windows init, not only when the `claude`
+ * CLI is missing — a successful `claude mcp add` of bare `npx` is exactly the failure that reported
+ * as a clean install with zero tools.
+ */
+export function mcpWindowsNote() {
+    return `On Windows, if the agent cannot start Reticle because npx is blocked ("running scripts is disabled
+on this system" — a PowerShell execution policy), register it through cmd instead, which that policy
+does not gate:
+
+  "${MCP_SERVER_NAME}": { "command": "${WINDOWS_SHELL}", "args": ${JSON.stringify([WINDOWS_SHELL_C, NPX, ...serverInvocation().slice(1)])} }`;
+}
 /** Printed when the `claude` CLI isn't available — register Reticle globally once, by hand. */
 export function mcpManual() {
     const tail = serverInvocation().join(' ');
@@ -105,9 +125,5 @@ Or, for another agent, add this to its global MCP config (e.g. Cursor's ~/.curso
 
   "${MCP_SERVER_NAME}": { "command": "${NPX}", "args": ${JSON.stringify(serverInvocation().slice(1))} }
 
-On Windows, if the agent cannot start Reticle because npx is blocked ("running scripts is disabled
-on this system" — a PowerShell execution policy), register it through cmd instead, which that policy
-does not gate:
-
-  "${MCP_SERVER_NAME}": { "command": "cmd", "args": ${JSON.stringify(['/c', NPX, ...serverInvocation().slice(1)])} }`;
+${mcpWindowsNote()}`;
 }

package/dist/init/node-io.js

@@ -3,7 +3,7 @@
  * `runInit` stays testable with an in-memory IO. Prints to stdout — `init` is a one-shot CLI
  * command, not the MCP stdio transport.
  */
-import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, statSync, accessSync, constants, } from 'node:fs';
 import { NodePlatform } from '../platform.js';
 import { join, dirname, isAbsolute } from 'node:path';
 import { homedir } from 'node:os';
@@ -95,6 +95,16 @@ export function buildNodeIo(cwd) {
             const result = spawnSync(command, shellSafe(args), { cwd, stdio: 'inherit', ...shellOpt() });
             return 0 === result.status;
         },
+        /** One access check, rather than discovering it as an EACCES stack four phases later. */
+        canWrite() {
+            try {
+                accessSync(cwd, constants.W_OK);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
         probe(command, args) {
             // Quiet yes/no check (CLI availability, existing registration). Never throws.
             const result = spawnSync(command, shellSafe(args), { cwd, stdio: 'ignore', ...shellOpt() });

package/dist/init/plan-framework.d.ts

@@ -17,11 +17,6 @@ export declare const VITE_PLUGIN_DETAIL: {
     readonly SVELTEKIT: "add reticle() to plugins (stamps data-reticle-source in .svelte components)";
 };
 export declare function viteSteps(input: PlanInput, detail?: string): Step[];
-/**
- * Next used to be the ONLY stack with hand edits left over — and both of them fail silently when
- * skipped, so a Next user's app booted, connected to nothing, and said nothing about why. Both are
- * now patched by the same conservative rules the Vite config gets.
- */
 export declare function nextSteps(input: PlanInput): Step[];
 /**
  * SvelteKit is WIRED but not SUPPORTED, and the plan says so out loud.