@reticlehq/server 2.13.0 → 2.14.0

package/dist/init/connect-steps.js

@@ -1,50 +0,0 @@
-/**
- * Which `init` steps decide whether the app can dial the daemon.
- *
- * Lifted out of `plan.ts` when that file reached the size backstop. A cohesive unit on its own
- * terms: one question, asked of a step title, with one consequence — a manual step in this set makes
- * `init` exit non-zero instead of reporting a success over an app that can never connect.
- *
- * Matched on TITLES, which is the fragile part and worth stating: renaming a step in
- * `plan-framework.ts` silently drops it out of this set and nothing goes red. `connect-steps.test.ts`
- * pins the membership for exactly that reason.
- */
-/**
- * Titles of the steps WITHOUT which no session ever appears.
- *
- * A ⚠ on one of these is not a warning, it is a guaranteed failure: nothing performs the manual step,
- * so the app will not connect and every Reticle tool will answer "no browser session connected".
- * Reported from a field sweep, where the ⚠ count and "did it connect" were treated as independent
- * signals and are not.
- */
-const CONNECT_STEP_TITLES = new Set([
-    'Connect snippet',
-    'Connect snippet (CRA)',
-    'Connect snippet (Astro)',
-    'Connect snippet (Nuxt)',
-    'Reticle client hook',
-    'Reticle connect module',
-    'ReticleDev component',
-    // Writing the component and MOUNTING it are two steps, and only the write was here. A root layout
-    // whose shape `init` does not recognise leaves the component on disk and never rendered: the SDK
-    // is in the project, nothing imports it, and `init` exited 0 over an app that could not connect.
-    'Mount ReticleDev',
-    // NOT here, and the reason is worth keeping: 'Pairing token'.
-    //
-    // It is a genuine connect step — CRA inlines only REACT_APP_*, so without the token in the env
-    // file the bridge refuses every connection and the app boots, looks correct, and never pairs. But
-    // it goes MANUAL in exactly one situation: no daemon has ever run on this machine, so there is no
-    // token to inline. That is the FIRST CRA install on a fresh machine, i.e. the first-time user —
-    // and making that exit non-zero reports a broken install to the one person least able to tell
-    // that it is not.
-    //
-    // The real fix is for `init` to mint the token rather than only read it, which is what both the
-    // daemon and the Vite plugin already do. `runInit` is synchronous and the existing helpers are
-    // not, and `gate:install` scaffolds no CRA app, so that change would ship with no coverage of the
-    // path it changes. It is worth doing, and worth doing with a scaffold behind it.
-    'Vite plugin',
-]);
-/** True when this step is what makes the app dial the daemon. */
-export function isConnectStep(title) {
-    return CONNECT_STEP_TITLES.has(title);
-}

package/dist/init/cra.d.ts

@@ -1,79 +0,0 @@
-/**
- * Wiring Reticle into a Create React App project.
- *
- * CRA had no automated path: init reported `⚠ Connect snippet → index.html`, a target that cannot
- * work. CRA's `public/index.html` is a static template the bundler never processes for modules, so a
- * bare import in it resolves to nothing. `src/index.tsx` is what gets bundled, and that is where the
- * connect has to arrive.
- *
- * The token is the second half of the problem. Every other stack has somewhere to inline it —
- * Vite defines `__RETICLE_TOKEN__`, the Astro and HTML snippets read the file in Node. `src/index.tsx`
- * is browser code inside a bundler that inlines exactly one thing: environment variables prefixed
- * `REACT_APP_`. So it travels through `.env.development.local`, which is CRA's own documented
- * mechanism and is gitignored by CRA's own template.
- */
-/** The line added to `src/index.tsx` / `src/index.js`. Side-effect import: the module guards itself on NODE_ENV. */
-export declare const CRA_DEV_MODULE_IMPORT = "import './reticle-dev';";
-/**
- * Where the connect module lands — `.ts` only when the app already speaks TypeScript.
- *
- * A JavaScript CRA project has no tsconfig and cannot resolve `.ts` (#675). Emitting `.ts` there
- * makes the first compile after init fail while the plan still reports `[✓]`.
- */
-export declare function craDevModulePath(typescript: boolean): string;
-/** TypeScript default path — prefer `craDevModulePath` when the project's language is known. */
-export declare const CRA_DEV_MODULE_PATH: string;
-export declare const CRA_ENV_PATH = ".env.development.local";
-export declare const TOKEN_VAR = "REACT_APP_RETICLE_TOKEN";
-/**
- * The bridge URL, carried through the same channel as the token.
- *
- * CRA is the one supported stack with no build-time hook of ours: no plugin, no config wrapper, no
- * `define`. Vite and Astro re-resolve the daemon every dev-server start and Next does it through
- * `withReticle`; CRA has nowhere to run that code. So the URL goes where the token already goes, and
- * is refreshed by the same `init` step that refreshes the token.
- *
- * That makes `reticle init` the heal rather than the dev server, which is weaker and is stated
- * plainly in the step's own detail. It is still strictly better than a URL frozen into a source file
- * the owner has to hand-edit, and `.env.development.local` is already the per-machine file.
- */
-export declare const URL_VAR = "REACT_APP_RETICLE_URL";
-/**
- * What the app itself says when the token is not there.
- *
- * The token is a per-machine secret and CRA's own template gitignores the file it lives in, so it
- * CANNOT travel with the repo — that part is correct and must stay. What was wrong is that it failed
- * silently: a teammate clones, runs `npm start`, and the app connects with an empty token, so the
- * only signal is the bridge's generic `authentication failed` in a console nobody had open. Naming
- * the variable, the gitignored file and the one command that fixes it turns a dead app into a
- * one-line repair. Every other stack reads the token in Node at dev-server start (the Vite plugin,
- * withReticle); CRA has no such hook without ejecting, so this message is the fix.
- */
-export declare const CRA_TOKEN_MISSING_NOTE: string;
-/**
- * Said as its own NOTICE line, beside the write — not inside it.
- *
- * The caveat has always been in the write step's `detail`, and the write step renders `[✓]`. But
- * `SKILL.md` tells whoever reads the report: *"If every line is `✓`, `·` or `–`, skip to Step 4 and
- * validate."* So the one fact that makes this install conditional sat in the one place the reading
- * protocol says to ignore — which is exactly how it was reported to us as "4 OK marks and no
- * warning". The words were on screen; the reader was following instructions.
- *
- * It cannot simply be promoted: `run.ts` only writes steps whose status is APPLY, so demoting the
- * token step to NOTICE would stop it writing the token and break the install outright.
- */
-export declare const CRA_TOKEN_PER_MACHINE_NOTICE: string;
-/** Add the import after the last existing one, or null when it is already present. */
-export declare function craImportPatch(source: string): string | null;
-/** Set the token variable, or null when nothing needs to change. */
-export declare function craEnvPatch(existing: string | null, token: string, url?: string): string | null;
-/** Options for the CRA connect module. */
-export interface CraDevModuleOptions {
-    /**
-     * When false, emit a `.js`-shaped body (no `export {}`). Default true for callers that predate
-     * the language branch.
-     */
-    typescript?: boolean;
-}
-/** The dev-only connect module imported from the app entry. */
-export declare function craDevModuleFile(port: number | undefined, projectId?: string, options?: CraDevModuleOptions): string;

package/dist/init/cra.js

@@ -1,178 +0,0 @@
-/**
- * Wiring Reticle into a Create React App project.
- *
- * CRA had no automated path: init reported `⚠ Connect snippet → index.html`, a target that cannot
- * work. CRA's `public/index.html` is a static template the bundler never processes for modules, so a
- * bare import in it resolves to nothing. `src/index.tsx` is what gets bundled, and that is where the
- * connect has to arrive.
- *
- * The token is the second half of the problem. Every other stack has somewhere to inline it —
- * Vite defines `__RETICLE_TOKEN__`, the Astro and HTML snippets read the file in Node. `src/index.tsx`
- * is browser code inside a bundler that inlines exactly one thing: environment variables prefixed
- * `REACT_APP_`. So it travels through `.env.development.local`, which is CRA's own documented
- * mechanism and is gitignored by CRA's own template.
- */
-import { bridgeWsUrl } from '@reticlehq/core';
-import { CLI } from './agent-rules.js';
-/** The line added to `src/index.tsx` / `src/index.js`. Side-effect import: the module guards itself on NODE_ENV. */
-export const CRA_DEV_MODULE_IMPORT = "import './reticle-dev';";
-/**
- * Where the connect module lands — `.ts` only when the app already speaks TypeScript.
- *
- * A JavaScript CRA project has no tsconfig and cannot resolve `.ts` (#675). Emitting `.ts` there
- * makes the first compile after init fail while the plan still reports `[✓]`.
- */
-export function craDevModulePath(typescript) {
-    return typescript ? 'src/reticle-dev.ts' : 'src/reticle-dev.js';
-}
-/** TypeScript default path — prefer `craDevModulePath` when the project's language is known. */
-export const CRA_DEV_MODULE_PATH = craDevModulePath(true);
-export const CRA_ENV_PATH = '.env.development.local';
-export const TOKEN_VAR = 'REACT_APP_RETICLE_TOKEN';
-/**
- * The bridge URL, carried through the same channel as the token.
- *
- * CRA is the one supported stack with no build-time hook of ours: no plugin, no config wrapper, no
- * `define`. Vite and Astro re-resolve the daemon every dev-server start and Next does it through
- * `withReticle`; CRA has nowhere to run that code. So the URL goes where the token already goes, and
- * is refreshed by the same `init` step that refreshes the token.
- *
- * That makes `reticle init` the heal rather than the dev server, which is weaker and is stated
- * plainly in the step's own detail. It is still strictly better than a URL frozen into a source file
- * the owner has to hand-edit, and `.env.development.local` is already the per-machine file.
- */
-export const URL_VAR = 'REACT_APP_RETICLE_URL';
-/**
- * What the app itself says when the token is not there.
- *
- * The token is a per-machine secret and CRA's own template gitignores the file it lives in, so it
- * CANNOT travel with the repo — that part is correct and must stay. What was wrong is that it failed
- * silently: a teammate clones, runs `npm start`, and the app connects with an empty token, so the
- * only signal is the bridge's generic `authentication failed` in a console nobody had open. Naming
- * the variable, the gitignored file and the one command that fixes it turns a dead app into a
- * one-line repair. Every other stack reads the token in Node at dev-server start (the Vite plugin,
- * withReticle); CRA has no such hook without ejecting, so this message is the fix.
- */
-export const CRA_TOKEN_MISSING_NOTE = `${TOKEN_VAR} is not set, so Reticle cannot pair with the daemon. ` +
-    `The pairing token is per-machine and ${CRA_ENV_PATH} is gitignored by CRA's template, ` +
-    `so it does not survive a clone. Run \`${CLI} init\` in this project to write it for this machine.`;
-/**
- * Said as its own NOTICE line, beside the write — not inside it.
- *
- * The caveat has always been in the write step's `detail`, and the write step renders `[✓]`. But
- * `SKILL.md` tells whoever reads the report: *"If every line is `✓`, `·` or `–`, skip to Step 4 and
- * validate."* So the one fact that makes this install conditional sat in the one place the reading
- * protocol says to ignore — which is exactly how it was reported to us as "4 OK marks and no
- * warning". The words were on screen; the reader was following instructions.
- *
- * It cannot simply be promoted: `run.ts` only writes steps whose status is APPLY, so demoting the
- * token step to NOTICE would stop it writing the token and break the install outright.
- */
-export const CRA_TOKEN_PER_MACHINE_NOTICE = `${CRA_ENV_PATH} is in CRA's own .gitignore, so the token just written does not travel. ` +
-    'It works on THIS machine and nowhere else: a teammate cloning the repo, CI, or a container ' +
-    'gets an app that boots, never pairs, and reports it only in the browser console. ' +
-    `Each developer runs \`${CLI} init\` once locally.`;
-/** Add the import after the last existing one, or null when it is already present. */
-export function craImportPatch(source) {
-    if (source.includes(CRA_DEV_MODULE_IMPORT))
-        return null;
-    const lines = source.split('\n');
-    // After the LAST import: React's own imports must still run first, and a side-effect import placed
-    // above them would connect before the app exists.
-    let lastImport = -1;
-    for (const [index, line] of lines.entries()) {
-        if (/^\s*import\s/.test(line))
-            lastImport = index;
-    }
-    lines.splice(lastImport + 1, 0, CRA_DEV_MODULE_IMPORT);
-    return lines.join('\n');
-}
-/** Set the token variable, or null when nothing needs to change. */
-export function craEnvPatch(existing, token, url) {
-    if ('' === token)
-        return null;
-    const pairs = [
-        [TOKEN_VAR, token],
-        ...(url !== undefined && url.length > 0 ? [[URL_VAR, url]] : []),
-    ];
-    let next = null === existing || '' === existing.trim() ? '' : existing;
-    for (const [name, value] of pairs) {
-        const line = `${name}=${value}`;
-        if (next.includes(line))
-            continue;
-        // Replace rather than append: two assignments of one variable is a silent coin flip on which
-        // wins, and for the URL that coin decides which daemon the app talks to.
-        if (new RegExp(`^${name}=`, 'm').test(next)) {
-            next = next.replace(new RegExp(`^${name}=.*$`, 'm'), line);
-        }
-        else {
-            next = `${'' === next || next.endsWith('\n') ? next : `${next}\n`}${line}\n`;
-        }
-    }
-    return next === (existing ?? '') ? null : next;
-}
-/** The dev-only connect module imported from the app entry. */
-export function craDevModuleFile(port, projectId, options = {}) {
-    const typescript = false !== options.typescript;
-    const fields = [];
-    // `bridgeWsUrl`, not a hand-written string. This was the only client URL in the product spelling
-    // the host as `127.0.0.1` while every other generator said `localhost` — same endpoint, but a
-    // difference with no reason behind it is the kind that becomes a real one after somebody edits half
-    // of it.
-    if (port !== undefined)
-        fields.push(`url: '${bridgeWsUrl(port)}'`);
-    if (projectId !== undefined && projectId.length > 0)
-        fields.push(`projectId: '${projectId}'`);
-    // Multiline on purpose (#684): a single-line connect + console.error fails CRA boilerplate
-    // Prettier (printWidth 80) and the project's own lint blocks a clean install.
-    const connectFields = [
-        ...fields.map((f) => `      ${f},`),
-        '      ...(url.length > 0 ? { url } : {}),',
-        '      ...(token.length > 0 ? { token } : {}),',
-    ].join('\n');
-    // Split so every emitted line stays under a CRA boilerplate printWidth of 80 (#684). A single
-    // JSON.stringify of the whole note is ~290 characters and fails prettier-as-eslint on install.
-    // Chunks are joined with `+` in the emitted file; together they equal `[reticle] ${CRA_TOKEN_MISSING_NOTE}`.
-    const missingChunks = [
-        `[reticle] ${TOKEN_VAR} is not set, so Reticle `,
-        'cannot pair with the daemon. The pairing token is ',
-        `per-machine and ${CRA_ENV_PATH} is gitignored by `,
-        "CRA's template, so it does not survive a clone. Run ",
-        `\`${CLI} init\` in this project to write it for this `,
-        'machine.',
-    ].map((c) => JSON.stringify(c));
-    // Eight spaces match the indent inside `console.error(` below.
-    const missingExpr = missingChunks.join(' +\n        ');
-    // `export {}` is a TypeScript empty-module marker. A `.js` file with it is fine under Babel, but
-    // the workaround reporters used was to drop it when renaming to `.js` — keep the JS emit clean.
-    const trailer = typescript ? '\nexport {};\n' : '\n';
-    return `// Dev-only: connect Reticle. Imported for its side effect from src/index.tsx.
-//
-// CRA's public/index.html is a static template the bundler never processes for
-// modules, so the connect cannot live there. The pairing token arrives through
-// REACT_APP_RETICLE_TOKEN because REACT_APP_* is the only thing CRA inlines
-// into browser code.
-if (process.env.NODE_ENV === 'development') {
-  void import('@reticlehq/react').then(({ reticle, install }) => {
-    install();
-    const token = process.env.${TOKEN_VAR} ?? '';
-    // Written by \`reticle init\` from the daemon that was live when it ran, and
-    // refreshed by re-running it. CRA gives us no hook to resolve this at
-    // dev-server start, so if the daemon moves, re-run \`reticle init\` rather
-    // than editing the url below.
-    const url = process.env.${URL_VAR} ?? '';
-    // Loud on purpose: without this the only symptom is the bridge's generic
-    // auth failure.
-    if (token.length === 0) {
-      console.error(
-        ${missingExpr},
-      );
-    }
-    // Still attempt it — a bridge running without a token pairs fine.
-    reticle.connect({
-${connectFields}
-    });
-  });
-}
-${trailer}`;
-}

package/dist/init/csp-check.d.ts

@@ -1,38 +0,0 @@
-/**
- * Does this app's Content-Security-Policy let the browser reach the Reticle bridge?
- *
- * Two independent field reports, both Next: `init` reported every step successful, the SDK mounted,
- * the dial URL was correct, and the app never connected because a strict `connect-src` excluded
- * `ws://localhost:<port>`. The browser blocks the WebSocket and says so in its own console, which
- * nothing on the Reticle side reads — so `status` and `doctor` reported perfect health at an app
- * that could not connect at all, forever. A setup step that exits 0 while leaving the user broken is
- * the worst failure mode this repo has.
- *
- * A TEXT SCAN, deliberately. `headers()` is a function; `init` cannot execute a user's Next config
- * without importing their whole app, and the thing worth finding is the policy string a developer
- * typed — in `next.config.*`, in middleware, or in a `<meta http-equiv>` tag. The scan finds the
- * string wherever it is written.
- *
- * NARROW on purpose: it fires only when a `connect-src` exists AND does not admit the bridge. No
- * CSP, or one that already covers us, produces nothing. A warning that fires on a working setup
- * costs precisely what a green check on a broken one costs, and this file exists because of the
- * second kind.
- */
-/**
- * The problem with this app's `connect-src`, or undefined if there is not one.
- *
- * `https:` counts as a wildcard here only in the sense that a policy written that loosely will not
- * be the thing blocking a dev WebSocket; the check stays quiet rather than arguing about it.
- */
-export declare function cspConnectSrcProblem(text: string, port: number): string | undefined;
-/** The exact addition to paste. Text to copy, not advice to interpret. */
-export declare function devCspAddition(port: number): string;
-/** The step title, named here so `doctor` and the plan cannot drift apart on what this check is called. */
-export declare const CSP_STEP_TITLE = "Content-Security-Policy";
-/**
- * The first blocking policy among the sources `init` already has in hand, or undefined.
- *
- * At most one finding: a second copy of the same policy in a second file is the same problem, and
- * two identical notices read as two problems.
- */
-export declare function cspPlanProblem(sources: readonly (string | null | undefined)[], port: number): string | undefined;

package/dist/init/csp-check.js

@@ -1,107 +0,0 @@
-/**
- * Does this app's Content-Security-Policy let the browser reach the Reticle bridge?
- *
- * Two independent field reports, both Next: `init` reported every step successful, the SDK mounted,
- * the dial URL was correct, and the app never connected because a strict `connect-src` excluded
- * `ws://localhost:<port>`. The browser blocks the WebSocket and says so in its own console, which
- * nothing on the Reticle side reads — so `status` and `doctor` reported perfect health at an app
- * that could not connect at all, forever. A setup step that exits 0 while leaving the user broken is
- * the worst failure mode this repo has.
- *
- * A TEXT SCAN, deliberately. `headers()` is a function; `init` cannot execute a user's Next config
- * without importing their whole app, and the thing worth finding is the policy string a developer
- * typed — in `next.config.*`, in middleware, or in a `<meta http-equiv>` tag. The scan finds the
- * string wherever it is written.
- *
- * NARROW on purpose: it fires only when a `connect-src` exists AND does not admit the bridge. No
- * CSP, or one that already covers us, produces nothing. A warning that fires on a working setup
- * costs precisely what a green check on a broken one costs, and this file exists because of the
- * second kind.
- */
-/** Sources that admit any ws origin, so the bridge is already reachable. */
-const WILDCARDS = ['*', 'ws:', 'wss:', 'ws://*', 'https:'];
-/** The two hosts the SDK may dial. `localhost` and the IPv4 loopback are different CSP sources. */
-function bridgeOrigins(port) {
-    return [`ws://localhost:${String(port)}`, `ws://127.0.0.1:${String(port)}`];
-}
-/**
- * The `connect-src` directive's source list, or undefined when the text declares none.
- *
- * Matches to the end of the directive (`;`) or the end of the enclosing quoted string, which is how
- * these are written in both a Next `headers()` value and a `<meta content="...">`.
- */
-function directiveSources(text, directive) {
-    // Stops at the directive separator or the closing double quote of the enclosing string. Single
-    // quotes are NOT terminators: `'self'` is a source, not the end of the list.
-    const match = new RegExp(`${directive}([^;"]*)`, 'i').exec(text);
-    const list = match?.[1];
-    if (list === undefined)
-        return undefined;
-    return list
-        .split(/\s+/)
-        .map((source) => source.trim())
-        .filter((source) => source.length > 0);
-}
-/**
- * What this policy allows a WebSocket to reach — `connect-src`, or `default-src` when it is absent.
- *
- * The fallback is the CSP spec's, and leaving it out made the check blind to the commonest strict
- * policy there is. MarkText, a production Electron editor, declares
- * `default-src 'self'; script-src 'self'; …` with NO `connect-src`: its WebSockets are restricted to
- * 'self', the bridge is blocked, and this returned "no problem" because it was looking for a
- * directive that was not written. Every fetch-directive falls back to `default-src`; that is what
- * `default` means, and it is why an author does not repeat themselves.
- *
- * Still undefined when NEITHER is present — a policy that constrains neither is not blocking us.
- */
-function connectSrcSources(text) {
-    return directiveSources(text, 'connect-src') ?? directiveSources(text, 'default-src');
-}
-/**
- * The problem with this app's `connect-src`, or undefined if there is not one.
- *
- * `https:` counts as a wildcard here only in the sense that a policy written that loosely will not
- * be the thing blocking a dev WebSocket; the check stays quiet rather than arguing about it.
- */
-export function cspConnectSrcProblem(text, port) {
-    const sources = connectSrcSources(text);
-    if (sources === undefined || 0 === sources.length)
-        return undefined;
-    if (sources.some((source) => WILDCARDS.includes(source)))
-        return undefined;
-    const wanted = bridgeOrigins(port);
-    // BOTH, not either: the SDK picks its host from how the page was served, and a policy that admits
-    // one is a coin flip. A coin flip that fails is indistinguishable from every other silent
-    // non-connect, which is the whole cost being avoided here.
-    if (wanted.every((origin) => sources.includes(origin)))
-        return undefined;
-    const missing = wanted.filter((origin) => !sources.includes(origin));
-    return (`this app declares a Content-Security-Policy whose \`connect-src\` does not admit the Reticle ` +
-        `bridge: ${missing.join(' and ')} ${1 === missing.length ? 'is' : 'are'} missing. The browser ` +
-        `will block the WebSocket and report it in ITS console only — every check on the Reticle side ` +
-        `will pass while the app never connects. ${devCspAddition(port)}`);
-}
-/** The exact addition to paste. Text to copy, not advice to interpret. */
-export function devCspAddition(port) {
-    return (`Add to \`connect-src\` in development only (e.g. behind ` +
-        `\`process.env.NODE_ENV === 'development'\`): ` +
-        `${bridgeOrigins(port).join(' ')}`);
-}
-/** The step title, named here so `doctor` and the plan cannot drift apart on what this check is called. */
-export const CSP_STEP_TITLE = 'Content-Security-Policy';
-/**
- * The first blocking policy among the sources `init` already has in hand, or undefined.
- *
- * At most one finding: a second copy of the same policy in a second file is the same problem, and
- * two identical notices read as two problems.
- */
-export function cspPlanProblem(sources, port) {
-    for (const source of sources) {
-        if ('string' !== typeof source)
-            continue;
-        const problem = cspConnectSrcProblem(source, port);
-        if (problem !== undefined)
-            return problem;
-    }
-    return undefined;
-}

package/dist/init/csp-doctor.d.ts

@@ -1,32 +0,0 @@
-/**
- * `doctor`'s web CSP check — the sibling of the desktop one next door.
- *
- * The desktop findings exist because a Tauri app with the default CSP runs perfectly and never
- * connects. The WEB version of that failure had no check at all, and it arrived twice in one batch
- * of field reports: two Next apps where `init` printed success for every step, the SDK mounted, the
- * dial URL was right, and the browser silently refused the WebSocket because `connect-src` excluded
- * the bridge. The violation is reported in the browser's console and nowhere else, so every check on
- * this side stayed green while the app was permanently unreachable.
- *
- * Reads the files a CSP is actually written in, by name — a full source scan would be slower and
- * would find policy strings in test fixtures and documentation.
- */
-/** Read a project-relative file, or undefined when it is absent/unreadable. */
-type ReadFile = (relative: string) => string | undefined;
-export interface CspDiagnosis {
-    /** Which file to look at. */
-    file: string;
-    /** What is wrong, in one line. */
-    problem: string;
-    /** Exactly what to add — copy-pasteable, with the port actually in use. */
-    fix: string;
-}
-/**
- * The places a Content-Security-Policy gets written in a JS app.
- *
- * Next config and middleware cover `headers()` and the edge-middleware style; the layouts and the
- * plain `index.html` cover the `<meta http-equiv>` style. Both reported cases were in this list.
- */
-export declare const CSP_FILES: readonly string[];
-export declare function diagnoseWebCsp(read: ReadFile, port: number, alsoCheck?: readonly string[]): CspDiagnosis[];
-export {};

package/dist/init/csp-doctor.js

@@ -1,54 +0,0 @@
-/**
- * `doctor`'s web CSP check — the sibling of the desktop one next door.
- *
- * The desktop findings exist because a Tauri app with the default CSP runs perfectly and never
- * connects. The WEB version of that failure had no check at all, and it arrived twice in one batch
- * of field reports: two Next apps where `init` printed success for every step, the SDK mounted, the
- * dial URL was right, and the browser silently refused the WebSocket because `connect-src` excluded
- * the bridge. The violation is reported in the browser's console and nowhere else, so every check on
- * this side stayed green while the app was permanently unreachable.
- *
- * Reads the files a CSP is actually written in, by name — a full source scan would be slower and
- * would find policy strings in test fixtures and documentation.
- */
-import { cspConnectSrcProblem, devCspAddition } from './csp-check.js';
-/**
- * The places a Content-Security-Policy gets written in a JS app.
- *
- * Next config and middleware cover `headers()` and the edge-middleware style; the layouts and the
- * plain `index.html` cover the `<meta http-equiv>` style. Both reported cases were in this list.
- */
-export const CSP_FILES = [
-    'next.config.js',
-    'next.config.mjs',
-    'next.config.ts',
-    'middleware.ts',
-    'middleware.js',
-    'src/middleware.ts',
-    'app/layout.tsx',
-    'app/layout.js',
-    'pages/_document.tsx',
-    'pages/_document.js',
-    'index.html',
-    'public/index.html',
-    // Vite puts the entry HTML at the project root; electron-vite and Tauri put the RENDERER's one
-    // under src/. MarkText declares its policy in `src/renderer/index.html`, and a desktop app is the
-    // likeliest place to meet a strict CSP at all — Electron's own security guidance asks for one.
-    'src/index.html',
-    'src/renderer/index.html',
-    'vercel.json',
-    'netlify.toml',
-];
-export function diagnoseWebCsp(read, port, alsoCheck = []) {
-    const findings = [];
-    for (const file of [...alsoCheck, ...CSP_FILES]) {
-        const source = read(file);
-        if (source === undefined)
-            continue;
-        const problem = cspConnectSrcProblem(source, port);
-        if (problem === undefined)
-            continue;
-        findings.push({ file, problem, fix: devCspAddition(port) });
-    }
-    return findings;
-}

package/dist/init/desktop-doctor.d.ts

@@ -1,41 +0,0 @@
-/**
- * Setup RCA for desktop apps.
- *
- * Every failure this catches is SILENT. A Tauri app with the default CSP runs perfectly and simply
- * never appears in `reticle status` — the WebSocket is blocked before it opens, and nothing in the
- * app's own console says so. An Electron app missing the preload line works fine and reports zero
- * network activity forever, which reads as "the app makes no backend calls" rather than "you are
- * blind to all of them".
- *
- * Silent misconfiguration is the same disease as a false green: the tool answers confidently and the
- * answer is wrong. So the diagnosis names the file, the reason, and the exact line to add.
- *
- * Pure: a `read` function in, findings out. No fs, no cwd, no process.
- */
-export declare const DesktopFinding: {
-    /** Tauri's CSP will block the bridge WebSocket — the app will never connect, with no error. */
-    readonly TAURI_CSP_BLOCKS_BRIDGE: "tauri-csp-blocks-bridge";
-    /** A custom CSP dropped the `ipc:` source Tauri needs for `invoke` itself. */
-    readonly TAURI_CSP_BLOCKS_IPC: "tauri-csp-blocks-ipc";
-    /** The preload never requires the shim, so every IPC call is invisible. */
-    readonly ELECTRON_PRELOAD_MISSING: "electron-preload-missing";
-    /** The main process never installs the capture helper, so screenshots are unavailable. */
-    readonly ELECTRON_CAPTURE_MISSING: "electron-capture-missing";
-};
-export type DesktopFinding = (typeof DesktopFinding)[keyof typeof DesktopFinding];
-interface DesktopDiagnosis {
-    code: DesktopFinding;
-    /** Which file to look at. */
-    file: string;
-    /** What is wrong, in one line. */
-    problem: string;
-    /** Exactly what to add — copy-pasteable, with the port actually in use. */
-    fix: string;
-}
-/** Reads a project-relative path. Undefined means the file does not exist. */
-type ReadFile = (path: string) => string | undefined;
-/** Is this project a desktop shell at all? Used to print a positive result instead of silence. */
-export declare function isDesktopProject(read: ReadFile): boolean;
-/** Which desktop shell (if any) this project is, and what is missing from its Reticle wiring. */
-export declare function diagnoseDesktop(read: ReadFile, port: number): DesktopDiagnosis[];
-export {};