@reticlehq/server 2.13.1 → 2.14.0

package/dist/init/desktop-doctor.js

@@ -1,198 +0,0 @@
-import { RETICLE_IPC_GLOBAL } from '@reticlehq/core';
-/**
- * Setup RCA for desktop apps.
- *
- * Every failure this catches is SILENT. A Tauri app with the default CSP runs perfectly and simply
- * never appears in `reticle status` — the WebSocket is blocked before it opens, and nothing in the
- * app's own console says so. An Electron app missing the preload line works fine and reports zero
- * network activity forever, which reads as "the app makes no backend calls" rather than "you are
- * blind to all of them".
- *
- * Silent misconfiguration is the same disease as a false green: the tool answers confidently and the
- * answer is wrong. So the diagnosis names the file, the reason, and the exact line to add.
- *
- * Pure: a `read` function in, findings out. No fs, no cwd, no process.
- */
-export const DesktopFinding = {
-    /** Tauri's CSP will block the bridge WebSocket — the app will never connect, with no error. */
-    TAURI_CSP_BLOCKS_BRIDGE: 'tauri-csp-blocks-bridge',
-    /** A custom CSP dropped the `ipc:` source Tauri needs for `invoke` itself. */
-    TAURI_CSP_BLOCKS_IPC: 'tauri-csp-blocks-ipc',
-    /** The preload never requires the shim, so every IPC call is invisible. */
-    ELECTRON_PRELOAD_MISSING: 'electron-preload-missing',
-    /** The main process never installs the capture helper, so screenshots are unavailable. */
-    ELECTRON_CAPTURE_MISSING: 'electron-capture-missing',
-};
-const TAURI_CONF = 'src-tauri/tauri.conf.json';
-const PRELOAD_REQUIRE = '@reticlehq/electron/preload';
-const CAPTURE_REQUIRE = '@reticlehq/electron/main';
-function parseJson(text) {
-    if (text === undefined)
-        return undefined;
-    try {
-        const parsed = JSON.parse(text);
-        return 'object' === typeof parsed && parsed !== null
-            ? parsed
-            : undefined;
-    }
-    catch {
-        return undefined; // a malformed config is the app's problem, not something to crash the doctor on
-    }
-}
-function record(value) {
-    return 'object' === typeof value && value !== null ? value : {};
-}
-/**
- * Does this CSP permit the bridge WebSocket on `port`?
- *
- * A MISSING csp key is treated as blocking, not permissive: Tauri applies a restrictive default, so
- * reporting "no CSP, therefore fine" would be precisely the false green this tool exists to prevent.
- */
-function cspAllowsBridge(csp, port) {
-    if (csp === undefined)
-        return false;
-    const exact = `ws://localhost:${String(port)}`;
-    const loopback = `ws://127.0.0.1:${String(port)}`;
-    // A BARE `ws:` scheme source allows any ws origin. It must be matched as a whole source, not as a
-    // substring: `includes('ws:')` also matches `ws://localhost:4400`, which would make every port
-    // look allowed and silently defeat the port check this function exists to perform.
-    const bareScheme = /(^|[\s;])ws:(?!\/\/)/.test(csp);
-    return (csp.includes(exact) ||
-        csp.includes(loopback) ||
-        csp.includes('ws://localhost:*') ||
-        csp.includes('ws://127.0.0.1:*') ||
-        bareScheme);
-}
-/** Tauri v2 needs `ipc:`/`http://ipc.localhost` in connect-src for `invoke` to work at all. */
-function cspAllowsIpc(csp) {
-    return csp.includes('ipc:') || csp.includes('ipc.localhost');
-}
-function diagnoseTauri(read, port) {
-    const conf = parseJson(read(TAURI_CONF));
-    if (conf === undefined)
-        return [];
-    const security = record(record(conf['app'])['security']);
-    const csp = 'string' === typeof security['csp'] ? security['csp'] : undefined;
-    const findings = [];
-    if (!cspAllowsBridge(csp, port)) {
-        findings.push({
-            code: DesktopFinding.TAURI_CSP_BLOCKS_BRIDGE,
-            file: TAURI_CONF,
-            problem: csp === undefined
-                ? "no `app.security.csp` set, so Tauri's restrictive default applies and blocks the Reticle bridge — the app will run normally and never connect"
-                : 'the CSP `connect-src` does not allow the Reticle bridge WebSocket — the app will run normally and never connect',
-            fix: `add to app.security.csp connect-src:  ws://localhost:${String(port)}`,
-        });
-    }
-    if (csp !== undefined && !cspAllowsIpc(csp)) {
-        findings.push({
-            code: DesktopFinding.TAURI_CSP_BLOCKS_IPC,
-            file: TAURI_CONF,
-            problem: 'the CSP dropped the `ipc:` source Tauri needs — `invoke` itself will fail',
-            fix: 'add to app.security.csp connect-src:  ipc: http://ipc.localhost',
-        });
-    }
-    return findings;
-}
-/** The directory portion of a path, without pulling in node:path (this module stays pure). */
-function dirOf(path) {
-    const cut = path.lastIndexOf('/');
-    return cut < 0 ? '' : path.slice(0, cut + 1);
-}
-/**
- * Where a preload SOURCE might live, in the order worth trying.
- *
- * Beside `main` first (the unbundled layout), then the usual source directories — a bundled setup
- * points `main` at `out/` or `dist/` while the real preload stays in `src/` or `electron/`.
- */
-function preloadCandidates(mainDir) {
-    const names = ['preload.cjs', 'preload.js', 'preload.mjs', 'preload.ts', 'preload.mts'];
-    const dirs = [mainDir, 'electron/', 'src/', 'src/preload/', 'src/main/', ''];
-    return dirs.flatMap((dir) => names.map((name) => `${dir}${name}`));
-}
-/**
- * Where a BUNDLED preload's output lands. electron-vite's default layout mirrors `out/main` with
- * `out/preload`; Forge and hand-rolled setups favour `dist`/`build`.
- */
-function bundledPreloadCandidates(mainDir) {
-    const roots = [mainDir.replace(/main\/?$/, ''), 'out/', 'dist/', 'build/', '.vite/build/'];
-    const names = [
-        'preload/index.js',
-        'preload/index.mjs',
-        'preload/index.cjs',
-        'preload.js',
-        'preload.mjs',
-        'preload.cjs',
-    ];
-    return roots.flatMap((root) => names.map((name) => `${root}${name}`));
-}
-/**
- * Is the preload wired, judged from whatever evidence exists?
- *
- * Source first (the require is right there). Failing that, the BUILD OUTPUT: bundling inlines the
- * shim, and the shim carries the contract's own window global — finding that string in the artifact
- * proves the preload is wired even though the require has been compiled away. Undefined means no
- * evidence either way, and an unknown must never be reported as a fault.
- */
-function preloadWired(read, mainDir) {
-    for (const candidate of preloadCandidates(mainDir)) {
-        const source = read(candidate);
-        if (source !== undefined)
-            return { wired: source.includes(PRELOAD_REQUIRE), file: candidate };
-    }
-    for (const candidate of bundledPreloadCandidates(mainDir)) {
-        const built = read(candidate);
-        if (built !== undefined) {
-            return { wired: built.includes(RETICLE_IPC_GLOBAL), file: candidate };
-        }
-    }
-    return undefined;
-}
-function diagnoseElectron(read, main) {
-    const findings = [];
-    const dir = dirOf(main);
-    // Undefined = no source AND no build output to judge from. An unknown is not a fault.
-    const preload = preloadWired(read, dir);
-    if (preload !== undefined && !preload.wired) {
-        findings.push({
-            code: DesktopFinding.ELECTRON_PRELOAD_MISSING,
-            file: preload.file,
-            problem: 'the preload never installs the Reticle IPC shim, so every ipcRenderer.invoke is invisible — reticle_network will report nothing and read as "this app makes no backend calls"',
-            fix: `add as the FIRST line:  require('${PRELOAD_REQUIRE}')`,
-        });
-    }
-    const mainSource = read(main);
-    if (mainSource !== undefined && !mainSource.includes(CAPTURE_REQUIRE)) {
-        findings.push({
-            code: DesktopFinding.ELECTRON_CAPTURE_MISSING,
-            file: main,
-            problem: 'the main process never installs the capture helper, so screenshots are unavailable',
-            fix: `add:  const { installReticleCapture } = require('${CAPTURE_REQUIRE}')  then installReticleCapture(win)`,
-        });
-    }
-    return findings;
-}
-/** Is this project a desktop shell at all? Used to print a positive result instead of silence. */
-export function isDesktopProject(read) {
-    if (read(TAURI_CONF) !== undefined)
-        return true;
-    const pkg = parseJson(read('package.json'));
-    if (pkg === undefined)
-        return false;
-    const deps = { ...record(pkg['dependencies']), ...record(pkg['devDependencies']) };
-    return deps['electron'] !== undefined;
-}
-/** Which desktop shell (if any) this project is, and what is missing from its Reticle wiring. */
-export function diagnoseDesktop(read, port) {
-    const tauri = diagnoseTauri(read, port);
-    if (tauri.length > 0 || read(TAURI_CONF) !== undefined)
-        return tauri;
-    const pkg = parseJson(read('package.json'));
-    if (pkg === undefined)
-        return [];
-    const deps = { ...record(pkg['dependencies']), ...record(pkg['devDependencies']) };
-    if (deps['electron'] === undefined)
-        return [];
-    const main = 'string' === typeof pkg['main'] ? pkg['main'] : undefined;
-    return main === undefined ? [] : diagnoseElectron(read, main);
-}

package/dist/init/detect.d.ts

@@ -1,96 +0,0 @@
-/**
- * Pure framework + toolchain detection for `reticle init`. No filesystem access — callers pass in
- * the parsed package.json and the set of config/lock filenames present in the project root.
- */
-export declare const Framework: {
-    readonly NEXT: "next";
-    /**
-     * Nuxt owns its own Vite instance and has no `vite.config`, so it used to fall all the way through
-     * to HTML — and then be handed a React kit and a connect snippet guarded on
-     * `window.location.hostname === 'localhost'`, which cannot work in a Vue app (the guard throws
-     * during SSR, and never runs at all on a non-localhost dev host). Detected in its own right so it
-     * gets the package and the recipe that actually fit it.
-     */
-    readonly NUXT: "nuxt";
-    readonly VITE: "vite";
-    readonly SVELTEKIT: "sveltekit";
-    readonly ASTRO: "astro";
-    /** Create React App. No config file exists, so `react-scripts` in the dependencies is the signal. */
-    readonly CRA: "cra";
-    readonly HTML: "html";
-};
-export type Framework = (typeof Framework)[keyof typeof Framework];
-export declare const PackageManager: {
-    readonly PNPM: "pnpm";
-    readonly YARN: "yarn";
-    readonly BUN: "bun";
-    readonly NPM: "npm";
-};
-export type PackageManager = (typeof PackageManager)[keyof typeof PackageManager];
-interface PackageJsonLike {
-    dependencies?: Record<string, string>;
-    devDependencies?: Record<string, string>;
-    peerDependencies?: Record<string, string>;
-}
-export interface DetectInput {
-    pkg: PackageJsonLike;
-    /** Basenames of config files present in the project root (e.g. 'next.config.mjs'). */
-    configFiles: ReadonlySet<string>;
-    /** Lockfile basenames present in the project root. */
-    lockfiles: ReadonlySet<string>;
-    /** Marker basenames inside `node_modules` (`.modules.yaml`, `.yarn-state.yml`, …), if installed. */
-    nodeModulesMarkers?: ReadonlySet<string>;
-}
-/**
- * The UI library the app renders with. Detection used to key on "vite is in package.json" and stop
- * there, so a Vue or Preact app got `@reticlehq/react` installed and an all-green report with no
- * mention that the React adapter has nothing to attach to.
- */
-export declare const UiLibrary: {
-    readonly REACT: "react";
-    readonly PREACT: "preact";
-    readonly VUE: "vue";
-    readonly SVELTE: "svelte";
-    readonly UNKNOWN: "unknown";
-};
-export type UiLibrary = (typeof UiLibrary)[keyof typeof UiLibrary];
-export interface Detection {
-    framework: Framework;
-    uiLibrary: UiLibrary;
-    /**
-     * Whether the project is TypeScript. Not cosmetic: generating a `.tsx` file into a JavaScript
-     * project makes Next auto-install TypeScript on the next `next dev`, which on Next 13 takes its
-     * require-hook down with it and the dev server never starts.
-     */
-    typescript: boolean;
-    reactMajor: number | undefined;
-    /** React 19 dropped _debugSource, so it needs the build-time source-map stamp. */
-    needsSourceMapping: boolean;
-    packageManager: PackageManager;
-}
-/** Extract the leading major version from a semver range like "^19.0.0" or "19.1.1". */
-export declare function parseMajor(range: string | undefined): number | undefined;
-/**
- * Whether an installed tree identifies the manager that built it. Callers use this to decide whether
- * they still need weaker evidence — see `resolveLockfiles`, which stops inheriting an ancestor
- * lockfile once the project's own tree can answer the question.
- */
-export declare function namesAPackageManager(markers: ReadonlySet<string>): boolean;
-export declare function detectPackageManager(lockfiles: ReadonlySet<string>, nodeModulesMarkers: ReadonlySet<string>): PackageManager;
-export declare function detect(input: DetectInput): Detection;
-interface InstallCommand {
-    command: string;
-    args: string[];
-}
-/** Build a dev-dependency install command for one or more packages (e.g. the kit + its build plugin). */
-export declare function installCommandParts(pm: PackageManager, pkgs: string | readonly string[]): InstallCommand;
-/**
- * The install command as a human reads it — and deliberately NOT `installCommandParts` joined.
- *
- * This string is what the plan prints and what a user retypes when running the step by hand, so it
- * must not carry the flags we add only to quieten our own child process. Built from `INSTALL_ARGS`
- * directly for that reason; routing it through the parts would put `--no-audit --no-fund` in front of
- * every reader and teach them our noise-suppression as if it were part of installing Reticle.
- */
-export declare function installCommand(pm: PackageManager, pkgs: string | readonly string[]): string;
-export {};

package/dist/init/detect.js

@@ -1,209 +0,0 @@
-/**
- * Pure framework + toolchain detection for `reticle init`. No filesystem access — callers pass in
- * the parsed package.json and the set of config/lock filenames present in the project root.
- */
-export const Framework = {
-    NEXT: 'next',
-    /**
-     * Nuxt owns its own Vite instance and has no `vite.config`, so it used to fall all the way through
-     * to HTML — and then be handed a React kit and a connect snippet guarded on
-     * `window.location.hostname === 'localhost'`, which cannot work in a Vue app (the guard throws
-     * during SSR, and never runs at all on a non-localhost dev host). Detected in its own right so it
-     * gets the package and the recipe that actually fit it.
-     */
-    NUXT: 'nuxt',
-    VITE: 'vite',
-    SVELTEKIT: 'sveltekit',
-    ASTRO: 'astro',
-    /** Create React App. No config file exists, so `react-scripts` in the dependencies is the signal. */
-    CRA: 'cra',
-    HTML: 'html',
-};
-export const PackageManager = {
-    PNPM: 'pnpm',
-    YARN: 'yarn',
-    BUN: 'bun',
-    NPM: 'npm',
-};
-/**
- * The UI library the app renders with. Detection used to key on "vite is in package.json" and stop
- * there, so a Vue or Preact app got `@reticlehq/react` installed and an all-green report with no
- * mention that the React adapter has nothing to attach to.
- */
-export const UiLibrary = {
-    REACT: 'react',
-    PREACT: 'preact',
-    VUE: 'vue',
-    SVELTE: 'svelte',
-    UNKNOWN: 'unknown',
-};
-const NEXT_CONFIGS = ['next.config.js', 'next.config.mjs', 'next.config.ts', 'next.config.cjs'];
-const VITE_CONFIGS = ['vite.config.js', 'vite.config.ts', 'vite.config.mjs', 'vite.config.mts'];
-const SVELTE_CONFIGS = ['svelte.config.js', 'svelte.config.ts', 'svelte.config.mjs'];
-const NUXT_CONFIGS = ['nuxt.config.ts', 'nuxt.config.js', 'nuxt.config.mjs'];
-const ASTRO_CONFIGS = [
-    'astro.config.mjs',
-    'astro.config.js',
-    'astro.config.ts',
-    'astro.config.cjs',
-];
-function depVersion(pkg, name) {
-    return pkg.dependencies?.[name] ?? pkg.devDependencies?.[name] ?? pkg.peerDependencies?.[name];
-}
-function hasAnyConfig(files, candidates) {
-    return candidates.some((c) => files.has(c));
-}
-/** Extract the leading major version from a semver range like "^19.0.0" or "19.1.1". */
-export function parseMajor(range) {
-    if (range === undefined)
-        return undefined;
-    const match = range.match(/(\d+)/);
-    if (null === match || match[1] === undefined)
-        return undefined;
-    const major = parseInt(match[1], 10);
-    return isNaN(major) ? undefined : major;
-}
-/**
- * Markers each package manager leaves INSIDE `node_modules`. An installed tree is the strongest
- * evidence there is — stronger than a lockfile, which may simply not be committed.
- *
- * Without this, a pnpm-installed project with no committed lockfile was read as npm, and `npm i -D`
- * then died on pnpm's symlink layout with `Cannot read properties of null (reading 'matches')`. Worse,
- * it left the package present in `node_modules` but absent from `package.json`, so every later run
- * reported the same failure — a setup that could not be retried into working.
- */
-const NODE_MODULES_MARKERS = [
-    ['.modules.yaml', PackageManager.PNPM],
-    ['.yarn-state.yml', PackageManager.YARN],
-    ['.package-lock.json', PackageManager.NPM],
-];
-/** Marker basenames present inside the project's `node_modules`, if it has one. */
-function packageManagerFromNodeModules(markers) {
-    for (const [name, pm] of NODE_MODULES_MARKERS)
-        if (markers.has(name))
-            return pm;
-    return undefined;
-}
-/**
- * Whether an installed tree identifies the manager that built it. Callers use this to decide whether
- * they still need weaker evidence — see `resolveLockfiles`, which stops inheriting an ancestor
- * lockfile once the project's own tree can answer the question.
- */
-export function namesAPackageManager(markers) {
-    return packageManagerFromNodeModules(markers) !== undefined;
-}
-export function detectPackageManager(lockfiles, nodeModulesMarkers) {
-    if (lockfiles.has('pnpm-lock.yaml'))
-        return PackageManager.PNPM;
-    if (lockfiles.has('yarn.lock'))
-        return PackageManager.YARN;
-    if (lockfiles.has('bun.lockb') || lockfiles.has('bun.lock'))
-        return PackageManager.BUN;
-    // No lockfile is not the same as "npm". An already-installed tree says which manager built it.
-    return packageManagerFromNodeModules(nodeModulesMarkers) ?? PackageManager.NPM;
-}
-function detectFramework(input) {
-    const { pkg, configFiles } = input;
-    if (depVersion(pkg, 'next') !== undefined || hasAnyConfig(configFiles, NEXT_CONFIGS)) {
-        return Framework.NEXT;
-    }
-    // Nuxt before Vite: Nuxt apps can carry a `vite` dependency and even a vite.config, but the
-    // generic Vite path would wire a plugin into a config Nuxt does not read, and inject connect into
-    // an index.html Nuxt does not serve.
-    if (depVersion(pkg, 'nuxt') !== undefined || hasAnyConfig(configFiles, NUXT_CONFIGS)) {
-        return Framework.NUXT;
-    }
-    // SvelteKit is Vite-based but renders through app.html, so the Vite plugin's index.html injection
-    // never fires (verified) — it needs a manual client connect. Check BEFORE the generic Vite branch.
-    if (depVersion(pkg, '@sveltejs/kit') !== undefined || hasAnyConfig(configFiles, SVELTE_CONFIGS)) {
-        return Framework.SVELTEKIT;
-    }
-    // Astro is Vite-based but SSRs its own HTML, so the plugin's index.html injection never fires and
-    // `vite` is not a direct dependency — it used to fall all the way through to HTML and be handed
-    // connect instructions for a bundler it does not have. Check BEFORE the generic Vite branch.
-    if (depVersion(pkg, 'astro') !== undefined || hasAnyConfig(configFiles, ASTRO_CONFIGS)) {
-        return Framework.ASTRO;
-    }
-    if (depVersion(pkg, 'vite') !== undefined || hasAnyConfig(configFiles, VITE_CONFIGS)) {
-        return Framework.VITE;
-    }
-    // Checked after Vite, never before: a project migrating off CRA can carry both, and the Vite path
-    // is the one that works. CRA has no config file at all, so the dependency is the only signal.
-    if (depVersion(pkg, 'react-scripts') !== undefined)
-        return Framework.CRA;
-    return Framework.HTML;
-}
-/**
- * React first: a Preact app using preact/compat aliases React, and Next/Remix apps list both. The
- * order is the precedence — whichever the app actually renders through is the one it depends on
- * directly.
- */
-function detectUiLibrary(pkg) {
-    if (depVersion(pkg, 'react') !== undefined)
-        return UiLibrary.REACT;
-    if (depVersion(pkg, 'preact') !== undefined)
-        return UiLibrary.PREACT;
-    if (depVersion(pkg, 'vue') !== undefined)
-        return UiLibrary.VUE;
-    if (depVersion(pkg, 'svelte') !== undefined)
-        return UiLibrary.SVELTE;
-    return UiLibrary.UNKNOWN;
-}
-const TS_CONFIGS = ['tsconfig.json'];
-export function detect(input) {
-    const reactMajor = parseMajor(depVersion(input.pkg, 'react'));
-    return {
-        framework: detectFramework(input),
-        uiLibrary: detectUiLibrary(input.pkg),
-        typescript: hasAnyConfig(input.configFiles, TS_CONFIGS) ||
-            depVersion(input.pkg, 'typescript') !== undefined,
-        reactMajor,
-        needsSourceMapping: reactMajor !== undefined && reactMajor >= 19,
-        packageManager: detectPackageManager(input.lockfiles, input.nodeModulesMarkers ?? new Set()),
-    };
-}
-const INSTALL_ARGS = {
-    [PackageManager.PNPM]: ['add', '-D'],
-    [PackageManager.YARN]: ['add', '-D'],
-    [PackageManager.BUN]: ['add', '-d'],
-    [PackageManager.NPM]: ['i', '-D'],
-};
-/**
- * Flags added only to the install we RUN, never to the one we print.
- *
- * The install is a child process whose output lands above ours. Measured on a real install: the run
- * opened with "added 602 packages", a funding notice, and "14 vulnerabilities (7 moderate, 7 high)"
- * with `npm audit fix` advice, before one line of Reticle output. A user's first impression of a
- * verification tool was a wall of somebody else's security warnings, at exactly the moment they are
- * deciding whether this tool is careful — and that audit summary describes their existing dependency
- * tree, which our two dev packages neither caused nor can fix.
- *
- * Kept off `installCommand`, which is the string shown in the plan and the one a user copies when
- * running it by hand: nobody should be taught to type our noise-suppression flags.
- *
- * Quieted, never silenced — the exit code and stderr are untouched, so a real failure of the step
- * everything downstream depends on stays as loud as it was.
- *
- * npm only: pnpm, yarn and bun reject these, and an unknown flag would turn a working install into a
- * hard failure, which is the opposite of the problem being fixed.
- */
-const QUIET_INSTALL_ARGS = {
-    [PackageManager.NPM]: ['--no-audit', '--no-fund'],
-};
-/** Build a dev-dependency install command for one or more packages (e.g. the kit + its build plugin). */
-export function installCommandParts(pm, pkgs) {
-    const list = 'string' === typeof pkgs ? [pkgs] : pkgs;
-    return { command: pm, args: [...INSTALL_ARGS[pm], ...list, ...(QUIET_INSTALL_ARGS[pm] ?? [])] };
-}
-/**
- * The install command as a human reads it — and deliberately NOT `installCommandParts` joined.
- *
- * This string is what the plan prints and what a user retypes when running the step by hand, so it
- * must not carry the flags we add only to quieten our own child process. Built from `INSTALL_ARGS`
- * directly for that reason; routing it through the parts would put `--no-audit --no-fund` in front of
- * every reader and teach them our noise-suppression as if it were part of installing Reticle.
- */
-export function installCommand(pm, pkgs) {
-    const list = 'string' === typeof pkgs ? [pkgs] : pkgs;
-    return `${pm} ${[...INSTALL_ARGS[pm], ...list].join(' ')}`;
-}

package/dist/init/dev-script.d.ts

@@ -1,50 +0,0 @@
-/**
- * Which command starts this project, and should we start it ourselves?
- *
- * `init` finishes by telling the human to start or restart their dev server, in a closing
- * paragraph, in a terminal that is about to be cleared by the client restart it also asks for.
- * That is the second unmarked hand-off in the install, after the capabilities file, and it lands
- * on the same surface: prose nobody re-reads.
- *
- * Every fact needed to remove it is already in the project. `package.json` names the script; the
- * framework tells us the conventional port; a probe tells us whether something already answers
- * there. Nothing here needs a human.
- *
- * Kept as a PURE decision, separate from spawning, because the interesting part is the judgement —
- * which script, and whether to touch anything at all — and that is what wants testing. Spawning a
- * process is not.
- */
-/** Script names a JS project uses to run itself, in the order we would pick them. */
-export declare const DEV_SCRIPT_NAMES: readonly ["dev", "start", "serve"];
-export declare const DevScriptChoice: {
-    /** Something already answers on the port. Use it; never replace a server the user is running. */
-    readonly ALREADY_SERVING: "already-serving";
-    /** We know the command and nothing is listening. Start it. */
-    readonly START: "start";
-    /** No script we recognise. Say so rather than guess a command. */
-    readonly NO_SCRIPT: "no-script";
-};
-export type DevScriptChoice = (typeof DevScriptChoice)[keyof typeof DevScriptChoice];
-export interface DevScriptPlan {
-    choice: DevScriptChoice;
-    /** The npm script name, when there is one. */
-    script?: string;
-    /** What a human would type, for the line we print. */
-    command?: string;
-}
-/**
- * Pick the script and decide whether to run it.
- *
- * `serving` is the probe result, passed in rather than measured here so the decision stays pure.
- * When something is already answering we do not care which script exists: the rule is never to
- * start a second server, because the one that is running may be the user's, with their state in it.
- */
-export declare function planDevScript(scripts: Readonly<Record<string, string>>, packageManager: string, serving: boolean): DevScriptPlan;
-/**
- * The command to print for this project, straight from its `package.json`.
- *
- * Lives here rather than in `run.ts` because it is the same judgement as `planDevScript` with the
- * parsing attached, and `run.ts` is at its cohesion limit. Returns undefined for anything it cannot
- * read: this phrasing decides nothing, so it must never be able to break an install.
- */
-export declare function devCommandFrom(pkg: unknown, packageManager: string): string | undefined;

package/dist/init/dev-script.js

@@ -1,66 +0,0 @@
-/**
- * Which command starts this project, and should we start it ourselves?
- *
- * `init` finishes by telling the human to start or restart their dev server, in a closing
- * paragraph, in a terminal that is about to be cleared by the client restart it also asks for.
- * That is the second unmarked hand-off in the install, after the capabilities file, and it lands
- * on the same surface: prose nobody re-reads.
- *
- * Every fact needed to remove it is already in the project. `package.json` names the script; the
- * framework tells us the conventional port; a probe tells us whether something already answers
- * there. Nothing here needs a human.
- *
- * Kept as a PURE decision, separate from spawning, because the interesting part is the judgement —
- * which script, and whether to touch anything at all — and that is what wants testing. Spawning a
- * process is not.
- */
-/** Script names a JS project uses to run itself, in the order we would pick them. */
-export const DEV_SCRIPT_NAMES = ['dev', 'start', 'serve'];
-const CANDIDATES = DEV_SCRIPT_NAMES;
-export const DevScriptChoice = {
-    /** Something already answers on the port. Use it; never replace a server the user is running. */
-    ALREADY_SERVING: 'already-serving',
-    /** We know the command and nothing is listening. Start it. */
-    START: 'start',
-    /** No script we recognise. Say so rather than guess a command. */
-    NO_SCRIPT: 'no-script',
-};
-/**
- * Pick the script and decide whether to run it.
- *
- * `serving` is the probe result, passed in rather than measured here so the decision stays pure.
- * When something is already answering we do not care which script exists: the rule is never to
- * start a second server, because the one that is running may be the user's, with their state in it.
- */
-export function planDevScript(scripts, packageManager, serving) {
-    if (serving)
-        return { choice: DevScriptChoice.ALREADY_SERVING };
-    const name = CANDIDATES.find((c) => 'string' === typeof scripts[c] && scripts[c] !== '');
-    if (name === undefined)
-        return { choice: DevScriptChoice.NO_SCRIPT };
-    // `npm` needs `run`; the others take the script name directly. Getting this wrong prints a
-    // command that fails, which is worse than printing nothing.
-    const command = 'npm' === packageManager ? `npm run ${name}` : `${packageManager} ${name}`;
-    return { choice: DevScriptChoice.START, script: name, command };
-}
-/**
- * The command to print for this project, straight from its `package.json`.
- *
- * Lives here rather than in `run.ts` because it is the same judgement as `planDevScript` with the
- * parsing attached, and `run.ts` is at its cohesion limit. Returns undefined for anything it cannot
- * read: this phrasing decides nothing, so it must never be able to break an install.
- */
-export function devCommandFrom(pkg, packageManager) {
-    try {
-        // Takes the PARSED manifest. It used to take the raw string and parse it a fourth time — the
-        // caller now reads the file once, through a guard, so there is one place a malformed manifest
-        // can be noticed and it is not this one.
-        const scripts = 'object' === typeof pkg && null !== pkg
-            ? (pkg.scripts ?? {})
-            : {};
-        return planDevScript(scripts, packageManager, false).command;
-    }
-    catch {
-        return undefined;
-    }
-}

package/dist/init/format-generated.d.ts

@@ -1,18 +0,0 @@
-/**
- * Format a file `init` is about to write, using the project's own Prettier when it is installed.
- *
- * Reported from the field (#684): a clean CRA install failed the project's own lint because
- * `src/reticle-dev.ts` was emitted as one long line. The project already had Prettier; init never
- * asked it. Best-effort: resolve Prettier from the app (not from ours — we do not ship it), apply
- * its config, and on any failure return the original content so init never fails because of a
- * formatter. Sync only — `applyEffects` is sync, and Prettier 3's async `format` cannot join here.
- */
-/** True when this write is a connect/dev module lint will treat as project source. */
-export declare function isGeneratedSourcePath(relPath: string): boolean;
-/**
- * Format `content` for `relPath` under `projectRoot`, or return it unchanged.
- *
- * Only the sync Prettier API is used. Prettier 3's async `format` is skipped (returns the original)
- * rather than holding init open on a promise `applyEffects` cannot await.
- */
-export declare function formatGeneratedSource(content: string, relPath: string, projectRoot: string): string;