@reticlehq/server 2.14.0 → 3.2.0

package/dist/journal/journal-recorder.js

@@ -1,115 +0,0 @@
-import { EventAttribution, JOURNAL_FILE_VERSION, } from '@reticlehq/core';
-const DEFAULT_FLUSH_AT = 64;
-/**
- * Owns action-window attribution and batched, order-preserving journaling — the durable half of the
- * causal spine, kept out of Session so neither file bloats. Every stamped event is `observe`d: if an
- * action is active (dispatch→settle), the event is attributed to it (`attribution:"window"` — a time
- * heuristic, never presented as dataflow truth) and its seq folds into the action's range. Writes are
- * serialized on one chain so `events.jsonl` never interleaves and an action is always persisted after
- * the events it closed. Sink writes are best-effort: a failed local journal write must never break the
- * live session, so errors are swallowed.
- */
-export class JournalRecorder {
-    #sink;
-    #now;
-    #flushAt;
-    #pending = [];
-    #active;
-    #chain = Promise.resolve();
-    constructor(sink, options) {
-        this.#sink = sink;
-        this.#now = options.now;
-        this.#flushAt = options.flushAt ?? DEFAULT_FLUSH_AT;
-    }
-    /** Attribute (if an action is active), enqueue for journaling, and return the possibly-stamped event. */
-    observe(event) {
-        let out = event;
-        const active = this.#active;
-        if (active !== undefined) {
-            out = { ...event, actionId: active.actionId, attribution: EventAttribution.WINDOW };
-            if ('number' === typeof event.seq) {
-                active.seqFrom =
-                    active.seqFrom === undefined ? event.seq : Math.min(active.seqFrom, event.seq);
-                active.seqTo = active.seqTo === undefined ? event.seq : Math.max(active.seqTo, event.seq);
-            }
-        }
-        this.#pending.push(out);
-        if (this.#pending.length >= this.#flushAt)
-            this.#enqueueFlush();
-        return out;
-    }
-    /** Open an attribution window. One action is active at a time (the agent drives sequentially). */
-    beginAction(actionId, tool, args) {
-        this.#active = { actionId, tool, args, tStart: this.#now() };
-    }
-    /** Close the active window: persist its buffered events, then the action record. No-op if none active. */
-    finishAction(effect, settled, settledInMs) {
-        const active = this.#active;
-        if (active === undefined)
-            return;
-        this.#active = undefined;
-        const action = {
-            v: JOURNAL_FILE_VERSION,
-            actionId: active.actionId,
-            tool: active.tool,
-            args: active.args,
-            effect,
-            settled,
-            settledInMs,
-            seqRange: active.seqFrom === undefined || active.seqTo === undefined
-                ? undefined
-                : { from: active.seqFrom, to: active.seqTo },
-            tRange: { from: active.tStart, to: this.#now() },
-            at: active.tStart,
-        };
-        this.#enqueueFlush();
-        this.#chain = this.#chain.then(() => this.#sink.appendAction(action)).catch(() => undefined);
-    }
-    /**
-     * Append one action record for a tool that PROVED something without driving the page.
-     *
-     * `reticle_assert` produces a verdict and moves nothing, so it must never open an attribution
-     * window: while one is open every observed event is stamped with that action's id, and stamping
-     * ambient traffic with an assertion's id would manufacture a causal link that does not exist —
-     * exactly what `EventAttribution.WINDOW` is carefully labelled to avoid claiming. So this writes
-     * the record and leaves `#active` precisely as it found it: an act window open across an assert
-     * keeps attributing to itself, which is the truth of what caused those events.
-     *
-     * `settled` is left unset for the same reason — nothing was dispatched, so there is no settle
-     * outcome to report, and the run fold skips actions that state none rather than inventing one.
-     *
-     * Ordering rides the same chain as `finishAction`: buffered events flush first, so a record is
-     * always persisted after the events that preceded it. Records land in the order verdicts were
-     * REACHED, so an assert taken mid-window is written before the act it interrupted.
-     */
-    recordAction(actionId, tool, args, effect) {
-        const at = this.#now();
-        const action = {
-            v: JOURNAL_FILE_VERSION,
-            actionId,
-            tool,
-            args,
-            effect,
-            // No window was opened, so no event carries this id: `seqRange` is omitted rather than
-            // invented, because any range here would claim an attribution that never happened. `tRange` is
-            // required by the schema and the honest value is the instant the verdict was recorded — a span
-            // of zero, which is exactly how much time this action attributed events over.
-            tRange: { from: at, to: at },
-            at,
-        };
-        this.#enqueueFlush();
-        this.#chain = this.#chain.then(() => this.#sink.appendAction(action)).catch(() => undefined);
-    }
-    /** Persist any buffered events now (call on session end). Awaits the write chain to settle. */
-    async flush() {
-        this.#enqueueFlush();
-        await this.#chain;
-    }
-    #enqueueFlush() {
-        if (0 === this.#pending.length)
-            return;
-        const batch = this.#pending;
-        this.#pending = [];
-        this.#chain = this.#chain.then(() => this.#sink.appendEvents(batch)).catch(() => undefined);
-    }
-}

package/dist/journal/retention.d.ts

@@ -1,20 +0,0 @@
-import type { FileSystemPort } from '../project/fs-port.js';
-/** Keep at most this many session journals on disk; older ones are pruned by recency. */
-export declare const DEFAULT_SESSION_RETENTION = 20;
-interface DatedDir {
-    name: string;
-    mtimeMs: number;
-}
-/**
- * Pure: given session dirs with their mtimes, the names to remove so only the `retention` most-recent
- * remain. Oldest-first. Exported for testing (no IO).
- */
-export declare function selectPrunable(dirs: readonly DatedDir[], retention: number): string[];
-/**
- * Bound the journal on disk: keep the `retention` most-recent session directories under
- * `.reticle/sessions/`, remove the rest by mtime. Never throws — retention is best-effort maintenance,
- * so a stat/rm failure on one dir (or a missing sessions/ dir) is swallowed, never crashing a session.
- * Mirrors RunStore's amortized pruning; run on daemon start.
- */
-export declare function pruneSessions(fs: FileSystemPort, root: string, retention?: number): Promise<void>;
-export {};

package/dist/journal/retention.js

@@ -1,49 +0,0 @@
-import { reticleDirPaths, sessionDirPath } from '../project/reticle-dir.js';
-/** Keep at most this many session journals on disk; older ones are pruned by recency. */
-export const DEFAULT_SESSION_RETENTION = 20;
-/**
- * Pure: given session dirs with their mtimes, the names to remove so only the `retention` most-recent
- * remain. Oldest-first. Exported for testing (no IO).
- */
-export function selectPrunable(dirs, retention) {
-    if (dirs.length <= retention)
-        return [];
-    return [...dirs]
-        .sort((a, b) => a.mtimeMs - b.mtimeMs)
-        .slice(0, dirs.length - retention)
-        .map((d) => d.name);
-}
-/**
- * Bound the journal on disk: keep the `retention` most-recent session directories under
- * `.reticle/sessions/`, remove the rest by mtime. Never throws — retention is best-effort maintenance,
- * so a stat/rm failure on one dir (or a missing sessions/ dir) is swallowed, never crashing a session.
- * Mirrors RunStore's amortized pruning; run on daemon start.
- */
-export async function pruneSessions(fs, root, retention = DEFAULT_SESSION_RETENTION) {
-    const sessionsDir = reticleDirPaths(root).sessions;
-    let names;
-    try {
-        names = await fs.readdir(sessionsDir);
-    }
-    catch {
-        return; // no sessions dir yet
-    }
-    const dated = [];
-    for (const name of names) {
-        try {
-            const { mtimeMs } = await fs.stat(sessionDirPath(root, name));
-            dated.push({ name, mtimeMs });
-        }
-        catch {
-            /* unstattable entry — skip */
-        }
-    }
-    for (const name of selectPrunable(dated, retention)) {
-        try {
-            await fs.rm(sessionDirPath(root, name));
-        }
-        catch {
-            /* best-effort */
-        }
-    }
-}

package/dist/journal/session-end.d.ts

@@ -1,32 +0,0 @@
-import type { AmbientCounts } from './ambient.js';
-import type { FileSystemPort } from '../project/fs-port.js';
-/**
- * Session teardown: the durable half of ending a session. Two things must happen when a tab disconnects,
- * and neither did before — the journal batches events and only writes at its flush threshold, so the tail
- * of every session (< one batch) was silently lost from disk, and the learned ambient map was never
- * persisted at all, so every session re-learned the page's churn from zero.
- *
- * Both are best-effort: a teardown failure must never surface as a session error (the tab is already gone).
- */
-/** The minimal Session surface teardown needs (Session satisfies it structurally). */
-export interface SessionEndTarget {
-    readonly id: string;
-    /** Write any batched journal events to disk. */
-    flushJournal(): Promise<void>;
-    /** The ambient-churn counts learned during this session. */
-    ambientCounts(): AmbientCounts;
-    ownAmbientCounts(): AmbientCounts;
-}
-interface SessionEndDeps {
-    fs: FileSystemPort;
-    reticleRoot: string;
-    /** Journaling/persistence off (opt-out) → teardown is a no-op. */
-    enabled: boolean;
-}
-/**
- * Build the teardown handler the bridge fires when a session is removed. Flushes the journal first (so no
- * evidence is lost), then folds this session's ambient counts into the persisted map so the NEXT session
- * starts already knowing which regions churn.
- */
-export declare function makeSessionEnd(deps: SessionEndDeps): (session: SessionEndTarget) => Promise<void>;
-export {};

package/dist/journal/session-end.js

@@ -1,51 +0,0 @@
-import { AmbientStore } from './ambient-store.js';
-import { pruneSessions } from './retention.js';
-/**
- * Build the teardown handler the bridge fires when a session is removed. Flushes the journal first (so no
- * evidence is lost), then folds this session's ambient counts into the persisted map so the NEXT session
- * starts already knowing which regions churn.
- */
-export function makeSessionEnd(deps) {
-    return async (session) => {
-        if (!deps.enabled)
-            return;
-        try {
-            await session.flushJournal();
-        }
-        catch {
-            // a failed flush must not block ambient persistence, and must never throw at teardown
-        }
-        try {
-            const store = new AmbientStore(deps.fs, deps.reticleRoot);
-            const persisted = await store.load();
-            // Accumulate history + what is NEW. `ownAmbientCounts` excludes the map this session was
-            // seeded from at startup; `ambientCounts` includes it, and adding that onto `persisted` wrote
-            // `2 x persisted + own` on every teardown — a doubling per session that had driven the
-            // committed map to ~9.1e23.
-            const merged = { ...persisted };
-            for (const [ref, count] of Object.entries(session.ownAmbientCounts())) {
-                merged[ref] = (merged[ref] ?? 0) + count;
-            }
-            await store.save(merged);
-        }
-        catch {
-            // ambient learning is an optimization; a disk failure never breaks teardown
-        }
-        try {
-            // Bound the journal on disk HERE, not only at daemon start.
-            //
-            // Pruning ran exactly once, during wiring. A daemon that stays up — which is the normal case for
-            // a dev session, and the whole point of the pool — therefore never pruned again, so session
-            // directories accumulated without bound for as long as it lived. Session end is the right moment
-            // because it is precisely when a new directory has just been created, which makes this amortized
-            // rather than periodic (no timer to leak) and mirrors what RunStore already does.
-            //
-            // Safe against deleting the session that just ended: pruning selects the OLDEST by mtime, and the
-            // directory written moments ago is the newest.
-            await pruneSessions(deps.fs, deps.reticleRoot);
-        }
-        catch {
-            // retention is best-effort maintenance; never surface at teardown
-        }
-    };
-}

package/dist/journal/session-journal.d.ts

@@ -1,24 +0,0 @@
-import { type JournalAction, type ReticleEvent } from '@reticlehq/core';
-import type { FileSystemPort } from '../project/fs-port.js';
-/**
- * The durable per-session journal: append-only JSONL for events and actions, the ledger the ring
- * buffer becomes a hot cache over. Writes are batched (the caller flushes ring-buffer windows), so a
- * batch is one syscall — not one per event. Reads never throw: a missing file is `[]`, a malformed or
- * schema-invalid line is skipped, matching the never-throw discipline of the run store.
- *
- * Events are already browser-edge-redacted (network/storage/DOM) before they reach the wire, so the
- * journal stores redacted payloads; the ledger is local-only. A server-side second-pass event redactor
- * is defense-in-depth for a later commit, not a correctness gate here.
- *
- * ponytail: append-per-batch, no retention yet. Bounded-disk pruning (cap session dirs / file size,
- * "pruned like runs/") is a dedicated follow-up — see the build ledger. Perf ceiling: if the <3%
- * main-thread overhead budget is threatened at high event rates, coalesce batches behind a flush timer.
- */
-export declare class SessionJournal {
-    #private;
-    constructor(fs: FileSystemPort, root: string, sessionId: string);
-    appendEvents(events: readonly ReticleEvent[]): Promise<void>;
-    appendAction(action: JournalAction): Promise<void>;
-    readEvents(): Promise<ReticleEvent[]>;
-    readActions(): Promise<JournalAction[]>;
-}

package/dist/journal/session-journal.js

@@ -1,167 +0,0 @@
-import { JournalActionSchema, ReticleEventSchema, } from '@reticlehq/core';
-import { isValidSessionId, journalActionsPath, journalEventsPath, sessionDirPath, } from '../project/reticle-dir.js';
-/**
- * The durable per-session journal: append-only JSONL for events and actions, the ledger the ring
- * buffer becomes a hot cache over. Writes are batched (the caller flushes ring-buffer windows), so a
- * batch is one syscall — not one per event. Reads never throw: a missing file is `[]`, a malformed or
- * schema-invalid line is skipped, matching the never-throw discipline of the run store.
- *
- * Events are already browser-edge-redacted (network/storage/DOM) before they reach the wire, so the
- * journal stores redacted payloads; the ledger is local-only. A server-side second-pass event redactor
- * is defense-in-depth for a later commit, not a correctness gate here.
- *
- * ponytail: append-per-batch, no retention yet. Bounded-disk pruning (cap session dirs / file size,
- * "pruned like runs/") is a dedicated follow-up — see the build ledger. Perf ceiling: if the <3%
- * main-thread overhead budget is threatened at high event rates, coalesce batches behind a flush timer.
- */
-export class SessionJournal {
-    #fs;
-    #root;
-    #sessionId;
-    #dirEnsured = false;
-    // Parse-cache for the append-only EVENTS journal. queryEvents falls through to readEvents on every
-    // observe/network/console call once the ring buffer has evicted (permanent ~60s into any session), so
-    // a naive readEvents re-read + re-JSON.parse + re-zod-validated the WHOLE file each time — measured at
-    // a 1-hour 100 ev/s session as ~1.5s CPU + ~300MB transient heap PER tool call, growing with age. The
-    // journal only ever grows and is always a run of complete '\n'-terminated lines, so we keep the parsed
-    // events and the char count already consumed, and parse only the tail written since the last read.
-    #eventCache;
-    #eventCharsConsumed = 0; // fallback (whole-file) path: UTF-16 code units consumed
-    #eventBytesConsumed = 0; // fast (bounded-read) path: UTF-8 bytes consumed, always at a '\n' boundary
-    constructor(fs, root, sessionId) {
-        if (!isValidSessionId(sessionId)) {
-            throw new Error(`refusing to journal an unsafe session id: ${sessionId}`);
-        }
-        this.#fs = fs;
-        this.#root = root;
-        this.#sessionId = sessionId;
-    }
-    async appendEvents(events) {
-        if (0 === events.length)
-            return;
-        await this.#ensureDir();
-        const text = `${events.map((e) => JSON.stringify(e)).join('\n')}\n`;
-        await this.#fs.appendFile(journalEventsPath(this.#root, this.#sessionId), text);
-    }
-    async appendAction(action) {
-        await this.#ensureDir();
-        await this.#fs.appendFile(journalActionsPath(this.#root, this.#sessionId), `${JSON.stringify(action)}\n`);
-    }
-    async readEvents() {
-        const path = journalEventsPath(this.#root, this.#sessionId);
-        if (this.#eventCache === undefined)
-            this.#eventCache = [];
-        // Fast path: read only the BYTES appended since the last read, so cost tracks the tail, not the
-        // whole (unboundedly growing) file. Falls back to a whole-file read for a FileSystemPort that omits
-        // readFileFrom (test stubs).
-        const readFrom = this.#fs.readFileFrom?.bind(this.#fs);
-        if (readFrom !== undefined) {
-            let chunk;
-            try {
-                chunk = await readFrom(path, this.#eventBytesConsumed);
-            }
-            catch (error) {
-                if (this.#fs.isNotFound(error))
-                    return this.#eventCache.slice();
-                throw error;
-            }
-            // Shrink/rotation guard (not done today): if the file is smaller than what we consumed, the offset
-            // is meaningless — reset and re-read from 0.
-            if (chunk.size < this.#eventBytesConsumed) {
-                this.#eventCache = [];
-                this.#eventBytesConsumed = 0;
-                chunk = await readFrom(path, 0);
-            }
-            this.#eventBytesConsumed += this.#ingestTail(chunk.text);
-            return this.#eventCache.slice();
-        }
-        let text;
-        try {
-            text = await this.#fs.readFile(path);
-        }
-        catch (error) {
-            if (this.#fs.isNotFound(error))
-                return this.#eventCache.slice();
-            throw error;
-        }
-        // Fallback (whole-file) path: #eventCharsConsumed is a UTF-16 offset into the whole text. Shrink
-        // guard, then ingest the un-consumed tail up to its last newline (see #ingestTail for the
-        // partial-line rationale).
-        if (text.length < this.#eventCharsConsumed) {
-            this.#eventCache = [];
-            this.#eventCharsConsumed = 0;
-        }
-        const end = text.lastIndexOf('\n') + 1;
-        if (end > this.#eventCharsConsumed) {
-            this.#ingestTail(text.slice(this.#eventCharsConsumed, end));
-            this.#eventCharsConsumed = end;
-        }
-        return this.#eventCache.slice();
-    }
-    /**
-     * Parse complete ('\n'-terminated) JSON event lines from `tail` into #eventCache, stopping at the LAST
-     * newline. A concurrent append can be observed mid-record (reads and writes run on separate libuv
-     * threads), and consuming a partial trailing line would splice its tail onto the next read's head, fail
-     * to parse, and drop that event forever — so the partial tail is left for the next read. Returns the
-     * UTF-8 BYTES consumed, which the bounded-read path uses to advance its byte offset.
-     */
-    #ingestTail(tail) {
-        const cache = this.#eventCache ?? (this.#eventCache = []);
-        const end = tail.lastIndexOf('\n') + 1;
-        if (0 === end)
-            return 0; // no complete line yet
-        const complete = tail.slice(0, end);
-        for (const line of complete.split('\n')) {
-            if (0 === line.length)
-                continue;
-            let parsed;
-            try {
-                parsed = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            const result = ReticleEventSchema.safeParse(parsed);
-            if (result.success)
-                cache.push(result.data);
-        }
-        return Buffer.byteLength(complete, 'utf8');
-    }
-    async readActions() {
-        return this.#readLines(journalActionsPath(this.#root, this.#sessionId), JournalActionSchema);
-    }
-    async #ensureDir() {
-        if (this.#dirEnsured)
-            return;
-        await this.#fs.mkdir(sessionDirPath(this.#root, this.#sessionId));
-        this.#dirEnsured = true;
-    }
-    async #readLines(path, schema) {
-        let text;
-        try {
-            text = await this.#fs.readFile(path);
-        }
-        catch (error) {
-            if (this.#fs.isNotFound(error))
-                return [];
-            throw error;
-        }
-        const out = [];
-        for (const line of text.split('\n')) {
-            if (0 === line.length)
-                continue;
-            let parsed;
-            try {
-                parsed = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            const result = schema.safeParse(parsed);
-            // Validated at this boundary; ZodTypeAny widens `.data` to any, so re-narrow to the schema output.
-            if (result.success)
-                out.push(result.data);
-        }
-        return out;
-    }
-}

package/dist/journal/workspace-gitignore.d.ts

@@ -1,10 +0,0 @@
-import type { FileSystemPort } from '../project/fs-port.js';
-/**
- * Write `.reticle/.gitignore` if it is not already there.
- *
- * Never overwrites — once the file exists it belongs to whoever edited it last, and silently
- * reverting somebody's change to a file we placed in their repository is worse than not having
- * written it. Best-effort throughout: this runs on the daemon's start path, and a workspace that
- * cannot be written must not stop a daemon coming up. Nothing about verification depends on it.
- */
-export declare function ensureWorkspaceGitignore(fs: FileSystemPort, root: string): Promise<void>;

package/dist/journal/workspace-gitignore.js

@@ -1,59 +0,0 @@
-import { join } from 'node:path';
-import { ReticleDir } from '@reticlehq/core';
-/**
- * The `.reticle/` entries that are LOCAL state, and must never be committed by accident.
- *
- * Split from the durable half deliberately, and the split is the whole design: `contract.json`,
- * `flows/`, `baselines/` and `capsules/` are meant to be checked in — a flow that cannot be shared
- * is not a regression check anybody else can run — while everything below is per-machine churn.
- *
- * The reason this matters beyond tidiness: a session journal carries URLs, request and response
- * bodies, and DOM text from the app under test. `.reticle/` is created by the daemon rather than by
- * the user, so it arrives untracked and unexplained, and one `git add -A` puts an app's traffic into
- * a shared repository. Reticle created the directory; the ignore for it is Reticle's to write.
- */
-const TRANSIENT = [
-    `${ReticleDir.SESSIONS_SUBDIR}/`,
-    `${ReticleDir.RUNS_SUBDIR}/`,
-    `${ReticleDir.VISUAL_SUBDIR}/`,
-    ReticleDir.PROJECT_FILE,
-    ReticleDir.AMBIENT_FILE,
-    ReticleDir.ENVELOPES_FILE,
-    ReticleDir.FLAKE_FILE,
-    ReticleDir.TIERS_FILE,
-    '*.log',
-    '*.tmp',
-];
-const HEADER = [
-    '# Written by Reticle, and only about the directory Reticle owns.',
-    '#',
-    '# The entries below are per-machine state — session journals, run artifacts, learned envelopes.',
-    '# Journals contain URLs, request and response bodies and page text from the app under test, so',
-    '# they are worth keeping out of a shared repository on their own account.',
-    '#',
-    `# Deliberately NOT ignored: ${ReticleDir.CONTRACT_FILE}, ${ReticleDir.FLOWS_SUBDIR}/, ${ReticleDir.BASELINES_SUBDIR}/ and`,
-    `# ${ReticleDir.CAPSULES_SUBDIR}/. Those are meant to be committed — a saved flow only earns its keep`,
-    '# when a teammate or CI can replay it.',
-    '#',
-    '# Edit freely: Reticle writes this once and never rewrites it.',
-];
-/**
- * Write `.reticle/.gitignore` if it is not already there.
- *
- * Never overwrites — once the file exists it belongs to whoever edited it last, and silently
- * reverting somebody's change to a file we placed in their repository is worse than not having
- * written it. Best-effort throughout: this runs on the daemon's start path, and a workspace that
- * cannot be written must not stop a daemon coming up. Nothing about verification depends on it.
- */
-export async function ensureWorkspaceGitignore(fs, root) {
-    const path = join(root, '.gitignore');
-    try {
-        if (await fs.exists(path))
-            return;
-        await fs.mkdir(root);
-        await fs.writeFile(path, `${[...HEADER, '', ...TRANSIENT].join('\n')}\n`);
-    }
-    catch {
-        /* a workspace we cannot write is not a reason to fail a session */
-    }
-}

package/dist/license/license-env.d.ts

@@ -1,29 +0,0 @@
-/**
- * Find an enterprise licence key the customer actually placed, wherever they reasonably placed it.
- *
- * The daemon folded in `<cwd>/.env` and nothing else. It is spawned without an explicit `cwd`, so it
- * inherits whatever directory the editor launched the MCP server from — in a monorepo that is the
- * workspace root while the key sits in the app's own `.env`, and under some editors it is the user's
- * home. The key was never read, `describeLicense` reported `missing`, and every event that customer
- * produced said they had no licence, which is indistinguishable from a customer who has none.
- *
- * That is the worst shape a licensing bug can take. A key that fails LOUDLY gets reported by the
- * customer within the hour. A key that silently fails to register leaves them believing they are
- * licensed and us believing they are not, and neither side finds out.
- *
- * Two directions, because the field hits both: DOWN one level into app directories (the daemon
- * starts at the workspace root) and UP to the project root (the editor starts inside the app).
- *
- * ONLY the licence key is ever taken out of a file found this way, and that restriction is the point
- * rather than an optimisation. Bulk-importing a `.env` discovered by walking would let a directory
- * the caller never named rebind the daemon's port, its telemetry gate or its allowed origins — a far
- * worse bug than the one this fixes. `loadDotEnv` still owns the local file, where importing
- * everything is what the caller asked for.
- */
-/**
- * The key, or undefined. Never throws, never mutates anything the caller did not ask it to.
- *
- * A key already present in `env` always wins: that is the operator stating it explicitly, and a file
- * silently overriding it is the surprise `loadDotEnv` already refuses to cause.
- */
-export declare function licenseKeyFromEnvFiles(startDir: string, env?: NodeJS.ProcessEnv): string | undefined;