@reticlehq/vite-plugin 2.14.0 → 3.2.0

package/dist/index.cjs

@@ -47,13 +47,13 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 var import_node_fs6 = require("node:fs");
 
-// src/missing-token.ts
+// src/token/missing-token.ts
 function missingTokenWarning(token) {
   if (token !== void 0 && token.length > 0) return void 0;
   return "[reticle] no pairing token was available when this dev server started, so the app will connect and be refused \u2014 you will see NO SESSION even though the SDK loads and the socket opens. The token is written by the Reticle daemon: start it (`reticle serve`, or let your agent start it) and then RESTART this dev server, because the value is inlined at config time.";
 }
 
-// src/ensure-token.ts
+// src/token/ensure-token.ts
 var import_node_fs = require("node:fs");
 var import_node_crypto = require("node:crypto");
 var import_node_path = require("node:path");
@@ -83,313 +83,7 @@ var import_node_path8 = require("node:path");
 var import_core6 = require("@babel/core");
 var import_babel_plugin = __toESM(require("@reticlehq/babel-plugin"), 1);
 
-// ../core/dist/constants.js
-var RETICLE_DEFAULT_PORT = 4400;
-var RETICLE_WS_PATH = "/reticle";
-var RETICLE_CLIENT_HOST = "localhost";
-function bridgeWsUrl(port = RETICLE_DEFAULT_PORT, host = RETICLE_CLIENT_HOST) {
-  return `ws://${host}:${String(port)}${RETICLE_WS_PATH}`;
-}
-var ReticleEnv = {
-  /** Shared-secret the browser SDK must present in HELLO; absent ⇒ loopback-trust only. */
-  TOKEN: "RETICLE_TOKEN",
-  /** Bridge bind host. Defaults to loopback; setting anything else is opt-in remote exposure. */
-  HOST: "RETICLE_HOST",
-  /** Comma-separated WS Origin allow-list for the bridge. */
-  ALLOWED_ORIGINS: "RETICLE_ALLOWED_ORIGINS",
-  /** Bridge/daemon WS port override. */
-  PORT: "RETICLE_PORT",
-  /** Daemon state — pidfiles, discovery registry, logs. Defaults to `~/.reticle`. Overridable
-   * because a read-only $HOME (sandboxed agent, locked-down Windows profile, container) otherwise
-   * makes the daemon unstartable with a raw EACCES naming nothing. Reported by a Windows user. */
-  STATE_DIR: "RETICLE_STATE_DIR",
-  /** Attach to an already-running browser over CDP instead of launching one. */
-  CDP_URL: "RETICLE_CDP_URL",
-  /** Max simultaneous leased headless contexts in the browser pool (resource cap). */
-  MAX_CONTEXTS: "RETICLE_MAX_CONTEXTS",
-  /**
-   * Inbound events per second before the bridge starts SAMPLING (never disconnecting).
-   *
-   * Raise it for a legitimately busy app — a streaming dashboard, a live grid — rather than accept
-   * partial coverage. Free and local: the daemon runs on the same machine, so a higher ceiling costs
-   * nothing to anyone.
-   */
-  MAX_MESSAGES_PER_SECOND: "RETICLE_MAX_MESSAGES_PER_SECOND",
-  /** Bearer token required by the optional `reticle serve --http` verify endpoint. */
-  VERIFY_TOKEN: "RETICLE_VERIFY_TOKEN",
-  /** Ms of continuous idleness (no agent, no browser session, no lease) before the daemon self-exits;
-   * `0` disables. Keeps Reticle from lingering on a user's machine after the editor closes. */
-  IDLE_SHUTDOWN: "RETICLE_IDLE_SHUTDOWN_MS",
-  /** Idle re-check cadence (default 30s). Overridable so daemon-lifecycle-test can watch a full
-   * exit/wake cycle in seconds rather than minutes. */
-  IDLE_CHECK: "RETICLE_IDLE_CHECK_MS",
-  /**
-   * Grace for a daemon with an agent ATTACHED. Longer than the base on purpose: quiet with a client
-   * present means a slow install or a thinking human, not an unwanted daemon — a flat 5 minutes was
-   * killing live runs mid-install. Derived from the base when unset.
-   */
-  IDLE_ATTACHED: "RETICLE_IDLE_ATTACHED_MS",
-  /**
-   * How often the daemon writes `reticle_daemon_alive`, so a GAP in its log is evidence it died.
-   *
-   * Overridable for the same reason the idle windows are: a spec that has to prove "a killed daemon
-   * is distinguishable from a tidy one" cannot wait 30 seconds per beat, and a spec that instead
-   * re-implements the cadence is insensitive to the thing it claims to guard.
-   */
-  HEARTBEAT: "RETICLE_HEARTBEAT_MS",
-  /** Directory holding the auto-provisioned pairing token. Defaults to ~/.reticle; relocatable for CI. */
-  PAIRING_TOKEN_DIR: "RETICLE_PAIRING_TOKEN_DIR",
-  /** Force the durable causal journal off (`0`/`false`/`off`) or on (`1`/`true`/`on`); default on. */
-  JOURNAL: "RETICLE_JOURNAL",
-  /**
-   * Verbose internal flow tracing for people working ON Reticle (`1`/`true`/`on`); default off.
-   *
-   * Distinct from the journal, which records what the AGENT did to the app. This records what
-   * RETICLE did to answer it: one line per internal stage, with its duration and nesting, so a
-   * developer can see which code a tool call actually went through and where the time went.
-   * Off by default and free when off — a trace on every tool call is a cost on the hot path.
-   */
-  TRACE: "RETICLE_TRACE",
-  /**
-   * How many consecutive reconnects the MCP proxy attempts before it stops retrying and goes
-   * dormant. Overridable for the same reason the idle windows are: the real budget takes MINUTES to
-   * exhaust, so the one spec that proves the proxy SURVIVES exhaustion could not run at all without
-   * shortening it. A budget nobody can reach in a test is a budget nobody tests.
-   */
-  RECONNECT_ATTEMPTS: "RETICLE_RECONNECT_ATTEMPTS",
-  /** Quiet window before an abandoned MCP stdio proxy exits; `0` disables the watcher. */
-  MCP_PROXY_IDLE: "RETICLE_MCP_PROXY_IDLE_MS"
-};
-var TRANSPORT_LIMITS = {
-  MAX_MESSAGE_BYTES: 1024 * 1024,
-  /**
-   * Inbound events per second before the bridge SAMPLES rather than records everything.
-   *
-   * This was 1000, and an ordinary React app with an active query cache blew through it: the
-   * reporter's FIRST `act_and_wait` of the session came back `unknown` with `unclean_capture` and a
-   * four-figure drop count, and setting the env override to twenty times the default fixed it (#316).
-   * Reticle was right to refuse the verdict — a sampled window cannot support one, and the guard that
-   * catches false greens is blindest exactly there — but landing that on the first drive after an
-   * install, recoverable only by knowing an environment variable exists and inventing a number for
-   * it, is the worst possible place to spend the honesty.
-   *
-   * 20000 is the value that was measured to work on the page that reported it. The cap exists to stop
-   * a PATHOLOGICAL page (an animation loop firing DOM mutations every frame), not to throttle a busy
-   * one, and the ceiling it has to defend is cheap: the daemon is on the same machine and a typical
-   * event is a few hundred bytes, so this is single-digit MB/s over loopback.
-   *
-   * Raising it does not raise what a runaway page can make the bridge HOLD, and that separation is
-   * what makes the change safe. Memory is bounded independently by the ring buffer, which evicts on
-   * `RING_BUFFER_DEFAULTS.MAX_BYTES` (this same constant, reached through that alias) as well as on
-   * a count and an age. Grep for `MAX_BUFFER_BYTES` alone and it looks like a constant nobody reads,
-   * which is exactly the wrong conclusion to draw before touching this number: the rate cap defends
-   * parse cost, the ring buffer defends memory, and they are not substitutes.
-   */
-  MAX_MESSAGES_PER_SECOND: 2e4,
-  MAX_SESSIONS: 32,
-  MAX_PENDING_CONNECTIONS: 16,
-  HELLO_TIMEOUT_MS: 5e3,
-  MAX_BUFFER_BYTES: 8 * 1024 * 1024,
-  MAX_SESSION_ID_LENGTH: 128,
-  MAX_URL_LENGTH: 4096,
-  MAX_TITLE_LENGTH: 512,
-  MAX_ADAPTERS: 32,
-  MAX_ADAPTER_NAME_LENGTH: 128,
-  MAX_TOKEN_LENGTH: 512,
-  MAX_COMMAND_ID_LENGTH: 128,
-  MAX_COMMAND_NAME_LENGTH: 128,
-  MAX_REF_LENGTH: 128,
-  MAX_ERROR_LENGTH: 4096,
-  /** Cap on a captured stack trace before it crosses the wire — the console observer and both React
-   *  error hooks (error-boundary, hydration-error) all truncate to this, so it is one fact. */
-  MAX_STACK_LENGTH: 4e3,
-  MAX_SERIALIZE_DEPTH: 8,
-  MAX_COLLECTION_ITEMS: 200,
-  MAX_OBJECT_KEYS: 200,
-  MAX_STRING_LENGTH: 64 * 1024,
-  /** Human review marks: the note the human types when flagging a mistake on the page. */
-  MAX_MARK_NOTE_LENGTH: 2e3,
-  /** Human review marks: the legible element label that pins the mark (e.g. "Submit button"). */
-  MAX_MARK_LABEL_LENGTH: 256
-};
-var ReticleDir = {
-  ROOT: ".reticle",
-  CONTRACT_FILE: "contract.json",
-  FLOWS_SUBDIR: "flows",
-  BASELINES_SUBDIR: "baselines",
-  /** cross-run memory — outcomes of past runs (the "did it behave like last time?" file). */
-  PROJECT_FILE: "project.json",
-  /**
-   * the user's own record of what Reticle has done for them — .reticle/impact.json.
-   *
-   * Local only, never uploaded, and deliberately NOT part of telemetry: telemetry answers our
-   * questions about the product; this answers the user's question about their own work.
-   */
-  IMPACT_FILE: "impact.json",
-  /** what changes were SUPPOSED to make true —.reticle/intent.json (git-checked, reviewed) */
-  INTENT_FILE: "intent.json",
-  /** opt-in pixel baselines —.reticle/visual/<name>.png + <name>.diff.png. */
-  VISUAL_SUBDIR: "visual",
-  /** verification-run artifacts —.reticle/runs/<runId>.json (the OEM/CI-consumable verdict). */
-  RUNS_SUBDIR: "runs",
-  /** fail-to-pass bug capsules —.reticle/capsules/<id>.json (a minimal failing flow + its evidence). */
-  CAPSULES_SUBDIR: "capsules",
-  /** durable causal journal —.reticle/sessions/<id>/{events,actions}.jsonl (the substrate). */
-  SESSIONS_SUBDIR: "sessions",
-  /** append-only event ledger inside a session dir (one ReticleEvent per line). */
-  JOURNAL_EVENTS_FILE: "events.jsonl",
-  /** append-only action ledger inside a session dir (one JournalAction per line). */
-  JOURNAL_ACTIONS_FILE: "actions.jsonl",
-  /** learned expected-envelopes per route, accumulated across runs (the deviation-report baseline). */
-  ENVELOPES_FILE: "envelopes.json",
-  /** learned ambient (action-less churn) region map — excluded from settle/summaries/envelopes. */
-  AMBIENT_FILE: "ambient.json",
-  /** per-flow flake ledger — replay outcomes that decide intermittent-failure quarantine. */
-  FLAKE_FILE: "flake.json",
-  /**
-   * the project's cloud binding — .reticle/cloud.json, written by `reticle link`. Git-checked and
-   * non-secret: the project id, the API origin, and where its dashboard lives. The KEY lives in
-   * ~/.reticle/credentials.json instead, because that one must never reach a repository.
-   */
-  CLOUD_LINK_FILE: "cloud.json",
-  /**
-   * local sync bookkeeping — .reticle/cloud-state.json. The pull cursor, when each half last ran,
-   * and the last error. NOT git-checked: it describes this machine's conversation with the server,
-   * and committing one machine's cursor would make every other machine skip what it had not seen.
-   */
-  CLOUD_STATE_FILE: "cloud-state.json",
-  /**
-   * triage decisions pulled BACK from the dashboard — .reticle/issues.json. What a human said about
-   * a defect ("resolved", "not a bug"), so the HUD stops showing it and the next run does not
-   * re-report it as though nobody had looked.
-   */
-  ISSUES_FILE: "issues.json",
-  /** Per-flow assertion tiers recorded on each PASSING replay — the gate's anti-downgrade baseline. */
-  TIERS_FILE: "assertion-tiers.json",
-  /**
-   * Auto-provisioned bridge pairing token, stored at ~/.reticle/pairing-token (mode 0600). Written by
-   * the daemon, read Node-side by the build plugins to inject into connect. A browser sandbox cannot
-   * read it, so a rogue localhost app can't present it — that's what stops cross-app session hijack.
-   */
-  PAIRING_TOKEN_FILE: "pairing-token"
-};
-var UpdateCheckIntervalMs = 24 * 60 * 60 * 1e3;
-var RING_BUFFER_DEFAULTS = {
-  MAX_EVENTS: 2e3,
-  MAX_AGE_MS: 6e4,
-  MAX_BYTES: TRANSPORT_LIMITS.MAX_BUFFER_BYTES
-};
-var EventType = {
-  DOM_ADDED: "dom.added",
-  DOM_REMOVED: "dom.removed",
-  DOM_ATTR: "dom.attr",
-  DOM_TEXT: "dom.text",
-  NET_REQUEST: "net.request",
-  NET_PENDING: "net.pending",
-  /** An SSE (EventSource) or WebSocket frame — a message on a long-lived streaming connection. */
-  NET_STREAM: "net.stream",
-  /** A web-perf metric a screenshot can't verify: LCP, cumulative layout shift, or a long task. */
-  PERF: "perf",
-  ROUTE_CHANGE: "route.change",
-  CONSOLE_LOG: "console.log",
-  CONSOLE_WARN: "console.warn",
-  CONSOLE_ERROR: "console.error",
-  CONSOLE_INFO: "console.info",
-  CONSOLE_DEBUG: "console.debug",
-  ERROR_UNCAUGHT: "error.uncaught",
-  VISIBLE_SHOWN: "visible.shown",
-  ANIM_START: "anim.start",
-  ANIM_END: "anim.end",
-  SCROLL_POSITION: "scroll.position",
-  REVEAL_SHOWN: "reveal.shown",
-  SIGNAL: "signal",
-  STATE_CHANGE: "state.change",
-  /** a write to localStorage/sessionStorage/cookies — `data: { area, key, old?, new? }` (values redacted). */
-  STORAGE_CHANGE: "storage.change",
-  /** page-level visibility/focus health (distinct from element-level VISIBLE_*). */
-  PAGE_HEALTH: "page.health",
-  /**
-   * synthetic: the page called window.open, so the consequence of what was just clicked may live in
-   * another browsing context this one cannot observe (an OAuth popup is the archetype).
-   * `data: { href }` — the URL the page asked to open, when it named one.
-   */
-  CONTEXT_OPENED: "context.opened",
-  /**
-   * The app opened a native `alert`/`confirm`/`prompt` while Reticle was driving it.
-   *
-   * Recorded because Reticle ANSWERS these rather than letting them block — a native dialog halts
-   * the main thread, and the SDK's own message pump is on that thread, so one `confirm` behind a
-   * driven click made the tab permanently unresponsive with no recovery from inside the session.
-   * Answering silently would trade a wedge for an invisible one, so the question the app asked, and
-   * the answer given, ride out as an event.
-   */
-  DIALOG_OPENED: "dialog.opened",
-  /** aggregated React commits over a throttle window (dev builds) — `data: { commits }`. Commit storms /
-   * wasted re-renders show up here without a per-render flood. */
-  RENDER_COMMIT: "render.commit",
-  /** element focus moved — `data: { to, from, toBody }`. Focus dropping to body after an act is a regression. */
-  FOCUS_CHANGE: "focus.change",
-  /** browser → bridge: a human recording compiled in-page. */
-  FLOW_RECORDED: "flow.recorded",
-  /** synthetic: browser transport queue overflowed; events were dropped. `data: { dropped: number }`. */
-  TRANSPORT_OVERFLOW: "transport.overflow",
-  /**
-   * synthetic: a per-channel cap truncated a batch (e.g. a DOM mutation flood). `data: { channel, dropped }`.
-   * Marks downstream rollups/envelopes as built on incomplete data — a ledger that lies at scale is worse
-   * than no ledger, so truncation is never silent.
-   */
-  TRUNCATED: "truncated",
-  /**
-   * synthetic: the SDK detected a region it CANNOT observe (a cross-origin iframe, a closed shadow root).
-   * `data: { kind: BlindSpotKind, count }`. Surfaced on results as `coverage: partial` so a green never
-   * implies it saw everything.
-   */
-  BLIND_SPOT: "blind-spot",
-  /** synthetic: the SDK ITSELF failed (an observer threw). `data: { site, message, errorType }`.
-   *  Rides the existing bridge — no outbound request. See browser/observers/sdk-failure.ts. */
-  SDK_FAILED: "sdk.failed",
-  /**
-   * synthetic (driven only): CDP/Playwright-authoritative network detail for a response the in-page
-   * fetch/XHR wrapper also saw — full response headers + authoritative status/mimeType the page-side
-   * wrapper can't reach. `data: { url, method?, status, headers, resourceType? }`. Merged onto the
-   * matching in-page NET_REQUEST so the driven view never loses fidelity to an outside-in tool.
-   */
-  NET_DETAIL: "net.detail",
-  /**
-   * Live-control: browser → bridge. A human acted on the presenter panel.
-   * `data: { kind: HumanControlKind; text?: string }`. Rides the existing EventMessage.
-   */
-  HUMAN_CONTROL: "human.control",
-  /**
-   * Human review: browser → bridge. A human pinned a mistake to an element on the running page
-   * (the "annotate the bug where you see it" loop). `data` narrows to HumanMarkDataSchema — a note
-   * plus a re-resolvable element anchor (and its source file:line when the framework stamped one) so
-   * the agent that drains the mark knows exactly which element and which source to fix.
-   */
-  HUMAN_MARK: "human.mark",
-  /**
-   * The app produced a FILE — a Blob handed to `URL.createObjectURL`, usually saved by clicking an
-   * anchor with `download`. `data: { filename?, mimeType, bytes, lines?, preview? }`. The one artifact
-   * class no outside-the-browser tool can inspect: it never crosses the network, so there is no
-   * request to intercept. See `observers/download.ts` for the defect that motivated it.
-   */
-  DOWNLOAD: "download"
-};
-var RETICLE_RENDER_PREHOOK = "__reticleRenderPreHook";
-var CONSOLE_LEVEL_PREFIX = "console.";
-var CONSOLE_LEVELS = [
-  EventType.CONSOLE_LOG,
-  EventType.CONSOLE_WARN,
-  EventType.CONSOLE_ERROR,
-  EventType.CONSOLE_INFO
-].map((type) => type.slice(CONSOLE_LEVEL_PREFIX.length));
-
-// ../core/dist/source-constants.js
-var DATA_RETICLE_SOURCE_ATTR = "data-reticle-source";
-var RETICLE_ROOT_GLOBAL = "__RETICLE_ROOT__";
-var RETICLE_SDK_VERSION_GLOBAL = "__RETICLE_SDK_VERSION__";
-
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
+// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
 __export(external_exports, {
   BRAND: () => BRAND,
@@ -501,7 +195,7 @@ __export(external_exports, {
   void: () => voidType
 });
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {
@@ -635,7 +329,7 @@ var getParsedType = (data) => {
   }
 };
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -753,7 +447,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -856,7 +550,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
+// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -865,7 +559,7 @@ function getErrorMap() {
   return overrideErrorMap;
 }
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -975,14 +669,14 @@ var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
+// ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -4287,150 +3981,550 @@ var ZodPipeline = class _ZodPipeline extends ZodType {
     });
   }
 };
-var ZodReadonly = class extends ZodType {
-  _parse(input) {
-    const result = this._def.innerType._parse(input);
-    const freeze = (data) => {
-      if (isValid(data)) {
-        data.value = Object.freeze(data.value);
-      }
-      return data;
-    };
-    return isAsync(result) ? result.then((data) => freeze(data)) : freeze(result);
-  }
-  unwrap() {
-    return this._def.innerType;
-  }
+var ZodReadonly = class extends ZodType {
+  _parse(input) {
+    const result = this._def.innerType._parse(input);
+    const freeze = (data) => {
+      if (isValid(data)) {
+        data.value = Object.freeze(data.value);
+      }
+      return data;
+    };
+    return isAsync(result) ? result.then((data) => freeze(data)) : freeze(result);
+  }
+  unwrap() {
+    return this._def.innerType;
+  }
+};
+ZodReadonly.create = (type, params) => {
+  return new ZodReadonly({
+    innerType: type,
+    typeName: ZodFirstPartyTypeKind.ZodReadonly,
+    ...processCreateParams(params)
+  });
+};
+function cleanParams(params, data) {
+  const p = typeof params === "function" ? params(data) : typeof params === "string" ? { message: params } : params;
+  const p2 = typeof p === "string" ? { message: p } : p;
+  return p2;
+}
+function custom(check, _params = {}, fatal) {
+  if (check)
+    return ZodAny.create().superRefine((data, ctx) => {
+      const r = check(data);
+      if (r instanceof Promise) {
+        return r.then((r2) => {
+          if (!r2) {
+            const params = cleanParams(_params, data);
+            const _fatal = params.fatal ?? fatal ?? true;
+            ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
+          }
+        });
+      }
+      if (!r) {
+        const params = cleanParams(_params, data);
+        const _fatal = params.fatal ?? fatal ?? true;
+        ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
+      }
+      return;
+    });
+  return ZodAny.create();
+}
+var late = {
+  object: ZodObject.lazycreate
+};
+var ZodFirstPartyTypeKind;
+(function(ZodFirstPartyTypeKind2) {
+  ZodFirstPartyTypeKind2["ZodString"] = "ZodString";
+  ZodFirstPartyTypeKind2["ZodNumber"] = "ZodNumber";
+  ZodFirstPartyTypeKind2["ZodNaN"] = "ZodNaN";
+  ZodFirstPartyTypeKind2["ZodBigInt"] = "ZodBigInt";
+  ZodFirstPartyTypeKind2["ZodBoolean"] = "ZodBoolean";
+  ZodFirstPartyTypeKind2["ZodDate"] = "ZodDate";
+  ZodFirstPartyTypeKind2["ZodSymbol"] = "ZodSymbol";
+  ZodFirstPartyTypeKind2["ZodUndefined"] = "ZodUndefined";
+  ZodFirstPartyTypeKind2["ZodNull"] = "ZodNull";
+  ZodFirstPartyTypeKind2["ZodAny"] = "ZodAny";
+  ZodFirstPartyTypeKind2["ZodUnknown"] = "ZodUnknown";
+  ZodFirstPartyTypeKind2["ZodNever"] = "ZodNever";
+  ZodFirstPartyTypeKind2["ZodVoid"] = "ZodVoid";
+  ZodFirstPartyTypeKind2["ZodArray"] = "ZodArray";
+  ZodFirstPartyTypeKind2["ZodObject"] = "ZodObject";
+  ZodFirstPartyTypeKind2["ZodUnion"] = "ZodUnion";
+  ZodFirstPartyTypeKind2["ZodDiscriminatedUnion"] = "ZodDiscriminatedUnion";
+  ZodFirstPartyTypeKind2["ZodIntersection"] = "ZodIntersection";
+  ZodFirstPartyTypeKind2["ZodTuple"] = "ZodTuple";
+  ZodFirstPartyTypeKind2["ZodRecord"] = "ZodRecord";
+  ZodFirstPartyTypeKind2["ZodMap"] = "ZodMap";
+  ZodFirstPartyTypeKind2["ZodSet"] = "ZodSet";
+  ZodFirstPartyTypeKind2["ZodFunction"] = "ZodFunction";
+  ZodFirstPartyTypeKind2["ZodLazy"] = "ZodLazy";
+  ZodFirstPartyTypeKind2["ZodLiteral"] = "ZodLiteral";
+  ZodFirstPartyTypeKind2["ZodEnum"] = "ZodEnum";
+  ZodFirstPartyTypeKind2["ZodEffects"] = "ZodEffects";
+  ZodFirstPartyTypeKind2["ZodNativeEnum"] = "ZodNativeEnum";
+  ZodFirstPartyTypeKind2["ZodOptional"] = "ZodOptional";
+  ZodFirstPartyTypeKind2["ZodNullable"] = "ZodNullable";
+  ZodFirstPartyTypeKind2["ZodDefault"] = "ZodDefault";
+  ZodFirstPartyTypeKind2["ZodCatch"] = "ZodCatch";
+  ZodFirstPartyTypeKind2["ZodPromise"] = "ZodPromise";
+  ZodFirstPartyTypeKind2["ZodBranded"] = "ZodBranded";
+  ZodFirstPartyTypeKind2["ZodPipeline"] = "ZodPipeline";
+  ZodFirstPartyTypeKind2["ZodReadonly"] = "ZodReadonly";
+})(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
+var instanceOfType = (cls, params = {
+  message: `Input not instance of ${cls.name}`
+}) => custom((data) => data instanceof cls, params);
+var stringType = ZodString.create;
+var numberType = ZodNumber.create;
+var nanType = ZodNaN.create;
+var bigIntType = ZodBigInt.create;
+var booleanType = ZodBoolean.create;
+var dateType = ZodDate.create;
+var symbolType = ZodSymbol.create;
+var undefinedType = ZodUndefined.create;
+var nullType = ZodNull.create;
+var anyType = ZodAny.create;
+var unknownType = ZodUnknown.create;
+var neverType = ZodNever.create;
+var voidType = ZodVoid.create;
+var arrayType = ZodArray.create;
+var objectType = ZodObject.create;
+var strictObjectType = ZodObject.strictCreate;
+var unionType = ZodUnion.create;
+var discriminatedUnionType = ZodDiscriminatedUnion.create;
+var intersectionType = ZodIntersection.create;
+var tupleType = ZodTuple.create;
+var recordType = ZodRecord.create;
+var mapType = ZodMap.create;
+var setType = ZodSet.create;
+var functionType = ZodFunction.create;
+var lazyType = ZodLazy.create;
+var literalType = ZodLiteral.create;
+var enumType = ZodEnum.create;
+var nativeEnumType = ZodNativeEnum.create;
+var promiseType = ZodPromise.create;
+var effectsType = ZodEffects.create;
+var optionalType = ZodOptional.create;
+var nullableType = ZodNullable.create;
+var preprocessType = ZodEffects.createWithPreprocess;
+var pipelineType = ZodPipeline.create;
+var ostring = () => stringType().optional();
+var onumber = () => numberType().optional();
+var oboolean = () => booleanType().optional();
+var coerce = {
+  string: ((arg) => ZodString.create({ ...arg, coerce: true })),
+  number: ((arg) => ZodNumber.create({ ...arg, coerce: true })),
+  boolean: ((arg) => ZodBoolean.create({
+    ...arg,
+    coerce: true
+  })),
+  bigint: ((arg) => ZodBigInt.create({ ...arg, coerce: true })),
+  date: ((arg) => ZodDate.create({ ...arg, coerce: true }))
+};
+var NEVER = INVALID;
+
+// ../../../core/dist/wire/constants/constants.js
+var RETICLE_DEFAULT_PORT = 4400;
+var RETICLE_WS_PATH = "/reticle";
+var RETICLE_CLIENT_HOST = "localhost";
+function bridgeWsUrl(port = RETICLE_DEFAULT_PORT, host = RETICLE_CLIENT_HOST) {
+  return `ws://${host}:${String(port)}${RETICLE_WS_PATH}`;
+}
+var ReticleEnv = {
+  /** Shared-secret the browser SDK must present in HELLO; absent ⇒ loopback-trust only. */
+  TOKEN: "RETICLE_TOKEN",
+  /** Bridge bind host. Defaults to loopback; setting anything else is opt-in remote exposure. */
+  HOST: "RETICLE_HOST",
+  /** Comma-separated WS Origin allow-list for the bridge. */
+  ALLOWED_ORIGINS: "RETICLE_ALLOWED_ORIGINS",
+  /** Bridge/daemon WS port override. */
+  PORT: "RETICLE_PORT",
+  /** Daemon state — pidfiles, discovery registry, logs. Defaults to `~/.reticle`. Overridable
+   * because a read-only $HOME (sandboxed agent, locked-down Windows profile, container) otherwise
+   * makes the daemon unstartable with a raw EACCES naming nothing. Reported by a Windows user. */
+  STATE_DIR: "RETICLE_STATE_DIR",
+  /** Attach to an already-running browser over CDP instead of launching one. */
+  CDP_URL: "RETICLE_CDP_URL",
+  /** Max simultaneous leased headless contexts in the browser pool (resource cap). */
+  MAX_CONTEXTS: "RETICLE_MAX_CONTEXTS",
+  /**
+   * Inbound events per second before the bridge starts SAMPLING (never disconnecting).
+   *
+   * Raise it for a legitimately busy app — a streaming dashboard, a live grid — rather than accept
+   * partial coverage. Free and local: the daemon runs on the same machine, so a higher ceiling costs
+   * nothing to anyone.
+   */
+  MAX_MESSAGES_PER_SECOND: "RETICLE_MAX_MESSAGES_PER_SECOND",
+  /** Bearer token required by the optional `reticle serve --http` verify endpoint. */
+  VERIFY_TOKEN: "RETICLE_VERIFY_TOKEN",
+  /** Ms of continuous idleness (no agent, no browser session, no lease) before the daemon self-exits;
+   * `0` disables. Keeps Reticle from lingering on a user's machine after the editor closes. */
+  IDLE_SHUTDOWN: "RETICLE_IDLE_SHUTDOWN_MS",
+  /** Idle re-check cadence (default 30s). Overridable so daemon-lifecycle-test can watch a full
+   * exit/wake cycle in seconds rather than minutes. */
+  IDLE_CHECK: "RETICLE_IDLE_CHECK_MS",
+  /**
+   * Grace for a daemon with an agent ATTACHED. Longer than the base on purpose: quiet with a client
+   * present means a slow install or a thinking human, not an unwanted daemon — a flat 5 minutes was
+   * killing live runs mid-install. Derived from the base when unset.
+   */
+  IDLE_ATTACHED: "RETICLE_IDLE_ATTACHED_MS",
+  /**
+   * How often the daemon writes `reticle_daemon_alive`, so a GAP in its log is evidence it died.
+   *
+   * Overridable for the same reason the idle windows are: a spec that has to prove "a killed daemon
+   * is distinguishable from a tidy one" cannot wait 30 seconds per beat, and a spec that instead
+   * re-implements the cadence is insensitive to the thing it claims to guard.
+   */
+  HEARTBEAT: "RETICLE_HEARTBEAT_MS",
+  /** Directory holding the auto-provisioned pairing token. Defaults to ~/.reticle; relocatable for CI. */
+  PAIRING_TOKEN_DIR: "RETICLE_PAIRING_TOKEN_DIR",
+  /** Force the durable causal journal off (`0`/`false`/`off`) or on (`1`/`true`/`on`); default on. */
+  JOURNAL: "RETICLE_JOURNAL",
+  /**
+   * Verbose internal flow tracing for people working ON Reticle (`1`/`true`/`on`); default off.
+   *
+   * Distinct from the journal, which records what the AGENT did to the app. This records what
+   * RETICLE did to answer it: one line per internal stage, with its duration and nesting, so a
+   * developer can see which code a tool call actually went through and where the time went.
+   * Off by default and free when off — a trace on every tool call is a cost on the hot path.
+   */
+  TRACE: "RETICLE_TRACE",
+  /**
+   * How many consecutive reconnects the MCP proxy attempts before it stops retrying and goes
+   * dormant. Overridable for the same reason the idle windows are: the real budget takes MINUTES to
+   * exhaust, so the one spec that proves the proxy SURVIVES exhaustion could not run at all without
+   * shortening it. A budget nobody can reach in a test is a budget nobody tests.
+   */
+  RECONNECT_ATTEMPTS: "RETICLE_RECONNECT_ATTEMPTS",
+  /** Quiet window before an abandoned MCP stdio proxy exits; `0` disables the watcher. */
+  MCP_PROXY_IDLE: "RETICLE_MCP_PROXY_IDLE_MS",
+  /**
+   * API key for the harness — the model that drives the app when no coding agent is in the loop.
+   *
+   * The standard Anthropic name, on purpose: a machine that can already run a coding agent can
+   * already run the harness, with nothing to configure. Absent ⇒ the harness is simply unavailable
+   * and every other part of Reticle is unaffected.
+   */
+  HARNESS_KEY: "ANTHROPIC_API_KEY",
+  /** Model the harness drives with. Defaults to a small one — see `DEFAULT_HARNESS_MODEL`. */
+  HARNESS_MODEL: "RETICLE_HARNESS_MODEL",
+  /** Base URL for the harness's model API, for a proxy or a gateway. */
+  HARNESS_BASE_URL: "RETICLE_HARNESS_BASE_URL",
+  /** Hard ceiling on harness model turns in one drive. Bounds cost, not value. */
+  HARNESS_MAX_STEPS: "RETICLE_HARNESS_MAX_STEPS",
+  /**
+   * Which model backs the harness driver: `anthropic` (the default) or `jev`.
+   *
+   * Two drivers exist because the driver's job turns out not to need a text generator. It picks the
+   * next action and says what it expects; the verdict is decided afterwards by the engine, with no
+   * model anywhere near it. A System One model answers typed questions against a state, which is
+   * exactly that job and none of the rest, so it can drive without being able to generate a
+   * sentence. Unset keeps the existing behaviour for everybody who has not asked for this.
+   */
+  HARNESS_DRIVER: "RETICLE_HARNESS_DRIVER",
+  /**
+   * A direct Jev key, for this repo's own benchmarks and for anyone holding a TypeSafe account.
+   *
+   * Users are not expected to have one. The ordinary path is the key they already minted on the
+   * platform (`RETICLE_API_KEY`), which reaches Jev through the proxy at `RETICLE_CLOUD_URL` —
+   * this variable is the escape hatch that skips it, and it takes precedence when both are set so
+   * that a developer debugging the upstream is never silently talking to the proxy instead.
+   */
+  HARNESS_JEV_KEY: "JEV_API_KEY",
+  /** Base URL for the Jev API, for a proxy or a gateway. Defaults to TypeSafe's own endpoint. */
+  HARNESS_JEV_URL: "RETICLE_HARNESS_JEV_URL",
+  /** A direct OpenAI key. As with Jev, the ordinary path is the platform key and its proxy. */
+  HARNESS_OPENAI_KEY: "OPENAI_API_KEY",
+  /** Model the OpenAI driver uses. Defaults to a small one — see `DEFAULT_OPENAI_MODEL`. */
+  HARNESS_OPENAI_MODEL: "RETICLE_HARNESS_OPENAI_MODEL",
+  /**
+   * The API key minted on the platform, and the host it belongs to.
+   *
+   * Read through `apiKeyFrom()`, never directly — see the note on that function for why there are
+   * two names for one key and why neither may be dropped.
+   */
+  API_KEY: "RETICLE_API_KEY",
+  /** The name this key had until 2026-09. Still honoured; see `apiKeyFrom()`. */
+  CLOUD_KEY: "RETICLE_CLOUD_KEY",
+  CLOUD_URL: "RETICLE_CLOUD_URL"
 };
-ZodReadonly.create = (type, params) => {
-  return new ZodReadonly({
-    innerType: type,
-    typeName: ZodFirstPartyTypeKind.ZodReadonly,
-    ...processCreateParams(params)
-  });
+var TRANSPORT_LIMITS = {
+  MAX_MESSAGE_BYTES: 1024 * 1024,
+  /**
+   * Inbound events per second before the bridge SAMPLES rather than records everything.
+   *
+   * The cap exists to stop a PATHOLOGICAL page (an animation loop firing DOM mutations every frame),
+   * not to throttle a busy one: an ordinary React app with an active query cache passes 1000/s, and a
+   * sampled window cannot support a verdict, so too low a cap answers `unknown` with
+   * `unclean_capture` on the first `act_and_wait` after an install (#316).
+   *
+   * The ceiling it defends is cheap — the daemon is on the same machine and a typical event is a few
+   * hundred bytes, so 20000/s is single-digit MB/s over loopback. Raising it does not raise what a
+   * runaway page can make the bridge HOLD: memory is bounded independently by the ring buffer, which
+   * evicts on `RING_BUFFER_DEFAULTS.MAX_BYTES` (this same constant through that alias) as well as on
+   * a count and an age. The rate cap defends parse cost, the ring buffer defends memory, and they are
+   * not substitutes.
+   */
+  MAX_MESSAGES_PER_SECOND: 2e4,
+  MAX_SESSIONS: 32,
+  MAX_PENDING_CONNECTIONS: 16,
+  HELLO_TIMEOUT_MS: 5e3,
+  MAX_BUFFER_BYTES: 8 * 1024 * 1024,
+  MAX_SESSION_ID_LENGTH: 128,
+  MAX_URL_LENGTH: 4096,
+  MAX_TITLE_LENGTH: 512,
+  MAX_ADAPTERS: 32,
+  /*
+   * The cap on ONE vocabulary in `contractParts` — the commands, events or actions a peer says it
+   * speaks.
+   *
+   * Its own number, and the reason is an outage this nearly shipped. `contractParts` reused
+   * `MAX_ADAPTERS` (32), and this implementation's own event vocabulary is larger than that. The
+   * field had never had a producer, so nothing had ever tried: the first build to actually send it
+   * had every HELLO rejected by the schema and NO SESSION COULD CONNECT AT ALL. The unit gate is
+   * blind to it — the schema accepts the shape in isolation, and only a real page talking to a real
+   * daemon fails — so the e2e battery is what caught it.
+   *
+   * 128 leaves the vocabularies room to roughly triple. A cap here is still worth having: this
+   * arrives on an unauthenticated HELLO, so it is an untrusted list and the bound is chosen here.
+   */
+  MAX_CONTRACT_NAMES: 128,
+  MAX_ADAPTER_NAME_LENGTH: 128,
+  MAX_TOKEN_LENGTH: 512,
+  MAX_COMMAND_ID_LENGTH: 128,
+  MAX_COMMAND_NAME_LENGTH: 128,
+  MAX_REF_LENGTH: 128,
+  MAX_ERROR_LENGTH: 4096,
+  /** Cap on a captured stack trace before it crosses the wire — the console observer and both React
+   *  error hooks (error-boundary, hydration-error) all truncate to this, so it is one fact. */
+  MAX_STACK_LENGTH: 4e3,
+  MAX_SERIALIZE_DEPTH: 8,
+  MAX_COLLECTION_ITEMS: 200,
+  MAX_OBJECT_KEYS: 200,
+  MAX_STRING_LENGTH: 64 * 1024,
+  /** Human review marks: the note the human types when flagging a mistake on the page. */
+  MAX_MARK_NOTE_LENGTH: 2e3,
+  /** Human review marks: the legible element label that pins the mark (e.g. "Submit button"). */
+  MAX_MARK_LABEL_LENGTH: 256
 };
-function cleanParams(params, data) {
-  const p = typeof params === "function" ? params(data) : typeof params === "string" ? { message: params } : params;
-  const p2 = typeof p === "string" ? { message: p } : p;
-  return p2;
-}
-function custom(check, _params = {}, fatal) {
-  if (check)
-    return ZodAny.create().superRefine((data, ctx) => {
-      const r = check(data);
-      if (r instanceof Promise) {
-        return r.then((r2) => {
-          if (!r2) {
-            const params = cleanParams(_params, data);
-            const _fatal = params.fatal ?? fatal ?? true;
-            ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
-          }
-        });
-      }
-      if (!r) {
-        const params = cleanParams(_params, data);
-        const _fatal = params.fatal ?? fatal ?? true;
-        ctx.addIssue({ code: "custom", ...params, fatal: _fatal });
-      }
-      return;
-    });
-  return ZodAny.create();
-}
-var late = {
-  object: ZodObject.lazycreate
+var ReticleDir = {
+  ROOT: ".reticle",
+  CONTRACT_FILE: "contract.json",
+  FLOWS_SUBDIR: "flows",
+  BASELINES_SUBDIR: "baselines",
+  /** cross-run memory — outcomes of past runs (the "did it behave like last time?" file). */
+  PROJECT_FILE: "project.json",
+  /**
+   * the user's own record of what Reticle has done for them — .reticle/impact.json.
+   *
+   * Local only, never uploaded, and deliberately NOT part of telemetry: telemetry answers questions
+   * about the product; this answers the user's question about their own work.
+   */
+  IMPACT_FILE: "impact.json",
+  /** what changes were SUPPOSED to make true —.reticle/intent.json (git-checked, reviewed) */
+  INTENT_FILE: "intent.json",
+  /**
+   * The sharded form of the same ledger —.reticle/intent/ (git-checked, for the same reason).
+   *
+   * Named here rather than inline at the store that writes it, because the partition guard over
+   * this object is what decides whether a name Reticle creates is committed or ignored. A directory
+   * spelled as a free string somewhere else is one the guard cannot see, so nobody ever makes that
+   * decision: `intent/` was written into users' repositories for that reason alone, neither
+   * classified nor ignored.
+   */
+  INTENT_SUBDIR: "intent",
+  /**
+   * what a drive types into a field, keyed by the field's label —.reticle/fill-values.json.
+   *
+   * Git-checked on purpose. A generated value is paid for once and then belongs to the project: the
+   * next drive reuses it for free, a replay sends exactly what the recording sent, and a human who
+   * dislikes one can edit the file rather than argue with a model.
+   */
+  FILL_VALUES_FILE: "fill-values.json",
+  /** opt-in pixel baselines —.reticle/visual/<name>.png + <name>.diff.png. */
+  VISUAL_SUBDIR: "visual",
+  /** verification-run artifacts —.reticle/runs/<runId>.json (the OEM/CI-consumable verdict). */
+  RUNS_SUBDIR: "runs",
+  /** fail-to-pass bug capsules —.reticle/capsules/<id>.json (a minimal failing flow + its evidence). */
+  CAPSULES_SUBDIR: "capsules",
+  /** durable causal journal —.reticle/sessions/<id>/{events,actions}.jsonl (the substrate). */
+  SESSIONS_SUBDIR: "sessions",
+  /** append-only event ledger inside a session dir (one ReticleEvent per line). */
+  JOURNAL_EVENTS_FILE: "events.jsonl",
+  /** append-only action ledger inside a session dir (one JournalAction per line). */
+  JOURNAL_ACTIONS_FILE: "actions.jsonl",
+  /**
+   * the event ledger's closure report — .reticle/sessions/<id>/events.closed.json.
+   *
+   * Written once, when the byte ceiling refuses a batch, and never removed. Its PRESENCE is what
+   * makes the ceiling durable: a session id survives a reload, so the next connection reopens the
+   * same ledger with an empty memory, and a bound that lives only in one object's field is a bound
+   * per connection. Its CONTENTS are the loss report a time-windowed query cannot filter away.
+   */
+  JOURNAL_EVENTS_CLOSED_FILE: "events.closed.json",
+  /** learned expected-envelopes per route, accumulated across runs (the deviation-report baseline). */
+  ENVELOPES_FILE: "envelopes.json",
+  /** learned ambient (action-less churn) region map — excluded from settle/summaries/envelopes. */
+  AMBIENT_FILE: "ambient.json",
+  /** per-flow flake ledger — replay outcomes that decide intermittent-failure quarantine. */
+  FLAKE_FILE: "flake.json",
+  /**
+   * the project's cloud binding — .reticle/cloud.json, written by `reticle link`. Git-checked and
+   * non-secret: the project id, the API origin, and where its dashboard lives. The KEY lives in
+   * ~/.reticle/credentials.json instead, because that one must never reach a repository.
+   */
+  CLOUD_LINK_FILE: "cloud.json",
+  /**
+   * local sync bookkeeping — .reticle/cloud-state.json. The pull cursor, when each half last ran,
+   * and the last error. NOT git-checked: it describes this machine's conversation with the server,
+   * and committing one machine's cursor would make every other machine skip what it had not seen.
+   */
+  CLOUD_STATE_FILE: "cloud-state.json",
+  /**
+   * triage decisions pulled BACK from the dashboard — .reticle/issues.json. What a human said about
+   * a defect ("resolved", "not a bug"), so the HUD stops showing it and the next run does not
+   * re-report it as though nobody had looked.
+   */
+  ISSUES_FILE: "issues.json",
+  /** Per-flow assertion tiers recorded on each PASSING replay — the gate's anti-downgrade baseline. */
+  TIERS_FILE: "assertion-tiers.json",
+  /**
+   * what to run when something happens — .reticle/hooks.json. Git-checked on purpose: a hook is a
+   * decision the whole team shares, the same way a git hook or a package script is, and one that
+   * only exists on the machine that wrote it is a rule nobody else is following.
+   *
+   * It names COMMANDS, so it is exactly as trusted as `package.json` scripts in the same repository
+   * and no more: opening a repo does not run them, and Reticle runs one only when the event it is
+   * attached to actually happens. The event payload is handed over on stdin, never interpolated into
+   * the command line, so a defect's own text can never become part of a command.
+   */
+  HOOKS_FILE: "hooks.json",
+  /**
+   * Auto-provisioned bridge pairing token, stored at ~/.reticle/pairing-token (mode 0600). Written by
+   * the daemon, read Node-side by the build plugins to inject into connect. A browser sandbox cannot
+   * read it, so a rogue localhost app can't present it — that's what stops cross-app session hijack.
+   */
+  PAIRING_TOKEN_FILE: "pairing-token"
 };
-var ZodFirstPartyTypeKind;
-(function(ZodFirstPartyTypeKind2) {
-  ZodFirstPartyTypeKind2["ZodString"] = "ZodString";
-  ZodFirstPartyTypeKind2["ZodNumber"] = "ZodNumber";
-  ZodFirstPartyTypeKind2["ZodNaN"] = "ZodNaN";
-  ZodFirstPartyTypeKind2["ZodBigInt"] = "ZodBigInt";
-  ZodFirstPartyTypeKind2["ZodBoolean"] = "ZodBoolean";
-  ZodFirstPartyTypeKind2["ZodDate"] = "ZodDate";
-  ZodFirstPartyTypeKind2["ZodSymbol"] = "ZodSymbol";
-  ZodFirstPartyTypeKind2["ZodUndefined"] = "ZodUndefined";
-  ZodFirstPartyTypeKind2["ZodNull"] = "ZodNull";
-  ZodFirstPartyTypeKind2["ZodAny"] = "ZodAny";
-  ZodFirstPartyTypeKind2["ZodUnknown"] = "ZodUnknown";
-  ZodFirstPartyTypeKind2["ZodNever"] = "ZodNever";
-  ZodFirstPartyTypeKind2["ZodVoid"] = "ZodVoid";
-  ZodFirstPartyTypeKind2["ZodArray"] = "ZodArray";
-  ZodFirstPartyTypeKind2["ZodObject"] = "ZodObject";
-  ZodFirstPartyTypeKind2["ZodUnion"] = "ZodUnion";
-  ZodFirstPartyTypeKind2["ZodDiscriminatedUnion"] = "ZodDiscriminatedUnion";
-  ZodFirstPartyTypeKind2["ZodIntersection"] = "ZodIntersection";
-  ZodFirstPartyTypeKind2["ZodTuple"] = "ZodTuple";
-  ZodFirstPartyTypeKind2["ZodRecord"] = "ZodRecord";
-  ZodFirstPartyTypeKind2["ZodMap"] = "ZodMap";
-  ZodFirstPartyTypeKind2["ZodSet"] = "ZodSet";
-  ZodFirstPartyTypeKind2["ZodFunction"] = "ZodFunction";
-  ZodFirstPartyTypeKind2["ZodLazy"] = "ZodLazy";
-  ZodFirstPartyTypeKind2["ZodLiteral"] = "ZodLiteral";
-  ZodFirstPartyTypeKind2["ZodEnum"] = "ZodEnum";
-  ZodFirstPartyTypeKind2["ZodEffects"] = "ZodEffects";
-  ZodFirstPartyTypeKind2["ZodNativeEnum"] = "ZodNativeEnum";
-  ZodFirstPartyTypeKind2["ZodOptional"] = "ZodOptional";
-  ZodFirstPartyTypeKind2["ZodNullable"] = "ZodNullable";
-  ZodFirstPartyTypeKind2["ZodDefault"] = "ZodDefault";
-  ZodFirstPartyTypeKind2["ZodCatch"] = "ZodCatch";
-  ZodFirstPartyTypeKind2["ZodPromise"] = "ZodPromise";
-  ZodFirstPartyTypeKind2["ZodBranded"] = "ZodBranded";
-  ZodFirstPartyTypeKind2["ZodPipeline"] = "ZodPipeline";
-  ZodFirstPartyTypeKind2["ZodReadonly"] = "ZodReadonly";
-})(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
-var instanceOfType = (cls, params = {
-  message: `Input not instance of ${cls.name}`
-}) => custom((data) => data instanceof cls, params);
-var stringType = ZodString.create;
-var numberType = ZodNumber.create;
-var nanType = ZodNaN.create;
-var bigIntType = ZodBigInt.create;
-var booleanType = ZodBoolean.create;
-var dateType = ZodDate.create;
-var symbolType = ZodSymbol.create;
-var undefinedType = ZodUndefined.create;
-var nullType = ZodNull.create;
-var anyType = ZodAny.create;
-var unknownType = ZodUnknown.create;
-var neverType = ZodNever.create;
-var voidType = ZodVoid.create;
-var arrayType = ZodArray.create;
-var objectType = ZodObject.create;
-var strictObjectType = ZodObject.strictCreate;
-var unionType = ZodUnion.create;
-var discriminatedUnionType = ZodDiscriminatedUnion.create;
-var intersectionType = ZodIntersection.create;
-var tupleType = ZodTuple.create;
-var recordType = ZodRecord.create;
-var mapType = ZodMap.create;
-var setType = ZodSet.create;
-var functionType = ZodFunction.create;
-var lazyType = ZodLazy.create;
-var literalType = ZodLiteral.create;
-var enumType = ZodEnum.create;
-var nativeEnumType = ZodNativeEnum.create;
-var promiseType = ZodPromise.create;
-var effectsType = ZodEffects.create;
-var optionalType = ZodOptional.create;
-var nullableType = ZodNullable.create;
-var preprocessType = ZodEffects.createWithPreprocess;
-var pipelineType = ZodPipeline.create;
-var ostring = () => stringType().optional();
-var onumber = () => numberType().optional();
-var oboolean = () => booleanType().optional();
-var coerce = {
-  string: ((arg) => ZodString.create({ ...arg, coerce: true })),
-  number: ((arg) => ZodNumber.create({ ...arg, coerce: true })),
-  boolean: ((arg) => ZodBoolean.create({
-    ...arg,
-    coerce: true
-  })),
-  bigint: ((arg) => ZodBigInt.create({ ...arg, coerce: true })),
-  date: ((arg) => ZodDate.create({ ...arg, coerce: true }))
+var UpdateCheckIntervalMs = 24 * 60 * 60 * 1e3;
+var RING_BUFFER_DEFAULTS = {
+  MAX_EVENTS: 2e3,
+  MAX_AGE_MS: 6e4,
+  MAX_BYTES: TRANSPORT_LIMITS.MAX_BUFFER_BYTES
 };
-var NEVER = INVALID;
+var EventType = {
+  DOM_ADDED: "dom.added",
+  DOM_REMOVED: "dom.removed",
+  DOM_ATTR: "dom.attr",
+  DOM_TEXT: "dom.text",
+  NET_REQUEST: "net.request",
+  NET_PENDING: "net.pending",
+  /** An SSE (EventSource) or WebSocket frame — a message on a long-lived streaming connection. */
+  NET_STREAM: "net.stream",
+  /** A web-perf metric a screenshot can't verify: LCP, cumulative layout shift, or a long task. */
+  PERF: "perf",
+  ROUTE_CHANGE: "route.change",
+  CONSOLE_LOG: "console.log",
+  CONSOLE_WARN: "console.warn",
+  CONSOLE_ERROR: "console.error",
+  CONSOLE_INFO: "console.info",
+  CONSOLE_DEBUG: "console.debug",
+  ERROR_UNCAUGHT: "error.uncaught",
+  VISIBLE_SHOWN: "visible.shown",
+  ANIM_START: "anim.start",
+  ANIM_END: "anim.end",
+  SCROLL_POSITION: "scroll.position",
+  REVEAL_SHOWN: "reveal.shown",
+  SIGNAL: "signal",
+  STATE_CHANGE: "state.change",
+  /** a write to localStorage/sessionStorage/cookies — `data: { area, key, old?, new? }` (values redacted). */
+  STORAGE_CHANGE: "storage.change",
+  /** page-level visibility/focus health (distinct from element-level VISIBLE_*). */
+  PAGE_HEALTH: "page.health",
+  /**
+   * synthetic: the page called window.open, so the consequence of what was just clicked may live in
+   * another browsing context this one cannot observe (an OAuth popup is the archetype).
+   * `data: { href }` — the URL the page asked to open, when it named one.
+   */
+  CONTEXT_OPENED: "context.opened",
+  /**
+   * The app opened a native `alert`/`confirm`/`prompt` while Reticle was driving it.
+   *
+   * Recorded because Reticle ANSWERS these rather than letting them block — a native dialog halts
+   * the main thread, and the SDK's own message pump is on that thread, so one `confirm` behind a
+   * driven click made the tab permanently unresponsive with no recovery from inside the session.
+   * Answering silently would trade a wedge for an invisible one, so the question the app asked, and
+   * the answer given, ride out as an event.
+   */
+  DIALOG_OPENED: "dialog.opened",
+  /** aggregated React commits over a throttle window (dev builds) — `data: { commits }`. Commit storms /
+   * wasted re-renders show up here without a per-render flood. */
+  RENDER_COMMIT: "render.commit",
+  /** element focus moved — `data: { to, from, toBody }`. Focus dropping to body after an act is a regression. */
+  FOCUS_CHANGE: "focus.change",
+  /** browser → bridge: a human recording compiled in-page. */
+  FLOW_RECORDED: "flow.recorded",
+  /** synthetic: browser transport queue overflowed; events were dropped. `data: { dropped: number }`. */
+  TRANSPORT_OVERFLOW: "transport.overflow",
+  /**
+   * synthetic: a per-channel cap truncated a batch (e.g. a DOM mutation flood). `data: { channel, dropped }`.
+   * Marks downstream rollups/envelopes as built on incomplete data — a ledger that lies at scale is worse
+   * than no ledger, so truncation is never silent.
+   */
+  TRUNCATED: "truncated",
+  /**
+   * synthetic: the SDK detected a region it CANNOT observe (a cross-origin iframe, a closed shadow root).
+   * `data: { kind: BlindSpotKind, count }`. Surfaced on results as `coverage: partial` so a green never
+   * implies it saw everything.
+   */
+  BLIND_SPOT: "blind-spot",
+  /** synthetic: the SDK ITSELF failed (an observer threw). `data: { site, message, errorType }`.
+   *  Rides the existing bridge — no outbound request. See browser/observers/sdk-failure.ts. */
+  SDK_FAILED: "sdk.failed",
+  /**
+   * synthetic (driven only): CDP/Playwright-authoritative network detail for a response the in-page
+   * fetch/XHR wrapper also saw — full response headers + authoritative status/mimeType the page-side
+   * wrapper can't reach. `data: { url, method?, status, headers, resourceType? }`. Merged onto the
+   * matching in-page NET_REQUEST so the driven view never loses fidelity to an outside-in tool.
+   */
+  NET_DETAIL: "net.detail",
+  /**
+   * Live-control: browser → bridge. A human acted on the presenter panel.
+   * `data: { kind: HumanControlKind; text?: string }`. Rides the existing EventMessage.
+   */
+  HUMAN_CONTROL: "human.control",
+  /**
+   * Human review: browser → bridge. A human pinned a mistake to an element on the running page
+   * (the "annotate the bug where you see it" loop). `data` narrows to HumanMarkDataSchema — a note
+   * plus a re-resolvable element anchor (and its source file:line when the framework stamped one) so
+   * the agent that drains the mark knows exactly which element and which source to fix.
+   */
+  HUMAN_MARK: "human.mark",
+  /**
+   * The app produced a FILE — a Blob handed to `URL.createObjectURL`, usually saved by clicking an
+   * anchor with `download`. `data: { filename?, mimeType, bytes, lines?, preview? }`. The one artifact
+   * class no outside-the-browser tool can inspect: it never crosses the network, so there is no
+   * request to intercept. See `observers/download.ts` for the defect that motivated it.
+   */
+  DOWNLOAD: "download"
+};
+var RETICLE_RENDER_PREHOOK = "__reticleRenderPreHook";
+var CONSOLE_LEVEL_PREFIX = "console.";
+var CONSOLE_LEVELS = [
+  EventType.CONSOLE_LOG,
+  EventType.CONSOLE_WARN,
+  EventType.CONSOLE_ERROR,
+  EventType.CONSOLE_INFO
+].map((type) => type.slice(CONSOLE_LEVEL_PREFIX.length));
+
+// ../../../core/dist/identity/source-constants.js
+var DATA_RETICLE_SOURCE_ATTR = "data-reticle-source";
+var RETICLE_ROOT_GLOBAL = "__RETICLE_ROOT__";
+var RETICLE_SDK_VERSION_GLOBAL = "__RETICLE_SDK_VERSION__";
 
-// ../core/dist/project-id.js
+// ../../../core/dist/identity/project-id.js
 var PROJECT_ID_HASH_LENGTH = 8;
 var FALLBACK_PROJECT_BASE = "app";
 function slugifyPackageName(name) {
@@ -4460,7 +4554,7 @@ function projectIdFrom(pkgName, rootPath, hash) {
   return `${base}-${hash(rootPath)}`;
 }
 
-// ../core/dist/daemon-registry.js
+// ../../../core/dist/registry/daemon-registry.js
 var DAEMON_REGISTRY_PREFIX = "daemon-";
 var DAEMON_REGISTRY_SUFFIX = ".json";
 function daemonRegistryPort(fileName) {
@@ -4484,7 +4578,7 @@ function pickDaemonPort(entries, projectId, isAlive2) {
   return matches[0] ?? null;
 }
 
-// ../core/dist/dev-server-registry.js
+// ../../../core/dist/registry/dev-server-registry.js
 var DEV_SERVER_PREFIX = "devserver-";
 var DEV_SERVER_SUFFIX = ".json";
 function devServerRegistryFileName(port) {
@@ -4517,25 +4611,26 @@ var DevServerEntrySchema = external_exports.object({
 var import_node_crypto2 = require("node:crypto");
 var import_node_path2 = require("node:path");
 var import_node_fs2 = require("node:fs");
+var RETICLE_CONFIG_BASENAME = ".reticle.json";
 function shortHash(input) {
   return (0, import_node_crypto2.createHash)("sha1").update(input).digest("hex").slice(0, PROJECT_ID_HASH_LENGTH);
 }
 function deriveProjectId(pkgName, rootPath) {
   return projectIdFrom(pkgName, rootPath, shortHash);
 }
-function readNearestPackageName(startDir) {
+var readFileOrThrow = (path) => (0, import_node_fs2.readFileSync)(path, "utf8");
+var MAX_CONFIG_SEARCH_DEPTH = 6;
+var MAX_PACKAGE_SEARCH_DEPTH = 50;
+function readNearestField(startDir, basename, field, readFile, maxDepth) {
   let dir = startDir;
-  for (let depth = 0; depth < 50; depth++) {
-    const pkgPath = (0, import_node_path2.join)(dir, "package.json");
-    if ((0, import_node_fs2.existsSync)(pkgPath)) {
-      try {
-        const parsed = JSON.parse((0, import_node_fs2.readFileSync)(pkgPath, "utf8"));
-        if ("object" === typeof parsed && parsed !== null) {
-          const name = parsed["name"];
-          if ("string" === typeof name && name.length > 0) return name;
-        }
-      } catch {
+  for (let depth = 0; depth <= maxDepth; depth++) {
+    try {
+      const parsed = JSON.parse(readFile((0, import_node_path2.join)(dir, basename)));
+      if ("object" === typeof parsed && parsed !== null) {
+        const value = parsed[field];
+        if ("string" === typeof value && value.length > 0) return value;
       }
+    } catch {
     }
     const parent = (0, import_node_path2.dirname)(dir);
     if (parent === dir) break;
@@ -4543,8 +4638,22 @@ function readNearestPackageName(startDir) {
   }
   return void 0;
 }
-function resolveProjectId(explicit, cwd, readPkgName = readNearestPackageName) {
+function readNearestPackageName(startDir, readFile = readFileOrThrow) {
+  return readNearestField(startDir, "package.json", "name", readFile, MAX_PACKAGE_SEARCH_DEPTH);
+}
+function readConfiguredProjectId(startDir, readFile = readFileOrThrow) {
+  return readNearestField(
+    startDir,
+    RETICLE_CONFIG_BASENAME,
+    "projectId",
+    readFile,
+    MAX_CONFIG_SEARCH_DEPTH
+  );
+}
+function resolveProjectId(explicit, cwd, readPkgName = readNearestPackageName, readConfiguredId = readConfiguredProjectId) {
   if (explicit !== void 0 && explicit.length > 0) return explicit;
+  const configured = readConfiguredId(cwd);
+  if (configured !== void 0 && configured.length > 0) return configured;
   return deriveProjectId(readPkgName(cwd), cwd);
 }
 
@@ -4800,6 +4909,41 @@ function optimizerOptions(key, inherited, add) {
   };
 }
 
+// src/plugin-name.ts
+var RETICLE_VITE_PLUGIN_NAME = "reticle";
+
+// src/injection-postcondition.ts
+var DEV_INJECTION_GRACE_MS = 1e4;
+var notInjectedMessage = () => `[${RETICLE_VITE_PLUGIN_NAME}] could not inject reticle.connect(): the HTML entry module was never matched, so this app carries no instrumentation and will never connect. Check that index.html references your entry with a <script type="module" src="...">, or pass \`inject: false\` and call reticle.connect({ token: __RETICLE_TOKEN__ }) yourself. The plugin still inlines that define; a connect without it is refused.`;
+var unconfirmedInjectionMessage = () => `[${RETICLE_VITE_PLUGIN_NAME}] could not confirm reticle.connect() was injected: the HTML entry module was not transformed this session. That is expected when Vite served it from its transform cache. If the app does not appear in \`reticle status\`, restart the dev server with \`--force\` to bypass the cache, then check that index.html references your entry with a <script type="module" src="...">.`;
+var htmlHookNeverRanMessage = () => `[${RETICLE_VITE_PLUGIN_NAME}] this app will never connect: the dev server never asked this plugin to transform any HTML, so reticle.connect() was never added to the page. That usually means your framework renders its own HTML instead of serving index.html \u2014 SvelteKit, Nuxt, Astro, React Router (framework mode) and TanStack Start all do. Fix: import '@reticlehq/browser' and call reticle.connect({ token: __RETICLE_TOKEN__ }) yourself from your app entry file, and pass \`inject: false\` to this plugin so the two do not both try.`;
+var defaultSchedule = (run, ms) => {
+  const timer = setTimeout(run, ms);
+  timer.unref?.();
+};
+function createInjectionWatch(deps) {
+  let htmlRequested = false;
+  const isDocumentRequest = (req) => true === req.headers?.accept?.includes("text/html");
+  const checkHtmlHookRan = () => {
+    if (deps.desktop || !deps.inject || deps.htmlTransformed()) return;
+    if (!htmlRequested) return;
+    deps.warn(htmlHookNeverRanMessage());
+  };
+  const noteHtmlRequest = () => {
+    if (htmlRequested) return;
+    htmlRequested = true;
+    (deps.schedule ?? defaultSchedule)(checkHtmlHookRan, DEV_INJECTION_GRACE_MS);
+  };
+  const checkInjected = () => {
+    if (!deps.desktop || !deps.inject || deps.injected()) return;
+    deps.warn(unconfirmedInjectionMessage());
+  };
+  const armDesktopCheck = () => {
+    (deps.schedule ?? defaultSchedule)(checkInjected, DEV_INJECTION_GRACE_MS);
+  };
+  return { noteHtmlRequest, isDocumentRequest, checkHtmlHookRan, checkInjected, armDesktopCheck };
+}
+
 // src/watch-ignore.ts
 function mergeIgnored(existing, ours) {
   if (void 0 === existing || null === existing) return [ours];
@@ -4820,7 +4964,6 @@ function isVitestBrowserServer(config) {
 }
 
 // src/index.ts
-var RETICLE_VITE_PLUGIN_NAME = "reticle";
 var RETICLE_PACKAGE2 = "@reticlehq/react";
 var RETICLE_SENSOR = "@reticlehq/browser";
 var RETICLE_TOKEN_GLOBAL = "__RETICLE_TOKEN__";
@@ -4848,7 +4991,6 @@ onScheduleFiberRoot:function(){},onCommitFiberRoot:fire,onPostCommitFiberRoot:fu
 }else{var prev=h.onCommitFiberRoot;h.onCommitFiberRoot=function(){try{fire.apply(null,arguments);}catch(e){}
 if(typeof prev==='function')return prev.apply(this,arguments);};}
 }catch(e){}})();`;
-var DEV_INJECTION_GRACE_MS = 1e4;
 var CONNECT_CHURN_LIMIT = 5;
 var connectChurnWarning = () => `[${RETICLE_VITE_PLUGIN_NAME}] the injected connect module has changed ${String(CONNECT_CHURN_LIMIT)} times in one dev-server session. Something it depends on (the bridge port, the pairing token, or a reticle-dev module appearing and disappearing) is not settling, and that can make the page reload repeatedly. Reticle will keep serving the newest version. Please report this at https://github.com/ReticleHQ/reticle/issues with your vite.config and whether more than one daemon is running (\`npx @reticlehq/server status\`).`;
 function isHtmlEntry(id, specifier, root) {
@@ -4993,6 +5135,7 @@ function reticle(options = {}) {
   let vitestBrowser = false;
   const warn = options.onWarn ?? ((message) => globalThis.console.warn(message));
   let injected = false;
+  let htmlTransformed = false;
   const resolveLazy = () => {
     const port = resolved.port ?? discoverDaemonPort(resolved.projectId);
     const withPort = port !== void 0 ? { ...resolved, port } : resolved;
@@ -5005,12 +5148,13 @@ function reticle(options = {}) {
   const currentConnectSource = () => connectModuleSource(resolveLazy(), root === void 0 ? null : findDevModule(root, import_node_fs6.existsSync));
   let lastServedConnectSource;
   let connectChanges = 0;
-  const notInjectedMessage = () => `[${RETICLE_VITE_PLUGIN_NAME}] could not inject reticle.connect(): the HTML entry module was never matched, so this app carries no instrumentation and will never connect. Check that index.html references your entry with a <script type="module" src="...">, or pass \`inject: false\` and call reticle.connect({ token: __RETICLE_TOKEN__ }) yourself. The plugin still inlines that define; a connect without it is refused.`;
-  const unconfirmedInjectionMessage = () => `[${RETICLE_VITE_PLUGIN_NAME}] could not confirm reticle.connect() was injected: the HTML entry module was not transformed this session. That is expected when Vite served it from its transform cache. If the app does not appear in \`reticle status\`, restart the dev server with \`--force\` to bypass the cache, then check that index.html references your entry with a <script type="module" src="...">.`;
-  const checkInjected = () => {
-    if (!desktop || !inject || injected) return;
-    warn(unconfirmedInjectionMessage());
-  };
+  const watch = createInjectionWatch({
+    desktop,
+    inject,
+    injected: () => injected,
+    htmlTransformed: () => htmlTransformed,
+    warn
+  });
   return {
     name: RETICLE_VITE_PLUGIN_NAME,
     // Web: serve-only, so a production bundle can never carry the SDK — gating is the tool's job.
@@ -5021,9 +5165,9 @@ function reticle(options = {}) {
     /**
      * Declare the SDK itself and the optimizer cache fingerprint.
      *
-     * The browser SDK used to need extra CJS query-engine deps here. It no longer imports that
-     * second accessibility engine, so keeping those names would make Vite pre-bundle packages the
-     * app may not have and blame Reticle for a false `Failed to resolve dependency` warning.
+     * The SDK itself only. It does not import a second accessibility engine, and naming CJS deps it
+     * does not use would make Vite pre-bundle packages the app may not have, then blame Reticle for a
+     * false `Failed to resolve dependency` warning.
      */
     config(config) {
       const appRoot = config.root ?? process.cwd();
@@ -5032,29 +5176,18 @@ function reticle(options = {}) {
         // Keep the daemon's journal out of the dev server's watcher.
         //
         // The daemon writes `.reticle/` into the PROJECT root — session journals, and `ambient.json`
-        // rewritten atomically as `ambient.json.tmp` + rename on a live session. Vite watches the
-        // project root and does not ignore that directory, so every journal write read as a project
-        // file changing and Vite answered with a full page reload.
-        //
-        // That is a loop with no exit: page loads -> SDK connects and streams events -> daemon
-        // journals them -> Vite reloads the page -> SDK reconnects -> more events. It ran several
-        // times a second for as long as the dev server was up, and the damage was total but
-        // misattributed: every ref went stale, every act_and_wait died mid-flight, and the log
-        // filled with connect/disconnect pairs that looked like a flapping SDK rather than a
-        // watcher chasing its own tail.
+        // rewritten atomically as `ambient.json.tmp` + rename on a live session. Unignored, every
+        // journal write reads as a project file changing and Vite answers with a full page reload,
+        // which is a loop with no exit: page loads -> SDK connects and streams events -> daemon
+        // journals them -> Vite reloads the page -> SDK reconnects.
         //
-        // A RegExp, not a glob, and that is the whole difference between this working and not.
-        // chokidar dropped glob support in v4 — Vite 7+ ships v4/v5, where a pattern like
-        // `**/.reticle/**` is silently accepted and matches nothing. MEASURED against the chokidar
-        // this repo resolves: with the glob, a write to `.reticle/ambient.json` still fires; with
-        // this RegExp it does not, while a normal file still does. Vite's own defaults are globs and
-        // have the same problem, which is why it is not safe to copy their shape here.
+        // A RegExp, NOT a glob: chokidar dropped glob support in v4, and Vite 7+ ships v4/v5, where
+        // `**/.reticle/**` is silently accepted and matches nothing. Vite's own defaults are globs
+        // and have the same problem, so their shape is not safe to copy here.
         //
         // Anchored on `^` or a separator so it matches the directory and not a file that merely ends
         // in those characters, and both separators are accepted because chokidar reports the path in
-        // the platform's own form.
-        //
-        // Appends to the app's list rather than replacing it, so nothing it already excluded is lost.
+        // the platform's own form. Appends to the app's list rather than replacing it.
         server: {
           watch: {
             ignored: mergeIgnored(config.server?.watch?.ignored, JOURNAL_IGNORE)
@@ -5062,8 +5195,8 @@ function reticle(options = {}) {
         },
         // Expose the daemon's pairing token to hand-written connects in the same Vite app. The
         // plugin's own injected connect gets the token directly, but a connect the USER writes —
-        // SvelteKit's client hook, a custom entry — had no way to reach a file only Node can read,
-        // so it called connect() with no credential and the bridge answered "authentication
+        // SvelteKit's client hook, a custom entry — cannot reach a file only Node can read, so it
+        // would call connect() with no credential and the bridge would answer "authentication
         // failed". Empty until the daemon has provisioned one; the page reloads once it has.
         define: {
           ...config.define ?? {},
@@ -5148,25 +5281,21 @@ ${code}`;
      * Serve the connect module fresh, every time.
      *
      * `load` reads the daemon's pairing token at serve time precisely because the daemon may start
-     * after the dev server — but Vite caches the module it produced, and answers every later request
-     * from that cache, INCLUDING after a full page reload. So a dev server started first served a
-     * tokenless connect module once and then kept serving it: the SDK got a 1008 `authentication
-     * failed`, stopped retrying (correctly — a wrong token does not fix itself), and `reticle status`
-     * showed no session while the page demonstrably contained `/@reticle-connect`. Only restarting
-     * the dev server cleared it, which is not a step anybody guesses.
+     * after the dev server — but Vite caches the module it produced and answers every later request
+     * from that cache, INCLUDING after a full page reload. A dev server started first therefore keeps
+     * serving a tokenless connect module: the SDK gets a 1008 `authentication failed` and stops
+     * retrying (correctly — a wrong token does not fix itself), so `reticle status` shows no session
+     * while the page demonstrably contains `/@reticle-connect`, and only a dev-server restart clears
+     * it.
      *
      * Dropping the cached module before it is served makes `load` re-read the token, so starting the
      * daemon and reloading the page is enough.
      *
-     * Only when the source would ACTUALLY differ, though. This used to invalidate on every request
-     * for the module, forever — and a module that is force-invalidated on every request is
-     * re-resolved against Vite's dep optimizer on every page load, which is the shape of a
-     * self-sustaining reload loop: reload → request → invalidate → re-resolve → reload. Reported
-     * from the field on a Vite + React Router app pinned to a non-default port: every route
-     * reloaded the whole page about once a second, `/@reticle-connect` was fetched in every cycle,
-     * and removing the plugin stopped it instantly. Comparing the source first costs one string
-     * compare, keeps the late-daemon fix intact (the token appearing IS a change), and makes the
-     * module inert once it has settled.
+     * Only when the source would ACTUALLY differ, though. A module force-invalidated on every
+     * request is re-resolved against Vite's dep optimizer on every page load, which is a
+     * self-sustaining reload loop: reload → request → invalidate → re-resolve → reload. Comparing
+     * the source first costs one string compare, keeps the late-daemon fix intact (the token
+     * appearing IS a change), and makes the module inert once it has settled.
      */
     configureServer(server) {
       if (!inject) return;
@@ -5195,6 +5324,7 @@ ${code}`;
         announce();
       }
       server.middlewares.use((req, _res, next) => {
+        if (!desktop && watch.isDocumentRequest(req)) watch.noteHtmlRequest();
         const requestPath = (req.url ?? "").split("?")[0];
         if (requestPath === RETICLE_CONNECT_MODULE || requestPath === connectModuleUrl(base)) {
           if (currentConnectSource() !== lastServedConnectSource) {
@@ -5216,12 +5346,12 @@ ${code}`;
       if (!desktop || !inject || injected) return;
       throw new Error(notInjectedMessage());
     },
-    checkInjectedForTest: checkInjected,
+    checkInjectedForTest: watch.checkInjected,
+    checkHtmlHookForTest: watch.checkHtmlHookRan,
+    injectionWatchForTest: watch,
     transformIndexHtml() {
-      if (desktop && inject && "serve" === command) {
-        const timer = setTimeout(checkInjected, DEV_INJECTION_GRACE_MS);
-        timer.unref?.();
-      }
+      htmlTransformed = true;
+      if (desktop && inject && "serve" === command) watch.armDesktopCheck();
       if (!inject || desktop) return [];
       if (true !== options.inject && vitestBrowser) return [];
       return [