@reticlehq/vite-plugin 3.1.0 → 3.3.0

package/dist/index.d.cts

@@ -72,9 +72,8 @@ export interface ReticleVitePluginOptions {
      * This build is an Electron/Tauri renderer. Changes two things a desktop shell needs and a web app
      * must not get:
      *
-     *  - The plugin also applies to `vite build`. A packaged desktop renderer IS a production build
-     *    loaded from `file://` or a custom protocol — there is no dev server — so the default
-     *    `apply: 'serve'` drops the plugin entirely and the app ships with no `connect()` at all.
+     *  - A packaged desktop renderer IS a production build with no dev server, so it needs the real
+     *    `connect()` wiring during `vite build` — the web default's stub-swap must not apply to it.
      *  - `connect()` is called with `allowInProduction`, because that same renderer reports
      *    NODE_ENV=production and the SDK's prod backstop would otherwise refuse to start.
      *
@@ -95,6 +94,20 @@ export interface ReticleVitePluginOptions {
      * Also settable as `VITE_RETICLE_CAPTURE_BODIES=1`.
      */
     captureNetworkBodies?: boolean;
+    /**
+     * Per-body character cap for captured bodies. Default 8192; clamped to [256, 262144].
+     *
+     * Reachable here for the reason `captureNetworkBodies` is: the plugin is the only `connect()`
+     * most apps ever have, so an SDK option the plugin cannot pass is an option that does not exist.
+     *
+     * Raise it to make a NEGATIVE `bodyContains` decidable -- a negation is checked over the whole
+     * payload, so on a list endpoint bigger than the cap it is permanently undecidable, and that is
+     * the class that proves "this dangerous field is absent from every row" (#799).
+     *
+     * Also settable as `VITE_RETICLE_BODY_MAX_CHARS=65536`, so one run can raise it without editing
+     * vite.config.
+     */
+    networkBodyMaxChars?: number;
     /**
      * Retain a FAILED request's response body even with `captureNetworkBodies` off. Default true.
      *
@@ -195,8 +208,6 @@ export interface ReticleVitePlugin {
             };
         };
     };
-    /** Absent in desktop mode, where the plugin must also run for `vite build`. */
-    apply?: 'serve';
     enforce: 'pre';
     transform: (code: string, id: string) => {
         code: string;
@@ -313,14 +324,14 @@ export declare function connectModuleSource(options: ReticleVitePluginOptions, d
  * import { reticle } from '@reticlehq/vite-plugin';
  * export default defineConfig({ plugins: [react(), reticle()] });
  *
- * `apply: 'serve'` means Vite drops the plugin entirely from `vite build`, so a web production
- * bundle is never instrumented — gating is the tool's job, not a user-managed env check.
+ * The web plugin also builds, replacing the browser SDK with an inert stub so a default
+ * production bundle ships no Reticle runtime code at all.
  *
  * `desktop: true` is the ONE documented exception, and it inverts that guarantee deliberately: a
- * packaged Electron/Tauri renderer IS a production build with no dev server, so serve-only gating
- * would ship an app with no connect() at all. The cost is that the flag hands gating back to the
- * caller — keep it behind your own dev-only build target so an instrumented bundle can never reach
- * a release binary.
+ * packaged Electron/Tauri renderer IS a production build with no dev server, so the web default's
+ * stub-replacement would ship an app with no connect() at all. The cost is that the flag hands
+ * gating back to the caller — keep it behind your own dev-only build target so an instrumented
+ * bundle can never reach a release binary.
  */
 /**
  * The daemon's journal directory, as a matcher every chokidar major honours.

package/dist/index.d.ts

@@ -72,9 +72,8 @@ export interface ReticleVitePluginOptions {
      * This build is an Electron/Tauri renderer. Changes two things a desktop shell needs and a web app
      * must not get:
      *
-     *  - The plugin also applies to `vite build`. A packaged desktop renderer IS a production build
-     *    loaded from `file://` or a custom protocol — there is no dev server — so the default
-     *    `apply: 'serve'` drops the plugin entirely and the app ships with no `connect()` at all.
+     *  - A packaged desktop renderer IS a production build with no dev server, so it needs the real
+     *    `connect()` wiring during `vite build` — the web default's stub-swap must not apply to it.
      *  - `connect()` is called with `allowInProduction`, because that same renderer reports
      *    NODE_ENV=production and the SDK's prod backstop would otherwise refuse to start.
      *
@@ -95,6 +94,20 @@ export interface ReticleVitePluginOptions {
      * Also settable as `VITE_RETICLE_CAPTURE_BODIES=1`.
      */
     captureNetworkBodies?: boolean;
+    /**
+     * Per-body character cap for captured bodies. Default 8192; clamped to [256, 262144].
+     *
+     * Reachable here for the reason `captureNetworkBodies` is: the plugin is the only `connect()`
+     * most apps ever have, so an SDK option the plugin cannot pass is an option that does not exist.
+     *
+     * Raise it to make a NEGATIVE `bodyContains` decidable -- a negation is checked over the whole
+     * payload, so on a list endpoint bigger than the cap it is permanently undecidable, and that is
+     * the class that proves "this dangerous field is absent from every row" (#799).
+     *
+     * Also settable as `VITE_RETICLE_BODY_MAX_CHARS=65536`, so one run can raise it without editing
+     * vite.config.
+     */
+    networkBodyMaxChars?: number;
     /**
      * Retain a FAILED request's response body even with `captureNetworkBodies` off. Default true.
      *
@@ -195,8 +208,6 @@ export interface ReticleVitePlugin {
             };
         };
     };
-    /** Absent in desktop mode, where the plugin must also run for `vite build`. */
-    apply?: 'serve';
     enforce: 'pre';
     transform: (code: string, id: string) => {
         code: string;
@@ -313,14 +324,14 @@ export declare function connectModuleSource(options: ReticleVitePluginOptions, d
  * import { reticle } from '@reticlehq/vite-plugin';
  * export default defineConfig({ plugins: [react(), reticle()] });
  *
- * `apply: 'serve'` means Vite drops the plugin entirely from `vite build`, so a web production
- * bundle is never instrumented — gating is the tool's job, not a user-managed env check.
+ * The web plugin also builds, replacing the browser SDK with an inert stub so a default
+ * production bundle ships no Reticle runtime code at all.
  *
  * `desktop: true` is the ONE documented exception, and it inverts that guarantee deliberately: a
- * packaged Electron/Tauri renderer IS a production build with no dev server, so serve-only gating
- * would ship an app with no connect() at all. The cost is that the flag hands gating back to the
- * caller — keep it behind your own dev-only build target so an instrumented bundle can never reach
- * a release binary.
+ * packaged Electron/Tauri renderer IS a production build with no dev server, so the web default's
+ * stub-replacement would ship an app with no connect() at all. The cost is that the flag hands
+ * gating back to the caller — keep it behind your own dev-only build target so an instrumented
+ * bundle can never reach a release binary.
  */
 /**
  * The daemon's journal directory, as a matcher every chokidar major honours.

package/dist/index.js

@@ -3,14 +3,15 @@ import { missingTokenWarning } from './token/missing-token.js';
 import { ensurePairingToken } from './token/ensure-token.js';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { transformSync } from '@babel/core';
-import reticleSource from '@reticlehq/babel-plugin';
-import { RETICLE_DEFAULT_PORT, RETICLE_RENDER_PREHOOK, bridgeWsUrl, ReticleDir, ReticleEnv, RETICLE_ROOT_GLOBAL, RETICLE_SDK_VERSION_GLOBAL, } from '@reticlehq/core';
+import { RETICLE_RENDER_PREHOOK, ReticleDir, ReticleEnv, RETICLE_ROOT_GLOBAL, RETICLE_SDK_VERSION_GLOBAL, } from '@reticlehq/core';
 import { resolveProjectId } from './project-id.js';
 import { discoverDaemonPort } from './discover-port.js';
 import { announceDevServer } from './announce.js';
-import { SVELTE_FILE, stampSvelte } from './svelte-source.js';
+import { stampSvelte } from './svelte-source.js';
+import { ignoredFileNotice, optsOutOfStamping, shouldStamp, shouldStampSvelte, stamp, } from './stamping.js';
 import { resolvableChain, sdkPackageVersion, sdkBuildFingerprint, viteMajor, optimizerOptionsKey, optimizerOptions, } from './installed.js';
+import { RETICLE_DISABLED_STUB_CODE, RETICLE_DISABLED_STUB, isReticleDisabledWebBuild, } from './disabled-browser-stub.js';
+import { connectArgs } from './connect-args.js';
 import { createInjectionWatch, notInjectedMessage, } from './injection-postcondition.js';
 import { RETICLE_VITE_PLUGIN_NAME } from './plugin-name.js';
 export { RETICLE_VITE_PLUGIN_NAME } from './plugin-name.js';
@@ -26,11 +27,6 @@ const RETICLE_SENSOR = '@reticlehq/browser';
  * file it lives in.
  */
 export const RETICLE_TOKEN_GLOBAL = '__RETICLE_TOKEN__';
-/** Files we stamp with source info — JSX/TSX only. */
-const JSX_FILE = /\.[jt]sx$/;
-/** Rollup virtual-module ids start with a NUL byte; never transform those. */
-const VIRTUAL_PREFIX = '\0';
-const NODE_MODULES = 'node_modules';
 /**
  * The connect code is served as a real module (not an inline <script>) so that Vite's import
  * pipeline resolves the bare `@reticlehq/react` specifier. An inline injected script is NOT run through
@@ -132,40 +128,6 @@ function isHtmlEntry(id, specifier, root) {
     // buildEnd post-condition means a wrong match cannot pass unnoticed as "nothing happened".
     return candidate.endsWith(target.startsWith('/') ? target : `/${target}`);
 }
-/** A module id we may stamp at all: not virtual, not a dependency. Extension decides which stamper. */
-function stampableId(id) {
-    if (id.startsWith(VIRTUAL_PREFIX))
-        return null;
-    if (id.includes(NODE_MODULES))
-        return null;
-    // Strip any query suffix (?worker, ?raw,...) before matching the extension.
-    return id.split('?')[0] ?? id;
-}
-function shouldStamp(id) {
-    const clean = stampableId(id);
-    return clean !== null && JSX_FILE.test(clean);
-}
-/** A `.svelte` single-file component, which needs the Svelte stamper rather than Babel. */
-function shouldStampSvelte(id) {
-    const clean = stampableId(id);
-    return clean !== null && SVELTE_FILE.test(clean);
-}
-function stamp(code, id) {
-    const out = transformSync(code, {
-        filename: id,
-        plugins: [reticleSource],
-        parserOpts: { plugins: ['jsx', 'typescript'] },
-        sourceMaps: true,
-        configFile: false,
-        babelrc: false,
-    });
-    if (out?.code === undefined || null === out.code)
-        return null;
-    return {
-        code: out.code,
-        map: out.map === undefined || null === out.map ? null : JSON.stringify(out.map),
-    };
-}
 /**
  * Read the daemon's auto-provisioned pairing token (~/.reticle/pairing-token, or the
  * RETICLE_PAIRING_TOKEN_DIR override) so the served app can present it. Node-side only — a browser
@@ -196,60 +158,6 @@ function warnIfTokenMissing(token) {
     }
     return token;
 }
-/** Build the `reticle.connect` argument literal — only includes keys the user set. */
-function connectArgs(options) {
-    const args = {};
-    const port = options.port ?? RETICLE_DEFAULT_PORT;
-    if (port !== RETICLE_DEFAULT_PORT)
-        args['url'] = bridgeWsUrl(port);
-    if (options.session !== undefined)
-        args['session'] = options.session;
-    if (options.projectId !== undefined)
-        args['projectId'] = options.projectId;
-    if (options.token !== undefined)
-        args['token'] = options.token;
-    // Passed as connect ARGUMENTS, not as a `define`. A define substitutes a bare identifier in the
-    // source it transforms; the SDK reads these as `globalThis[NAME]`, a dynamic lookup no define can
-    // ever reach — so defining them looked right, shipped, and did nothing. Baking them into the
-    // generated connect call is a literal in generated source: no bundler subtleties, works the same
-    // in dev and in a desktop build.
-    if (options.root !== undefined && options.root.length > 0)
-        args['root'] = options.root;
-    if (options.sdkVersion !== undefined && options.sdkVersion.length > 0) {
-        args['sdkVersion'] = options.sdkVersion;
-    }
-    // A desktop renderer is a production build by construction; without this the SDK's prod backstop
-    // refuses to connect and the app is silently uninstrumented.
-    if (true === options.desktop)
-        args['allowInProduction'] = true;
-    // Env wins nothing — it only turns the flag ON, so a config that never set it can still be
-    // switched on for one debugging session without editing vite.config and restarting the mental
-    // model with it.
-    if (true === options.captureNetworkBodies || '1' === process.env['VITE_RETICLE_CAPTURE_BODIES']) {
-        args['captureNetworkBodies'] = true;
-    }
-    // Only the OPT-OUT is announced, never the default. The daemon reads absence as "unknown", so
-    // sending `true` here would say nothing it does not already assume — while sending `false` is the
-    // one fact a red verdict needs to stop prescribing a plugin this project has deliberately muted.
-    if (false === options.sourceMapping)
-        args['sourceMapping'] = false;
-    // The one option that defaults ON, so the env var and the config flag both DISABLE rather than
-    // enable. Emitted only when switched off; the default stays implicit in the SDK.
-    if (false === options.captureErrorBodies || '1' === process.env['VITE_RETICLE_NO_ERROR_BODIES']) {
-        args['captureErrorBodies'] = false;
-    }
-    // Same shape, same reason. Off unless asked for, in a config or for one session.
-    if (true === options.exposePresenter || '1' === process.env['VITE_RETICLE_EXPOSE_PRESENTER']) {
-        args['exposePresenter'] = true;
-    }
-    // Same shape, same reason: without it an app that cannot be served on localhost has no way to
-    // reach the SDK option at all. The pairing token still applies — see the option's docstring.
-    if (true === options.allowNonLocalhost ||
-        '1' === process.env['VITE_RETICLE_ALLOW_NON_LOCALHOST']) {
-        args['allowNonLocalhost'] = true;
-    }
-    return Object.keys(args).length > 0 ? JSON.stringify(args) : '';
-}
 /** The body of the connect module — real imports, resolved by Vite when the module is served. */
 /**
  * The conventional app-side dev module: `registerStore` / `registerCapabilities` live here.
@@ -333,14 +241,14 @@ export function connectModuleSource(options, devModule = null) {
  * import { reticle } from '@reticlehq/vite-plugin';
  * export default defineConfig({ plugins: [react(), reticle()] });
  *
- * `apply: 'serve'` means Vite drops the plugin entirely from `vite build`, so a web production
- * bundle is never instrumented — gating is the tool's job, not a user-managed env check.
+ * The web plugin also builds, replacing the browser SDK with an inert stub so a default
+ * production bundle ships no Reticle runtime code at all.
  *
  * `desktop: true` is the ONE documented exception, and it inverts that guarantee deliberately: a
- * packaged Electron/Tauri renderer IS a production build with no dev server, so serve-only gating
- * would ship an app with no connect() at all. The cost is that the flag hands gating back to the
- * caller — keep it behind your own dev-only build target so an instrumented bundle can never reach
- * a release binary.
+ * packaged Electron/Tauri renderer IS a production build with no dev server, so the web default's
+ * stub-replacement would ship an app with no connect() at all. The cost is that the flag hands
+ * gating back to the caller — keep it behind your own dev-only build target so an instrumented
+ * bundle can never reach a release binary.
  */
 /**
  * The daemon's journal directory, as a matcher every chokidar major honours.
@@ -378,6 +286,8 @@ export function reticle(options = {}) {
     const warn = options.onWarn ?? ((message) => globalThis.console.warn(message));
     /** Whether connect() actually reached a module — asserted at buildEnd, never assumed. */
     let injected = false;
+    /** Files already announced as opted out of stamping: one line each, for the life of the server. */
+    const announcedIgnored = new Set();
     /**
      * Whether Vite ever asked us to transform the app's HTML.
      *
@@ -426,10 +336,6 @@ export function reticle(options = {}) {
     });
     return {
         name: RETICLE_VITE_PLUGIN_NAME,
-        // Web: serve-only, so a production bundle can never carry the SDK — gating is the tool's job.
-        // Desktop: a packaged renderer IS a production build with no dev server, so the plugin must also
-        // run for `vite build` or the shipped app has no connect() at all.
-        ...(true === options.desktop ? {} : { apply: 'serve' }),
         enforce: 'pre',
         /**
          * Declare the SDK itself and the optimizer cache fingerprint.
@@ -511,6 +417,8 @@ export function reticle(options = {}) {
             };
         },
         transform(code, id) {
+            if (isReticleDisabledWebBuild(desktop, command))
+                return null;
             // Desktop injection: prepend connect() to the HTML's own entry module. It is a REAL module, so
             // its bare `@reticlehq/react` import resolves through the normal pipeline in both dev and
             // build — which a virtual <script src> only ever did in dev.
@@ -522,6 +430,16 @@ export function reticle(options = {}) {
             }
             if (!sourceMapping)
                 return null;
+            // Decided HERE, ahead of both stampers, so the Svelte path honours the marker too and so the
+            // opt-out is announced once regardless of which stamper would have run. The Babel plugin reads
+            // the same marker on its own for the callers that reach it without Vite (#853).
+            if (optsOutOfStamping(code, id)) {
+                if (!announcedIgnored.has(id)) {
+                    announcedIgnored.add(id);
+                    warn(ignoredFileNotice(id));
+                }
+                return null;
+            }
             // `.svelte` runs on the RAW component source, which is only still markup because this plugin
             // declares `enforce: 'pre'` and therefore transforms before @sveltejs/vite-plugin-svelte. No
             // map: the insertions are within a line and never move one, and a wrong map is worse than none.
@@ -534,6 +452,9 @@ export function reticle(options = {}) {
             return stamp(code, id);
         },
         resolveId(id, importer) {
+            if (isReticleDisabledWebBuild(desktop, command) && id === RETICLE_SENSOR) {
+                return RETICLE_DISABLED_STUB;
+            }
             // Desktop: remember the module the HTML points at, so `transform` can prepend connect() into
             // it. A packaged build has no dev server, so the serve-time trick below — a <script src> at a
             // virtual URL — would emit a tag pointing at a file that does not exist. That shipped an app
@@ -549,6 +470,9 @@ export function reticle(options = {}) {
             return inject && id === RETICLE_CONNECT_MODULE ? RETICLE_CONNECT_MODULE : null;
         },
         load(id) {
+            if (isReticleDisabledWebBuild(desktop, command) && id === RETICLE_DISABLED_STUB) {
+                return RETICLE_DISABLED_STUB_CODE;
+            }
             if (!inject || id !== RETICLE_CONNECT_MODULE)
                 return null;
             const source = currentConnectSource();
@@ -672,6 +596,8 @@ export function reticle(options = {}) {
         checkHtmlHookForTest: watch.checkHtmlHookRan,
         injectionWatchForTest: watch,
         transformIndexHtml() {
+            if (isReticleDisabledWebBuild(desktop, command))
+                return [];
             htmlTransformed = true;
             if (desktop && inject && 'serve' === command)
                 watch.armDesktopCheck();

package/dist/stamping.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Which files get a `data-reticle-source` stamp, and how.
+ *
+ * Split out of index.ts when that file crossed the line cap while gaining the per-file opt-out.
+ * This is one concern — a module id comes in, and either a stamper runs on it, nothing does, or the
+ * file has asked to be left alone — and it changes for one reason (the source-pointer feature)
+ * rather than for the dozen the plugin's lifecycle does. The Svelte stamper is its sibling module;
+ * the JSX one is `@reticlehq/babel-plugin`, which also reads the opt-out on its own for the callers
+ * that reach it without Vite.
+ */
+/** A module id we may stamp at all: not virtual, not a dependency. Extension decides which stamper. */
+export declare function stampableId(id: string): string | null;
+export declare function shouldStamp(id: string): boolean;
+/** A `.svelte` single-file component, which needs the Svelte stamper rather than Babel. */
+export declare function shouldStampSvelte(id: string): boolean;
+export declare function stamp(code: string, id: string): {
+    code: string;
+    map: string | null;
+} | null;
+/**
+ * Has this file asked not to be stamped?
+ *
+ * Decided ahead of BOTH stampers, so the Svelte path honours the marker too and so the opt-out is
+ * announced once regardless of which stamper would have run. Only a file one of them would have
+ * touched can opt out — an id that was never stampable has nothing to announce (#853).
+ */
+export declare function optsOutOfStamping(code: string, id: string): boolean;
+/**
+ * The one line said when a file opts out of source stamping with `@reticle-ignore`.
+ *
+ * Not silent, on purpose. An opt-out nobody is told about is an opt-out somebody forgets, and the
+ * `file:line` it would have produced quietly stops resolving months later with nothing to point at
+ * the comment. Said once per file, in the dev-server output where the person who added the comment
+ * will see it. Exported for the test that pins the wording.
+ */
+export declare function ignoredFileNotice(id: string): string;

package/dist/stamping.js

@@ -0,0 +1,99 @@
+/**
+ * Which files get a `data-reticle-source` stamp, and how.
+ *
+ * Split out of index.ts when that file crossed the line cap while gaining the per-file opt-out.
+ * This is one concern — a module id comes in, and either a stamper runs on it, nothing does, or the
+ * file has asked to be left alone — and it changes for one reason (the source-pointer feature)
+ * rather than for the dozen the plugin's lifecycle does. The Svelte stamper is its sibling module;
+ * the JSX one is `@reticlehq/babel-plugin`, which also reads the opt-out on its own for the callers
+ * that reach it without Vite.
+ */
+import { transformSync } from '@babel/core';
+import reticleSource from '@reticlehq/babel-plugin';
+import { isSourceStampingIgnored } from '@reticlehq/babel-plugin/ignore';
+import { RETICLE_IGNORE_MARKER } from '@reticlehq/core';
+import { SVELTE_FILE } from './svelte-source.js';
+/** Files we stamp with source info — JSX/TSX only. */
+const JSX_FILE = /\.[jt]sx$/;
+/** Rollup virtual-module ids start with a NUL byte; never transform those. */
+const VIRTUAL_PREFIX = '\0';
+const NODE_MODULES = 'node_modules';
+/** A module id we may stamp at all: not virtual, not a dependency. Extension decides which stamper. */
+export function stampableId(id) {
+    if (id.startsWith(VIRTUAL_PREFIX))
+        return null;
+    if (id.includes(NODE_MODULES))
+        return null;
+    // Strip any query suffix (?worker, ?raw,...) before matching the extension.
+    return id.split('?')[0] ?? id;
+}
+/**
+ * A test file, by the names every JS test runner agrees on.
+ *
+ * `.test.`/`.spec.` before the extension, or anywhere under a `__tests__` directory. Anchored to a
+ * path SEGMENT and a dot so `TestBanner.tsx`, `latest.tsx` and `contest.tsx` stay ordinary
+ * components — they are somebody's app, and skipping them would silently cost source mapping.
+ */
+const TEST_FILE = /(?:\.(?:test|spec)\.[^./]+$)|(?:^|\/)__tests__\//;
+export function shouldStamp(id) {
+    const clean = stampableId(id);
+    if (null === clean)
+        return false;
+    /*
+     * A test file is not the app under test.
+     *
+     * Nothing reads `data-reticle-source` on one — an agent inspects the app's DOM, never a test's —
+     * so stamping them is pure cost, charged per file on every run, and reported from the field as
+     * nearly doubling a large jsdom suite and failing a test that passed without instrumentation:
+     * inserting attributes into JSX is exactly what an assertion on rendered output notices (#995).
+     *
+     * Cut on the NAME rather than on "are we under Vitest": `vitest-browser.ts` records what happened
+     * the last time that was cut on the `VITEST` env var, which also reads true when a Vitest suite
+     * boots an app in order to test it. A name check cannot make that mistake.
+     */
+    if (TEST_FILE.test(clean))
+        return false;
+    return JSX_FILE.test(clean);
+}
+/** A `.svelte` single-file component, which needs the Svelte stamper rather than Babel. */
+export function shouldStampSvelte(id) {
+    const clean = stampableId(id);
+    return clean !== null && SVELTE_FILE.test(clean);
+}
+export function stamp(code, id) {
+    const out = transformSync(code, {
+        filename: id,
+        plugins: [reticleSource],
+        parserOpts: { plugins: ['jsx', 'typescript'] },
+        sourceMaps: true,
+        configFile: false,
+        babelrc: false,
+    });
+    if (out?.code === undefined || null === out.code)
+        return null;
+    return {
+        code: out.code,
+        map: out.map === undefined || null === out.map ? null : JSON.stringify(out.map),
+    };
+}
+/**
+ * Has this file asked not to be stamped?
+ *
+ * Decided ahead of BOTH stampers, so the Svelte path honours the marker too and so the opt-out is
+ * announced once regardless of which stamper would have run. Only a file one of them would have
+ * touched can opt out — an id that was never stampable has nothing to announce (#853).
+ */
+export function optsOutOfStamping(code, id) {
+    return (shouldStamp(id) || shouldStampSvelte(id)) && isSourceStampingIgnored(code);
+}
+/**
+ * The one line said when a file opts out of source stamping with `@reticle-ignore`.
+ *
+ * Not silent, on purpose. An opt-out nobody is told about is an opt-out somebody forgets, and the
+ * `file:line` it would have produced quietly stops resolving months later with nothing to point at
+ * the comment. Said once per file, in the dev-server output where the person who added the comment
+ * will see it. Exported for the test that pins the wording.
+ */
+export function ignoredFileNotice(id) {
+    return `[reticle] ${id} opts out of source stamping (${RETICLE_IGNORE_MARKER} on its first line) — elements in it will have no file:line.`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reticlehq/vite-plugin",
-  "version": "3.1.0",
+  "version": "3.3.0",
   "description": "Vite plugin for Reticle: dev-only source-map stamping plus auto-injected reticle.connect(). apply:'serve' guarantees it never ships to production.",
   "type": "module",
   "license": "Apache-2.0",
@@ -41,15 +41,15 @@
   ],
   "dependencies": {
     "@babel/core": "^7.26.0",
-    "@reticlehq/babel-plugin": "3.1.0",
-    "@reticlehq/core": "3.1.0"
+    "@reticlehq/babel-plugin": "3.3.0",
+    "@reticlehq/core": "3.3.0"
   },
   "devDependencies": {
     "@types/babel__core": "^7.20.5",
     "esbuild": "^0.28.2",
     "svelte": "^5.56.10",
     "vite": "^8",
-    "@reticlehq/react": "3.1.0"
+    "@reticlehq/react": "3.3.0"
   },
   "peerDependencies": {
     "vite": ">=4"