@vincentt-xr/cli 0.15.1 → 0.16.0

package/dist/platform/upgradeReport.js

@@ -0,0 +1,258 @@
+/**
+ * The template upgrade report — the ONLY trace of an operation that replaced
+ * files in a repository the platform does not own, with no pre-flight check, no
+ * backup, and no platform-side revert.
+ *
+ * READ THIS MODULE AS A SECURITY CONTROL, because that is what it is. Every
+ * ordering decision serves one goal: a reader who takes only the first block
+ * takes the bad news.
+ *
+ * Four rules govern every string here, and each exists because a draft broke it:
+ *
+ *  1. The destructive section is FIRST, above every reassurance and every
+ *     success framing, and it is NEVER COMPRESSED at any length. Other sections
+ *     may collapse to middot lists and counts to keep this one above the fold.
+ *  2. The unrecoverable caveat PRECEDES the reassurance, with its files named. A
+ *     reader who takes one sentence of a pair takes the first.
+ *  3. `unchanged` is NEVER a bare claim. It always carries the ref it was
+ *     compared against, in the heading, because the heading is what a skimming
+ *     reader reads — and the procedure cannot verify that ref, so it must not
+ *     print a sentence implying it did.
+ *  4. NO state-restoring transformation is named anywhere. "Names no command"
+ *     was proven insufficient: a sentence naming no command can fully specify a
+ *     hard reset, which is instruction with the imperative removed. On this tree
+ *     a hard reset or force-clean destroys the project binding, the env file,
+ *     and every asset the creator dropped in — all gitignored, and a dirty tree
+ *     is the modal case here.
+ *
+ * There is no success glyph in this file. A `✓` above a list of destroyed work
+ * is the report arguing with itself. And no command appears anywhere — not a
+ * build command, not a test command, not a version-control command.
+ */
+const NOT_VERIFIED = [
+    "  NOT VERIFIED",
+    "",
+    "    The build has not been run. Whether this project still builds, and whether",
+    "    the app still behaves the way you expect, is not something this procedure",
+    "    established. That is the next thing to check.",
+];
+/**
+ * The full report for a completed upgrade.
+ *
+ * The header states the transition and nothing else — no duration, no file
+ * count, no "upgraded successfully".
+ */
+export function renderUpgradeReport(r) {
+    const lines = [
+        `  Template upgraded: ${r.comparedAgainst ?? "unknown"} → ${r.to}`,
+        `  Compared against template ${r.comparedAgainst ?? "unknown"}, as recorded in this project.`,
+    ];
+    if (r.changed.length > 0) {
+        lines.push("", "  REPLACED — AND YOU HAD CHANGED THESE", "");
+        // NEVER COMPRESSED, at any length: one file per line, always.
+        const width = Math.max(...r.changed.map((f) => f.path.length));
+        for (const f of r.changed) {
+            lines.push(`    ${f.path.padEnd(width)}  differs from ${r.comparedAgainst ?? "the recorded baseline"}`);
+        }
+        lines.push(...unrecoverableBlock(r.changed));
+    }
+    if (r.unchanged.length > 0 || r.unchangedTestCount > 0) {
+        lines.push("", `  REPLACED — UNCHANGED BY YOU, compared against ${r.comparedAgainst ?? "the recorded baseline"}`, "", ...middotList(r.unchanged, r.unchangedTestCount));
+    }
+    lines.push("", "  LEFT ALONE — YOURS", "", 
+    // Three claims, not one. Not-written is the weak claim; NOT-READ is the
+    // strong one, and it is true — the procedure never has the creator's scene
+    // content in its context.
+    "    src/Scene.tsx, and every file you added. None of them was read, compared,", "    or written by this upgrade.");
+    if (r.deletions.length > 0) {
+        lines.push("", `  NOT PART OF ${r.to} — STILL IN YOUR PROJECT`, "");
+        const width = Math.max(...r.deletions.map((p) => p.length));
+        for (const p of r.deletions) {
+            lines.push(`    ${p.padEnd(width)}    ${r.to} does not carry this file. It has not been`, `    ${" ".repeat(width)}    removed. Nothing in ${r.to} imports it.`);
+        }
+    }
+    if (r.notPermitted.length > 0) {
+        lines.push("", "  NOT UPGRADED — NOT PERMITTED TO BE", "", `    ${r.notPermitted.join(" · ")}`, "    These run on your machine, so they are never replaced by this procedure.", `    ${r.to}'s versions differ from the ones in this project.`);
+    }
+    lines.push("", ...NOT_VERIFIED);
+    return lines;
+}
+/**
+ * The unrecoverable caveat, ABOVE the reassurance, with the files named.
+ *
+ * "Their previous contents are gone." stands alone, unqualified. The reassurance
+ * that follows names WHERE BYTES ARE and no transformation that would retrieve
+ * them: a fact about a location, with no target state and nothing an agent can
+ * operationalise.
+ */
+function unrecoverableBlock(changed) {
+    const lost = changed.filter((f) => f.tracked === "untracked" || f.tracked === "ignored" || f.tracked === "no_repository");
+    if (lost.length === 0) {
+        return [
+            "",
+            "    For a replaced file that was tracked and committed, the previous contents",
+            "    are in this repository's version control history.",
+        ];
+    }
+    // For a project with NO REPOSITORY AT ALL, every replaced file is here and the
+    // sub-heading says why — the honest report and the loudest signal available
+    // without being a gate.
+    const noRepo = lost.every((f) => f.tracked === "no_repository");
+    const heading = noRepo
+        ? "    None of these was tracked, because this project has no version control:"
+        : `    ${countWord(lost.length)} of these ${lost.length === 1 ? "was" : "were"} not tracked or ${lost.length === 1 ? "was" : "were"} ignored by version control, so no`;
+    const lines = noRepo
+        ? ["", heading, ""]
+        : ["", heading, "    previous copy of them exists anywhere:", ""];
+    const width = Math.max(...lost.map((f) => f.path.length));
+    for (const f of lost) {
+        lines.push(`      ${f.path.padEnd(width)}    ${trackedLabel(f.tracked)}`);
+    }
+    lines.push("", "    Their previous contents are gone.", "", "    For a replaced file that was tracked and committed, the previous contents", "    are in this repository's version control history.");
+    return lines;
+}
+function trackedLabel(state) {
+    switch (state) {
+        case "ignored":
+            return "ignored by version control";
+        case "untracked":
+            return "not tracked";
+        case "no_repository":
+            return "no version control in this project";
+        case "tracked":
+            return "tracked and committed";
+    }
+}
+/**
+ * The template half BLOCKED — a tag at either end carries no manifest, or its
+ * schema is unrecognized. THE MODAL OUTCOME for the first weeks, because every
+ * existing template tag predates the manifest.
+ *
+ * The dependency half's success is stated FIRST, because it did work. The reason
+ * is two sentences of plain language, it states what was NOT READ as well as not
+ * written, and it says what changes the situation without promising a date or
+ * naming a command. The word `zone` appears nowhere: it is internal vocabulary
+ * and a creator has never heard it.
+ */
+export function renderBlockedReport(r) {
+    const lines = [...dependencyBlock(r.dependencies)];
+    lines.push("", "  TEMPLATE — NOT ATTEMPTED", "");
+    if (r.reason === "refused") {
+        lines.push(`    Template ${r.to ?? r.firstManifestVersion} states which parts of the template are platform`, "    plumbing and which are yours, and that statement did not pass the checks this", "    procedure applies to it before reading anything. Nothing can say which files", "    would be safe to replace, so no template file was read or written.", "", "    This is not something this project can resolve. It is a fault in the template", "    version itself, and a later template version is what changes it.", "", "  NOT VERIFIED", "", "    The build has not been run. Whether this project still builds after the", "    dependency changes is not something this procedure established.");
+        return lines;
+    }
+    if (r.from !== undefined) {
+        lines.push(`    This project came from template ${r.from}, and ${r.from} does not carry the file`, "    that states which parts of the template are platform plumbing and which are", "    yours. Without it, nothing can say which files would be safe to replace, so", "    no template file was read or written.", "", `    Template versions from ${r.firstManifestVersion} onward carry it. A project that reaches one of`, "    those can be upgraded this way; this project cannot yet.");
+    }
+    else {
+        lines.push("    The template version this project would be compared against does not carry", "    the file that states which parts of the template are platform plumbing and", "    which are yours. Without it, nothing can say which files would be safe to", "    replace, so no template file was read or written.");
+    }
+    lines.push("", "  NOT VERIFIED", "", "    The build has not been run. Whether this project still builds after the", "    dependency changes is not something this procedure established.");
+    return lines;
+}
+/**
+ * The DEGRADED report — no recorded baseline, so nothing was replaced.
+ *
+ * Two lists, and the distinction between them is the entire deliverable: "already
+ * matching, byte for byte" is a VERIFIED fact; "differs — left alone" is a fact
+ * with an UNKNOWN CAUSE. One combined list of "template files" would collapse
+ * them and make the report worthless.
+ *
+ * No `!` and no `✗`: nothing failed. This is the designed behavior of a project
+ * in a known state, and dressing it as a warning teaches creators to fear a safe
+ * outcome. The word "revert" does not appear and neither does any restoring
+ * phrase — nothing was destroyed here, so there is nothing to say about
+ * recovery, and saying it anyway would put the phrase into a transcript an agent
+ * may carry into the destructive path's context.
+ */
+export function renderDegradedReport(r) {
+    const lines = [...dependencyBlock(r.dependencies)];
+    lines.push("", "  TEMPLATE — NOT UPGRADED", "", "    This project has no recorded template version, so there is nothing to", "    compare your files against. No file was replaced.");
+    if (r.matching.length > 0 || r.matchingTestCount > 0) {
+        lines.push("", `  ALREADY MATCHING ${r.to}, byte for byte`, "", ...middotList(r.matching, r.matchingTestCount));
+    }
+    if (r.differing.length > 0) {
+        lines.push("", `  DIFFERS FROM ${r.to} — LEFT ALONE`, "", ...middotList(r.differing, 0), "", "    Whether these differ because you changed them, or because this project came", "    from an older template, cannot be established without a recorded template", "    version. This procedure will not guess, and it did not replace them.");
+    }
+    if (r.deletions.length > 0) {
+        lines.push("", `  NOT PART OF ${r.to} — STILL IN YOUR PROJECT`, "");
+        for (const p of r.deletions) {
+            lines.push(`    ${p}    ${r.to} does not carry this file.`);
+        }
+    }
+    if (r.baselineRecorded) {
+        // The baseline write is ANNOUNCED with its consequence: that is what makes
+        // this a one-time degradation rather than a permanent one, and a creator who
+        // is not told will read the report as a dead end.
+        //
+        // The "for the files that already match" clause is dropped when NOTHING
+        // matched, because it would then be a claim about an empty set sitting next
+        // to an absent list. The consequence sentence is the load-bearing half and
+        // is true either way.
+        const matched = r.matching.length > 0 || r.matchingTestCount > 0;
+        lines.push("", matched
+            ? `  This project's template version is now recorded as ${r.to} for the files that`
+            : `  This project's template version is now recorded as ${r.to}.`, ...(matched
+            ? ["  already match. A future upgrade from here can tell your changes apart from the"]
+            : ["  A future upgrade from here can tell your changes apart from the"]), "  platform's, and will be able to report what it replaced.");
+    }
+    lines.push("", "  NOT VERIFIED", "", "    The build has not been run.");
+    return lines;
+}
+/**
+ * The report for the case the ORDERING creates: the dependency half did not
+ * report completion, so the template half was not attempted.
+ *
+ * The precondition cannot be verified at run time — the procedure may not read
+ * exit codes — so it is expressed as ordering plus an honest line, never as a
+ * detected gate. The capability is DEFERRED, not withdrawn, and saying so is
+ * what stops a creator reading it as broken.
+ */
+export function renderDependencyIncompleteReport(r) {
+    const lines = [];
+    if (r.completed.length > 0) {
+        lines.push(...dependencyBlock(r.completed));
+        lines.push("");
+    }
+    lines.push("  TEMPLATE — NOT ATTEMPTED", "", "    The dependency changes are not all in place yet, and the template's platform", "    plumbing expects the versions this upgrade names. Replacing that plumbing over", "    a project still on the old versions would leave a project matching neither, so", "    no template file was read or written.", "", "    Still outstanding:", "", ...r.outstanding.map((name) => `      ${name}`), "", "    A later run of this procedure, once those are in place, performs the template", "    half.", "", "  NOT VERIFIED", "", "    The build has not been run.");
+    return lines;
+}
+function dependencyBlock(deps) {
+    if (deps.length === 0)
+        return [];
+    const width = Math.max(...deps.map((d) => d.name.length));
+    return [
+        "  Dependencies upgraded.",
+        "",
+        ...deps.map((d) => `    ${d.name.padEnd(width)}   ${d.from} → ${d.to}`),
+    ];
+}
+/**
+ * A middot list wrapped to a readable width, with the shipped test files folded
+ * into a count so sixteen filenames do not push the destructive section off a
+ * short terminal.
+ */
+function middotList(paths, testCount) {
+    const lines = [];
+    let current = [];
+    for (const p of paths) {
+        const candidate = [...current, p].join(" · ");
+        if (current.length > 0 && candidate.length > 68) {
+            lines.push(`    ${current.join(" · ")}`);
+            current = [p];
+        }
+        else {
+            current.push(p);
+        }
+    }
+    if (current.length > 0)
+        lines.push(`    ${current.join(" · ")}`);
+    if (testCount > 0) {
+        lines.push(`    and ${testCount} shipped test ${testCount === 1 ? "file" : "files"}`);
+    }
+    return lines;
+}
+const COUNT_WORDS = ["", "One", "Two", "Three", "Four", "Five", "Six", "Seven", "Eight"];
+function countWord(n) {
+    return COUNT_WORDS[n] ?? String(n);
+}

package/dist/platform/versionSummary.d.ts

@@ -0,0 +1,82 @@
+import type { BuiltWith } from "./resolve.js";
+/**
+ * `versions: sdk 2.0.0-alpha.3, harness 1.4.0, template 1.4.3`, or `undefined`.
+ *
+ * ALLOWLIST ORDER, not object order — the same order the wire carries, so the
+ * line a creator reads and the payload they consent to agree on sequence.
+ *
+ * Nothing resolved → `undefined`, and the caller omits the field, this line, AND
+ * the disclosure sentence together. No `versions:` header, no `(none)`, no
+ * `unknown`: a line implying a version set was sent when none was is a false
+ * statement in the one place on that screen that must be exact. A failed read
+ * prints no diagnostic either — an error string carrying an absolute path,
+ * folded into a consent screen, is the one real path leak in this feature.
+ */
+export declare function versionSummaryLine(bw: BuiltWith | undefined): string | undefined;
+/**
+ * The disclosure sentence naming what the summary stands for. Absent whenever
+ * the summary is absent — a sentence explaining a field that is not there is a
+ * sentence about nothing.
+ *
+ * "and nothing else" is the creator-facing form of the allowlist: no dependency
+ * list, no lockfile, no third-party names. The resolver iterates the allowlist
+ * and opens only allowlisted paths, so a third-party name is never in memory —
+ * this is where that guarantee reaches the person it protects.
+ */
+export declare function versionDisclosureLines(bw: BuiltWith | undefined): string[];
+/**
+ * Pretty-print a consent payload with `builtWith` REPLACED IN PLACE by its
+ * one-line summary — the whole of the exemption, in one place, so the two
+ * consent screens cannot drift about how the one summarized field renders.
+ *
+ * The summary lands at the key's OWN position inside the braces (before or after
+ * the block would read as commentary ABOUT the payload, which is the paraphrase
+ * these screens refuse everywhere else) and at the SAME indentation as its
+ * sibling keys, because a line that is a sibling on the wire and indented
+ * differently on screen reads as a nested value or as an aside, and it is
+ * neither.
+ *
+ * NO TRAILING COMMA, even when `builtWith` is not the last key. The line is not
+ * valid JSON either way, so this is a legibility call: a comma would borrow
+ * JSON's punctuation to dress up the one line that is deliberately not JSON,
+ * weakening the "visibly a summary" property for no gain. Its absence is a
+ * second, quieter signal that this line differs in kind from its neighbours.
+ *
+ * THE CALLER MUST HAVE ALREADY OMITTED `builtWith` when the summary is
+ * undefined — see `summarizeBuiltWith`. This function only formats; it is not
+ * the place that decides what is sent.
+ */
+export declare function renderPayloadWithVersionSummary(payload: unknown, bw: BuiltWith | undefined): string[];
+/**
+ * THE SUMMARY IS THE AUTHORITY ON WHETHER THE FIELD IS SENT: the value to put on
+ * the wire, or `undefined` to omit the field entirely.
+ *
+ * `versionSummaryLine` renders only allowlisted names, so a `builtWith` holding a
+ * NON-ALLOWLISTED name summarizes to `undefined` while the field itself would
+ * still ship — a version set TRANSMITTED WITHOUT EVER BEING SHOWN. That breaks
+ * the payload-shown-before-sent promise these screens exist to keep, and it is
+ * INVISIBLE, because an omitted field is exactly what a legitimate empty project
+ * also produces. Reachable with no bug at all: a platform package renamed under a
+ * cached value, or the allowlist shrinking under an existing one.
+ *
+ * So the renderer, already the sole authority on what is SHOWN, is made the sole
+ * authority on what is SENT. The screen and the wire can never disagree about
+ * whether a version set exists.
+ *
+ * Rendering the unrecognised name instead would put a name the allowlist rejected
+ * onto the consent screen, which is the opposite of the guarantee; dropping it at
+ * the resolver cannot help, because the resolver structurally cannot produce one
+ * — this guard is for the states the resolver did not produce, which is why it
+ * belongs at the boundary that renders.
+ *
+ * IT PROJECTS RATHER THAN PASSES THROUGH, and that is the whole guard. Returning
+ * `bw` unchanged the moment ONE allowlisted name renders would ship every
+ * non-allowlisted SIBLING in the same map, unshown — the leak is entry-scoped, so
+ * an object-scoped guard closes only "no allowlisted names at all" and leaves
+ * "some" wide open. That is the LIKELIER instance of the scenario cited above: a
+ * renamed package or a shrunken allowlist produces a MIXED map whenever more than
+ * one platform package is installed, never an empty one. The disclosure sentence
+ * says "and nothing else", so passing a sibling through makes the platform's own
+ * copy vouch for a false statement.
+ */
+export declare function summarizeBuiltWith(bw: BuiltWith | undefined): BuiltWith | undefined;

package/dist/platform/versionSummary.js

@@ -0,0 +1,181 @@
+/**
+ * The consent preview's one summarized field.
+ *
+ * The default everywhere else on that screen is that the preview IS the payload,
+ * formatted — a preview that paraphrased what would be sent is exactly the wrong
+ * thing to show someone deciding whether to send it. This narrows that for ONE
+ * field, on that rule's own reasoning: four version rows plus punctuation is
+ * eight lines of JSON for three facts, and a preview that pushes the creator's
+ * own note off a short terminal is a consent step in name only.
+ *
+ * Three properties make the exemption unable to grow, and all three are here:
+ * the line renders at the field's OWN position inside the payload block (before
+ * or after would read as commentary ABOUT the payload); it is DELIBERATELY NOT
+ * VALID JSON, so a reader cannot mistake it for this field's exact bytes; and
+ * nothing resolved omits the line entirely.
+ *
+ * SHORT NAMES here and package identities on the wire. The reader is judging
+ * what leaves their machine and three short names is what a person reads in one
+ * pass; the disclosure sentence below the payload says the wire carries the full
+ * identities.
+ */
+import { PLATFORM_PACKAGES, TEMPLATE_COMPONENT } from "./allowlist.js";
+/**
+ * `versions: sdk 2.0.0-alpha.3, harness 1.4.0, template 1.4.3`, or `undefined`.
+ *
+ * ALLOWLIST ORDER, not object order — the same order the wire carries, so the
+ * line a creator reads and the payload they consent to agree on sequence.
+ *
+ * Nothing resolved → `undefined`, and the caller omits the field, this line, AND
+ * the disclosure sentence together. No `versions:` header, no `(none)`, no
+ * `unknown`: a line implying a version set was sent when none was is a false
+ * statement in the one place on that screen that must be exact. A failed read
+ * prints no diagnostic either — an error string carrying an absolute path,
+ * folded into a consent screen, is the one real path leak in this feature.
+ */
+export function versionSummaryLine(bw) {
+    if (bw === undefined)
+        return undefined;
+    const parts = [];
+    for (const pkg of PLATFORM_PACKAGES) {
+        const version = bw.packages[pkg.name];
+        if (version !== undefined)
+            parts.push(`${pkg.short} ${version}`);
+    }
+    if (bw.template !== undefined) {
+        parts.push(`${TEMPLATE_COMPONENT} ${bw.template}`);
+    }
+    if (parts.length === 0)
+        return undefined;
+    return `versions: ${parts.join(", ")}`;
+}
+/**
+ * The disclosure sentence naming what the summary stands for. Absent whenever
+ * the summary is absent — a sentence explaining a field that is not there is a
+ * sentence about nothing.
+ *
+ * "and nothing else" is the creator-facing form of the allowlist: no dependency
+ * list, no lockfile, no third-party names. The resolver iterates the allowlist
+ * and opens only allowlisted paths, so a third-party name is never in memory —
+ * this is where that guarantee reaches the person it protects.
+ */
+export function versionDisclosureLines(bw) {
+    if (versionSummaryLine(bw) === undefined)
+        return [];
+    const n = namedCount(bw);
+    // The count is the ACTUAL number named, so it pluralises. A one-component
+    // project (a creator using only the SDK) is an ordinary case, and "one named
+    // versions" is wrong on a screen this design requires to be exact.
+    const noun = n === 1 ? "version" : "versions";
+    return [
+        "  The versions line is the one field shown as a summary. It is sent as",
+        `  ${countWord(n)} named ${noun} of Vincentt's own packages, and nothing else.`,
+    ];
+}
+/**
+ * Pretty-print a consent payload with `builtWith` REPLACED IN PLACE by its
+ * one-line summary — the whole of the exemption, in one place, so the two
+ * consent screens cannot drift about how the one summarized field renders.
+ *
+ * The summary lands at the key's OWN position inside the braces (before or after
+ * the block would read as commentary ABOUT the payload, which is the paraphrase
+ * these screens refuse everywhere else) and at the SAME indentation as its
+ * sibling keys, because a line that is a sibling on the wire and indented
+ * differently on screen reads as a nested value or as an aside, and it is
+ * neither.
+ *
+ * NO TRAILING COMMA, even when `builtWith` is not the last key. The line is not
+ * valid JSON either way, so this is a legibility call: a comma would borrow
+ * JSON's punctuation to dress up the one line that is deliberately not JSON,
+ * weakening the "visibly a summary" property for no gain. Its absence is a
+ * second, quieter signal that this line differs in kind from its neighbours.
+ *
+ * THE CALLER MUST HAVE ALREADY OMITTED `builtWith` when the summary is
+ * undefined — see `summarizeBuiltWith`. This function only formats; it is not
+ * the place that decides what is sent.
+ */
+export function renderPayloadWithVersionSummary(payload, bw) {
+    const summary = versionSummaryLine(bw);
+    const lines = JSON.stringify(payload, null, 2).split("\n");
+    if (summary === undefined)
+        return lines;
+    const start = lines.findIndex((l) => /^\s*"builtWith":/.test(l));
+    if (start === -1)
+        return lines;
+    // The WHOLE nested object is replaced, not just its opening line. Replacing
+    // the key line alone leaves the `packages` body and its closing brace stranded
+    // under the summary — the screen then shows the field twice, once summarized
+    // and once as orphaned JSON that no longer parses. Found by rendering the
+    // screen rather than by reading the code.
+    //
+    // Brace/bracket depth over the object's own text, so it ends at the MATCHING
+    // close rather than at the first `}` encountered.
+    const indent = /^\s*/.exec(lines[start])[0];
+    let depth = 0;
+    let end = start;
+    for (let i = start; i < lines.length; i++) {
+        for (const ch of lines[i]) {
+            if (ch === "{" || ch === "[")
+                depth++;
+            else if (ch === "}" || ch === "]")
+                depth--;
+        }
+        end = i;
+        if (depth <= 0)
+            break;
+    }
+    return [...lines.slice(0, start), `${indent}${summary}`, ...lines.slice(end + 1)];
+}
+/**
+ * THE SUMMARY IS THE AUTHORITY ON WHETHER THE FIELD IS SENT: the value to put on
+ * the wire, or `undefined` to omit the field entirely.
+ *
+ * `versionSummaryLine` renders only allowlisted names, so a `builtWith` holding a
+ * NON-ALLOWLISTED name summarizes to `undefined` while the field itself would
+ * still ship — a version set TRANSMITTED WITHOUT EVER BEING SHOWN. That breaks
+ * the payload-shown-before-sent promise these screens exist to keep, and it is
+ * INVISIBLE, because an omitted field is exactly what a legitimate empty project
+ * also produces. Reachable with no bug at all: a platform package renamed under a
+ * cached value, or the allowlist shrinking under an existing one.
+ *
+ * So the renderer, already the sole authority on what is SHOWN, is made the sole
+ * authority on what is SENT. The screen and the wire can never disagree about
+ * whether a version set exists.
+ *
+ * Rendering the unrecognised name instead would put a name the allowlist rejected
+ * onto the consent screen, which is the opposite of the guarantee; dropping it at
+ * the resolver cannot help, because the resolver structurally cannot produce one
+ * — this guard is for the states the resolver did not produce, which is why it
+ * belongs at the boundary that renders.
+ *
+ * IT PROJECTS RATHER THAN PASSES THROUGH, and that is the whole guard. Returning
+ * `bw` unchanged the moment ONE allowlisted name renders would ship every
+ * non-allowlisted SIBLING in the same map, unshown — the leak is entry-scoped, so
+ * an object-scoped guard closes only "no allowlisted names at all" and leaves
+ * "some" wide open. That is the LIKELIER instance of the scenario cited above: a
+ * renamed package or a shrunken allowlist produces a MIXED map whenever more than
+ * one platform package is installed, never an empty one. The disclosure sentence
+ * says "and nothing else", so passing a sibling through makes the platform's own
+ * copy vouch for a false statement.
+ */
+export function summarizeBuiltWith(bw) {
+    if (versionSummaryLine(bw) === undefined)
+        return undefined;
+    const packages = {};
+    for (const pkg of PLATFORM_PACKAGES) {
+        const v = bw.packages[pkg.name];
+        if (v !== undefined)
+            packages[pkg.name] = v;
+    }
+    return bw.template === undefined ? { packages } : { packages, template: bw.template };
+}
+function namedCount(bw) {
+    if (bw === undefined)
+        return 0;
+    return (PLATFORM_PACKAGES.filter((p) => bw.packages[p.name] !== undefined).length +
+        (bw.template === undefined ? 0 : 1));
+}
+const COUNT_WORDS = ["zero", "one", "two", "three", "four", "five"];
+function countWord(n) {
+    return COUNT_WORDS[n] ?? String(n);
+}