create-stitchkit 0.5.0 → 0.6.0

package/template/packages/backend/src/lib/live.ts

@@ -0,0 +1,73 @@
+import { boardContract, liveContract } from '@app/shared';
+import { createWatchHub, type WatchHub } from 'stitchkit/application';
+import { bindRealtimeServer, type RealtimeServerHandle } from 'stitchkit/server';
+import type { BoardRuntime } from './board';
+
+/** What makes the board’s answer stale — the one topic, named once. */
+const INVALIDATED_BY = 'board.changed';
+
+/** A read the browser is allowed to watch. */
+const WATCHABLE = new Set([`${boardContract.meta.prefix}/list`]);
+
+export interface LiveHandle {
+  readonly hub: WatchHub;
+}
+
+export function bindLive(board: BoardRuntime, handle: RealtimeServerHandle): LiveHandle {
+  const realtime = bindRealtimeServer(liveContract, handle, {
+    onRejected: (rejected) => {
+      // A frame that failed its schema is reported where it was refused. Silence
+      // here is how two versions of an application go on talking past each other.
+      console.warn(`Realtime frame refused: ${rejected.event} (${rejected.reason})`);
+    },
+  });
+
+  const hub = createWatchHub({
+    // The hub does not dispatch; it asks the application. One reader for the
+    // watched answer and the plain `GET` alike, so the two cannot disagree.
+    read: async (operation) => {
+      if (operation.action !== 'list') {
+        throw new Error(`${operation.service}.${operation.action} is not readable here`);
+      }
+      return board.read();
+    },
+    watchable: (operation) => WATCHABLE.has(`${operation.service}/${operation.action}`),
+    // The board's list takes no arguments, so its topic is the whole board.
+    // When a read *does* depend on an argument — one conversation of many — the
+    // topic is narrowed with it (`board.changed:${args.id}`), or one change wakes
+    // every watcher of the operation and pays for a read per watcher.
+    invalidatedBy: () => [INVALIDATED_BY],
+    subscribe: (topic, listener) => {
+      // The hub hands back the topics `invalidatedBy` returned, so this is a
+      // narrowing rather than a check — and it refuses rather than quietly
+      // returning a no-op, because an invalidation that silently never fires
+      // is a board that stops updating with nothing to show for it.
+      if (topic !== INVALIDATED_BY) {
+        throw new Error(`The board declares no invalidation topic named ${topic}`);
+      }
+      return board.events.on(topic, listener);
+    },
+    // A browser may watch a handful of questions, not an unbounded number: the
+    // limit is what turns a bug in a page into a refusal instead of a leak.
+    maxWatchesPerSubscriber: 8,
+    // A page that navigates away and back inside the window finds the answer
+    // warm and costs no read.
+    holdMs: 30_000,
+  });
+
+  realtime.onConnection(({ raw, events }) => {
+    const watcher = hub.attach({
+      value: (frame) => events.emit('stitchkit.watch.value', frame),
+      state: (frame) => events.emit('stitchkit.watch.state', frame),
+    });
+    events.on('stitchkit.watch.open', (payload, acknowledge) => {
+      acknowledge(watcher.open(payload.key, payload.args));
+    });
+    events.on('stitchkit.watch.close', (payload) => watcher.close(payload.key));
+    // Every key this connection held is released here. Without it the hub goes
+    // on re-reading for a browser that closed its tab.
+    raw.on('disconnect', () => watcher.detach());
+  });
+
+  return { hub };
+}

package/template/packages/backend/src/surface.snapshot.json

@@ -1,4 +1,36 @@
 [
+  {
+    "service": "board",
+    "action": "list",
+    "scope": "public",
+    "hasInput": false,
+    "hasOutput": true,
+    "inputShape": null,
+    "outputShape": "ce49fe198eb3412f",
+    "http": [
+      {
+        "method": "GET",
+        "path": "/api/board"
+      }
+    ],
+    "tools": {}
+  },
+  {
+    "service": "board",
+    "action": "post",
+    "scope": "public",
+    "hasInput": true,
+    "hasOutput": true,
+    "inputShape": "b1d8eb61c62cafed",
+    "outputShape": "ce49fe198eb3412f",
+    "http": [
+      {
+        "method": "POST",
+        "path": "/api/board"
+      }
+    ],
+    "tools": {}
+  },
   {
     "service": "system",
     "action": "status",

package/template/packages/backend/src/surface.ts

@@ -1,13 +1,63 @@
 import { env } from '@app/config';
-import { createSocketIOServer } from 'stitchkit/server';
+import { createSocketIOServer, createTrustFence, type TrustFence } from 'stitchkit/server';
+import { type BoardRuntime, openBoard } from './lib/board';
+import { bindLive } from './lib/live';
+import { createBoardService } from './transport/board-service';
 import { createSystemService } from './transport/system-service';
 
+/**
+ * The fence this deployment answers behind, or nothing.
+ *
+ * `trustedHosts` has no default and cannot have one: a fence can compare the
+ * authority a request addressed against a list, and it cannot invent the list.
+ * Unset means no fence, which is honest for a checkout on a laptop and wrong for
+ * anything a network can reach.
+ *
+ * The browser origin is the one already declared for CORS. They answer different
+ * questions — CORS says what a page may *read*, the fence says which authority
+ * this server agreed to *answer on* — but a deployment that names a cross-origin
+ * browser has named it once, and asking twice is asking for two answers that
+ * disagree.
+ */
+function createFence(): TrustFence | undefined {
+  if (!env.TRUSTED_HOSTS) return undefined;
+  const browserOrigin = env.CORS_ORIGIN ? [new URL(env.CORS_ORIGIN).host] : [];
+  return createTrustFence({
+    trustedHosts: env.TRUSTED_HOSTS.split(',').map((entry) => entry.trim()),
+    ...(browserOrigin.length > 0 && { trustedOrigins: browserOrigin }),
+    onRefused: (refusal) => {
+      console.warn(
+        `Refused a ${refusal.lane} request: ${refusal.reason} (host ${refusal.host ?? 'absent'})`,
+      );
+    },
+  });
+}
+
 export async function createSurface() {
+  const board: BoardRuntime = await openBoard();
+  const fence = createFence();
+
   // An EMPTY allow-list is same-origin: no origin is permitted to open a
   // cross-origin socket, and no browser on this app's own origin needs one.
   // `CORS_ORIGIN` is set only when the browser genuinely lives elsewhere.
   // (Once the workspace targets a Stitchkit release where `cors` itself is
   // optional, this becomes `undefined` and the empty array goes away.)
-  const socket = await createSocketIOServer({ cors: { origin: env.CORS_ORIGIN ?? [] } });
-  return { socket, services: [createSystemService()] };
+  const socket = await createSocketIOServer({
+    cors: { origin: env.CORS_ORIGIN ?? [] },
+    // The socket's own admission point, and the reason the fence has two halves:
+    // `/socket.io/*` never reaches a lifecycle hook on either runtime, so a
+    // fence installed only in `hooks` would leave open the lane this app pushes
+    // its live data over.
+    ...(fence && { allowRequest: fence.allowRequest }),
+  });
+
+  const live = bindLive(board, socket);
+
+  return {
+    socket,
+    fence,
+    board,
+    hub: live.hub,
+    services: [createSystemService(), createBoardService(board)],
+  };
 }

package/template/packages/backend/src/transport/board-service.ts

@@ -0,0 +1,18 @@
+import { type Board, boardContract } from '@app/shared';
+import { implement } from 'stitchkit/server';
+import type { BoardRuntime } from '../lib/board';
+
+/**
+ * The board's two operations.
+ *
+ * Nothing here knows it is watched. `list` is an ordinary handler that reads
+ * memory and returns; the watch hub calls this same implementation when a topic
+ * says the answer may have changed, so a watching browser and a plain `GET` can
+ * never disagree — there is one reader, not two.
+ */
+export function createBoardService(board: BoardRuntime) {
+  return implement(boardContract, {
+    list: (): Board => board.read(),
+    post: ({ input }) => board.post(input),
+  });
+}

package/template/packages/config/src/variables.ts

@@ -73,6 +73,22 @@ const baseVariables = {
    * requiring an origin there would be requiring knowledge of the place.
    */
   CORS_ORIGIN: z.url().optional(),
+  /**
+   * Where the board keeps its notes. A file, so they survive a restart — which
+   * is the only thing that makes the board worth watching rather than a toy.
+   */
+  BOARD_STORE_PATH: z.string().min(1).default('.data/board.sqlite'),
+  /**
+   * The authorities this API answers on, comma-separated — `host` or
+   * `host:port`.
+   *
+   * Set it and the trust fence is installed on BOTH lanes: HTTP before routing,
+   * and the realtime handshake, which never reaches a lifecycle hook on either
+   * runtime. Unset and there is no fence, which is honest for a local checkout
+   * and wrong for anything reachable from a network — a fence cannot invent the
+   * list of names it should answer to.
+   */
+  TRUSTED_HOSTS: z.string().min(1).optional(),
 };
 
 /**

package/template/packages/frontend/src/app/[locale]/page.tsx

@@ -1,6 +1,7 @@
 import { appIdentity } from '@app/config/app-identity';
 import type { Metadata } from 'next';
 import { getTranslations } from 'next-intl/server';
+import { env } from '@/env';
 import { LocaleSchema } from '@/i18n/locales';
 import { createPageMetadata } from '@/lib/seo/metadata';
 import { StarterPage } from './starter-page';
@@ -28,6 +29,7 @@ export default async function Page({ params }: { params: Promise<{ locale: strin
       heroTitle={t('heroTitle')}
       catalogueLabel={t('ui')}
       locale={appLocale}
+      realtimeOrigin={env.PUBLIC_REALTIME_ORIGIN}
     />
   );
 }

package/template/packages/frontend/src/app/[locale]/starter-page.tsx

@@ -3,6 +3,7 @@ import Image from 'next/image';
 import { BrandMark } from '@/components/brand-mark';
 import { LanguageSwitcher, ThemeToggle } from '@/components/system-controls';
 import { buttonVariants } from '@/components/ui';
+import { BoardPanel } from '@/features/board/board-panel';
 import type { AppLocale } from '@/i18n/locales';
 import { Link } from '@/i18n/navigation';
 import { absoluteSiteUrl } from '@/lib/seo/metadata';
@@ -14,6 +15,7 @@ interface StarterPageProps {
   applicationDescription: string;
   heroTitle: string;
   catalogueLabel: string;
+  realtimeOrigin?: string;
   locale: AppLocale;
 }
 
@@ -61,6 +63,7 @@ export async function StarterPage({
   applicationDescription,
   heroTitle,
   catalogueLabel,
+  realtimeOrigin,
   locale,
 }: StarterPageProps) {
   const homeSeo = getSeoPage('home', locale);
@@ -139,8 +142,13 @@ export async function StarterPage({
               </div>
             </div>
 
+            <div className='mt-6 w-full max-w-xl'>
+              <BoardPanel realtimeOrigin={realtimeOrigin} />
+            </div>
+
             <p className='mt-5 text-sm text-muted-foreground'>
-              Add your first vertical feature from schema to transport and UI.
+              One vertical feature, from schema to transport to UI. Open a second tab and post
+              from it — nothing on this page polls.
             </p>
           </section>
         </div>

package/template/packages/frontend/src/features/board/board-live.ts

@@ -0,0 +1,91 @@
+'use client';
+
+import { type Board, BoardSchema, boardContract, liveContract } from '@app/shared';
+import { createClient, createRealtimeClient } from 'stitchkit';
+import { createWatchClient, type WatchStateFrame, watchTransport } from 'stitchkit/live';
+
+/**
+ * One socket and one watch client for the life of the tab.
+ *
+ * Kept in a module local rather than in React state, and that is the whole
+ * point: the server shares one read between everyone asking the same question,
+ * and a client per component would defeat that from the other side. A component
+ * that remounts joins the subscription that exists.
+ */
+let shared: ReturnType<typeof connect> | undefined;
+
+/**
+ * Where the socket dials.
+ *
+ * The page's own origin unless a deployment says otherwise, and "otherwise" is
+ * handed down per request rather than compiled in — a `NEXT_PUBLIC_` value is
+ * substituted at build time, which would freeze one deployment's address into
+ * the artifact. `PUBLIC_REALTIME_ORIGIN` exists because a WebSocket upgrade does
+ * not survive a proxying route handler, so the two roles can share an origin for
+ * HTTP and still need to name the socket's.
+ */
+function connect(realtimeOrigin?: string) {
+  const realtime = createRealtimeClient(liveContract, {
+    url: realtimeOrigin ?? window.location.origin,
+  });
+  realtime.connect();
+  return {
+    realtime,
+    // `watchTransport` is the conversion the framework owns: a bound realtime
+    // client's `on` is generic over its contract, and TypeScript will not relate
+    // that to a transport interface. One call, and no cast in this application.
+    watch: createWatchClient(boardContract, {
+      transport: watchTransport(realtime),
+      // A tab that navigates away and back inside the window paints from memory
+      // and costs no read.
+      holdMs: 30_000,
+    }),
+  };
+}
+
+/** The typed HTTP client, for the one operation that writes. */
+export const boardApi = createClient(boardContract, { baseUrl: '/api' });
+
+export interface BoardWatch {
+  close(): void;
+}
+
+/**
+ * Watch the board.
+ *
+ * `onState` is the honest half and is not optional in practice: `opening` means
+ * subscribed and nothing read yet, which is neither healthy nor broken, and
+ * `unavailable` carries the read's own words rather than a flag. A socket that
+ * drops says so here and resumes on its own when it comes back.
+ */
+export function watchBoard(
+  onValue: (board: Board) => void,
+  onState: (state: WatchStateFrame) => void,
+  realtimeOrigin?: string,
+): BoardWatch {
+  shared ??= connect(realtimeOrigin);
+  const handle = shared.watch.list({});
+  const stop = handle.subscribe({
+    value: (value) => {
+      // Parsed at the boundary rather than asserted. A watched read carries the
+      // operation's output, so a value that fails its own schema means this tab
+      // and the server disagree about the contract — a half-finished deploy, or
+      // a cached bundle from before one. That is worth showing; a cast would
+      // render it as though it were fine and fail somewhere unrelated.
+      const parsed = BoardSchema.safeParse(value);
+      if (!parsed.success) {
+        onState({
+          key: { service: boardContract.meta.prefix, action: 'list', digest: '' },
+          phase: 'unavailable',
+          reason: 'source-error',
+          message:
+            'The board arrived in a shape this page does not know — reload to update it.',
+        });
+        return;
+      }
+      onValue(parsed.data);
+    },
+    state: onState,
+  });
+  return { close: stop };
+}

package/template/packages/frontend/src/features/board/board-panel.tsx

@@ -0,0 +1,112 @@
+'use client';
+
+import type { Board } from '@app/shared';
+import { useEffect, useState } from 'react';
+import type { WatchStateFrame } from 'stitchkit/live';
+import {
+  Button,
+  Card,
+  CardContent,
+  CardHeader,
+  CardTitle,
+  Input,
+  Spinner,
+} from '@/components/ui';
+import { boardApi, watchBoard } from './board-live';
+
+/**
+ * The board, live.
+ *
+ * The demonstration is the second tab: open one, post from the other, and the
+ * note appears without this component asking for it. Nothing here polls, and
+ * nothing here refetches after a write — the server re-reads once, for everyone
+ * watching, and pushes the answer.
+ */
+export function BoardPanel({ realtimeOrigin }: { realtimeOrigin?: string }) {
+  const [board, setBoard] = useState<Board>();
+  const [state, setState] = useState<WatchStateFrame>();
+  const [draft, setDraft] = useState('');
+  const [posting, setPosting] = useState(false);
+
+  useEffect(() => {
+    const watch = watchBoard(setBoard, setState, realtimeOrigin);
+    return () => watch.close();
+  }, [realtimeOrigin]);
+
+  async function post(event: React.FormEvent) {
+    event.preventDefault();
+    const body = draft.trim();
+    if (!body || posting) return;
+    setPosting(true);
+    try {
+      // The write returns the board too, so this tab does not wait for its own
+      // announcement to come back around. Every other tab learns from the push.
+      setBoard(await boardApi.post({ body }));
+      setDraft('');
+    } finally {
+      setPosting(false);
+    }
+  }
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Board</CardTitle>
+      </CardHeader>
+      <CardContent className='space-y-4'>
+        <form className='flex gap-2' onSubmit={post}>
+          <Input
+            aria-label='Note'
+            maxLength={140}
+            onChange={(event) => setDraft(event.target.value)}
+            placeholder='Say something, then open a second tab'
+            value={draft}
+          />
+          <Button disabled={posting || draft.trim().length === 0} type='submit'>
+            Post
+          </Button>
+        </form>
+
+        <BoardStatus board={board} state={state} />
+
+        <ul className='space-y-2'>
+          {board?.notes.map((note) => (
+            <li className='rounded-md border px-3 py-2 text-sm' key={note.id}>
+              {note.body}
+            </li>
+          ))}
+        </ul>
+      </CardContent>
+    </Card>
+  );
+}
+
+/**
+ * Three states, not two.
+ *
+ * `opening` is subscribed and nothing read yet — early, not broken — and showing
+ * it as a failure tells a reader something is wrong when the truth is that it
+ * has not arrived. `unavailable` shows the read's own words, because "something
+ * went wrong" is the message that helps nobody.
+ */
+function BoardStatus({ board, state }: { board?: Board; state?: WatchStateFrame }) {
+  if (state?.phase === 'unavailable') {
+    return (
+      <p className='text-destructive text-sm'>
+        Not live: {state.message ?? state.reason ?? 'the server stopped answering'}
+      </p>
+    );
+  }
+  if (!board) {
+    return (
+      <p className='flex items-center gap-2 text-muted-foreground text-sm'>
+        <Spinner /> Waiting for the first read…
+      </p>
+    );
+  }
+  return (
+    <p className='text-muted-foreground text-sm'>
+      {board.total} {board.total === 1 ? 'note' : 'notes'}, live
+    </p>
+  );
+}

package/template/packages/shared/src/contracts/board.ts

@@ -0,0 +1,54 @@
+import { createContractFactory } from 'stitchkit';
+import { defineEvents } from 'stitchkit/live';
+import { BoardChangedSchema, BoardSchema, PostNoteSchema } from '../schemas/board';
+
+const { defineContract } = createContractFactory<'public'>({
+  toolExposure: 'explicit',
+});
+
+/**
+ * The board: read it, add to it.
+ *
+ * Two operations, and the interesting one is `list` — it is a **watched read**.
+ * Nothing about that shows up here, which is the point: a watched read is an
+ * ordinary `GET` that the server happens to re-run when something it depends on
+ * changes. The contract stays the contract, and one caller can fetch it once
+ * while another watches it.
+ */
+export const boardContract = defineContract(
+  { prefix: 'board', scope: 'public' },
+  {
+    list: {
+      method: 'GET',
+      path: '/',
+      desc: 'Read the board',
+      output: BoardSchema,
+      expose: ['HTTP'],
+    },
+    post: {
+      method: 'POST',
+      path: '/',
+      desc: 'Add a note to the board',
+      input: PostNoteSchema,
+      output: BoardSchema,
+      expose: ['HTTP'],
+    },
+  },
+);
+
+/**
+ * What the server announces, declared beside what it can be asked.
+ *
+ * One topic, one payload schema, and a delivery mode — `emit`, because an
+ * announcement that the board changed is an observation and nothing waits on it.
+ * The wire name is the prefixed one, `board.changed`, and it is the only name
+ * this topic has: the short key below is where the full one is built.
+ *
+ * Declared in `shared` for the same reason the contract is: the server publishes
+ * it and the browser subscribes to it, and a topic described twice is a topic
+ * that will be published in one shape and parsed in another.
+ */
+export const boardEvents = defineEvents(
+  { prefix: 'board' },
+  { changed: { schema: BoardChangedSchema, mode: 'emit' } },
+);

package/template/packages/shared/src/contracts/live.ts

@@ -0,0 +1,20 @@
+import { toRealtimeContract, watchContract } from 'stitchkit/live';
+import { boardEvents } from './board';
+
+/**
+ * Everything this application says over its one socket.
+ *
+ * Its own announcements, projected from the same declaration both ends read,
+ * plus the protocol a watched read travels on. Declared in `shared` because the
+ * server binds it and the browser binds it, and a contract described twice is a
+ * contract that will be published in one shape and parsed in another — which is
+ * the failure `defineContract` exists to make impossible for requests and this
+ * makes impossible for announcements.
+ */
+export const liveContract = {
+  serverToClient: {
+    ...toRealtimeContract(boardEvents).serverToClient,
+    ...watchContract.serverToClient,
+  },
+  clientToServer: watchContract.clientToServer,
+};

package/template/packages/shared/src/index.ts

@@ -1,2 +1,5 @@
+export * from './contracts/board';
+export * from './contracts/live';
 export * from './contracts/system';
+export * from './schemas/board';
 export * from './schemas/system';

package/template/packages/shared/src/schemas/board.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+
+/**
+ * One note on the board.
+ *
+ * Small on purpose: the board exists to show a value that several browsers
+ * watch at once, and everything about it that is not that gets in the way.
+ */
+export const NoteSchema = z
+  .object({
+    id: z.uuid(),
+    /** Trimmed and bounded here, so the same limit holds for every transport. */
+    body: z.string().trim().min(1).max(140),
+    postedAt: z.iso.datetime({ offset: true }),
+  })
+  .strict();
+export type Note = z.infer<typeof NoteSchema>;
+
+/** What a reader of the board receives — newest first, and how many there are. */
+export const BoardSchema = z
+  .object({
+    notes: z.array(NoteSchema),
+    total: z.number().int().nonnegative(),
+  })
+  .strict();
+export type Board = z.infer<typeof BoardSchema>;
+
+/** What a writer sends. The server owns `id` and `postedAt`; a client cannot set either. */
+export const PostNoteSchema = z.object({ body: NoteSchema.shape.body }).strict();
+export type PostNote = z.infer<typeof PostNoteSchema>;
+
+/**
+ * The payload of the announcement that the board changed.
+ *
+ * It carries the note's id rather than the note. An announcement says *that*
+ * something changed; the value comes from the read, which is the one place that
+ * decides what a reader is allowed to see. A payload that carried the row would
+ * be a second, unauthorised copy of the answer.
+ */
+export const BoardChangedSchema = z.object({ noteId: NoteSchema.shape.id }).strict();
+export type BoardChanged = z.infer<typeof BoardChangedSchema>;

package/template/project.json

@@ -105,6 +105,11 @@
         "shape": "string",
         "required": false
       },
+      {
+        "name": "BOARD_STORE_PATH",
+        "shape": "string",
+        "required": false
+      },
       {
         "name": "CORS_ORIGIN",
         "shape": "url",
@@ -159,6 +164,11 @@
         "shape": "url",
         "required": false
       },
+      {
+        "name": "TRUSTED_HOSTS",
+        "shape": "string",
+        "required": false
+      },
       {
         "name": "WEB_PORT",
         "shape": "integer",

package/template/scripts/check-authored.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, test } from 'bun:test';
+import { inspect } from './check-authored';
+
+describe('check:authored — assertions', () => {
+  test('lets a const assertion through: it narrows and cannot launder a type', () => {
+    const source = [
+      "export const benchKeys = { jobs: ['bench', 'jobs'] as const };",
+      "export const modes = ['fast', 'full'] as const;",
+      '',
+    ].join('\n');
+    expect(inspect('packages/shared/src/bench.ts', source)).toEqual([]);
+  });
+
+  test('still refuses a real assertion, and the finding names what to do instead', () => {
+    const findings = inspect(
+      'packages/shared/src/parse.ts',
+      'const parsed = JSON.parse(raw) as Payload;\n',
+    );
+    expect(findings).toHaveLength(1);
+    const [finding] = findings;
+    // Line and file, so it is navigable…
+    expect(finding).toContain('packages/shared/src/parse.ts:1');
+    // …and the remedy, so the reader does not have to search for the sanctioned way.
+    expect(finding).toContain('satisfies');
+    expect(finding).toContain('schema at the boundary');
+  });
+
+  test('the angle-bracket form is refused too, and explicit any separately', () => {
+    expect(inspect('scripts/x.ts', 'const a = <Foo>bar;\n')).toHaveLength(1);
+    const anyFindings = inspect('scripts/y.ts', 'function f(a: any) { return a; }\n');
+    expect(anyFindings).toHaveLength(1);
+    expect(anyFindings[0]).toContain('explicit any');
+  });
+
+  test('a const assertion beside a real one reports only the real one', () => {
+    const findings = inspect(
+      'scripts/mixed.ts',
+      "const keys = ['a'] as const;\nconst value = raw as Payload;\n",
+    );
+    expect(findings).toHaveLength(1);
+    expect(findings[0]).toContain('scripts/mixed.ts:2');
+  });
+});