flet-box 0.0.0-stage → 1.0.2

package/bin/ota/loader.js

@@ -0,0 +1,361 @@
+/**
+ * FletBox OTA loader — runs BEFORE the app inside a production bundle (www/).
+ *
+ * createBundle copies this file verbatim to www/loader.js and rewrites
+ * www/index.html so the module entry is ./loader.js instead of ./src/app.js.
+ * It is a real, self-contained ES module (no build step, no imports) so it can
+ * be syntax-checked with `node --check` and shipped as-is.
+ *
+ * Boot sequence:
+ *   1. Read the SHIPPED ./config.json (describes the bundle baked into this
+ *      build + where updates live: `update.url`).
+ *   2. Work out which bundle is currently active — a previously installed OTA
+ *      bundle (tracked in localStorage + Cache Storage) or the shipped one —
+ *      and remember its hash.
+ *   3. Fetch the REMOTE config.json from `update.url` (no-store, short timeout).
+ *      If its hash differs from the active one, an update is available.
+ *   4. Depending on policy, either download silently (mode:"auto"/mandatory) or
+ *      show an Accept/Cancel dialog. On accept: download the bundle, verify its
+ *      sha256, store it in Cache Storage, and run it.
+ *   5. Whatever happens, an app always launches — network failures, offline,
+ *      hash mismatches, or a missing update URL simply fall back to the current
+ *      bundle. OTA never bricks the app.
+ *
+ * SECURITY: the downloaded bundle is only run if its sha256 matches the hash in
+ * the remote config.json. If Web Crypto is unavailable (non-secure context) OTA
+ * is skipped rather than running unverified code.
+ */
+
+const SHIPPED_BUNDLE = "./src/app.js";
+const OTA_CACHE = "fletbox-ota";
+const LS_KEY = "fletbox.ota.installed";
+const FETCH_TIMEOUT_MS = 6000;
+
+const log = (...a) => console.log("[fletbox-ota]", ...a);
+const warn = (...a) => console.warn("[fletbox-ota]", ...a);
+
+const readInstalled = () => {
+  try {
+    return JSON.parse(localStorage.getItem(LS_KEY)) || null;
+  } catch {
+    return null;
+  }
+};
+
+const writeInstalled = (value) => {
+  try {
+    if (value) localStorage.setItem(LS_KEY, JSON.stringify(value));
+    else localStorage.removeItem(LS_KEY);
+  } catch {
+    /* storage disabled (private mode) — OTA just won't persist */
+  }
+};
+
+/** sha256 hex digest of a string, or null when Web Crypto is unavailable. */
+async function sha256(text) {
+  if (!(globalThis.crypto && crypto.subtle)) return null;
+  const buf = new TextEncoder().encode(text);
+  const digest = await crypto.subtle.digest("SHA-256", buf);
+  return [...new Uint8Array(digest)]
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+/** fetch JSON with a timeout + no-store so a stale cache never masks an update. */
+async function fetchJson(url) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(url, { cache: "no-store", signal: ctrl.signal });
+    if (!res.ok) throw new Error("HTTP " + res.status);
+    return await res.json();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/** Executes an ES module from source text via a Blob URL. */
+function runModuleSource(text) {
+  const blobUrl = URL.createObjectURL(
+    new Blob([text], { type: "text/javascript" }),
+  );
+  return import(blobUrl);
+}
+
+/** Runs the installed OTA bundle if present, else the shipped one. */
+async function runInstalledOrShipped() {
+  const inst = readInstalled();
+  if (inst && inst.url && "caches" in globalThis) {
+    try {
+      const cache = await caches.open(OTA_CACHE);
+      const res = await cache.match(inst.url);
+      if (res) {
+        log("running installed bundle", inst.version || "");
+        return runModuleSource(await res.text());
+      }
+      writeInstalled(null); // cache entry vanished — fall back to shipped
+    } catch (e) {
+      warn("could not read installed bundle, using shipped:", e.message);
+      writeInstalled(null);
+    }
+  }
+  return import(SHIPPED_BUNDLE);
+}
+
+/**
+ * Plain-DOM "update available" dialog. Built by hand (no flet-box) because it
+ * must render BEFORE the framework itself is loaded. Resolves true on Accept,
+ * false on Cancel. `mandatory` hides the Cancel option.
+ */
+function showPrompt({ from, to, notes, sizeBytes, mandatory }) {
+  return new Promise((resolve) => {
+    const kb = sizeBytes ? (sizeBytes / 1024).toFixed(0) + " KB" : "";
+    const overlay = document.createElement("div");
+    overlay.setAttribute("role", "dialog");
+    overlay.setAttribute("aria-modal", "true");
+    overlay.style.cssText =
+      "position:fixed;inset:0;z-index:2147483647;display:flex;align-items:center;" +
+      "justify-content:center;background:rgba(10,10,20,.6);backdrop-filter:blur(4px);" +
+      "font-family:system-ui,-apple-system,sans-serif;padding:20px;box-sizing:border-box;";
+
+    const card = document.createElement("div");
+    card.style.cssText =
+      "width:100%;max-width:380px;background:#16162a;color:#eaeaf2;border-radius:18px;" +
+      "padding:24px;box-shadow:0 20px 60px rgba(0,0,0,.5);box-sizing:border-box;";
+
+    const title = document.createElement("div");
+    title.textContent = "Update available";
+    title.style.cssText = "font-size:19px;font-weight:700;margin-bottom:6px;";
+
+    const ver = document.createElement("div");
+    ver.textContent = from && to ? from + "  →  " + to : "A new version is ready.";
+    ver.style.cssText = "font-size:13px;color:#9a9ac0;margin-bottom:14px;";
+
+    card.appendChild(title);
+    card.appendChild(ver);
+
+    if (notes) {
+      const n = document.createElement("div");
+      n.textContent = notes;
+      n.style.cssText =
+        "font-size:14px;line-height:1.5;color:#c7c7e0;margin-bottom:14px;" +
+        "white-space:pre-wrap;max-height:160px;overflow:auto;";
+      card.appendChild(n);
+    }
+    if (kb) {
+      const s = document.createElement("div");
+      s.textContent = "Download size: " + kb;
+      s.style.cssText = "font-size:12px;color:#7a7aa0;margin-bottom:18px;";
+      card.appendChild(s);
+    }
+
+    const row = document.createElement("div");
+    row.style.cssText = "display:flex;gap:10px;justify-content:flex-end;";
+
+    const btnBase =
+      "border:0;border-radius:10px;padding:11px 18px;font-size:14px;font-weight:600;" +
+      "cursor:pointer;font-family:inherit;";
+
+    if (!mandatory) {
+      const later = document.createElement("button");
+      later.textContent = "Later";
+      later.style.cssText = btnBase + "background:#2a2a44;color:#c7c7e0;";
+      later.onclick = () => {
+        overlay.remove();
+        resolve(false);
+      };
+      row.appendChild(later);
+    }
+
+    const update = document.createElement("button");
+    update.textContent = mandatory ? "Update" : "Update now";
+    update.style.cssText = btnBase + "background:#6366f1;color:#fff;";
+    update.onclick = () => {
+      update.disabled = true;
+      update.textContent = "Downloading…";
+      overlay.dataset.accepted = "1";
+      resolve(true);
+    };
+    row.appendChild(update);
+
+    card.appendChild(row);
+    overlay.appendChild(card);
+    document.body.appendChild(overlay);
+
+    // Expose the overlay so the caller can update/close it during download.
+    showPrompt._overlay = overlay;
+    showPrompt._btn = update;
+  });
+}
+
+const closePrompt = () => {
+  if (showPrompt._overlay) {
+    showPrompt._overlay.remove();
+    showPrompt._overlay = null;
+    showPrompt._btn = null;
+  }
+};
+
+const setPromptStatus = (text) => {
+  if (showPrompt._btn) showPrompt._btn.textContent = text;
+};
+
+/**
+ * Numeric version compare for the minNativeVersion gate. Returns true when
+ * `have` >= `want`. Missing parts are treated as 0. On web there is no native
+ * version, so callers pass null and the gate is skipped.
+ */
+function versionAtLeast(have, want) {
+  if (!want || want === "0.0.0") return true;
+  if (!have) return true; // unknown native version (web) → don't block
+  const a = String(have).split(".").map((n) => parseInt(n, 10) || 0);
+  const b = String(want).split(".").map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    const x = a[i] || 0;
+    const y = b[i] || 0;
+    if (x !== y) return x >= y;
+  }
+  return true;
+}
+
+/**
+ * Checks the remote config and, if an update is accepted, downloads + verifies +
+ * stores + runs it. Returns true when a NEW bundle was launched, false when the
+ * caller should run the current one.
+ */
+async function checkAndUpdate(shippedConfig, activeHash) {
+  const update = shippedConfig && shippedConfig.update;
+  if (!update || !update.url) return false; // OTA disabled
+
+  let remote;
+  try {
+    remote = await fetchJson(update.url + "config.json");
+  } catch (e) {
+    log("no remote config (offline or not deployed yet):", e.message);
+    return false;
+  }
+  if (!remote || typeof remote.hash !== "string") return false;
+  if (remote.hash === activeHash) {
+    log("up to date (" + (remote.version || activeHash.slice(0, 8)) + ")");
+    return false;
+  }
+
+  // Native-shell compatibility gate (Phase 2 injects the real native version).
+  const nativeVersion = globalThis.__FLETBOX_NATIVE_VERSION__ || null;
+  if (!versionAtLeast(nativeVersion, remote.minNativeVersion)) {
+    warn(
+      "update requires native " +
+        remote.minNativeVersion +
+        " but shell is " +
+        (nativeVersion || "unknown") +
+        " — update the app from the store instead.",
+    );
+    return false;
+  }
+
+  const mandatory = !!(remote.update && remote.update.mandatory);
+  const auto = update.mode === "auto";
+
+  // mode:"auto" downloads silently. Otherwise show the dialog; a mandatory
+  // update still shows it but without a "Later" button, so it can't be skipped.
+  if (!auto) {
+    const ok = await showPrompt({
+      from: (readInstalled() || shippedConfig || {}).version,
+      to: remote.version,
+      notes: (remote.update && remote.update.notes) || "",
+      sizeBytes: remote.size,
+      mandatory,
+    });
+    if (!ok) {
+      closePrompt();
+      return false;
+    }
+  }
+
+  // Download the bundle.
+  const bundleUrl = update.url + (remote.bundle || "src/app.js");
+  let text;
+  try {
+    if (!auto) setPromptStatus("Downloading…");
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 30000);
+    const res = await fetch(bundleUrl, { cache: "no-store", signal: ctrl.signal });
+    clearTimeout(timer);
+    if (!res.ok) throw new Error("HTTP " + res.status);
+    text = await res.text();
+  } catch (e) {
+    warn("download failed:", e.message);
+    closePrompt();
+    return false;
+  }
+
+  // Verify integrity before running anything.
+  const digest = await sha256(text);
+  if (digest === null) {
+    warn("Web Crypto unavailable — refusing to run an unverified bundle.");
+    closePrompt();
+    return false;
+  }
+  if (digest !== remote.hash) {
+    warn("hash mismatch (expected " + remote.hash.slice(0, 12) + ", got " + digest.slice(0, 12) + ") — aborting.");
+    closePrompt();
+    return false;
+  }
+
+  // Persist into Cache Storage so the next launch runs it offline.
+  if ("caches" in globalThis) {
+    try {
+      const cache = await caches.open(OTA_CACHE);
+      await cache.put(
+        bundleUrl,
+        new Response(text, {
+          headers: { "Content-Type": "text/javascript" },
+        }),
+      );
+      writeInstalled({
+        url: bundleUrl,
+        hash: remote.hash,
+        version: remote.version,
+      });
+    } catch (e) {
+      warn("could not cache bundle (running it once):", e.message);
+    }
+  }
+
+  log("applying update → " + (remote.version || remote.hash.slice(0, 12)));
+  await runModuleSource(text);
+  closePrompt();
+  return true;
+}
+
+(async function main() {
+  let shippedConfig = null;
+  try {
+    shippedConfig = await fetchJson("./config.json");
+  } catch (e) {
+    warn("no shipped config.json:", e.message);
+  }
+
+  const installed = readInstalled();
+  const activeHash = installed
+    ? installed.hash
+    : shippedConfig && shippedConfig.hash;
+
+  let updated = false;
+  try {
+    updated = await checkAndUpdate(shippedConfig, activeHash);
+  } catch (e) {
+    warn("update check failed:", e.message);
+  }
+
+  if (!updated) {
+    try {
+      await runInstalledOrShipped();
+    } catch (e) {
+      // Last resort: an installed bundle may be corrupt — clear it and ship.
+      warn("could not run active bundle, falling back to shipped:", e.message);
+      writeInstalled(null);
+      await import(SHIPPED_BUNDLE);
+    }
+  }
+})();

package/bin/utils/bundleConfig.js

@@ -0,0 +1,178 @@
+/**
+ * @file bin/utils/bundleConfig.js
+ * @description Builds the OTA `config.json` manifest that ships inside a
+ * FletBox bundle (`www/config.json`).
+ *
+ * The manifest is what a running app fetches to decide whether an update is
+ * available: it carries the app version, a sha256 of the bundle, the build
+ * timestamp, and update policy (channel / mode / mandatory / notes). The
+ * comparison that drives the OTA is the `hash` — the version is a human label.
+ *
+ * Update source URL resolution order:
+ *   1. `update.url` in `fletbox.config.json` (explicit wins)
+ *   2. derived from the `repository` field of the project's package.json,
+ *      mapped to its GitHub Pages URL: https://<user>.github.io/<repo>/
+ *   3. derived from the CURRENT PROJECT's git remote `origin` (when it is a
+ *      GitHub URL), so a bundle always points at the project itself — never at
+ *      the flet-box package that happens to be installed
+ *   4. null (OTA disabled — the bundle just runs what shipped in it)
+ */
+
+import crypto from "crypto";
+import { execSync } from "child_process";
+import fs from "fs";
+import path from "path";
+import { INITIAL_VERSION, isValidVersion } from "./version.js";
+
+/**
+ * Computes the sha256 hex digest of a string or buffer.
+ *
+ * @param {string|Buffer} content
+ * @returns {string} `"<hex>"`
+ */
+export const sha256 = (content) =>
+  crypto.createHash("sha256").update(content).digest("hex");
+
+/**
+ * Reads and JSON-parses a file, returning `fallback` when it is missing or
+ * cannot be parsed. Never throws.
+ *
+ * @param {string} file - Absolute path.
+ * @param {*} fallback - Value returned on any failure.
+ * @returns {*}
+ */
+const readJsonSafe = (file, fallback) => {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return fallback;
+  }
+};
+
+/**
+ * Extracts `user` and `repo` from a GitHub repository reference.
+ * Accepts the shapes npm produces/accepts:
+ *   - "git+https://github.com/user/repo.git"
+ *   - "https://github.com/user/repo"
+ *   - "git@github.com:user/repo.git"
+ *   - "user/repo"
+ *
+ * @param {string} repository - The `repository` value (string form).
+ * @returns {{ user: string, repo: string } | null}
+ */
+export const parseGithubRepo = (repository) => {
+  if (!repository || typeof repository !== "string") return null;
+  const match = repository.match(/github\.com[:/]([^/]+)\/([^/.]+)/);
+  if (match) return { user: match[1], repo: match[2] };
+  const short = repository.match(/^([\w.-]+)\/([\w.-]+)$/);
+  if (short) return { user: short[1], repo: short[2] };
+  return null;
+};
+
+/**
+ * Resolves the OTA update URL for a project.
+ *
+ * @param {string} projectRoot - Absolute path to the project root.
+ * @returns {string|null} A base URL ending in "/", or null when it cannot be
+ *   determined (OTA disabled).
+ */
+export const resolveUpdateUrl = (projectRoot) => {
+  const fletboxConfig = readJsonSafe(
+    path.join(projectRoot, "fletbox.config.json"),
+    {},
+  );
+
+  // 1. Explicit configuration always wins.
+  const explicit = fletboxConfig?.update?.url;
+  if (typeof explicit === "string" && explicit.trim()) {
+    return explicit.endsWith("/") ? explicit : `${explicit}/`;
+  }
+
+  // 2. Derive from package.json repository → GitHub Pages URL.
+  const pkg = readJsonSafe(path.join(projectRoot, "package.json"), {});
+  const repository =
+    typeof pkg.repository === "string"
+      ? pkg.repository
+      : pkg.repository?.url || null;
+  const gh = parseGithubRepo(repository);
+  if (gh) return `https://${gh.user}.github.io/${gh.repo}/`;
+
+  // 3. Derive from the current project's git remote. This guarantees the
+  // bundle targets the project it was built in, not the flet-box framework
+  // that may be present as a dependency elsewhere.
+  const remote = getGitRemoteUrl(projectRoot);
+  const ghRemote = parseGithubRepo(remote);
+  if (ghRemote) return `https://${ghRemote.user}.github.io/${ghRemote.repo}/`;
+
+  return null;
+};
+
+/**
+ * Returns the `origin` remote URL of the git repo at `projectRoot`, or null.
+ *
+ * @param {string} projectRoot - Absolute path to the project root.
+ * @returns {string|null}
+ */
+export const getGitRemoteUrl = (projectRoot) => {
+  try {
+    const out = execSync("git remote get-url origin", {
+      cwd: projectRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5000,
+    });
+    return out.trim() || null;
+  } catch {
+    return null;
+  }
+};
+
+/**
+ * Builds the OTA config manifest object for a freshly written bundle.
+ *
+ * @param {object} opts
+ * @param {string} opts.projectRoot - Absolute path to the project root.
+ * @param {string|Buffer} opts.bundleContent - Exact bytes of the shipped
+ *   `app.js` (after the version header is stamped), used for the hash + size.
+ * @param {string} [opts.bundlePath="src/app.js"] - Bundle path, relative to
+ *   the bundle root, as the loader should request it.
+ * @returns {object} The config.json manifest.
+ */
+export const buildBundleConfig = ({
+  projectRoot,
+  bundleContent,
+  bundlePath = "src/app.js",
+}) => {
+  const pkg = readJsonSafe(path.join(projectRoot, "package.json"), {});
+  const fletboxConfig = readJsonSafe(
+    path.join(projectRoot, "fletbox.config.json"),
+    {},
+  );
+  const updateCfg = fletboxConfig.update || {};
+
+  const version = isValidVersion(pkg.version) ? pkg.version : INITIAL_VERSION;
+  const content = Buffer.from(bundleContent);
+
+  return {
+    version,
+    hash: sha256(content),
+    builtAt: new Date().toISOString(),
+    bundle: bundlePath,
+    size: content.length,
+    // Minimum native (APK/IPA) version this bundle is compatible with. When the
+    // installed native shell is older, the loader must fall back to a store
+    // update instead of applying the OTA. Defaults to "0.0.0" (always compatible).
+    minNativeVersion:
+      typeof updateCfg.minNativeVersion === "string"
+        ? updateCfg.minNativeVersion
+        : "0.0.0",
+    update: {
+      // Where the app fetches config.json + bundle from. null disables OTA.
+      url: resolveUpdateUrl(projectRoot),
+      mode: updateCfg.mode === "auto" ? "auto" : "prompt",
+      channel: typeof updateCfg.channel === "string" ? updateCfg.channel : "stable",
+      mandatory: updateCfg.mandatory === true,
+      notes: typeof updateCfg.notes === "string" ? updateCfg.notes : "",
+    },
+  };
+};

package/bin/utils/capacitor.js

@@ -0,0 +1,137 @@
+/**
+ * @file bin/utils/capacitor.js
+ * @description Shared plumbing for the Capacitor build commands (`build android`,
+ * `build ios`). Both commands do the same three things before they touch a
+ * native toolchain: validate the project, make sure the generated npm
+ * dependencies exist, and run child processes with readable failures.
+ */
+
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { c } from "./colors.js";
+
+/**
+ * Runs a command synchronously, inheriting stdio so the user watches Gradle,
+ * CocoaPods or Xcode do their work.
+ *
+ * @param {string} command - Executable to run.
+ * @param {string[]} args - Arguments for the executable.
+ * @param {string} cwd - Working directory.
+ * @param {string} label - Human readable name used in error messages.
+ * @param {NodeJS.ProcessEnv} [env] - Environment for the child process.
+ * @returns {void}
+ * @throws {Error} When the command cannot start or exits with a non-zero code.
+ */
+export const run = (command, args, cwd, label, env = process.env) => {
+  const result = spawnSync(command, args, {
+    cwd,
+    stdio: "inherit",
+    shell: process.platform === "win32",
+    env,
+  });
+
+  if (result.error) {
+    throw new Error(`${label} could not start: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(
+      `${label} failed with exit code ${result.status ?? "unknown"}`,
+    );
+  }
+};
+
+/**
+ * Checks that a command exists and can report a version.
+ *
+ * @param {string} command - Executable name, resolved through PATH.
+ * @param {string[]} [args] - Arguments used as the probe (defaults to `--version`).
+ * @returns {boolean} `true` when the probe exits successfully.
+ */
+export const commandExists = (command, args = ["--version"]) => {
+  const result = spawnSync(command, args, { stdio: "ignore" });
+  return !result.error && result.status === 0;
+};
+
+const hasPackage = (projectRoot, packageName) =>
+  fs.existsSync(
+    path.join(projectRoot, "node_modules", ...packageName.split("/"), "package.json"),
+  );
+
+/**
+ * Installs the project npm dependencies when any of the packages the native
+ * build needs are missing. Projects created by `flet-box create` already declare
+ * them, this only repairs projects whose `node_modules` was never installed.
+ *
+ * @param {string} projectRoot - Absolute path of the project.
+ * @param {string[]} requiredPackages - Packages that must be resolvable.
+ * @returns {void}
+ */
+export const ensureNpmDependencies = (projectRoot, requiredPackages) => {
+  const missingPackages = requiredPackages.filter(
+    (packageName) => !hasPackage(projectRoot, packageName),
+  );
+  if (missingPackages.length === 0) return;
+
+  console.log(
+    c(
+      "yellow",
+      `\n📦 Installing project dependencies: ${missingPackages.join(", ")}`,
+    ),
+  );
+  run("npm", ["install"], projectRoot, "npm dependency installation");
+
+  const stillMissing = requiredPackages.filter(
+    (packageName) => !hasPackage(projectRoot, packageName),
+  );
+  if (stillMissing.length > 0) {
+    throw new Error(
+      `Dependencies are still missing after npm install: ${stillMissing.join(", ")}.`,
+    );
+  }
+};
+
+/**
+ * Validates that the current directory is a FletBox project scaffolded for
+ * Capacitor, and returns its parsed `package.json`.
+ *
+ * @param {string[]} requiredScripts - npm scripts the caller needs, for example `["ios:init"]`.
+ * @returns {{ projectRoot: string, projectPackage: object }} Project root and manifest.
+ * @throws {Error} When the folder is not a Capacitor-enabled FletBox project.
+ */
+export const assertCapacitorProject = (requiredScripts) => {
+  const projectRoot = process.cwd();
+  const packagePath = path.join(projectRoot, "package.json");
+  const capacitorConfig = [
+    "capacitor.config.json",
+    "capacitor.config.ts",
+    "capacitor.config.js",
+  ].some((file) => fs.existsSync(path.join(projectRoot, file)));
+
+  if (!fs.existsSync(path.join(projectRoot, "src", "app.js"))) {
+    throw new Error("Run this inside a Flet-Box project with src/app.js.");
+  }
+  if (!fs.existsSync(packagePath) || !capacitorConfig) {
+    throw new Error(
+      "This project is not configured for Capacitor. Create it with a recent version of Flet-Box.",
+    );
+  }
+
+  let projectPackage;
+  try {
+    projectPackage = JSON.parse(fs.readFileSync(packagePath, "utf8"));
+  } catch (error) {
+    throw new Error(`Could not read package.json: ${error.message}`);
+  }
+
+  const missingScripts = requiredScripts.filter(
+    (script) => !projectPackage?.scripts?.[script],
+  );
+  if (missingScripts.length > 0) {
+    throw new Error(
+      `Missing npm scripts: ${missingScripts.join(", ")}. Recreate the project with a recent version of Flet-Box.`,
+    );
+  }
+
+  return { projectRoot, projectPackage };
+};