@abraca/nuxt 2.0.11 → 2.3.0

package/dist/runtime/composables/useEditorSuggestions.js

@@ -73,7 +73,8 @@ export function useEditorSuggestions(options = {}) {
         ...extEnabled("mathBlock") ? [{ kind: "mathBlock", label: "Math (block)", icon: "i-lucide-square-sigma", description: "Display-mode LaTeX equation", keywords: ["katex", "latex", "equation", "formula", "math"] }] : [],
         ...extEnabled("mathInline") ? [{ kind: "mathInline", label: "Math (inline)", icon: "i-lucide-sigma", description: "Inline LaTeX expression", keywords: ["katex", "latex", "inline math"] }] : [],
         ...extEnabled("diff") ? [{ kind: "diff", label: "Diff", icon: "i-lucide-git-compare", description: "Side-by-side text diff", keywords: ["compare", "changes", "git"] }] : [],
-        ...extEnabled("svgEmbed") ? [{ kind: "svgEmbed", label: "SVG embed", icon: "i-lucide-image", description: "Inline SVG (sanitized)", keywords: ["svg", "vector", "icon", "diagram"] }] : []
+        ...extEnabled("svgEmbed") ? [{ kind: "svgEmbed", label: "SVG embed", icon: "i-lucide-image", description: "Inline SVG (sanitized)", keywords: ["svg", "vector", "icon", "diagram"] }] : [],
+        ...extEnabled("timeline") ? [{ kind: "timeline", label: "Timeline", icon: "i-lucide-git-commit-vertical", description: "Vertical event timeline", keywords: ["events", "history", "milestones"] }] : []
       ]
     ];
     try {

package/dist/runtime/composables/useInstalledPlugins.d.ts

@@ -1,24 +1,6 @@
-export interface ExternalPluginEntry {
-    url: string;
-    /** Plugin name from the loaded bundle's `plugin.name` field */
-    name: string;
-    label?: string;
-    version?: string;
-    description?: string;
-    enabled: boolean;
-    /** Error message from the last load attempt, if any */
-    error?: string;
-    installedAt: number;
-}
-/**
- * Normalizes user-entered shorthand to a full CDN URL.
- *
- * Supported formats:
- * - `npm:package-name[@version]` -> jsDelivr npm CDN
- * - `github:user/repo[@branch]` -> jsDelivr GitHub CDN
- * - Any other string is returned as-is (assumed to be a full URL)
- */
-export declare function normalizePluginUrl(input: string): string;
+import { normalizePluginUrl, type ExternalPluginEntry } from '@abraca/plugin';
+export { normalizePluginUrl };
+export type { ExternalPluginEntry };
 export declare function useInstalledPlugins(): {
     entries: import("@vueuse/shared").RemovableRef<ExternalPluginEntry[]>;
     install: (rawUrl: string) => void;

package/dist/runtime/composables/useInstalledPlugins.js

@@ -1,18 +1,8 @@
 import { useLocalStorage } from "@vueuse/core";
+import { normalizePluginUrl } from "@abraca/plugin";
+export { normalizePluginUrl };
 const STORAGE_KEY = "abracadabra_external_plugins";
 const DISABLED_BUILTINS_KEY = "abracadabra_disabled_builtins";
-export function normalizePluginUrl(input) {
-  const trimmed = input.trim();
-  if (trimmed.startsWith("npm:")) {
-    const pkg = trimmed.slice(4);
-    return `https://cdn.jsdelivr.net/npm/${pkg}/dist/plugin.js`;
-  }
-  if (trimmed.startsWith("github:")) {
-    const repo = trimmed.slice(7);
-    return `https://cdn.jsdelivr.net/gh/${repo}/dist/plugin.js`;
-  }
-  return trimmed;
-}
 export function useInstalledPlugins() {
   const entries = useLocalStorage(STORAGE_KEY, []);
   const disabledBuiltins = useLocalStorage(DISABLED_BUILTINS_KEY, []);

package/dist/runtime/composables/useMetaMenuItems.d.ts

@@ -0,0 +1,21 @@
+/**
+ * useMetaMenuItems — unified "Add Property" menu items for documentMeta.
+ *
+ * Used by:
+ *  - The (+) button inside DocumentMetaView
+ *  - The drag-handle menu on the documentMeta row
+ *
+ * Returns two groups:
+ *   [0] Schema properties (from `editor.storage.metaField.configFields`)
+ *   [1] Standard properties (from `META_FIELD_DEFINITIONS`)
+ *
+ * Items already present are marked with a check trailing icon. Schema fields
+ * focus the existing chip instead of duplicating; standard fields insert a
+ * new chip (their `metaKey` is timestamped, so duplicates are intentional)
+ * unless they're singleton field types (rating, icon, color, members).
+ *
+ * Ported 1:1 from cou-sh/app/composables/useMetaMenuItems.ts.
+ */
+import type { Editor } from '@tiptap/vue-3';
+import type { DropdownMenuItem } from '@nuxt/ui';
+export declare function buildMetaMenuItems(editor: Editor): DropdownMenuItem[][];

package/dist/runtime/composables/useMetaMenuItems.js

@@ -0,0 +1,115 @@
+import { META_FIELD_DEFINITIONS } from "../utils/metaFieldDefinitions.js";
+import { schemaFieldToAttrs } from "../extensions/meta-field.js";
+function collectPresentFields(editor) {
+  const present = [];
+  const doc = editor.state.doc;
+  doc.forEach((node, offset) => {
+    if (node.type.name !== "documentMeta") return;
+    node.forEach((child, childOffset) => {
+      if (child.type.name !== "metaField") return;
+      present.push({
+        fieldType: child.attrs.fieldType ?? "",
+        metaKey: child.attrs.metaKey ?? "",
+        startKey: child.attrs.startKey ?? "",
+        endKey: child.attrs.endKey ?? "",
+        latKey: child.attrs.latKey ?? "",
+        lngKey: child.attrs.lngKey ?? "",
+        userDefined: !!child.attrs.userDefined,
+        pos: offset + 1 + childOffset
+      });
+    });
+  });
+  return present;
+}
+function schemaFieldKey(field) {
+  if (field.type === "daterange" || field.type === "timerange")
+    return `${field.type}:${String(field.startKey)}|${String(field.endKey)}`;
+  if (field.type === "datetimerange")
+    return `${field.type}:${String(field.startKey)}|${String(field.endKey)}`;
+  if (field.type === "location")
+    return `${field.type}:${String(field.latKey)}|${String(field.lngKey)}`;
+  if ("key" in field) return `${field.type}:${String(field.key)}`;
+  return field.type;
+}
+function presentFieldKey(p) {
+  if (p.fieldType === "daterange" || p.fieldType === "timerange" || p.fieldType === "datetimerange")
+    return `${p.fieldType}:${p.startKey}|${p.endKey}`;
+  if (p.fieldType === "location")
+    return `${p.fieldType}:${p.latKey}|${p.lngKey}`;
+  return `${p.fieldType}:${p.metaKey}`;
+}
+function focusExistingChip(editor, pos) {
+  try {
+    const { node } = editor.view.domAtPos(pos);
+    const el = node instanceof Element ? node : node.parentElement;
+    if (!el) return;
+    el.scrollIntoView({ behavior: "smooth", block: "nearest", inline: "nearest" });
+    el.classList.add("meta-chip-flash");
+    setTimeout(() => el.classList.remove("meta-chip-flash"), 900);
+  } catch {
+  }
+}
+export function buildMetaMenuItems(editor) {
+  const storage = editor.storage?.metaField;
+  const configFields = storage?.configFields ?? [];
+  const present = collectPresentFields(editor);
+  const presentKeys = new Set(present.map(presentFieldKey));
+  const presentFieldTypes = new Set(present.map((p) => p.fieldType));
+  const groups = [];
+  if (configFields.length) {
+    groups.push(configFields.map((f) => {
+      const key = schemaFieldKey(f);
+      const already = presentKeys.has(key);
+      const existing = already ? present.find((p) => presentFieldKey(p) === key) : void 0;
+      return {
+        label: f.label || ("key" in f ? String(f.key) : f.type),
+        icon: "i-lucide-settings-2",
+        trailingIcon: already ? "i-lucide-check" : void 0,
+        onSelect: () => {
+          if (already && existing) {
+            focusExistingChip(editor, existing.pos);
+            return;
+          }
+          const attrs = schemaFieldToAttrs(f);
+          signalAutoOpen(editor, attrs);
+          editor.commands.insertMetaField(attrs);
+        }
+      };
+    }));
+  }
+  groups.push(META_FIELD_DEFINITIONS.map((def) => {
+    const sampleAttrs = def.buildAttrs();
+    const already = presentFieldTypes.has(String(sampleAttrs.fieldType));
+    const existing = already ? present.find((p) => p.fieldType === sampleAttrs.fieldType) : void 0;
+    return {
+      label: def.label,
+      icon: def.icon,
+      trailingIcon: already ? "i-lucide-check" : void 0,
+      onSelect: () => {
+        if (already && existing && isSingletonFieldType(String(sampleAttrs.fieldType))) {
+          focusExistingChip(editor, existing.pos);
+          return;
+        }
+        const attrs = def.buildAttrs();
+        signalAutoOpen(editor, attrs);
+        editor.commands.insertMetaField(attrs);
+      }
+    };
+  }));
+  return groups;
+}
+function isSingletonFieldType(fieldType) {
+  return fieldType === "rating" || fieldType === "icon" || fieldType === "colorPreset" || fieldType === "colorPicker" || fieldType === "members";
+}
+function isPopoverFieldType(fieldType) {
+  return fieldType === "colorPreset" || fieldType === "colorPicker" || fieldType === "icon" || fieldType === "location" || fieldType === "select" || fieldType === "multiselect" || fieldType === "members" || fieldType === "textarea" || fieldType === "date" || fieldType === "datetime" || fieldType === "time" || fieldType === "daterange" || fieldType === "datetimerange";
+}
+function signalAutoOpen(editor, attrs) {
+  const storage = editor.storage?.metaField;
+  if (!storage) return;
+  const fieldType = String(attrs.fieldType ?? "");
+  if (!isPopoverFieldType(fieldType)) return;
+  const marker = String(attrs.metaKey ?? attrs.startKey ?? attrs.latKey ?? "");
+  if (!marker) return;
+  storage.pendingOpen = `${fieldType}:${marker}`;
+}

package/dist/runtime/composables/useMetaValidator.d.ts

@@ -0,0 +1,27 @@
+/**
+ * useMetaValidator — ad-hoc meta validation for UI forms.
+ *
+ * Returns a single `validate(typeName, meta)` function that delegates to
+ * whichever registry was attached via the `abracadabra:before-boot` hook.
+ * Returns `{ ok: true, value }` for unknown doc-types (Rule 4).
+ *
+ * Intended for properties-panel inputs and similar UI surfaces that
+ * want a non-throwing pre-write check. For the throwing path, use
+ * `useTypedDoc(...)` (which validates inside `update`/`set`).
+ */
+import { type SchemaRegistryLike } from './useAbracadabraSchema.js';
+export interface MetaValidationFailure {
+    ok: false;
+    errors: ReadonlyArray<{
+        path: ReadonlyArray<PropertyKey>;
+        message: string;
+        code?: string;
+    }>;
+}
+export interface MetaValidationOk {
+    ok: true;
+    value: unknown;
+}
+export declare function useMetaValidator(_explicitSchema?: SchemaRegistryLike): {
+    validate: (typeName: string, meta: unknown) => MetaValidationOk | MetaValidationFailure;
+};

package/dist/runtime/composables/useMetaValidator.js

@@ -0,0 +1,10 @@
+import { useAbracadabraSchema } from "./useAbracadabraSchema.js";
+export function useMetaValidator(_explicitSchema) {
+  const { validateMeta } = useAbracadabraSchema();
+  return {
+    validate(typeName, meta) {
+      const result = validateMeta(typeName, meta);
+      return result;
+    }
+  };
+}

package/dist/runtime/composables/usePluginCatalog.d.ts

@@ -0,0 +1,161 @@
+import type { PluginManifest, PluginCapability } from '@abraca/plugin';
+export interface CatalogPlugin {
+    id: string;
+    name: string | null;
+    description: string;
+    repository: string | null;
+    homepage: string | null;
+    categories: string[];
+    pricing: string;
+    status: string;
+    latest_version: string | null;
+    owner_login: string | null;
+    created_at: string;
+    updated_at: string;
+}
+export interface CatalogVersionSummary {
+    version: string;
+    integrity: string;
+    status: string;
+    github_tag: string | null;
+    submitted_at: string;
+    scanned_at: string | null;
+}
+export interface CatalogPluginDetail {
+    plugin: CatalogPlugin;
+    versions: CatalogVersionSummary[];
+}
+export interface CatalogVersionDetail {
+    plugin_id: string;
+    version: string;
+    integrity: string;
+    status: string;
+    artifact_url: string | null;
+    github_tag: string | null;
+    submitted_at: string;
+    scanned_at: string | null;
+    manifest: PluginManifest;
+}
+export interface CatalogListResult {
+    plugins: CatalogPlugin[];
+    pagination: {
+        limit: number;
+        offset: number;
+        has_more: boolean;
+    };
+}
+export interface CatalogListParams {
+    category?: string;
+    search?: string;
+    limit?: number;
+    offset?: number;
+}
+/**
+ * Mirrors `GET /plugins/policy` on the abracadabra server. Fields are
+ * stable across server versions; new fields are additive.
+ */
+export interface ServerPluginPolicy {
+    registry_url: string;
+    allowlist: string[];
+    allow_user_install: boolean;
+    allow_unsafe_install: boolean;
+    auto_update: 'off' | 'patch' | 'minor' | 'major';
+    require_review_on_cap_growth: boolean;
+}
+/** One row in `checkUpdates()`'s report. */
+export interface AutoUpdateOutcome {
+    pluginId: string;
+    fromVersion: string;
+    toVersion: string;
+    /**
+     * `applied` — version was bumped, artifact URL re-installed.
+     * `pending-review` — version is newer but introduces capabilities not
+     *   present in the installed version; `require_review_on_cap_growth`
+     *   is on, so the user must explicitly accept the new manifest.
+     * `skipped-policy` — bump fell outside `auto_update` (e.g. a minor
+     *   bump while policy is `patch`).
+     * `skipped-blocked` — server policy blocks this plugin entirely now.
+     */
+    state: 'applied' | 'pending-review' | 'skipped-policy' | 'skipped-blocked';
+    /** Capabilities new in the upstream version vs the installed one. */
+    newCapabilities: PluginCapability[];
+    /** Set when state === 'pending-review' or skipped — actionable reason. */
+    reason?: string;
+}
+/**
+ * `policyDecisionFor` outcome. Drives every Install button across the UI —
+ * one helper, three rendered states, no scattered "if" chains.
+ */
+export type PolicyDecision = 
+/** Plugin is in the server's `allowlist`. Install + auto-update silently. */
+{
+    state: 'allowed';
+    reason?: undefined;
+}
+/** Not allowlisted but `allow_user_install` is true. Show capability disclosure. */
+ | {
+    state: 'gated';
+    reason?: undefined;
+}
+/** Not allowlisted and `allow_user_install` is false. Install button hidden. */
+ | {
+    state: 'blocked';
+    reason: string;
+}
+/** Policy hasn't been fetched yet — fall back to permissive (allowed). */
+ | {
+    state: 'unknown';
+    reason?: undefined;
+};
+export declare function usePluginCatalog(): {
+    /** Public catalog (latest page fetched). Refresh via `list()`. */
+    plugins: import("vue").ShallowRef<CatalogPlugin[], CatalogPlugin[]>;
+    /** Distinct category tags across `plugins`, alphabetical. */
+    categories: import("vue").ComputedRef<string[]>;
+    pagination: import("vue").Ref<{
+        limit: number;
+        offset: number;
+        has_more: boolean;
+    } | null, {
+        limit: number;
+        offset: number;
+        has_more: boolean;
+    } | {
+        limit: number;
+        offset: number;
+        has_more: boolean;
+    } | null>;
+    isLoading: import("vue").Ref<boolean, boolean>;
+    error: import("vue").Ref<Error | null, Error | null>;
+    list: (params?: CatalogListParams) => Promise<CatalogListResult>;
+    get: (id: string) => Promise<CatalogPluginDetail>;
+    getLatest: (id: string) => Promise<CatalogVersionDetail>;
+    getVersion: (id: string, version: string) => Promise<CatalogVersionDetail>;
+    install: (id: string) => Promise<CatalogVersionDetail>;
+    installFromUrl: (url: string) => Promise<void>;
+    isInstalled: (id: string) => boolean;
+    capabilitiesFor: (detail: CatalogVersionDetail | PluginManifest) => {
+        required: PluginCapability[];
+        optional: PluginCapability[];
+    };
+    /** Current server policy. `null` until `loadPolicy()` resolves. */
+    policy: import("vue").Ref<{
+        registry_url: string;
+        allowlist: string[];
+        allow_user_install: boolean;
+        allow_unsafe_install: boolean;
+        auto_update: "off" | "patch" | "minor" | "major";
+        require_review_on_cap_growth: boolean;
+    } | null, ServerPluginPolicy | {
+        registry_url: string;
+        allowlist: string[];
+        allow_user_install: boolean;
+        allow_unsafe_install: boolean;
+        auto_update: "off" | "patch" | "minor" | "major";
+        require_review_on_cap_growth: boolean;
+    } | null>;
+    loadPolicy: (serverUrl: string) => Promise<ServerPluginPolicy>;
+    /** Per-plugin install gate. Drives every Install button across the UI. */
+    policyDecisionFor: (pluginId: string) => PolicyDecision;
+    checkUpdates: () => Promise<AutoUpdateOutcome[]>;
+};

package/dist/runtime/composables/usePluginCatalog.js

@@ -0,0 +1,234 @@
+import { ref, computed, shallowRef } from "vue";
+import { useRuntimeConfig } from "#imports";
+import { useInstalledPlugins } from "./useInstalledPlugins.js";
+export function usePluginCatalog() {
+  const cfg = useRuntimeConfig();
+  const base = cfg.public.abracadabra?.pluginRegistry?.url || "http://127.0.0.1:8787";
+  const plugins = shallowRef([]);
+  const isLoading = ref(false);
+  const error = ref(null);
+  const pagination = ref(null);
+  const details = shallowRef({});
+  const policy = ref(null);
+  async function list(params = {}) {
+    isLoading.value = true;
+    error.value = null;
+    try {
+      const url = new URL(`${base.replace(/\/$/, "")}/v1/plugins`);
+      if (params.category) url.searchParams.set("category", params.category);
+      if (params.search) url.searchParams.set("search", params.search);
+      if (typeof params.limit === "number") url.searchParams.set("limit", String(params.limit));
+      if (typeof params.offset === "number") url.searchParams.set("offset", String(params.offset));
+      const result = await $fetch(url.toString());
+      plugins.value = result.plugins;
+      pagination.value = result.pagination;
+      return result;
+    } catch (e) {
+      error.value = e instanceof Error ? e : new Error(String(e));
+      throw error.value;
+    } finally {
+      isLoading.value = false;
+    }
+  }
+  async function get(id) {
+    if (details.value[id]) return details.value[id];
+    const detail = await $fetch(`${base.replace(/\/$/, "")}/v1/plugins/${encodeURIComponent(id)}`);
+    details.value = { ...details.value, [id]: detail };
+    return detail;
+  }
+  async function getLatest(id) {
+    return await $fetch(
+      `${base.replace(/\/$/, "")}/v1/plugins/${encodeURIComponent(id)}/latest`
+    );
+  }
+  async function getVersion(id, version) {
+    return await $fetch(
+      `${base.replace(/\/$/, "")}/v1/plugins/${encodeURIComponent(id)}/versions/${encodeURIComponent(version)}`
+    );
+  }
+  const installed = useInstalledPlugins();
+  function isInstalled(id) {
+    return installed.entries.value.some((e) => e.name === id || e.url.includes(`/${id}/`));
+  }
+  async function install(id) {
+    const decision = policyDecisionFor(id);
+    if (decision.state === "blocked") {
+      throw new Error(`install refused by server policy: ${decision.reason}`);
+    }
+    const latest = await getLatest(id);
+    if (!latest.artifact_url) {
+      throw new Error(
+        `plugin "${id}" version ${latest.version} has no artifact URL \u2014 registry artifact storage not configured yet`
+      );
+    }
+    installed.install(latest.artifact_url);
+    installed.updateMeta(latest.artifact_url, {
+      name: id,
+      version: latest.version,
+      label: latest.manifest.name ?? id,
+      description: latest.manifest.description
+    });
+    return latest;
+  }
+  async function installFromUrl(url) {
+    const p = policy.value;
+    if (p && !p.allow_unsafe_install) {
+      throw new Error(
+        "install refused by server policy: out-of-registry URL/file installs are disabled"
+      );
+    }
+    installed.install(url);
+  }
+  async function checkUpdates() {
+    const p = policy.value;
+    if (p && p.auto_update === "off") return [];
+    const outcomes = [];
+    for (const entry of installed.entries.value) {
+      if (!entry.name || !entry.version) continue;
+      let latest;
+      try {
+        latest = await getLatest(entry.name);
+      } catch {
+        continue;
+      }
+      const decision = policyDecisionFor(entry.name);
+      if (decision.state === "blocked") {
+        outcomes.push({
+          pluginId: entry.name,
+          fromVersion: entry.version,
+          toVersion: latest.version,
+          state: "skipped-blocked",
+          newCapabilities: [],
+          reason: decision.reason
+        });
+        continue;
+      }
+      const bump = semverBump(entry.version, latest.version);
+      if (!bump) continue;
+      if (!bumpAllowed(bump, p?.auto_update ?? "patch")) {
+        outcomes.push({
+          pluginId: entry.name,
+          fromVersion: entry.version,
+          toVersion: latest.version,
+          state: "skipped-policy",
+          newCapabilities: [],
+          reason: `policy is '${p?.auto_update ?? "patch"}', would not apply '${bump}' bump`
+        });
+        continue;
+      }
+      let installedCaps = [];
+      try {
+        const installedDetail = await getVersion(entry.name, entry.version);
+        installedCaps = installedDetail.manifest.capabilities.required ?? [];
+      } catch {
+      }
+      const latestCaps = latest.manifest.capabilities.required ?? [];
+      const newCaps = latestCaps.filter((c) => !installedCaps.includes(c));
+      const requireReview = p?.require_review_on_cap_growth ?? true;
+      if (newCaps.length > 0 && requireReview) {
+        outcomes.push({
+          pluginId: entry.name,
+          fromVersion: entry.version,
+          toVersion: latest.version,
+          state: "pending-review",
+          newCapabilities: newCaps,
+          reason: "new capabilities requested"
+        });
+        continue;
+      }
+      if (latest.artifact_url) {
+        installed.uninstall(entry.url);
+        installed.install(latest.artifact_url);
+        installed.updateMeta(latest.artifact_url, {
+          name: entry.name,
+          version: latest.version,
+          label: latest.manifest.name ?? entry.name,
+          description: latest.manifest.description
+        });
+      }
+      outcomes.push({
+        pluginId: entry.name,
+        fromVersion: entry.version,
+        toVersion: latest.version,
+        state: "applied",
+        newCapabilities: newCaps
+      });
+    }
+    return outcomes;
+  }
+  function capabilitiesFor(detail) {
+    const m = "manifest" in detail ? detail.manifest : detail;
+    return {
+      required: [...m.capabilities.required ?? []],
+      optional: [...m.capabilities.optional ?? []]
+    };
+  }
+  async function loadPolicy(serverUrl) {
+    const url = `${serverUrl.replace(/\/$/, "")}/plugins/policy`;
+    const fetched = await $fetch(url);
+    policy.value = fetched;
+    return fetched;
+  }
+  function policyDecisionFor(pluginId) {
+    const p = policy.value;
+    if (!p) return { state: "unknown" };
+    if (p.allowlist.includes(pluginId)) return { state: "allowed" };
+    if (p.allow_user_install) return { state: "gated" };
+    return {
+      state: "blocked",
+      reason: "Your server only permits plugins from its allowlist."
+    };
+  }
+  const categories = computed(() => {
+    const set = /* @__PURE__ */ new Set();
+    for (const p of plugins.value) for (const c of p.categories) set.add(c);
+    return [...set].sort();
+  });
+  return {
+    /** Public catalog (latest page fetched). Refresh via `list()`. */
+    plugins,
+    /** Distinct category tags across `plugins`, alphabetical. */
+    categories,
+    pagination,
+    isLoading,
+    error,
+    list,
+    get,
+    getLatest,
+    getVersion,
+    install,
+    installFromUrl,
+    isInstalled,
+    capabilitiesFor,
+    /** Current server policy. `null` until `loadPolicy()` resolves. */
+    policy,
+    loadPolicy,
+    /** Per-plugin install gate. Drives every Install button across the UI. */
+    policyDecisionFor,
+    checkUpdates
+  };
+}
+function semverBump(from, to) {
+  const a = parseSemver(from);
+  const b = parseSemver(to);
+  if (!a || !b) return null;
+  if (b.major > a.major) return "major";
+  if (b.major < a.major) return null;
+  if (b.minor > a.minor) return "minor";
+  if (b.minor < a.minor) return null;
+  if (b.patch > a.patch) return "patch";
+  return null;
+}
+function parseSemver(v) {
+  const cleaned = v.replace(/^v/, "").split(/[-+]/)[0];
+  if (!cleaned) return null;
+  const parts = cleaned.split(".").map((p) => Number.parseInt(p, 10));
+  if (parts.length !== 3 || parts.some((p) => Number.isNaN(p))) return null;
+  return { major: parts[0], minor: parts[1], patch: parts[2] };
+}
+function bumpAllowed(bump, policy) {
+  if (policy === "off") return false;
+  if (policy === "patch") return bump === "patch";
+  if (policy === "minor") return bump === "patch" || bump === "minor";
+  return true;
+}