@dolphy-app/extension-tools 0.2.0

package/dist/cli/main.js

@@ -0,0 +1,2050 @@
+#!/usr/bin/env node
+import { builtinModules } from "node:module";
+import path from "node:path";
+import { cp, lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { z } from "zod";
+import { build } from "vite";
+import { tmpdir } from "node:os";
+import { createHash } from "node:crypto";
+
+//#region packages/extension-host/src/protocol.ts
+const typed = {
+	type: z.string(),
+	exerciseId: z.string(),
+	spec: z.unknown(),
+	isolated: z.boolean()
+};
+const extRequestSchema = z.discriminatedUnion("method", [
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("project"),
+		params: z.strictObject(typed)
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("grade"),
+		params: z.strictObject({
+			...typed,
+			answer: z.unknown(),
+			timeoutMs: z.number(),
+			authorMode: z.boolean()
+		})
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("referenceAnswer"),
+		params: z.strictObject(typed)
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("gradePolicy"),
+		params: z.strictObject({
+			policyId: z.string(),
+			verdicts: z.array(z.strictObject({
+				outcome: z.enum([
+					"passed",
+					"failed",
+					"error"
+				]),
+				reason: z.string().optional()
+			})),
+			gaveUp: z.boolean(),
+			isolated: z.boolean()
+		})
+	})
+]);
+/** Результат правила оценки: целое 1–5 или `null`. */
+const gradeValueSchema = z.union([z.literal([
+	1,
+	2,
+	3,
+	4,
+	5
+]), z.null()]);
+const reason = z.string().min(1).max(100);
+const text$1 = z.string().max(4e3);
+const gradeResultSchema = z.discriminatedUnion("outcome", [
+	z.strictObject({
+		outcome: z.literal("passed"),
+		feedback: text$1.optional(),
+		data: z.unknown().optional()
+	}),
+	z.strictObject({
+		outcome: z.literal("failed"),
+		reason,
+		feedback: text$1.optional(),
+		detail: text$1.optional(),
+		data: z.unknown().optional()
+	}),
+	z.strictObject({
+		outcome: z.literal("error"),
+		reason,
+		feedback: text$1.optional(),
+		data: z.unknown().optional()
+	})
+]);
+
+//#endregion
+//#region packages/extension-api/src/index.ts
+const EXTENSION_ID_PATTERN = /^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*$/;
+/** GitHub-логин автора расширения (`author` в манифесте и каталоге). */
+const GITHUB_LOGIN_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+/** Возможности, которые расширение объявляет в манифесте; без объявления — ни одной. */
+const EXTENSION_PERMISSIONS = [
+	"library.read",
+	"process.spawn",
+	"worker.threads",
+	"native.addons",
+	"network"
+];
+/** Платформы, на которых расширение может работать (`process.platform`). */
+const EXTENSION_PLATFORMS = [
+	"darwin",
+	"linux",
+	"win32"
+];
+const ELEMENT_NAME_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)+$/;
+/** Идентификаторы встроенных тем: расширения не могут их занять. */
+const BUILTIN_THEME_IDS = [
+	"system",
+	"light",
+	"dark"
+];
+/** Допустимые ключи `ThemeContribution.colors`. */
+const THEME_COLOR_KEYS = [
+	"background",
+	"surface",
+	"surface-bright",
+	"surface-light",
+	"surface-variant",
+	"on-background",
+	"on-surface",
+	"on-surface-variant",
+	"primary",
+	"on-primary",
+	"secondary",
+	"on-secondary",
+	"error",
+	"on-error",
+	"warning",
+	"on-warning",
+	"success",
+	"on-success",
+	"info",
+	"on-info",
+	"hero-start",
+	"hero-end",
+	"hero-contrast"
+];
+/** Допустимые ключи `ThemeContribution.variables`. */
+const THEME_VARIABLE_KEYS = [
+	"border-color",
+	"border-opacity",
+	"medium-emphasis-opacity",
+	"high-emphasis-opacity",
+	"disabled-opacity"
+];
+const DEFAULT_MARKDOWN_RENDERER = "./markdown.mjs";
+const DEFAULT_MAIN = "./main.mjs";
+const DEFAULT_RENDERER = "./view.mjs";
+/** Тег элемента по умолчанию: `dolphy.sql` → `dolphy-sql-answer`. */
+const defaultElementName = (id) => `${id.replaceAll(".", "-")}-answer`;
+
+//#endregion
+//#region packages/extension-catalog/src/errors.ts
+const MAX_ISSUES = 10;
+var CatalogFormatError = class extends Error {
+	issues;
+	constructor(issues) {
+		const kept = issues.slice(0, MAX_ISSUES);
+		super(`invalid catalog: ${kept.join("; ")}`);
+		this.name = "CatalogFormatError";
+		this.issues = kept;
+	}
+};
+
+//#endregion
+//#region packages/extension-catalog/src/semver.ts
+const NUMERIC = "(0|[1-9]\\d*)";
+const SEMVER = new RegExp(`^${NUMERIC}\\.${NUMERIC}\\.${NUMERIC}(?:-([0-9A-Za-z.-]+))?$`);
+const NUMERIC_ID = /^\d+$/;
+const parseSemver = (text) => {
+	const match = SEMVER.exec(text);
+	if (match === null) return null;
+	const [, major = "", minor = "", patch = "", pre] = match;
+	const prerelease = pre === void 0 ? [] : pre.split(".");
+	if (prerelease.some((id) => id === "" || NUMERIC_ID.test(id) && /^0\d/.test(id))) return null;
+	return {
+		major: Number(major),
+		minor: Number(minor),
+		patch: Number(patch),
+		prerelease
+	};
+};
+const isSemver = (text) => parseSemver(text) !== null;
+const sign = (difference) => {
+	if (difference < 0) return -1;
+	return difference > 0 ? 1 : 0;
+};
+const compareIdentifier = (a, b) => {
+	const aNumeric = NUMERIC_ID.test(a);
+	const bNumeric = NUMERIC_ID.test(b);
+	if (aNumeric && bNumeric) return sign(Number(a) - Number(b));
+	if (aNumeric) return -1;
+	if (bNumeric) return 1;
+	if (a === b) return 0;
+	return a < b ? -1 : 1;
+};
+const comparePrerelease = (a, b) => {
+	if (a.length === 0 && b.length === 0) return 0;
+	if (a.length === 0) return 1;
+	if (b.length === 0) return -1;
+	const common = Math.min(a.length, b.length);
+	for (let i = 0; i < common; i++) {
+		const order = compareIdentifier(a[i] ?? "", b[i] ?? "");
+		if (order !== 0) return order;
+	}
+	return sign(a.length - b.length);
+};
+const compareParsed = (a, b) => sign(a.major - b.major) || sign(a.minor - b.minor) || sign(a.patch - b.patch) || comparePrerelease(a.prerelease, b.prerelease);
+const mustParse = (text) => {
+	const parsed = parseSemver(text);
+	if (parsed === null) throw new CatalogFormatError([`invalid semver '${text}'`]);
+	return parsed;
+};
+const compareSemver = (a, b) => compareParsed(mustParse(a), mustParse(b));
+const COMPARATOR = /^(<=|>=|<|>|=)?(.+)$/;
+const parseComparator = (token, range) => {
+	const match = COMPARATOR.exec(token);
+	const version = match?.[2] === void 0 ? null : parseSemver(match[2]);
+	if (match === null || version === null) throw new CatalogFormatError([`invalid version range '${range}'`]);
+	return {
+		operator: match[1] ?? "=",
+		version
+	};
+};
+const parseRange = (range) => {
+	const tokens = range.split(" ").filter((token) => token !== "");
+	if (tokens.length === 0 || range.trim() !== range) throw new CatalogFormatError([`invalid version range '${range}'`]);
+	return tokens.map((token) => parseComparator(token, range));
+};
+
+//#endregion
+//#region packages/extension-catalog/src/compat.ts
+/** Пустой список платформ — любая. */
+const platformFailure = (platforms, platform) => platforms.length === 0 || platforms.some((p) => p === platform) ? null : {
+	reason: "platform",
+	detail: `not available on ${platform}`
+};
+const minAppVersionFailure = (minAppVersion, appVersion) => minAppVersion !== null && appVersion !== void 0 && compareSemver(minAppVersion, appVersion) > 0 ? {
+	reason: "app",
+	detail: `requires app >= ${minAppVersion}`
+} : null;
+/** `minAppVersion` и `platforms` манифеста или записи каталога. */
+const checkCompatibility = (requirements, context) => minAppVersionFailure(requirements.minAppVersion, context.appVersion) ?? platformFailure(requirements.platforms, context.platform);
+
+//#endregion
+//#region packages/extension-catalog/src/install-meta.ts
+const httpUrl = z.url().refine((value) => /^https?:\/\//i.test(value), "catalogUrl must be an http(s) URL");
+const installMetaSchema = z.strictObject({
+	catalogUrl: httpUrl,
+	version: z.string().refine(isSemver, "version must be semver"),
+	installedAt: z.iso.datetime()
+});
+
+//#endregion
+//#region packages/extension-catalog/src/schema.ts
+const CATALOG_SCHEMA_VERSION = 1;
+const MAX_VERSIONS = 5;
+const MAX_FILES = 50;
+const MAX_TOTAL_BYTES = 1e7;
+const MAX_PATH_LENGTH = 200;
+const CATALOG_FILE_EXTENSIONS = [
+	"json",
+	"js",
+	"mjs",
+	"md",
+	"txt"
+];
+const FILE_EXTENSIONS = new Set(CATALOG_FILE_EXTENSIONS);
+const SHA256 = /^[0-9a-f]{64}$/;
+/** Допустимые символы сегмента пути: без `:` (потоки NTFS), пробелов и управляющих символов. */
+const SEGMENT = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
+/** Имена устройств Windows: недоступны как файлы, с расширением или без. */
+const RESERVED_NAME = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i;
+const semver = z.string().refine(isSemver, "must be semver");
+const timestamp = z.iso.datetime({ offset: true });
+const httpsUrl = z.url().refine((value) => value.startsWith("https://"), "must be an https URL");
+const isSafeSegment = (segment) => SEGMENT.test(segment) && !segment.endsWith(".") && !RESERVED_NAME.test(segment);
+/** Путь файла версии: безопасные сегменты и расширение из `FILE_EXTENSIONS`. */
+const isSafeCatalogPath = (value) => {
+	if (value.length > MAX_PATH_LENGTH) return false;
+	const segments = value.split("/");
+	if (!segments.every(isSafeSegment)) return false;
+	const name = segments[segments.length - 1] ?? "";
+	const dot = name.lastIndexOf(".");
+	return dot > 0 && FILE_EXTENSIONS.has(name.slice(dot + 1));
+};
+const filePath = z.string().refine(isSafeCatalogPath, "must be a safe relative path");
+/**
+* Каталог файлов версии относительно адреса `index.json` (`extensions/<id>/<version>/`).
+* Абсолютный адрес не допускается: файлы версии по построению лежат на origin индекса,
+* а локальный каталог разработчика и e2e не требуют https.
+*/
+const baseUrl = z.string().max(MAX_PATH_LENGTH).refine((value) => value.endsWith("/") && value.slice(0, -1).split("/").every(isSafeSegment), "must be a relative directory path ending with /");
+const fileSchema = z.strictObject({
+	path: filePath,
+	size: z.number().int().min(0).max(MAX_TOTAL_BYTES),
+	sha256: z.string().regex(SHA256, "must be lowercase hex sha256")
+});
+const extensionId$1 = z.string().max(64).regex(EXTENSION_ID_PATTERN, "invalid extension id");
+const versionSchema = z.strictObject({
+	version: semver,
+	apiVersion: z.number().int().min(1),
+	minAppVersion: semver.nullable(),
+	permissions: z.array(z.enum(EXTENSION_PERMISSIONS)),
+	publishedAt: timestamp,
+	baseUrl,
+	files: z.array(fileSchema).max(50).superRefine((files, ctx) => {
+		const seen = /* @__PURE__ */ new Set();
+		files.forEach((file, index) => {
+			const key = file.path.toLowerCase();
+			if (seen.has(key)) ctx.addIssue({
+				code: "custom",
+				path: [index, "path"],
+				message: `duplicate path '${file.path}'`
+			});
+			seen.add(key);
+		});
+		files.forEach((file, index) => {
+			const segments = file.path.toLowerCase().split("/");
+			for (let depth = 1; depth < segments.length; depth++) if (seen.has(segments.slice(0, depth).join("/"))) {
+				ctx.addIssue({
+					code: "custom",
+					path: [index, "path"],
+					message: `'${file.path}' lies inside a file`
+				});
+				break;
+			}
+		});
+		if (!files.some((file) => file.path === "extension.json")) ctx.addIssue({
+			code: "custom",
+			message: "extension.json is required"
+		});
+		const total = files.reduce((sum, file) => sum + file.size, 0);
+		if (total > 1e7) ctx.addIssue({
+			code: "custom",
+			message: `total size ${total} exceeds ${MAX_TOTAL_BYTES}`
+		});
+	})
+});
+const contributesSchema$1 = z.strictObject({
+	exerciseTypes: z.array(z.string()),
+	themes: z.array(z.string()),
+	markdownRenderers: z.array(z.string()),
+	gradePolicies: z.array(z.string())
+});
+const descendingUnique = (versions, ctx) => {
+	for (let i = 1; i < versions.length; i++) {
+		const previous = versions[i - 1]?.version ?? "";
+		const current = versions[i]?.version ?? "";
+		if (previous === current) ctx.addIssue({
+			code: "custom",
+			path: [i, "version"],
+			message: `duplicate version '${current}'`
+		});
+		else if (isSemver(previous) && isSemver(current)) {
+			if (compareSemver(previous, current) < 0) ctx.addIssue({
+				code: "custom",
+				path: [i, "version"],
+				message: "versions must be sorted newest first"
+			});
+		}
+	}
+};
+const entrySchema = z.strictObject({
+	id: extensionId$1,
+	name: z.string().min(1).max(80),
+	description: z.string().min(1).max(500),
+	author: z.string().regex(GITHUB_LOGIN_PATTERN, "must be a GitHub login"),
+	source: httpsUrl,
+	platforms: z.array(z.enum(EXTENSION_PLATFORMS)),
+	contributes: contributesSchema$1,
+	versions: z.array(versionSchema).min(1).max(5).superRefine(descendingUnique)
+});
+const rangeText = z.string().superRefine((value, ctx) => {
+	try {
+		parseRange(value);
+	} catch (error) {
+		if (!(error instanceof CatalogFormatError)) throw error;
+		ctx.addIssue({
+			code: "custom",
+			message: "invalid version range"
+		});
+	}
+});
+const revokedSchema = z.strictObject({
+	id: extensionId$1,
+	versions: rangeText,
+	reason: z.string().min(1).max(300)
+});
+const indexSchema = z.strictObject({
+	schemaVersion: z.literal(1),
+	generatedAt: timestamp,
+	extensions: z.array(entrySchema),
+	revoked: z.array(revokedSchema)
+});
+const parseIndex = (raw) => {
+	const parsed = indexSchema.safeParse(raw);
+	if (parsed.success) return parsed.data;
+	throw new CatalogFormatError(parsed.error.issues.map((issue) => `${issue.path.join(".") || "/"}: ${issue.message}`));
+};
+
+//#endregion
+//#region packages/extension-host/src/points/support.ts
+/** Относительный путь внутри каталога расширения: без `..`, `\` и ведущего `/`. */
+const isSafeRelativePath = (value) => value.length > 0 && !value.includes("\\") && !value.startsWith("/") && !value.split("/").includes("..");
+const safePath = (extensions) => z.string().refine(isSafeRelativePath, "must be a safe relative path").refine((value) => extensions.some((ext) => value.endsWith(ext)), `must end with ${extensions.join(" or ")}`);
+const extensionId = z.string().max(64).regex(EXTENSION_ID_PATTERN, "invalid extension id");
+/** Пути с нарушением правила «`id` равен id расширения или начинается с ним». */
+const idPrefixIssues = (key, ids, owner) => ids.flatMap((id, index) => id === owner || id.startsWith(`${owner}.`) ? [] : [`contributes.${key}.${index}.id: id must be '${owner}' or start with '${owner}.'`]);
+const isFile = async (file) => (await stat(file).catch(() => null))?.isFile() === true;
+/** Путь внутри каталога расширения; выход за каталог — ошибка. */
+const inside = (dir, relative) => {
+	const resolved = path.resolve(dir, relative);
+	if (!resolved.startsWith(dir + path.sep)) throw new Error(`path '${relative}' escapes the extension directory`);
+	return resolved;
+};
+const rendererUrlOf = (id, renderer) => `dolphy-ext://${id}/${renderer.replace(/^\.\//, "").split("/").map(encodeURIComponent).join("/")}`;
+const defaultNote = (value, fallback) => value === fallback ? " (default)" : "";
+/** Проверяет, что файл модуля существует (если проверка включена), и даёт адрес. */
+const resolveModuleUrl = async (extensionId, dir, file, fallback, verifyFiles, label) => {
+	const absolute = inside(dir, file);
+	if (verifyFiles && !await isFile(absolute)) throw new Error(`${label} '${file}'${defaultNote(file, fallback)} is not a file`);
+	return rendererUrlOf(extensionId, file);
+};
+const deepFreeze = (value) => {
+	if (typeof value === "object" && value !== null) {
+		for (const child of Object.values(value)) deepFreeze(child);
+		Object.freeze(value);
+	}
+	return value;
+};
+const compileSchema = (ajv, schema, label) => {
+	try {
+		ajv.compile(schema);
+	} catch (error) {
+		throw new Error(`schema ${label} does not compile: ${error instanceof Error ? error.message : String(error)}`);
+	}
+};
+/** Схема объектом (копия, заморожена) или файлом внутри каталога расширения. */
+const resolveSchema = async (ajv, dir, source, label) => {
+	if (typeof source !== "string") {
+		const schema = deepFreeze(structuredClone(source));
+		compileSchema(ajv, schema, `${label} (inline)`);
+		return schema;
+	}
+	const file = inside(dir, source);
+	let parsed;
+	try {
+		parsed = JSON.parse(await readFile(file, "utf8"));
+	} catch (error) {
+		throw new Error(`schema '${source}' is unreadable: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error(`schema '${source}' is not an object`);
+	compileSchema(ajv, parsed, `'${source}'`);
+	return parsed;
+};
+
+//#endregion
+//#region packages/extension-host/src/points/exercise-types.ts
+const schemaField = z.union([safePath([".json"]), z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, "must not be empty")]);
+const exerciseTypes = {
+	key: "exerciseTypes",
+	needsMain: true,
+	schema: z.strictObject({
+		id: extensionId,
+		specSchema: schemaField,
+		answerSchema: schemaField,
+		element: z.string().optional(),
+		renderer: safePath([".js", ".mjs"]).optional()
+	}),
+	normalize: (entries) => entries.map((type) => ({
+		id: type.id,
+		specSchema: type.specSchema,
+		answerSchema: type.answerSchema,
+		element: type.element ?? defaultElementName(type.id),
+		renderer: type.renderer ?? "./view.mjs"
+	})),
+	check: (entries, owner) => [...idPrefixIssues("exerciseTypes", entries.map(({ id }) => id), owner), ...entries.flatMap((type, index) => ELEMENT_NAME_PATTERN.test(type.element) ? [] : [`contributes.exerciseTypes.${index}.element: invalid element name '${type.element}'`])],
+	resolve: async (entries, { dir, extensionId: owner, verifyFiles, ajv }) => {
+		const resolved = [];
+		for (const contribution of entries) {
+			const rendererUrl = await resolveModuleUrl(owner, dir, contribution.renderer, DEFAULT_RENDERER, verifyFiles, "renderer");
+			resolved.push({
+				id: contribution.id,
+				specSchema: await resolveSchema(ajv, dir, contribution.specSchema, `specSchema of '${contribution.id}'`),
+				answerSchema: await resolveSchema(ajv, dir, contribution.answerSchema, `answerSchema of '${contribution.id}'`),
+				element: contribution.element,
+				rendererUrl
+			});
+		}
+		return resolved;
+	},
+	claims: (resolved) => resolved.flatMap((type) => [`exerciseType:${type.id}`, `element:${type.element}`])
+};
+
+//#endregion
+//#region packages/extension-host/src/points/grade-policies.ts
+const BUILTIN_POLICY_ID = "passAtN";
+const gradePolicies = {
+	key: "gradePolicies",
+	needsMain: true,
+	schema: z.strictObject({
+		id: extensionId.refine((id) => id !== BUILTIN_POLICY_ID, `id '${BUILTIN_POLICY_ID}' is reserved for the built-in policy`),
+		label: z.string().min(1).max(60)
+	}),
+	normalize: (entries) => entries,
+	check: (entries, owner) => idPrefixIssues("gradePolicies", entries.map(({ id }) => id), owner),
+	resolve: async (entries) => entries.map(({ id, label }) => ({
+		id,
+		label
+	})),
+	claims: (resolved) => resolved.map((policy) => `gradePolicy:${policy.id}`)
+};
+
+//#endregion
+//#region packages/extension-host/src/points/markdown-renderers.ts
+const markdownRenderers = {
+	key: "markdownRenderers",
+	needsMain: false,
+	schema: z.strictObject({
+		language: z.string().regex(/^[a-z][a-z0-9-]{0,31}$/, "invalid language"),
+		renderer: safePath([".js", ".mjs"]).optional()
+	}),
+	normalize: (entries) => entries.map((entry) => ({
+		language: entry.language,
+		renderer: entry.renderer ?? "./markdown.mjs"
+	})),
+	check: () => [],
+	resolve: async (entries, { dir, extensionId, verifyFiles }) => {
+		const resolved = [];
+		for (const entry of entries) resolved.push({
+			language: entry.language,
+			rendererUrl: await resolveModuleUrl(extensionId, dir, entry.renderer, DEFAULT_MARKDOWN_RENDERER, verifyFiles, "markdown renderer")
+		});
+		return resolved;
+	},
+	claims: (resolved) => resolved.map((entry) => `markdown:${entry.language}`)
+};
+
+//#endregion
+//#region packages/extension-host/src/points/themes.ts
+const HEX_COLOR = /^#[0-9a-fA-F]{6}([0-9a-fA-F]{2})?$/;
+const hexColor = z.string().regex(HEX_COLOR, "must be #rrggbb or #rrggbbaa");
+const unknownKeys = (record, allowed) => Object.keys(record).filter((key) => !allowed.includes(key));
+const rejectUnknownKeys = (allowed, noun) => (value, ctx) => {
+	const unknown = unknownKeys(value, allowed);
+	if (unknown.length === 0) return;
+	ctx.addIssue({
+		code: "custom",
+		message: `unknown ${noun} keys: ${unknown.join(", ")}`
+	});
+};
+const colors = z.record(z.string(), hexColor).refine((value) => Object.keys(value).length > 0, "must not be empty").superRefine(rejectUnknownKeys(THEME_COLOR_KEYS, "color"));
+const isVariableValid = (key, value) => key === "border-color" ? typeof value === "string" && HEX_COLOR.test(value) : typeof value === "number" && value >= 0 && value <= 1;
+const variables = z.record(z.string(), z.union([z.string(), z.number()])).superRefine(rejectUnknownKeys(THEME_VARIABLE_KEYS, "variable")).refine((value) => Object.entries(value).every(([key, item]) => isVariableValid(key, item)), "border-color must be a hex color, other variables numbers in [0, 1]");
+const themes = {
+	key: "themes",
+	needsMain: false,
+	schema: z.strictObject({
+		id: extensionId.refine((id) => !BUILTIN_THEME_IDS.includes(id), "id is reserved for a built-in theme"),
+		label: z.string().min(1).max(60),
+		dark: z.boolean(),
+		colors,
+		variables: variables.optional()
+	}),
+	normalize: (entries) => entries,
+	check: (entries, owner) => idPrefixIssues("themes", entries.map(({ id }) => id), owner),
+	resolve: async (entries) => entries.map((theme) => ({
+		id: theme.id,
+		label: theme.label,
+		dark: theme.dark,
+		colors: { ...theme.colors },
+		variables: { ...theme.variables }
+	})),
+	claims: (resolved) => resolved.map((theme) => `theme:${theme.id}`)
+};
+
+//#endregion
+//#region packages/extension-host/src/points/index.ts
+/** Реестр точек вклада: порядок значим для диагностики и разбора. */
+const CONTRIBUTION_POINTS = [
+	exerciseTypes,
+	themes,
+	markdownRenderers,
+	gradePolicies
+];
+const POINT_KEYS = CONTRIBUTION_POINTS.map(({ key }) => key);
+
+//#endregion
+//#region packages/extension-host/src/manifest.ts
+const contributesSchema = z.strictObject(Object.fromEntries(CONTRIBUTION_POINTS.map((point) => [point.key, z.array(point.schema).optional()])));
+const entriesOf = (contributes, key) => contributes[key] ?? [];
+const isEmpty = (contributes) => CONTRIBUTION_POINTS.every((point) => entriesOf(contributes, point.key).length === 0);
+const manifestSchema = z.strictObject({
+	id: extensionId,
+	version: z.string().refine(isSemver, "version must be semver"),
+	apiVersion: z.literal(1),
+	main: safePath([".mjs"]).optional(),
+	permissions: z.array(z.enum(EXTENSION_PERMISSIONS)).optional(),
+	name: z.string().min(1).max(80).optional(),
+	description: z.string().min(1).max(500).optional(),
+	author: z.string().regex(GITHUB_LOGIN_PATTERN, "must be a GitHub login").optional(),
+	platforms: z.array(z.enum(EXTENSION_PLATFORMS)).optional(),
+	minAppVersion: z.string().refine(isSemver, "minAppVersion must be semver x.y.z").optional(),
+	contributes: contributesSchema
+}).superRefine((manifest, ctx) => {
+	const { permissions = [], platforms = [] } = manifest;
+	platforms.forEach((platform, index) => {
+		if (platforms.indexOf(platform) !== index) ctx.addIssue({
+			code: "custom",
+			path: ["platforms", index],
+			message: `duplicate platform '${platform}'`
+		});
+	});
+	permissions.forEach((permission, index) => {
+		if (permissions.indexOf(permission) !== index) ctx.addIssue({
+			code: "custom",
+			path: ["permissions", index],
+			message: `duplicate permission '${permission}'`
+		});
+	});
+	if (isEmpty(manifest.contributes)) ctx.addIssue({
+		code: "custom",
+		path: ["contributes"],
+		message: "at least one contribution is required"
+	});
+});
+/** Код нужен, если есть записи в точке, которая его требует. */
+const needsMain = (contributes) => CONTRIBUTION_POINTS.some((point) => point.needsMain && entriesOf(contributes, point.key).length > 0);
+/** Применяет умолчания: `main`, `renderer`, `element`, пустые точки. */
+const normalizeManifest = (input) => {
+	const contributes = Object.fromEntries(CONTRIBUTION_POINTS.map((point) => [point.key, point.normalize(entriesOf(input.contributes, point.key))]));
+	return {
+		id: input.id,
+		version: input.version,
+		apiVersion: input.apiVersion,
+		main: input.main ?? (needsMain(input.contributes) ? "./main.mjs" : null),
+		permissions: [...input.permissions ?? []],
+		name: input.name ?? null,
+		description: input.description ?? null,
+		author: input.author ?? null,
+		platforms: [...input.platforms ?? []],
+		minAppVersion: input.minAppVersion ?? null,
+		contributes
+	};
+};
+const formatIssues = (error) => error.issues.map((issue) => `${issue.path.join(".") || "/"}: ${issue.message}`).join("; ");
+/** Сообщения о нарушениях в нормализованном манифесте. */
+const normalizedIssues = (manifest) => CONTRIBUTION_POINTS.flatMap((point) => point.check(manifest.contributes[point.key], manifest.id));
+const parseManifest = (raw) => {
+	const parsed = manifestSchema.safeParse(raw);
+	if (!parsed.success) return {
+		ok: false,
+		message: formatIssues(parsed.error)
+	};
+	const manifest = normalizeManifest(parsed.data);
+	const issues = normalizedIssues(manifest);
+	if (issues.length > 0) return {
+		ok: false,
+		message: issues.join("; ")
+	};
+	return {
+		ok: true,
+		manifest
+	};
+};
+
+//#endregion
+//#region packages/extension-host/src/discover.ts
+const compatibilityIssue = (manifest, appVersion, platform) => checkCompatibility(manifest, {
+	appVersion,
+	platform
+})?.detail ?? null;
+const resolveMain = async (dir, main, verifyFiles) => {
+	if (main === null) return null;
+	const mainPath = inside(dir, main);
+	if (verifyFiles && !await isFile(mainPath)) throw new Error(`main '${main}'${defaultNote(main, DEFAULT_MAIN)} is not a file`);
+	return mainPath;
+};
+const inspectExtensionDir = async (directory, options = {}) => {
+	const { verifyFiles = true, expectedId = null, appVersion, platform = process.platform } = options;
+	const dir = path.resolve(directory);
+	const dirName = expectedId ?? path.basename(dir);
+	const ajv = new Ajv2020({
+		allErrors: true,
+		strict: false
+	});
+	let raw;
+	try {
+		raw = JSON.parse(await readFile(path.join(dir, "extension.json"), "utf8"));
+	} catch (error) {
+		return {
+			ok: false,
+			id: dirName,
+			message: `extension.json is unreadable: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	const parsed = parseManifest(raw);
+	if (!parsed.ok) return {
+		ok: false,
+		id: dirName,
+		message: parsed.message
+	};
+	const { manifest } = parsed;
+	if (expectedId !== null && manifest.id !== expectedId) return {
+		ok: false,
+		id: dirName,
+		message: `directory name '${expectedId}' does not match manifest id '${manifest.id}'`
+	};
+	const incompatible = compatibilityIssue(manifest, appVersion, platform);
+	if (incompatible !== null) return {
+		ok: false,
+		id: manifest.id,
+		message: incompatible
+	};
+	try {
+		const mainPath = await resolveMain(dir, manifest.main, verifyFiles);
+		const context = {
+			dir,
+			extensionId: manifest.id,
+			verifyFiles,
+			ajv
+		};
+		const resolved = {};
+		for (const point of CONTRIBUTION_POINTS) resolved[point.key] = await point.resolve(manifest.contributes[point.key], context);
+		return {
+			ok: true,
+			extension: {
+				id: manifest.id,
+				version: manifest.version,
+				dir,
+				mainPath,
+				permissions: manifest.permissions,
+				name: manifest.name,
+				description: manifest.description,
+				author: manifest.author,
+				platforms: manifest.platforms,
+				minAppVersion: manifest.minAppVersion,
+				...resolved
+			}
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			id: manifest.id,
+			message: error instanceof Error ? error.message : String(error)
+		};
+	}
+};
+
+//#endregion
+//#region packages/extension-tools/src/errors.ts
+/** Ошибка сборки/проверки расширения; `subject` — id расширения или каталог. */
+var BuildError = class extends Error {
+	subject;
+	constructor(message, subject) {
+		super(message);
+		this.name = "BuildError";
+		this.subject = subject;
+	}
+};
+/** Неверные входные данные команды (несуществующий каталог): код выхода 2. */
+var CatalogUsageError = class extends BuildError {};
+
+//#endregion
+//#region packages/extension-tools/src/bundle.ts
+const isWatcher = (value) => typeof value === "object" && value !== null && "on" in value && "close" in value;
+const errorText$2 = (error) => error instanceof Error ? error.message : String(error);
+const nodeExternal = (external) => [
+	/^node:/,
+	...builtinModules,
+	...external
+];
+const bundleConfig = (project, entry, outDir, isNode) => ({
+	root: project.root,
+	configFile: false,
+	publicDir: false,
+	logLevel: "warn",
+	build: {
+		target: isNode ? "node22" : "es2022",
+		outDir,
+		emptyOutDir: false,
+		minify: false,
+		copyPublicDir: false,
+		lib: {
+			entry: path.resolve(project.root, entry.source),
+			formats: ["es"],
+			fileName: () => entry.output
+		},
+		rolldownOptions: { external: isNode ? nodeExternal(project.external) : [] }
+	}
+});
+const configsOf = (project, outDir) => [...project.nodeEntries.map((entry) => bundleConfig(project, entry, outDir, true)), ...project.browserEntries.map((entry) => bundleConfig(project, entry, outDir, false))];
+const sourcesOf = (project) => [...project.nodeEntries, ...project.browserEntries];
+const buildOne = async (config, entry, subject) => {
+	try {
+		await build(config);
+	} catch (error) {
+		throw new BuildError(`failed to bundle '${entry.source}': ${errorText$2(error)}`, subject);
+	}
+};
+/** Собирает все бандлы (по одному, без общих чанков) в `outDir`. */
+const bundleAll = async (project, outDir) => {
+	const configs = configsOf(project, outDir);
+	const entries = sourcesOf(project);
+	for (const [index, config] of configs.entries()) await buildOne(config, entries[index], project.manifest.id);
+};
+const whenFirstEnd = (watcher, entry, onRebuild) => {
+	let isFirst = true;
+	return new Promise((resolve, reject) => {
+		watcher.on("event", (event) => {
+			if (event.code === "ERROR") {
+				if (isFirst) reject(event.error);
+				else onRebuild(entry, event.error);
+			}
+			if (event.code === "END") {
+				if (isFirst) resolve();
+				else onRebuild(entry, null);
+				isFirst = false;
+			}
+		});
+	});
+};
+/**
+* Запускает вотчеры всех бандлов; резолвится после первой сборки каждого.
+* `onRebuild` вызывается после последующих пересборок (`error` — причина сбоя).
+*/
+const watchAll = async (project, outDir, onRebuild) => {
+	const watchers = [];
+	const close = async () => {
+		await Promise.all(watchers.map((watcher) => watcher.close()));
+	};
+	const entries = sourcesOf(project);
+	try {
+		const firsts = [];
+		for (const [index, config] of configsOf(project, outDir).entries()) {
+			const entry = entries[index];
+			const started = await build({
+				...config,
+				build: {
+					...config.build,
+					watch: {}
+				}
+			});
+			if (!isWatcher(started)) throw new Error(`watch mode is not available for '${entry.source}'`);
+			watchers.push(started);
+			firsts.push(whenFirstEnd(started, entry, onRebuild));
+		}
+		await Promise.all(firsts);
+	} catch (error) {
+		await close();
+		throw new BuildError(`failed to bundle: ${errorText$2(error)}`, project.manifest.id);
+	}
+	return { close };
+};
+
+//#endregion
+//#region packages/extension-tools/src/project.ts
+const MANIFEST_FILE = "extension.json";
+const CONFIG_FILE = "dolphy-ext.config.json";
+const DEFAULT_OUT_DIR = "dist-ext";
+const stripDot = (file) => file.replace(/^\.\//, "");
+const stripExtension = (file) => file.slice(0, file.length - path.posix.extname(file).length);
+const entrySource = (file) => `src/${path.posix.basename(stripExtension(file))}.ts`;
+const errorText$1 = (error) => error instanceof Error ? error.message : String(error);
+const isStringRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((item) => typeof item === "string");
+const isStringArray = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
+const readJson = async (file, subject) => {
+	try {
+		return JSON.parse(await readFile(file, "utf8"));
+	} catch (error) {
+		throw new BuildError(`${path.basename(file)} is unreadable: ${errorText$1(error)}`, subject);
+	}
+};
+const readConfig = async (root) => {
+	const file = path.join(root, CONFIG_FILE);
+	if (!((await stat(file).catch(() => null))?.isFile() === true)) return {
+		nodeEntries: {},
+		external: []
+	};
+	const config = await readJson(file, root);
+	const nodeEntries = config.nodeEntries ?? {};
+	const external = config.external ?? [];
+	if (!isStringRecord(nodeEntries) || !isStringArray(external)) throw new BuildError(`${CONFIG_FILE}: 'nodeEntries' must map output files to sources and 'external' must be a string array`, root);
+	return {
+		nodeEntries,
+		external
+	};
+};
+const schemaPathsOf = (manifest) => {
+	const paths = manifest.contributes.exerciseTypes.flatMap((type) => [type.specSchema, type.answerSchema]).filter((schema) => typeof schema === "string").map(stripDot);
+	return [...new Set(paths)];
+};
+/** Без кода (`main: null`) node-входов нет. */
+const nodeEntriesOf = (manifest, config) => {
+	if (manifest.main === null) return [];
+	const main = stripDot(manifest.main);
+	return [{
+		source: entrySource(main),
+		output: main
+	}, ...Object.entries(config.nodeEntries).map(([output, source]) => ({
+		source,
+		output: stripDot(output)
+	}))];
+};
+/** Читает исходный манифест и конфиг проекта, вычисляет точки входа. */
+const loadProject = async (rootDir) => {
+	const root = path.resolve(rootDir);
+	const manifestFile = path.join(root, MANIFEST_FILE);
+	let manifestBytes;
+	try {
+		manifestBytes = await readFile(manifestFile);
+	} catch (error) {
+		throw new BuildError(`${MANIFEST_FILE} is unreadable: ${errorText$1(error)}`, root);
+	}
+	const raw = await readJson(manifestFile, root);
+	const parsed = parseManifest(raw);
+	if (!parsed.ok) throw new BuildError(parsed.message, root);
+	const { manifest } = parsed;
+	const config = await readConfig(root);
+	const nodeEntries = nodeEntriesOf(manifest, config);
+	const browserEntries = [.../* @__PURE__ */ new Set([...manifest.contributes.exerciseTypes.map((type) => type.renderer), ...manifest.contributes.markdownRenderers.map((entry) => entry.renderer)])].map(stripDot).map((output) => ({
+		source: entrySource(output),
+		output
+	}));
+	return {
+		root,
+		manifest,
+		manifestBytes,
+		nodeEntries,
+		browserEntries,
+		external: config.external,
+		schemaPaths: schemaPathsOf(manifest)
+	};
+};
+
+//#endregion
+//#region packages/extension-tools/src/index.ts
+const STATIC_DIRS = ["schema", "assets"];
+const isPresent = async (file) => await stat(file).catch(() => null) !== null;
+const targetDir = (project, options) => {
+	const base = options.outDir ?? path.join(project.root, "dist-ext");
+	return path.join(path.resolve(base), project.manifest.id);
+};
+const requireSources = async (project) => {
+	const entries = [...project.nodeEntries, ...project.browserEntries];
+	for (const entry of entries) {
+		const file = path.join(project.root, entry.source);
+		if (!await isPresent(file)) throw new BuildError(`entry source '${entry.source}' for '${entry.output}' is not found`, project.manifest.id);
+	}
+};
+const copyStatic = async (project, dir) => {
+	await writeFile(path.join(dir, MANIFEST_FILE), project.manifestBytes);
+	for (const name of STATIC_DIRS) {
+		const from = path.join(project.root, name);
+		if (await isPresent(from)) await cp(from, path.join(dir, name), { recursive: true });
+	}
+	for (const schema of project.schemaPaths) {
+		const from = path.join(project.root, schema);
+		if (!await isPresent(from)) throw new BuildError(`schema '${schema}' referenced by the manifest is not found`, project.manifest.id);
+		await mkdir(path.dirname(path.join(dir, schema)), { recursive: true });
+		await cp(from, path.join(dir, schema));
+	}
+};
+const listFiles = async (dir, prefix = "") => {
+	const entries = await readdir(path.join(dir, prefix), { withFileTypes: true });
+	return (await Promise.all(entries.map(async (entry) => {
+		const relative = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+		return entry.isDirectory() ? listFiles(dir, relative) : [relative];
+	}))).flat().sort();
+};
+const validateExtension = async (dir) => {
+	const result = await inspectExtensionDir(path.resolve(dir), {
+		verifyFiles: true,
+		expectedId: null
+	});
+	return result.ok ? {
+		ok: true,
+		problems: []
+	} : {
+		ok: false,
+		problems: [result.message]
+	};
+};
+const assertValid = async (project, dir) => {
+	const { ok, problems } = await validateExtension(dir);
+	if (!ok) throw new BuildError(problems.join("; "), project.manifest.id);
+};
+const prepare = async (options) => {
+	const project = await loadProject(options.root);
+	await requireSources(project);
+	const dir = targetDir(project, options);
+	await rm(dir, {
+		recursive: true,
+		force: true
+	});
+	await mkdir(dir, { recursive: true });
+	return {
+		project,
+		dir
+	};
+};
+const resultOf$1 = async (project, dir) => ({
+	id: project.manifest.id,
+	dir,
+	files: await listFiles(dir)
+});
+const buildExtension = async (options) => {
+	const { project, dir } = await prepare(options);
+	await bundleAll(project, dir);
+	await copyStatic(project, dir);
+	await assertValid(project, dir);
+	return resultOf$1(project, dir);
+};
+/**
+* Первая сборка + пересборка бандлов при правке исходников до `close()`.
+* Манифест, схемы и assets копируются один раз: их правка требует перезапуска.
+*/
+const watchExtension = async (options) => {
+	const { project, dir } = await prepare(options);
+	const { logger } = options;
+	const watch = await watchAll(project, dir, (entry, error) => {
+		if (error === null) logger?.info(`rebuilt ${entry.output}`);
+		else {
+			const message = error instanceof Error ? error.message : String(error);
+			logger?.error(`error ${project.manifest.id}: ${message}`);
+		}
+	});
+	try {
+		await copyStatic(project, dir);
+		await assertValid(project, dir);
+	} catch (error) {
+		await watch.close();
+		throw error;
+	}
+	return {
+		result: await resultOf$1(project, dir),
+		close: watch.close
+	};
+};
+
+//#endregion
+//#region packages/extension-tools/src/catalog/github.ts
+const API = "https://api.github.com/users/";
+const statusOf = (response) => {
+	if (response.status === 200) return "exists";
+	if (response.status === 404) return "missing";
+	return "unknown";
+};
+/** Результат кэшируется на время жизни проверяющего: один автор — один запрос. */
+const createGithubChecker = (options = {}) => {
+	const fetchUser = options.fetch ?? fetch;
+	const headers = {
+		accept: "application/vnd.github+json",
+		"user-agent": "dolphy-ext",
+		...options.token ? { authorization: `Bearer ${options.token}` } : {}
+	};
+	const cache = /* @__PURE__ */ new Map();
+	const lookup = async (login) => {
+		try {
+			const url = `${API}${encodeURIComponent(login)}`;
+			return statusOf(await fetchUser(url, { headers }));
+		} catch {
+			return "unknown";
+		}
+	};
+	return (login) => {
+		const cached = cache.get(login);
+		if (cached !== void 0) return cached;
+		const pending = lookup(login);
+		cache.set(login, pending);
+		return pending;
+	};
+};
+
+//#endregion
+//#region packages/extension-tools/src/catalog/rules.ts
+const MAX_SOURCE_FILES = 200;
+const MAX_SOURCE_BYTES = 5e6;
+const MAX_SOURCE_FILE_BYTES = 1e6;
+const LOCKFILES = [
+	"package-lock.json",
+	"pnpm-lock.yaml",
+	"yarn.lock",
+	"bun.lock"
+];
+const LIFECYCLE_SCRIPTS = [
+	"preinstall",
+	"install",
+	"postinstall",
+	"prepare",
+	"prepublish",
+	"prepublishOnly",
+	"prepack",
+	"postpack"
+];
+const EXECUTABLE_EXTENSIONS = [
+	".exe",
+	".dll",
+	".so",
+	".dylib",
+	".node",
+	".sh",
+	".bat"
+];
+const REQUIRED_SCOPE = "@dolphy-app";
+const DEPENDENCY_FIELDS = [
+	"dependencies",
+	"devDependencies",
+	"optionalDependencies",
+	"peerDependencies"
+];
+const NON_REGISTRY_SPECIFIER = /^(git[+:@]|github:|gitlab:|bitbucket:|gist:|https?:|file:|link:|workspace:|portal:|patch:|\.{0,2}\/|[\w.-]+\/[\w.-]+(#.*)?$)/;
+const MAX_NAME_LENGTH = 80;
+const MAX_DESCRIPTION_LENGTH = 500;
+const error = (field, message) => ({
+	severity: "error",
+	field,
+	message
+});
+const warning = (field, message) => ({
+	severity: "warning",
+	field,
+	message
+});
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const readPackageJson = async (context) => {
+	const text = await context.readText("package.json");
+	if (text === null) return null;
+	try {
+		const parsed = JSON.parse(text);
+		return isRecord(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+};
+const manifestValid = {
+	id: "CHECK-001",
+	title: "extension.json читается и проходит разбор манифеста",
+	run: ({ manifestProblem }) => manifestProblem === null ? [] : [error("extension.json", manifestProblem)]
+};
+const directoryName = {
+	id: "CHECK-002",
+	title: "имя каталога равно id из манифеста",
+	run: ({ manifest, dirName }) => manifest === null || manifest.id === dirName ? [] : [error("id", `directory name '${dirName}' does not match manifest id '${manifest.id}'`)]
+};
+const textFinding = (field, value, maxLength) => {
+	if (value === null || value.trim() === "") return [error(field, `'${field}' is required for publication`)];
+	return value.length > maxLength ? [error(field, `'${field}' is longer than ${maxLength} characters`)] : [];
+};
+const publicationMetadata = {
+	id: "CHECK-003",
+	title: "заданы name, description и author",
+	run: ({ declared }) => declared === null ? [] : [
+		...textFinding("name", declared.name, MAX_NAME_LENGTH),
+		...textFinding("description", declared.description, MAX_DESCRIPTION_LENGTH),
+		...textFinding("author", declared.author, Infinity)
+	]
+};
+const readme = {
+	id: "CHECK-004",
+	title: "README.md существует и не пуст",
+	run: async (context) => {
+		const text = await context.readText("README.md");
+		return text === null || text.trim() === "" ? [error("README.md", "README.md is missing or empty")] : [];
+	}
+};
+const isLogin = (author) => GITHUB_LOGIN_PATTERN.test(author);
+const authorLogin = {
+	id: "CHECK-005",
+	title: "author имеет форму GitHub-логина",
+	run: ({ declared }) => declared?.author && !isLogin(declared.author) ? [error("author", `'${declared.author}' is not a GitHub login`)] : []
+};
+const authorExists = {
+	id: "CHECK-006",
+	title: "author — существующий пользователь GitHub",
+	run: async ({ declared, skipGithubCheck, checkGithubUser }) => {
+		const author = declared?.author;
+		if (skipGithubCheck || !author || !isLogin(author)) return [];
+		const status = await checkGithubUser(author);
+		if (status === "missing") return [error("author", `GitHub user '${author}' does not exist`)];
+		return status === "unknown" ? [warning("author", `could not verify GitHub user '${author}'`)] : [];
+	}
+};
+const packageJson = {
+	id: "CHECK-007",
+	title: "package.json существует и разбирается",
+	run: async (context) => {
+		if (await context.readText("package.json") === null) return [error("package.json", "package.json is missing")];
+		return await readPackageJson(context) === null ? [error("package.json", "package.json is not a valid JSON object")] : [];
+	}
+};
+const lockfile = {
+	id: "CHECK-008",
+	title: "есть lock-файл зависимостей",
+	run: ({ tree }) => LOCKFILES.some((name) => tree.files.some((file) => file.path === name)) ? [] : [error("package.json", `no lockfile (${LOCKFILES.join(", ")})`)]
+};
+const lifecycleScripts = {
+	id: "CHECK-009",
+	title: "нет lifecycle-скриптов установки и публикации",
+	run: async (context) => {
+		const scripts = (await readPackageJson(context))?.scripts;
+		if (!isRecord(scripts)) return [];
+		return LIFECYCLE_SCRIPTS.filter((name) => name in scripts).map((name) => error(`scripts.${name}`, `lifecycle script '${name}' is not allowed`));
+	}
+};
+const registryDependencies = {
+	id: "CHECK-010",
+	title: "зависимости только из реестра (без git, http, file, link, workspace)",
+	run: async (context) => {
+		const manifest = await readPackageJson(context);
+		if (manifest === null) return [];
+		return DEPENDENCY_FIELDS.flatMap((field) => {
+			const section = manifest[field];
+			if (!isRecord(section)) return [];
+			return Object.entries(section).filter(([, spec]) => typeof spec !== "string" || NON_REGISTRY_SPECIFIER.test(spec.trim())).map(([name, spec]) => error(`${field}.${name}`, `specifier '${String(spec)}' is not a registry range`));
+		});
+	}
+};
+const packageScope = {
+	id: "CHECK-011",
+	title: "name в package.json не занимает чужой scope",
+	run: async (context) => {
+		const name = (await readPackageJson(context))?.name;
+		if (typeof name !== "string" || !name.startsWith("@")) return [];
+		return name.startsWith(`${"@dolphy-app"}/`) ? [] : [warning("name", `package scope of '${name}' is not ${REQUIRED_SCOPE}`)];
+	}
+};
+const newerThanPublished = {
+	id: "CHECK-012",
+	title: "версия строго больше опубликованной",
+	run: ({ manifest, published }) => {
+		if (manifest === null || published === void 0) return [];
+		const { version } = manifest;
+		if (published.versions.some((item) => item.version === version)) return [error("version", `version ${version} is already published`)];
+		const newest = published.versions[0]?.version;
+		return newest !== void 0 && compareSemver(version, newest) < 0 ? [error("version", `version ${version} is not greater than published ${newest}`)] : [];
+	}
+};
+const sourceLimits = {
+	id: "CHECK-013",
+	title: `не более ${200} файлов и 5 МБ исходников, файл не больше 1 МБ`,
+	run: ({ tree }) => {
+		const findings = [];
+		const total = tree.files.reduce((sum, file) => sum + file.size, 0);
+		if (tree.files.length > 200) findings.push(error("files", `${tree.files.length} files exceed the limit of ${200}`));
+		if (total > 5e6) findings.push(error("files", `${total} bytes exceed the limit of ${MAX_SOURCE_BYTES}`));
+		for (const file of tree.files) if (file.size > 1e6) findings.push(error(file.path, `file is ${file.size} bytes, limit is ${MAX_SOURCE_FILE_BYTES}`));
+		return findings;
+	}
+};
+const noSymlinks = {
+	id: "CHECK-014",
+	title: "нет символических ссылок",
+	run: ({ tree }) => tree.symlinks.map((link) => error(link, "symbolic links are not allowed"))
+};
+const noExecutables = {
+	id: "CHECK-015",
+	title: `нет исполняемых файлов (${EXECUTABLE_EXTENSIONS.join(", ")})`,
+	run: ({ tree }) => tree.files.filter((file) => EXECUTABLE_EXTENSIONS.includes(path.posix.extname(file.path).toLowerCase())).map((file) => error(file.path, "executable files are not allowed"))
+};
+const appVersionBound = {
+	id: "CHECK-016",
+	title: "minAppVersion не новее --max-app-version",
+	run: ({ manifest, maxAppVersion }) => manifest?.minAppVersion && maxAppVersion !== null && compareSemver(manifest.minAppVersion, maxAppVersion) > 0 ? [error("minAppVersion", `minAppVersion ${manifest.minAppVersion} is newer than the released app ${maxAppVersion}`)] : []
+};
+const RULES = [
+	manifestValid,
+	directoryName,
+	publicationMetadata,
+	readme,
+	authorLogin,
+	authorExists,
+	packageJson,
+	lockfile,
+	lifecycleScripts,
+	registryDependencies,
+	packageScope,
+	newerThanPublished,
+	sourceLimits,
+	noSymlinks,
+	noExecutables,
+	appVersionBound
+];
+
+//#endregion
+//#region packages/extension-tools/src/catalog/tree.ts
+const compareText = (a, b) => {
+	if (a === b) return 0;
+	return a < b ? -1 : 1;
+};
+const sha256Of = (data) => createHash("sha256").update(data).digest("hex");
+const readTree = async (root, skipped = /* @__PURE__ */ new Set()) => {
+	const tree = {
+		files: [],
+		symlinks: []
+	};
+	const visit = async (prefix) => {
+		const entries = await readdir(path.join(root, prefix), { withFileTypes: true });
+		entries.sort((a, b) => compareText(a.name, b.name));
+		for (const entry of entries) {
+			if (skipped.has(entry.name)) continue;
+			const relative = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+			if (entry.isSymbolicLink()) tree.symlinks.push(relative);
+			else if (entry.isDirectory()) await visit(relative);
+			else {
+				const { size } = await lstat(path.join(root, relative));
+				tree.files.push({
+					path: relative,
+					size
+				});
+			}
+		}
+	};
+	await visit("");
+	return tree;
+};
+const hashTree = async (root, files) => Promise.all(files.map(async (file) => ({
+	...file,
+	sha256: sha256Of(await readFile(path.join(root, file.path)))
+})));
+
+//#endregion
+//#region packages/extension-tools/src/catalog/check.ts
+const SKIPPED_SOURCE_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	"dist-ext",
+	".git"
+]);
+const formatFinding = (finding) => `${finding.severity} ${finding.extensionId} ${finding.ruleId} ${finding.field}: ${finding.message}`;
+const hasErrors = (findings) => findings.some((finding) => finding.severity === "error");
+const isMissing = (error) => error.code === "ENOENT";
+const loadIndexFile = async (file) => {
+	let text;
+	try {
+		text = await readFile(file, "utf8");
+	} catch (error) {
+		if (isMissing(error)) return null;
+		throw error;
+	}
+	try {
+		return parseIndex(JSON.parse(text));
+	} catch (error) {
+		throw new BuildError(`${file} is not a valid catalog index: ${error instanceof Error ? error.message : String(error)}`, file);
+	}
+};
+const listExtensionDirs = async (root) => {
+	return (await readdir(root, { withFileTypes: true }).catch((error) => {
+		throw new CatalogUsageError(`cannot read extensions directory: ${error instanceof Error ? error.message : String(error)}`, root);
+	})).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name).sort();
+};
+const selectDirs = async (options) => {
+	const all = await listExtensionDirs(options.extensionsDir);
+	if (options.ids === void 0) return all;
+	const missing = options.ids.filter((id) => !all.includes(id));
+	if (missing.length > 0) throw new CatalogUsageError(`no such extension directories: ${missing.join(", ")}`, options.extensionsDir);
+	return [...options.ids].sort();
+};
+const readTextOrNull = async (file) => {
+	return (await stat(file).catch(() => null))?.isFile() === true ? readFile(file, "utf8") : null;
+};
+const inspectManifest = async (dir) => {
+	const result = await inspectExtensionDir(dir, {
+		verifyFiles: false,
+		expectedId: null
+	});
+	return result.ok ? {
+		manifest: result.extension,
+		problem: null
+	} : {
+		manifest: null,
+		problem: result.message
+	};
+};
+const stringOrNull = (value) => typeof value === "string" ? value : null;
+const readDeclared = async (dir) => {
+	try {
+		const raw = JSON.parse(await readFile(path.join(dir, "extension.json"), "utf8"));
+		if (typeof raw !== "object" || raw === null) return null;
+		const fields = raw;
+		return {
+			name: stringOrNull(fields.name),
+			description: stringOrNull(fields.description),
+			author: stringOrNull(fields.author)
+		};
+	} catch {
+		return null;
+	}
+};
+const contextFor = async (options, dirName, published, checkGithubUser) => {
+	const dir = path.resolve(options.extensionsDir, dirName);
+	const { manifest, problem } = await inspectManifest(dir);
+	return {
+		dirName,
+		dir,
+		manifest,
+		declared: await readDeclared(dir),
+		manifestProblem: problem,
+		tree: await readTree(dir, SKIPPED_SOURCE_DIRS),
+		readText: (file) => readTextOrNull(path.join(dir, file)),
+		published: published?.extensions.find((entry) => entry.id === (manifest?.id ?? dirName)),
+		maxAppVersion: options.maxAppVersion ?? null,
+		skipGithubCheck: options.skipGithubCheck === true,
+		checkGithubUser
+	};
+};
+const checkCatalog = async (options) => {
+	const dirs = await selectDirs(options);
+	const published = options.publishedIndex === void 0 ? null : await loadIndexFile(options.publishedIndex);
+	const checkGithubUser = options.checkGithubUser ?? createGithubChecker({
+		...options.fetch === void 0 ? {} : { fetch: options.fetch },
+		token: options.githubToken
+	});
+	const findings = [];
+	for (const dirName of dirs) {
+		const context = await contextFor(options, dirName, published, checkGithubUser);
+		for (const rule of RULES) for (const finding of await rule.run(context)) findings.push({
+			...finding,
+			extensionId: dirName,
+			ruleId: rule.id
+		});
+	}
+	return findings;
+};
+const listRules = () => RULES.map((rule) => `${rule.id} ${rule.title}`);
+
+//#endregion
+//#region packages/extension-tools/src/catalog/index-file.ts
+const INDEX_FILE = "index.json";
+const orderFile = (file) => ({
+	path: file.path,
+	size: file.size,
+	sha256: file.sha256
+});
+const byPath = (a, b) => compareText(a.path, b.path);
+const sameFiles = (a, b) => JSON.stringify([...a].sort(byPath).map(orderFile)) === JSON.stringify([...b].sort(byPath).map(orderFile));
+const orderVersion = (version) => ({
+	version: version.version,
+	apiVersion: version.apiVersion,
+	minAppVersion: version.minAppVersion,
+	permissions: [...version.permissions],
+	publishedAt: version.publishedAt,
+	baseUrl: version.baseUrl,
+	files: [...version.files].sort(byPath).map(orderFile)
+});
+const orderEntry = (entry) => ({
+	id: entry.id,
+	name: entry.name,
+	description: entry.description,
+	author: entry.author,
+	source: entry.source,
+	platforms: [...entry.platforms],
+	contributes: {
+		exerciseTypes: [...entry.contributes.exerciseTypes],
+		themes: [...entry.contributes.themes],
+		markdownRenderers: [...entry.contributes.markdownRenderers],
+		gradePolicies: [...entry.contributes.gradePolicies]
+	},
+	versions: entry.versions.map(orderVersion)
+});
+const byId = (a, b) => compareText(a.id, b.id);
+const newestFirst = (versions) => [...versions].sort((a, b) => compareSemver(b.version, a.version)).slice(0, 5);
+/** Собирает индекс в стабильном порядке ключей; бросает `BuildError`, если он не проходит `parseIndex`. */
+const assembleIndex = (parts) => {
+	const candidate = {
+		schemaVersion: 1,
+		generatedAt: parts.generatedAt,
+		extensions: [...parts.extensions].sort(byId).map(orderEntry),
+		revoked: parts.revoked.map((item) => ({
+			id: item.id,
+			versions: item.versions,
+			reason: item.reason
+		}))
+	};
+	try {
+		parseIndex(candidate);
+		return candidate;
+	} catch (error) {
+		throw new BuildError(`resulting index is invalid: ${error instanceof Error ? error.message : String(error)}`, INDEX_FILE);
+	}
+};
+const writeIndexAtomically = async (file, index) => {
+	const temporary = `${file}.${process.pid}.tmp`;
+	await writeFile(temporary, `${JSON.stringify(index, null, 2)}\n`);
+	await rename(temporary, file);
+};
+const contentOf = (index) => {
+	const { extensions, revoked } = assembleIndex({
+		generatedAt: index.generatedAt,
+		extensions: index.extensions,
+		revoked: index.revoked
+	});
+	return JSON.stringify({
+		extensions,
+		revoked
+	});
+};
+/** Совпадают ли записи и список отзыва (без `generatedAt`). */
+const hasSameContent = (current, next) => current !== null && contentOf(current) === contentOf(next);
+
+//#endregion
+//#region packages/extension-tools/src/catalog/build.ts
+const DEFAULT_SOURCE_BASE = "https://github.com/dolphy-app/dolphy-extensions/tree/main/extensions";
+const errorText = (error) => error instanceof Error ? error.message : String(error);
+const README = "README.md";
+const copyReadme = async (srcDir, dir, id) => {
+	const text = await readFile(path.join(srcDir, README), "utf8").catch(() => "");
+	if (text.trim() === "") throw new BuildError(`${README} is missing or empty`, id);
+	await writeFile(path.join(dir, README), text);
+};
+const fileProblems = (files) => {
+	const problems = files.filter((file) => !isSafeCatalogPath(file.path)).map((file) => `'${file.path}' is not allowed (extensions ${CATALOG_FILE_EXTENSIONS.join("|")}, safe path segments)`);
+	if (files.length > 50) problems.push(`${files.length} files exceed the limit of ${50}`);
+	const total = files.reduce((sum, file) => sum + file.size, 0);
+	if (total > 1e7) problems.push(`${total} bytes exceed the limit of ${MAX_TOTAL_BYTES}`);
+	return problems;
+};
+const readBuiltManifest = async (dir) => {
+	const parsed = parseManifest(JSON.parse(await readFile(path.join(dir, "extension.json"), "utf8")));
+	if (!parsed.ok) throw new BuildError(parsed.message, dir);
+	return parsed.manifest;
+};
+const stage = async (options, id, scratch) => {
+	const srcDir = path.resolve(options.src, id);
+	const built = await buildExtension({
+		root: srcDir,
+		outDir: scratch
+	});
+	if (built.id !== id) throw new BuildError(`directory name '${id}' does not match manifest id '${built.id}'`, id);
+	await copyReadme(srcDir, built.dir, id);
+	const tree = await readTree(built.dir);
+	const files = await hashTree(built.dir, tree.files);
+	const problems = [...tree.symlinks.map((link) => `'${link}' is a symbolic link`), ...fileProblems(files)];
+	if (problems.length > 0) throw new BuildError(problems.join("; "), id);
+	return {
+		id,
+		dir: built.dir,
+		manifest: await readBuiltManifest(built.dir),
+		files: files.map(({ path: file, size, sha256 }) => ({
+			path: file,
+			size,
+			sha256
+		}))
+	};
+};
+const requirePublication = (staged) => {
+	const { name, description, author } = staged.manifest;
+	const missing = Object.entries({
+		name,
+		description,
+		author
+	}).filter(([, value]) => value === null || value.trim() === "").map(([key]) => key);
+	if (missing.length > 0) throw new BuildError(`manifest lacks publication metadata: ${missing.join(", ")}`, staged.id);
+};
+const versionDir = (out, staged) => path.join(out, "extensions", staged.id, staged.manifest.version);
+const baseUrlOf = (staged) => `extensions/${staged.id}/${staged.manifest.version}/`;
+const existingFiles = async (dir) => {
+	if (await stat(dir).catch(() => null) === null) return null;
+	const tree = await readTree(dir);
+	if (tree.symlinks.length > 0) return [];
+	return (await hashTree(dir, tree.files)).map(({ path: file, size, sha256 }) => ({
+		path: file,
+		size,
+		sha256
+	}));
+};
+const immutabilityError = (staged) => new BuildError(`version ${staged.manifest.version} is already published with different content; published versions never change`, staged.id);
+const newRecord = (staged, publishedAt) => ({
+	version: staged.manifest.version,
+	apiVersion: staged.manifest.apiVersion,
+	minAppVersion: staged.manifest.minAppVersion,
+	permissions: [...staged.manifest.permissions],
+	publishedAt,
+	baseUrl: baseUrlOf(staged),
+	files: staged.files
+});
+const plan = async (staged, out, previous, publishedAt) => {
+	const onDisk = await existingFiles(versionDir(out, staged));
+	const recorded = previous?.versions.find((item) => item.version === staged.manifest.version);
+	if (onDisk !== null && !sameFiles(onDisk, staged.files)) throw immutabilityError(staged);
+	if (recorded !== void 0 && !sameFiles(recorded.files, staged.files)) throw immutabilityError(staged);
+	const isPublished = onDisk !== null && recorded !== void 0;
+	return {
+		staged,
+		record: recorded ?? newRecord(staged, publishedAt),
+		status: isPublished ? "unchanged" : "published",
+		shouldWrite: onDisk === null
+	};
+};
+const entryOf = (item, previous, sourceBase) => {
+	const { staged, record } = item;
+	const { manifest } = staged;
+	const others = (previous?.versions ?? []).filter((version) => version.version !== record.version);
+	return {
+		id: staged.id,
+		name: manifest.name ?? "",
+		description: manifest.description ?? "",
+		author: manifest.author ?? "",
+		source: `${sourceBase.replace(/\/+$/, "")}/${staged.id}`,
+		platforms: [...manifest.platforms],
+		contributes: {
+			exerciseTypes: manifest.contributes.exerciseTypes.map((type) => type.id),
+			themes: manifest.contributes.themes.map((theme) => theme.id),
+			markdownRenderers: manifest.contributes.markdownRenderers.map((renderer) => renderer.language),
+			gradePolicies: manifest.contributes.gradePolicies.map((policy) => policy.id)
+		},
+		versions: newestFirst([record, ...others])
+	};
+};
+const loadRevoked = async (file, previous) => {
+	if (file === void 0) return previous?.revoked ?? [];
+	let raw;
+	try {
+		raw = JSON.parse(await readFile(file, "utf8"));
+	} catch (error) {
+		throw new BuildError(`revoked list is unreadable: ${errorText(error)}`, file);
+	}
+	if (!Array.isArray(raw)) throw new BuildError("revoked list must be a JSON array", file);
+	return raw;
+};
+const writeVersion = async (item, out) => {
+	const target = versionDir(out, item.staged);
+	const parent = path.dirname(target);
+	await mkdir(parent, { recursive: true });
+	const temporary = `${target}.${process.pid}.tmp`;
+	await rm(temporary, {
+		recursive: true,
+		force: true
+	});
+	await cp(item.staged.dir, temporary, { recursive: true });
+	await rename(temporary, target);
+};
+const resultOf = (item) => ({
+	id: item.staged.id,
+	version: item.staged.manifest.version,
+	status: item.status,
+	files: item.staged.files.length,
+	bytes: item.staged.files.reduce((sum, file) => sum + file.size, 0)
+});
+const formatPublishResult = (result) => result.status === "unchanged" ? `unchanged ${result.id}@${result.version}` : `published ${result.id}@${result.version} (${result.files} files, ${result.bytes} bytes)`;
+/** Собирает версии расширений и обновляет `index.json`; при ошибке на диск ничего не пишется. */
+const buildCatalog = async (options) => {
+	const out = path.resolve(options.out);
+	const now = (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+	const publishedAt = options.publishedAt ?? now;
+	const sourceBase = options.sourceBase ?? "https://github.com/dolphy-app/dolphy-extensions/tree/main/extensions";
+	const previous = await loadIndexFile(path.resolve(options.previousIndex ?? path.join(out, "index.json")));
+	const revoked = await loadRevoked(options.revoked, previous);
+	const scratch = await mkdtemp(path.join(tmpdir(), "dolphy-catalog-"));
+	try {
+		const plans = [];
+		const entries = new Map((previous?.extensions ?? []).map((entry) => [entry.id, entry]));
+		for (const id of options.ids) {
+			const staged = await stage(options, id, scratch);
+			requirePublication(staged);
+			const before = entries.get(id);
+			const item = await plan(staged, out, before, publishedAt);
+			plans.push(item);
+			entries.set(id, entryOf(item, before, sourceBase));
+		}
+		const index = assembleIndex({
+			generatedAt: now,
+			extensions: [...entries.values()],
+			revoked
+		});
+		for (const item of plans) if (item.shouldWrite) await writeVersion(item, out);
+		await mkdir(out, { recursive: true });
+		const indexFile = path.join(out, INDEX_FILE);
+		if (!hasSameContent(await loadIndexFile(indexFile), index)) await writeIndexAtomically(indexFile, index);
+		return plans.map(resultOf);
+	} finally {
+		await rm(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+};
+const formatReindexResult = (result) => `reindexed (${result.extensions} extensions, ${result.revoked} revoked)${result.changed ? "" : " — no changes"}`;
+/** Перезаписывает `revoked` и `generatedAt` существующего индекса; записи расширений не меняются. */
+const reindexCatalog = async (options) => {
+	const out = path.resolve(options.out);
+	const source = path.resolve(options.previousIndex ?? path.join(out, "index.json"));
+	const previous = await loadIndexFile(source);
+	if (previous === null) throw new CatalogUsageError(`nothing to reindex: ${source} does not exist`, source);
+	const index = assembleIndex({
+		generatedAt: options.publishedAt ?? (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+		extensions: previous.extensions,
+		revoked: await loadRevoked(options.revoked, previous)
+	});
+	const indexFile = path.join(out, INDEX_FILE);
+	const changed = !hasSameContent(await loadIndexFile(indexFile), index);
+	if (changed) {
+		await mkdir(out, { recursive: true });
+		await writeIndexAtomically(indexFile, index);
+	}
+	return {
+		extensions: index.extensions.length,
+		revoked: index.revoked.length,
+		changed
+	};
+};
+
+//#endregion
+//#region packages/extension-tools/src/catalog/cli.ts
+const CATALOG_SYNOPSIS = `       dolphy-ext catalog check <extensionsDir> [--ids a,b]
+                   [--published-index <path>] [--max-app-version <x.y.z>]
+                   [--skip-github-check] [--list-rules]
+       dolphy-ext catalog build --src <extensionsDir> --ids a,b --out <siteDir>
+                   [--previous-index <path>] [--revoked <path>]
+                   [--source-base <url>] [--published-at <iso>]
+       dolphy-ext catalog build --reindex --out <siteDir>
+                   [--previous-index <path>] [--revoked <path>]
+                   [--published-at <iso>]
+`;
+const CATALOG_HELP = `  catalog check    проверить исходники расширений каталога; строки
+                   «error|warning <id> <RULE-ID> <поле>: <сообщение>»,
+                   код 1 при наличии error
+  catalog build    собрать версии в <siteDir>/extensions/<id>/<version>/ и
+                   обновить <siteDir>/index.json (опубликованные версии
+                   неизменны)
+  catalog build --reindex
+                   только заменить revoked и generatedAt в существующем
+                   <siteDir>/index.json (--src и --ids не нужны)
+
+  --ids a,b              только эти расширения (check: по умолчанию все)
+  --published-index <p>  index.json опубликованного каталога (нет файла —
+                         ничего не опубликовано)
+  --max-app-version <v>  minAppVersion не должен быть новее
+  --skip-github-check    не проверять автора через api.github.com
+                         (токен — переменная GITHUB_TOKEN)
+  --list-rules           вывести правила check
+  --src <dir>            каталог с проектами <dir>/<id>
+  --out <dir>            корень сайта
+  --previous-index <p>   исходный индекс (по умолчанию <out>/index.json)
+  --revoked <p>          JSON-массив {id, versions, reason}
+  --source-base <url>    основа поля source записи индекса
+  --published-at <iso>   publishedAt новых версий (по умолчанию сейчас);
+                         с --reindex — generatedAt
+`;
+const VALUE_FLAGS = {
+	check: [
+		"--ids",
+		"--published-index",
+		"--max-app-version"
+	],
+	build: [
+		"--src",
+		"--ids",
+		"--out",
+		"--previous-index",
+		"--revoked",
+		"--source-base",
+		"--published-at"
+	]
+};
+const SWITCHES = {
+	check: ["--skip-github-check", "--list-rules"],
+	build: ["--reindex"]
+};
+const readFlags = (mode, args) => {
+	const flags = {};
+	const positional = [];
+	const valued = VALUE_FLAGS[mode];
+	const switches = SWITCHES[mode];
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (switches.includes(arg)) flags[arg] = true;
+		else if (valued.includes(arg)) {
+			const value = args[++i];
+			if (value === void 0) return `${arg} требует значение`;
+			flags[arg] = value;
+		} else if (arg.startsWith("-")) return `неизвестный флаг: ${arg}`;
+		else positional.push(arg);
+	}
+	return {
+		flags,
+		positional
+	};
+};
+const text = (flags, name) => {
+	const value = flags[name];
+	return typeof value === "string" ? value : void 0;
+};
+const idsOf = (flags) => {
+	const value = text(flags, "--ids");
+	if (value === void 0) return value;
+	return [...new Set(value.split(",").map((id) => id.trim()).filter(Boolean))];
+};
+const parseCheck = (args) => {
+	const read = readFlags("check", args);
+	if (typeof read === "string") return { usageError: read };
+	const { flags, positional } = read;
+	const maxAppVersion = text(flags, "--max-app-version");
+	if (maxAppVersion !== void 0 && !isSemver(maxAppVersion)) return { usageError: "--max-app-version: нужен semver x.y.z" };
+	const listRulesFlag = flags["--list-rules"] === true;
+	if (positional.length > 1) return { usageError: `лишние аргументы: ${positional.slice(1).join(" ")}` };
+	if (positional[0] === void 0 && !listRulesFlag) return { usageError: "catalog check: не указан каталог расширений" };
+	return {
+		command: "check",
+		dir: positional[0] ?? null,
+		ids: idsOf(flags),
+		publishedIndex: text(flags, "--published-index"),
+		maxAppVersion,
+		skipGithubCheck: flags["--skip-github-check"] === true,
+		listRules: listRulesFlag
+	};
+};
+const REINDEX_FORBIDDEN = [
+	"--src",
+	"--ids",
+	"--source-base"
+];
+const parseReindex = (flags) => {
+	const forbidden = REINDEX_FORBIDDEN.find((name) => name in flags);
+	if (forbidden !== void 0) return { usageError: `catalog build --reindex: ${forbidden} не нужен` };
+	const out = text(flags, "--out");
+	if (out === void 0) return { usageError: "catalog build: нужен --out" };
+	return {
+		command: "reindex",
+		out,
+		previousIndex: text(flags, "--previous-index"),
+		revoked: text(flags, "--revoked"),
+		publishedAt: text(flags, "--published-at")
+	};
+};
+const parseBuild$1 = (args) => {
+	const read = readFlags("build", args);
+	if (typeof read === "string") return { usageError: read };
+	const { flags, positional } = read;
+	if (positional.length > 0) return { usageError: `лишние аргументы: ${positional.join(" ")}` };
+	if (flags["--reindex"] === true) return parseReindex(flags);
+	const src = text(flags, "--src");
+	const out = text(flags, "--out");
+	const ids = idsOf(flags);
+	if (src === void 0) return { usageError: "catalog build: нужен --src" };
+	if (out === void 0) return { usageError: "catalog build: нужен --out" };
+	if (ids === void 0 || ids.length === 0) return { usageError: "catalog build: нужен --ids" };
+	return {
+		command: "build",
+		src,
+		ids,
+		out,
+		previousIndex: text(flags, "--previous-index"),
+		revoked: text(flags, "--revoked"),
+		sourceBase: text(flags, "--source-base"),
+		publishedAt: text(flags, "--published-at")
+	};
+};
+const parseCatalogArgs = (args) => {
+	const [sub, ...rest] = args;
+	if (sub === "check") return parseCheck(rest);
+	if (sub === "build") return parseBuild$1(rest);
+	return { usageError: sub === void 0 ? "catalog: не указана подкоманда (check|build)" : `catalog: неизвестная подкоманда: ${sub}` };
+};
+const runCheck = async (parsed, io, deps) => {
+	if (parsed.listRules) {
+		for (const line of listRules()) io.stdout(`${line}\n`);
+		return 0;
+	}
+	const findings = await checkCatalog({
+		extensionsDir: path.resolve(parsed.dir),
+		...parsed.ids === void 0 ? {} : { ids: parsed.ids },
+		...parsed.publishedIndex === void 0 ? {} : { publishedIndex: path.resolve(parsed.publishedIndex) },
+		...parsed.maxAppVersion === void 0 ? {} : { maxAppVersion: parsed.maxAppVersion },
+		skipGithubCheck: parsed.skipGithubCheck,
+		githubToken: deps.env?.GITHUB_TOKEN,
+		...deps.fetch === void 0 ? {} : { fetch: deps.fetch }
+	});
+	for (const finding of findings) io.stdout(`${formatFinding(finding)}\n`);
+	return hasErrors(findings) ? 1 : 0;
+};
+const runReindex = async (parsed, io, deps) => {
+	const result = await reindexCatalog({
+		out: parsed.out,
+		...parsed.previousIndex === void 0 ? {} : { previousIndex: parsed.previousIndex },
+		...parsed.revoked === void 0 ? {} : { revoked: parsed.revoked },
+		...parsed.publishedAt === void 0 ? {} : { publishedAt: parsed.publishedAt },
+		...deps.now === void 0 ? {} : { now: deps.now }
+	});
+	io.stdout(`${formatReindexResult(result)}\n`);
+	return 0;
+};
+const runBuild$1 = async (parsed, io, deps) => {
+	const results = await buildCatalog({
+		src: parsed.src,
+		ids: parsed.ids,
+		out: parsed.out,
+		...parsed.previousIndex === void 0 ? {} : { previousIndex: parsed.previousIndex },
+		...parsed.revoked === void 0 ? {} : { revoked: parsed.revoked },
+		...parsed.sourceBase === void 0 ? {} : { sourceBase: parsed.sourceBase },
+		...parsed.publishedAt === void 0 ? {} : { publishedAt: parsed.publishedAt },
+		...deps.now === void 0 ? {} : { now: deps.now }
+	});
+	for (const result of results) io.stdout(`${formatPublishResult(result)}\n`);
+	return 0;
+};
+/** Код выхода: 0, 1 (проблемы), 2 (аргументы/окружение). */
+const runCatalog = async (parsed, io, deps = {}) => {
+	try {
+		if (parsed.command === "check") return await runCheck(parsed, io, deps);
+		if (parsed.command === "reindex") return await runReindex(parsed, io, deps);
+		return await runBuild$1(parsed, io, deps);
+	} catch (error) {
+		if (!(error instanceof BuildError)) throw error;
+		io.stderr(`error ${error.subject}: ${error.message}\n`);
+		return error instanceof CatalogUsageError ? 2 : 1;
+	}
+};
+
+//#endregion
+//#region packages/extension-tools/src/cli/run.ts
+const EXIT_OK = 0;
+const EXIT_PROBLEMS = 1;
+const EXIT_USAGE = 2;
+const USAGE = `usage: dolphy-ext build [dir] [--out <dir>] [--watch]
+       dolphy-ext validate <dir>
+${CATALOG_SYNOPSIS}
+  build [dir]      собрать расширение из проекта (по умолчанию — текущий каталог)
+                   в <dir>/dist-ext/<id>
+  validate <dir>   проверить каталог собранного расширения (extension.json,
+                   схемы, main и renderer)
+${CATALOG_HELP}
+  --out <dir>      корень вывода (расширение кладётся в <dir>/<id>)
+  --watch          пересобирать бандлы при изменении исходников
+  --help           эта справка
+`;
+const parseBuild = (args) => {
+	const positional = [];
+	let out;
+	let watch = false;
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg === "--watch") watch = true;
+		else if (arg === "--out") {
+			out = args[++i];
+			if (out === void 0) return { usageError: "--out требует путь" };
+		} else if (arg.startsWith("-")) return { usageError: `неизвестный флаг: ${arg}` };
+		else positional.push(arg);
+	}
+	if (positional.length > 1) return { usageError: `лишние аргументы: ${positional.slice(1).join(" ")}` };
+	return {
+		command: "build",
+		dir: positional[0] ?? ".",
+		out,
+		watch
+	};
+};
+const parseValidate = (args) => {
+	const flag = args.find((arg) => arg.startsWith("-"));
+	if (flag !== void 0) return { usageError: `неизвестный флаг: ${flag}` };
+	const [dir, ...extra] = args;
+	if (dir === void 0) return { usageError: "validate: не указан каталог" };
+	if (extra.length > 0) return { usageError: `лишние аргументы: ${extra.join(" ")}` };
+	return {
+		command: "validate",
+		dir
+	};
+};
+const parseArgs = (argv) => {
+	if (argv.includes("--help") || argv.includes("-h")) return { help: true };
+	const [command, ...rest] = argv;
+	if (command === "build") return parseBuild(rest);
+	if (command === "validate") return parseValidate(rest);
+	if (command === "catalog") return {
+		command: "catalog",
+		args: rest
+	};
+	return { usageError: command === void 0 ? "не указана команда" : `неизвестная команда: ${command}` };
+};
+const waitForSignal = () => new Promise((resolve) => {
+	process.once("SIGINT", resolve);
+	process.once("SIGTERM", resolve);
+});
+const summary = ({ id, dir, files }) => `built ${id} -> ${dir} (${files.length} files)\n`;
+const reportBuildError = (io, error) => {
+	if (!(error instanceof BuildError)) throw error;
+	io.stderr(`error ${error.subject}: ${error.message}\n`);
+	return 1;
+};
+const runBuild = async (parsed, io, deps) => {
+	const options = {
+		root: path.resolve(parsed.dir),
+		...parsed.out === void 0 ? {} : { outDir: path.resolve(parsed.out) },
+		logger: {
+			info: (message) => io.stdout(`${message}\n`),
+			error: (message) => io.stderr(`${message}\n`)
+		}
+	};
+	try {
+		if (!parsed.watch) {
+			io.stdout(summary(await buildExtension(options)));
+			return 0;
+		}
+		const handle = await watchExtension(options);
+		io.stdout(summary(handle.result));
+		io.stdout("watching for changes...\n");
+		try {
+			await (deps.waitForExit ?? waitForSignal)();
+		} finally {
+			await handle.close();
+		}
+		return 0;
+	} catch (error) {
+		return reportBuildError(io, error);
+	}
+};
+const runValidate = async (dir, io) => {
+	const root = path.resolve(dir);
+	const { ok, problems } = await validateExtension(root);
+	if (ok) {
+		io.stdout(`${root}: ok\n`);
+		return 0;
+	}
+	for (const problem of problems) io.stderr(`error ${root}: ${problem}\n`);
+	return 1;
+};
+/** `dolphy-ext build|validate|catalog`; `argv` без `node` и имени скрипта. */
+const runCli = async (argv, io, deps = {}) => {
+	const parsed = parseArgs(argv);
+	if ("help" in parsed) {
+		io.stdout(USAGE);
+		return 0;
+	}
+	if ("usageError" in parsed) {
+		io.stderr(`${parsed.usageError}\n${USAGE}`);
+		return 2;
+	}
+	if (parsed.command === "catalog") {
+		const catalog = parseCatalogArgs(parsed.args);
+		if ("usageError" in catalog) {
+			io.stderr(`${catalog.usageError}\n${USAGE}`);
+			return 2;
+		}
+		return runCatalog(catalog, io, deps);
+	}
+	if (parsed.command === "validate") return runValidate(parsed.dir, io);
+	return runBuild(parsed, io, deps);
+};
+
+//#endregion
+//#region packages/extension-tools/src/cli/main.ts
+process.exitCode = await runCli(process.argv.slice(2), {
+	stdout: (text) => process.stdout.write(text),
+	stderr: (text) => process.stderr.write(text)
+}, { env: process.env });
+
+//#endregion
+export {  };