@dolphy-app/extension-tools 0.3.0 → 0.5.0

package/dist/cli/main.js

@@ -1,27 +1,112 @@
 #!/usr/bin/env node
 import { builtinModules } from "node:module";
-import path from "node:path";
-import { realpathSync, statSync, watch } from "node:fs";
+import path, { extname } from "node:path";
+import { existsSync, readFileSync, readdirSync, realpathSync, statSync, watch } from "node:fs";
 import { cp, lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import { Ajv2020 } from "ajv/dist/2020.js";
+import "ajv/dist/2020.js";
 import { z } from "zod";
 import { createHash } from "node:crypto";
-import { build, createLogger, parseAst } from "vite";
-import { tmpdir } from "node:os";
+import { build, createLogger, mergeConfig, parseAst } from "vite";
+import MagicString from "magic-string";
+import vue from "@vitejs/plugin-vue";
+import { homedir, tmpdir } from "node:os";
+import { spawn } from "node:child_process";
 
+//#region packages/extension-tools/src/errors.ts
+/** Extension build/check error; `subject` is the extension id or directory. */
+var BuildError = class extends Error {
+	subject;
+	constructor(message, subject) {
+		super(message);
+		this.name = "BuildError";
+		this.subject = subject;
+	}
+};
+/** Invalid command input (nonexistent directory): exit code 2. */
+var CatalogUsageError = class extends BuildError {};
+
+//#endregion
+//#region packages/extension-api/src/when.ts
+/**
+* Visibility conditions (`when`) of commands, panels and widgets. A condition
+* is a small boolean expression over a closed set of typed keys of the app
+* window (`WHEN_KEYS`). The functions are pure: the manifest check, the app
+* window and `dolphy-ext validate` share them, and so can any dispatcher that
+* can supply a `WhenContext`.
+*
+* Grammar (`!` binds tightest, then `&&`, then `||`):
+*
+* ```
+* expr    := term ('||' term)*
+* term    := factor ('&&' factor)*
+* factor  := '!' factor | '(' expr ')' | 'true' | 'false' | boolean-key | comparison
+* comparison := key ('==' | '!=') literal | key 'in' '(' literal (',' literal)* ')'
+* literal := 'text' | true | false
+* ```
+*
+* `!` stands before a boolean key, a group or another `!`; negate a
+* comparison with a group (`!(route == 'courses')`) or use `!=`.
+*/
+/** Names of the screens `route` can have: the route names of the app window. */
+const WHEN_ROUTES = [
+	"daily-plan",
+	"courses",
+	"extension-panel",
+	"placement",
+	"session",
+	"settings",
+	"settings-learning",
+	"settings-library",
+	"settings-appearance",
+	"settings-shortcuts",
+	"settings-extensions",
+	"settings-extension-details",
+	"settings-about"
+];
+/** Interface languages a `locale` condition can name. */
+const WHEN_LOCALES = ["ru", "en"];
+/**
+* Closed set of keys with their types.
+*
+* - `route`: the screen shown (a value of `WHEN_ROUTES`).
+* - `course.active`: a course is in focus (the course switcher is not on "all courses").
+* - `session.active`: the learning session screen is open.
+* - `locale`: the interface language after resolving the "system" mode.
+* - `theme.dark`: the current theme is dark.
+*/
+const WHEN_KEYS = Object.freeze({
+	route: {
+		type: "string",
+		values: WHEN_ROUTES
+	},
+	"course.active": { type: "boolean" },
+	"session.active": { type: "boolean" },
+	locale: {
+		type: "string",
+		values: WHEN_LOCALES
+	},
+	"theme.dark": { type: "boolean" }
+});
+
+//#endregion
+//#region packages/extension-api/src/hooks.ts
+/** Limits on hooks; the host and the engine check the same numbers. */
+const EXTENSION_HOOK_LIMITS = Object.freeze({
+	/** Budget of one handler call, ms. */
+	timeoutMs: 3e4,
+	/** Hooks registered by one extension. */
+	hooks: 8,
+	/** Exercises in a `practice.batch` response. */
+	maxExercises: 500
+});
+/** Hooks an extension can register with `server.before`. */
+const EXTENSION_HOOK_NAMES = ["session.start", "practice.batch"];
+
+//#endregion
 //#region packages/extension-api/src/index.ts
 const EXTENSION_ID_PATTERN = /^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*$/;
 /** GitHub login of the extension author (`author` in the manifest and catalog). */
 const GITHUB_LOGIN_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
-/** Capabilities an extension declares in its manifest; none without a declaration. */
-const EXTENSION_PERMISSIONS = [
-	"library.read",
-	"process.spawn",
-	"worker.threads",
-	"native.addons",
-	"network",
-	"learning.events"
-];
 /** Platforms the extension can run on (`process.platform`). */
 const EXTENSION_PLATFORMS = [
 	"darwin",
@@ -38,64 +123,97 @@ const EXTENSION_TAGS = [
 	"productivity",
 	"developer"
 ];
-const ELEMENT_NAME_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)+$/;
-/** Learning events an extension with the `learning.events` permission can subscribe to. */
+/**
+* Closed list of icon names an extension picks from (`icon` of a command or panel); the
+* app draws its own glyph for each name, so nothing from the extension is rendered as an image.
+*/
+const EXTENSION_ICONS = [
+	"puzzle",
+	"book",
+	"brain",
+	"calendar",
+	"chart",
+	"check",
+	"clock",
+	"cog",
+	"fire",
+	"flag",
+	"heart",
+	"help",
+	"home",
+	"idea",
+	"list",
+	"message",
+	"pencil",
+	"play",
+	"star",
+	"target",
+	"trophy",
+	"bell",
+	"bookmark",
+	"tag"
+];
+/** Limits on injections; the app enforces them. */
+const INJECTION_LIMITS = Object.freeze({ 
+/** Characters in `InjectionRegistration.target`. */
+selectorLength: 200 });
+/** `at` of a `daily` schedule: `HH:MM`, 24-hour clock, local time. */
+const SCHEDULE_AT_PATTERN = /^(?:[01]\d|2[0-3]):[0-5]\d$/;
+/** Limits on schedules; the host, the scheduler, and the runtime enforce them. */
+const EXTENSION_SCHEDULE_LIMITS = Object.freeze({
+	/** Schedules per extension. */
+	schedules: 4,
+	/** Handler budget, ms. */
+	handlerMs: 1e4,
+	/** A firing found later than this after its moment (the app was closed or asleep) is skipped, ms. */
+	lateMs: 12e4,
+	/** How often the app looks for due firings, ms. */
+	tickMs: 3e4
+});
+/** Limits of the settings types (`text`, `color`, `list`, `enum`, `group`, `order`); they match those checked by the host and the engine. */
+const SETTING_LIMITS = Object.freeze({
+	/** `maxLength` of `string` and `text`. */
+	stringLength: 1e4,
+	/** `maxItems` of `list`. */
+	listItems: 50,
+	/** `itemMaxLength` of `list`. */
+	listItemLength: 200,
+	/** Length of a label, in UTF-16 code units; also of an option's label. */
+	labelLength: 60,
+	/** Length of a help text. */
+	descriptionLength: 500,
+	groupLength: 60,
+	orderMax: 1e3,
+	/** Options of one `enum`. */
+	options: 64,
+	/** Length of an option's value. */
+	optionValueLength: 100
+});
+/** `#rrggbb` (any case in a definition; the stored value is lower-case). */
+const COLOR_SETTING_PATTERN = /^#[0-9a-fA-F]{6}$/;
+/** Learning events an extension can subscribe to. */
 const LEARNING_EVENT_NAMES = [
 	"session.started",
 	"session.finished",
 	"attempt.closed"
 ];
-/** Identifiers of built-in themes: extensions cannot take them. */
-const BUILTIN_THEME_IDS = [
-	"system",
-	"light",
-	"dark"
-];
-/** Allowed keys of `ThemeContribution.colors`. */
-const THEME_COLOR_KEYS = [
-	"background",
-	"surface",
-	"surface-bright",
-	"surface-light",
-	"surface-variant",
-	"on-background",
-	"on-surface",
-	"on-surface-variant",
-	"primary",
-	"on-primary",
-	"secondary",
-	"on-secondary",
-	"error",
-	"on-error",
-	"warning",
-	"on-warning",
-	"success",
-	"on-success",
-	"info",
-	"on-info",
-	"hero-start",
-	"hero-end",
-	"hero-contrast"
-];
-/** Allowed keys of `ThemeContribution.variables`. */
-const THEME_VARIABLE_KEYS = [
-	"border-color",
-	"border-opacity",
-	"medium-emphasis-opacity",
-	"high-emphasis-opacity",
-	"disabled-opacity"
-];
-const DEFAULT_MARKDOWN_RENDERER = "./markdown.mjs";
-const DEFAULT_PANEL = "./panel.mjs";
+const KEYBINDING_STROKE = `(?:(?:Mod|Ctrl|Control|Alt|Option|Shift|Cmd|Command|Meta|Win|Super)\\+){0,3}(?:[A-Z0-9]|F(?:[1-9]|1[0-9]|2[0-4])|Enter|Return|Space|Tab|Escape|Esc|Backspace|Delete|Insert|Arrow(?:Up|Down|Left|Right)|Home|End|Page(?:Up|Down)|Plus|\\[[A-Za-z][A-Za-z0-9]*\\]|[\`\\-=\\[\\]\\\\;',./+])`;
 /**
-* Command key hint: up to three modifiers (`Mod`, `Ctrl`, `Alt`,
-* `Shift`) and a key joined with `+`: a letter or digit, `F1`–`F12`, or a name
-* (`Enter`, `Space`, `Tab`, `Escape`, `Backspace`, `Delete`, arrows,
-* `Home`, `End`, `PageUp`, `PageDown`).
+* Key notation: one stroke or two strokes separated by a space
+* (`Mod+K Mod+S`). A stroke is up to three modifiers (`Mod`, `Ctrl`, `Alt`,
+* `Shift`, `Cmd`, `Meta`, `Win`, `Super`, `Option`, ...) and a key joined with
+* `+`: a letter or digit, `F1`–`F24`, a punctuation mark, a physical key
+* (`[KeyK]`) or a name (`Enter`, `Space`, `Tab`, `Escape`, `Insert`, arrows,
+* `Home`, `End`, `PageUp`, `PageDown`). A superset for the JSON Schema; the
+* host validates every string authoritatively with `@dolphy-app/keybindings`.
 */
-const KEYBINDING_PATTERN = /^(?:(?:Mod|Ctrl|Alt|Shift)\+){0,3}(?:[A-Z0-9]|F(?:[1-9]|1[0-2])|Enter|Space|Tab|Escape|Backspace|Delete|Arrow(?:Up|Down|Left|Right)|Home|End|Page(?:Up|Down))$/;
-/** Limits on commands and panels (R1, R3); they match those checked by the manifest, host, and engine. */
+const KEYBINDING_PATTERN = new RegExp(`^${KEYBINDING_STROKE}(?: ${KEYBINDING_STROKE})?$`);
+/** Limits on commands and panels (R1, R3); they match those checked by the host and the engine. */
 const EXTENSION_COMMAND_LIMITS = Object.freeze({
+	/** Keybinding entries (`keybindings`) per command. */
+	keybindingsPerCommand: 4,
+	/** Length of a `when` condition (of a command, panel or `keybindings[]` entry). */
+	whenLength: 200,
 	/** Commands per extension. */
 	commands: 64,
 	/** Panels per extension. */
@@ -112,10 +230,52 @@ const EXTENSION_COMMAND_LIMITS = Object.freeze({
 	/** Handler budget, ms. */
 	handlerMs: 1e4
 });
+/** A file extension an importer accepts: a dot and 1–16 lower-case letters or digits. */
+const TRANSFER_ACCEPT_PATTERN = /^\.[a-z0-9]{1,16}$/;
+/** Limits on importers and exporters; the host and the engine check the same numbers. */
+const EXTENSION_TRANSFER_LIMITS = Object.freeze({
+	/** Importers per extension. */
+	importers: 8,
+	/** Exporters per extension. */
+	exporters: 8,
+	/** Entries in `accept` of one importer. */
+	acceptExtensions: 8,
+	/** Handler budget, ms (import and export). */
+	handlerMs: 3e4,
+	/** Size of the file the user picks for an importer, bytes. */
+	inputBytes: 20971520,
+	/** Files in the directory an importer returns. */
+	files: 5e3,
+	/** One file of the returned directory, UTF-8 bytes. */
+	fileBytes: 2097152,
+	/** All files of the returned directory (and of a course snapshot), UTF-8 bytes. */
+	totalBytes: 20971520,
+	/** Size of the file an exporter returns, bytes. */
+	outputBytes: 20971520,
+	/** Length of the file name an exporter returns. */
+	filenameChars: 120,
+	/** One path of the returned directory, UTF-8 bytes. */
+	pathBytes: 1024
+});
+/**
+* Name of an RPC contract: lower-case dot-separated segments, such as
+* `greeting.say-hello`, the first segment without a hyphen, at least two
+* segments, at most `EXTENSION_RPC_LIMITS.nameLength` characters.
+*/
+const RPC_NAME_PATTERN = /^[a-z][a-z0-9]*(\.[a-z][a-z0-9-]*)+$/;
+/** Limits on RPC between the client and the server part of an extension; the host and the engine check the same numbers. */
+const EXTENSION_RPC_LIMITS = Object.freeze({
+	/** Characters in the name of a contract. */
+	nameLength: 120,
+	/** Handlers (`server.handle`) per extension. */
+	rpcs: 64,
+	/** `JSON.stringify(input).length` at the engine boundary. */
+	inputChars: 2e5,
+	/** Handler budget, ms. */
+	handlerMs: 1e4
+});
 const DEFAULT_MAIN = "./main.mjs";
-const DEFAULT_RENDERER = "./view.mjs";
-/** Default element tag: `dolphy.sql` → `dolphy-sql-answer`. */
-const defaultElementName = (id) => `${id.replaceAll(".", "-")}-answer`;
+const DEFAULT_CLIENT = "./client.mjs";
 /** Extension storage limits (R2); they match the engine's limits, which enforces them. */
 const EXTENSION_STORAGE_LIMITS = Object.freeze({
 	/** Key length in UTF-16 code units. */
@@ -127,26 +287,81 @@ const EXTENSION_STORAGE_LIMITS = Object.freeze({
 	/** Sum of JSON texts of all values in UTF-8 bytes. */
 	totalBytes: 1048576
 });
+/** Secret limits; the engine enforces them (`StorageQuotaError`, kinds `key-length`, `value-size`, `key-count`). */
+const EXTENSION_SECRET_LIMITS = Object.freeze({
+	/** Key length in UTF-16 code units. */
+	keyLength: 128,
+	/** Value size in UTF-8 bytes. */
+	valueBytes: 4096,
+	/** Number of keys. */
+	keys: 32
+});
+/** Limits of `server.stats`; the engine enforces them. */
+const EXTENSION_STATS_LIMITS = Object.freeze({ 
+/** Most dates in one `daily` range (both ends included). */
+dailyDays: 366 });
+/** Limits of `server.notifications`; the engine enforces them. */
+const EXTENSION_NOTIFICATION_LIMITS = Object.freeze({
+	/** Title length in characters (code points). */
+	titleLength: 80,
+	/** Body length in characters (code points). */
+	bodyLength: 300,
+	/** Notifications per rolling minute and extension. */
+	perMinute: 3,
+	/** Notifications per rolling hour and extension. */
+	perHour: 30
+});
+/** Registration of an extension without a server part, or before it has registered anything. */
+const EMPTY_SERVER_REGISTRATION = Object.freeze({
+	exerciseTypes: Object.freeze([]),
+	gradePolicies: Object.freeze([]),
+	settings: Object.freeze([]),
+	events: Object.freeze([]),
+	commands: Object.freeze([]),
+	schedules: Object.freeze([]),
+	importers: Object.freeze([]),
+	exporters: Object.freeze([]),
+	rpcs: Object.freeze([]),
+	hooks: Object.freeze([])
+});
 
 //#endregion
 //#region packages/extension-host/src/protocol.ts
 const eventParams = z.strictObject({
 	extensionId: z.string(),
 	name: z.enum(LEARNING_EVENT_NAMES),
-	payload: z.record(z.string(), z.unknown()),
-	isolated: z.boolean()
+	payload: z.record(z.string(), z.unknown())
+});
+const scheduleParams = z.strictObject({
+	extensionId: z.string(),
+	scheduleId: z.string()
 });
 const commandParams = z.strictObject({
 	extensionId: z.string(),
 	commandId: z.string(),
-	args: z.unknown().optional(),
-	isolated: z.boolean()
+	args: z.unknown().optional()
 });
+const rpcParams = z.strictObject({
+	extensionId: z.string(),
+	name: z.string(),
+	input: z.unknown().optional()
+});
+const bytesField = z.custom((value) => value instanceof Uint8Array, "must be a Uint8Array");
+const importParams = {
+	extensionId: z.string(),
+	importerId: z.string(),
+	name: z.string()
+};
+const exportInput = z.discriminatedUnion("scope", [z.strictObject({
+	scope: z.literal("course"),
+	courseId: z.string(),
+	title: z.string(),
+	files: z.record(z.string(), z.string())
+}), z.strictObject({ scope: z.literal("progress") })]);
 const typed = {
 	type: z.string(),
 	exerciseId: z.string(),
-	spec: z.unknown(),
-	isolated: z.boolean()
+	spec: z.unknown()
 };
 const extRequestSchema = z.discriminatedUnion("method", [
 	z.strictObject({
@@ -182,8 +397,7 @@ const extRequestSchema = z.discriminatedUnion("method", [
 				]),
 				reason: z.string().optional()
 			})),
-			gaveUp: z.boolean(),
-			isolated: z.boolean()
+			gaveUp: z.boolean()
 		})
 	}),
 	z.strictObject({
@@ -191,16 +405,56 @@ const extRequestSchema = z.discriminatedUnion("method", [
 		method: z.literal("deliverEvent"),
 		params: eventParams
 	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("fireSchedule"),
+		params: scheduleParams
+	}),
 	z.strictObject({
 		id: z.string(),
 		method: z.literal("invokeCommand"),
 		params: commandParams
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("invokeRpc"),
+		params: rpcParams
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("runImporter"),
+		params: z.union([z.strictObject({
+			...importParams,
+			text: z.string()
+		}), z.strictObject({
+			...importParams,
+			bytes: bytesField
+		})])
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("runExporter"),
+		params: z.strictObject({
+			extensionId: z.string(),
+			exporterId: z.string(),
+			input: exportInput
+		})
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("runHook"),
+		params: z.strictObject({
+			extensionId: z.string(),
+			name: z.enum(EXTENSION_HOOK_NAMES),
+			request: z.unknown()
+		})
 	})
 ]);
 const settingValue = z.union([
 	z.boolean(),
 	z.string(),
-	z.number()
+	z.number(),
+	z.array(z.string())
 ]);
 const settingChangedSchema = z.strictObject({
 	method: z.literal("settingChanged"),
@@ -241,10 +495,82 @@ const hostRequestSchema = z.discriminatedUnion("method", [
 		method: z.literal("storage.keys"),
 		params: hostOwner
 	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("secrets.get"),
+		params: hostKey
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("secrets.set"),
+		params: z.strictObject({
+			extensionId: z.string(),
+			key: z.string(),
+			value: z.unknown()
+		})
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("secrets.delete"),
+		params: hostKey
+	}),
 	z.strictObject({
 		id: z.string(),
 		method: z.literal("settings.all"),
 		params: hostOwner
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("stats.streak"),
+		params: z.strictObject({
+			extensionId: z.string(),
+			courseId: z.string().optional()
+		})
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("stats.daily"),
+		params: z.strictObject({
+			extensionId: z.string(),
+			from: z.string(),
+			to: z.string(),
+			courseId: z.string().optional()
+		})
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("notifications.show"),
+		params: z.strictObject({
+			extensionId: z.string(),
+			title: z.string(),
+			body: z.string()
+		})
+	}),
+	z.strictObject({
+		id: z.string(),
+		method: z.literal("health.report"),
+		params: z.discriminatedUnion("kind", [
+			z.strictObject({
+				extensionId: z.string(),
+				kind: z.literal("activated"),
+				durationMs: z.number().finite().nonnegative()
+			}),
+			z.strictObject({
+				extensionId: z.string(),
+				kind: z.literal("failed"),
+				reason: z.string(),
+				message: z.string()
+			}),
+			z.strictObject({
+				extensionId: z.string(),
+				kind: z.literal("suppressed"),
+				until: z.number().finite().nonnegative()
+			}),
+			z.strictObject({
+				extensionId: z.string(),
+				kind: z.literal("reset")
+			})
+		])
 	})
 ]);
 const hostResponseSchema = z.union([z.strictObject({
@@ -260,30 +586,44 @@ const hostResponseSchema = z.union([z.strictObject({
 		details: z.record(z.string(), z.unknown()).optional()
 	})
 })]);
-const isResolvedExtension = (value) => {
+const isExtensionCandidate = (value) => {
 	if (typeof value !== "object" || value === null) return false;
 	const item = value;
-	return typeof item.id === "string" && typeof item.version === "string" && typeof item.dir === "string" && typeof item.revision === "string" && (item.origin === "bundled" || item.origin === "user" || item.origin === "dev") && Array.isArray(item.permissions) && Array.isArray(item.exerciseTypes) && Array.isArray(item.themes) && Array.isArray(item.markdownRenderers) && Array.isArray(item.gradePolicies) && Array.isArray(item.settings) && Array.isArray(item.events) && Array.isArray(item.commands) && Array.isArray(item.panels);
+	return typeof item.id === "string" && typeof item.version === "string" && typeof item.dir === "string" && typeof item.revision === "string" && (item.origin === "bundled" || item.origin === "user" || item.origin === "dev") && (item.mainPath === null || typeof item.mainPath === "string") && (item.clientPath === null || typeof item.clientPath === "string") && Array.isArray(item.dependencies) && Array.isArray(item.warnings);
 };
 /** Набор приходит от движка того же приложения, поэтому проверяется форма, а не каждое поле. */
 const replaceExtensionsSchema = z.strictObject({
 	id: z.string(),
 	method: z.literal("replaceExtensions"),
-	params: z.strictObject({ extensions: z.array(z.custom(isResolvedExtension)) })
+	params: z.strictObject({ extensions: z.array(z.custom(isExtensionCandidate)) })
 });
+/** Кадры туннеля `engine-rpc`: форму кадра проверяет получатель протокола (диспетчер или клиент движка). */
+const engineTunnelSchema = z.discriminatedUnion("method", [z.strictObject({
+	method: z.literal("engineFrame"),
+	params: z.strictObject({
+		extensionId: z.string(),
+		frame: z.unknown()
+	})
+}), z.strictObject({
+	method: z.literal("engineDetach"),
+	params: z.strictObject({ extensionId: z.string() })
+})]);
 /** Всё, что хост расширений принимает по каналу. */
 const extMessageSchema = z.union([
 	extRequestSchema,
 	replaceExtensionsSchema,
 	settingChangedSchema,
+	engineTunnelSchema,
 	hostResponseSchema
 ]);
-/** Всё, что ограниченный процесс принимает от хоста (набор расширений ему не шлют). */
-const childInboundSchema = z.union([
-	extRequestSchema,
-	settingChangedSchema,
-	hostResponseSchema
-]);
+/** Ответ на `replaceExtensions`: итог по каждому расширению; форму регистрации проверил регистратор хоста. */
+const replaceExtensionsResultSchema = z.strictObject({ registrations: z.record(z.string(), z.union([z.strictObject({
+	ok: z.literal(true),
+	registration: z.custom((value) => typeof value === "object" && value !== null)
+}), z.strictObject({
+	ok: z.literal(false),
+	error: z.string()
+})])) });
 /** Результат правила оценки: целое 1–5 или `null`. */
 const gradeValueSchema = z.union([z.literal([
 	1,
@@ -293,24 +633,24 @@ const gradeValueSchema = z.union([z.literal([
 	5
 ]), z.null()]);
 const reason = z.string().min(1).max(100);
-const text$1 = z.string().max(4e3);
+const text$2 = z.string().max(4e3);
 const gradeResultSchema = z.discriminatedUnion("outcome", [
 	z.strictObject({
 		outcome: z.literal("passed"),
-		feedback: text$1.optional(),
+		feedback: text$2.optional(),
 		data: z.unknown().optional()
 	}),
 	z.strictObject({
 		outcome: z.literal("failed"),
 		reason,
-		feedback: text$1.optional(),
-		detail: text$1.optional(),
+		feedback: text$2.optional(),
+		detail: text$2.optional(),
 		data: z.unknown().optional()
 	}),
 	z.strictObject({
 		outcome: z.literal("error"),
 		reason,
-		feedback: text$1.optional(),
+		feedback: text$2.optional(),
 		data: z.unknown().optional()
 	})
 ]);
@@ -347,6 +687,110 @@ const commandOutcomeSchema = z.discriminatedUnion("kind", [
 	})
 ]);
 
+//#endregion
+//#region packages/extension-api/src/hook-schemas.ts
+/**
+* Request and response schemas of the hooks in `hooks.ts`. They live apart
+* from the names and types so that code which only registers or types a hook
+* (every browser bundle imports this package) does not pull `zod` in; the host,
+* the engine and the test server import them from
+* `@dolphy-app/extension-api/hook-schemas`.
+*/
+const itemReason = z.enum([
+	"review",
+	"new",
+	"remediation"
+]);
+/** `null` fields: the exercise has no attempts yet, so there is no memory state. */
+const exerciseMemory = z.object({
+	/** Probability of recall right now, 0..1. */
+	retrievability: z.number().nullable(),
+	/** Unix epoch milliseconds of the newest attempt. */
+	lastAttemptAt: z.number().nullable(),
+	/** Attempts that count (cancelled ones excluded). */
+	attempts: z.number(),
+	/** FSRS stability in days. */
+	stability: z.number().nullable(),
+	/** FSRS difficulty. */
+	difficulty: z.number().nullable()
+});
+/**
+* Request and response schema of every hook. The handlers of the extensions
+* that registered a hook run one after another in ascending order of the
+* extension id; each gets the response of the previous one (for a hook
+* without a response, the same request). A thrown error, an invalid
+* response or a handler exceeding `EXTENSION_HOOK_LIMITS.timeoutMs` cancels
+* the operation and the error message reaches the user.
+*/
+const EXTENSION_HOOKS = Object.freeze({
+	/**
+	* A learning session is about to start. The handler can only cancel the
+	* start by throwing.
+	*/
+	"session.start": {
+		request: z.object({ 
+		/** Unix epoch milliseconds. */
+now: z.number() }),
+		response: z.void()
+	},
+	/**
+	* A batch of exercises or a day plan is about to be handed to the learner.
+	* `exerciseIds` and `reasons` are parallel arrays; the response can
+	* reorder, remove and add exercises (every id must exist in the library;
+	* `exerciseIds` and `reasons` keep the same length, at most
+	* `EXTENSION_HOOK_LIMITS.maxExercises`).
+	*/
+	"practice.batch": {
+		request: z.object({
+			/** The open session; `null` while none has started. */
+			sessionId: z.string().nullable(),
+			/** `batch` — `practice.getBatch`, `plan` — `plan.getDay`. */
+			source: z.enum(["batch", "plan"]),
+			exerciseIds: z.array(z.string()),
+			reasons: z.array(itemReason),
+			/**
+			* Parallel to `exerciseIds`: what the engine remembers of each
+			* exercise. Read-only; the FSRS state is not changed by the hook.
+			*/
+			memory: z.array(exerciseMemory)
+		}),
+		response: z.object({
+			exerciseIds: z.array(z.string()).max(EXTENSION_HOOK_LIMITS.maxExercises),
+			reasons: z.array(itemReason).max(EXTENSION_HOOK_LIMITS.maxExercises)
+		}).refine(({ exerciseIds, reasons }) => exerciseIds.length === reasons.length, { message: "exerciseIds and reasons must have the same length" })
+	}
+});
+
+//#endregion
+//#region packages/extension-host/src/diagnostics.ts
+const text$1 = (data, key) => {
+	const value = data[key];
+	return Array.isArray(value) ? value.join(", ") : String(value ?? "");
+};
+const rangeSuffix = (data) => data.range === void 0 ? "" : ` ${text$1(data, "range")}`;
+const FORMATTERS = {
+	"manifest-unreadable": (data) => `extension.json is unreadable: ${text$1(data, "reason")}`,
+	"manifest-invalid": (data) => Array.isArray(data.issues) ? data.issues.join("; ") : text$1(data, "issues"),
+	"id-mismatch": (data) => `directory name '${text$1(data, "expected")}' does not match manifest id '${text$1(data, "actual")}'`,
+	"requires-app": (data) => `requires app >= ${text$1(data, "minAppVersion")}`,
+	"unavailable-platform": (data) => `not available on ${text$1(data, "platform")}`,
+	"claim-clash": (data) => `${text$1(data, "kind")} '${text$1(data, "name")}' is already provided by '${text$1(data, "by")}'`,
+	"load-failed": (data) => text$1(data, "reason"),
+	"overridden-by": (data) => `overridden by ${text$1(data, "origin")} ${text$1(data, "version")}`,
+	"safe-mode": () => "disabled in safe mode",
+	"dependency-missing": (data) => `requires extension '${text$1(data, "id")}'${rangeSuffix(data)}, which is not installed`,
+	"dependency-disabled": (data) => `requires extension '${text$1(data, "id")}'${rangeSuffix(data)}, which is disabled`,
+	"dependency-version": (data) => `requires extension '${text$1(data, "id")}' ${text$1(data, "range")}, found ${text$1(data, "found")}`,
+	"dependency-unmet": (data) => `requires extension '${text$1(data, "id")}'${rangeSuffix(data)}, which is not loaded because its own dependencies are not met`,
+	"dependency-cycle": (data) => `extensions depend on each other: ${text$1(data, "cycle")}`
+};
+/**
+* English text of a diagnostic: the single place that renders it for the CLI,
+* logs and the installer. The app window builds its own localized text from
+* the code and data.
+*/
+const formatDiagnostic = ({ code, data }) => FORMATTERS[code](data);
+
 //#endregion
 //#region packages/extension-catalog/src/assets.ts
 /**
@@ -354,8 +798,8 @@ const commandOutcomeSchema = z.discriminatedUnion("kind", [
 * signature/geometry readers for the binary formats. Pure functions over bytes: the
 * installer, the protocol and the author tools read the same constants.
 */
-/** File extensions the first catalog format accepts (the released apps parse only these). */
-const LEGACY_FILE_EXTENSIONS = [
+/** Extensions of a version's own files: manifest, code, schemas, documentation. */
+const SOURCE_FILE_EXTENSIONS = [
 	"json",
 	"js",
 	"mjs",
@@ -372,8 +816,8 @@ const ASSET_EXTENSIONS = [
 	"jpeg",
 	"woff2"
 ];
-/** Every extension a file of a version may have in the full index. */
-const CATALOG_FILE_EXTENSIONS = [...LEGACY_FILE_EXTENSIONS, ...ASSET_EXTENSIONS];
+/** Every extension a file of a version may have. */
+const CATALOG_FILE_EXTENSIONS = [...SOURCE_FILE_EXTENSIONS, ...ASSET_EXTENSIONS];
 const KIB = 1024;
 /** Per-file ceilings in bytes. `icon` bounds the manifest icon, which travels inside the index. */
 const ASSET_LIMITS = {
@@ -693,50 +1137,43 @@ const minAppVersionFailure = (minAppVersion, appVersion) => minAppVersion !== nu
 /** `minAppVersion` и `platforms` манифеста или записи каталога. */
 const checkCompatibility = (requirements, context) => minAppVersionFailure(requirements.minAppVersion, context.appVersion) ?? platformFailure(requirements.platforms, context.platform);
 
+//#endregion
+//#region packages/extension-catalog/src/install-meta.ts
+const httpUrl = z.url().refine((value) => /^https?:\/\//i.test(value), "catalogUrl must be an http(s) URL");
+const installMetaSchema = z.strictObject({
+	catalogUrl: httpUrl,
+	version: z.string().refine(isSemver, "version must be semver"),
+	installedAt: z.iso.datetime()
+});
+
 //#endregion
 //#region packages/extension-catalog/src/schema.ts
-/** Format of `index.json`: parsed by every released app, strictly. */
-const LEGACY_SCHEMA_VERSION = 1;
-/** Format of `index.v2.json`: asset file types, icons, up to `MAX_FILES_V2` files. */
+/** Format of `index.v2.json`, the only index: asset file types, icons, up to `MAX_FILES_V2` files. */
 const CATALOG_SCHEMA_VERSION = 2;
 const MAX_VERSIONS = 5;
-const MAX_FILES = 50;
 const MAX_TOTAL_BYTES = 1e7;
-/** Longest contribution title in `titles` (the manifest limit of `label`/`title`). */
-const MAX_TITLE_LENGTH = 60;
 /** Most tags of a version. */
 const MAX_TAGS = 5;
-/** Contribution points whose entries carry a human title in the manifest (`label` or `title`). */
-const TITLED_POINTS = [
-	"themes",
-	"gradePolicies",
-	"settings",
-	"commands",
-	"panels"
-];
 const MAX_PATH_LENGTH = 200;
 const SHA256 = /^[0-9a-f]{64}$/;
 /** Допустимые символы сегмента пути: без `:` (потоки NTFS), пробелов и управляющих символов. */
 const SEGMENT = /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/;
 /** Имена устройств Windows: недоступны как файлы, с расширением или без. */
 const RESERVED_NAME = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\..*)?$/i;
+const describeIssues = (error, prefix = "") => error.issues.map((issue) => `${prefix}${issue.path.join(".") || "/"}: ${issue.message}`);
 const semver = z.string().refine(isSemver, "must be semver");
 const timestamp = z.iso.datetime({ offset: true });
 const httpsUrl = z.url().refine((value) => value.startsWith("https://"), "must be an https URL");
 const isSafeSegment = (segment) => SEGMENT.test(segment) && !segment.endsWith(".") && !RESERVED_NAME.test(segment);
-/** Путь файла версии: безопасные сегменты и расширение из `extensions`. */
-const isSafePathWith = (value, extensions) => {
+/** Path of a version file: safe segments, an allowed extension. */
+const isSafeCatalogPath = (value) => {
 	if (value.length > MAX_PATH_LENGTH) return false;
 	if (!value.split("/").every(isSafeSegment)) return false;
 	const extension = extensionOf(value);
-	return extension !== null && extensions.includes(extension);
+	return extension !== null && CATALOG_FILE_EXTENSIONS.includes(extension);
 };
-/** Path of a version file in the full index: safe segments, an allowed extension. */
-const isSafeCatalogPath = (value) => isSafePathWith(value, CATALOG_FILE_EXTENSIONS);
-/** Path of a version file in the first format (`index.json`). */
-const isLegacyCatalogPath = (value) => isSafePathWith(value, LEGACY_FILE_EXTENSIONS);
 /**
-* Каталог файлов версии относительно адреса `index.json` (`extensions/<id>/<version>/`).
+* Каталог файлов версии относительно адреса индекса (`extensions/<id>/<version>/`).
 * Абсолютный адрес не допускается: файлы версии по построению лежат на origin индекса,
 * а локальный каталог разработчика и e2e не требуют https.
 */
@@ -776,9 +1213,44 @@ const revokedSchema = z.strictObject({
 	versions: rangeText,
 	reason: z.string().min(1).max(300)
 });
+/** Deprecation of an entry: a warning, not a revocation. `versions: null` — every version. */
+const MAX_DEPRECATION_REASON = 200;
+const MAX_ALTERNATIVES = 3;
+const deprecatedShape = {
+	versions: rangeText.nullable(),
+	reason: z.string().min(1).max(200),
+	alternatives: z.array(extensionId$1).max(3)
+};
+const strictDeprecated = z.strictObject(deprecatedShape);
+/** The tolerant reader drops an unreadable `deprecated`; the entry stays. */
+const tolerantDeprecated = z.object(deprecatedShape).optional().catch(void 0);
+/** One item of `deprecated.json` in the catalog repository: no `versions` — every version. */
+const deprecatedItemSchema = z.strictObject({
+	id: extensionId$1,
+	versions: rangeText.optional(),
+	reason: deprecatedShape.reason,
+	alternatives: deprecatedShape.alternatives
+});
+const deprecatedListSchema = z.array(deprecatedItemSchema).superRefine((items, ctx) => {
+	const seen = /* @__PURE__ */ new Set();
+	items.forEach((item, position) => {
+		if (seen.has(item.id)) ctx.addIssue({
+			code: "custom",
+			path: [position, "id"],
+			message: `duplicate id '${item.id}'`
+		});
+		seen.add(item.id);
+	});
+});
+/** Strict parse of `deprecated.json`; throws `CatalogFormatError` (also for a repeated `id`). */
+const parseDeprecatedList = (raw) => {
+	const result = deprecatedListSchema.safeParse(raw);
+	if (result.success) return result.data;
+	throw new CatalogFormatError(describeIssues(result.error));
+};
 const object = (profile, shape) => profile.strict ? z.strictObject(shape) : z.object(shape);
 const fileSchemaOf = (profile) => object(profile, {
-	path: z.string().refine((value) => isSafePathWith(value, profile.extensions), "must be a safe relative path"),
+	path: z.string().refine(isSafeCatalogPath, "must be a safe relative path"),
 	size: z.number().int().min(0).max(MAX_TOTAL_BYTES),
 	sha256: z.string().regex(SHA256, "must be lowercase hex sha256")
 }).superRefine((file, ctx) => {
@@ -788,7 +1260,7 @@ const fileSchemaOf = (profile) => object(profile, {
 		message: problem
 	});
 });
-const filesSchemaOf = (profile) => z.array(fileSchemaOf(profile)).max(profile.maxFiles).superRefine((files, ctx) => {
+const filesSchemaOf = (profile) => z.array(fileSchemaOf(profile)).max(100).superRefine((files, ctx) => {
 	const seen = /* @__PURE__ */ new Set();
 	files.forEach((file, index) => {
 		const key = file.path.toLowerCase();
@@ -832,46 +1304,38 @@ const strictTags = z.array(z.enum(EXTENSION_TAGS)).max(5).superRefine((tags, ctx
 const knownTags = EXTENSION_TAGS;
 const tolerantTags = z.array(z.string()).transform((tags) => [...new Set(tags.filter((tag) => knownTags.includes(tag)))].slice(0, 5)).catch([]);
 const tagsSchemaOf = (profile) => (profile.strict ? strictTags : tolerantTags).optional();
+const strictDependencies = z.array(z.strictObject({
+	id: extensionId$1,
+	range: rangeText.optional()
+})).max(16).superRefine((items, ctx) => {
+	items.forEach(({ id }, index) => {
+		if (items.findIndex((item) => item.id === id) !== index) ctx.addIssue({
+			code: "custom",
+			path: [index, "id"],
+			message: `duplicate dependency '${id}'`
+		});
+	});
+});
+/** The tolerant reader drops an unreadable `dependencies`; the version stays. */
+const tolerantDependencies = z.array(z.object({
+	id: extensionId$1,
+	range: rangeText.optional()
+})).max(16).catch([]);
+const dependenciesSchemaOf = (profile) => (profile.strict ? strictDependencies : tolerantDependencies).optional();
 const versionSchemaOf = (profile) => object(profile, {
 	version: semver,
 	apiVersion: z.number().int().min(1),
 	minAppVersion: semver.nullable(),
-	permissions: z.array(z.enum(EXTENSION_PERMISSIONS)),
 	publishedAt: timestamp,
 	baseUrl,
 	files: filesSchemaOf(profile),
 	/** The icon of the version as a `data:` URI; the file itself is among `files`. */
 	icon: z.string().max(MAX_ICON_URI_LENGTH).regex(ICON_URI_PATTERN).optional(),
 	/** Explicit tags of the version (a closed vocabulary); the tolerant reader drops the ones it does not know. */
-	tags: tagsSchemaOf(profile)
-}).superRefine((version, ctx) => {
-	if (!profile.tags && version.tags !== void 0) ctx.addIssue({
-		code: "custom",
-		path: ["tags"],
-		message: "tags is not part of this index format"
-	});
-	if (!profile.icon && version.icon !== void 0) ctx.addIssue({
-		code: "custom",
-		path: ["icon"],
-		message: "icon is not part of this index format"
-	});
-});
-const contributesSchemaOf = (profile) => object(profile, {
-	exerciseTypes: z.array(z.string()),
-	themes: z.array(z.string()),
-	markdownRenderers: z.array(z.string()),
-	gradePolicies: z.array(z.string()),
-	settings: z.array(z.string()).optional(),
-	events: z.array(z.string()).optional(),
-	commands: z.array(z.string()).optional(),
-	panels: z.array(z.string()).optional()
+	tags: tagsSchemaOf(profile),
+	/** Extensions the version needs (`dependencies` of the manifest); no key — none. */
+	dependencies: dependenciesSchemaOf(profile)
 });
-const titleMap = z.record(extensionId$1, z.string().min(1).max(MAX_TITLE_LENGTH));
-/** Titles of the contributions by point; an unreadable map is dropped by the tolerant reader, the entry stays. */
-const titlesSchemaOf = (profile) => {
-	const schema = object(profile, Object.fromEntries(TITLED_POINTS.map((point) => [point, titleMap.optional()]))).optional();
-	return profile.strict ? schema : schema.catch(void 0).optional();
-};
 const entryHeadOf = (profile) => ({
 	id: extensionId$1,
 	name: z.string().min(1).max(80),
@@ -879,83 +1343,34 @@ const entryHeadOf = (profile) => ({
 	author: z.string().regex(GITHUB_LOGIN_PATTERN, "must be a GitHub login"),
 	source: httpsUrl,
 	platforms: z.array(z.enum(EXTENSION_PLATFORMS)),
-	contributes: contributesSchemaOf(profile),
-	titles: titlesSchemaOf(profile)
+	deprecated: profile.strict ? strictDeprecated.optional() : tolerantDeprecated
 });
 const entrySchemaOf = (profile) => object(profile, {
 	...entryHeadOf(profile),
 	versions: z.array(versionSchemaOf(profile)).min(1).max(5).superRefine(descendingUnique)
-}).superRefine((entry, ctx) => {
-	if (entry.titles === void 0) return;
-	if (!profile.titles) {
-		ctx.addIssue({
-			code: "custom",
-			path: ["titles"],
-			message: "titles is not part of this index format"
-		});
-		return;
-	}
-	if (!profile.strict) return;
-	for (const point of TITLED_POINTS) {
-		const known = new Set(entry.contributes[point] ?? []);
-		for (const id of Object.keys(entry.titles[point] ?? {})) if (!known.has(id)) ctx.addIssue({
-			code: "custom",
-			path: [
-				"titles",
-				point,
-				id
-			],
-			message: `title for '${id}', which is not in contributes.${point}`
-		});
-	}
 });
 const indexSchemaOf = (profile) => object(profile, {
-	schemaVersion: z.literal(profile.schemaVersion),
+	schemaVersion: z.literal(2),
 	generatedAt: timestamp,
 	extensions: z.array(entrySchemaOf(profile)),
 	revoked: z.array(revokedSchema)
 });
-const LEGACY_PROFILE = {
-	schemaVersion: 1,
-	maxFiles: 50,
-	extensions: LEGACY_FILE_EXTENSIONS,
-	icon: false,
-	titles: false,
-	tags: false,
-	strict: true
-};
-const FULL_PROFILE = {
-	schemaVersion: 2,
-	maxFiles: 100,
-	extensions: CATALOG_FILE_EXTENSIONS,
-	icon: true,
-	titles: true,
-	tags: true,
-	strict: true
-};
+const FULL_PROFILE = { strict: true };
 /** Reader of the app: the limits of the full format, unknown keys dropped. */
-const TOLERANT_PROFILE = {
-	...FULL_PROFILE,
-	strict: false
-};
-/** `index.json`: the first format. */
-const legacyIndexSchema = indexSchemaOf(LEGACY_PROFILE);
-/** `index.v2.json`: the full format. */
+const TOLERANT_PROFILE = { strict: false };
+/** `index.v2.json`: the only index format. */
 const indexSchema = indexSchemaOf(FULL_PROFILE);
-const describeIssues = (error, prefix = "") => error.issues.map((issue) => `${prefix}${issue.path.join(".") || "/"}: ${issue.message}`);
-const isLegacyIndex = (raw) => typeof raw === "object" && raw !== null && "schemaVersion" in raw && raw.schemaVersion === 1;
 /**
 * Strict parse for the author tools: unknown keys, file types and limits fail.
-* Both formats are accepted; `schemaVersion` chooses the rules.
 * Throws `CatalogFormatError`.
 */
 const parseIndex = (raw) => {
-	const parsed = (isLegacyIndex(raw) ? legacyIndexSchema : indexSchema).safeParse(raw);
+	const parsed = indexSchema.safeParse(raw);
 	if (parsed.success) return parsed.data;
 	throw new CatalogFormatError(describeIssues(parsed.error));
 };
 const tolerantHead = object(TOLERANT_PROFILE, {
-	schemaVersion: z.union([z.literal(1), z.literal(2)]),
+	schemaVersion: z.literal(2),
 	generatedAt: timestamp,
 	extensions: z.array(z.unknown()),
 	revoked: z.array(revokedSchema)
@@ -966,470 +1381,36 @@ const tolerantEntry = object(TOLERANT_PROFILE, {
 });
 const tolerantVersion = versionSchemaOf(TOLERANT_PROFILE);
 
-//#endregion
-//#region packages/extension-catalog/src/legacy.ts
-/** Permissions the released apps know: a catalog with any other value is rejected whole by them. */
-const LEGACY_PERMISSIONS = [
-	"library.read",
-	"process.spawn",
-	"worker.threads",
-	"native.addons",
-	"network"
-];
-/** Contribution lists the released apps do not know (`contributes.settings` and later). */
-const NEWER_CONTRIBUTION_KEYS = [
-	"settings",
-	"events",
-	"commands",
-	"panels"
-];
-/** Whether a released app can parse the entry's summary of contributions. */
-const isLegacyEntry = (entry) => NEWER_CONTRIBUTION_KEYS.every((key) => entry.contributes[key] === void 0);
-/**
-* Whether a released app can parse the version: only first-format file types,
-* at most `MAX_FILES` files, no `icon` and no `tags`, only permissions it knows.
-*/
-const isLegacyVersion = (version) => version.icon === void 0 && version.tags === void 0 && version.files.length <= 50 && version.files.every((file) => isLegacyCatalogPath(file.path)) && version.permissions.every((permission) => LEGACY_PERMISSIONS.includes(permission));
-/**
-* The part of the full index that every released app parses: versions and entries
-* they cannot read are left out, an extension left without versions is skipped,
-* `titles` (unknown to them) is dropped from the entries that stay.
-* The revocation list is kept whole.
-*/
-const legacySubset = (index) => ({
-	...index,
-	schemaVersion: 1,
-	extensions: index.extensions.filter(isLegacyEntry).map((entry) => {
-		const legacy = {
-			...entry,
-			versions: entry.versions.filter(isLegacyVersion)
-		};
-		delete legacy.titles;
-		return legacy;
-	}).filter((entry) => entry.versions.length > 0)
-});
-
-//#endregion
-//#region packages/extension-catalog/src/install-meta.ts
-const httpUrl = z.url().refine((value) => /^https?:\/\//i.test(value), "catalogUrl must be an http(s) URL");
-const installMetaSchema = z.strictObject({
-	catalogUrl: httpUrl,
-	version: z.string().refine(isSemver, "version must be semver"),
-	installedAt: z.iso.datetime()
-});
-
 //#endregion
 //#region packages/extension-catalog/src/urls.ts
-/** File name of the first-format index: the catalog identity (`catalogUrl`) points at it. */
-const INDEX_FILE = "index.json";
-/** File name of the full index, published next to `index.json`. */
+/** File name of the catalog index, the only one. */
 const FULL_INDEX_FILE = "index.v2.json";
 
-//#endregion
-//#region packages/extension-host/src/points/support.ts
-/** Относительный путь внутри каталога расширения: без `..`, `\` и ведущего `/`. */
-const isSafeRelativePath = (value) => value.length > 0 && !value.includes("\\") && !value.startsWith("/") && !value.split("/").includes("..");
-const safePath = (extensions) => z.string().refine(isSafeRelativePath, "must be a safe relative path").refine((value) => extensions.some((ext) => value.endsWith(ext)), `must end with ${extensions.join(" or ")}`);
-const extensionId = z.string().max(64).regex(EXTENSION_ID_PATTERN, "invalid extension id");
-/** Пути с нарушением правила «`id` равен id расширения или начинается с ним». */
-const idPrefixIssues = (key, ids, owner) => ids.flatMap((id, index) => id === owner || id.startsWith(`${owner}.`) ? [] : [`contributes.${key}.${index}.id: id must be '${owner}' or start with '${owner}.'`]);
-/** Повторы значений в списке `path` (путь до массива, `field` — имя поля записи). */
-const duplicateIssues = (path, field, values) => values.flatMap((value, index) => values.indexOf(value) === index ? [] : [`${path}.${index}.${field}: duplicate ${field} '${value}'`]);
-const isFile$1 = async (file) => (await stat(file).catch(() => null))?.isFile() === true;
-/** Путь внутри каталога расширения; выход за каталог — ошибка. */
-const inside = (dir, relative) => {
-	const resolved = path.resolve(dir, relative);
-	if (!resolved.startsWith(dir + path.sep)) throw new Error(`path '${relative}' escapes the extension directory`);
-	return resolved;
-};
-const rendererUrlOf = (id, renderer) => `dolphy-ext://${id}/${renderer.replace(/^\.\//, "").split("/").map(encodeURIComponent).join("/")}`;
-const defaultNote = (value, fallback) => value === fallback ? " (default)" : "";
-/** Проверяет, что файл модуля существует (если проверка включена), и даёт адрес. */
-const resolveModuleUrl = async (extensionId, dir, file, fallback, verifyFiles, label) => {
-	const absolute = inside(dir, file);
-	if (verifyFiles && !await isFile$1(absolute)) throw new Error(`${label} '${file}'${defaultNote(file, fallback)} is not a file`);
-	return rendererUrlOf(extensionId, file);
-};
-const deepFreeze = (value) => {
-	if (typeof value === "object" && value !== null) {
-		for (const child of Object.values(value)) deepFreeze(child);
-		Object.freeze(value);
-	}
-	return value;
-};
-const compileSchema = (ajv, schema, label) => {
-	try {
-		ajv.compile(schema);
-	} catch (error) {
-		throw new Error(`schema ${label} does not compile: ${error instanceof Error ? error.message : String(error)}`);
-	}
-};
-/** Схема объектом (копия, заморожена) или файлом внутри каталога расширения. */
-const resolveSchema = async (ajv, dir, source, label) => {
-	if (typeof source !== "string") {
-		const schema = deepFreeze(structuredClone(source));
-		compileSchema(ajv, schema, `${label} (inline)`);
-		return schema;
-	}
-	const file = inside(dir, source);
-	let parsed;
-	try {
-		parsed = JSON.parse(await readFile(file, "utf8"));
-	} catch (error) {
-		throw new Error(`schema '${source}' is unreadable: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error(`schema '${source}' is not an object`);
-	compileSchema(ajv, parsed, `'${source}'`);
-	return parsed;
-};
-
-//#endregion
-//#region packages/extension-host/src/points/commands.ts
-const { commands: MAX_COMMANDS } = EXTENSION_COMMAND_LIMITS;
-const commands = {
-	key: "commands",
-	needsMain: true,
-	schema: z.strictObject({
-		id: extensionId,
-		title: z.string().min(1).max(EXTENSION_COMMAND_LIMITS.titleLength),
-		description: z.string().min(1).max(EXTENSION_COMMAND_LIMITS.descriptionLength).optional(),
-		category: z.string().min(1).max(EXTENSION_COMMAND_LIMITS.categoryLength).optional(),
-		keybinding: z.string().regex(KEYBINDING_PATTERN, "must look like Mod+Shift+L").optional(),
-		palette: z.boolean().optional()
-	}),
-	normalize: (entries) => entries.map((entry) => ({
-		...entry,
-		palette: entry.palette ?? true
-	})),
-	check: (entries, owner) => {
-		const ids = entries.map(({ id }) => id);
-		return [
-			...entries.length > MAX_COMMANDS ? [`contributes.commands: at most ${MAX_COMMANDS} commands allowed`] : [],
-			...idPrefixIssues("commands", ids, owner),
-			...duplicateIssues("contributes.commands", "id", ids)
-		];
-	},
-	resolve: async (entries) => entries.map((entry) => ({
-		id: entry.id,
-		title: entry.title,
-		description: entry.description ?? null,
-		category: entry.category ?? null,
-		keybinding: entry.keybinding ?? null,
-		palette: entry.palette
-	})),
-	claims: (resolved) => resolved.map((command) => `command:${command.id}`)
-};
-
-//#endregion
-//#region packages/extension-host/src/points/exercise-types.ts
-const schemaField = z.union([safePath([".json"]), z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, "must not be empty")]);
-const exerciseTypes = {
-	key: "exerciseTypes",
-	needsMain: true,
-	schema: z.strictObject({
-		id: extensionId,
-		specSchema: schemaField,
-		answerSchema: schemaField,
-		element: z.string().optional(),
-		renderer: safePath([".js", ".mjs"]).optional()
-	}),
-	normalize: (entries) => entries.map((type) => ({
-		id: type.id,
-		specSchema: type.specSchema,
-		answerSchema: type.answerSchema,
-		element: type.element ?? defaultElementName(type.id),
-		renderer: type.renderer ?? "./view.mjs"
-	})),
-	check: (entries, owner) => [...idPrefixIssues("exerciseTypes", entries.map(({ id }) => id), owner), ...entries.flatMap((type, index) => ELEMENT_NAME_PATTERN.test(type.element) ? [] : [`contributes.exerciseTypes.${index}.element: invalid element name '${type.element}'`])],
-	resolve: async (entries, { dir, extensionId: owner, verifyFiles, ajv }) => {
-		const resolved = [];
-		for (const contribution of entries) {
-			const rendererUrl = await resolveModuleUrl(owner, dir, contribution.renderer, DEFAULT_RENDERER, verifyFiles, "renderer");
-			resolved.push({
-				id: contribution.id,
-				specSchema: await resolveSchema(ajv, dir, contribution.specSchema, `specSchema of '${contribution.id}'`),
-				answerSchema: await resolveSchema(ajv, dir, contribution.answerSchema, `answerSchema of '${contribution.id}'`),
-				element: contribution.element,
-				rendererUrl
-			});
-		}
-		return resolved;
-	},
-	claims: (resolved) => resolved.flatMap((type) => [`exerciseType:${type.id}`, `element:${type.element}`])
-};
-
-//#endregion
-//#region packages/extension-host/src/points/events.ts
-const events = {
-	key: "events",
-	needsMain: true,
-	schema: z.strictObject({ event: z.enum(LEARNING_EVENT_NAMES) }),
-	normalize: (entries) => entries,
-	check: (entries) => duplicateIssues("contributes.events", "event", entries.map(({ event }) => event)),
-	resolve: async (entries) => entries.map(({ event }) => ({ event })),
-	claims: () => []
-};
-
-//#endregion
-//#region packages/extension-host/src/points/grade-policies.ts
-const BUILTIN_POLICY_ID = "passAtN";
-const gradePolicies = {
-	key: "gradePolicies",
-	needsMain: true,
-	schema: z.strictObject({
-		id: extensionId.refine((id) => id !== BUILTIN_POLICY_ID, `id '${BUILTIN_POLICY_ID}' is reserved for the built-in policy`),
-		label: z.string().min(1).max(60)
-	}),
-	normalize: (entries) => entries,
-	check: (entries, owner) => idPrefixIssues("gradePolicies", entries.map(({ id }) => id), owner),
-	resolve: async (entries) => entries.map(({ id, label }) => ({
-		id,
-		label
-	})),
-	claims: (resolved) => resolved.map((policy) => `gradePolicy:${policy.id}`)
-};
-
-//#endregion
-//#region packages/extension-host/src/points/markdown-renderers.ts
-const markdownRenderers = {
-	key: "markdownRenderers",
-	needsMain: false,
-	schema: z.strictObject({
-		language: z.string().regex(/^[a-z][a-z0-9-]{0,31}$/, "invalid language"),
-		renderer: safePath([".js", ".mjs"]).optional()
-	}),
-	normalize: (entries) => entries.map((entry) => ({
-		language: entry.language,
-		renderer: entry.renderer ?? "./markdown.mjs"
-	})),
-	check: () => [],
-	resolve: async (entries, { dir, extensionId, verifyFiles }) => {
-		const resolved = [];
-		for (const entry of entries) resolved.push({
-			language: entry.language,
-			rendererUrl: await resolveModuleUrl(extensionId, dir, entry.renderer, DEFAULT_MARKDOWN_RENDERER, verifyFiles, "markdown renderer")
-		});
-		return resolved;
-	},
-	claims: (resolved) => resolved.map((entry) => `markdown:${entry.language}`)
-};
-
-//#endregion
-//#region packages/extension-host/src/points/panels.ts
-const { panels: MAX_PANELS } = EXTENSION_COMMAND_LIMITS;
-const panels = {
-	key: "panels",
-	needsMain: false,
-	schema: z.strictObject({
-		id: extensionId,
-		title: z.string().min(1).max(EXTENSION_COMMAND_LIMITS.titleLength),
-		module: safePath([".js", ".mjs"]).optional()
-	}),
-	normalize: (entries) => entries.map((entry) => ({
-		id: entry.id,
-		title: entry.title,
-		module: entry.module ?? "./panel.mjs"
-	})),
-	check: (entries, owner) => {
-		const ids = entries.map(({ id }) => id);
-		return [
-			...entries.length > MAX_PANELS ? [`contributes.panels: at most ${MAX_PANELS} panels allowed`] : [],
-			...idPrefixIssues("panels", ids, owner),
-			...duplicateIssues("contributes.panels", "id", ids)
-		];
-	},
-	resolve: async (entries, { dir, extensionId: owner, verifyFiles }) => {
-		const resolved = [];
-		for (const entry of entries) resolved.push({
-			id: entry.id,
-			title: entry.title,
-			rendererUrl: await resolveModuleUrl(owner, dir, entry.module, DEFAULT_PANEL, verifyFiles, "panel module")
-		});
-		return resolved;
-	},
-	claims: (resolved) => resolved.map((panel) => `panel:${panel.id}`)
-};
-
-//#endregion
-//#region packages/extension-host/src/points/settings.ts
-/** Потолок длины строкового значения: даже в UTF-8 (3 байта на единицу) остаётся в пределах 64 КиБ хранилища. */
-const MAX_STRING_LENGTH = 1e4;
-const MAX_OPTIONS = 64;
-const base = {
-	id: extensionId,
-	label: z.string().min(1).max(60),
-	description: z.string().min(1).max(500).optional()
-};
-const option = z.strictObject({
-	value: z.string().min(1).max(100),
-	label: z.string().min(1).max(60)
-});
-const schema = z.discriminatedUnion("type", [
-	z.strictObject({
-		...base,
-		type: z.literal("boolean"),
-		default: z.boolean()
-	}),
-	z.strictObject({
-		...base,
-		type: z.literal("string"),
-		default: z.string(),
-		maxLength: z.number().int().min(1).max(MAX_STRING_LENGTH).optional()
-	}),
-	z.strictObject({
-		...base,
-		type: z.literal("number"),
-		default: z.number(),
-		min: z.number().optional(),
-		max: z.number().optional(),
-		integer: z.boolean().optional()
-	}),
-	z.strictObject({
-		...base,
-		type: z.literal("enum"),
-		default: z.string(),
-		options: z.array(option).min(1).max(MAX_OPTIONS)
-	})
-]);
-/** Нарушения `default` и границ одного определения (путь — до поля). */
-const constraintIssues = (setting, at) => {
-	const issue = (field, message) => `${at}.${field}: ${message}`;
-	switch (setting.type) {
-		case "boolean": return [];
-		case "string": {
-			const limit = setting.maxLength ?? MAX_STRING_LENGTH;
-			return setting.default.length > limit ? [issue("default", `default is longer than ${limit} characters`)] : [];
-		}
-		case "number": {
-			const { min, max, integer = false } = setting;
-			const issues = [];
-			if (min !== void 0 && max !== void 0 && min > max) issues.push(issue("min", "min is greater than max"));
-			if (integer && !Number.isInteger(setting.default)) issues.push(issue("default", "default must be an integer"));
-			if (min !== void 0 && setting.default < min) issues.push(issue("default", `default is less than min ${min}`));
-			if (max !== void 0 && setting.default > max) issues.push(issue("default", `default is greater than max ${max}`));
-			return issues;
-		}
-		default: {
-			const values = setting.options.map(({ value }) => value);
-			return [...duplicateIssues(`${at}.options`, "value", values), ...values.includes(setting.default) ? [] : [issue("default", `default '${setting.default}' is not an option`)]];
-		}
-	}
-};
-const resolveSetting = (setting) => {
-	const common = {
-		id: setting.id,
-		label: setting.label,
-		description: setting.description ?? null
-	};
-	switch (setting.type) {
-		case "boolean": return {
-			...common,
-			type: "boolean",
-			default: setting.default
-		};
-		case "string": return {
-			...common,
-			type: "string",
-			default: setting.default,
-			maxLength: setting.maxLength ?? null
-		};
-		case "number": return {
-			...common,
-			type: "number",
-			default: setting.default,
-			min: setting.min ?? null,
-			max: setting.max ?? null,
-			integer: setting.integer ?? false
-		};
-		default: return {
-			...common,
-			type: "enum",
-			default: setting.default,
-			options: setting.options.map(({ value, label }) => ({
-				value,
-				label
-			}))
-		};
-	}
-};
-const settings = {
-	key: "settings",
-	needsMain: false,
-	schema,
-	normalize: (entries) => entries,
-	check: (entries, owner) => [
-		...idPrefixIssues("settings", entries.map(({ id }) => id), owner),
-		...duplicateIssues("contributes.settings", "id", entries.map(({ id }) => id)),
-		...entries.flatMap((entry, index) => constraintIssues(entry, `contributes.settings.${index}`))
-	],
-	resolve: async (entries) => entries.map(resolveSetting),
-	claims: (resolved) => resolved.map((setting) => `setting:${setting.id}`)
-};
-
-//#endregion
-//#region packages/extension-host/src/points/themes.ts
-const HEX_COLOR = /^#[0-9a-fA-F]{6}([0-9a-fA-F]{2})?$/;
-const hexColor = z.string().regex(HEX_COLOR, "must be #rrggbb or #rrggbbaa");
-const unknownKeys = (record, allowed) => Object.keys(record).filter((key) => !allowed.includes(key));
-const rejectUnknownKeys = (allowed, noun) => (value, ctx) => {
-	const unknown = unknownKeys(value, allowed);
-	if (unknown.length === 0) return;
-	ctx.addIssue({
-		code: "custom",
-		message: `unknown ${noun} keys: ${unknown.join(", ")}`
-	});
-};
-const colors = z.record(z.string(), hexColor).refine((value) => Object.keys(value).length > 0, "must not be empty").superRefine(rejectUnknownKeys(THEME_COLOR_KEYS, "color"));
-const isVariableValid = (key, value) => key === "border-color" ? typeof value === "string" && HEX_COLOR.test(value) : typeof value === "number" && value >= 0 && value <= 1;
-const variables = z.record(z.string(), z.union([z.string(), z.number()])).superRefine(rejectUnknownKeys(THEME_VARIABLE_KEYS, "variable")).refine((value) => Object.entries(value).every(([key, item]) => isVariableValid(key, item)), "border-color must be a hex color, other variables numbers in [0, 1]");
-const themes = {
-	key: "themes",
-	needsMain: false,
-	schema: z.strictObject({
-		id: extensionId.refine((id) => !BUILTIN_THEME_IDS.includes(id), "id is reserved for a built-in theme"),
-		label: z.string().min(1).max(60),
-		dark: z.boolean(),
-		colors,
-		variables: variables.optional()
-	}),
-	normalize: (entries) => entries,
-	check: (entries, owner) => idPrefixIssues("themes", entries.map(({ id }) => id), owner),
-	resolve: async (entries) => entries.map((theme) => ({
-		id: theme.id,
-		label: theme.label,
-		dark: theme.dark,
-		colors: { ...theme.colors },
-		variables: { ...theme.variables }
-	})),
-	claims: (resolved) => resolved.map((theme) => `theme:${theme.id}`)
-};
-
-//#endregion
-//#region packages/extension-host/src/points/index.ts
-/** Реестр точек вклада: порядок значим для диагностики и разбора. */
-const CONTRIBUTION_POINTS = [
-	exerciseTypes,
-	themes,
-	markdownRenderers,
-	gradePolicies,
-	settings,
-	events,
-	commands,
-	panels
-];
-const POINT_KEYS = CONTRIBUTION_POINTS.map(({ key }) => key);
-
 //#endregion
 //#region packages/extension-host/src/manifest.ts
-const contributesSchema = z.strictObject(Object.fromEntries(CONTRIBUTION_POINTS.map((point) => [point.key, z.array(point.schema).optional()])));
-const entriesOf = (contributes, key) => contributes[key] ?? [];
-const isEmpty = (contributes) => CONTRIBUTION_POINTS.every((point) => entriesOf(contributes, point.key).length === 0);
+/** Относительный путь внутри каталога расширения: без `..`, `\` и ведущего `/`. */
+const isSafeRelativePath = (value) => value.length > 0 && !value.includes("\\") && !value.startsWith("/") && !value.split("/").includes("..");
+const safePath = (extensions) => z.string().refine(isSafeRelativePath, "must be a safe relative path").refine((value) => extensions.some((ext) => value.endsWith(ext)), `must end with ${extensions.join(" or ")}`);
+const extensionId = z.string().max(64).regex(EXTENSION_ID_PATTERN, "invalid extension id");
+/** Диапазон версий в том же виде, что `versions` отзыва и устаревания в каталоге. */
+const versionRange = z.string().superRefine((value, ctx) => {
+	try {
+		parseRange(value);
+	} catch {
+		ctx.addIssue({
+			code: "custom",
+			message: "range must be space-separated comparators such as '>=1.2.0 <2.0.0'"
+		});
+	}
+});
 const manifestSchema = z.strictObject({
+	/** Ссылка на JSON Schema для редактора; приложением и инструментами игнорируется. */
+	$schema: z.string().optional(),
 	id: extensionId,
 	version: z.string().refine(isSemver, "version must be semver"),
 	apiVersion: z.literal(1),
-	main: safePath([".mjs"]).optional(),
-	permissions: z.array(z.enum(EXTENSION_PERMISSIONS)).optional(),
+	main: safePath([".mjs"]).nullable().optional(),
+	client: safePath([".mjs"]).nullable().optional(),
 	name: z.string().min(1).max(80).optional(),
 	description: z.string().min(1).max(500).optional(),
 	author: z.string().regex(GITHUB_LOGIN_PATTERN, "must be a GitHub login").optional(),
@@ -1437,9 +1418,14 @@ const manifestSchema = z.strictObject({
 	minAppVersion: z.string().refine(isSemver, "minAppVersion must be semver x.y.z").optional(),
 	icon: safePath([".png", ".webp"]).optional(),
 	tags: z.array(z.enum(EXTENSION_TAGS, { error: `tag must be one of: ${EXTENSION_TAGS.join(", ")}` })).max(5, "at most 5 tags").optional(),
-	contributes: contributesSchema
+	dependencies: z.array(z.strictObject({
+		id: extensionId,
+		range: versionRange.optional()
+	})).max(16, `at most ${16} dependencies`).optional(),
+	/** Вклады регистрирует код (`server`, `client`): ключ отвергается с подсказкой. */
+	contributes: z.never({ error: "contributions are registered in code (src/index.ts: server, client)" }).optional()
 }).superRefine((manifest, ctx) => {
-	const { permissions = [], platforms = [] } = manifest;
+	const { platforms = [] } = manifest;
 	platforms.forEach((platform, index) => {
 		if (platforms.indexOf(platform) !== index) ctx.addIssue({
 			code: "custom",
@@ -1447,13 +1433,6 @@ const manifestSchema = z.strictObject({
 			message: `duplicate platform '${platform}'`
 		});
 	});
-	permissions.forEach((permission, index) => {
-		if (permissions.indexOf(permission) !== index) ctx.addIssue({
-			code: "custom",
-			path: ["permissions", index],
-			message: `duplicate permission '${permission}'`
-		});
-	});
 	const { tags = [] } = manifest;
 	tags.forEach((tag, index) => {
 		if (tags.indexOf(tag) !== index) ctx.addIssue({
@@ -1462,70 +1441,93 @@ const manifestSchema = z.strictObject({
 			message: `duplicate tag '${tag}'`
 		});
 	});
-	if (entriesOf(manifest.contributes, "events").length > 0 && !permissions.includes("learning.events")) ctx.addIssue({
-		code: "custom",
-		path: ["permissions"],
-		message: "contributes.events requires the 'learning.events' permission"
-	});
-	if (isEmpty(manifest.contributes)) ctx.addIssue({
-		code: "custom",
-		path: ["contributes"],
-		message: "at least one contribution is required"
+	const { dependencies = [] } = manifest;
+	dependencies.forEach(({ id }, index) => {
+		if (id === manifest.id) ctx.addIssue({
+			code: "custom",
+			path: [
+				"dependencies",
+				index,
+				"id"
+			],
+			message: "an extension cannot depend on itself"
+		});
+		else if (dependencies.findIndex((item) => item.id === id) !== index) ctx.addIssue({
+			code: "custom",
+			path: [
+				"dependencies",
+				index,
+				"id"
+			],
+			message: `duplicate dependency '${id}'`
+		});
 	});
 });
-/** Код нужен, если есть записи в точке, которая его требует. */
-const needsMain = (contributes) => CONTRIBUTION_POINTS.some((point) => point.needsMain && entriesOf(contributes, point.key).length > 0);
-/** Применяет умолчания: `main`, `renderer`, `element`, пустые точки. */
-const normalizeManifest = (input) => {
-	const contributes = Object.fromEntries(CONTRIBUTION_POINTS.map((point) => [point.key, point.normalize(entriesOf(input.contributes, point.key))]));
-	return {
-		id: input.id,
-		version: input.version,
-		apiVersion: input.apiVersion,
-		main: input.main ?? (needsMain(input.contributes) ? "./main.mjs" : null),
-		permissions: [...input.permissions ?? []],
-		name: input.name ?? null,
-		description: input.description ?? null,
-		author: input.author ?? null,
-		platforms: [...input.platforms ?? []],
-		minAppVersion: input.minAppVersion ?? null,
-		tags: [...input.tags ?? []],
-		icon: input.icon ?? null,
-		contributes
-	};
-};
-const formatIssues = (error) => error.issues.map((issue) => `${issue.path.join(".") || "/"}: ${issue.message}`).join("; ");
-/** Сообщения о нарушениях в нормализованном манифесте. */
-const normalizedIssues = (manifest) => CONTRIBUTION_POINTS.flatMap((point) => point.check(manifest.contributes[point.key], manifest.id));
+/** Применяет умолчания: части, которой нет, соответствует `null`. */
+const normalizeManifest = (input) => ({
+	id: input.id,
+	version: input.version,
+	apiVersion: input.apiVersion,
+	main: input.main ?? null,
+	client: input.client ?? null,
+	name: input.name ?? null,
+	description: input.description ?? null,
+	author: input.author ?? null,
+	platforms: [...input.platforms ?? []],
+	minAppVersion: input.minAppVersion ?? null,
+	tags: [...input.tags ?? []],
+	dependencies: (input.dependencies ?? []).map(({ id, range }) => ({
+		id,
+		range: range ?? null
+	})),
+	icon: input.icon ?? null
+});
+const zodIssues = (error) => error.issues.map((issue) => `${issue.path.join(".") || "/"}: ${issue.message}`);
+/** Разбор манифеста; ошибка — диагностика `manifest-invalid` (текст — `formatDiagnostic`). */
 const parseManifest = (raw) => {
 	const parsed = manifestSchema.safeParse(raw);
 	if (!parsed.success) return {
 		ok: false,
-		message: formatIssues(parsed.error)
-	};
-	const manifest = normalizeManifest(parsed.data);
-	const issues = normalizedIssues(manifest);
-	if (issues.length > 0) return {
-		ok: false,
-		message: issues.join("; ")
+		diagnostic: {
+			code: "manifest-invalid",
+			data: { issues: zodIssues(parsed.error) }
+		}
 	};
 	return {
 		ok: true,
-		manifest
+		manifest: normalizeManifest(parsed.data)
 	};
 };
 
 //#endregion
 //#region packages/extension-host/src/discover.ts
-const compatibilityIssue = (manifest, appVersion, platform) => checkCompatibility(manifest, {
-	appVersion,
-	platform
-})?.detail ?? null;
-const resolveMain = async (dir, main, verifyFiles) => {
-	if (main === null) return null;
-	const mainPath = inside(dir, main);
-	if (verifyFiles && !await isFile$1(mainPath)) throw new Error(`main '${main}'${defaultNote(main, DEFAULT_MAIN)} is not a file`);
-	return mainPath;
+const compatibilityIssue = (manifest, appVersion, platform) => {
+	const failure = checkCompatibility(manifest, {
+		appVersion,
+		platform
+	});
+	if (failure === null) return null;
+	return failure.reason === "app" ? {
+		code: "requires-app",
+		data: { minAppVersion: manifest.minAppVersion ?? "" }
+	} : {
+		code: "unavailable-platform",
+		data: { platform }
+	};
+};
+const isFile$2 = async (file) => (await stat(file).catch(() => null))?.isFile() === true;
+/** Путь внутри каталога расширения; выход за каталог — ошибка. */
+const inside = (dir, relative) => {
+	const resolved = path.resolve(dir, relative);
+	if (!resolved.startsWith(dir + path.sep)) throw new Error(`path '${relative}' escapes the extension directory`);
+	return resolved;
+};
+/** Путь собранной части расширения (`main`, `client`) внутри каталога; `null` — части нет. */
+const resolvePart = async (dir, part, file, verifyFiles) => {
+	if (file === null) return null;
+	const target = inside(dir, file);
+	if (verifyFiles && !await isFile$2(target)) throw new Error(`${part} '${file}' is not a file`);
+	return target;
 };
 /**
 * Значок манифеста как `data:`-URI. Читается при обнаружении (≤16 КиБ), снимок
@@ -1541,14 +1543,11 @@ const resolveIcon = async (dir, icon, verifyFiles) => {
 	if (problem !== null) throw new Error(problem);
 	return iconDataUri(icon, bytes);
 };
+/** Полностью разбирает каталог одного расширения; ошибка — диагностика (английский текст — `formatDiagnostic`). */
 const inspectExtensionDir = async (directory, options = {}) => {
 	const { verifyFiles = true, expectedId = null, appVersion, platform = process.platform } = options;
 	const dir = path.resolve(directory);
 	const dirName = expectedId ?? path.basename(dir);
-	const ajv = new Ajv2020({
-		allErrors: true,
-		strict: false
-	});
 	let raw;
 	try {
 		raw = JSON.parse(await readFile(path.join(dir, "extension.json"), "utf8"));
@@ -1556,68 +1555,237 @@ const inspectExtensionDir = async (directory, options = {}) => {
 		return {
 			ok: false,
 			id: dirName,
-			message: `extension.json is unreadable: ${error instanceof Error ? error.message : String(error)}`
+			diagnostic: {
+				code: "manifest-unreadable",
+				data: { reason: error instanceof Error ? error.message : String(error) }
+			}
 		};
 	}
 	const parsed = parseManifest(raw);
 	if (!parsed.ok) return {
 		ok: false,
 		id: dirName,
-		message: parsed.message
+		diagnostic: parsed.diagnostic
 	};
 	const { manifest } = parsed;
 	if (expectedId !== null && manifest.id !== expectedId) return {
 		ok: false,
 		id: dirName,
-		message: `directory name '${expectedId}' does not match manifest id '${manifest.id}'`
+		diagnostic: {
+			code: "id-mismatch",
+			data: {
+				expected: expectedId,
+				actual: manifest.id
+			}
+		}
 	};
 	const incompatible = compatibilityIssue(manifest, appVersion, platform);
 	if (incompatible !== null) return {
 		ok: false,
 		id: manifest.id,
-		message: incompatible
+		diagnostic: incompatible
 	};
 	try {
-		const mainPath = await resolveMain(dir, manifest.main, verifyFiles);
-		const context = {
-			dir,
-			extensionId: manifest.id,
-			verifyFiles,
-			ajv
-		};
-		const resolved = {};
-		for (const point of CONTRIBUTION_POINTS) resolved[point.key] = await point.resolve(manifest.contributes[point.key], context);
 		return {
 			ok: true,
 			extension: {
 				id: manifest.id,
 				version: manifest.version,
 				dir,
-				mainPath,
-				permissions: manifest.permissions,
+				mainPath: await resolvePart(dir, "main", manifest.main, verifyFiles),
+				clientPath: await resolvePart(dir, "client", manifest.client, verifyFiles),
 				name: manifest.name,
 				description: manifest.description,
 				author: manifest.author,
 				platforms: manifest.platforms,
 				minAppVersion: manifest.minAppVersion,
 				icon: await resolveIcon(dir, manifest.icon, verifyFiles),
+				warnings: [],
 				tags: manifest.tags,
-				...resolved
+				dependencies: manifest.dependencies
 			}
 		};
 	} catch (error) {
 		return {
 			ok: false,
 			id: manifest.id,
-			message: error instanceof Error ? error.message : String(error)
+			diagnostic: {
+				code: "load-failed",
+				data: { reason: error instanceof Error ? error.message : String(error) }
+			}
 		};
 	}
 };
 
+//#endregion
+//#region packages/extension-host/src/registrar-support.ts
+/** Идентификатор вклада: форма проверяется схемой, принадлежность расширению — `checkOwnId`. */
+const idField = z.string().max(64).regex(EXTENSION_ID_PATTERN, "invalid id");
+/** Подпись: строка или `{ en, ru? }`; каждый текст 1..`max` символов. */
+const localizedField = (max) => {
+	const text = z.string().min(1).max(max);
+	return z.union([text, z.strictObject({
+		en: text,
+		ru: text.optional()
+	})]).transform((value) => {
+		if (typeof value === "string") return value;
+		return value.ru === void 0 ? { en: value.en } : {
+			en: value.en,
+			ru: value.ru
+		};
+	});
+};
+/** Условие видимости: длина здесь, разбор — `whenProblem`. */
+const whenField = z.string().min(1).max(EXTENSION_COMMAND_LIMITS.whenLength);
+/** Значение — функция (схема не копирует её, только проверяет тип). */
+const functionField = z.custom((value) => typeof value === "function", "must be a function");
+
+//#endregion
+//#region packages/extension-host/src/registrar-commands.ts
+const keyText = z.string().min(1);
+const schema = z.strictObject({
+	id: idField,
+	title: localizedField(EXTENSION_COMMAND_LIMITS.titleLength),
+	description: localizedField(EXTENSION_COMMAND_LIMITS.descriptionLength).optional(),
+	category: localizedField(EXTENSION_COMMAND_LIMITS.categoryLength).optional(),
+	keybindings: z.array(z.strictObject({
+		key: keyText,
+		mac: keyText.optional(),
+		windows: keyText.optional(),
+		linux: keyText.optional(),
+		when: whenField.optional()
+	})).max(EXTENSION_COMMAND_LIMITS.keybindingsPerCommand).optional(),
+	palette: z.boolean().optional(),
+	when: whenField.optional(),
+	icon: z.enum(EXTENSION_ICONS).optional(),
+	run: functionField
+});
+
+//#endregion
+//#region packages/extension-host/src/registrar-settings.ts
+const base = {
+	id: idField,
+	label: localizedField(SETTING_LIMITS.labelLength),
+	description: localizedField(SETTING_LIMITS.descriptionLength).optional(),
+	group: localizedField(SETTING_LIMITS.groupLength).optional(),
+	order: z.number().int().min(0).max(SETTING_LIMITS.orderMax).optional(),
+	visibleWhen: z.strictObject({
+		setting: idField,
+		equals: z.union([
+			z.boolean(),
+			z.string(),
+			z.number()
+		])
+	}).optional()
+};
+const option = z.strictObject({
+	value: z.string().min(1).max(SETTING_LIMITS.optionValueLength),
+	label: localizedField(SETTING_LIMITS.labelLength)
+});
+const maxLength = z.number().int().min(1).max(SETTING_LIMITS.stringLength).optional();
+const definitionSchema = z.discriminatedUnion("type", [
+	z.strictObject({
+		...base,
+		type: z.literal("boolean"),
+		default: z.boolean()
+	}),
+	z.strictObject({
+		...base,
+		type: z.literal("string"),
+		default: z.string(),
+		maxLength
+	}),
+	z.strictObject({
+		...base,
+		type: z.literal("text"),
+		default: z.string(),
+		maxLength
+	}),
+	z.strictObject({
+		...base,
+		type: z.literal("color"),
+		default: z.string().regex(COLOR_SETTING_PATTERN, "must be #rrggbb")
+	}),
+	z.strictObject({
+		...base,
+		type: z.literal("list"),
+		default: z.array(z.string()),
+		maxItems: z.number().int().min(1).max(SETTING_LIMITS.listItems).optional(),
+		itemMaxLength: z.number().int().min(1).max(SETTING_LIMITS.listItemLength).optional()
+	}),
+	z.strictObject({
+		...base,
+		type: z.literal("number"),
+		default: z.number().finite(),
+		min: z.number().finite().optional(),
+		max: z.number().finite().optional(),
+		integer: z.boolean().optional()
+	}),
+	z.strictObject({
+		...base,
+		type: z.literal("enum"),
+		default: z.string(),
+		options: z.array(option).min(1).max(SETTING_LIMITS.options)
+	})
+]);
+
+//#endregion
+//#region packages/extension-host/src/registrar.ts
+const BUILTIN_POLICY_ID = "passAtN";
+const { titleLength } = EXTENSION_COMMAND_LIMITS;
+const schemaField = z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, "must not be empty");
+const exerciseTypeSchema = z.strictObject({
+	id: idField,
+	title: localizedField(titleLength).optional(),
+	specSchema: schemaField,
+	answerSchema: schemaField,
+	project: functionField,
+	grade: functionField,
+	referenceAnswer: functionField.optional()
+});
+const gradePolicySchema = z.strictObject({
+	id: idField.refine((id) => id !== BUILTIN_POLICY_ID, `id '${BUILTIN_POLICY_ID}' is reserved for the built-in policy`),
+	label: localizedField(titleLength),
+	evaluate: functionField
+});
+const scheduleSchema = z.discriminatedUnion("every", [z.strictObject({
+	id: idField,
+	every: z.literal("daily"),
+	at: z.string().regex(SCHEDULE_AT_PATTERN, "must be a time such as '09:00'")
+}), z.strictObject({
+	id: idField,
+	every: z.literal("hourly")
+})]);
+const importerSchema = z.strictObject({
+	id: idField,
+	title: localizedField(titleLength),
+	accept: z.array(z.string().regex(TRANSFER_ACCEPT_PATTERN, "must be a lower-case file extension such as '.csv'")).min(1).max(EXTENSION_TRANSFER_LIMITS.acceptExtensions),
+	input: z.enum(["text", "bytes"]),
+	run: functionField
+});
+const exporterSchema = z.strictObject({
+	id: idField,
+	title: localizedField(titleLength),
+	scope: z.enum(["course", "progress"]),
+	run: functionField
+});
+const schemaLike = z.custom((value) => typeof value === "object" && value !== null && typeof Reflect.get(value, "safeParseAsync") === "function", "must be a zod schema");
+const rpcSchema = z.object({
+	name: z.string().max(EXTENSION_RPC_LIMITS.nameLength).regex(RPC_NAME_PATTERN, "must match RPC_NAME_PATTERN"),
+	input: schemaLike,
+	output: schemaLike
+});
+
 //#endregion
 //#region packages/extension-host/src/runtime.ts
-/** Срок обработчика команды расширения (R3); раннер ограниченного процесса и клиент движка ждут дольше. */
+/** Срок обработчика расписания (R12); клиент планировщика ждёт дольше. */
+const SCHEDULE_HANDLER_MS = EXTENSION_SCHEDULE_LIMITS.handlerMs;
+/** Срок обработчика команды расширения (R3); клиент движка ждёт дольше. */
 const COMMAND_HANDLER_MS = EXTENSION_COMMAND_LIMITS.handlerMs;
+/** Срок обработчика `server.handle`; клиент движка ждёт дольше. */
+const RPC_HANDLER_MS = EXTENSION_RPC_LIMITS.handlerMs;
+/** Срок обработчика импортёра и экспортёра; клиент движка (34 с) ждёт дольше. */
+const TRANSFER_HANDLER_MS = EXTENSION_TRANSFER_LIMITS.handlerMs;
 
 //#endregion
 //#region packages/extension-tools/src/catalog/assets.ts
@@ -2117,12 +2285,26 @@ const isBig = (file) => {
 		return false;
 	}
 };
+/** A style sheet or a `<style>` block of a component (`X.vue?vue&type=style…`): the module ends up as a string in the bundle. */
+const VUE_STYLE_MODULE = /\.vue\?(?:.*&)?type=style(?:&|$)/;
+const isStyleModule = (id) => STYLE_FILE.test(cleanId(id)) || VUE_STYLE_MODULE.test(id);
+/** `<style src="./x.css">` in the component `importer`: the component plugin resolves the file once as it is, to link it to the component, and then imports it as text. */
+const isStyleSourceOf = (importer, source) => {
+	if (!importer.endsWith(".vue")) return false;
+	try {
+		const escaped = source.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		return new RegExp(`<style\\b[^>]*\\ssrc\\s*=\\s*(["'])${escaped}\\1`).test(readFileSync(importer, "utf8"));
+	} catch {
+		return false;
+	}
+};
 /**
 * Vite in library mode inlines every asset and has no place for a style sheet: the
-* plugin brings the two documented paths. An image or a font is a data URI up to
+* plugin brings the documented paths. An image or a font is a data URI up to
 * `ASSETS_INLINE_LIMIT` and a file in `assets/` above it (an import with `?url` or
-* `new URL('./x.png', import.meta.url)`); a style sheet is imported as a string with
-* `?inline`, a plain `import './x.css'` is an error with the way out in the message.
+* `new URL('./x.png', import.meta.url)`); a style sheet of the author is imported as a
+* string with `?inline`, a plain `import './x.css'` is an error with the way out in the
+* message.
 */
 const assetsPlugin = (state) => ({
 	name: "dolphy-ext:assets",
@@ -2146,13 +2328,13 @@ const assetsPlugin = (state) => ({
 		const file = cleanId(resolved.id);
 		const query = resolved.id.slice(file.length);
 		if (STYLE_FILE.test(file)) {
-			if (TEXT_IMPORT.test(query)) return null;
+			if (TEXT_IMPORT.test(query) || isStyleSourceOf(importer, source)) return null;
 			const message = `'${source}' is imported as a side-effect style sheet, which a bundle cannot carry: import it as text with import css from '${source}?inline' and add it to the page, or ship it as a file in assets/`;
 			state.problem = message;
 			return this.error(message);
 		}
 		if (!ASSET_FILE.test(file) || MARKED.test(query)) return null;
-		if (STYLE_FILE.test(cleanId(importer)) || !isBig(file)) return null;
+		if (isStyleModule(importer) || !isBig(file)) return null;
 		return {
 			...resolved,
 			id: `${resolved.id}${query === "" ? "?" : "&"}no-inline`
@@ -2161,33 +2343,393 @@ const assetsPlugin = (state) => ({
 });
 
 //#endregion
-//#region packages/extension-tools/src/errors.ts
-/** Extension build/check error; `subject` is the extension id or directory. */
-var BuildError = class extends Error {
-	subject;
-	constructor(message, subject) {
-		super(message);
-		this.name = "BuildError";
-		this.subject = subject;
+//#region packages/extension-tools/src/host-modules.ts
+/**
+* Modules the app gives to the client code of an extension: the extension
+* imports them as usual, the bundle does not contain them, and the window
+* resolves them to its own instances (one Vue, one Vuetify, one theme).
+*/
+const HOST_MODULES = [
+	"vue",
+	"vuetify",
+	"vuetify/components",
+	"vuetify/directives"
+];
+/** Style sheets of the app: the window already has them, the import is dropped. */
+const HOST_STYLES = ["vuetify/styles"];
+/** Name of the host's loader on `globalThis`: `require(name)` returns a promise of the module. */
+const HOST_GLOBAL = "__dolphy";
+/** Modules of the window (`vue`, `vuetify`, `vuetify/…`): the host file is not a place for them, so they are not read. */
+const WINDOW_SPECIFIER = /^(?:vue|vuetify)(?:\/.*)?$/;
+const isHostModule = (specifier) => HOST_MODULES.includes(specifier);
+const isHostStyle = (specifier) => HOST_STYLES.includes(specifier);
+const child$1 = (node, key) => node[key];
+const children$1 = (node, key) => node[key];
+const nameOf$1 = (node) => node["name"] ?? node["value"];
+const newlines = (text) => "\n".repeat(text.split("\n").length - 1);
+/**
+* Replaces the imports of host modules in the generated code of an ES module
+* with reads from the host's loader. A replacement keeps the number of lines
+* of the import it replaces, so source maps stay valid line by line.
+*/
+const rewriteHostImports = (code) => {
+	const ast = parseAst(code, { lang: "js" }).body;
+	const result = new MagicString(code);
+	let index = 0;
+	for (const statement of ast) {
+		if (statement.type !== "ImportDeclaration") continue;
+		const specifier = child$1(statement, "source")["value"];
+		const source = code.slice(statement.start, statement.end);
+		if (isHostStyle(specifier)) {
+			result.overwrite(statement.start, statement.end, newlines(source));
+			continue;
+		}
+		if (!isHostModule(specifier)) continue;
+		const holder = `${HOST_GLOBAL}_${index}`;
+		index += 1;
+		const lines = [`const ${holder} = await globalThis.${HOST_GLOBAL}.require(${JSON.stringify(specifier)});`];
+		const named = [];
+		for (const item of children$1(statement, "specifiers")) {
+			const local = nameOf$1(child$1(item, "local"));
+			if (item.type === "ImportNamespaceSpecifier") lines.push(`const ${local} = ${holder};`);
+			else if (item.type === "ImportDefaultSpecifier") lines.push(`const ${local} = ${holder}.default;`);
+			else {
+				const imported = nameOf$1(child$1(item, "imported"));
+				named.push(imported === local ? local : `${imported}: ${local}`);
+			}
+		}
+		if (named.length > 0) lines.push(`const { ${named.join(", ")} } = ${holder};`);
+		result.overwrite(statement.start, statement.end, lines.join(" ") + newlines(source));
 	}
+	return result.toString();
 };
-/** Invalid command input (nonexistent directory): exit code 2. */
-var CatalogUsageError = class extends BuildError {};
+/**
+* Build plugin for browser files: marks the host modules external and, in
+* the generated bundle, turns their imports into reads from `globalThis.__dolphy`.
+* The result needs neither an import map nor a CSP change.
+*/
+const hostModulesPlugin = () => ({
+	name: "dolphy-ext:host-modules",
+	enforce: "pre",
+	resolveId(source) {
+		if (isHostModule(source) || isHostStyle(source)) return {
+			id: source,
+			external: true
+		};
+		if (WINDOW_SPECIFIER.test(source)) return this.error(`'${source}' is not a module the app gives to extensions (${HOST_MODULES.join(", ")}): import the components from 'vuetify/components'`);
+		return null;
+	},
+	generateBundle(_options, bundle) {
+		for (const file of Object.values(bundle)) if (file.type === "chunk") file.code = rewriteHostImports(file.code);
+	}
+});
 
 //#endregion
-//#region packages/extension-tools/src/analyze.ts
-/** Named entries of `src/index.ts` from which the browser files are built. */
-const RECORDS = [
-	"views",
-	"panels",
-	"markdown"
+//#region packages/extension-tools/src/presets/react.ts
+/**
+* React: `.tsx` and `.jsx` with the automatic JSX runtime, compiled by the
+* bundler itself (no `@vitejs/plugin-react`: a bundle needs no Fast Refresh).
+* `react` and `react-dom` are the author's dependencies and go into the bundle:
+* every extension carries its own copy.
+*/
+const reactPreset = {
+	name: "react",
+	extensions: [".tsx", ".jsx"],
+	packages: [
+		"react",
+		"react-dom",
+		"scheduler"
+	],
+	plugins: () => [],
+	options: { oxc: { jsx: {
+		runtime: "automatic",
+		development: false
+	} } }
+};
+
+//#endregion
+//#region packages/extension-tools/src/presets/vue-styles.ts
+const REGISTRY_SPECIFIER = "dolphy-ext:vue-styles";
+const REGISTRY_ID = `\0${REGISTRY_SPECIFIER}`;
+/** `<style>` blocks of components in the request form of `@vitejs/plugin-vue`: `X.vue?vue&type=style&index=0&inline&lang.css` (the file is the `src` of the block for `<style src>`). */
+const VUE_REQUEST = /[?&]vue(?:&|$)/;
+const STYLE_TYPE = /[?&]type=style(?:&|$)/;
+const INLINE = /[?&]inline(?:&|$)/;
+const DEFAULT_EXPORT = /^export default (".*");?\s*$/s;
+/**
+* Module the style blocks report to: puts all of them into one
+* `<style data-dolphy-ext="<id>">` of the page. The first block of a module
+* instance removes the tag an earlier instance of the same extension left
+* (the window imports `client.mjs` again after a reload), so there is one tag
+* per loaded module.
+*/
+const registrySource = (extensionId) => [
+	`const id = ${JSON.stringify(extensionId)};`,
+	"let tag = null;",
+	"export const addStyle = (css) => {",
+	"  if (tag === null) {",
+	"    for (const old of document.head.querySelectorAll('style[data-dolphy-ext]')) {",
+	"      if (old.getAttribute('data-dolphy-ext') === id) old.remove();",
+	"    }",
+	"    tag = document.createElement('style');",
+	"    tag.setAttribute('data-dolphy-ext', id);",
+	"    document.head.append(tag);",
+	"  }",
+	"  tag.append(css);",
+	"};",
+	""
+].join("\n");
+/**
+* Style blocks of single-file components go to the page as text: a bundle has
+* no style file, so every block, `scoped` or not, is a string the module
+* adds to the tag of the extension when it is evaluated.
+*/
+const vueStylesPlugin = (extensionId) => ({
+	name: "dolphy-ext:vue-styles",
+	enforce: "post",
+	resolveId(source) {
+		return source === REGISTRY_SPECIFIER ? REGISTRY_ID : null;
+	},
+	load(id) {
+		return id === REGISTRY_ID ? registrySource(extensionId) : null;
+	},
+	transform(code, id) {
+		if (!VUE_REQUEST.test(id) || !STYLE_TYPE.test(id) || !INLINE.test(id)) return null;
+		const exported = DEFAULT_EXPORT.exec(code)?.[1];
+		if (exported === void 0) return this.error(`'${id.split("?")[0]}': a style block of a component did not become a string`);
+		return {
+			code: `import { addStyle } from ${JSON.stringify(REGISTRY_SPECIFIER)};\nconst css = ${exported};\naddStyle(css);\nexport default css;\n`,
+			map: null
+		};
+	}
+});
+
+//#endregion
+//#region packages/extension-tools/src/presets/vuetify-template.ts
+const COMPONENTS = "vuetify/components";
+const DIRECTIVES = "vuetify/directives";
+/** Exports of `vuetify/directives`: a template names them as `v-ripple`, `v-click-outside`. */
+const DIRECTIVE_EXPORTS = [
+	"ClickOutside",
+	"Intersect",
+	"Mutate",
+	"Resize",
+	"Ripple",
+	"Scroll",
+	"Tooltip",
+	"Touch"
 ];
+const VUE_FILE$1 = /\.vue(?:\?|$)/;
+/** `_resolveComponent("v-btn")`: the call of the template compiler for a tag that is not a binding of `<script setup>`. */
+const RESOLVE_CALL = /\b_resolve(Component|Directive)\(("(?:[^"\\]|\\.)*")\)/g;
+const pascalCase = (name) => name.split("-").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+/** `v-btn` and `VBtn` → `VBtn`; the other tags are not Vuetify's. */
+const vuetifyComponentOf = (tag) => {
+	if (/^v-[a-z][a-z0-9-]*$/.test(tag)) return pascalCase(tag);
+	return /^V[A-Z][A-Za-z0-9]*$/.test(tag) ? tag : null;
+};
+/** `ripple` and `click-outside` → `Ripple` and `ClickOutside`. */
+const vuetifyDirectiveOf = (name) => {
+	const exported = pascalCase(name);
+	return DIRECTIVE_EXPORTS.includes(exported) ? exported : null;
+};
+/** `import { VBtn as _dolphy_VBtn } from "vuetify/components";` (empty for no names). */
+const importLine = (names, source) => names.size === 0 ? "" : `import { ${[...names].map((name) => `${name} as _dolphy_${name}`).join(", ")} } from ${JSON.stringify(source)};`;
+/**
+* Turns the tags of Vuetify in the templates (`<v-btn>`) into imports from
+* `vuetify/components`, and the directives (`v-ripple`) into imports from
+* `vuetify/directives`. Both are host modules: the window gives its own Vuetify
+* and there is no copy in the bundle. A name the module does not export falls
+* back to Vue's own lookup, which reports the unknown component.
+*/
+const vuetifyTemplatePlugin = () => ({
+	name: "dolphy-ext:vuetify-template",
+	enforce: "post",
+	transform(code, id) {
+		if (!VUE_FILE$1.test(id) || !code.includes("_resolve")) return null;
+		const result = new MagicString(code);
+		const components = /* @__PURE__ */ new Set();
+		const directives = /* @__PURE__ */ new Set();
+		for (const match of code.matchAll(RESOLVE_CALL)) {
+			const [call, kind, literal] = match;
+			if (kind === void 0 || literal === void 0) continue;
+			const name = JSON.parse(literal);
+			const isComponent = kind === "Component";
+			const exported = isComponent ? vuetifyComponentOf(name) : vuetifyDirectiveOf(name);
+			if (exported === null) continue;
+			(isComponent ? components : directives).add(exported);
+			result.overwrite(match.index, match.index + call.length, `(_dolphy_${exported} ?? ${call})`);
+		}
+		const imports = [importLine(components, COMPONENTS), importLine(directives, DIRECTIVES)].filter((line) => line !== "");
+		if (imports.length === 0) return null;
+		result.prepend(`${imports.join(" ")} `);
+		return {
+			code: result.toString(),
+			map: result.generateMap()
+		};
+	}
+});
+
+//#endregion
+//#region packages/extension-tools/src/presets/vue.ts
+/**
+* `@vitejs/plugin-vue` takes "production" from `NODE_ENV` of the process, and a
+* build under `NODE_ENV=test` or `development` would write the development
+* form of the components (`__file` with a path on the build machine, a render
+* function that reads `$setup`). A bundle is always the production form.
+*/
+const alwaysProduction = (plugin) => {
+	const { configResolved } = plugin;
+	if (typeof configResolved !== "function") throw new Error("@vitejs/plugin-vue has no configResolved hook");
+	plugin.configResolved = function resolved(config) {
+		return configResolved.call(this, {
+			...config,
+			isProduction: true
+		});
+	};
+	return plugin;
+};
+/**
+* Vue single-file components (`.vue`): `<script setup lang="ts">`,
+* `<template>` with Vuetify components as `<v-btn>`, `<style>` and
+* `<style scoped>`. Vue and Vuetify are the window's: the bundle imports them
+* from the host, like any other client code.
+*/
+const vuePreset = {
+	name: "vue",
+	extensions: [".vue"],
+	packages: [
+		"vue",
+		"@vue",
+		"vuetify",
+		"@vuetify"
+	],
+	plugins: ({ extensionId }) => [
+		alwaysProduction(vue({ customElement: true })),
+		vuetifyTemplatePlugin(),
+		vueStylesPlugin(extensionId)
+	]
+};
+
+//#endregion
+//#region packages/extension-tools/src/presets/index.ts
+const PRESETS = [vuePreset, reactPreset];
+/** The window is a Vue application, so this preset is always on. */
+const ALWAYS_ON = vuePreset.name;
+const FRAMEWORK_NAMES = PRESETS.map((preset) => preset.name);
+const DEFAULT_FRAMEWORKS = [ALWAYS_ON];
+const isFramework = (name) => FRAMEWORK_NAMES.includes(name);
+/** `frameworks` of the config as it is used: no repeats, the always-on preset first. */
+const normalizeFrameworks = (names) => [.../* @__PURE__ */ new Set([ALWAYS_ON, ...names])];
+const presetsOf = (frameworks) => PRESETS.filter((preset) => frameworks.includes(preset.name));
+/**
+* Modules of the runtime packages of the frameworks in `frameworks`. The server
+* file shares `src/index.ts` with the client file and must not keep what it
+* imports of them (a component defined at the top level of `src/index.ts` is not
+* code of the server), so their top level does not count as code with effects
+* there: tree shaking drops the library together with the component.
+*/
+const frameworkPackagePattern = (frameworks) => new RegExp(`[\\\\/]node_modules[\\\\/](?:${presetsOf(frameworks).flatMap((preset) => preset.packages).join("|")})[\\\\/]`);
+const hasJsx = (node) => {
+	if (typeof node !== "object" || node === null) return false;
+	if (Array.isArray(node)) return node.some(hasJsx);
+	const { type } = node;
+	if (type === "JSXElement" || type === "JSXFragment") return true;
+	return Object.values(node).some(hasJsx);
+};
+const SOURCE_LANG = {
+	".tsx": "tsx",
+	".jsx": "jsx"
+};
+/**
+* A source file of a preset that is not on, with markup in it: without the
+* check the bundler would fail on an import of the runtime of a framework
+* that is not installed, with no word about the config.
+*/
+const disabledPresetGuard = (disabled) => ({
+	name: "dolphy-ext:disabled-presets",
+	enforce: "pre",
+	transform(code, id) {
+		const file = id.split("?")[0] ?? id;
+		const extension = extname(file);
+		const lang = SOURCE_LANG[extension];
+		if (lang === void 0) return null;
+		const owner = disabled.find((preset) => preset.extensions.includes(extension));
+		if (owner === void 0 || !hasJsx(parseAst(code, { lang }).body)) return null;
+		return this.error(`'${file}' contains JSX, which needs the '${owner.name}' framework: add "frameworks": ["${owner.name}"] to dolphy-ext.config.json`);
+	}
+});
+/** Plugins of the client build: those of the presets in `frameworks` and the check for the files of the others. */
+const presetPlugins = async (frameworks, context) => {
+	const enabled = presetsOf(frameworks);
+	const disabled = PRESETS.filter((preset) => !enabled.includes(preset));
+	const groups = await Promise.all(enabled.map((preset) => preset.plugins(context)));
+	return [disabledPresetGuard(disabled), ...groups.flat()];
+};
+/** Vite configuration of the client build with the additions of the presets in `frameworks`. */
+const presetConfig = (frameworks, config) => presetsOf(frameworks).reduce((merged, preset) => preset.options === void 0 ? merged : mergeConfig(merged, preset.options), config);
+
+//#endregion
+//#region packages/extension-tools/src/server-vue.ts
+const VUE_FILE = /\.vue(?:\?|$)/;
+const STUB_PREFIX = "\0dolphy-ext:server-vue:";
+const MARK = "dolphy-ext:server-vue:";
+/** The stub as it stays in the code of a chunk (a comment with the module id may precede it). */
+const STUB_LITERAL = new RegExp(`"${MARK}(?:[^"\\\\]|\\\\.)*"`);
+/**
+* Boundary of a Node bundle: a `.vue` file is a component of the client part.
+* The server file is built without the compiler of components, and
+* `src/index.ts` may import a component for `client`, so the file is replaced
+* by a stub that tree shaking drops with the rest of the client code. A stub
+* that is still in the output means the server code uses the component: that
+* is the error, with the file in the message.
+*/
+const serverVuePlugin = (root, output, state) => ({
+	name: "dolphy-ext:server-vue",
+	enforce: "pre",
+	async resolveId(source, importer, options) {
+		if (!VUE_FILE.test(source)) return null;
+		const resolved = await this.resolve(source, importer, {
+			...options,
+			skipSelf: true
+		});
+		if (resolved === null || resolved.external === true) return null;
+		return {
+			id: `${STUB_PREFIX}${resolved.id}`,
+			moduleSideEffects: false
+		};
+	},
+	load(id) {
+		return id.startsWith(STUB_PREFIX) ? `export default ${JSON.stringify(`${MARK}${id.slice(23)}`)};\n` : null;
+	},
+	generateBundle(_options, bundle) {
+		for (const chunk of Object.values(bundle)) {
+			if (chunk.type !== "chunk") continue;
+			const literal = STUB_LITERAL.exec(chunk.code)?.[0];
+			if (literal === void 0) continue;
+			const file = JSON.parse(literal).slice(22).split("?")[0] ?? "";
+			const message = `${output} uses '${path.relative(root, file)}': a .vue component belongs to the client part, keep it out of the code of 'server'`;
+			state.problem = message;
+			this.error(message);
+		}
+	}
+});
+
+//#endregion
+//#region packages/extension-tools/src/analyze.ts
 const SOURCE_EXTENSIONS = [
 	".ts",
 	".mts",
+	".tsx",
 	".js",
-	".mjs"
+	".mjs",
+	".jsx"
 ];
+const langOf = (file) => {
+	if (/\.tsx$/.test(file)) return "tsx";
+	if (/\.jsx$/.test(file)) return "jsx";
+	return /\.[mc]?ts$/.test(file) ? "ts" : "js";
+};
 const MAX_HOPS = 16;
 const child = (node, key) => node[key];
 const children = (node, key) => node[key];
@@ -2205,7 +2747,7 @@ const unwrap = (node) => {
 };
 /** Name from an identifier or string literal (`{ a: 1 }`, `{ 'a-b': 1 }`, `export { x as 'y' }`). */
 const nameOf = (node) => String(node.type === "Identifier" ? node.name : node.value);
-const isFile = async (file) => (await stat(file).catch(() => null))?.isFile() === true;
+const isFile$1 = async (file) => (await stat(file).catch(() => null))?.isFile() === true;
 /** Relative import → source file; packages and `node:*` are not analyzed. */
 const resolveRelative = async (from, specifier) => {
 	if (!specifier.startsWith(".")) return null;
@@ -2216,28 +2758,13 @@ const resolveRelative = async (from, specifier) => {
 		...SOURCE_EXTENSIONS.map((extension) => `${withoutJs}${extension}`),
 		...SOURCE_EXTENSIONS.map((extension) => path.join(base, `index${extension}`))
 	];
-	for (const candidate of candidates) if (await isFile(candidate)) return candidate;
+	for (const candidate of candidates) if (await isFile$1(candidate)) return candidate;
 	return null;
 };
-const propertyKeys = (literal) => {
-	const keys = [];
-	for (const property of children(literal, "properties")) {
-		if (property.type !== "Property") return { reason: "it uses a spread or a computed entry" };
-		const key = child(property, "key");
-		if (!(property.computed !== true || key.type === "Literal")) return { reason: "it uses a computed key" };
-		keys.push({
-			name: nameOf(key),
-			start: property.start,
-			end: property.end
-		});
-	}
-	return { keys };
-};
 /**
-* Static analysis of `src/index.ts` without executing author code: whether the
-* `host` export exists and which keys the `views`, `panels` and `markdown`
-* entries have. Entries are found through local constants and relative
-* re-exports; keys must be given as an object literal.
+* Static analysis of `src/index.ts` without executing author code: whether it
+* exports `server` and `client`. Exports are found through local constants
+* and relative re-exports.
 */
 const analyzeIndex = async (indexFile) => {
 	const cache = /* @__PURE__ */ new Map();
@@ -2245,7 +2772,7 @@ const analyzeIndex = async (indexFile) => {
 		let parsed = cache.get(file);
 		if (parsed === void 0) {
 			parsed = readFile(file, "utf8").then((source) => {
-				const lang = /\.[mc]?ts$/.test(file) ? "ts" : "js";
+				const lang = langOf(file);
 				return {
 					file,
 					source,
@@ -2346,58 +2873,13 @@ const analyzeIndex = async (indexFile) => {
 			return null;
 		}
 	};
-	const recordOf = async (name) => {
-		const resolved = await walk.export(indexFile, name, 0);
-		if (resolved === null) return { status: "missing" };
-		if (resolved.kind === "opaque") return {
-			status: "opaque",
-			reason: resolved.reason
-		};
-		if (resolved.node.type !== "ObjectExpression") return {
-			status: "opaque",
-			reason: "it is not an object literal"
-		};
-		const found = propertyKeys(resolved.node);
-		if ("reason" in found) return {
-			status: "opaque",
-			reason: found.reason
-		};
-		return {
-			status: "found",
-			site: {
-				file: resolved.parsed.file,
-				source: resolved.parsed.source,
-				start: resolved.node.start,
-				end: resolved.node.end,
-				keys: found.keys
-			}
-		};
-	};
-	const [views, panels, markdown] = await Promise.all(RECORDS.map(recordOf));
-	const hasHost = await walk.export(indexFile, "host", 0) !== null;
+	const [hasServer, hasClient] = await Promise.all([walk.export(indexFile, "server", 0).then((found) => found !== null), walk.export(indexFile, "client", 0).then((found) => found !== null)]);
 	return {
 		files: [...cache.keys()],
-		hasHost,
-		records: {
-			views,
-			panels,
-			markdown
-		}
+		hasServer,
+		hasClient
 	};
 };
-/**
-* Source of `site.file` with the entry literal trimmed to `keep`: the code of the
-* discarded keys does not reach the bundle, and neither do their dependencies.
-*/
-const pruneRecords = (source, sites) => {
-	let result = source;
-	const ordered = [...sites].sort((a, b) => b.site.start - a.site.start);
-	for (const { site, keep } of ordered) {
-		const kept = site.keys.filter((key) => keep.has(key.name)).map((key) => source.slice(key.start, key.end));
-		result = `${result.slice(0, site.start)}{ ${kept.join(", ")} }${result.slice(site.end)}`;
-	}
-	return result;
-};
 const isRecord$1 = (value) => typeof value === "object" && value !== null;
 const collectImports = (node, found) => {
 	if (Array.isArray(node)) {
@@ -2434,101 +2916,26 @@ const stripBareImports = (code, isDropped) => {
 
 //#endregion
 //#region packages/extension-tools/src/shim.ts
-/** SDK subpath with element registration and dispatch; resolved from the author's project. */
-const SDK_RUNTIME = "@dolphy-app/extension-sdk/runtime";
 /** Path of the virtual shim: the build's `lib.entry` and the plugin's `resolveId`; there is no file on disk. */
 const shimEntry = (project, output) => path.join(project.root, "src", `.dolphy-ext-${output.output.replaceAll(/[^\w.-]/g, "-")}.js`);
-const quote = (text) => JSON.stringify(text);
-/** Which `src/index.ts` entries the output file needs: entry name → keys. */
-const wantedRecords = (output) => output.kind === "host" ? {
-	views: [],
-	panels: [],
-	markdown: []
-} : {
-	views: output.views.map((view) => view.id),
-	panels: output.panels,
-	markdown: output.languages
-};
-/** Exports of `src/index.ts` the file is built from (for messages). */
-const exportsOf = (output) => output.kind === "host" ? ["host"] : RECORDS.filter((name) => wantedRecords(output)[name].length > 0);
+/** Export of `src/index.ts` the output file is built from. */
+const exportOf = (output) => output.kind;
 /**
-* Source of the output file's virtual shim: imports from `src/index.ts` only
-* what is needed and does what the app expects from this file. The
-* `export default` result is the module the app loads (`ExtensionModule`,
-* panel module, renderer module); a file of this kind registers elements.
+* Source of the output file's virtual shim: the file's only export is the
+* entry the app loads (`server` or `client`).
 */
-const shimSource = (output, indexFile) => {
-	if (output.kind === "host") return `export { host as default } from ${quote(indexFile)};\n`;
-	const runtime = [];
-	const body = [];
-	const modules = [];
-	if (output.views.length > 0) {
-		runtime.push("registerAnswerView");
-		for (const view of output.views) body.push(`registerAnswerView(${quote(view.element)}, views[${quote(view.id)}]);`);
-	}
-	const table = (name, keys) => `{ ${keys.map((key) => `${quote(key)}: ${name}[${quote(key)}]`).join(", ")} }`;
-	if (output.panels.length > 0) {
-		runtime.push("dispatchPanels");
-		modules.push(`...dispatchPanels(${table("panels", output.panels)})`);
-	}
-	if (output.languages.length > 0) {
-		runtime.push("dispatchMarkdown");
-		modules.push(`...dispatchMarkdown(${table("markdown", output.languages)})`);
-	}
-	const lines = [
-		`import { ${RECORDS.filter((name) => wantedRecords(output)[name].length > 0).join(", ")} } from ${quote(indexFile)};`,
-		`import { ${runtime.join(", ")} } from ${quote(SDK_RUNTIME)};`,
-		...body
-	];
-	if (modules.length > 0) lines.push(`export default { ${modules.join(", ")} };`);
-	return `${lines.join("\n")}\n`;
-};
-/** Mismatches between `src/index.ts` and the manifest; empty — everything agrees. */
-const findMismatches = (project, analysis, indexSource, root) => {
-	const problems = [];
-	if (project.host !== null && !analysis.hasHost) problems.push(`${indexSource} does not export 'host' for ${project.host.output}: add export const host = defineExtension({ … })`);
-	const declared = {
-		views: project.manifest.contributes.exerciseTypes.map((type) => type.id),
-		panels: project.manifest.contributes.panels.map((panel) => panel.id),
-		markdown: project.manifest.contributes.markdownRenderers.map((entry) => entry.language)
-	};
-	const what = {
-		views: "exercise type",
-		panels: "panel",
-		markdown: "markdown renderer"
-	};
-	const fix = {
-		views: "defineAnswerView(…)",
-		panels: "defineExtensionPanel(…)",
-		markdown: "defineMarkdownRenderer(…)"
-	};
-	for (const name of RECORDS) {
-		const result = analysis.records[name];
-		const ids = declared[name];
-		if (result.status === "opaque") problems.push(`${indexSource}: cannot read the keys of '${name}' (${result.reason}); declare it as an object literal with static keys`);
-		else if (result.status === "missing") {
-			if (ids.length > 0) problems.push(`${indexSource} does not export '${name}', but extension.json declares ${what[name]} ${ids.map((id) => `'${id}'`).join(", ")}: add export const ${name} = { ${quote(ids[0])}: ${fix[name]} }`);
-		} else {
-			const file = path.relative(root, result.site.file).split(path.sep).join("/");
-			const keys = result.site.keys.map((key) => key.name);
-			for (const id of ids) if (!keys.includes(id)) problems.push(`${file}: '${name}' has no entry '${id}', but extension.json declares ${what[name]} '${id}'`);
-			for (const key of keys) if (!ids.includes(key)) problems.push(`${file}: '${name}' has entry '${key}', but extension.json declares no ${what[name]} '${key}'`);
-		}
-	}
-	return problems;
-};
+const shimSource = (output, indexFile) => `export { ${exportOf(output)} } from ${JSON.stringify(indexFile)};\n`;
 const isNodeSpecifier = (specifier, external) => specifier.startsWith("node:") || builtinModules.includes(specifier) || external.some((name) => specifier === name || specifier.startsWith(`${name}/`));
 /**
-* Build plugin for a single output file: the virtual shim, reconciliation of
-* `src/index.ts` with the manifest on every (re)build, pruning of entries not
-* belonging to the file, and protection of browser files from `node:*`.
+* Build plugin for a single output file: the virtual shim, the check that
+* `src/index.ts` still exports what the file is built from, and the boundary
+* rules: the client file takes no Node.js modules, the server file no `vue`
+* or `vuetify`.
 */
 const shimPlugin = ({ project, output, state }) => {
-	const indexSource = project.indexSource;
 	const root = realpathSync(project.root);
-	const indexFile = path.join(root, indexSource);
+	const indexFile = path.join(root, project.indexSource);
 	const shimId = shimEntry(project, output);
-	let sites = [];
 	const fail = (context, message) => {
 		state.problem = message;
 		return context.error(message);
@@ -2538,44 +2945,35 @@ const shimPlugin = ({ project, output, state }) => {
 		enforce: "pre",
 		resolveId(specifier) {
 			if (specifier === shimId) return shimId;
-			if (output.kind === "browser" && isNodeSpecifier(specifier, project.external)) return {
+			if (output.kind === "client" && isNodeSpecifier(specifier, project.external)) return {
 				id: specifier,
 				external: true
 			};
 			return null;
 		},
 		generateBundle(_options, bundle) {
-			if (output.kind !== "browser") return;
 			for (const chunk of Object.values(bundle)) {
 				if (chunk.type !== "chunk") continue;
-				chunk.code = stripBareImports(chunk.code, (specifier) => isNodeSpecifier(specifier, project.external));
-				const leaked = [...importsOf(chunk.code)].find((specifier) => isNodeSpecifier(specifier, project.external));
-				if (leaked !== void 0) fail(this, `${output.output} imports '${leaked}': Node.js modules and the 'external' packages of dolphy-ext.config.json are for the extension host, keep them out of code that views, panels and markdown renderers use`);
+				if (output.kind === "server") {
+					chunk.code = stripBareImports(chunk.code, (specifier) => WINDOW_SPECIFIER.test(specifier));
+					const leaked = [...importsOf(chunk.code)].find((specifier) => WINDOW_SPECIFIER.test(specifier));
+					if (leaked !== void 0) fail(this, `${output.output} imports '${leaked}': vue and vuetify belong to the client part, keep them out of the code of 'server'`);
+				} else {
+					chunk.code = stripBareImports(chunk.code, (specifier) => isNodeSpecifier(specifier, project.external));
+					const leaked = [...importsOf(chunk.code)].find((specifier) => isNodeSpecifier(specifier, project.external));
+					if (leaked !== void 0) fail(this, `${output.output} imports '${leaked}': Node.js modules and the 'external' packages of dolphy-ext.config.json belong to the server part, keep them out of the code of 'client'`);
+				}
 			}
 		},
 		async buildStart() {
 			this.addWatchFile(indexFile);
-			const analysis = await analyzeIndex(indexFile).catch((error) => fail(this, `${indexSource} cannot be read: ${String(error)}`));
+			const analysis = await analyzeIndex(indexFile).catch((error) => fail(this, `${project.indexSource} cannot be read: ${String(error)}`));
 			for (const file of analysis.files) this.addWatchFile(file);
-			const problems = findMismatches(project, analysis, indexSource, root);
-			if (problems.length > 0) fail(this, problems.join("; "));
-			const wanted = wantedRecords(output);
-			sites = RECORDS.flatMap((name) => {
-				const result = analysis.records[name];
-				return result.status === "found" ? [{
-					site: result.site,
-					keep: new Set(wanted[name])
-				}] : [];
-			});
+			const name = exportOf(output);
+			if (!(output.kind === "server" ? analysis.hasServer : analysis.hasClient)) fail(this, `${project.indexSource} does not export '${name}', but ${output.output} is built from it`);
 		},
 		load(id) {
 			return id === shimId ? shimSource(output, indexFile) : null;
-		},
-		transform(code, id) {
-			const here = sites.filter(({ site }) => site.file === id);
-			const first = here[0];
-			if (first === void 0 || first.site.source !== code) return null;
-			return pruneRecords(code, here);
 		}
 	};
 };
@@ -2586,13 +2984,23 @@ const errorText$2 = (error) => error instanceof Error ? error.message : String(e
 const nodeExternal = (external) => [
 	/^node:/,
 	...builtinModules,
+	WINDOW_SPECIFIER,
 	...external
 ];
+/** Production flags for browser files: the page has no `process`, and Vue and Vuetify come from the app. */
+const BROWSER_DEFINE = {
+	"process.env.NODE_ENV": "\"production\"",
+	"process.env.VITE_LOGGER_ENABLED": "undefined",
+	__VUE_OPTIONS_API__: "false",
+	__VUE_PROD_DEVTOOLS__: "false",
+	__VUE_PROD_HYDRATION_MISMATCH_DETAILS__: "false"
+};
 const bundleConfig = (project, entry, output, outDir, isNode) => ({
 	root: project.root,
 	configFile: false,
 	publicDir: false,
 	base: "./",
+	define: isNode ? {} : BROWSER_DEFINE,
 	logLevel: "warn",
 	customLogger: {
 		...createLogger("warn"),
@@ -2603,6 +3011,7 @@ const bundleConfig = (project, entry, output, outDir, isNode) => ({
 		outDir,
 		emptyOutDir: false,
 		minify: false,
+		cssMinify: true,
 		copyPublicDir: false,
 		assetsInlineLimit: ASSETS_INLINE_LIMIT,
 		lib: {
@@ -2616,19 +3025,54 @@ const bundleConfig = (project, entry, output, outDir, isNode) => ({
 		}
 	}
 });
-const outputJob = (project, output, outDir) => {
+/** Constants of the extension API are `Object.freeze({…})` calls: without this a browser bundle keeps all of them. */
+const BROWSER_PURE_CALLS = ["Object.freeze"];
+/**
+* Calls of the client part that the server file shares `src/index.ts` with: a
+* call whose result the server does not use is dropped with everything it
+* refers to (a component and the library behind it). The `__NO_SIDE_EFFECTS__`
+* mark of the SDK does not do it for the SDK as published: the bundler keeps
+* the call, and with it React, in `main.mjs`.
+*/
+const SERVER_PURE_CALLS = [
+	"defineComponent",
+	"defineAsyncComponent",
+	"defineClient",
+	"defineMountable",
+	"reactComponent"
+];
+/** `presets`: plugins of the frameworks of the client file (the server file and workers are built without them). */
+const outputJob = (project, output, outDir, presets) => {
 	const state = { problem: null };
-	const config = bundleConfig(project, shimEntry(project, output), output.output, outDir, output.kind === "host");
+	const isBrowser = output.kind === "client";
+	const base = bundleConfig(project, shimEntry(project, output), output.output, outDir, !isBrowser);
+	const config = isBrowser ? presetConfig(project.frameworks, base) : base;
+	const frameworkPackages = frameworkPackagePattern(project.frameworks);
+	config.build = {
+		...config.build,
+		rolldownOptions: {
+			...config.build?.rolldownOptions,
+			treeshake: isBrowser ? { manualPureFunctions: BROWSER_PURE_CALLS } : {
+				moduleSideEffects: (id) => !frameworkPackages.test(id),
+				manualPureFunctions: SERVER_PURE_CALLS
+			}
+		}
+	};
 	return {
 		output: output.output,
-		label: `${output.output} (${exportsOf(output).join(", ")} from ${project.indexSource})`,
+		label: `${output.output} (${exportOf(output)} from ${project.indexSource})`,
 		config: {
 			...config,
-			plugins: [shimPlugin({
-				project,
-				output,
-				state
-			}), assetsPlugin(state)]
+			plugins: [
+				shimPlugin({
+					project,
+					output,
+					state
+				}),
+				...isBrowser ? [hostModulesPlugin()] : [serverVuePlugin(realpathSync(project.root), output.output, state)],
+				...presets,
+				assetsPlugin(state)
+			]
 		},
 		state
 	};
@@ -2640,22 +3084,22 @@ const workerJob = (project, entry, outDir) => {
 		label: `${entry.output} (${entry.source})`,
 		config: {
 			...bundleConfig(project, path.resolve(project.root, entry.source), entry.output, outDir, true),
-			plugins: [assetsPlugin(state)]
+			plugins: [serverVuePlugin(realpathSync(project.root), entry.output, state), assetsPlugin(state)]
 		},
 		state
 	};
 };
-/** Project bundles: the extensions process, browser files, workers. */
-const jobsOf = (project, outDir) => [
-	...project.host === null ? [] : [outputJob(project, project.host, outDir)],
-	...project.browserOutputs.map((output) => outputJob(project, output, outDir)),
+/** Project bundles: the server part, the client part, workers. */
+const jobsOf = async (project, outDir) => [
+	...project.server === null ? [] : [outputJob(project, project.server, outDir, [])],
+	...project.client === null ? [] : [outputJob(project, project.client, outDir, await presetPlugins(project.frameworks, { extensionId: project.manifest.id }))],
 	...project.workerEntries.map((entry) => workerJob(project, entry, outDir))
 ];
 /** Failure cause: a reconciliation or guard error named by the plugin, or the bundler's text. */
 const failureDetail = (job, error) => job.state.problem ?? errorText$2(error);
 /** Builds all bundles (one at a time, no shared chunks) into `outDir`. */
 const bundleAll = async (project, outDir) => {
-	for (const job of jobsOf(project, outDir)) {
+	for (const job of await jobsOf(project, outDir)) {
 		job.state.problem = null;
 		try {
 			await build(job.config);
@@ -2665,66 +3109,6 @@ const bundleAll = async (project, outDir) => {
 	}
 };
 
-//#endregion
-//#region packages/extension-tools/src/ids.ts
-/** Directory of the generated files in a project; never part of `dist-ext` or a catalog source tree. */
-const GENERATED_DIR = ".dolphy";
-/** The declarations file, relative to the project root (posix separators, as in `tsconfig` `include`). */
-const IDS_FILE = `${GENERATED_DIR}/ids.d.ts`;
-const HEADER = "// Generated by `dolphy-ext types` from extension.json. Do not edit: the file is rewritten on every build.";
-/** A single-quoted TypeScript string literal. */
-const literal = (text) => `'${JSON.stringify(text).slice(1, -1).replaceAll("\\\"", "\"").replaceAll("'", "\\'")}'`;
-/** A union of literals; `never` when the manifest declares none. */
-const union = (values) => values.length === 0 ? "never" : values.map(literal).join(" | ");
-const settingType = (setting) => setting.type === "enum" ? union(setting.options.map((option) => option.value)) : setting.type;
-const settingsType = (settings) => settings.length === 0 ? "{}" : `{\n${settings.map((setting) => `      ${literal(setting.id)}: ${settingType(setting)};`).join("\n")}\n    }`;
-/**
-* The declarations for a manifest: an augmentation of `ExtensionIds` in
-* `@dolphy-app/extension-sdk`. Pure function of the normalized manifest, so
-* the output is deterministic; a kind with no ids is `never`.
-*/
-const renderIds = ({ contributes }) => {
-	const entries = [
-		["exerciseTypes", union(contributes.exerciseTypes.map(({ id }) => id))],
-		["gradePolicies", union(contributes.gradePolicies.map(({ id }) => id))],
-		["commands", union(contributes.commands.map(({ id }) => id))],
-		["events", union(contributes.events.map(({ event }) => event))],
-		["panels", union(contributes.panels.map(({ id }) => id))],
-		["markdownLanguages", union(contributes.markdownRenderers.map(({ language }) => language))],
-		["settings", settingsType(contributes.settings)]
-	];
-	return [
-		HEADER,
-		"declare module '@dolphy-app/extension-sdk' {",
-		"  interface ExtensionIds {",
-		...entries.map(([name, type]) => `    ${name}: ${type};`),
-		"  }",
-		"}",
-		"",
-		"export {};",
-		""
-	].join("\n");
-};
-/**
-* Writes `.dolphy/ids.d.ts` for the project, from `extension.json` only (no
-* author code is run). A file with identical content is not rewritten, so a
-* watcher on the project does not see a change.
-*/
-const writeIds = async (project) => {
-	const file = path.join(project.root, IDS_FILE);
-	const content = renderIds(project.manifest);
-	if (await readFile(file, "utf8").catch(() => null) === content) return {
-		file,
-		changed: false
-	};
-	await mkdir(path.dirname(file), { recursive: true });
-	await writeFile(file, content);
-	return {
-		file,
-		changed: true
-	};
-};
-
 //#endregion
 //#region packages/extension-tools/src/project.ts
 const MANIFEST_FILE = "extension.json";
@@ -2732,9 +3116,8 @@ const CONFIG_FILE = "dolphy-ext.config.json";
 const DEFAULT_OUT_DIR = "dist-ext";
 const INDEX_SOURCE = "src/index.ts";
 const stripDot = (file) => file.replace(/^\.\//, "");
-const stripExtension = (file) => file.slice(0, file.length - path.posix.extname(file).length);
-const entrySource = (file) => `src/${path.posix.basename(stripExtension(file))}.ts`;
 const errorText$1 = (error) => error instanceof Error ? error.message : String(error);
+const isFile = async (file) => (await stat(file).catch(() => null))?.isFile() === true;
 const isStringRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((item) => typeof item === "string");
 const isStringArray = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
 const readJson = async (file, subject) => {
@@ -2744,11 +3127,19 @@ const readJson = async (file, subject) => {
 		throw new BuildError(`${path.basename(file)} is unreadable: ${errorText$1(error)}`, subject);
 	}
 };
+/** `frameworks` of the config: names of known presets (an error lists the known ones); `vue` is always on. */
+const frameworksOf = (value, root) => {
+	if (!isStringArray(value)) throw new BuildError(`${CONFIG_FILE}: 'frameworks' must be an array of framework names (${FRAMEWORK_NAMES.join(", ")})`, root);
+	const unknown = value.find((name) => !isFramework(name));
+	if (unknown !== void 0) throw new BuildError(`${CONFIG_FILE}: unknown framework '${unknown}' in 'frameworks': the known frameworks are ${FRAMEWORK_NAMES.join(", ")}`, root);
+	return normalizeFrameworks(value);
+};
 const readConfig = async (root) => {
 	const file = path.join(root, CONFIG_FILE);
 	if (!((await stat(file).catch(() => null))?.isFile() === true)) return {
 		nodeEntries: {},
-		external: []
+		external: [],
+		frameworks: normalizeFrameworks(DEFAULT_FRAMEWORKS)
 	};
 	const config = await readJson(file, root);
 	const nodeEntries = config.nodeEntries ?? {};
@@ -2756,52 +3147,16 @@ const readConfig = async (root) => {
 	if (!isStringRecord(nodeEntries) || !isStringArray(external)) throw new BuildError(`${CONFIG_FILE}: 'nodeEntries' must map output files to sources and 'external' must be a string array`, root);
 	return {
 		nodeEntries,
-		external
+		external,
+		frameworks: frameworksOf(config.frameworks ?? DEFAULT_FRAMEWORKS, root)
 	};
 };
-const schemaPathsOf = (manifest) => {
-	const paths = manifest.contributes.exerciseTypes.flatMap((type) => [type.specSchema, type.answerSchema]).filter((schema) => typeof schema === "string").map(stripDot);
-	return [...new Set(paths)];
-};
-/** Workers are built only together with code: without `main` there are none. */
-const workerEntriesOf = (manifest, config) => manifest.main === null ? [] : Object.entries(config.nodeEntries).map(([output, source]) => ({
+/** Workers are built only together with a server part. */
+const workerEntriesOf = (config, hasServer) => hasServer ? Object.entries(config.nodeEntries).map(([output, source]) => ({
 	source,
 	output: stripDot(output)
-}));
-const browserOutputsOf = (manifest) => {
-	const outputs = /* @__PURE__ */ new Map();
-	const outputOf = (file) => {
-		const output = stripDot(file);
-		const existing = outputs.get(output);
-		if (existing !== void 0) return existing;
-		const created = {
-			kind: "browser",
-			output,
-			views: [],
-			panels: [],
-			languages: []
-		};
-		outputs.set(output, created);
-		return created;
-	};
-	const { exerciseTypes, markdownRenderers, panels } = manifest.contributes;
-	for (const type of exerciseTypes) outputOf(type.renderer).views.push({
-		id: type.id,
-		element: type.element
-	});
-	for (const entry of markdownRenderers) outputOf(entry.renderer).languages.push(entry.language);
-	for (const panel of panels) outputOf(panel.module).panels.push(panel.id);
-	return [...outputs.values()];
-};
-/**
-* Paths where code lived before the single entry (`src/<file name>.ts`):
-* the build uses them to recognize the old layout and suggest a migration.
-*/
-const legacySources = (project) => {
-	const outputs = [...project.host === null ? [] : [project.host.output], ...project.browserOutputs.map((entry) => entry.output)];
-	return [...new Set(outputs.map(entrySource))];
-};
-/** Reads the source manifest and project config, computes the output files. */
+})) : [];
+/** Reads the source manifest, project config and exports of `src/index.ts`, computes the output files. */
 const loadProject = async (rootDir) => {
 	const root = path.resolve(rootDir);
 	const manifestFile = path.join(root, MANIFEST_FILE);
@@ -2813,25 +3168,41 @@ const loadProject = async (rootDir) => {
 	}
 	const raw = await readJson(manifestFile, root);
 	const parsed = parseManifest(raw);
-	if (!parsed.ok) throw new BuildError(parsed.message, root);
+	if (!parsed.ok) throw new BuildError(formatDiagnostic(parsed.diagnostic), root);
 	const { manifest } = parsed;
 	const config = await readConfig(root);
-	const host = manifest.main === null ? null : {
-		kind: "host",
-		output: stripDot(manifest.main)
-	};
-	const browserOutputs = browserOutputsOf(manifest);
+	const indexFile = path.join(root, INDEX_SOURCE);
+	if (!await isFile(indexFile)) throw new BuildError(`'${INDEX_SOURCE}' is not found: an extension is built from one entry file that exports 'server' and/or 'client'`, manifest.id);
+	const analysis = await analyzeIndex(indexFile).catch((error) => {
+		throw new BuildError(`${INDEX_SOURCE} cannot be read: ${errorText$1(error)}`, manifest.id);
+	});
+	if (!analysis.hasServer && !analysis.hasClient) throw new BuildError(`${INDEX_SOURCE} exports neither 'server' nor 'client': export const server = defineServer(…) and/or export const client = defineClient(…)`, manifest.id);
 	return {
 		root,
 		manifest,
 		manifestBytes,
-		indexSource: host !== null || browserOutputs.length > 0 ? INDEX_SOURCE : null,
-		host,
-		browserOutputs,
-		workerEntries: workerEntriesOf(manifest, config),
+		indexSource: INDEX_SOURCE,
+		server: analysis.hasServer ? {
+			kind: "server",
+			output: stripDot(DEFAULT_MAIN)
+		} : null,
+		client: analysis.hasClient ? {
+			kind: "client",
+			output: stripDot(DEFAULT_CLIENT)
+		} : null,
+		workerEntries: workerEntriesOf(config, analysis.hasServer),
 		external: config.external,
-		schemaPaths: schemaPathsOf(manifest)
+		frameworks: config.frameworks
+	};
+};
+/** Bytes of the built `extension.json`: the source manifest with `main` and `client` naming the built files (`null` — no such part). */
+const builtManifestText = (project) => {
+	const built = {
+		...JSON.parse(project.manifestBytes.toString("utf8")),
+		main: project.server === null ? null : `./${project.server.output}`,
+		client: project.client === null ? null : `./${project.client.output}`
 	};
+	return `${JSON.stringify(built, null, 2)}\n`;
 };
 
 //#endregion
@@ -2890,12 +3261,19 @@ const createReporter = (onReport, settleMs = SETTLE_MS) => {
 		}
 	};
 };
+/**
+* Watch output is for development: inline source maps let DevTools show the
+* author's TypeScript for browser bundles. A normal build and a catalog build
+* never write them (`bundleConfig` leaves `sourcemap` unset; `catalog check`
+* rejects them in a submission, CHECK-025).
+*/
 const watchJob = async (job, reporter, isFailFast, failedFirst) => {
 	const started = await build({
 		...job.config,
 		build: {
 			...job.config.build,
-			watch: {}
+			watch: {},
+			sourcemap: "inline"
 		}
 	});
 	if (!isWatcher(started)) throw new Error(`watch mode is not available for '${job.output}'`);
@@ -2943,7 +3321,7 @@ const watchAll = async (project, outDir, reporter, isFailFast) => {
 	const failedFirst = /* @__PURE__ */ new Set();
 	try {
 		const firsts = [];
-		for (const job of jobsOf(project, outDir)) {
+		for (const job of await jobsOf(project, outDir)) {
 			const { watcher, first } = await watchJob(job, reporter, isFailFast, failedFirst);
 			watchers.push(watcher);
 			firsts.push(first);
@@ -2961,7 +3339,7 @@ const watchAll = async (project, outDir, reporter, isFailFast) => {
 
 //#endregion
 //#region packages/extension-tools/src/index.ts
-const STATIC_DIRS = ["schema", "assets"];
+const STATIC_DIRS = ["assets"];
 /** Editors write a file in several events: manifest reload waits for quiet. */
 const MANIFEST_SETTLE_MS = 100;
 const isPresent = async (file) => await stat(file).catch(() => null) !== null;
@@ -2969,29 +3347,11 @@ const targetDir = (project, options) => {
 	const base = options.outDir ?? path.join(project.root, "dist-ext");
 	return path.join(path.resolve(base), project.manifest.id);
 };
-const legacyHint = (project) => {
-	const { contributes } = project.manifest;
-	return [
-		"create src/index.ts",
-		...project.host === null ? [] : [`move the default export of the main file into it as export const host = defineExtension({ … })`],
-		...contributes.exerciseTypes.length === 0 ? [] : [`replace defineAnswerElement(tag, mount) with an entry of export const views = { '<exercise type id>': defineAnswerView(mount) } (the tag now comes from extension.json)`],
-		...contributes.panels.length === 0 ? [] : [`move the default export of the panel module into export const panels = { '<panel id>': defineExtensionPanel({ … }) }`],
-		...contributes.markdownRenderers.length === 0 ? [] : [`move the default export of the renderer module into export const markdown = { '<language>': defineMarkdownRenderer(…) }`],
-		"delete the old src files and import from src/index.ts in tests"
-	].map((step, index) => `${index + 1}. ${step}`).join("; ");
-};
 const requireSources = async (project) => {
-	const { indexSource } = project;
-	if (indexSource !== null && !await isPresent(path.join(project.root, indexSource))) {
-		const legacy = legacySources(project);
-		const found = (await Promise.all(legacy.map(async (source) => await isPresent(path.join(project.root, source)) ? source : null))).filter((source) => source !== null);
-		const reason = found.length > 0 ? `found the old layout (${found.join(", ")}), which is no longer supported; migrate: ${legacyHint(project)}` : `add it: ${legacyHint(project)}`;
-		throw new BuildError(`'${indexSource}' is not found: an extension with code is built from one entry file; ${reason}`, project.manifest.id);
-	}
 	for (const entry of project.workerEntries) if (!await isPresent(path.join(project.root, entry.source))) throw new BuildError(`entry source '${entry.source}' for '${entry.output}' is not found`, project.manifest.id);
 };
 const copyStatic = async (project, dir) => {
-	await writeFile(path.join(dir, MANIFEST_FILE), project.manifestBytes);
+	await writeFile(path.join(dir, MANIFEST_FILE), builtManifestText(project));
 	for (const name of STATIC_DIRS) {
 		const from = path.join(project.root, name);
 		if (await isPresent(from)) await cp(from, path.join(dir, name), { recursive: true });
@@ -3003,12 +3363,6 @@ const copyStatic = async (project, dir) => {
 		await mkdir(path.dirname(path.join(dir, icon)), { recursive: true });
 		await cp(from, path.join(dir, icon));
 	}
-	for (const schema of project.schemaPaths) {
-		const from = path.join(project.root, schema);
-		if (!await isPresent(from)) throw new BuildError(`schema '${schema}' referenced by the manifest is not found`, project.manifest.id);
-		await mkdir(path.dirname(path.join(dir, schema)), { recursive: true });
-		await cp(from, path.join(dir, schema));
-	}
 };
 const listFiles = async (dir, prefix = "") => {
 	const entries = await readdir(path.join(dir, prefix), { withFileTypes: true });
@@ -3025,9 +3379,10 @@ const validateExtension = async (dir) => {
 	});
 	if (!result.ok) return {
 		ok: false,
-		problems: [result.message]
+		problems: [formatDiagnostic(result.diagnostic)]
 	};
-	const problems = (await assetFindings(root, await listFiles(root))).map(({ path: file, message }) => `${file}: ${message}`);
+	const files = await listFiles(root);
+	const problems = (await assetFindings(root, files)).map(({ path: file, message }) => `${file}: ${message}`);
 	return {
 		ok: problems.length === 0,
 		problems
@@ -3037,11 +3392,8 @@ const assertValid = async (project, dir) => {
 	const { ok, problems } = await validateExtension(dir);
 	if (!ok) throw new BuildError(problems.join("; "), project.manifest.id);
 };
-/** Writes `.dolphy/ids.d.ts` for the project in `options.root` from its `extension.json`; `changed` is false when the file was already current. */
-const generateTypes = async (options) => writeIds(await loadProject(options.root));
 const prepare = async (options) => {
 	const project = await loadProject(options.root);
-	await writeIds(project);
 	await requireSources(project);
 	const dir = targetDir(project, options);
 	await rm(dir, {
@@ -3081,17 +3433,20 @@ const watchExtension = async (options) => {
 	const { logger } = options;
 	let project = first;
 	let dir = firstDir;
+	let current = null;
 	const reporter = createReporter((report) => reportTo(project.manifest.id, logger)(report));
-	let current = await watchAll(project, dir, reporter, true);
-	try {
-		await copyStatic(project, dir);
-		await assertValid(project, dir);
-	} catch (error) {
-		await current.close();
-		reporter.close();
-		throw error;
-	}
-	const result = await resultOf$1(project, dir);
+	const start = async () => {
+		const started = await watchAll(project, dir, reporter, true);
+		current = started;
+		try {
+			await copyStatic(project, dir);
+			await assertValid(project, dir);
+		} catch (error) {
+			await started.close();
+			throw error;
+		}
+		return resultOf$1(project, dir);
+	};
 	const reload = async () => {
 		const previous = project.manifestBytes;
 		let next;
@@ -3109,7 +3464,6 @@ const watchExtension = async (options) => {
 			force: true
 		});
 		try {
-			await writeIds(next);
 			await requireSources(next);
 			project = next;
 			dir = targetDir(project, options);
@@ -3125,19 +3479,32 @@ const watchExtension = async (options) => {
 		}
 	};
 	let queue = Promise.resolve();
-	let timer = null;
-	const manifestWatcher = watch(project.root, (_event, name) => {
+	let timer;
+	const manifestWatcher = watch(first.root, (_event, name) => {
 		if (name !== "extension.json") return;
-		if (timer !== null) clearTimeout(timer);
+		clearTimeout(timer);
 		timer = setTimeout(() => {
 			queue = queue.then(reload);
 		}, MANIFEST_SETTLE_MS);
 	});
+	const stopWatching = () => {
+		manifestWatcher.close();
+		clearTimeout(timer);
+	};
+	const started = start();
+	queue = started.then(() => void 0, () => void 0);
+	let result;
+	try {
+		result = await started;
+	} catch (error) {
+		stopWatching();
+		reporter.close();
+		throw error;
+	}
 	return {
 		result,
 		close: async () => {
-			manifestWatcher.close();
-			if (timer !== null) clearTimeout(timer);
+			stopWatching();
 			await queue;
 			reporter.close();
 			await current?.close();
@@ -3179,6 +3546,111 @@ const createGithubChecker = (options = {}) => {
 	};
 };
 
+//#endregion
+//#region packages/extension-tools/src/lint/bundle.ts
+const CODE_FILE = /\.(?:mjs|js|cjs)$/;
+const OBFUSCATION_MIN_BYTES = 20480;
+const OBFUSCATION_LINE_LENGTH = 500;
+const OBFUSCATION_IDENTIFIERS = 20;
+/**
+* `eval(…)` and `new Function(…)`, except `new Function("")`: its body is
+* empty, nothing runs. `zod` makes that call to find out whether code
+* generation is allowed, so every bundle that validates with `zod` has it.
+*/
+const DYNAMIC_EXECUTION = /(?<![\w$])(?:eval\s*\(|new\s+Function\s*\((?!\s*(?:""|''|``)\s*\)))/;
+const HEX_IDENTIFIER = /(?<![\w$])_0x[0-9a-f]{3,}(?![\w$])/gi;
+const SOURCE_MAP = /\/\/[#@]\s*sourceMappingURL=/;
+const listCodeFiles = async (dir, prefix = "") => {
+	const entries = await readdir(path.join(dir, prefix), { withFileTypes: true });
+	return (await Promise.all(entries.map(async (entry) => {
+		const relative = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+		if (entry.isDirectory()) return listCodeFiles(dir, relative);
+		return entry.isFile() && CODE_FILE.test(entry.name) ? [relative] : [];
+	}))).flat().sort();
+};
+/** Code files (`.mjs`, `.js`, `.cjs`) of a built extension directory. */
+const readBundleFiles = async (dir) => Promise.all((await listCodeFiles(dir)).map(async (file) => ({
+	path: file,
+	text: await readFile(path.join(dir, file), "utf8")
+})));
+const isObfuscated = (text) => {
+	const size = Buffer.byteLength(text);
+	if (size >= OBFUSCATION_MIN_BYTES) {
+		const average = size / text.split("\n").length;
+		if (average > OBFUSCATION_LINE_LENGTH) return `average line length is ${Math.round(average)} characters`;
+	}
+	const identifiers = new Set(text.match(HEX_IDENTIFIER) ?? []);
+	return identifiers.size >= OBFUSCATION_IDENTIFIERS ? `${identifiers.size} identifiers of the form _0x1a2b` : null;
+};
+/**
+* Heuristics over the built code (`CHECK-022`, `CHECK-023`, `CHECK-025`). They
+* read the whole bundle, dependencies included, so only the source map is an
+* error.
+*/
+const bundleFindings = (files) => {
+	const findings = [];
+	for (const { path: field, text } of files) {
+		if (DYNAMIC_EXECUTION.test(text)) findings.push({
+			ruleId: "CHECK-022",
+			severity: "warning",
+			field,
+			message: "dynamic code execution (eval or new Function)"
+		});
+		const obfuscation = isObfuscated(text);
+		if (obfuscation !== null) findings.push({
+			ruleId: "CHECK-023",
+			severity: "warning",
+			field,
+			message: `looks obfuscated: ${obfuscation}`
+		});
+		if (SOURCE_MAP.test(text)) findings.push({
+			ruleId: "CHECK-025",
+			severity: "error",
+			field,
+			message: "embedded source map: the catalog builds without maps"
+		});
+	}
+	return findings;
+};
+
+//#endregion
+//#region packages/extension-tools/src/lint/manifest.ts
+const MIN_DESCRIPTION_LENGTH = 20;
+/** `CHECK-019`: a description is present but too short to tell what the extension does. */
+const shortDescription = (description) => description !== null && description.trim() !== "" && description.trim().length < 20 ? [{
+	severity: "warning",
+	field: "description",
+	message: `description is shorter than ${20} characters: say what the extension does`
+}] : [];
+const missing$1 = (value) => value === null || value.trim() === "";
+/** Publication metadata of a project: every problem is a warning. */
+const manifestFindings = (fields) => {
+	const findings = [];
+	for (const field of ["name", "author"]) if (missing$1(fields[field])) findings.push({
+		ruleId: "CHECK-003",
+		severity: "warning",
+		field,
+		message: `'${field}' is not set: the catalog requires it`
+	});
+	if (missing$1(fields.description)) findings.push({
+		ruleId: "CHECK-003",
+		severity: "warning",
+		field: "description",
+		message: "'description' is not set: the catalog requires it"
+	});
+	for (const finding of shortDescription(fields.description)) findings.push({
+		ruleId: "CHECK-019",
+		...finding
+	});
+	if (fields.tags === null || fields.tags.length === 0) findings.push({
+		ruleId: "LINT-001",
+		severity: "warning",
+		field: "tags",
+		message: "'tags' is not set: the catalog lists the extension without tags"
+	});
+	return findings;
+};
+
 //#endregion
 //#region packages/extension-tools/src/catalog/rules.ts
 const MAX_SOURCE_FILES = 200;
@@ -3388,6 +3860,91 @@ const iconFile = {
 		return problem === null ? [] : [error("icon", problem)];
 	}
 };
+const shortDescriptionRule = {
+	id: "CHECK-019",
+	title: "description is at least 20 characters",
+	run: ({ declared }) => shortDescription(declared?.description ?? null).map((finding) => warning(finding.field, finding.message))
+};
+const MAX_CHANGELOG_BYTES = 65536;
+const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** Why the bytes are no acceptable `CHANGELOG.md` (over 64 KiB, not UTF-8, NUL); `null` — fine. */
+const changelogProblem = (bytes) => {
+	if (bytes.length > 65536) return `${bytes.length} bytes exceed the limit of ${MAX_CHANGELOG_BYTES}`;
+	try {
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes).includes("\0") ? "contains NUL characters" : null;
+	} catch {
+		return "is not valid UTF-8";
+	}
+};
+/** CHANGELOG.md: up to 64 KiB, UTF-8 without NUL; a missing section of the manifest version is a warning. */
+const changelog = {
+	id: "CHECK-030",
+	title: "CHANGELOG.md is up to 64 KiB of UTF-8 text and has a section of the current version",
+	run: async ({ readBytes, manifest }) => {
+		const bytes = await readBytes("CHANGELOG.md");
+		if (bytes === null) return [];
+		const problem = changelogProblem(bytes);
+		if (problem !== null) return [error("CHANGELOG.md", problem)];
+		const text = new TextDecoder().decode(bytes);
+		if (manifest === null) return [];
+		return new RegExp(`^##[ \\t]+\\[?v?${escapeRegExp(manifest.version)}\\]?(?:[ \\t]|$)`, "m").test(text) ? [] : [warning("CHANGELOG.md", `has no '## ${manifest.version}' section for the current version`)];
+	}
+};
+const firstPublisherOwnsId = {
+	id: "CHECK-021",
+	title: "the id is not published under another author",
+	run: ({ declared, published }) => {
+		const author = declared?.author;
+		if (!author || published === void 0) return [];
+		return published.author.toLowerCase() === author.toLowerCase() ? [] : [error("author", `id '${published.id}' is published by '${published.author}': the first publisher owns the id`)];
+	}
+};
+const NO_BUNDLE = "built version is not found: the bundle heuristics are skipped";
+/** `CHECK-022`…`CHECK-025`: heuristics over the built version; silent without `--built`. */
+const bundleRule = (id, title, missingBundle = false) => ({
+	id,
+	title,
+	run: async ({ bundleDir, manifest }) => {
+		if (bundleDir === null || manifest === null) return [];
+		const files = await readBundleFiles(bundleDir).catch(() => null);
+		if (files === null) return missingBundle ? [warning("--built", `${NO_BUNDLE} (${bundleDir})`)] : [];
+		return bundleFindings(files).filter((finding) => finding.ruleId === id).map(({ severity, field, message }) => ({
+			severity,
+			field,
+			message
+		}));
+	}
+});
+const BUILT_PARTS = [{
+	field: "main",
+	file: DEFAULT_MAIN
+}, {
+	field: "client",
+	file: DEFAULT_CLIENT
+}];
+/** `CHECK-031`: the built manifest's `main` and `client` name the files that are in the built version, and each file has its field; silent without `--built`. */
+const builtParts = {
+	id: "CHECK-031",
+	title: "main.mjs and client.mjs match the main and client fields",
+	run: async ({ bundleDir }) => {
+		if (bundleDir === null) return [];
+		let built;
+		try {
+			built = JSON.parse(await readFile(path.join(bundleDir, "extension.json"), "utf8"));
+		} catch {
+			return [];
+		}
+		if (!isRecord(built)) return [];
+		const findings = [];
+		for (const { field, file } of BUILT_PARTS) {
+			const declared = built[field];
+			const exists = (await stat(path.join(bundleDir, file)).catch(() => null))?.isFile() === true;
+			if (typeof declared === "string" && !exists) findings.push(error(field, `'${declared}' is not in the built version`));
+			else if (typeof declared !== "string" && exists) findings.push(error(field, `${file} is in the built version, but '${field}' is not set`));
+		}
+		return findings;
+	}
+};
 const RULES = [
 	manifestValid,
 	directoryName,
@@ -3406,9 +3963,61 @@ const RULES = [
 	noExecutables,
 	appVersionBound,
 	assetFiles,
-	iconFile
+	iconFile,
+	shortDescriptionRule,
+	firstPublisherOwnsId,
+	bundleRule("CHECK-022", "built code does not execute dynamic code", true),
+	bundleRule("CHECK-023", "built code is not obfuscated"),
+	bundleRule("CHECK-025", "built code has no embedded source map"),
+	builtParts,
+	changelog
 ];
 
+//#endregion
+//#region packages/extension-tools/src/catalog/deprecated.ts
+/** Reads `deprecated.json`; every problem is a `BuildError` (nothing is written by the caller). */
+const loadDeprecated = async (file) => {
+	let raw;
+	try {
+		raw = JSON.parse(await readFile(file, "utf8"));
+	} catch (error) {
+		throw new BuildError(`deprecated list is unreadable: ${error instanceof Error ? error.message : String(error)}`, file);
+	}
+	try {
+		return parseDeprecatedList(raw);
+	} catch (error) {
+		if (!(error instanceof CatalogFormatError)) throw error;
+		throw new BuildError(`deprecated list is invalid: ${error.issues.join("; ")}`, file);
+	}
+};
+/** Problems of the list against the ids known to the index: unknown `id`, alternative missing from the index. */
+const deprecatedProblems = (items, known, { checkIds = true } = {}) => items.flatMap((item) => [...checkIds && !known.has(item.id) ? [{
+	id: item.id,
+	field: "id",
+	message: `'${item.id}' is not in the index`
+}] : [], ...item.alternatives.filter((alternative) => !known.has(alternative)).map((alternative) => ({
+	id: item.id,
+	field: "alternatives",
+	message: `alternative '${alternative}' is not in the index`
+}))]);
+/** Sets `deprecated` of the entries from the list and removes it from entries no longer listed. */
+const applyDeprecated = (entries, items, file) => {
+	const problems = deprecatedProblems(items, new Set(entries.map(({ id }) => id)));
+	if (problems.length > 0) throw new BuildError(problems.map(({ id, message }) => `${id}: ${message}`).join("; "), file);
+	const byId = new Map(items.map((item) => [item.id, item]));
+	return entries.map((entry) => {
+		const next = { ...entry };
+		delete next.deprecated;
+		const item = byId.get(entry.id);
+		if (item !== void 0) next.deprecated = {
+			versions: item.versions ?? null,
+			reason: item.reason,
+			alternatives: [...item.alternatives]
+		};
+		return next;
+	});
+};
+
 //#endregion
 //#region packages/extension-tools/src/catalog/tree.ts
 const compareText = (a, b) => {
@@ -3451,7 +4060,6 @@ const hashTree = async (root, files) => Promise.all(files.map(async (file) => ({
 const SKIPPED_SOURCE_DIRS = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist-ext",
-	".dolphy",
 	".git"
 ]);
 const formatFinding = (finding) => `${finding.severity} ${finding.extensionId} ${finding.ruleId} ${finding.field}: ${finding.message}`;
@@ -3502,35 +4110,49 @@ const inspectManifest = async (dir) => {
 		problem: null
 	} : {
 		manifest: null,
-		problem: result.message
+		problem: formatDiagnostic(result.diagnostic)
 	};
 };
-const stringOrNull = (value) => typeof value === "string" ? value : null;
+const stringOrNull$1 = (value) => typeof value === "string" ? value : null;
+/** The extension manifest as written. */
 const readDeclared = async (dir) => {
+	let raw;
 	try {
-		const raw = JSON.parse(await readFile(path.join(dir, "extension.json"), "utf8"));
-		if (typeof raw !== "object" || raw === null) return null;
-		const fields = raw;
+		raw = JSON.parse(await readFile(path.join(dir, "extension.json"), "utf8"));
+	} catch {
 		return {
-			name: stringOrNull(fields.name),
-			description: stringOrNull(fields.description),
-			author: stringOrNull(fields.author),
-			icon: stringOrNull(fields.icon)
+			raw: null,
+			declared: null
 		};
-	} catch {
-		return null;
 	}
+	if (typeof raw !== "object" || raw === null) return {
+		raw,
+		declared: null
+	};
+	const fields = raw;
+	return {
+		raw,
+		declared: {
+			name: stringOrNull$1(fields.name),
+			description: stringOrNull$1(fields.description),
+			author: stringOrNull$1(fields.author),
+			icon: stringOrNull$1(fields.icon)
+		}
+	};
 };
 const contextFor = async (options, dirName, published, checkGithubUser) => {
 	const dir = path.resolve(options.extensionsDir, dirName);
 	const { manifest, problem } = await inspectManifest(dir);
+	const { raw, declared } = await readDeclared(dir);
 	return {
 		dirName,
 		dir,
 		manifest,
-		declared: await readDeclared(dir),
+		declared,
+		rawManifest: raw,
 		manifestProblem: problem,
 		tree: await readTree(dir, SKIPPED_SOURCE_DIRS),
+		bundleDir: options.builtDir === void 0 || manifest === null ? null : path.join(path.resolve(options.builtDir), "extensions", manifest.id, manifest.version),
 		readText: (file) => readTextOrNull(path.join(dir, file)),
 		readBytes: (file) => readBytesInside(dir, file),
 		published: published?.extensions.find((entry) => entry.id === (manifest?.id ?? dirName)),
@@ -3539,6 +4161,32 @@ const contextFor = async (options, dirName, published, checkGithubUser) => {
 		checkGithubUser
 	};
 };
+const DEPRECATED_RULE = "deprecated";
+/** The form of `deprecated.json` and (with an index) the existence of the alternatives; unknown ids are a build matter. */
+const deprecatedFindings = async (file, published) => {
+	let items;
+	try {
+		items = await loadDeprecated(file);
+	} catch (error) {
+		if (!(error instanceof BuildError)) throw error;
+		return [{
+			severity: "error",
+			extensionId: path.basename(file),
+			ruleId: DEPRECATED_RULE,
+			field: "/",
+			message: error.message
+		}];
+	}
+	if (published === null) return [];
+	const known = new Set(published.extensions.map(({ id }) => id));
+	return deprecatedProblems(items, known, { checkIds: false }).map(({ id, field, message }) => ({
+		severity: "error",
+		extensionId: id,
+		ruleId: DEPRECATED_RULE,
+		field,
+		message
+	}));
+};
 const checkCatalog = async (options) => {
 	const dirs = await selectDirs(options);
 	const published = options.publishedIndex === void 0 ? null : await loadIndexFile(options.publishedIndex);
@@ -3546,7 +4194,7 @@ const checkCatalog = async (options) => {
 		...options.fetch === void 0 ? {} : { fetch: options.fetch },
 		token: options.githubToken
 	});
-	const findings = [];
+	const findings = [...options.deprecated === void 0 ? [] : await deprecatedFindings(options.deprecated, published)];
 	for (const dirName of dirs) {
 		const context = await contextFor(options, dirName, published, checkGithubUser);
 		for (const rule of RULES) for (const finding of await rule.run(context)) findings.push({
@@ -3572,22 +4220,16 @@ const orderVersion = (version) => ({
 	version: version.version,
 	apiVersion: version.apiVersion,
 	minAppVersion: version.minAppVersion,
-	permissions: [...version.permissions],
 	publishedAt: version.publishedAt,
 	baseUrl: version.baseUrl,
 	files: [...version.files].sort(byPath).map(orderFile),
 	...version.icon === void 0 ? {} : { icon: version.icon },
-	...version.tags === void 0 || version.tags.length === 0 ? {} : { tags: [...version.tags] }
+	...version.tags === void 0 || version.tags.length === 0 ? {} : { tags: [...version.tags] },
+	...version.dependencies === void 0 || version.dependencies.length === 0 ? {} : { dependencies: version.dependencies.map(({ id, range }) => ({
+		id,
+		...range === void 0 ? {} : { range }
+	})) }
 });
-const optionalIds = (key, ids) => ids === void 0 || ids.length === 0 ? {} : { [key]: [...ids] };
-const orderTitles = (titles) => {
-	const ordered = {};
-	for (const point of TITLED_POINTS) {
-		const map = titles?.[point];
-		if (map !== void 0 && Object.keys(map).length > 0) ordered[point] = { ...map };
-	}
-	return Object.keys(ordered).length > 0 ? { titles: ordered } : {};
-};
 const orderEntry = (entry) => ({
 	id: entry.id,
 	name: entry.name,
@@ -3595,30 +4237,24 @@ const orderEntry = (entry) => ({
 	author: entry.author,
 	source: entry.source,
 	platforms: [...entry.platforms],
-	contributes: {
-		exerciseTypes: [...entry.contributes.exerciseTypes],
-		themes: [...entry.contributes.themes],
-		markdownRenderers: [...entry.contributes.markdownRenderers],
-		gradePolicies: [...entry.contributes.gradePolicies],
-		...optionalIds("settings", entry.contributes.settings),
-		...optionalIds("events", entry.contributes.events),
-		...optionalIds("commands", entry.contributes.commands),
-		...optionalIds("panels", entry.contributes.panels)
-	},
-	...orderTitles(entry.titles),
+	...entry.deprecated === void 0 ? {} : { deprecated: {
+		versions: entry.deprecated.versions,
+		reason: entry.deprecated.reason,
+		alternatives: [...entry.deprecated.alternatives]
+	} },
 	versions: entry.versions.map(orderVersion)
 });
 const byId = (a, b) => compareText(a.id, b.id);
 const newestFirst = (versions) => [...versions].sort((a, b) => compareSemver(b.version, a.version)).slice(0, 5);
-const checked = (candidate, file) => {
+const checked = (candidate) => {
 	try {
 		parseIndex(candidate);
 		return candidate;
 	} catch (error) {
-		throw new BuildError(`resulting index is invalid: ${error instanceof Error ? error.message : String(error)}`, file);
+		throw new BuildError(`resulting index is invalid: ${error instanceof Error ? error.message : String(error)}`, FULL_INDEX_FILE);
 	}
 };
-/** Builds the full index with a stable key order; throws `BuildError` if it fails `parseIndex`. */
+/** Builds the index with a stable key order; throws `BuildError` if it fails `parseIndex`. */
 const assembleIndex = (parts) => {
 	const candidate = {
 		schemaVersion: 2,
@@ -3630,15 +4266,7 @@ const assembleIndex = (parts) => {
 			reason: item.reason
 		}))
 	};
-	return checked(candidate, FULL_INDEX_FILE);
-};
-/** `index.v2.json` and `index.json` of the same content and `generatedAt`. */
-const assembleIndexes = (parts) => {
-	const full = assembleIndex(parts);
-	return {
-		full,
-		legacy: checked(legacySubset(full), INDEX_FILE)
-	};
+	return checked(candidate);
 };
 const writeIndexAtomically = async (file, index) => {
 	const temporary = `${file}.${process.pid}.tmp`;
@@ -3664,11 +4292,20 @@ const hasSameContent = (current, next) => current !== null && contentOf(current)
 const DEFAULT_SOURCE_BASE = "https://github.com/dolphy-app/dolphy-extensions/tree/main/extensions";
 const errorText = (error) => error instanceof Error ? error.message : String(error);
 const README = "README.md";
+const CHANGELOG = "CHANGELOG.md";
 const copyReadme = async (srcDir, dir, id) => {
 	const text = await readFile(path.join(srcDir, README), "utf8").catch(() => "");
 	if (text.trim() === "") throw new BuildError(`${README} is missing or empty`, id);
 	await writeFile(path.join(dir, README), text);
 };
+/** `CHANGELOG.md` is optional; its limits are checked by the file-size rules and `CHECK-030`. */
+const copyChangelog = async (srcDir, dir, id) => {
+	const bytes = await readFile(path.join(srcDir, CHANGELOG)).catch(() => null);
+	if (bytes === null) return;
+	const problem = changelogProblem(bytes);
+	if (problem !== null) throw new BuildError(`${CHANGELOG} ${problem}`, id);
+	await writeFile(path.join(dir, CHANGELOG), bytes);
+};
 const fileProblems = (files) => {
 	const problems = files.filter((file) => !isSafeCatalogPath(file.path)).map((file) => `'${file.path}' is not allowed (extensions ${CATALOG_FILE_EXTENSIONS.join("|")}, safe path segments)`);
 	if (files.length > 100) problems.push(`${files.length} files exceed the limit of ${100}`);
@@ -3682,7 +4319,7 @@ const fileProblems = (files) => {
 };
 const readBuiltManifest = async (dir) => {
 	const parsed = parseManifest(JSON.parse(await readFile(path.join(dir, "extension.json"), "utf8")));
-	if (!parsed.ok) throw new BuildError(parsed.message, dir);
+	if (!parsed.ok) throw new BuildError(formatDiagnostic(parsed.diagnostic), dir);
 	return parsed.manifest;
 };
 /** The icon declared in the manifest, read from the built directory; its checks ran in `buildExtension`. */
@@ -3701,6 +4338,7 @@ const stage = async (options, id, scratch) => {
 	});
 	if (built.id !== id) throw new BuildError(`directory name '${id}' does not match manifest id '${built.id}'`, id);
 	await copyReadme(srcDir, built.dir, id);
+	await copyChangelog(srcDir, built.dir, id);
 	const tree = await readTree(built.dir);
 	const files = await hashTree(built.dir, tree.files);
 	const problems = [...tree.symlinks.map((link) => `'${link}' is a symbolic link`), ...fileProblems(files)];
@@ -3740,43 +4378,19 @@ const existingFiles = async (dir) => {
 	}));
 };
 const immutabilityError = (staged) => new BuildError(`version ${staged.manifest.version} is already published with different content; published versions never change`, staged.id);
-/** `label`/`title` of the manifest contributions by point; points without contributions are left out. */
-const titlesOf = (manifest) => {
-	const { contributes } = manifest;
-	const byPoint = {
-		themes: contributes.themes.map(({ id, label }) => ({
-			id,
-			title: label
-		})),
-		gradePolicies: contributes.gradePolicies.map(({ id, label }) => ({
-			id,
-			title: label
-		})),
-		settings: contributes.settings.map(({ id, label }) => ({
-			id,
-			title: label
-		})),
-		commands: contributes.commands.map(({ id, title }) => ({
-			id,
-			title
-		})),
-		panels: contributes.panels.map(({ id, title }) => ({
-			id,
-			title
-		}))
-	};
-	return Object.fromEntries(TITLED_POINTS.filter((point) => byPoint[point].length > 0).map((point) => [point, Object.fromEntries(byPoint[point].map(({ id, title }) => [id, title]))]));
-};
 const newRecord = (staged, publishedAt) => ({
 	version: staged.manifest.version,
 	apiVersion: staged.manifest.apiVersion,
 	minAppVersion: staged.manifest.minAppVersion,
-	permissions: [...staged.manifest.permissions],
 	publishedAt,
 	baseUrl: baseUrlOf(staged),
 	files: staged.files,
 	...staged.icon === null ? {} : { icon: staged.icon },
-	...staged.manifest.tags.length === 0 ? {} : { tags: [...staged.manifest.tags] }
+	...staged.manifest.tags.length === 0 ? {} : { tags: [...staged.manifest.tags] },
+	...staged.manifest.dependencies.length === 0 ? {} : { dependencies: staged.manifest.dependencies.map(({ id, range }) => ({
+		id,
+		...range === null ? {} : { range }
+	})) }
 });
 const plan = async (staged, out, previous, publishedAt) => {
 	const onDisk = await existingFiles(versionDir(out, staged));
@@ -3795,11 +4409,6 @@ const entryOf = (item, previous, sourceBase) => {
 	const { staged, record } = item;
 	const { manifest } = staged;
 	const others = (previous?.versions ?? []).filter((version) => version.version !== record.version);
-	const settings = manifest.contributes.settings.map((setting) => setting.id);
-	const events = manifest.contributes.events.map((item) => item.event);
-	const commands = manifest.contributes.commands.map(({ id }) => id);
-	const panels = manifest.contributes.panels.map(({ id }) => id);
-	const titles = titlesOf(manifest);
 	return {
 		id: staged.id,
 		name: manifest.name ?? "",
@@ -3807,17 +4416,7 @@ const entryOf = (item, previous, sourceBase) => {
 		author: manifest.author ?? "",
 		source: `${sourceBase.replace(/\/+$/, "")}/${staged.id}`,
 		platforms: [...manifest.platforms],
-		contributes: {
-			exerciseTypes: manifest.contributes.exerciseTypes.map((type) => type.id),
-			themes: manifest.contributes.themes.map((theme) => theme.id),
-			markdownRenderers: manifest.contributes.markdownRenderers.map((renderer) => renderer.language),
-			gradePolicies: manifest.contributes.gradePolicies.map((policy) => policy.id),
-			...settings.length > 0 ? { settings } : {},
-			...events.length > 0 ? { events } : {},
-			...commands.length > 0 ? { commands } : {},
-			...panels.length > 0 ? { panels } : {}
-		},
-		...Object.keys(titles).length > 0 ? { titles } : {},
+		...previous?.deprecated === void 0 ? {} : { deprecated: previous.deprecated },
 		versions: newestFirst([record, ...others])
 	};
 };
@@ -3832,6 +4431,7 @@ const loadRevoked = async (file, previous) => {
 	if (!Array.isArray(raw)) throw new BuildError("revoked list must be a JSON array", file);
 	return raw;
 };
+const withDeprecations = async (entries, file) => file === void 0 ? entries : applyDeprecated(entries, await loadDeprecated(file), file);
 const writeVersion = async (item, out) => {
 	const target = versionDir(out, item.staged);
 	const parent = path.dirname(target);
@@ -3844,38 +4444,25 @@ const writeVersion = async (item, out) => {
 	await cp(item.staged.dir, temporary, { recursive: true });
 	await rename(temporary, target);
 };
-const resultOf = (item, entry) => ({
+const resultOf = (item) => ({
 	id: item.staged.id,
 	version: item.staged.manifest.version,
 	status: item.status,
 	files: item.staged.files.length,
-	bytes: item.staged.files.reduce((sum, file) => sum + file.size, 0),
-	inLegacyIndex: isLegacyEntry(entry) && isLegacyVersion(item.record)
+	bytes: item.staged.files.reduce((sum, file) => sum + file.size, 0)
 });
-const formatPublishResult = (result) => {
-	const legacy = result.inLegacyIndex ? "" : ` — only in ${FULL_INDEX_FILE}: released apps cannot read it`;
-	return result.status === "unchanged" ? `unchanged ${result.id}@${result.version}${legacy}` : `published ${result.id}@${result.version} (${result.files} files, ${result.bytes} bytes)${legacy}`;
-};
-/** The index to start from: the explicit file, else the full index of the site, else its `index.json`. */
-const previousIndexFile = async (out, explicit) => {
-	if (explicit !== void 0) return path.resolve(explicit);
-	const full = path.join(out, FULL_INDEX_FILE);
-	return await stat(full).catch(() => null) === null ? path.join(out, INDEX_FILE) : full;
-};
-/**
-* Writes `index.v2.json` and `index.json` when either differs from the disk (ignoring
-* `generatedAt`); both get the same `generatedAt`, so the app can compare them with each other.
-*/
-const writeIndexes = async (out, { full, legacy }) => {
-	const fullFile = path.join(out, FULL_INDEX_FILE);
-	const legacyFile = path.join(out, INDEX_FILE);
-	if (hasSameContent(await loadIndexFile(fullFile), full) && hasSameContent(await loadIndexFile(legacyFile), legacy)) return false;
+const formatPublishResult = (result) => result.status === "unchanged" ? `unchanged ${result.id}@${result.version}` : `published ${result.id}@${result.version} (${result.files} files, ${result.bytes} bytes)`;
+/** The index to start from: the explicit file, else the index of the site. */
+const previousIndexFile = async (out, explicit) => explicit === void 0 ? path.join(out, FULL_INDEX_FILE) : path.resolve(explicit);
+/** Writes `index.v2.json` when it differs from the disk (ignoring `generatedAt`). */
+const writeIndex = async (out, index) => {
+	const file = path.join(out, FULL_INDEX_FILE);
+	if (hasSameContent(await loadIndexFile(file), index)) return false;
 	await mkdir(out, { recursive: true });
-	await writeIndexAtomically(fullFile, full);
-	await writeIndexAtomically(legacyFile, legacy);
+	await writeIndexAtomically(file, index);
 	return true;
 };
-/** Builds extension versions and updates `index.v2.json` and `index.json`; on error nothing is written to disk. */
+/** Builds extension versions and updates `index.v2.json`; on error nothing is written to disk. */
 const buildCatalog = async (options) => {
 	const out = path.resolve(options.out);
 	const now = (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
@@ -3896,15 +4483,15 @@ const buildCatalog = async (options) => {
 			plans.push(item);
 			const entry = entryOf(item, before, sourceBase);
 			entries.set(id, entry);
-			results.push(resultOf(item, entry));
+			results.push(resultOf(item));
 		}
-		const indexes = assembleIndexes({
+		const index = assembleIndex({
 			generatedAt: now,
-			extensions: [...entries.values()],
+			extensions: await withDeprecations([...entries.values()], options.deprecated),
 			revoked
 		});
 		for (const item of plans) if (item.shouldWrite) await writeVersion(item, out);
-		await writeIndexes(out, indexes);
+		await writeIndex(out, index);
 		return results;
 	} finally {
 		await rm(scratch, {
@@ -3914,21 +4501,21 @@ const buildCatalog = async (options) => {
 	}
 };
 const formatReindexResult = (result) => `reindexed (${result.extensions} extensions, ${result.revoked} revoked)${result.changed ? "" : " — no changes"}`;
-/** Rewrites `revoked` and `generatedAt` of both indexes; extension entries are unchanged. */
+/** Rewrites `revoked` and `generatedAt` of the index; extension entries are unchanged. */
 const reindexCatalog = async (options) => {
 	const out = path.resolve(options.out);
 	const source = await previousIndexFile(out, options.previousIndex);
 	const previous = await loadIndexFile(source);
 	if (previous === null) throw new CatalogUsageError(`nothing to reindex: ${source} does not exist`, source);
-	const indexes = assembleIndexes({
+	const index = assembleIndex({
 		generatedAt: options.publishedAt ?? (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
-		extensions: previous.extensions,
+		extensions: await withDeprecations(previous.extensions, options.deprecated),
 		revoked: await loadRevoked(options.revoked, previous)
 	});
-	const changed = await writeIndexes(out, indexes);
+	const changed = await writeIndex(out, index);
 	return {
-		extensions: indexes.full.extensions.length,
-		revoked: indexes.full.revoked.length,
+		extensions: index.extensions.length,
+		revoked: index.revoked.length,
 		changed
 	};
 };
@@ -3936,36 +4523,45 @@ const reindexCatalog = async (options) => {
 //#endregion
 //#region packages/extension-tools/src/catalog/cli.ts
 const CATALOG_SYNOPSIS = `       dolphy-ext catalog check <extensionsDir> [--ids a,b]
-                   [--published-index <path>] [--max-app-version <x.y.z>]
-                   [--skip-github-check] [--list-rules]
+                   [--published-index <path>] [--deprecated <path>]
+                   [--max-app-version <x.y.z>]
+                   [--built <siteDir>] [--skip-github-check] [--list-rules]
        dolphy-ext catalog build --src <extensionsDir> --ids a,b --out <siteDir>
                    [--previous-index <path>] [--revoked <path>]
-                   [--source-base <url>] [--published-at <iso>]
+                   [--deprecated <path>] [--source-base <url>]
+                   [--published-at <iso>]
        dolphy-ext catalog build --reindex --out <siteDir>
                    [--previous-index <path>] [--revoked <path>]
-                   [--published-at <iso>]
+                   [--deprecated <path>] [--published-at <iso>]
 `;
 const CATALOG_HELP = `  catalog check    check the catalog's extension sources; lines
                    «error|warning <id> <RULE-ID> <field>: <message>»,
                    exit code 1 if any error
   catalog build    build versions into <siteDir>/extensions/<id>/<version>/ and
-                   update <siteDir>/index.json (published versions are
+                   update <siteDir>/index.v2.json (published versions are
                    immutable)
   catalog build --reindex
-                   only replace revoked and generatedAt in the existing
-                   <siteDir>/index.json (--src and --ids are not needed)
+                   only replace revoked, deprecated and generatedAt in the
+                   existing <siteDir>/index.v2.json (--src and --ids are not needed)
 
   --ids a,b              only these extensions (check: all by default)
-  --published-index <p>  index.json of the published catalog (no file —
+  --published-index <p>  index.v2.json of the published catalog (no file —
                          nothing is published)
   --max-app-version <v>  minAppVersion must not be newer
+  --built <siteDir>      also check the built versions in
+                         <siteDir>/extensions/<id>/<version>/ (eval, obfuscation,
+                         URLs, source maps); without it these rules are silent
   --skip-github-check    do not verify the author via api.github.com
                          (token — the GITHUB_TOKEN variable)
   --list-rules           print the check rules
   --src <dir>            directory of projects <dir>/<id>
   --out <dir>            site root
-  --previous-index <p>   source index (default <out>/index.json)
+  --previous-index <p>   source index (default <out>/index.v2.json)
   --revoked <p>          JSON array {id, versions, reason}
+  --deprecated <p>       JSON array {id, versions?, reason, alternatives}
+                         (check: validate the form and, with
+                         --published-index, the alternatives; build: write
+                         "deprecated" to entries, unset — keep the index's)
   --source-base <url>    base for the index entry's source field
   --published-at <iso>   publishedAt of new versions (default now);
                          with --reindex — generatedAt
@@ -3974,7 +4570,9 @@ const VALUE_FLAGS = {
 	check: [
 		"--ids",
 		"--published-index",
-		"--max-app-version"
+		"--deprecated",
+		"--max-app-version",
+		"--built"
 	],
 	build: [
 		"--src",
@@ -3982,6 +4580,7 @@ const VALUE_FLAGS = {
 		"--out",
 		"--previous-index",
 		"--revoked",
+		"--deprecated",
 		"--source-base",
 		"--published-at"
 	]
@@ -4033,7 +4632,9 @@ const parseCheck = (args) => {
 		dir: positional[0] ?? null,
 		ids: idsOf(flags),
 		publishedIndex: text(flags, "--published-index"),
+		deprecated: text(flags, "--deprecated"),
 		maxAppVersion,
+		built: text(flags, "--built"),
 		skipGithubCheck: flags["--skip-github-check"] === true,
 		listRules: listRulesFlag
 	};
@@ -4053,6 +4654,7 @@ const parseReindex = (flags) => {
 		out,
 		previousIndex: text(flags, "--previous-index"),
 		revoked: text(flags, "--revoked"),
+		deprecated: text(flags, "--deprecated"),
 		publishedAt: text(flags, "--published-at")
 	};
 };
@@ -4075,6 +4677,7 @@ const parseBuild$1 = (args) => {
 		out,
 		previousIndex: text(flags, "--previous-index"),
 		revoked: text(flags, "--revoked"),
+		deprecated: text(flags, "--deprecated"),
 		sourceBase: text(flags, "--source-base"),
 		publishedAt: text(flags, "--published-at")
 	};
@@ -4094,7 +4697,9 @@ const runCheck = async (parsed, io, deps) => {
 		extensionsDir: path.resolve(parsed.dir),
 		...parsed.ids === void 0 ? {} : { ids: parsed.ids },
 		...parsed.publishedIndex === void 0 ? {} : { publishedIndex: path.resolve(parsed.publishedIndex) },
+		...parsed.deprecated === void 0 ? {} : { deprecated: path.resolve(parsed.deprecated) },
 		...parsed.maxAppVersion === void 0 ? {} : { maxAppVersion: parsed.maxAppVersion },
+		...parsed.built === void 0 ? {} : { builtDir: path.resolve(parsed.built) },
 		skipGithubCheck: parsed.skipGithubCheck,
 		githubToken: deps.env?.GITHUB_TOKEN,
 		...deps.fetch === void 0 ? {} : { fetch: deps.fetch }
@@ -4107,6 +4712,7 @@ const runReindex = async (parsed, io, deps) => {
 		out: parsed.out,
 		...parsed.previousIndex === void 0 ? {} : { previousIndex: parsed.previousIndex },
 		...parsed.revoked === void 0 ? {} : { revoked: parsed.revoked },
+		...parsed.deprecated === void 0 ? {} : { deprecated: parsed.deprecated },
 		...parsed.publishedAt === void 0 ? {} : { publishedAt: parsed.publishedAt },
 		...deps.now === void 0 ? {} : { now: deps.now }
 	});
@@ -4120,6 +4726,7 @@ const runBuild$1 = async (parsed, io, deps) => {
 		out: parsed.out,
 		...parsed.previousIndex === void 0 ? {} : { previousIndex: parsed.previousIndex },
 		...parsed.revoked === void 0 ? {} : { revoked: parsed.revoked },
+		...parsed.deprecated === void 0 ? {} : { deprecated: parsed.deprecated },
 		...parsed.sourceBase === void 0 ? {} : { sourceBase: parsed.sourceBase },
 		...parsed.publishedAt === void 0 ? {} : { publishedAt: parsed.publishedAt },
 		...deps.now === void 0 ? {} : { now: deps.now }
@@ -4140,23 +4747,229 @@ const runCatalog = async (parsed, io, deps = {}) => {
 	}
 };
 
+//#endregion
+//#region packages/extension-tools/src/dev.ts
+/** An app that quits sooner than this did not start for us: see `QUICK_EXIT_HINT`. */
+const QUICK_EXIT_MS = 5e3;
+const QUICK_EXIT_HINT = "Dolphy is probably already running: quit it and run again (the app has a single instance, a second launch exits at once and the extension directory is lost)";
+const flavor = (platform) => platform === "win32" ? path.win32 : path.posix;
+/** `Dolphy-Linux-1.12.0.AppImage` → `[1, 12, 0]`; other names have no version. */
+const versionOf = (name) => {
+	const match = /^Dolphy-Linux-(\d+(?:\.\d+)*)\.AppImage$/.exec(name);
+	return match === null ? null : match[1].split(".").map(Number);
+};
+const compareVersions = (a, b) => {
+	for (let i = 0; i < Math.max(a.length, b.length); i++) {
+		const diff = (a[i] ?? 0) - (b[i] ?? 0);
+		if (diff !== 0) return diff;
+	}
+	return 0;
+};
+/** Places the installer puts the app (`electron-builder.json`); Linux has no fixed place. */
+const standardPlaces = (where) => {
+	const p = flavor(where.platform);
+	if (where.platform === "darwin") return ["/Applications/Dolphy.app", p.join(where.home, "Applications", "Dolphy.app")];
+	if (where.platform === "win32") {
+		const base = where.env.LOCALAPPDATA ?? p.join(where.home, "AppData", "Local");
+		return [p.join(base, "Programs", "Dolphy", "Dolphy.exe")];
+	}
+	const dir = p.join(where.home, "Applications");
+	return where.list(dir).flatMap((name) => {
+		const version = versionOf(name);
+		return version === null ? [] : [{
+			name,
+			version
+		}];
+	}).sort((a, b) => compareVersions(b.version, a.version)).map(({ name }) => p.join(dir, name));
+};
+const lookedAt = (where) => where.platform === "linux" ? flavor(where.platform).join(where.home, "Applications", "Dolphy-Linux-*.AppImage") : standardPlaces(where).join(", ");
+const missing = (where, what) => new CatalogUsageError(`${what}; looked at: ${lookedAt(where)}; point to the app with --app <path> or the DOLPHY_APP environment variable`, "dolphy-ext dev");
+/**
+* The app to launch: `--app`, then `DOLPHY_APP`, then the standard places of the
+* platform. A macOS bundle (`Dolphy.app`) is started by its executable, so that
+* the environment reaches the app and the process lives as long as the app does.
+*/
+const findApp = (explicit, where) => {
+	const p = flavor(where.platform);
+	const given = explicit ?? where.env.DOLPHY_APP;
+	const chosen = given === void 0 || given === "" ? null : given;
+	const found = (chosen === null ? standardPlaces(where) : [chosen]).find((place) => where.exists(place)) ?? null;
+	if (found === null) throw missing(where, chosen === null ? "the Dolphy app is not found" : `${explicit === void 0 ? "DOLPHY_APP" : "--app"} points to '${chosen}', which does not exist`);
+	return found.endsWith(".app") ? p.join(found, "Contents", "MacOS", p.basename(found, ".app")) : found;
+};
+const systemDeps = (env) => ({
+	platform: process.platform,
+	env,
+	home: homedir(),
+	exists: existsSync,
+	list: (dir) => {
+		try {
+			return readdirSync(dir);
+		} catch {
+			return [];
+		}
+	},
+	launch: (command, childEnv) => {
+		const child = spawn(command, [], {
+			env: childEnv,
+			stdio: "inherit"
+		});
+		return {
+			exited: new Promise((resolve, reject) => {
+				child.once("error", reject);
+				child.once("exit", (code, signal) => resolve({
+					code,
+					signal
+				}));
+			}),
+			kill: () => {
+				child.kill("SIGTERM");
+			}
+		};
+	},
+	now: Date.now
+});
+/**
+* `dolphy-ext dev`: a watch build of the project and the installed app that
+* reads the output through `DOLPHY_DEV_EXTENSIONS`. Resolves with the exit code
+* when the user stops it (0) or the app quits (0 after a normal session, 1 when
+* it quit at once).
+*/
+const runDev = async (options, io, deps, startBuild, waitForExit) => {
+	const command = findApp(options.app, deps);
+	const build = await startBuild();
+	io.stdout(`${build.summary}\n`);
+	try {
+		io.stdout(`launching ${command} with DOLPHY_DEV_EXTENSIONS=${build.outDir}\n`);
+		const startedAt = deps.now();
+		const app = deps.launch(command, {
+			...deps.env,
+			DOLPHY_DEV_EXTENSIONS: build.outDir
+		});
+		io.stdout("watching for changes, Ctrl+C stops the build and the app\n");
+		const ending = await Promise.race([waitForExit().then(() => ({ by: "user" })), app.exited.then((exit) => ({
+			by: "app",
+			exit
+		}))]);
+		if (ending.by === "user") {
+			app.kill();
+			await app.exited.catch(() => void 0);
+			return 0;
+		}
+		const { code } = ending.exit;
+		if (code !== null && deps.now() - startedAt < 5e3) {
+			io.stderr(`${QUICK_EXIT_HINT}\n`);
+			return 1;
+		}
+		return 0;
+	} catch (error) {
+		io.stderr(`error dolphy-ext dev: cannot run ${command}: ${error instanceof Error ? error.message : String(error)}\n`);
+		return 1;
+	} finally {
+		await build.close();
+	}
+};
+
+//#endregion
+//#region packages/extension-tools/src/lint/index.ts
+const formatLintFinding = (finding) => `${finding.severity} ${finding.extensionId} ${finding.ruleId} ${finding.field}: ${finding.message}`;
+const lintHasErrors = (findings) => findings.some((finding) => finding.severity === "error");
+const stringOrNull = (value) => typeof value === "string" ? value : null;
+const readManifest = async (root) => {
+	let raw;
+	try {
+		raw = JSON.parse(await readFile(path.join(root, MANIFEST_FILE), "utf8"));
+	} catch (error) {
+		throw new CatalogUsageError(`${MANIFEST_FILE} is unreadable: ${error instanceof Error ? error.message : String(error)}`, root);
+	}
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new CatalogUsageError(`${MANIFEST_FILE} is not an object`, root);
+	return raw;
+};
+const isDirectory = async (dir) => (await stat(dir).catch(() => null))?.isDirectory() === true;
+/** Code files of the build the author is going to publish. */
+const builtFiles = async (options) => {
+	if (options.built !== void 0) return readBundleFiles(options.built);
+	const temp = await mkdtemp(path.join(tmpdir(), "dolphy-lint-"));
+	try {
+		const { dir } = await buildExtension({
+			root: options.root,
+			outDir: temp
+		});
+		return await readBundleFiles(dir);
+	} finally {
+		await rm(temp, {
+			recursive: true,
+			force: true
+		});
+	}
+};
+/**
+* Checks a project the way `catalog check` checks it, before a pull request:
+* manifest metadata, README and the built code. Everything is a warning
+* except a missing README and an embedded source map.
+*/
+const lintProject = async (options) => {
+	const root = path.resolve(options.root);
+	if (!await isDirectory(root)) throw new CatalogUsageError("not a directory", root);
+	if (options.built !== void 0 && !await isDirectory(options.built)) throw new CatalogUsageError("--built: not a directory", options.built);
+	const manifest = await readManifest(root);
+	const extensionId = stringOrNull(manifest.id) ?? path.basename(root);
+	const findings = manifestFindings({
+		name: stringOrNull(manifest.name),
+		description: stringOrNull(manifest.description),
+		author: stringOrNull(manifest.author),
+		tags: Array.isArray(manifest.tags) ? manifest.tags : null
+	});
+	const readme = await readFile(path.join(root, "README.md"), "utf8").catch(() => null);
+	if (readme === null || readme.trim() === "") findings.push({
+		ruleId: "CHECK-004",
+		severity: "error",
+		field: "README.md",
+		message: "README.md is missing or empty"
+	});
+	const files = await builtFiles(options.built === void 0 ? { root } : {
+		root,
+		built: path.resolve(options.built)
+	});
+	findings.push(...bundleFindings(files));
+	return findings.map((finding) => ({
+		...finding,
+		severity: finding.ruleId === "CHECK-004" ? "error" : "warning",
+		extensionId
+	}));
+};
+
 //#endregion
 //#region packages/extension-tools/src/cli/run.ts
 const EXIT_OK = 0;
 const EXIT_PROBLEMS = 1;
 const EXIT_USAGE = 2;
 const USAGE = `usage: dolphy-ext build [dir] [--out <dir>] [--watch]
-       dolphy-ext types [dir]
        dolphy-ext validate <dir>
+       dolphy-ext lint [dir] [--built <dir>]
+       dolphy-ext dev [dir] [--app <path>]
 ${CATALOG_SYNOPSIS}
   build [dir]      build the extension from a project (default: the current
-                   directory) into <dir>/dist-ext/<id>; also writes
-                   <dir>/.dolphy/ids.d.ts
-  types [dir]      write <dir>/.dolphy/ids.d.ts: the ids declared in
-                   extension.json as types for the SDK (no code is run)
+                   directory) into <dir>/dist-ext/<id>: main.mjs from the
+                   'server' export of src/index.ts, client.mjs from 'client'
   validate <dir>   check the directory of a built extension (extension.json,
-                   schemas, main and renderer)
+                   main and client files, assets)
+  lint [dir]       check the project before a pull request to the catalog:
+                   manifest metadata, README.md and the built code (eval,
+                   obfuscation, source maps); lines «error|warning <id>
+                   <RULE-ID> <field>: <message>», exit code 1 only if
+                   README.md is missing
+  dev [dir]        watch-build the project and launch the installed Dolphy app
+                   with DOLPHY_DEV_EXTENSIONS=<dir>/dist-ext; Ctrl+C stops both.
+                   The app is --app, then the DOLPHY_APP variable, then the
+                   standard place of the platform (macOS /Applications/Dolphy.app
+                   and ~/Applications/Dolphy.app; Windows
+                   %LOCALAPPDATA%\\Programs\\Dolphy\\Dolphy.exe; Linux the newest
+                   ~/Applications/Dolphy-Linux-*.AppImage); exit code 2 if none
 ${CATALOG_HELP}
+  --app <path>     dev: the Dolphy app (macOS .app bundle or an executable)
+  --built <dir>    lint: check this built extension instead of building the
+                   project into a temporary directory
   --out <dir>      output root (the extension goes to <dir>/<id>)
   --watch          rebuild the bundles when the sources change
   --help           this help
@@ -4182,15 +4995,6 @@ const parseBuild = (args) => {
 		watch
 	};
 };
-const parseTypes = (args) => {
-	const flag = args.find((arg) => arg.startsWith("-"));
-	if (flag !== void 0) return { usageError: `unknown flag: ${flag}` };
-	if (args.length > 1) return { usageError: `extra arguments: ${args.slice(1).join(" ")}` };
-	return {
-		command: "types",
-		dir: args[0] ?? "."
-	};
-};
 const parseValidate = (args) => {
 	const flag = args.find((arg) => arg.startsWith("-"));
 	if (flag !== void 0) return { usageError: `unknown flag: ${flag}` };
@@ -4202,12 +5006,49 @@ const parseValidate = (args) => {
 		dir
 	};
 };
+const parseLint = (args) => {
+	const positional = [];
+	let built;
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg === "--built") {
+			built = args[++i];
+			if (built === void 0) return { usageError: "--built needs a path" };
+		} else if (arg.startsWith("-")) return { usageError: `unknown flag: ${arg}` };
+		else positional.push(arg);
+	}
+	if (positional.length > 1) return { usageError: `extra arguments: ${positional.slice(1).join(" ")}` };
+	return {
+		command: "lint",
+		dir: positional[0] ?? ".",
+		built
+	};
+};
+const parseDev = (args) => {
+	const positional = [];
+	let app;
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg === "--app") {
+			app = args[++i];
+			if (app === void 0) return { usageError: "--app needs a path" };
+		} else if (arg.startsWith("-")) return { usageError: `unknown flag: ${arg}` };
+		else positional.push(arg);
+	}
+	if (positional.length > 1) return { usageError: `extra arguments: ${positional.slice(1).join(" ")}` };
+	return {
+		command: "dev",
+		dir: positional[0] ?? ".",
+		app
+	};
+};
 const parseArgs = (argv) => {
 	if (argv.includes("--help") || argv.includes("-h")) return { help: true };
 	const [command, ...rest] = argv;
 	if (command === "build") return parseBuild(rest);
-	if (command === "types") return parseTypes(rest);
 	if (command === "validate") return parseValidate(rest);
+	if (command === "lint") return parseLint(rest);
+	if (command === "dev") return parseDev(rest);
 	if (command === "catalog") return {
 		command: "catalog",
 		args: rest
@@ -4261,18 +5102,51 @@ const runValidate = async (dir, io) => {
 	for (const problem of problems) io.stderr(`error ${root}: ${problem}\n`);
 	return 1;
 };
-const runTypes = async (dir, io) => {
+const runLint = async (parsed, io) => {
 	try {
-		const root = path.resolve(dir);
-		const { file, changed } = await generateTypes({ root });
-		const shown = path.relative(root, file);
-		io.stdout(changed ? `wrote ${shown}\n` : `${shown} is up to date\n`);
-		return 0;
+		const findings = await lintProject({
+			root: parsed.dir,
+			...parsed.built === void 0 ? {} : { built: parsed.built }
+		});
+		for (const finding of findings) io.stdout(`${formatLintFinding(finding)}\n`);
+		return lintHasErrors(findings) ? 1 : 0;
+	} catch (error) {
+		if (error instanceof CatalogUsageError) {
+			io.stderr(`error ${error.subject}: ${error.message}\n`);
+			return 2;
+		}
+		return reportBuildError(io, error);
+	}
+};
+const runDevCommand = async (parsed, io, deps) => {
+	const root = path.resolve(parsed.dir);
+	try {
+		return await runDev({
+			root,
+			...parsed.app === void 0 ? {} : { app: parsed.app }
+		}, io, deps.dev ?? systemDeps(deps.env ?? process.env), async () => {
+			const handle = await watchExtension({
+				root,
+				logger: {
+					info: (message) => io.stdout(`${message}\n`),
+					error: (message) => io.stderr(`${message}\n`)
+				}
+			});
+			return {
+				outDir: path.join(root, DEFAULT_OUT_DIR),
+				summary: summary(handle.result).trimEnd(),
+				close: handle.close
+			};
+		}, deps.waitForExit ?? waitForSignal);
 	} catch (error) {
+		if (error instanceof CatalogUsageError) {
+			io.stderr(`error ${error.subject}: ${error.message}\n`);
+			return 2;
+		}
 		return reportBuildError(io, error);
 	}
 };
-/** `dolphy-ext build|types|validate|catalog`; `argv` is without `node` and the script name. */
+/** `dolphy-ext build|validate|lint|dev|catalog`; `argv` is without `node` and the script name. */
 const runCli = async (argv, io, deps = {}) => {
 	const parsed = parseArgs(argv);
 	if ("help" in parsed) {
@@ -4292,7 +5166,8 @@ const runCli = async (argv, io, deps = {}) => {
 		return runCatalog(catalog, io, deps);
 	}
 	if (parsed.command === "validate") return runValidate(parsed.dir, io);
-	if (parsed.command === "types") return runTypes(parsed.dir, io);
+	if (parsed.command === "lint") return runLint(parsed, io);
+	if (parsed.command === "dev") return runDevCommand(parsed, io, deps);
 	return runBuild(parsed, io, deps);
 };