@loomweaver/cli 0.16.0 → 0.17.1

package/dist/main.mjs

@@ -126,6 +126,7 @@ function amendments(recipe, input) {
 }
 
 // ../devkit/src/lib/amend/merge.ts
+import { posix } from "node:path";
 function normalizeProjectRoot(value) {
   const rooted = value.replace(/^\.?\/*/, "");
   let end = rooted.length;
@@ -141,27 +142,6 @@ function joinProjectPath(projectRoot, path) {
 function resolveAssetInput(glob, projectRoot) {
   return glob.from === "project" ? joinProjectPath(projectRoot, glob.input) : glob.input;
 }
-function ensurePostcssPlugin(existing, amendment) {
-  const root = asObject(existing) ?? {};
-  const plugins = asObject(root["plugins"]);
-  if (plugins === void 0 && root["plugins"] !== void 0) {
-    return {
-      value: root,
-      added: [],
-      declined: [`${amendment.file}: "plugins" is not an object`]
-    };
-  }
-  const next = { ...plugins };
-  if (Object.hasOwn(next, amendment.plugin)) {
-    return { value: root, added: [], declined: [] };
-  }
-  next[amendment.plugin] = {};
-  return {
-    value: { ...root, plugins: next },
-    added: [`${amendment.file}: ${amendment.plugin}`],
-    declined: []
-  };
-}
 function ensureDependency(manifest2, amendment) {
   const root = asObject(manifest2) ?? {};
   const dependencies = asObject(root["dependencies"]);
@@ -358,7 +338,7 @@ function ensureAssets(existing, wanted, projectRoot) {
   const added = [];
   for (const glob of wanted) {
     const input = resolveAssetInput(glob, projectRoot);
-    if (list2.some((entry) => inputOf(entry) === input)) {
+    if (list2.some((entry) => inputOf(entry) === input || serves(entry, input, glob.output))) {
       continue;
     }
     list2.push({
@@ -370,6 +350,16 @@ function ensureAssets(existing, wanted, projectRoot) {
   }
   return { value: list2, added };
 }
+function serves(entry, input, output = "") {
+  const asset = asObject(entry);
+  const from = inputOf(entry);
+  if (!asset || from === void 0 || !["**", "**/*"].includes(String(asset["glob"]))) {
+    return false;
+  }
+  const below = posix.relative(from, input);
+  const servedAt = posix.join(String(asset["output"] ?? ""), below);
+  return !below.startsWith("..") && below !== "" && servedAt === posix.normalize(output);
+}
 function inputOf(entry) {
   if (typeof entry === "string") {
     return entry;
@@ -380,8 +370,61 @@ function inputOf(entry) {
 function asObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
+function usesTailwind(css) {
+  return css.split("\n").some((line) => {
+    const directive = line.trimStart();
+    return /^@import\s+['"]tailwindcss['"]/.test(directive) || /^@source\s/.test(directive);
+  });
+}
+function entryStylesheet(styles) {
+  if (!Array.isArray(styles)) {
+    return void 0;
+  }
+  return styles.map((style) => inputOf(style)).find((input) => input?.endsWith(".css") === true);
+}
+function relativeImport(fromDirectory, toDirectory) {
+  const path = posix.relative(fromDirectory, toDirectory);
+  if (path === "") {
+    return ".";
+  }
+  return path.startsWith("..") ? path : `./${path}`;
+}
+
+// ../devkit/src/lib/amend/postcss.ts
+function ensurePostcssPlugin(existing, amendment) {
+  const root = asObject(existing) ?? {};
+  const plugins = asObject(root["plugins"]);
+  if (plugins === void 0 && root["plugins"] !== void 0) {
+    return {
+      value: root,
+      added: [],
+      declined: [`${amendment.file}: "plugins" is not an object`]
+    };
+  }
+  const next = { ...plugins };
+  if (Object.hasOwn(next, amendment.plugin)) {
+    return { value: root, added: [], declined: [] };
+  }
+  next[amendment.plugin] = {};
+  return {
+    value: { ...root, plugins: next },
+    added: [`${amendment.file}: ${amendment.plugin}`],
+    declined: []
+  };
+}
+var CODE_POSTCSS_CONFIGS = [
+  "postcss.config.js",
+  "postcss.config.mjs",
+  "postcss.config.cjs",
+  ".postcssrc.js"
+];
+function postcssWrittenAsCode(exists, amendment) {
+  const inTheWay = CODE_POSTCSS_CONFIGS.find((name) => exists(name));
+  return inTheWay === void 0 ? void 0 : `${inTheWay} is written as code and cannot be merged into, so add ${amendment.plugin} to it yourself; until then the stylesheet emits no utility class and the workbench renders unstyled.`;
+}
 
 // ../devkit/src/lib/amend/compose.ts
+import { posix as posix2 } from "node:path";
 var APP_CONFIG = /export\s+const\s+appConfig\s*:[^=]*=\s*\{/;
 var NAMESPACES = /provideTranslationNamespaces\(([^)]*)\)/;
 var PROVIDERS_OPEN = /providers\s*:\s*\[/g;
@@ -426,15 +469,12 @@ function composePlugin(source, amendment, importPath) {
   }
   const wanted = providersToAdd(source, amendment);
   const ownSymbols = [amendment.symbol, ...wanted.flatMap((provider) => provider.own ?? [])];
-  const foreign = wanted.flatMap((provider) => provider.from ?? []);
   const withImports = source.replace(
     SHELL_IMPORT,
     () => [
-      `import {${withShellSymbols(shellImport[1], wanted)}} from '@loomweaver/shell';`,
-      ...foreign.map(
-        (entry) => `import { ${[...entry.symbols].toSorted((a, b) => a.localeCompare(b)).join(", ")} } from '${entry.path}';`
-      ),
-      `import { ${ownSymbols.toSorted((a, b) => a.localeCompare(b)).join(", ")} } from '${importPath}';`
+      `import {${withShellSymbols(shellImport[1], [...REGISTRATION_SHELL_SYMBOLS, ...shellSymbolsOf(wanted)])}} from '@loomweaver/shell';`,
+      ...foreignImports(wanted),
+      `import { ${sorted(ownSymbols).join(", ")} } from '${importPath}';`
     ].join("\n")
   );
   const joined = joinNamespaces(withImports, amendment.id);
@@ -452,6 +492,71 @@ ${lines}${joined.source.slice(block.insertAt)}`,
     kept: keptProviders(source, amendment).map((provider) => provider.line)
   };
 }
+function composeProviders(source, amendment, importPath) {
+  const pending = amendment.providers.filter(
+    (provider) => !source.includes(provider.line.replace(/,$/, ""))
+  );
+  const kept = pending.filter(
+    (provider) => provider.unless !== void 0 && source.includes(provider.unless)
+  );
+  const wanted = pending.filter((provider) => !kept.includes(provider));
+  const keptLines = kept.map((provider) => provider.line);
+  if (wanted.length === 0) {
+    return { source, composed: true, kept: keptLines };
+  }
+  const shellImport = SHELL_IMPORT.exec(source);
+  if (!shellImport || !providersBlock(source)) {
+    return { source, composed: false, kept: keptLines };
+  }
+  const own = wanted.flatMap((provider) => provider.own ?? []);
+  const withImports = source.replace(
+    SHELL_IMPORT,
+    () => [
+      `import {${withShellSymbols(shellImport[1], shellSymbolsOf(wanted))}} from '@loomweaver/shell';`,
+      ...foreignImports(wanted),
+      ...own.length > 0 && importPath !== void 0 ? [`import { ${sorted(own).join(", ")} } from '${importPath}';`] : []
+    ].join("\n")
+  );
+  const block = providersBlock(withImports);
+  if (!block) {
+    return { source, composed: false, kept: keptLines };
+  }
+  const lines = wanted.map((provider) => `${block.indent}  ${provider.line}`).join("\n");
+  return {
+    source: `${withImports.slice(0, block.insertAt)}
+${lines}${withImports.slice(block.insertAt)}`,
+    composed: true,
+    kept: keptLines
+  };
+}
+function providerLines(amendment, importPath) {
+  const own = amendment.providers.flatMap((provider) => provider.own ?? []);
+  return [
+    `import { ${shellSymbolsOf(amendment.providers).join(", ")} } from '@loomweaver/shell';`,
+    ...foreignImports(amendment.providers),
+    ...own.length > 0 && importPath !== void 0 ? [`import { ${own.join(", ")} } from '${importPath}';`] : [],
+    ...amendment.providers.map((provider) => provider.line)
+  ];
+}
+function moduleImport(fromDirectory, module) {
+  if (module === void 0) {
+    return void 0;
+  }
+  const directory = relativeImport(fromDirectory, posix2.dirname(module));
+  return `${directory}/${posix2.basename(module)}`;
+}
+function keptNote(line) {
+  return `kept the ${line.replace(/^\.\.\./, "").split("(", 1)[0]} already there instead of ${line.replace(/,$/, "")}`;
+}
+function shellSymbolsOf(providers) {
+  return providers.flatMap((provider) => provider.shell ?? []);
+}
+function foreignImports(providers) {
+  return providers.flatMap((provider) => provider.from ?? []).map((entry) => `import { ${sorted(entry.symbols).join(", ")} } from '${entry.path}';`);
+}
+function sorted(symbols) {
+  return symbols.toSorted((a, b) => a.localeCompare(b));
+}
 function joinNamespaces(source, id) {
   const existing = NAMESPACES.exec(source);
   if (!existing) {
@@ -498,21 +603,20 @@ function registrationLines(amendment, providers) {
   return [
     ...providers.map((provider) => provider.line),
     namespaceLine(amendment.id),
-    `provideCapabilityGrants({ ${amendment.id}: [${quotedList(amendment.capabilities)}] }),`,
+    `provideCapabilityGrants({ ${grantKey(amendment.id)}: [${quotedList(amendment.capabilities)}] }),`,
     `...providePlugins(${amendment.symbol}),`
   ];
 }
+function grantKey(id) {
+  return /^[A-Za-z_$][\w$]*$/.test(id) ? id : `'${id}'`;
+}
 function quotedList(values) {
   return values.map((value) => `'${value}'`).join(", ");
 }
 function namespaceLine(id) {
   return `provideTranslationNamespaces('${id}'),`;
 }
-function withShellSymbols(existing, providers) {
-  const wanted = [
-    ...REGISTRATION_SHELL_SYMBOLS,
-    ...providers.flatMap((provider) => provider.shell ?? [])
-  ];
+function withShellSymbols(existing, wanted) {
   const present = existing.split(",").map((symbol) => symbol.trim()).filter(Boolean);
   const missing = wanted.filter(
     (symbol) => present.every((entry) => entry.replace(/^type\s+/, "") !== symbol)
@@ -527,6 +631,29 @@ function withShellSymbols(existing, providers) {
 ` : ` ${all.join(", ")} `;
 }
 
+// ../devkit/src/lib/amend/stylesheet-import.ts
+import { posix as posix3 } from "node:path";
+var IMPORT = /^\s*@import\s+(?:url\(\s*)?['"]([^'"]+)['"]/;
+function specifierOf(line) {
+  return IMPORT.exec(line)?.[1];
+}
+function importSpecifier(entryStylesheet2, file) {
+  const path = posix3.relative(posix3.dirname(entryStylesheet2), file);
+  return path.startsWith("..") ? path : `./${path}`;
+}
+function ensureStylesheetImport(css, specifier, after) {
+  const lines = css.split("\n");
+  if (lines.some((line) => specifierOf(line) === specifier)) {
+    return { css, anchored: true };
+  }
+  const anchor = lines.findLastIndex(
+    (line) => specifierOf(line)?.startsWith(after) === true
+  );
+  const position = anchor === -1 ? lines.findLastIndex((line) => specifierOf(line) !== void 0) : anchor;
+  lines.splice(position + 1, 0, `@import '${specifier}';`);
+  return { css: lines.join("\n"), anchored: anchor !== -1 };
+}
+
 // ../devkit/src/lib/amend/describe.ts
 function describeAmendment(amendment) {
   switch (amendment.kind) {
@@ -542,6 +669,12 @@ function describeAmendment(amendment) {
     case "compose-plugin": {
       return describeRegistration(amendment);
     }
+    case "compose-provider": {
+      return describeProviders(amendment);
+    }
+    case "stylesheet-import": {
+      return `Import '${amendment.file}' in the application's entry stylesheet, resolved from that stylesheet, after its import of ${amendment.after}. ${amendment.without}`;
+    }
     case "build-target": {
       return describeBuildTarget(amendment);
     }
@@ -560,6 +693,18 @@ function describeRegistration(amendment) {
   ).join("");
   return `Register ${amendment.id} in the composition root: import { ${amendment.symbol} }, ${calls.slice(0, -1).join(", ")} and ${calls.at(-1)}.${imports} Without it none of its contributions appear.`;
 }
+function describeProviders(amendment) {
+  const lines = providerLines(amendment, amendment.module).map((line) => line.replace(/[,;]$/, "")).join("; ");
+  const resolved = amendment.module === void 0 ? "" : " Resolve the generated import from the composition root.";
+  const keeps = amendment.providers.map((provider) => provider.unless).filter((unless) => unless?.endsWith("(") === true).map((unless) => unless.slice(0, -1));
+  const keep = keeps.length > 0 ? ` Where the composition already calls ${keeps.join(" or ")}, that one is the product's choice: keep it, or replace it with this one.` : "";
+  return `Add to the composition root, after provideShell(): ${lines}.${resolved}${keep} ${amendment.without}`;
+}
+var STRINGS_COST = "the shell fetches its own strings at runtime, so without that glob every label in the chrome renders as its raw translation key";
+function assetCost(amendment) {
+  const own = amendment.assets.map((asset) => asset.without).filter((without) => without !== void 0);
+  return own.length > 0 ? own.join("; ") : STRINGS_COST;
+}
 function describeBuildTarget(amendment) {
   const steps = [];
   if (amendment.styles.length > 0) {
@@ -569,9 +714,7 @@ function describeBuildTarget(amendment) {
     const assets = amendment.assets.map(
       (asset) => asset.output ? `${asset.input} served under ${asset.output}` : asset.input
     ).join(", ");
-    steps.push(
-      `add assets for ${assets} (the shell fetches its own strings at runtime, so without that glob every label in the chrome renders as its raw translation key)`
-    );
+    steps.push(`add assets for ${assets} (${assetCost(amendment)})`);
   }
   if (amendment.serviceWorker) {
     steps.push(
@@ -922,16 +1065,30 @@ function pause(): Promise<void> {
 `;
 }
 
+// ../devkit/src/lib/generate/escape.ts
+var MARKUP_ENTITIES = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;",
+  "{": "&#123;",
+  "}": "&#125;",
+  "@": "&#64;"
+};
+function markupText(value) {
+  return value.replaceAll(/[&<>"'{}@]/g, (character) => MARKUP_ENTITIES[character]);
+}
+function stringLiteral(value) {
+  const escaped = value.replaceAll("\\", "\\\\").replaceAll("'", String.raw`\'`).replaceAll("\n", String.raw`\n`).replaceAll("\r", String.raw`\r`);
+  return `'${escaped}'`;
+}
+
 // ../devkit/src/recipes/angular-weaver/agent-files.ts
 var AG_UI_PROTOCOL_VERSION = "0.0.x";
 function connectionFile(weaver) {
   return `import { signal } from '@angular/core';
-import {
-  commandTools,
-  type CommandTools,
-  type PendingToolCall,
-  type ToolDecision,
-} from '@loomweaver/ag-ui';
+import { commandTools, consentPolicy, type CommandTools } from '@loomweaver/ag-ui';
 import type { PluginContext } from '@loomweaver/plugin-sdk';
 
 // The connection is the workbench's half: the commands offered as tools, and each call put to the
@@ -940,43 +1097,28 @@ import type { PluginContext } from '@loomweaver/plugin-sdk';
 // A factory, not a module-level connection: everything a run needs lives in the closure, so a second
 // one never shares state with the first.
 export function connect${weaver.className}(ctx: PluginContext): CommandTools {
-  return commandTools(ctx, { before: (call) => decide(ctx, call) });
+  // What an agent's word is enough for is each command's own statement, declared where the command
+  // is registered. consentPolicy acts on it: it declines what may never run on an agent's word, runs
+  // what may, and asks through your confirmation for the rest, remembering a yes for a command that
+  // asks first for as long as this connection lives. The workbench states and enforces nothing here,
+  // so replace it with a decision of your own where you need one. A decision can only narrow: the
+  // workbench still refuses whatever it always refused.
+  return commandTools(ctx, {
+    before: consentPolicy(() =>
+      ctx.ui.confirm({
+        title: '${weaver.id}.agent.confirm.title',
+        message: '${weaver.id}.agent.confirm.message',
+        confirmLabel: '${weaver.id}.agent.confirm.yes',
+        cancelLabel: '${weaver.id}.agent.confirm.no',
+        tone: 'warning',
+      }),
+    ),
+  });
 }
 
 // The one connection this plugin activates, published for its panel. Set in activate(), cleared in
 // deactivate(), so the panel renders an honest empty state either side of that.
 export const ${weaver.propertyName}Tools = signal<CommandTools | null>(null);
-
-// What an agent's word is enough for is the command's own statement, declared where the command is
-// registered and read off the call here. No list of ids lives beside the commands: a list drifts from
-// what it describes, and it cannot speak for a command another plugin registered. Acting on the
-// statement is this weaver's half: the workbench states it and enforces nothing.
-async function decide(
-  ctx: PluginContext,
-  call: PendingToolCall,
-): Promise<ToolDecision> {
-  if (call.agentConsent === 'never') {
-    return {
-      decision: 'decline',
-      reason: 'an agent may not run this one on its own word.',
-    };
-  }
-  if (call.agentConsent !== 'ask' && call.agentConsent !== 'ask-always') {
-    return { decision: 'run' };
-  }
-  const yes = await ctx.ui.confirm({
-    title: '${weaver.id}.agent.confirm.title',
-    message: '${weaver.id}.agent.confirm.message',
-    confirmLabel: '${weaver.id}.agent.confirm.yes',
-    cancelLabel: '${weaver.id}.agent.confirm.no',
-    tone: 'warning',
-  });
-  // A decision can only narrow. Letting a call through does not make it reachable: the workbench
-  // still refuses whatever it always refused.
-  return yes
-    ? { decision: 'run' }
-    : { decision: 'decline', reason: 'the person at the keyboard said no.' };
-}
 `;
 }
 function specFile(weaver) {
@@ -990,17 +1132,22 @@ interface Asked {
   readonly args?: CommandArguments;
 }
 
-function contextThat(confirms: boolean, ran: Asked[]): PluginContext {
+function contextThat(confirms: boolean, ran: Asked[], asked: string[] = []): PluginContext {
   return {
     invocableCommands: () => [
       // agentConsent travels with the command, which is what the connection reads off the call.
-      { id: '${weaver.id}.hello', title: '${weaver.name} action', description: 'Shows a short message.', agentConsent: 'ask' },
+      { id: '${weaver.id}.hello', title: ${stringLiteral(`${weaver.name} action`)}, description: 'Shows a short message.', agentConsent: 'ask' },
     ],
     invokeCommand: (id: string, args?: CommandArguments) => {
       ran.push({ id, args });
       return Promise.resolve({ outcome: 'answered', value: { tone: args?.['tone'] ?? 'info' } });
     },
-    ui: { confirm: () => Promise.resolve(confirms) },
+    ui: {
+      confirm: (input: { title: string }) => {
+        asked.push(input.title);
+        return Promise.resolve(confirms);
+      },
+    },
   } as unknown as PluginContext;
 }
 
@@ -1040,6 +1187,18 @@ describe('connect${weaver.className}', () => {
     expect(answer?.error).toBeUndefined();
   });
 
+  it('asks once for a command that asks first, and remembers the yes', async () => {
+    const asked: string[] = [];
+    const ran: Asked[] = [];
+    const tools = connect${weaver.className}(contextThat(true, ran, asked));
+
+    await answersTo(tools, streamedCall('c3', '{}'));
+    await answersTo(tools, streamedCall('c4', '{}'));
+
+    expect(asked).toEqual(['${weaver.id}.agent.confirm.title']);
+    expect(ran).toHaveLength(2);
+  });
+
   it('never reaches the workbench when a consequential call is declined', async () => {
     const ran: Asked[] = [];
     const tools = connect${weaver.className}(contextThat(false, ran));
@@ -1149,6 +1308,12 @@ var APP_OPTION = {
   description: "Application to drop into. Inferred when the workspace has exactly one.",
   workspaceOnly: true
 };
+var DIRECTORY_OPTION = {
+  name: "directory",
+  type: "string",
+  description: "Where the files land, relative to the workspace root.",
+  workspaceOnly: true
+};
 
 // ../devkit/src/lib/validate/manifest.ts
 var KNOWN_CAPABILITIES = [
@@ -1162,11 +1327,18 @@ var KNOWN_CAPABILITIES = [
 ];
 function validateManifest(manifest2, known = KNOWN_CAPABILITIES) {
   const findings = [];
-  if (typeof manifest2.id !== "string" || !isKebabId(manifest2.id)) {
+  if (typeof manifest2.id !== "string" || manifest2.id.trim() === "") {
     findings.push({
       level: "error",
       code: "manifest.id",
-      message: `Plugin id must be a kebab-case string; got ${JSON.stringify(manifest2.id)}.`,
+      message: `Plugin id must be a non-empty string; got ${JSON.stringify(manifest2.id)}. Grants, settings and every contribution are keyed by it.`,
+      path: "manifest.id"
+    });
+  } else if (!isKebabId(manifest2.id)) {
+    findings.push({
+      level: "warning",
+      code: "manifest.id.convention",
+      message: `Plugin id ${JSON.stringify(manifest2.id)} is not kebab-case. The workbench accepts it; every scaffold and guide writes ids in kebab-case, so it will read differently from the plugins beside it.`,
       path: "manifest.id"
     });
   }
@@ -1258,6 +1430,13 @@ var PLATFORM_BOUND_CHORD_TOKENS = /* @__PURE__ */ new Set([
   "control",
   "meta"
 ]);
+var KEPT_BY_BROWSERS = /* @__PURE__ */ new Set(["n", "t", "w", "q"]);
+function defaultShortcut(id) {
+  const letter = [...id].find(
+    (character) => /[a-z]/.test(character) && !KEPT_BY_BROWSERS.has(character)
+  );
+  return letter && `mod+shift+${letter}`;
+}
 function assertPlatformNeutralChord(shortcut) {
   const tokens = shortcut.toLowerCase().split("+").map((token) => token.trim());
   const bound = tokens.find((token) => PLATFORM_BOUND_CHORD_TOKENS.has(token));
@@ -1287,7 +1466,7 @@ function resolveFeatures(id, input) {
     menuSlot,
     settings: Boolean(input?.settings),
     access: input?.access ? accessLiteral(input.access) : void 0,
-    shortcut: input?.shortcut?.trim() || `mod+shift+${id.charAt(0)}`,
+    shortcut: input?.shortcut?.trim() || defaultShortcut(id),
     barItem,
     about: Boolean(input?.about),
     instanceable,
@@ -1352,7 +1531,7 @@ function commandBlock(weaver) {
     `        { name: 'tone', kind: 'choice', choices: ['info', 'success', 'warning'], description: '${weaver.id}.actionTone' },`,
     "      ],",
     `      answers: '${weaver.id}.actionAnswers',`,
-    `      shortcut: '${weaver.features.shortcut}',`,
+    ...weaver.features.shortcut ? [`      shortcut: '${weaver.features.shortcut}',`] : [],
     "      callable: true,",
     ...weaver.features.agent ? [
       "      // What an agent's word is enough for. The platform states it and enforces nothing:",
@@ -1584,7 +1763,7 @@ ${pluginConsts(weaver).join("\n\n")}
 export const ${weaver.propertyName}Plugin: Plugin = {
   manifest: {
     id: '${weaver.id}',
-    name: '${weaver.name}',
+    name: ${stringLiteral(weaver.name)},
     capabilities: [${quotedList(weaver.capabilities)}],
   },
   activate(ctx) {
@@ -1598,7 +1777,7 @@ function accessLine(weaver) {
 }
 
 // ../devkit/src/recipes/platform-version.ts
-var PLATFORM_VERSION = "0.16.0";
+var PLATFORM_VERSION = "0.17.1";
 
 // ../devkit/src/recipes/readme-notes.ts
 var UNTAGGED_NOTE = [
@@ -1741,7 +1920,7 @@ function readmeFile(weaver) {
     "## After scaffolding",
     "",
     "- `src/lib/i18n/de.json` starts as a copy of the English strings \u2014 translate it.",
-    `- A scaffolded command defaults its shortcut to \`mod+shift+<first letter of the id>\` \u2014 two weavers whose ids share a first letter collide; pass \`--shortcut\` or edit the command.`,
+    `- A scaffolded command defaults its shortcut to \`mod+shift+\` and the first letter of the id a browser leaves to the page (it keeps n, t, w and q for itself) \u2014 two weavers that land on the same letter collide; pass \`--shortcut\` or edit the command.`,
     ...asBullet(UNTAGGED_NOTE),
     ""
   ].join("\n");
@@ -1763,7 +1942,7 @@ export class ${weaver.className}AboutDialog {
 }
 function aboutDialogTemplateFile(weaver) {
   return `<div class="flex flex-col items-center gap-2 text-center">
-  <h2 class="text-lg font-semibold text-content">${weaver.name}</h2>
+  <h2 class="text-lg font-semibold text-content">${markupText(weaver.name)}</h2>
   <span class="text-xs text-content-faint tabular-nums">v{{ host.version() }}</span>
 </div>
 `;
@@ -1820,7 +1999,7 @@ function viewTemplateFile(weaver) {
   </p>
 ` : "";
   return `<div class="mx-auto flex max-w-2xl flex-col gap-4 p-6">
-  <h2 class="text-lg font-semibold text-content">${weaver.name}</h2>
+  <h2 class="text-lg font-semibold text-content">${markupText(weaver.name)}</h2>
   <p class="text-sm text-content-faint">
     Your new weaver surface. Register more surfaces, commands, rail items and menus on
     <code class="text-content">ctx</code> inside the plugin's
@@ -1933,7 +2112,7 @@ function pluginHtml(plugin) {
 <html lang="en">
   <head>
     <meta charset="utf-8" />
-    <title>${plugin.name} \u2014 frame plugin (logic)</title>
+    <title>${markupText(plugin.name)} \u2014 frame plugin (logic)</title>
   </head>
   <body>
     <script src="/frame-kit/penpal.global.js"></script>
@@ -1954,10 +2133,10 @@ function pluginJs(plugin) {
   connection.promise
     .then(function (ctx) {
       return Promise.all([
-        ctx.toast({ message: '${plugin.name} ready', kind: 'success', timeoutMs: 4000 }),
+        ctx.toast({ message: ${stringLiteral(`${plugin.name} ready`)}, kind: 'success', timeoutMs: 4000 }),
         ctx.registerSurface({
           id: '${plugin.id}.view',
-          title: '${plugin.name}',
+          title: ${stringLiteral(plugin.name)},
           iframe: '/${plugin.id}/view.html',
           routable: { path: '${plugin.id}', titleIsLiteral: true },
         }),
@@ -1974,23 +2153,18 @@ function viewHtml(plugin) {
 <html lang="en">
   <head>
     <meta charset="utf-8" />
-    <title>${plugin.name}</title>
+    <title>${markupText(plugin.name)}</title>
     <link rel="stylesheet" href="/frame-kit/lw-frame.css" />
     <style>
-      body {
-        margin: 0;
-        font-family: var(--lw-font-sans, system-ui, sans-serif);
-        color: var(--lw-content, #1f2937);
-        background: var(--lw-surface, transparent);
-      }
+      body { margin: 0; }
       .wrap { max-width: 42rem; margin: 0 auto; padding: 1.5rem; }
       h1 { font-size: 1.125rem; font-weight: 600; }
-      p { color: var(--lw-content-faint, #6b7280); }
+      p { color: var(--lw-content-faint); }
     </style>
   </head>
   <body>
     <div class="wrap">
-      <h1>${plugin.name}</h1>
+      <h1>${markupText(plugin.name)}</h1>
       <p>
         Your sandboxed surface. It runs isolated in its own iframe, so its body can be built with
         any framework (React, Vue, Svelte, vanilla). The frame UI kit (served by the distribution
@@ -2002,16 +2176,23 @@ function viewHtml(plugin) {
     <script src="/frame-kit/penpal.global.js"></script>
     <script src="/frame-kit/lw-elements.global.js"></script>
     <script>
-      globalThis.Penpal.connect({
+      const connection = globalThis.Penpal.connect({
         messenger: new globalThis.Penpal.WindowMessenger({
           remoteWindow: globalThis.parent,
           allowedOrigins: ['*'],
         }),
-        methods: {
+        methods: globalThis.LwFrame.surfaceMethods({
           render: function (state) {
             globalThis.LwFrame.applySurfaceState(state);
           },
-        },
+          stateChanged: function (key, value, loaded) {
+            globalThis.LwFrame.state.apply(key, value, loaded);
+          },
+        }),
+      });
+      connection.promise.then(function (host) {
+        globalThis.LwFrame.connectState(host);
+        globalThis.LwFrame.connectToolbars(host);
       });
     </script>
   </body>
@@ -2025,24 +2206,25 @@ function readme(plugin) {
     `A framework-agnostic LoomWeaver plugin: it runs in an isolated \`<iframe sandbox>\` and`,
     `receives \`ctx\` over Penpal RPC through the same default-deny broker a trusted plugin uses.`,
     "",
-    "## Serve it + wire it into a distribution",
+    "## How it is served and wired",
     "",
-    `1. Put these files under the distribution's static dir, e.g. \`public/${plugin.id}/\`. The plugin`,
-    `   references the **frame UI kit** (\`@loomweaver/frame-kit\`) at \`/frame-kit/\` \u2014`,
-    `   the distribution serves it via an assets glob (generated distributions already do):`,
+    `The scaffold wires it into the distribution: it serves these files under \`/${plugin.id}/\` and the`,
+    "**frame UI kit** (`@loomweaver/frame-kit`) under `/frame-kit/`, and registers and grants the",
+    "plugin in the composition root:",
     "",
-    "   ```jsonc",
-    '   { "input": "node_modules/@loomweaver/frame-kit/dist", "glob": "**", "output": "frame-kit" }',
-    "   ```",
-    "",
-    `2. Register + grant it in the composition root:`,
+    "```ts",
+    `...provideFramePlugins({ id: '${plugin.id}', entryUrl: '/${plugin.id}/plugin.html', capabilities: ['contributions', 'ui'] }),`,
+    `provideCapabilityGrants({ '${plugin.id}': ['contributions', 'ui'] }),`,
+    "```",
     "",
-    "   ```ts",
-    `   provideFramePlugins({ id: '${plugin.id}', entryUrl: '/${plugin.id}/plugin.html', capabilities: ['contributions', 'ui'] });`,
-    `   provideCapabilityGrants({ '${plugin.id}': ['contributions', 'ui'] });`,
-    "   ```",
+    "Where it was generated without a workspace to wire, those are the steps it named instead.",
     "",
     `The surface is routable at \`/${plugin.id}\`. Replace \`view.html\` with your own UI in any framework.`,
+    "",
+    "Keep its connection on `LwFrame.surfaceMethods`, `connectState` and `connectToolbars`: they let the",
+    "workbench picture the surface, push the plugin's state and fill any `<lw-toolbar>` you place. Writing",
+    'the surface in TypeScript? Add `"types": ["@loomweaver/frame-kit"]` to your tsconfig and `LwFrame` is',
+    "typed from the kit's `lw-frame.d.ts`.",
     ""
   ].join("\n");
 }
@@ -2395,7 +2577,7 @@ export const appConfig: ApplicationConfig = {
     provideCommandPaletteEntry(),
     provideQuickOpenEntry(),
     provideProductIdentity({
-      name: '${distribution.title}',
+      name: ${stringLiteral(distribution.title)},
       tagline: 'Built on LoomWeaver',
       logoUrl: 'logo.svg',
     }),
@@ -2465,7 +2647,7 @@ function indexHtml(distribution) {
 <html lang="en">
   <head>
     <meta charset="utf-8" />
-    <title>${distribution.title}</title>
+    <title>${markupText(distribution.title)}</title>
     <base href="/" />
     <meta
       http-equiv="Content-Security-Policy"
@@ -2835,8 +3017,8 @@ function resolveSettingsStoreInput(input) {
 function moduleFile2(store) {
   return `// A backend-backed settings store for the SETTINGS_STORE port. The platform
 // ships local defaults; the product persists settings against its own backend. Only genuine
-// settings flow through this port \u2014 working state stays on WORKING_STATE_STORE. Wire it with:
-// provideSettingsStore(new ${store.className}SettingsStore()).
+// settings flow through this port \u2014 working state stays on WORKING_STATE_STORE. The scaffold
+// provides it in the composition root: provideSettingsStore(new ${store.className}SettingsStore()).
 import { KeyValueStore } from '@loomweaver/shell';
 
 export class ${store.className}SettingsStore implements KeyValueStore {
@@ -2886,7 +3068,7 @@ function resolveThemeInput(input) {
 }
 function cssFile(theme2) {
   return `/* ${theme2.title} theme \u2014 overrides LoomWeaver's --lw-* design tokens.
-   Import it AFTER the shell theme in your distribution styles.css:
+   The scaffold imports it into your distribution's entry stylesheet, after the shell's styles:
      @import '@loomweaver/shell/styles/theme.css';
      @import './themes/${theme2.name}.css';
    Declared in @layer lw-tenant-theme so it beats any plugin's ctx.contributeTheme
@@ -2925,8 +3107,8 @@ function cssFile(theme2) {
 }
 function bootstrapFile(theme2) {
   return `/* ${theme2.title} theme \u2014 maps LoomWeaver's --lw-* design tokens onto Bootstrap 5.3's --bs-*.
-   Import it AFTER the shell theme in your distribution styles.css, and import Bootstrap itself
-   INTO A LAYER \u2014 unlayered CSS outranks layered CSS whatever its specificity, so Bootstrap's
+   The scaffold imports it into your distribution's entry stylesheet, after the shell's styles.
+   Import Bootstrap itself INTO A LAYER \u2014 unlayered CSS outranks layered CSS whatever its specificity, so Bootstrap's
    Reboot (button { border-radius: 0 }) would otherwise beat our .lw-* component classes:
      @layer vendor;
      @import 'bootstrap/dist/css/bootstrap.css' layer(vendor);
@@ -3021,8 +3203,8 @@ function resolveLayoutInput(input) {
   return { name, propertyName: toCamelCase(name) };
 }
 function moduleFile3(layout2) {
-  return `// A base layout for the distribution. Pass it to provideLayout(${layout2.propertyName}Layout)
-// in src/app/app.config.ts. Region ids are what contributions target \u2014 '${RAIL_REGION}' (rail) and '${STATUS_BAR_REGION}' (bar) match
+  return `// A base layout for the distribution. The scaffold provides it in src/app/app.config.ts with
+// provideLayout(${layout2.propertyName}Layout), unless a layout is already provided there. Region ids are what contributions target \u2014 '${RAIL_REGION}' (rail) and '${STATUS_BAR_REGION}' (bar) match
 // the devkit weaver defaults, so a scaffolded weaver's rail + bar items land here.
 import { ShellLayout } from '@loomweaver/shell';
 
@@ -3332,18 +3514,70 @@ var authSourceScaffold = {
       default: false
     },
     APP_OPTION,
-    {
-      name: "directory",
-      type: "string",
-      description: "Where the files land, relative to the workspace root.",
-      workspaceOnly: true
-    }
+    DIRECTORY_OPTION
   ],
   build: (values) => generate(authSource, authSourceInput(values)),
   amend: (values) => authSourceAmendments(authSourceInput(values), stringValue(values, "directory"))
 };
 
+// ../devkit/src/recipes/frame-plugin/amendments.ts
+var FRAME_PLUGIN_CAPABILITIES = ["contributions", "ui"];
+function framePluginAmendments(input, where) {
+  if (where === void 0 || where === "") {
+    return [];
+  }
+  const plugin = resolveFramePluginInput(input);
+  const capabilities = quotedList(FRAME_PLUGIN_CAPABILITIES);
+  const entryUrl = `/${plugin.id}/plugin.html`;
+  return [
+    {
+      kind: "package",
+      name: "@loomweaver/frame-kit",
+      version: `^${PLATFORM_VERSION}`
+    },
+    {
+      kind: "build-target",
+      styles: [],
+      assets: [
+        {
+          glob: "**/*",
+          input: normalizeProjectRoot(where),
+          from: "workspace",
+          output: plugin.id,
+          without: `without it nothing is served at /${plugin.id}/ and the plugin never loads`
+        },
+        {
+          glob: "**/*",
+          input: "node_modules/@loomweaver/frame-kit/dist",
+          from: "workspace",
+          output: "frame-kit",
+          without: "without it the frame kit the plugin loads from /frame-kit/ is missing"
+        }
+      ]
+    },
+    {
+      kind: "compose-provider",
+      providers: [
+        {
+          line: `...provideFramePlugins({ id: '${plugin.id}', name: ${stringLiteral(plugin.name)}, entryUrl: '${entryUrl}', capabilities: [${capabilities}] }),`,
+          shell: ["provideFramePlugins"],
+          unless: `'${entryUrl}'`
+        },
+        {
+          line: `provideCapabilityGrants({ ${grantKey(plugin.id)}: [${capabilities}] }),`,
+          shell: ["provideCapabilityGrants"],
+          unless: `${grantKey(plugin.id)}: [`
+        }
+      ],
+      without: "Without them the plugin is never loaded, and loaded without its grant every call it makes is refused."
+    }
+  ];
+}
+
 // ../devkit/src/recipes/frame-plugin/scaffold.ts
+function framePluginInput(values) {
+  return { id: stringValue(values, "id") ?? "", name: stringValue(values, "name") };
+}
 var framePluginScaffold = {
   name: "frame-plugin",
   summary: "a framework-agnostic iframe plugin (Penpal + the frame UI kit)",
@@ -3360,14 +3594,37 @@ var framePluginScaffold = {
       type: "string",
       description: "Human-readable name. Defaults to a title-cased id."
     },
-    APP_OPTION
+    APP_OPTION,
+    DIRECTORY_OPTION
   ],
-  build: (values) => generate(framePlugin, {
-    id: stringValue(values, "id") ?? "",
-    name: stringValue(values, "name")
-  })
+  build: (values) => generate(framePlugin, framePluginInput(values)),
+  amend: (values) => framePluginAmendments(framePluginInput(values), stringValue(values, "directory"))
 };
 
+// ../devkit/src/recipes/layout/amendments.ts
+function layoutAmendments(input, where) {
+  if (where === void 0 || where === "") {
+    return [];
+  }
+  const layout2 = resolveLayoutInput(input);
+  const symbol = `${layout2.propertyName}Layout`;
+  return [
+    {
+      kind: "compose-provider",
+      module: joinProjectPath(normalizeProjectRoot(where), `${layout2.name}-layout`),
+      providers: [
+        {
+          line: `provideLayout(${symbol}),`,
+          shell: ["provideLayout"],
+          own: [symbol],
+          unless: "provideLayout("
+        }
+      ],
+      without: "Without it the workbench keeps the layout it has, and this one is never drawn."
+    }
+  ];
+}
+
 // ../devkit/src/recipes/layout/scaffold.ts
 var layoutScaffold = {
   name: "layout",
@@ -3376,13 +3633,41 @@ var layoutScaffold = {
     {
       name: "name",
       type: "string",
-      description: "Layout name. Defaults to a base layout."
+      description: "Layout name, kebab-case; the file is <name>-layout.ts.",
+      pattern: KEBAB_ID_PATTERN,
+      default: "base"
     },
-    APP_OPTION
+    APP_OPTION,
+    DIRECTORY_OPTION
   ],
-  build: (values) => generate(layout, { name: stringValue(values, "name") })
+  build: (values) => generate(layout, { name: stringValue(values, "name") }),
+  amend: (values) => layoutAmendments({ name: stringValue(values, "name") }, stringValue(values, "directory"))
 };
 
+// ../devkit/src/recipes/settings-store/amendments.ts
+function settingsStoreAmendments(input, where) {
+  if (where === void 0 || where === "") {
+    return [];
+  }
+  const store = resolveSettingsStoreInput(input);
+  const symbol = `${store.className}SettingsStore`;
+  return [
+    {
+      kind: "compose-provider",
+      module: joinProjectPath(normalizeProjectRoot(where), `${store.name}-settings-store`),
+      providers: [
+        {
+          line: `provideSettingsStore(new ${symbol}()),`,
+          shell: ["provideSettingsStore"],
+          own: [symbol],
+          unless: "provideSettingsStore("
+        }
+      ],
+      without: "Without it settings stay in the browser's local storage and never reach your API."
+    }
+  ];
+}
+
 // ../devkit/src/recipes/settings-store/scaffold.ts
 var settingsStoreScaffold = {
   name: "settings-store",
@@ -3395,12 +3680,40 @@ var settingsStoreScaffold = {
       required: true,
       pattern: KEBAB_ID_PATTERN
     },
-    APP_OPTION
+    APP_OPTION,
+    DIRECTORY_OPTION
   ],
-  build: (values) => generate(settingsStore, { name: stringValue(values, "name") ?? "" })
+  build: (values) => generate(settingsStore, { name: stringValue(values, "name") ?? "" }),
+  amend: (values) => settingsStoreAmendments(
+    { name: stringValue(values, "name") ?? "" },
+    stringValue(values, "directory")
+  )
 };
 
+// ../devkit/src/recipes/theme/amendments.ts
+var SHELL_STYLES = "@loomweaver/shell/styles/";
+function themeAmendments(input, where) {
+  if (where === void 0 || where === "") {
+    return [];
+  }
+  const theme2 = resolveThemeInput(input);
+  return [
+    {
+      kind: "stylesheet-import",
+      file: joinProjectPath(normalizeProjectRoot(where), `${theme2.name}.css`),
+      after: SHELL_STYLES,
+      without: "Without it the theme is never loaded and changes nothing."
+    }
+  ];
+}
+
 // ../devkit/src/recipes/theme/scaffold.ts
+function themeInput(values) {
+  return {
+    name: stringValue(values, "name") ?? "",
+    preset: stringValue(values, "preset") ?? "literal"
+  };
+}
 var themeScaffold = {
   name: "theme",
   summary: "a token-override stylesheet in @layer lw-tenant-theme",
@@ -3419,12 +3732,11 @@ var themeScaffold = {
       choices: THEME_PRESETS,
       default: "literal"
     },
-    APP_OPTION
+    APP_OPTION,
+    DIRECTORY_OPTION
   ],
-  build: (values) => generate(theme, {
-    name: stringValue(values, "name") ?? "",
-    preset: stringValue(values, "preset") ?? "literal"
-  })
+  build: (values) => generate(theme, themeInput(values)),
+  amend: (values) => themeAmendments(themeInput(values), stringValue(values, "directory"))
 };
 
 // ../devkit/src/lib/scaffolds/scaffolds.ts
@@ -3493,30 +3805,11 @@ function validateI18nParity(bundles) {
   return findings;
 }
 
-// ../devkit/src/lib/validate/catalog.ts
-var CATALOG_ENTRY_KEYS = [
-  "id",
-  "name",
-  "entryUrl",
-  "capabilities",
-  "version",
-  "iconUrl",
-  "description",
-  "icon",
-  "category",
-  "author",
-  "downloads",
-  "updated",
-  "repository",
-  "readmeUrl"
-];
+// ../devkit/src/lib/validate/catalog-urls.ts
 var SAME_ORIGIN_FIELDS = ["entryUrl", "iconUrl", "readmeUrl"];
 function pathOf(index, field) {
   return field ? `catalog[${index}].${field}` : `catalog[${index}]`;
 }
-function isPlainObject(raw) {
-  return typeof raw === "object" && raw !== null && !Array.isArray(raw);
-}
 function requiredUrlFinding(value, index, field) {
   if (typeof value !== "string" || value.length === 0) {
     return {
@@ -3540,6 +3833,14 @@ function optionalUrlFinding(value, index, field) {
   return schemeFinding(value, index, field, "ignores the field");
 }
 function schemeFinding(value, index, field, refusal) {
+  if (value.startsWith("//")) {
+    return {
+      level: "error",
+      code: "catalog.url.foreign",
+      message: `${pathOf(index, field)} is protocol-relative, so it names another host. The host accepts same-origin URLs only and ${refusal}.`,
+      path: pathOf(index, field)
+    };
+  }
   const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(value)?.[1]?.toLowerCase();
   if (scheme && scheme !== "http" && scheme !== "https") {
     return {
@@ -3559,6 +3860,56 @@ function schemeFinding(value, index, field, refusal) {
   }
   return void 0;
 }
+function validateSameOriginUrls(raw, index) {
+  const findings = [];
+  for (const field of SAME_ORIGIN_FIELDS) {
+    const finding = sameOriginUrlFinding(raw, index, field);
+    if (finding) {
+      findings.push(finding);
+    }
+  }
+  return findings;
+}
+function sameOriginUrlFinding(raw, index, field) {
+  if (field === "entryUrl") {
+    return requiredUrlFinding(raw[field], index, field);
+  }
+  return raw[field] === void 0 ? void 0 : optionalUrlFinding(raw[field], index, field);
+}
+function isHttpUrl(raw) {
+  if (typeof raw !== "string") {
+    return false;
+  }
+  try {
+    const url = new URL(raw);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+// ../devkit/src/lib/validate/catalog.ts
+var CATALOG_ENTRY_KEYS = [
+  "id",
+  "name",
+  "entryUrl",
+  "capabilities",
+  "version",
+  "iconUrl",
+  "description",
+  "icon",
+  "category",
+  "author",
+  "downloads",
+  "updated",
+  "repository",
+  "readmeUrl",
+  "level",
+  "deployed"
+];
+function isPlainObject(raw) {
+  return typeof raw === "object" && raw !== null && !Array.isArray(raw);
+}
 function validateCapabilities2(value, index, known) {
   if (value === void 0) {
     return [
@@ -3623,22 +3974,6 @@ function validateId(raw, index) {
     }
   ];
 }
-function validateSameOriginUrls(raw, index) {
-  const findings = [];
-  for (const field of SAME_ORIGIN_FIELDS) {
-    const finding = sameOriginUrlFinding(raw, index, field);
-    if (finding) {
-      findings.push(finding);
-    }
-  }
-  return findings;
-}
-function sameOriginUrlFinding(raw, index, field) {
-  if (field === "entryUrl") {
-    return requiredUrlFinding(raw[field], index, field);
-  }
-  return raw[field] === void 0 ? void 0 : optionalUrlFinding(raw[field], index, field);
-}
 function validateNameAndVersion(raw, index) {
   const findings = [];
   if (raw["name"] === void 0) {
@@ -3666,8 +4001,28 @@ function validateNameAndVersion(raw, index) {
   }
   return findings;
 }
+var TEXT_FIELDS = [
+  { field: "description", loss: "the store shows no description" },
+  { field: "icon", loss: "the install dialog shows the default icon" },
+  { field: "category", loss: "the entry carries no category badge and the search cannot match one" },
+  { field: "author", loss: "the store names no author" },
+  {
+    field: "version",
+    loss: "update detection has nothing to compare, so the store can never offer an update"
+  }
+];
+function validateTextFields(raw, index) {
+  return TEXT_FIELDS.filter(
+    ({ field }) => raw[field] !== void 0 && (typeof raw[field] !== "string" || raw[field] === "")
+  ).map(({ field, loss }) => ({
+    level: "warning",
+    code: "catalog.text",
+    message: `${pathOf(index, field)} is not a non-empty string, so the host drops it and ${loss}.`,
+    path: pathOf(index, field)
+  }));
+}
 function validateEntryMetadata(raw, index) {
-  const findings = [];
+  const findings = [...validateTextFields(raw, index)];
   if (raw["downloads"] !== void 0 && (typeof raw["downloads"] !== "number" || raw["downloads"] < 0)) {
     findings.push({
       level: "warning",
@@ -3676,7 +4031,14 @@ function validateEntryMetadata(raw, index) {
       path: pathOf(index, "downloads")
     });
   }
-  if (raw["updated"] !== void 0 && !isRenderableDate(raw["updated"])) {
+  if (raw["updated"] !== void 0 && (typeof raw["updated"] !== "string" || raw["updated"] === "")) {
+    findings.push({
+      level: "warning",
+      code: "catalog.updated",
+      message: `${pathOf(index, "updated")} is not a non-empty string, so the host drops it and the store shows no date.`,
+      path: pathOf(index, "updated")
+    });
+  } else if (raw["updated"] !== void 0 && !isRenderableDate(raw["updated"])) {
     findings.push({
       level: "warning",
       code: "catalog.updated",
@@ -3684,6 +4046,7 @@ function validateEntryMetadata(raw, index) {
       path: pathOf(index, "updated")
     });
   }
+  findings.push(...validatePlacement(raw, index));
   if (raw["repository"] !== void 0 && !isHttpUrl(raw["repository"])) {
     findings.push({
       level: "warning",
@@ -3694,6 +4057,26 @@ function validateEntryMetadata(raw, index) {
   }
   return findings;
 }
+function validatePlacement(raw, index) {
+  const findings = [];
+  if (raw["deployed"] !== void 0 && typeof raw["deployed"] !== "boolean") {
+    findings.push({
+      level: "warning",
+      code: "catalog.deployed",
+      message: `${pathOf(index, "deployed")} must be true or false. The host deploys an entry only when it is exactly true, so this one is merely offered.`,
+      path: pathOf(index, "deployed")
+    });
+  }
+  if (raw["level"] !== void 0 && raw["level"] !== "embedded" && raw["level"] !== "isolated") {
+    findings.push({
+      level: "warning",
+      code: "catalog.level",
+      message: `${pathOf(index, "level")} must be "embedded" or "isolated". The host ignores anything else and runs the plugin at the level the distribution chooses.`,
+      path: pathOf(index, "level")
+    });
+  }
+  return findings;
+}
 function validateEntryKeys(raw, index) {
   const findings = [];
   for (const key of Object.keys(raw)) {
@@ -3708,16 +4091,11 @@ function validateEntryKeys(raw, index) {
   }
   return findings;
 }
-function isHttpUrl(raw) {
-  if (typeof raw !== "string") {
-    return false;
-  }
-  try {
-    const url = new URL(raw);
-    return url.protocol === "http:" || url.protocol === "https:";
-  } catch {
-    return false;
-  }
+function dropsEntry(findings, index) {
+  const fatal = /* @__PURE__ */ new Set([pathOf(index), pathOf(index, "id"), pathOf(index, "entryUrl")]);
+  return findings.some(
+    (finding) => finding.level === "error" && finding.path !== void 0 && fatal.has(finding.path)
+  );
 }
 function isRenderableDate(raw) {
   return typeof raw === "string" && !Number.isNaN(new Date(raw).getTime());
@@ -3734,20 +4112,24 @@ function validateCatalog(catalog, known = KNOWN_CAPABILITIES) {
     ];
   }
   const findings = [];
-  const seen = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Map();
   for (const [index, entry] of catalog.entries()) {
-    findings.push(...validateEntry(entry, index, known));
-    const id = isPlainObject(entry) ? entry["id"] : void 0;
-    if (typeof id === "string" && id.length > 0) {
-      if (seen.has(id)) {
-        findings.push({
-          level: "warning",
-          code: "catalog.id.duplicate",
-          message: `${pathOf(index, "id")} repeats "${id}". The host keeps the first entry with an id and drops the rest.`,
-          path: pathOf(index, "id")
-        });
-      }
-      seen.add(id);
+    const own = validateEntry(entry, index, known);
+    findings.push(...own);
+    if (!isPlainObject(entry) || dropsEntry(own, index)) {
+      continue;
+    }
+    const id = entry["id"];
+    const first = seen.get(id);
+    if (first === void 0) {
+      seen.set(id, index);
+    } else {
+      findings.push({
+        level: "warning",
+        code: "catalog.id.duplicate",
+        message: `${pathOf(index, "id")} repeats "${id}" from ${pathOf(first)}. The host keeps the first usable entry with an id and drops this one.`,
+        path: pathOf(index, "id")
+      });
     }
   }
   return findings;
@@ -3758,26 +4140,100 @@ var RUNTIME_NOTE = "Grants, access and the window decide what is finally offered
 function validateCommands(sources, ts) {
   const findings = [];
   for (const source of sources) {
-    const file = ts.createSourceFile(source.path, source.text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+    const file = ts.createSourceFile(source.path, source.text, ts.ScriptTarget.Latest, true, scriptKind(ts, source.path));
+    const constants = stringConstants(ts, file);
     for (const call of registerCommandCalls(ts, file)) {
-      findings.push(...findingsFor(readRegistration(ts, file, call)));
+      findings.push(...findingsFor(readRegistration(ts, file, call, constants)));
     }
   }
   findings.push({ level: "info", code: "commands.runtime", message: RUNTIME_NOTE });
   return findings;
 }
+var REGISTER = "registerCommand";
+function scriptKind(ts, path) {
+  if (/\.[cm]?js$/.test(path)) {
+    return ts.ScriptKind.JS;
+  }
+  if (path.endsWith(".jsx")) {
+    return ts.ScriptKind.JSX;
+  }
+  return path.endsWith(".tsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS;
+}
+function walk(ts, file, visit) {
+  const step = (node) => {
+    visit(node);
+    ts.forEachChild(node, step);
+  };
+  step(file);
+}
+function stringConstants(ts, file) {
+  const constants = /* @__PURE__ */ new Map();
+  walk(ts, file, (node) => {
+    if (ts.isVariableDeclarationList(node) && (node.flags & ts.NodeFlags.Const) !== 0) {
+      for (const declaration of node.declarations) {
+        const value = unwrapped(ts, declaration.initializer);
+        if (ts.isIdentifier(declaration.name) && value && ts.isStringLiteralLike(value)) {
+          constants.set(declaration.name.text, value.text);
+        }
+      }
+    }
+  });
+  return constants;
+}
+function registerAliases(ts, file) {
+  const aliases = /* @__PURE__ */ new Set([REGISTER]);
+  walk(ts, file, (node) => {
+    if (ts.isBindingElement(node) && ts.isIdentifier(node.name)) {
+      const property = node.propertyName ?? node.name;
+      if (ts.isIdentifier(property) && property.text === REGISTER) {
+        aliases.add(node.name.text);
+      }
+    }
+    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && namesRegister(ts, node.initializer)) {
+      aliases.add(node.name.text);
+    }
+  });
+  return aliases;
+}
+function namesRegister(ts, value) {
+  let target = unwrapped(ts, value);
+  while (target && ts.isCallExpression(target) && ts.isPropertyAccessExpression(target.expression) && target.expression.name.text === "bind") {
+    target = unwrapped(ts, target.expression.expression);
+  }
+  return !!target && ts.isPropertyAccessExpression(target) && target.name.text === REGISTER;
+}
 function registerCommandCalls(ts, file) {
+  const aliases = registerAliases(ts, file);
   const calls = [];
-  const visit = (node) => {
-    if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) && node.expression.name.text === "registerCommand") {
+  walk(ts, file, (node) => {
+    if (!ts.isCallExpression(node)) {
+      return;
+    }
+    const callee = node.expression;
+    if (ts.isPropertyAccessExpression(callee) && callee.name.text === REGISTER || ts.isIdentifier(callee) && aliases.has(callee.text)) {
       calls.push(node);
     }
-    ts.forEachChild(node, visit);
-  };
-  visit(file);
+  });
   return calls;
 }
-function readRegistration(ts, file, call) {
+function stringOf(ts, value, constants) {
+  const node = unwrapped(ts, value);
+  if (!node) {
+    return void 0;
+  }
+  if (ts.isStringLiteralLike(node)) {
+    return node.text;
+  }
+  return ts.isIdentifier(node) ? constants.get(node.text) : void 0;
+}
+function isDeclared(ts, value) {
+  const node = unwrapped(ts, value);
+  if (!node) {
+    return false;
+  }
+  return !(ts.isIdentifier(node) && node.text === "undefined" || ts.isVoidExpression(node));
+}
+function readRegistration(ts, file, call, constants) {
   const line = file.getLineAndCharacterOfPosition(call.getStart(file)).line + 1;
   const at = `${file.fileName}:${line}`;
   const literal = call.arguments[0];
@@ -3792,31 +4248,28 @@ function readRegistration(ts, file, call) {
     }
     if (ts.isPropertyAssignment(property) && (ts.isIdentifier(property.name) || ts.isStringLiteral(property.name))) {
       properties.set(property.name.text, property.initializer);
+    } else if (ts.isShorthandPropertyAssignment(property)) {
+      properties.set(property.name.text, property.name);
     } else if (ts.isMethodDeclaration(property) && ts.isIdentifier(property.name)) {
       properties.set(property.name.text, property);
     }
   }
-  const id = properties.get("id");
-  if (!id || !ts.isStringLiteral(id)) {
-    return { ...empty, unreadable: "its id is not a string literal" };
+  const id = stringOf(ts, properties.get("id"), constants);
+  if (id === void 0) {
+    return { ...empty, unreadable: "its id is neither a string literal nor a string constant declared in the file" };
   }
-  const callable = properties.get("callable");
-  const consent = properties.get("agentConsent");
+  const consent = stringOf(ts, properties.get("agentConsent"), constants);
   return {
     at,
-    id: id.text,
-    callable: callable?.kind === ts.SyntaxKind.TrueKeyword,
-    described: properties.has("description"),
-    answers: properties.has("answers"),
+    id,
+    callable: unwrapped(ts, properties.get("callable"))?.kind === ts.SyntaxKind.TrueKeyword,
+    described: isDeclared(ts, properties.get("description")),
+    answers: isDeclared(ts, properties.get("answers")),
     returnsValue: returnsValue(ts, properties.get("run")),
-    arguments: readArguments(ts, properties.get("arguments")),
-    ...consentOf(ts, consent)
+    arguments: readArguments(ts, properties.get("arguments"), constants),
+    ...consent !== void 0 && { agentConsent: consent }
   };
 }
-function consentOf(ts, declared) {
-  const value = unwrapped(ts, declared);
-  return value && ts.isStringLiteral(value) ? { agentConsent: value.text } : {};
-}
 function unwrapped(ts, value) {
   if (!value) {
     return void 0;
@@ -3845,7 +4298,8 @@ function consentLine(consent) {
   }
   return CONSENT_LINES.get(consent) ?? `declares "${consent}" about an agent's word, which is none of ${STATED_CONSENTS.join(", ")}, so nothing reads it.`;
 }
-function readArguments(ts, value) {
+function readArguments(ts, declared, constants) {
+  const value = unwrapped(ts, declared);
   if (!value || !ts.isArrayLiteralExpression(value)) {
     return [];
   }
@@ -3859,17 +4313,17 @@ function readArguments(ts, value) {
       if (!ts.isPropertyAssignment(property) || !ts.isIdentifier(property.name)) {
         continue;
       }
-      if (property.name.text === "name" && ts.isStringLiteral(property.initializer)) {
-        name = property.initializer.text;
-      }
-      if (property.name.text === "description") {
-        described = true;
+      if (property.name.text === "name") {
+        name = stringOf(ts, property.initializer, constants) ?? name;
+      } else if (property.name.text === "description") {
+        described = isDeclared(ts, property.initializer);
       }
     }
     return { name, described };
   });
 }
-function returnsValue(ts, run2) {
+function returnsValue(ts, declared) {
+  const run2 = unwrapped(ts, declared);
   if (!run2) {
     return false;
   }
@@ -3979,32 +4433,20 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, relative, resolve as resolve2, sep } from "node:path";
 
 // src/lib/angular-config.ts
-function asObject2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
-}
 function buildProjects(config) {
-  const projects = asObject2(asObject2(config)?.["projects"]) ?? {};
+  const projects = asObject(asObject(config)?.["projects"]) ?? {};
   return Object.entries(projects).filter(([, project]) => buildTargetIn(project) !== void 0).map(([name, project]) => ({
     name,
-    root: normaliseRoot(asObject2(project)?.["root"]),
-    prefix: declaredPrefix(asObject2(project)?.["prefix"])
+    root: normaliseRoot(asObject(project)?.["root"]),
+    prefix: declaredPrefix(asObject(project)?.["prefix"])
   }));
 }
 function buildTargetOf(config, project) {
-  return buildTargetIn(asObject2(asObject2(config)?.["projects"])?.[project]);
-}
-function entryStylesheetOf(target) {
-  const styles = asObject2(asObject2(target)?.["options"])?.["styles"];
-  if (!Array.isArray(styles)) {
-    return void 0;
-  }
-  return styles.map((style) => typeof style === "string" ? style : asObject2(style)?.["input"]).find(
-    (input) => typeof input === "string" && input.endsWith(".css")
-  );
+  return buildTargetIn(asObject(asObject(config)?.["projects"])?.[project]);
 }
 function buildTargetIn(project) {
   for (const key of ["architect", "targets"]) {
-    const targets = asObject2(asObject2(project)?.[key]);
+    const targets = asObject(asObject(project)?.[key]);
     if (targets?.["build"] !== void 0) {
       return {
         value: targets["build"],
@@ -4247,7 +4689,7 @@ import { basename, join, relative as relative3, sep as sep2 } from "node:path";
 var SKIPPED = /* @__PURE__ */ new Set(["node_modules", "dist", "tmp", "coverage"]);
 function nxApplications(workspaceRoot) {
   const found = [];
-  const walk = (folder) => {
+  const walk2 = (folder) => {
     const project = join(folder, "project.json");
     if (existsSync2(project)) {
       const config = readJsonFile(project);
@@ -4263,10 +4705,10 @@ function nxApplications(workspaceRoot) {
       if (!entry.isDirectory() || SKIPPED.has(entry.name) || entry.name.startsWith(".")) {
         continue;
       }
-      walk(join(folder, entry.name));
+      walk2(join(folder, entry.name));
     }
   };
-  walk(workspaceRoot);
+  walk2(workspaceRoot);
   return found.toSorted((a, b) => a.name.localeCompare(b.name));
 }
 
@@ -4328,10 +4770,12 @@ function runScriptCommand(manager, script) {
 }
 
 // src/lib/init/init-plan.ts
-var RUNTIME_PACKAGES = [
+var PLATFORM_PACKAGES = [
   "@loomweaver/shell",
   "@loomweaver/plugin-sdk",
-  "@loomweaver/frame-kit",
+  "@loomweaver/frame-kit"
+];
+var PEER_PACKAGES = [
   "@angular/cdk",
   "@jsverse/transloco",
   "@ng-icons/heroicons"
@@ -4358,6 +4802,12 @@ function planInit(args, deps) {
   const app = workspace.kind === "nx" ? chooseApplication(workspace.root, stringFlag(args, "app")) : void 0;
   const name = app?.name ?? packageNameToId(manifest2.name ?? basename2(workspace.root));
   const styles = stringFlag(args, "styles") ?? "tailwind";
+  const title = stringFlag(args, "title") ?? toTitleCase(name);
+  const weaver = weaverId(args);
+  resolveDistributionInput({ name, title, styles });
+  if (weaver !== void 0) {
+    resolveWeaverInput({ id: weaver });
+  }
   const declared = { ...manifest2.dependencies, ...manifest2.devDependencies };
   const missing = (names) => names.filter((candidate) => !Object.hasOwn(declared, candidate));
   return {
@@ -4365,16 +4815,17 @@ function planInit(args, deps) {
     manager: override ?? detected.manager,
     lockfile: override ? void 0 : detected.lockfile,
     name,
-    title: stringFlag(args, "title") ?? toTitleCase(name),
+    title,
     styles,
-    weaver: weaverId(args),
+    weaver,
     runtime: [
-      ...missing(RUNTIME_PACKAGES),
+      ...missing(PLATFORM_PACKAGES).map((pkg) => platformSpec(pkg, deps.version)),
+      ...missing(PEER_PACKAGES),
       ...Object.hasOwn(declared, SERVICE_WORKER) ? [] : [serviceWorkerSpec(workspace.root, manifest2)]
     ],
     dev: [
       ...styles === "tailwind" ? missing(STYLE_PACKAGES) : [],
-      ...workspace.kind === "nx" && !Object.hasOwn(declared, NX_COLLECTION) ? [collectionSpec(deps.version)] : []
+      ...workspace.kind === "nx" && !Object.hasOwn(declared, NX_COLLECTION) ? [platformSpec(NX_COLLECTION, deps.version)] : []
     ],
     app,
     dryRun: boolFlag(args, "dry-run") === true
@@ -4430,8 +4881,8 @@ function serviceWorkerSpec(root, manifest2) {
   const declared = manifest2.dependencies?.["@angular/core"];
   return declared ? `${SERVICE_WORKER}@${declared}` : SERVICE_WORKER;
 }
-function collectionSpec(version) {
-  return version === UNBUNDLED_VERSION ? `${NX_COLLECTION}@latest` : `${NX_COLLECTION}@${version}`;
+function platformSpec(name, version) {
+  return `${name}@${version === UNBUNDLED_VERSION ? "latest" : version}`;
 }
 function packageNameToId(value) {
   const unscoped = value.includes("/") ? value.slice(value.lastIndexOf("/") + 1) : value;
@@ -4673,7 +5124,7 @@ var AmendLog = class {
 
 // src/lib/scaffold/project-wiring.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4 } from "node:fs";
-import { dirname as dirname2, posix, resolve as resolve6 } from "node:path";
+import { dirname as dirname2, posix as posix4, resolve as resolve6 } from "node:path";
 var ProjectWiring = class {
   constructor(workspace, target, log) {
     this.workspace = workspace;
@@ -4686,6 +5137,7 @@ var ProjectWiring = class {
   configAdded = [];
   config;
   projectResolved = false;
+  pendingCss = /* @__PURE__ */ new Map();
   project;
   plan(amendment) {
     const project = this.resolveProject();
@@ -4701,8 +5153,16 @@ var ProjectWiring = class {
         this.planStylesheetSource(amendment, project);
         return;
       }
+      case "stylesheet-import": {
+        this.planStylesheetImport(amendment, project);
+        return;
+      }
       case "compose-plugin": {
         this.planComposePlugin(amendment, project);
+        return;
+      }
+      case "compose-provider": {
+        this.planComposeProviders(amendment, project);
       }
     }
   }
@@ -4745,7 +5205,7 @@ var ProjectWiring = class {
     if (!usesTailwind(css)) {
       return;
     }
-    const source = posix.relative(this.log.displayName(dirname2(entry)), amendment.sourceRoot) || ".";
+    const source = posix4.relative(this.log.displayName(dirname2(entry)), amendment.sourceRoot) || ".";
     const next = ensureStylesheetSource(css, source);
     if (next === css) {
       return;
@@ -4780,9 +5240,58 @@ var ProjectWiring = class {
       [
         `${amendment.symbol}, its translations and its capability grants`,
         ...(amendment.providers ?? []).filter((provider) => !result.kept.includes(provider.line)).map((provider) => provider.line.replace(/,$/, "")),
-        ...result.kept.map(
-          (line) => `kept the ${line.split("(", 1)[0]} already there instead of ${line.replace(/,$/, "")}`
-        )
+        ...result.kept.map((line) => keptNote(line))
+      ],
+      result.source
+    );
+  }
+  planStylesheetImport(amendment, project) {
+    const entry = this.entryStylesheet(project);
+    if (!entry || !existsSync6(entry)) {
+      this.log.note(
+        `No entry stylesheet is wired for ${project.name}, so add it yourself: ${describeAmendment(amendment)}`
+      );
+      return;
+    }
+    const css = this.pendingCss.get(entry) ?? readFileSync4(entry, "utf8");
+    const displayed = this.log.displayName(entry);
+    const result = ensureStylesheetImport(
+      css,
+      importSpecifier(displayed, amendment.file),
+      amendment.after
+    );
+    if (!result.anchored) {
+      this.log.note(
+        `${displayed} does not import ${amendment.after}, so ${amendment.file} was imported after its last import instead; check that it still comes after the shell's styles.`
+      );
+    }
+    if (result.css === css) {
+      return;
+    }
+    this.pendingCss.set(entry, result.css);
+    this.log.plan(entry, [`@import '${importSpecifier(displayed, amendment.file)}'`], result.css);
+  }
+  planComposeProviders(amendment, project) {
+    const root = resolve6(this.workspace.root, project.root, "src/app/app.config.ts");
+    const importPath = moduleImport(this.log.displayName(dirname2(root)), amendment.module);
+    const source = existsSync6(root) ? readFileSync4(root, "utf8") : void 0;
+    const result = source === void 0 ? void 0 : composeProviders(source, amendment, importPath);
+    if (!result?.composed) {
+      this.log.note(
+        `The composition root no longer presents the shape this scaffold generated, so these were NOT added. ${amendment.without} Add them yourself: ${providerLines(amendment, importPath).join(" ")}`
+      );
+      return;
+    }
+    const kept = result.kept.map((line) => keptNote(line));
+    if (result.source === source) {
+      this.log.note(...kept.map((note) => `${note}; replace it to use the generated one.`));
+      return;
+    }
+    this.log.plan(
+      root,
+      [
+        ...amendment.providers.filter((provider) => !result.kept.includes(provider.line)).map((provider) => provider.line.replace(/,$/, "")),
+        ...kept
       ],
       result.source
     );
@@ -4799,37 +5308,20 @@ var ProjectWiring = class {
     return this.project;
   }
   readConfig() {
-    this.config ??= asObject2(readJsonFile(this.workspace.configFile)) ?? {};
+    this.config ??= asObject(readJsonFile(this.workspace.configFile)) ?? {};
     return this.config;
   }
   entryStylesheet(project) {
-    const entry = entryStylesheetOf(
-      buildTargetOf(this.readConfig(), project.name)?.value
-    );
+    const target = buildTargetOf(this.readConfig(), project.name)?.value;
+    const entry = entryStylesheet(asObject(asObject(target)?.["options"])?.["styles"]);
     return entry === void 0 ? void 0 : resolve6(this.workspace.root, entry);
   }
 };
 function composeNote(amendment, importPath) {
   return `The composition root no longer presents the shape this scaffold generated, so ${amendment.id} was NOT registered and none of its contributions will appear. Add these to it yourself: ` + composeLines(amendment, importPath).join(" ");
 }
-function usesTailwind(css) {
-  return css.split("\n").some((line) => {
-    const directive = line.trimStart();
-    return /^@import\s+['"]tailwindcss['"]/.test(directive) || /^@source\s/.test(directive);
-  });
-}
-function relativeImport(fromDir, sourceRoot) {
-  const path = posix.relative(fromDir, sourceRoot);
-  return path.startsWith(".") ? path : `./${path}`;
-}
 
 // src/lib/scaffold/amend.ts
-var JS_POSTCSS_CONFIGS = [
-  "postcss.config.js",
-  "postcss.config.mjs",
-  "postcss.config.cjs",
-  ".postcssrc.js"
-];
 function planAmend(amendments2, target) {
   if (amendments2.length === 0) {
     return { amendments: [], remaining: [] };
@@ -4894,13 +5386,12 @@ var Amender = class {
     this.wiring.plan(amendment);
   }
   planPostcss(amendment) {
-    const inTheWay = JS_POSTCSS_CONFIGS.find(
-      (name) => existsSync7(resolve7(this.workspace.root, name))
+    const writtenAsCode = postcssWrittenAsCode(
+      (name) => existsSync7(resolve7(this.workspace.root, name)),
+      amendment
     );
-    if (inTheWay) {
-      this.log.note(
-        `${inTheWay} is written as code and cannot be merged into, so add ${amendment.plugin} to it yourself; until then the stylesheet emits no utility class and the workbench renders unstyled.`
-      );
+    if (writtenAsCode) {
+      this.log.note(writtenAsCode);
       return;
     }
     const file = resolve7(this.workspace.root, amendment.file);
@@ -5027,14 +5518,10 @@ function reportAmendments(io, amend, done) {
     }
   }
 }
+var SCAFFOLD_FLAGS = ["out", "dry-run", "force"];
 function scaffold(args, io) {
   const descriptor = findScaffold2(args.command);
-  rejectUnknownFlags(args, [
-    ...allowedFlagsFor(descriptor),
-    "out",
-    "dry-run",
-    "force"
-  ]);
+  rejectUnknownFlags(args, [...allowedFlagsFor(descriptor), ...SCAFFOLD_FLAGS]);
   const values = scaffoldValues(descriptor, args);
   const files = descriptor.build(values);
   const out = stringFlag(args, "out") ?? ".";
@@ -5093,8 +5580,14 @@ function reportFindings(io, findings, strict) {
   }
   return strict && gating.length > 0 ? 1 : 0;
 }
+var VALIDATE_FLAGS = {
+  "validate-manifest": ["id", "name", "capabilities", "strict"],
+  "validate-i18n": ["dir", "strict"],
+  "validate-commands": ["dir", "strict"],
+  "validate-catalog": ["file", "strict"]
+};
 function validateManifestCommand(args, io) {
-  rejectUnknownFlags(args, ["id", "name", "capabilities", "strict"]);
+  rejectUnknownFlags(args, VALIDATE_FLAGS["validate-manifest"]);
   const capabilities = (stringFlag(args, "capabilities") ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
   return reportFindings(
     io,
@@ -5127,40 +5620,45 @@ function readBundles(dir) {
   return bundles;
 }
 function validateI18nCommand(args, io) {
-  rejectUnknownFlags(args, ["dir", "strict"]);
+  rejectUnknownFlags(args, VALIDATE_FLAGS["validate-i18n"]);
   return reportFindings(
     io,
     validateI18nParity(readBundles(requiredFlag(args, "dir"))),
     boolFlag(args, "strict") === true
   );
 }
+var SOURCE = /\.(?:[cm]?[jt]s|[jt]sx)$/;
+var NOT_SOURCE = /\.(?:d|spec|test)\.[cm]?[jt]sx?$/;
+function isCommandSource(name) {
+  return SOURCE.test(name) && !NOT_SOURCE.test(name);
+}
 function readSources(dir) {
   const sources = [];
-  const walk = (folder) => {
+  const walk2 = (folder) => {
     for (const entry of readdirSync2(folder, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === "dist" || entry.name.startsWith(".")) {
         continue;
       }
       const path = join4(folder, entry.name);
       if (entry.isDirectory()) {
-        walk(path);
-      } else if (entry.name.endsWith(".ts") && !entry.name.endsWith(".d.ts") && !entry.name.endsWith(".spec.ts")) {
+        walk2(path);
+      } else if (isCommandSource(entry.name)) {
         sources.push({ path, text: readFileSync5(path, "utf8") });
       }
     }
   };
   try {
-    walk(dir);
+    walk2(dir);
   } catch (error) {
     throw new ArgError(`Cannot read ${dir}: ${error.message}`);
   }
   if (sources.length === 0) {
-    throw new ArgError(`No TypeScript sources found under ${dir}.`);
+    throw new ArgError(`No TypeScript or JavaScript sources found under ${dir}.`);
   }
   return sources;
 }
 function validateCommandsCommand(args, io) {
-  rejectUnknownFlags(args, ["dir", "strict"]);
+  rejectUnknownFlags(args, VALIDATE_FLAGS["validate-commands"]);
   const dir = requiredFlag(args, "dir");
   const ts = loadTypeScript(dir);
   if (!ts) {
@@ -5190,7 +5688,7 @@ function readCatalog(file) {
   }
 }
 function validateCatalogCommand(args, io) {
-  rejectUnknownFlags(args, ["file", "strict"]);
+  rejectUnknownFlags(args, VALIDATE_FLAGS["validate-catalog"]);
   return reportFindings(
     io,
     validateCatalog(readCatalog(requiredFlag(args, "file"))),
@@ -5199,7 +5697,7 @@ function validateCatalogCommand(args, io) {
 }
 
 // src/lib/run.ts
-var VERSION = "0.16.0";
+var VERSION = "0.17.1";
 var COMMANDS = /* @__PURE__ */ new Map([
   ["init", init],
   ["list", list],