@rpgm-tools/neo-angband-mod-sdk 0.25.0 → 0.26.0

package/dist/capabilities.d.ts

@@ -131,6 +131,70 @@
  *                             write to it succeeded or failed. Its own kind,
  *                             like "display:replace" - there is nothing to
  *                             range over, so it has no wildcard either.
+ *  - "mod:install"         - install a CONTENT mod from archive bytes the mod
+ *                             holds in memory, through the same door the
+ *                             player's own zip import uses. Its own kind, like
+ *                             "display:replace": there is nothing to range over,
+ *                             so it has no wildcard. Two things bound it, and
+ *                             they are what make it proportionate rather than
+ *                             total. An archive that ships CODE, or whose
+ *                             manifest asks for any capability, is refused - so
+ *                             this grants "may add records to my library", not
+ *                             "may write and deploy a program". And an install
+ *                             is not an ENABLE: what arrives is switched off, and
+ *                             the player is shown its own capability list before
+ *                             any of it runs, which is what stops one grant
+ *                             turning into every grant.
+ *  - "mod:session"         - load a CONTENT mod into this session only, so it
+ *                             composes into the game on the next reload and is
+ *                             gone with the window. Bounded exactly as
+ *                             "mod:install" is - code and capability requests are
+ *                             refused - and deliberately NOT the same grant, since
+ *                             an install waits to be switched on and this does not.
+ *                             `grantCovers` compares the action so neither can be
+ *                             sold under the other's sentence. It is a shorter
+ *                             LIFETIME for the archive and not a smaller reach for
+ *                             the records: what composes, composes.
+ *  - "debug:spawn"         - conjure an item or a creature into the live game the
+ *                             way the debug commands do. Its own kind and no
+ *                             wildcard, and here that is the whole point rather
+ *                             than a consequence of there being one string: this
+ *                             is the grant a player is most likely to want to
+ *                             check for by name, so it must never arrive as part
+ *                             of something broader. What it adds over what a
+ *                             plugin can already reach through `ctx.core` is not
+ *                             the ability - `wizCreateObj` and friends take a
+ *                             `debug` flag the CALLER supplies - but the mark: the
+ *                             character is asked about and flagged, through the
+ *                             game's own confirmation and before anything is
+ *                             placed, so "the debug commands cannot be scored"
+ *                             stays true with a mod in the picture.
+ *  - "debug:wizard"        - drive the WHOLE debug set, not just the two spawns:
+ *                             depth, experience, gold, stats, acquirement,
+ *                             mapping. Its own action beside "spawn" rather than a
+ *                             wider reading of it, because the two cost the player
+ *                             different things. Spawning happens to the character
+ *                             they are playing and costs them the score. This one
+ *                             refuses to run until the session has been cut loose
+ *                             from its save slot - one way, checked by the host on
+ *                             every call - so it costs them the session and leaves
+ *                             the character on disk untouched. Neither is a
+ *                             superset of the other and `grantCovers` compares the
+ *                             action, so one consent cannot buy both.
+ *  - "ui:panel.mount"      - draw with real HTML instead of the character grid: a
+ *                             panel of the mod's own, mounted on the page above
+ *                             the game. A THIRD "ui:" action, and the reason it is
+ *                             not a third region name is the same reason
+ *                             "ui:region.create" is not a seventh: the sentence a
+ *                             player agrees to is different. "replace" hands over
+ *                             something the game draws, "create" adds a rectangle
+ *                             of the game's own character grid, and this one puts
+ *                             a piece of web page on top - which can look like the
+ *                             game's own interface, style anything inside itself,
+ *                             and read what the player types into it. No wildcard,
+ *                             and "ui:*.replace" does not cover it: `grantCovers`
+ *                             compares the action, so a mod that may redraw the
+ *                             vitals still cannot mount a panel without asking.
  *  - "ui:region.create"    - ADD a rectangle of your own to the player's screen
  *                             (ModPlugin.regions), rather than take one of the
  *                             game's. The only "ui:" capability whose ACTION is
@@ -176,10 +240,16 @@ export type ParsedCapability = {
 } | {
     kind: "ui";
     region: string;
-    action: "replace" | "create";
+    action: "replace" | "create" | "mount";
 } | {
     kind: "backup";
     action: "folder";
+} | {
+    kind: "mod";
+    action: "install" | "session";
+} | {
+    kind: "debug";
+    action: "spawn" | "wizard";
 };
 /**
  * Parse and validate a capability string against the vocabulary above,

package/dist/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuJG;AAEH,OAAO,EAAY,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAE5D,qBAAa,eAAgB,SAAQ,KAAK;CAAG;AAE7C,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,KAAK,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AA6CzC;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CA8C7D;AAiED;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAE1C,OAAO;IAUP;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,aAAa;IAgB1D;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAKzB;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAOxB,0EAA0E;IAC1E,kBAAkB,IAAI,OAAO;IAI7B,6DAA6D;IAC7D,iBAAiB,IAAI,OAAO;CAG7B"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuNG;AAEH,OAAO,EAAY,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAE5D,qBAAa,eAAgB,SAAQ,KAAK;CAAG;AAE7C,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,KAAK,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAA;CAAE,CAAC;AAyElD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CA2F7D;AAoFD;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAE1C,OAAO;IAUP;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,aAAa;IAgB1D;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAKzB;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAOxB,0EAA0E;IAC1E,kBAAkB,IAAI,OAAO;IAI7B,6DAA6D;IAC7D,iBAAiB,IAAI,OAAO;CAG7B"}

package/dist/capabilities.js

@@ -131,6 +131,70 @@
  *                             write to it succeeded or failed. Its own kind,
  *                             like "display:replace" - there is nothing to
  *                             range over, so it has no wildcard either.
+ *  - "mod:install"         - install a CONTENT mod from archive bytes the mod
+ *                             holds in memory, through the same door the
+ *                             player's own zip import uses. Its own kind, like
+ *                             "display:replace": there is nothing to range over,
+ *                             so it has no wildcard. Two things bound it, and
+ *                             they are what make it proportionate rather than
+ *                             total. An archive that ships CODE, or whose
+ *                             manifest asks for any capability, is refused - so
+ *                             this grants "may add records to my library", not
+ *                             "may write and deploy a program". And an install
+ *                             is not an ENABLE: what arrives is switched off, and
+ *                             the player is shown its own capability list before
+ *                             any of it runs, which is what stops one grant
+ *                             turning into every grant.
+ *  - "mod:session"         - load a CONTENT mod into this session only, so it
+ *                             composes into the game on the next reload and is
+ *                             gone with the window. Bounded exactly as
+ *                             "mod:install" is - code and capability requests are
+ *                             refused - and deliberately NOT the same grant, since
+ *                             an install waits to be switched on and this does not.
+ *                             `grantCovers` compares the action so neither can be
+ *                             sold under the other's sentence. It is a shorter
+ *                             LIFETIME for the archive and not a smaller reach for
+ *                             the records: what composes, composes.
+ *  - "debug:spawn"         - conjure an item or a creature into the live game the
+ *                             way the debug commands do. Its own kind and no
+ *                             wildcard, and here that is the whole point rather
+ *                             than a consequence of there being one string: this
+ *                             is the grant a player is most likely to want to
+ *                             check for by name, so it must never arrive as part
+ *                             of something broader. What it adds over what a
+ *                             plugin can already reach through `ctx.core` is not
+ *                             the ability - `wizCreateObj` and friends take a
+ *                             `debug` flag the CALLER supplies - but the mark: the
+ *                             character is asked about and flagged, through the
+ *                             game's own confirmation and before anything is
+ *                             placed, so "the debug commands cannot be scored"
+ *                             stays true with a mod in the picture.
+ *  - "debug:wizard"        - drive the WHOLE debug set, not just the two spawns:
+ *                             depth, experience, gold, stats, acquirement,
+ *                             mapping. Its own action beside "spawn" rather than a
+ *                             wider reading of it, because the two cost the player
+ *                             different things. Spawning happens to the character
+ *                             they are playing and costs them the score. This one
+ *                             refuses to run until the session has been cut loose
+ *                             from its save slot - one way, checked by the host on
+ *                             every call - so it costs them the session and leaves
+ *                             the character on disk untouched. Neither is a
+ *                             superset of the other and `grantCovers` compares the
+ *                             action, so one consent cannot buy both.
+ *  - "ui:panel.mount"      - draw with real HTML instead of the character grid: a
+ *                             panel of the mod's own, mounted on the page above
+ *                             the game. A THIRD "ui:" action, and the reason it is
+ *                             not a third region name is the same reason
+ *                             "ui:region.create" is not a seventh: the sentence a
+ *                             player agrees to is different. "replace" hands over
+ *                             something the game draws, "create" adds a rectangle
+ *                             of the game's own character grid, and this one puts
+ *                             a piece of web page on top - which can look like the
+ *                             game's own interface, style anything inside itself,
+ *                             and read what the player types into it. No wildcard,
+ *                             and "ui:*.replace" does not cover it: `grantCovers`
+ *                             compares the action, so a mod that may redraw the
+ *                             vitals still cannot mount a panel without asking.
  *  - "ui:region.create"    - ADD a rectangle of your own to the player's screen
  *                             (ModPlugin.regions), rather than take one of the
  *                             game's. The only "ui:" capability whose ACTION is
@@ -190,6 +254,34 @@ const UI_RE = /^ui:(\*|messages|sidebar|status|menu|screen)\.replace$/;
  * the note there.
  */
 const UI_CREATE_RE = /^ui:region\.create$/;
+/**
+ * `ui:panel.mount` - draw with real HTML instead of the character grid.
+ *
+ * A THIRD ACTION, for the same reason `create` was a second one rather than a
+ * seventh region name: what the player is agreeing to is a different sentence.
+ * `replace` hands a mod something the game already draws. `create` gives it a
+ * rectangle of the game's own character grid, painted with the same seven
+ * methods every other surface has. This one puts a piece of WEB PAGE above the
+ * game - arbitrary markup and styling, which can be made to look exactly like
+ * the game's own interface, and which can hold a real text field and read what
+ * is typed into it.
+ *
+ * NO WILDCARD, for the reason `create` has none: a mod either may mount panels
+ * or it may not, and there is no set of panel names to range over, because a
+ * panel does not exist until the mod asks for one.
+ *
+ * AND `ui:*.replace` MUST NOT COVER IT. `grantCovers` compares the action as
+ * well as the region, so this holds by construction rather than by a rule
+ * somebody has to remember - which is exactly what that comparison was added
+ * for when `create` arrived.
+ *
+ * WHAT IT IS NOT. It is not a containment boundary and this module's header
+ * already says why: a plugin's code runs in the page's own realm and can reach
+ * the document with no capability at all. What this grant buys is a panel the
+ * HOST owns - one it can place, stack, take the keyboard back from and close -
+ * plus a sentence the player reads before any of it happens.
+ */
+const UI_MOUNT_RE = /^ui:panel\.mount$/;
 const STATE_RE = /^state:(\*|[a-z][a-z0-9-]*)\.read$/;
 const NETWORK_RE = /^network:(\*|[a-zA-Z0-9.-]+)$/;
 /** The override domains ModRegistryHost gates, plus the "*" wildcard. */
@@ -220,6 +312,45 @@ export function parseCapability(cap) {
     if (cap === "backup:folder") {
         return { kind: "backup", action: "folder" };
     }
+    /* "mod:install": hand archive bytes to the same install door the player's own
+     * zip import uses. Its own kind and no wildcard, same reasoning as the two
+     * above. What bounds it is not this grammar - it is that the door refuses an
+     * archive carrying code or asking for capabilities, and that installing is not
+     * enabling, so what arrives is consented to on its own terms before it runs. */
+    if (cap === "mod:install") {
+        return { kind: "mod", action: "install" };
+    }
+    /* "mod:session": load content into THIS session only, without it joining the
+     * library. Bounded the same way `mod:install` is - the door refuses an archive
+     * carrying code or asking for capabilities - and separated from it because the
+     * two say different things to a player. An install arrives switched OFF and waits
+     * to be turned on; a session load is on for the rest of the session as soon as
+     * the game reloads. That is more, not less, so it cannot be sold under the other
+     * one's sentence: `grantCovers` compares the action for exactly that reason. */
+    if (cap === "mod:session") {
+        return { kind: "mod", action: "session" };
+    }
+    /* "debug:spawn": put an item or a creature into the live game the way the debug
+     * commands do, marking the character the way they do. Its own kind and no
+     * wildcard on purpose - a player asking "which of my mods can conjure things"
+     * must be able to read the answer off one line, and no broader grant may ever
+     * carry this one along. */
+    if (cap === "debug:spawn") {
+        return { kind: "debug", action: "spawn" };
+    }
+    /* "debug:wizard": drive the whole debug set - depth, experience, gold, stats,
+     * acquirement, mapping - and not just the two spawns. A separate string from
+     * "debug:spawn" because it is a separate bargain, not a bigger helping of the
+     * same one. Spawning acts on the character the player is actually playing, after
+     * the game's own question, and leaves them playing it. This one refuses to run
+     * at all until the session has been cut loose from its save slot, one way, so
+     * the character it happens to has already stopped being written to disk. Neither
+     * is a superset of the other - one costs the score, the other costs the session -
+     * so `grantCovers` compares the action and neither can be sold under the other's
+     * sentence. */
+    if (cap === "debug:wizard") {
+        return { kind: "debug", action: "wizard" };
+    }
     const ui = UI_RE.exec(cap);
     if (ui) {
         return { kind: "ui", region: ui[1], action: "replace" };
@@ -230,6 +361,12 @@ export function parseCapability(cap) {
     if (UI_CREATE_RE.test(cap)) {
         return { kind: "ui", region: "region", action: "create" };
     }
+    /* `panel` is the region NAME, on the same terms `region` is above: the literal
+     * the author wrote, so one `kind: "ui"` arm keeps one shape. `action` is what
+     * separates the three, and `grantCovers` compares it. */
+    if (UI_MOUNT_RE.test(cap)) {
+        return { kind: "ui", region: "panel", action: "mount" };
+    }
     const event = EVENT_RE.exec(cap);
     if (event) {
         return { kind: "event", name: event[1] };
@@ -278,6 +415,25 @@ function grantCovers(grant, request) {
             /* Exact match only, same reasoning as "display" - there is exactly one
              * backup capability and no wildcard grant could ever cover it. */
             return grant.kind === "backup";
+        case "mod":
+            /* THE ACTION IS COMPARED, not just the kind, and it is the #261 lesson
+             * applied before it could be re-learned here: `mod:install` puts a pack in
+             * the library switched off, `mod:session` switches one on for the rest of the
+             * session. Neither is a superset of the other, there is no wildcard, and a
+             * kind-only comparison would have let one consent buy both. */
+            return grant.kind === "mod" && grant.action === request.action;
+        case "debug":
+            /* Exact match only, and here that is the point rather than a consequence:
+             * this is the grant a player is most likely to check for by name, so it
+             * must never be reachable through anything wider.
+             *
+             * THE ACTION IS COMPARED, and until "debug:wizard" landed it was not - which
+             * was invisible while "spawn" was the only action, and would have been a real
+             * hole the moment a second one existed: a player who agreed to a mod
+             * conjuring one monster would have been granting it the depth jumps, the
+             * experience and the acquirement too. Exactly the #261 lesson, caught by
+             * adding the second action rather than by shipping it. */
+            return grant.kind === "debug" && grant.action === request.action;
         case "ui":
             /* Per region, with one wildcard. A `display` grant is NOT accepted here
              * and a `ui` grant is not accepted above: owning the dungeon and owning

package/dist/capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuJG;AAEH,OAAO,EAAE,QAAQ,EAAqB,MAAM,eAAe,CAAC;AAE5D,MAAM,OAAO,eAAgB,SAAQ,KAAK;CAAG;AAa7C,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAC7C;;;;;;;;;;;;GAYG;AACH,MAAM,KAAK,GAAG,wDAAwD,CAAC;AACvE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C,MAAM,QAAQ,GAAG,oCAAoC,CAAC;AACtD,MAAM,UAAU,GAAG,+BAA+B,CAAC;AACnD,yEAAyE;AACzE,MAAM,WAAW,GACf,iJAAiJ,CAAC;AAEpJ;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD;;;;+DAI2D;IAC3D,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IACD;;;oFAGgF;IAChF,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpE,CAAC;IACD;;uEAEmE;IACnE,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAW,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAW,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,6BAA6B,GAAG,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAuB,EAAE,OAAyB;IACrE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;QAClC,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC;QAC/D,KAAK,OAAO;YACV,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,OAAO;gBACtB,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAC/B,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAC1D,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CACpD,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,UAAU;gBACzB,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAC1D,CAAC;QACJ,KAAK,SAAS;YACZ;;wDAE4C;YAC5C,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;QAClC,KAAK,QAAQ;YACX;8EACkE;YAClE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;QACjC,KAAK,IAAI;YACP;;;;;;;;;;;;;;;;;6BAiBiB;YACjB,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,IAAI;gBACnB,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAC/B,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAC1D,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAa;IACP,MAAM,CAA8B;IACpC,gBAAgB,CAAU;IAC1B,eAAe,CAAU;IAE1C,YACE,MAAmC,EACnC,gBAAyB,EACzB,eAAwB;QAExB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CAAC,QAAsB;QACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,eAAe,CACvB,QAAQ,QAAQ,CAAC,EAAE,uDAAuD;gBACxE,wBAAwB,QAAQ,CAAC,KAAK,IAAI,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,OAAO,IAAI,aAAa,CACtB,MAAM,EACN,QAAQ,CAAC,gBAAgB,IAAI,KAAK,EAClC,QAAQ,CAAC,eAAe,IAAI,KAAK,CAClC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,GAAW;QACb,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAW;QACf,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,MAAM,IAAI,eAAe,CACvB,iCAAiC,GAAG,yCAAyC,CAC9E,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,kBAAkB;QAChB,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,6DAA6D;IAC7D,iBAAiB;QACf,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuNG;AAEH,OAAO,EAAE,QAAQ,EAAqB,MAAM,eAAe,CAAC;AAE5D,MAAM,OAAO,eAAgB,SAAQ,KAAK;CAAG;AAe7C,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAC7C;;;;;;;;;;;;GAYG;AACH,MAAM,KAAK,GAAG,wDAAwD,CAAC;AACvE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,QAAQ,GAAG,oCAAoC,CAAC;AACtD,MAAM,UAAU,GAAG,+BAA+B,CAAC;AACnD,yEAAyE;AACzE,MAAM,WAAW,GACf,iJAAiJ,CAAC;AAEpJ;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD;;;;+DAI2D;IAC3D,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IACD;;;oFAGgF;IAChF,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;IACD;;;;oFAIgF;IAChF,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD;;;;;;oFAMgF;IAChF,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD;;;;+BAI2B;IAC3B,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;IACD;;;;;;;;;mBASe;IACf,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpE,CAAC;IACD;;uEAEmE;IACnE,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC5D,CAAC;IACD;;6DAEyD;IACzD,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAW,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAW,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,6BAA6B,GAAG,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAuB,EAAE,OAAyB;IACrE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;QAClC,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC;QAC/D,KAAK,OAAO;YACV,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,OAAO;gBACtB,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAC/B,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAC1D,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CACpD,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,UAAU;gBACzB,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAC1D,CAAC;QACJ,KAAK,SAAS;YACZ;;wDAE4C;YAC5C,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;QAClC,KAAK,QAAQ;YACX;8EACkE;YAClE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;QACjC,KAAK,KAAK;YACR;;;;2EAI+D;YAC/D,OAAO,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;QACjE,KAAK,OAAO;YACV;;;;;;;;;sEAS0D;YAC1D,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;QACnE,KAAK,IAAI;YACP;;;;;;;;;;;;;;;;;6BAiBiB;YACjB,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,IAAI;gBACnB,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAC/B,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAC1D,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAa;IACP,MAAM,CAA8B;IACpC,gBAAgB,CAAU;IAC1B,eAAe,CAAU;IAE1C,YACE,MAAmC,EACnC,gBAAyB,EACzB,eAAwB;QAExB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,YAAY,CAAC,QAAsB;QACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,eAAe,CACvB,QAAQ,QAAQ,CAAC,EAAE,uDAAuD;gBACxE,wBAAwB,QAAQ,CAAC,KAAK,IAAI,CAC7C,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,OAAO,IAAI,aAAa,CACtB,MAAM,EACN,QAAQ,CAAC,gBAAgB,IAAI,KAAK,EAClC,QAAQ,CAAC,eAAe,IAAI,KAAK,CAClC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,GAAW;QACb,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,GAAW;QACf,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO;QAC1B,MAAM,IAAI,eAAe,CACvB,iCAAiC,GAAG,yCAAyC,CAC9E,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,kBAAkB;QAChB,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED,6DAA6D;IAC7D,iBAAiB;QACf,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rpgm-tools/neo-angband-mod-sdk",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Pack schemas, validation, and tooling for Neo Angband mods (content packs, tile packs, scripted plugins)",
   "license": "GPL-2.0-only",
   "author": "neostryder (RPGM Tools)",

package/src/capabilities.ts

@@ -131,6 +131,70 @@
  *                             write to it succeeded or failed. Its own kind,
  *                             like "display:replace" - there is nothing to
  *                             range over, so it has no wildcard either.
+ *  - "mod:install"         - install a CONTENT mod from archive bytes the mod
+ *                             holds in memory, through the same door the
+ *                             player's own zip import uses. Its own kind, like
+ *                             "display:replace": there is nothing to range over,
+ *                             so it has no wildcard. Two things bound it, and
+ *                             they are what make it proportionate rather than
+ *                             total. An archive that ships CODE, or whose
+ *                             manifest asks for any capability, is refused - so
+ *                             this grants "may add records to my library", not
+ *                             "may write and deploy a program". And an install
+ *                             is not an ENABLE: what arrives is switched off, and
+ *                             the player is shown its own capability list before
+ *                             any of it runs, which is what stops one grant
+ *                             turning into every grant.
+ *  - "mod:session"         - load a CONTENT mod into this session only, so it
+ *                             composes into the game on the next reload and is
+ *                             gone with the window. Bounded exactly as
+ *                             "mod:install" is - code and capability requests are
+ *                             refused - and deliberately NOT the same grant, since
+ *                             an install waits to be switched on and this does not.
+ *                             `grantCovers` compares the action so neither can be
+ *                             sold under the other's sentence. It is a shorter
+ *                             LIFETIME for the archive and not a smaller reach for
+ *                             the records: what composes, composes.
+ *  - "debug:spawn"         - conjure an item or a creature into the live game the
+ *                             way the debug commands do. Its own kind and no
+ *                             wildcard, and here that is the whole point rather
+ *                             than a consequence of there being one string: this
+ *                             is the grant a player is most likely to want to
+ *                             check for by name, so it must never arrive as part
+ *                             of something broader. What it adds over what a
+ *                             plugin can already reach through `ctx.core` is not
+ *                             the ability - `wizCreateObj` and friends take a
+ *                             `debug` flag the CALLER supplies - but the mark: the
+ *                             character is asked about and flagged, through the
+ *                             game's own confirmation and before anything is
+ *                             placed, so "the debug commands cannot be scored"
+ *                             stays true with a mod in the picture.
+ *  - "debug:wizard"        - drive the WHOLE debug set, not just the two spawns:
+ *                             depth, experience, gold, stats, acquirement,
+ *                             mapping. Its own action beside "spawn" rather than a
+ *                             wider reading of it, because the two cost the player
+ *                             different things. Spawning happens to the character
+ *                             they are playing and costs them the score. This one
+ *                             refuses to run until the session has been cut loose
+ *                             from its save slot - one way, checked by the host on
+ *                             every call - so it costs them the session and leaves
+ *                             the character on disk untouched. Neither is a
+ *                             superset of the other and `grantCovers` compares the
+ *                             action, so one consent cannot buy both.
+ *  - "ui:panel.mount"      - draw with real HTML instead of the character grid: a
+ *                             panel of the mod's own, mounted on the page above
+ *                             the game. A THIRD "ui:" action, and the reason it is
+ *                             not a third region name is the same reason
+ *                             "ui:region.create" is not a seventh: the sentence a
+ *                             player agrees to is different. "replace" hands over
+ *                             something the game draws, "create" adds a rectangle
+ *                             of the game's own character grid, and this one puts
+ *                             a piece of web page on top - which can look like the
+ *                             game's own interface, style anything inside itself,
+ *                             and read what the player types into it. No wildcard,
+ *                             and "ui:*.replace" does not cover it: `grantCovers`
+ *                             compares the action, so a mod that may redraw the
+ *                             vitals still cannot mount a panel without asking.
  *  - "ui:region.create"    - ADD a rectangle of your own to the player's screen
  *                             (ModPlugin.regions), rather than take one of the
  *                             game's. The only "ui:" capability whose ACTION is
@@ -163,8 +227,10 @@ export type ParsedCapability =
   | { kind: "network"; host: string }
   | { kind: "registry"; domain: string }
   | { kind: "display"; action: "replace" }
-  | { kind: "ui"; region: string; action: "replace" | "create" }
-  | { kind: "backup"; action: "folder" };
+  | { kind: "ui"; region: string; action: "replace" | "create" | "mount" }
+  | { kind: "backup"; action: "folder" }
+  | { kind: "mod"; action: "install" | "session" }
+  | { kind: "debug"; action: "spawn" | "wizard" };
 
 const EVENT_RE = /^event:([a-z][a-z0-9-]*)$/;
 /**
@@ -203,6 +269,34 @@ const UI_RE = /^ui:(\*|messages|sidebar|status|menu|screen)\.replace$/;
  * the note there.
  */
 const UI_CREATE_RE = /^ui:region\.create$/;
+/**
+ * `ui:panel.mount` - draw with real HTML instead of the character grid.
+ *
+ * A THIRD ACTION, for the same reason `create` was a second one rather than a
+ * seventh region name: what the player is agreeing to is a different sentence.
+ * `replace` hands a mod something the game already draws. `create` gives it a
+ * rectangle of the game's own character grid, painted with the same seven
+ * methods every other surface has. This one puts a piece of WEB PAGE above the
+ * game - arbitrary markup and styling, which can be made to look exactly like
+ * the game's own interface, and which can hold a real text field and read what
+ * is typed into it.
+ *
+ * NO WILDCARD, for the reason `create` has none: a mod either may mount panels
+ * or it may not, and there is no set of panel names to range over, because a
+ * panel does not exist until the mod asks for one.
+ *
+ * AND `ui:*.replace` MUST NOT COVER IT. `grantCovers` compares the action as
+ * well as the region, so this holds by construction rather than by a rule
+ * somebody has to remember - which is exactly what that comparison was added
+ * for when `create` arrived.
+ *
+ * WHAT IT IS NOT. It is not a containment boundary and this module's header
+ * already says why: a plugin's code runs in the page's own realm and can reach
+ * the document with no capability at all. What this grant buys is a panel the
+ * HOST owns - one it can place, stack, take the keyboard back from and close -
+ * plus a sentence the player reads before any of it happens.
+ */
+const UI_MOUNT_RE = /^ui:panel\.mount$/;
 const STATE_RE = /^state:(\*|[a-z][a-z0-9-]*)\.read$/;
 const NETWORK_RE = /^network:(\*|[a-zA-Z0-9.-]+)$/;
 /** The override domains ModRegistryHost gates, plus the "*" wildcard. */
@@ -235,6 +329,45 @@ export function parseCapability(cap: string): ParsedCapability {
   if (cap === "backup:folder") {
     return { kind: "backup", action: "folder" };
   }
+  /* "mod:install": hand archive bytes to the same install door the player's own
+   * zip import uses. Its own kind and no wildcard, same reasoning as the two
+   * above. What bounds it is not this grammar - it is that the door refuses an
+   * archive carrying code or asking for capabilities, and that installing is not
+   * enabling, so what arrives is consented to on its own terms before it runs. */
+  if (cap === "mod:install") {
+    return { kind: "mod", action: "install" };
+  }
+  /* "mod:session": load content into THIS session only, without it joining the
+   * library. Bounded the same way `mod:install` is - the door refuses an archive
+   * carrying code or asking for capabilities - and separated from it because the
+   * two say different things to a player. An install arrives switched OFF and waits
+   * to be turned on; a session load is on for the rest of the session as soon as
+   * the game reloads. That is more, not less, so it cannot be sold under the other
+   * one's sentence: `grantCovers` compares the action for exactly that reason. */
+  if (cap === "mod:session") {
+    return { kind: "mod", action: "session" };
+  }
+  /* "debug:spawn": put an item or a creature into the live game the way the debug
+   * commands do, marking the character the way they do. Its own kind and no
+   * wildcard on purpose - a player asking "which of my mods can conjure things"
+   * must be able to read the answer off one line, and no broader grant may ever
+   * carry this one along. */
+  if (cap === "debug:spawn") {
+    return { kind: "debug", action: "spawn" };
+  }
+  /* "debug:wizard": drive the whole debug set - depth, experience, gold, stats,
+   * acquirement, mapping - and not just the two spawns. A separate string from
+   * "debug:spawn" because it is a separate bargain, not a bigger helping of the
+   * same one. Spawning acts on the character the player is actually playing, after
+   * the game's own question, and leaves them playing it. This one refuses to run
+   * at all until the session has been cut loose from its save slot, one way, so
+   * the character it happens to has already stopped being written to disk. Neither
+   * is a superset of the other - one costs the score, the other costs the session -
+   * so `grantCovers` compares the action and neither can be sold under the other's
+   * sentence. */
+  if (cap === "debug:wizard") {
+    return { kind: "debug", action: "wizard" };
+  }
   const ui = UI_RE.exec(cap);
   if (ui) {
     return { kind: "ui", region: ui[1] as string, action: "replace" };
@@ -245,6 +378,12 @@ export function parseCapability(cap: string): ParsedCapability {
   if (UI_CREATE_RE.test(cap)) {
     return { kind: "ui", region: "region", action: "create" };
   }
+  /* `panel` is the region NAME, on the same terms `region` is above: the literal
+   * the author wrote, so one `kind: "ui"` arm keeps one shape. `action` is what
+   * separates the three, and `grantCovers` compares it. */
+  if (UI_MOUNT_RE.test(cap)) {
+    return { kind: "ui", region: "panel", action: "mount" };
+  }
   const event = EVENT_RE.exec(cap);
   if (event) {
     return { kind: "event", name: event[1] as string };
@@ -300,6 +439,25 @@ function grantCovers(grant: ParsedCapability, request: ParsedCapability): boolea
       /* Exact match only, same reasoning as "display" - there is exactly one
        * backup capability and no wildcard grant could ever cover it. */
       return grant.kind === "backup";
+    case "mod":
+      /* THE ACTION IS COMPARED, not just the kind, and it is the #261 lesson
+       * applied before it could be re-learned here: `mod:install` puts a pack in
+       * the library switched off, `mod:session` switches one on for the rest of the
+       * session. Neither is a superset of the other, there is no wildcard, and a
+       * kind-only comparison would have let one consent buy both. */
+      return grant.kind === "mod" && grant.action === request.action;
+    case "debug":
+      /* Exact match only, and here that is the point rather than a consequence:
+       * this is the grant a player is most likely to check for by name, so it
+       * must never be reachable through anything wider.
+       *
+       * THE ACTION IS COMPARED, and until "debug:wizard" landed it was not - which
+       * was invisible while "spawn" was the only action, and would have been a real
+       * hole the moment a second one existed: a player who agreed to a mod
+       * conjuring one monster would have been granting it the depth jumps, the
+       * experience and the acquirement too. Exactly the #261 lesson, caught by
+       * adding the second action rather than by shipping it. */
+      return grant.kind === "debug" && grant.action === request.action;
     case "ui":
       /* Per region, with one wildcard. A `display` grant is NOT accepted here
        * and a `ui` grant is not accepted above: owning the dungeon and owning