deck-plugin-sdk 1.11.0 → 1.12.0

package/types/core/workspaces/zones.d.ts

@@ -0,0 +1,215 @@
+// GENERATED by sdk/gen-types.mjs from Deck's source — do not edit.
+import { LayoutTab, LayoutWorkspace, Layout } from "./layout";
+/**
+ * How many columns the zone board has. Here rather than only in the UI because the fallback
+ * placement below has to agree with what the overview can draw.
+ */
+export declare const ZONE_BOARD = 3;
+/**
+ * Every tab's cell on the canvas.
+ *
+ * Placed tabs claim their stored coordinates first; unplaced ones then fill the free cells in
+ * reading order. Two consequences, both load-bearing:
+ *
+ * - A layout written before zones existed has no coordinates at all, so tab i lands on cell i —
+ *   the first row, left to right, then the next — without anything on disk being rewritten.
+ * - An unplaced tab never lands on a cell a placed tab already holds. Tabs that share a cell ARE
+ *   one zone, so a tab created without a position (the pinboard, an agent over MCP) must not
+ *   silently join whichever zone happens to sit at its list index. Before zones held several
+ *   tabs that collision only drew two zones on top of each other; now it would merge them.
+ */
+export declare function zoneCells(tabs: readonly LayoutTab[], cols: number): Map<string, {
+    x: number;
+    y: number;
+}>;
+/** Where a tab sits on the canvas — which is to say, which zone it belongs to. */
+export declare function zoneAt(tabs: readonly LayoutTab[], id: string, cols?: number): {
+    x: number;
+    y: number;
+};
+/** One zone: a cell, the tabs in it in list order, and the one it shows. */
+export interface Zone {
+    x: number;
+    y: number;
+    tabs: LayoutTab[];
+    front: LayoutTab;
+}
+/**
+ * The tabs grouped into zones, one per occupied cell, in the order each cell first appears.
+ *
+ * The front tab is the one not marked `hidden` — the last one shown there, which is what makes a
+ * zone open on the tab you left it on. A cell whose tabs are ALL hidden (its front was closed
+ * from outside, by an agent) shows its first, rather than nothing.
+ */
+export declare function zones(tabs: readonly LayoutTab[], cols?: number): Zone[];
+/** The zone holding a tab. */
+export declare function zoneOf(tabs: readonly LayoutTab[], id: string): Zone | undefined;
+/**
+ * The zone to move to from `id` going `dir`, as the tab it would show, or null when there is
+ * none that way.
+ *
+ * Nearest in a straight line: same row for left/right, same column for up/down, smallest step.
+ * No wrapping — running out of canvas should feel like an edge, not teleport you across it.
+ */
+export declare function zoneToward(tabs: readonly LayoutTab[], id: string, dir: "left" | "right" | "up" | "down"): LayoutTab | null;
+/**
+ * Every tab with explicit coordinates, at the cell it already appeared in.
+ *
+ * Needed before writing any coordinate: an unplaced tab's position depends on what else is
+ * placed, so placing one tab can move another that was relying on the fallback.
+ */
+export declare function placeAll(tabs: readonly LayoutTab[]): LayoutTab[];
+/**
+ * Put a zone at a spot on the canvas, swapping with whatever is already there.
+ *
+ * Every tab in the zone moves, since the zone IS the tabs sharing a cell — moving only the one
+ * named would split it in two.
+ *
+ * Swap rather than push-and-shuffle: a zone you did not touch should not move because another
+ * one arrived next to it, and with sparse coordinates there is no row to shuffle along anyway.
+ */
+export declare function moveZone(tabs: readonly LayoutTab[], id: string, to: {
+    x: number;
+    y: number;
+}): LayoutTab[];
+/**
+ * Move a tab to just before or after another — the order a zone's strip shows its tabs in, which
+ * is their order in the list.
+ *
+ * Every tab's cell is pinned first (placeAll): a tab with no stored position takes its cell from
+ * its index, so reordering the list could otherwise move a zone you never touched.
+ */
+export declare function reorderTab(tabs: readonly LayoutTab[], srcId: string, overId: string, after: boolean, 
+/** A drag in the strip says which group the tab ends up in: the one of the tab it is held over
+ *  (null: none, held over a tab outside any group or over a group's chip). Left out, the tabs
+ *  either side decide (settleGroup). */
+group?: string | null): LayoutTab[];
+/**
+ * A tab group's tabs sit together in their zone's row: a tab dropped between two of one group's
+ * tabs joins it, and one moved away from every other tab of its own group leaves it. Next to one
+ * of its group's tabs (at either end) it stays.
+ */
+export declare function settleGroup(tabs: LayoutTab[], id: string): LayoutTab[];
+/** A tab group: its tabs carry its id. Its colour is an index into GROUP_COLORS. */
+export interface TabGroup {
+    id: string;
+    name: string;
+    color: number;
+    folded?: boolean;
+}
+/** Chrome's group colours, tuned for Deck's dark surfaces. */
+export declare const GROUP_COLORS: string[];
+/** Move a tab to just after the last other tab of `group` in its zone, if it has any there. */
+export declare function besideGroup(tabs: readonly LayoutTab[], id: string, group: string): LayoutTab[];
+/**
+ * Put a tab in a group: `groupId`, or a new one in the next colour not yet used (its id is
+ * returned, so its editor can open). The tab moves next to the group's other tabs.
+ */
+export declare function addToGroup(w: LayoutWorkspace, tabId: string, groupId?: string): {
+    w: LayoutWorkspace;
+    groupId: string;
+};
+/** Take a tab out of its group, to just after the group's tabs. */
+export declare function leaveGroup(w: LayoutWorkspace, tabId: string): LayoutWorkspace;
+/**
+ * Move a whole group, its tabs in their order, to just before or after `overId`. Over another
+ * group's tab it goes before or after that group as a whole, never into the middle of it.
+ */
+export declare function moveGroup(tabs: readonly LayoutTab[], groupId: string, overId: string, after: boolean): LayoutTab[];
+/**
+ * Fold a group, or open it. A group holding the tab its zone shows is not folded over it: the
+ * zone moves to the nearest tab outside the group that is not itself folded away (after the group
+ * first, then before it). With none, `makeTab` gives a new tab for the zone to open on; without
+ * it, the group stays open.
+ */
+export declare function toggleGroupFold(w: LayoutWorkspace, groupId: string, makeTab?: () => LayoutTab): LayoutWorkspace;
+/** The group goes; its tabs stay where they are. */
+export declare function ungroup(w: LayoutWorkspace, groupId: string): LayoutWorkspace;
+/** Change a group's name, colour or fold. */
+export declare function setGroup(w: LayoutWorkspace, groupId: string, patch: Partial<Omit<TabGroup, "id">>): LayoutWorkspace;
+/**
+ * The open tab is never folded away: however it came to be open (the tab beside a closed one, the
+ * switcher, a shortcut, an agent's notification), a folded group holding it opens.
+ */
+export declare function openActiveGroup(w: LayoutWorkspace): LayoutWorkspace;
+/** A group with no tabs left goes (its last tab closed, moved to another zone, taken out). */
+export declare function pruneGroups(w: LayoutWorkspace): LayoutWorkspace;
+/**
+ * Move one tab to another zone's cell — joining the zone there as the tab it shows, or making a
+ * new zone in an empty cell. The zone it left keeps its other tabs.
+ */
+export declare function moveTabToZone(tabs: readonly LayoutTab[], tabId: string, to: {
+    x: number;
+    y: number;
+}): LayoutTab[];
+/**
+ * Add a tab to the zone holding `besideId`, as the tab it shows.
+ *
+ * The others there are marked hidden here rather than left to the active-tab normaliser, so the
+ * result is right even for a zone that is not the active one.
+ */
+export declare function addTabToZone(tabs: readonly LayoutTab[], besideId: string, tab: LayoutTab): LayoutTab[];
+/**
+ * A closed tab put back in workspace `w` (core/workspaces/closedtabs.ts): in front in the zone you are in,
+ * with new ids for the tab and its panes, since the old panes' shells and state are gone. Out of
+ * any group and any window it was in. Returns the workspace and each old pane's new id.
+ */
+export declare function reopenTab(w: LayoutWorkspace, tab: LayoutTab, fresh?: () => string): {
+    w: LayoutWorkspace;
+    ids: Record<string, string>;
+};
+/**
+ * Make a workspace's active tab the one its zone shows.
+ *
+ * Run on every layout write (mutateLayout), so whatever made a tab active — a click in the
+ * strip, the compass, an agent notification jumping to a pane in a tab behind another — the
+ * zone ends up showing it, and remembers it next time. One place rather than every caller that
+ * sets activeTab, of which there are many and will be more.
+ */
+export declare function showActiveTab(w: LayoutWorkspace): LayoutWorkspace;
+/**
+ * Which tab becomes active when `closing` goes: the one beside it in the same zone (the next, or
+ * the one before when it was last), as a browser does, so closing a tab neither throws you out of
+ * the zone nor back to its first tab; otherwise the first zone left.
+ */
+export declare function nextActiveAfterClose(tabs: readonly LayoutTab[], closing: string): string | undefined;
+/**
+ * Tear a tab off into window `win`, or (`win` undefined) dock it back. A workspace always keeps
+ * one docked tab: floating its last one leaves a fresh terminal behind, as the main window has
+ * to show something. Tearing off the active tab makes its neighbour active.
+ */
+export declare function setTabWindow(w: LayoutWorkspace, tabId: string, win: string | undefined, keepGroup?: boolean): LayoutWorkspace;
+/**
+ * Merge floating window `from`'s tabs into another window: floating window `into`, or (`into`
+ * null) the main window, into the active zone of the project it shows. They go in behind the tab
+ * that window shows, which stays shown: a tab dropped somewhere does not take you away from the one
+ * you were on. The tabs move between projects when the window they land in shows another one's,
+ * since a window holds one project's tabs.
+ */
+export declare function mergeWindow(l: Layout, from: string, into: string | null): Layout;
+/**
+ * Close floating window `id` into the main window: its tabs go back to their zones, each behind the
+ * tab its zone shows, so closing a window does not take you away from the tab you are on. With
+ * `discard` (its X, Alt+F4), the tabs Deck opened into it (`transient`) close instead; the caller
+ * destroys their panes.
+ */
+export declare function dockWindow(l: Layout, id: string, discard?: boolean): Layout;
+/** The first free spot on the top row, for a zone created without a position of its own. */
+export declare function nextZoneSpot(tabs: readonly LayoutTab[], cols?: number, rows?: number): {
+    x: number;
+    y: number;
+};
+/**
+ * Is there nowhere left to put a zone?
+ *
+ * Counts zones, not tabs: a zone can hold several tabs and still take one cell.
+ *
+ * The board is a fixed 3x3 — deliberately, so the overview and the Ctrl+Alt compass are always
+ * the same nine cells. A tenth zone has no spot: it drew off the edge of the overview and the
+ * compass could not reach it, so it existed but could not be seen or switched to.
+ *
+ * Checked by every caller that creates one, rather than inside nextZoneSpot, because refusing
+ * and reporting why is the caller's job — the keyboard shortcut says so in a toast, and the
+ * layout op tells the agent that asked.
+ */
+export declare function zoneBoardFull(tabs: readonly LayoutTab[], cols?: number, rows?: number): boolean;

package/types/modules/editor/MonacoHosts.d.ts

@@ -1,7 +1,7 @@
 // GENERATED by sdk/gen-types.mjs from Deck's source — do not edit.
-import { monaco } from "../../core/monaco";
-import { type EditorSettings } from "../../core/editorsettings";
-import type { DirtyRange } from "./hunks";
+import { monaco } from "../../core/editor/monaco";
+import { type EditorSettings } from "../../core/editor/editorsettings";
+import type { DirtyRange } from "./git/hunks";
 declare function MonacoEditorInner({ path, rel, value, onChange, onSave, gotoLine, gotoCol, gotoNonce, highlight, dirty, settings, onEditor, clean, onStageChange, onUnstageChange, onReadBase }: {
     path: string;
     rel?: string | null;

package/types/modules/editor/{DiffPeek.d.ts → git/DiffPeek.d.ts}

@@ -1,6 +1,6 @@
 // GENERATED by sdk/gen-types.mjs from Deck's source — do not edit.
 import { type RefObject } from "react";
-import { monaco } from "../../core/monaco";
+import { monaco } from "../../../core/editor/monaco";
 import { type DirtyRange } from "./hunks";
 /**
  * The peek, for the editor in `edRef` showing `path` with the gutter's `ranges`. Returns what to

package/types/modules/editor/models.d.ts

@@ -1,5 +1,5 @@
 // GENERATED by sdk/gen-types.mjs from Deck's source — do not edit.
-import { monaco } from "../../core/monaco";
+import { monaco } from "../../core/editor/monaco";
 export declare const viewStates: Map<string, monaco.editor.ICodeEditorViewState | null>;
 /**
  * An untitled buffer (Ctrl+N): `untitled:Untitled-N`. It has no file behind it, so its model gets

package/types/modules/editor/{tree.d.ts → tree/tree.d.ts}

@@ -1,5 +1,5 @@
 // GENERATED by sdk/gen-types.mjs from Deck's source — do not edit.
-import type { GitStatusRow } from "../../core/bridge";
+import type { GitStatusRow } from "../../../core/bridge";
 /** Last path segment, trailing separators ignored. */
 export declare const baseName: (p: string) => string;
 /** Windows paths use both separators; normalize to "/" for comparison and display. */

package/validate.mjs

@@ -1,112 +1,112 @@
-// The checks a package must pass to be published, that need nothing but its files: shared by
-// `deck-plugin publish` (which runs them before anything leaves the machine) and the registry's
-// own validation (deck-registry's tools/validate.mjs, which adds what needs GitHub: who owns it,
-// the release, the rebuild). One copy, so the two cannot disagree about what is valid.
-//
-// Pure: no network, no filesystem.
-
-/** Deck's own modules and the view prefixes: a plugin with one of these ids could never load. */
-export const RESERVED = new Set(["terminals", "editor", "docs", "settings", "deck", "module", "plugin", "browser"]);
-/**
- * Packages the registry's rebuild executes. Each must be the real one from npm, since the rebuild
- * runs on a machine that can merge; see the SECURITY note in deck-registry's tools/validate.mjs.
- */
-export const BUILD_RUNS = ["deck-plugin-sdk", "esbuild", "react", "lucide-react", "framer-motion"];
-export const MAX_FILE = 10 * 1024 * 1024, MAX_TOTAL = 15 * 1024 * 1024;
-export const ID = /^[a-z0-9][a-z0-9-]{0,39}$/;
-export const SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
-
-/** A file's name as a release asset: flat, so a language's snippets/x.json is snippets--x.json. */
-export const assetName = (name) => name.replace(/\//g, "--");
-
-export function compareVersions(a, b) {
-  const x = SEMVER.exec(a), y = SEMVER.exec(b);
-  for (let i = 1; i <= 3; i++) if (Number(x[i]) !== Number(y[i])) return Number(x[i]) - Number(y[i]);
-  if (x[4] === y[4]) return 0;
-  return x[4] === undefined ? 1 : y[4] === undefined ? -1 : x[4] < y[4] ? -1 : 1;
-}
-
-/** An id: its shape, and not one of Deck's own. */
-export function checkId(id) {
-  const errors = [];
-  if (!ID.test(id)) errors.push(`the id \`${id}\` must be lowercase letters, digits and dashes, 40 at most`);
-  if (RESERVED.has(id)) errors.push(`\`${id}\` is one of Deck's own names and cannot be a package id`);
-  return errors;
-}
-
-/** A plugin's plugin.json, for publishing: what the registry shows and what Deck needs. */
-export function checkManifest(m) {
-  const errors = [];
-  if (typeof m.name !== "string" || !m.name.trim() || m.name.length > 60) errors.push("the name must be 1 to 60 characters");
-  if (typeof m.description !== "string" || m.description.trim().length < 10 || m.description.length > 300) {
-    errors.push("the description must be 10 to 300 characters");
-  }
-  if (typeof m.version !== "string" || !SEMVER.test(m.version)) errors.push("`version` must be a version, such as \"1.0.0\"");
-  if (typeof m.minDeck !== "string" || !SEMVER.test(m.minDeck)) errors.push("`minDeck` must say which Deck it needs, such as \"1.8.0\"");
-  if (m.color !== undefined && !/^#[0-9a-f]{6}$/i.test(m.color)) errors.push("`color` must be #rrggbb");
-  return errors;
-}
-
-/** The release's files: the allowed names, the required ones, and the size limits. */
-export function checkAssets(kind, assets) {
-  const errors = [];
-  const ok = (n) => kind === "plugin" ? ["plugin.json", "plugin.js", "mcp.js"].includes(n) : n === "language.json" || /^snippets--[\w.-]+\.json$/.test(n);
-  for (const a of assets) if (!ok(a.name)) errors.push(`the release has \`${a.name}\`, which a ${kind} cannot contain`);
-  for (const need of kind === "plugin" ? ["plugin.json", "plugin.js"] : ["language.json"]) {
-    if (!assets.some((a) => a.name === need)) errors.push(`the release has no \`${need}\``);
-  }
-  for (const a of assets) if (a.size > MAX_FILE) errors.push(`\`${a.name}\` is ${(a.size / 1048576).toFixed(1)} MB; a file may be 10 MB at most`);
-  const total = assets.reduce((n, a) => n + a.size, 0);
-  if (total > MAX_TOTAL) errors.push(`the release is ${(total / 1048576).toFixed(1)} MB; a package may be 15 MB at most`);
-  for (const a of assets) if ("digest" in a && !/^sha256:[0-9a-f]{64}$/.test(a.digest ?? "")) errors.push(`GitHub gives no sha256 for \`${a.name}\`; upload it again`);
-  return errors;
-}
-
-/** Whether a lockfile lets `npm ci` install only published npm packages. */
-export function checkLockfile(lock) {
-  const errors = [];
-  if (!lock || lock.lockfileVersion < 2 || typeof lock.packages !== "object") return ["package-lock.json must be npm 7 or newer (lockfileVersion 2 or 3)"];
-  for (const [path, p] of Object.entries(lock.packages)) {
-    if (path === "") continue;
-    if (p.link) { errors.push(`\`${path}\` is a link to a folder; publish it to npm or bundle it`); continue; }
-    if (!p.resolved?.startsWith("https://registry.npmjs.org/") || !/^sha(512|384|256)-/.test(p.integrity ?? "")) {
-      errors.push(`\`${path}\` does not come from registry.npmjs.org with an integrity hash`);
-    }
-    const name = path.replace(/^.*node_modules\//, "");
-    const runs = BUILD_RUNS.includes(name) || name.startsWith("@esbuild/");
-    if (runs && p.name && p.name !== name) errors.push(`\`${name}\` is an alias of \`${p.name}\`; the build runs it, so it must be the real package`);
-  }
-  if (!lock.packages["node_modules/deck-plugin-sdk"]) errors.push("the lockfile has no deck-plugin-sdk; a plugin is built with it");
-  return errors;
-}
-
-/**
- * What a plugin's permissions must be, from its manifest and its bundle (`table` is the SDK's
- * permissions.json): only known names, and covering every bridge call the bundle makes. The shim
- * calls the bridge as `b().fsWrite(`, which minifying keeps, so `().fn(` is the pattern, and a
- * method of the same name on something else (a RegExp's .exec) does not count. Reaching Deck's
- * internals directly, around the bridge, is refused outright.
- */
-export function checkPermissions(declared, bundle, table) {
-  const errors = [], notes = [];
-  if (!Array.isArray(declared)) {
-    return { errors: ['plugin.json must say what it uses: "permissions": [...], or [] when it needs nothing beyond its own data and settings'], notes };
-  }
-  const unknown = declared.filter((p) => !(p in table.permissions));
-  if (unknown.length) errors.push(`unknown permission${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")} (known: ${Object.keys(table.permissions).join(", ")})`);
-  if (/__TAURI_INTERNALS__|__TAURI_IPC__|window\.__TAURI__\b/.test(bundle)) {
-    errors.push("its bundle reaches Deck's internals directly, around the bridge its permissions apply to");
-  }
-  const needs = new Map();
-  for (const [fn, p] of Object.entries(table.bridge)) {
-    if (new RegExp(`\\(\\)\\.${fn}\\(`).test(bundle)) needs.set(p, [...(needs.get(p) ?? []), fn]);
-  }
-  for (const [mod, p] of Object.entries(table.modules)) {
-    if (new RegExp(`__deck\\?\\.${mod}\\b`).test(bundle)) needs.set(p, [...(needs.get(p) ?? []), mod]);
-  }
-  for (const [p, fns] of needs) {
-    if (!declared.includes(p)) errors.push(`it uses ${fns.slice(0, 4).join(", ")}${fns.length > 4 ? ` and ${fns.length - 4} more` : ""}, which ${fns.length > 1 ? "need" : "needs"} the "${p}" permission; add it to "permissions"`);
-  }
-  if (/\beval\(|new Function\(/.test(bundle)) notes.push("Its bundle uses eval or new Function, which runs code made at run time; a library may do this legitimately.");
-  return { errors, notes };
-}
+// The checks a package must pass to be published, that need nothing but its files: shared by
+// `deck-plugin publish` (which runs them before anything leaves the machine) and the registry's
+// own validation (deck-registry's tools/validate.mjs, which adds what needs GitHub: who owns it,
+// the release, the rebuild). One copy, so the two cannot disagree about what is valid.
+//
+// Pure: no network, no filesystem.
+
+/** Deck's own modules and the view prefixes: a plugin with one of these ids could never load. */
+export const RESERVED = new Set(["terminals", "editor", "docs", "settings", "deck", "module", "plugin", "browser"]);
+/**
+ * Packages the registry's rebuild executes. Each must be the real one from npm, since the rebuild
+ * runs on a machine that can merge; see the SECURITY note in deck-registry's tools/validate.mjs.
+ */
+export const BUILD_RUNS = ["deck-plugin-sdk", "esbuild", "react", "lucide-react", "framer-motion"];
+export const MAX_FILE = 10 * 1024 * 1024, MAX_TOTAL = 15 * 1024 * 1024;
+export const ID = /^[a-z0-9][a-z0-9-]{0,39}$/;
+export const SEMVER = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
+
+/** A file's name as a release asset: flat, so a language's snippets/x.json is snippets--x.json. */
+export const assetName = (name) => name.replace(/\//g, "--");
+
+export function compareVersions(a, b) {
+  const x = SEMVER.exec(a), y = SEMVER.exec(b);
+  for (let i = 1; i <= 3; i++) if (Number(x[i]) !== Number(y[i])) return Number(x[i]) - Number(y[i]);
+  if (x[4] === y[4]) return 0;
+  return x[4] === undefined ? 1 : y[4] === undefined ? -1 : x[4] < y[4] ? -1 : 1;
+}
+
+/** An id: its shape, and not one of Deck's own. */
+export function checkId(id) {
+  const errors = [];
+  if (!ID.test(id)) errors.push(`the id \`${id}\` must be lowercase letters, digits and dashes, 40 at most`);
+  if (RESERVED.has(id)) errors.push(`\`${id}\` is one of Deck's own names and cannot be a package id`);
+  return errors;
+}
+
+/** A plugin's plugin.json, for publishing: what the registry shows and what Deck needs. */
+export function checkManifest(m) {
+  const errors = [];
+  if (typeof m.name !== "string" || !m.name.trim() || m.name.length > 60) errors.push("the name must be 1 to 60 characters");
+  if (typeof m.description !== "string" || m.description.trim().length < 10 || m.description.length > 300) {
+    errors.push("the description must be 10 to 300 characters");
+  }
+  if (typeof m.version !== "string" || !SEMVER.test(m.version)) errors.push("`version` must be a version, such as \"1.0.0\"");
+  if (typeof m.minDeck !== "string" || !SEMVER.test(m.minDeck)) errors.push("`minDeck` must say which Deck it needs, such as \"1.8.0\"");
+  if (m.color !== undefined && !/^#[0-9a-f]{6}$/i.test(m.color)) errors.push("`color` must be #rrggbb");
+  return errors;
+}
+
+/** The release's files: the allowed names, the required ones, and the size limits. */
+export function checkAssets(kind, assets) {
+  const errors = [];
+  const ok = (n) => kind === "plugin" ? ["plugin.json", "plugin.js", "mcp.js"].includes(n) : n === "language.json" || /^snippets--[\w.-]+\.json$/.test(n);
+  for (const a of assets) if (!ok(a.name)) errors.push(`the release has \`${a.name}\`, which a ${kind} cannot contain`);
+  for (const need of kind === "plugin" ? ["plugin.json", "plugin.js"] : ["language.json"]) {
+    if (!assets.some((a) => a.name === need)) errors.push(`the release has no \`${need}\``);
+  }
+  for (const a of assets) if (a.size > MAX_FILE) errors.push(`\`${a.name}\` is ${(a.size / 1048576).toFixed(1)} MB; a file may be 10 MB at most`);
+  const total = assets.reduce((n, a) => n + a.size, 0);
+  if (total > MAX_TOTAL) errors.push(`the release is ${(total / 1048576).toFixed(1)} MB; a package may be 15 MB at most`);
+  for (const a of assets) if ("digest" in a && !/^sha256:[0-9a-f]{64}$/.test(a.digest ?? "")) errors.push(`GitHub gives no sha256 for \`${a.name}\`; upload it again`);
+  return errors;
+}
+
+/** Whether a lockfile lets `npm ci` install only published npm packages. */
+export function checkLockfile(lock) {
+  const errors = [];
+  if (!lock || lock.lockfileVersion < 2 || typeof lock.packages !== "object") return ["package-lock.json must be npm 7 or newer (lockfileVersion 2 or 3)"];
+  for (const [path, p] of Object.entries(lock.packages)) {
+    if (path === "") continue;
+    if (p.link) { errors.push(`\`${path}\` is a link to a folder; publish it to npm or bundle it`); continue; }
+    if (!p.resolved?.startsWith("https://registry.npmjs.org/") || !/^sha(512|384|256)-/.test(p.integrity ?? "")) {
+      errors.push(`\`${path}\` does not come from registry.npmjs.org with an integrity hash`);
+    }
+    const name = path.replace(/^.*node_modules\//, "");
+    const runs = BUILD_RUNS.includes(name) || name.startsWith("@esbuild/");
+    if (runs && p.name && p.name !== name) errors.push(`\`${name}\` is an alias of \`${p.name}\`; the build runs it, so it must be the real package`);
+  }
+  if (!lock.packages["node_modules/deck-plugin-sdk"]) errors.push("the lockfile has no deck-plugin-sdk; a plugin is built with it");
+  return errors;
+}
+
+/**
+ * What a plugin's permissions must be, from its manifest and its bundle (`table` is the SDK's
+ * permissions.json): only known names, and covering every bridge call the bundle makes. The shim
+ * calls the bridge as `b().fsWrite(`, which minifying keeps, so `().fn(` is the pattern, and a
+ * method of the same name on something else (a RegExp's .exec) does not count. Reaching Deck's
+ * internals directly, around the bridge, is refused outright.
+ */
+export function checkPermissions(declared, bundle, table) {
+  const errors = [], notes = [];
+  if (!Array.isArray(declared)) {
+    return { errors: ['plugin.json must say what it uses: "permissions": [...], or [] when it needs nothing beyond its own data and settings'], notes };
+  }
+  const unknown = declared.filter((p) => !(p in table.permissions));
+  if (unknown.length) errors.push(`unknown permission${unknown.length > 1 ? "s" : ""}: ${unknown.join(", ")} (known: ${Object.keys(table.permissions).join(", ")})`);
+  if (/__TAURI_INTERNALS__|__TAURI_IPC__|window\.__TAURI__\b/.test(bundle)) {
+    errors.push("its bundle reaches Deck's internals directly, around the bridge its permissions apply to");
+  }
+  const needs = new Map();
+  for (const [fn, p] of Object.entries(table.bridge)) {
+    if (new RegExp(`\\(\\)\\.${fn}\\(`).test(bundle)) needs.set(p, [...(needs.get(p) ?? []), fn]);
+  }
+  for (const [mod, p] of Object.entries(table.modules)) {
+    if (new RegExp(`__deck\\?\\.${mod}\\b`).test(bundle)) needs.set(p, [...(needs.get(p) ?? []), mod]);
+  }
+  for (const [p, fns] of needs) {
+    if (!declared.includes(p)) errors.push(`it uses ${fns.slice(0, 4).join(", ")}${fns.length > 4 ? ` and ${fns.length - 4} more` : ""}, which ${fns.length > 1 ? "need" : "needs"} the "${p}" permission; add it to "permissions"`);
+  }
+  if (/\beval\(|new Function\(/.test(bundle)) notes.push("Its bundle uses eval or new Function, which runs code made at run time; a library may do this legitimately.");
+  return { errors, notes };
+}