modwright 0.1.0

package/dist/surfaces/valheim/references.js

@@ -0,0 +1,121 @@
+function stripComments(text) {
+    let out = "";
+    let i = 0;
+    while (i < text.length) {
+        const c = text[i];
+        const next = text[i + 1];
+        if (c === "@" && next === '"') {
+            let j = i + 2;
+            while (j < text.length) {
+                if (text[j] === '"' && text[j + 1] === '"') {
+                    j += 2;
+                    continue;
+                }
+                if (text[j] === '"')
+                    break;
+                j++;
+            }
+            out += text.slice(i, j + 1);
+            i = j + 1;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            let j = i + 1;
+            while (j < text.length && text[j] !== c) {
+                if (text[j] === "\\")
+                    j++;
+                if (text[j] === "\n")
+                    break;
+                j++;
+            }
+            out += text.slice(i, j + 1);
+            i = j + 1;
+            continue;
+        }
+        if (c === "/" && next === "/") {
+            while (i < text.length && text[i] !== "\n") {
+                out += " ";
+                i++;
+            }
+            continue;
+        }
+        if (c === "/" && next === "*") {
+            const end = text.indexOf("*/", i + 2);
+            const stop = end < 0 ? text.length : end + 2;
+            out += text.slice(i, stop).replace(/[^\n]/g, " ");
+            i = stop;
+            continue;
+        }
+        out += c;
+        i++;
+    }
+    return out;
+}
+function lineAt(text, index) {
+    let line = 1;
+    for (let i = 0; i < index && i < text.length; i++)
+        if (text.charCodeAt(i) === 10)
+            line++;
+    return line;
+}
+const STR = String.raw `"((?:[^"\\\n]|\\.)*)"`;
+const ASSET_ID_RE = /^[0-9a-f]{32}$/i;
+function all(re, text, fn) {
+    let m;
+    const g = new RegExp(re.source, re.flags.includes("g") ? re.flags : re.flags + "g");
+    while ((m = g.exec(text)))
+        fn(m);
+}
+function uniq(values) {
+    return [...new Set(values)];
+}
+export function scanReferences(source) {
+    const text = stripComments(source);
+    const refs = [];
+    const declares = { prefabs: [], tokens: [], pieceTables: [] };
+    const push = (kind, value, index, via) => refs.push({ kind, value, line: lineAt(text, index), via });
+    all(new RegExp(String.raw `new\s+(CustomItem|CustomPiece|CustomPrefab)\s*\(\s*${STR}\s*,\s*${STR}`), text, (m) => {
+        declares.prefabs.push(m[2]);
+        push("prefab", m[3], m.index, `new ${m[1]}(…, "${m[3]}")`);
+    });
+    all(new RegExp(String.raw `new\s+(CustomItem|CustomPiece|CustomPrefab)\s*\(\s*${STR}\s*,\s*(?:true|false|fixReference)`), text, (m) => {
+        declares.prefabs.push(m[2]);
+    });
+    all(new RegExp(String.raw `new\s+(?:CustomItem|CustomPiece|CustomPrefab)\s*\(\s*[A-Za-z_][A-Za-z0-9_.]*\s*,\s*${STR}\s*,\s*(?:true|false|fixReference)`), text, (m) => {
+        declares.prefabs.push(m[1]);
+    });
+    all(new RegExp(String.raw `new\s+CustomPieceTable\s*\(\s*${STR}`), text, (m) => declares.pieceTables.push(m[1]));
+    all(new RegExp(String.raw `new\s+CustomPieceTable\s*\(\s*[A-Za-z_][A-Za-z0-9_.]*\s*,\s*${STR}`), text, (m) => declares.pieceTables.push(m[1]));
+    all(new RegExp(String.raw `\.(GetPrefab|GetItemPrefab)\s*\(\s*${STR}\s*\)`), text, (m) => push("prefab", m[2], m.index, `${m[1]}("${m[2]}")`));
+    all(new RegExp(String.raw `\.CreateClonedPrefab\s*\(\s*${STR}\s*,\s*${STR}`), text, (m) => push("prefab", m[2], m.index, `CreateClonedPrefab(…, "${m[2]}")`));
+    all(new RegExp(String.raw `\.(?:CreateClonedPrefab|CreateEmptyPrefab)\s*\(\s*${STR}`), text, (m) => declares.prefabs.push(m[1]));
+    all(new RegExp(String.raw `\.AddRequirement\s*\(\s*${STR}`), text, (m) => push("requirement", m[1], m.index, `AddRequirement("${m[1]}")`));
+    all(new RegExp(String.raw `\bItem\s*=\s*${STR}`), text, (m) => push("requirement", m[1], m.index, `Item = "${m[1]}"`));
+    all(new RegExp(String.raw `\bPieceTable\s*=\s*${STR}`), text, (m) => push("piece_table", m[1], m.index, `PieceTable = "${m[1]}"`));
+    all(new RegExp(String.raw `"(\$[A-Za-z0-9_]+)"`), text, (m) => push("token", m[1], m.index, `"${m[1]}"`));
+    all(new RegExp(String.raw `"([0-9a-fA-F]{32})"`), text, (m) => {
+        if (ASSET_ID_RE.test(m[1]))
+            push("asset", m[1].toLowerCase(), m.index, `"${m[1]}"`);
+    });
+    all(new RegExp(String.raw `AddTranslation\s*\(\s*${STR}\s*,\s*new\s+Dictionary<\s*string\s*,\s*string\s*>\s*\{([\s\S]*?)\}\s*\)`), text, (m) => {
+        all(new RegExp(String.raw `\{\s*${STR}\s*,\s*${STR}\s*\}`), m[2], (pair) => declares.tokens.push(pair[1].replace(/^\$/, "")));
+    });
+    all(new RegExp(String.raw `AddTranslation\s*\(\s*${STR}\s*,\s*${STR}\s*(?:,\s*${STR}\s*)?\)`), text, (m) => {
+        declares.tokens.push((m[3] !== undefined ? m[2] : m[1]).replace(/^\$/, ""));
+    });
+    declares.prefabs = uniq(declares.prefabs);
+    declares.tokens = uniq(declares.tokens);
+    declares.pieceTables = uniq(declares.pieceTables);
+    return { refs, declares };
+}
+export function translationKeys(jsonText) {
+    try {
+        const parsed = JSON.parse(jsonText.replace(/^/, ""));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return [];
+        return Object.keys(parsed).map((k) => k.replace(/^\$/, ""));
+    }
+    catch {
+        return [];
+    }
+}

package/dist/surfaces/valheim/surface.js

@@ -0,0 +1,223 @@
+import { promises as fs } from "node:fs";
+import * as path from "node:path";
+import { homePath, pathExists, readTextIfExists } from "../../core/fsutil.js";
+import { findInSteam } from "../../core/steam.js";
+import { dedupeByRoot, logs, roots } from "../../core/surfaceutil.js";
+import { valheimCompat } from "./compat.js";
+import { valheimIndex } from "./index/index.js";
+import { SIGNATURES } from "./logs.js";
+import { PACKAGING_VALIDATORS } from "./validators/packaging.js";
+import { PLUGIN_VALIDATORS } from "./validators/plugins.js";
+import { REFERENCE_VALIDATORS } from "./validators/references.js";
+export const valheim = {
+    id: "valheim",
+    name: "Valheim",
+    aliases: ["valheim", "vh"],
+    summary: "Unity (Mono) with BepInEx 5: plugin assemblies under BepInEx/plugins, Harmony patches, " +
+        "Jötunn as the common library, Thunderstore and r2modman as the distribution channel.",
+    async detect() {
+        const installs = [];
+        for (const [variable, source] of [["MODWRIGHT_VALHEIM_ROOT", "env"], ["VALHEIM_INSTALL", "env"]]) {
+            const value = process.env[variable];
+            if (value && (await pathExists(value)))
+                installs.push({ gameId: "valheim", root: value, source });
+        }
+        for (const root of await findInSteam(["Valheim", "Valheim dedicated server"])) {
+            const kind = await installKind(root);
+            if (kind)
+                installs.push({ gameId: "valheim", root, source: "steam" });
+        }
+        return dedupeByRoot(installs);
+    },
+    modRoots(install) {
+        const bepinex = path.join(install.root, "BepInEx");
+        return roots([
+            {
+                id: "plugins",
+                label: "BepInEx plugins",
+                path: path.join(bepinex, "plugins"),
+                layout: "directory",
+                conflictScope: "isolated",
+                notes: "Each mod in its own subdirectory (loose .dlls directly in plugins/ load too). Real " +
+                    "collisions are on plugin GUID, not on file path: two plugins with the same GUID in " +
+                    "different folders silently drop the older one, with one 'Skipping [...] because a " +
+                    "newer version exists' line in LogOutput.log. Load order is a topological sort of " +
+                    "[BepInDependency] declarations; there is no order file.",
+            },
+            {
+                id: "patchers",
+                label: "BepInEx preloader patchers",
+                path: path.join(bepinex, "patchers"),
+                layout: "directory",
+                conflictScope: "isolated",
+                notes: "Assembly patchers that run before any plugin. A failure here breaks everything downstream.",
+            },
+            {
+                id: "config",
+                label: "BepInEx config",
+                path: path.join(bepinex, "config"),
+                layout: "flat",
+                conflictScope: "merged",
+                notes: "One <GUID>.cfg per plugin plus BepInEx.cfg, created at runtime. Thunderstore's " +
+                    "ecosystem schema tracks this folder as 'none', which is why it is the one merged " +
+                    "root a mod actually deploys into: core and loader are merged too, but core is never " +
+                    "a deploy target and loader holds BepInEx's own files.",
+            },
+            {
+                id: "monomod",
+                label: "MonoMod patches",
+                path: path.join(bepinex, "monomod"),
+                layout: "file",
+                extensions: [".mm.dll"],
+                conflictScope: "isolated",
+                notes: "Declared by Thunderstore's schema; rare on Valheim.",
+            },
+            {
+                id: "core",
+                label: "BepInEx core",
+                path: path.join(bepinex, "core"),
+                layout: "flat",
+                conflictScope: "merged",
+                notes: "BepInEx's own assemblies. Listed so a mod wrongly shipping into it is visible; never a deploy target.",
+            },
+            {
+                id: "loader",
+                label: "Doorstop loader files",
+                path: install.root,
+                layout: "flat",
+                conflictScope: "merged",
+                notes: "winhttp.dll, doorstop_config.ini and .doorstop_version beside the executable (the " +
+                    "Linux run scripts too). Where 'is BepInEx installed' is answered; the ini's keys " +
+                    "changed at BepInEx 5.4.23 ([UnityDoorstop] camelCase before, [General]/[UnityMono] " +
+                    "snake_case after), so an old ini under a new BepInEx loads nothing.",
+            },
+        ]);
+    },
+    async readManifest(modPath, root) {
+        if (root.id !== "plugins")
+            return undefined;
+        const file = path.join(modPath, "manifest.json");
+        const text = await readTextIfExists(file);
+        if (text === undefined)
+            return undefined;
+        try {
+            const raw = JSON.parse(text);
+            const deps = Array.isArray(raw.dependencies) ? raw.dependencies.filter((d) => typeof d === "string") : undefined;
+            return {
+                format: "thunderstore-manifest.json",
+                ...(typeof raw.name === "string" ? { name: raw.name } : {}),
+                ...(typeof raw.version_number === "string" ? { version: raw.version_number } : {}),
+                ...(typeof raw.description === "string" ? { description: raw.description } : {}),
+                ...(deps ? { dependencies: deps } : {}),
+                raw,
+            };
+        }
+        catch {
+            return undefined;
+        }
+    },
+    logs(install) {
+        const bepinex = path.join(install.root, "BepInEx");
+        return logs([
+            {
+                id: "bepinex",
+                label: "BepInEx LogOutput.log",
+                candidates: [path.join(bepinex, "LogOutput.log"), ...[1, 2, 3, 4].map((n) => path.join(bepinex, `LogOutput.log.${n}`))],
+                rootId: "plugins",
+                notes: "One fresh file per run (FileMode.Create unless [Logging.Disk] AppendLog is on), so a " +
+                    "whole-file read is already one run. Lines are '[Level  :    Source] message' with no " +
+                    "timestamp; Debug lines are excluded from disk by default. Unity exceptions are not " +
+                    "here unless WriteUnityLog is on: see Player.log.",
+            },
+            {
+                id: "player",
+                label: "Unity Player.log",
+                candidates: [homePath("AppData", "LocalLow", "IronGate", "Valheim", "Player.log")],
+                notes: "Unity's own log for the client: engine and script exceptions, including those a " +
+                    "plugin's patch throws at runtime. The dedicated server's location follows its " +
+                    "-savedir argument and is not fixed.",
+            },
+            {
+                id: "preloader-crash",
+                label: "BepInEx preloader crash log",
+                candidates: [path.join(install.root, "preloader_*.log")],
+                rootId: "patchers",
+                notes: "Written beside the executable only when the preloader itself threw; newest wins.",
+            },
+        ]);
+    },
+    async explainMissing(install) {
+        const reasons = {};
+        const winhttp = path.join(install.root, "winhttp.dll");
+        if (!(await pathExists(winhttp))) {
+            reasons.bepinex = `${winhttp} was not found beside the executable: BepInEx (the Doorstop loader) is not installed here, so no LogOutput.log can exist. Under r2modman the install lives in a profile folder, not the game folder.`;
+            reasons["preloader-crash"] = reasons.bepinex;
+            return reasons;
+        }
+        const cfg = await readTextIfExists(path.join(install.root, "BepInEx", "config", "BepInEx.cfg"));
+        if (cfg !== undefined && diskLoggingDisabled(cfg)) {
+            reasons.bepinex = "[Logging.Disk] Enabled = false in BepInEx/config/BepInEx.cfg: the loader runs but writes no LogOutput.log. Set it to true.";
+        }
+        else if (cfg === undefined) {
+            reasons.bepinex = "BepInEx/config/BepInEx.cfg does not exist yet: BepInEx creates it on first run, so the loader has not run since it was installed.";
+        }
+        reasons["preloader-crash"] = "The preloader crash log exists only when the preloader itself threw.";
+        return reasons;
+    },
+    logSignatures: SIGNATURES,
+    validators: [...PACKAGING_VALIDATORS, ...PLUGIN_VALIDATORS, ...REFERENCE_VALIDATORS],
+    compat: valheimCompat,
+    index: valheimIndex,
+    toolNeeds: [
+        { feature: "index", data: [{ id: "valheim.jotunn", envVar: "MODWRIGHT_VALHEIM_JOTUNN_DATA", what: "a Valheim-Modding/Jotunn checkout (or its JotunnLib/Documentation/data folder)" }], note: "build_index reads JotunnDoc's committed dumps; no game install or tool is needed." },
+        { feature: "build", tools: ["dotnet"], note: "dotnet build compiles BepInEx plugins." },
+        { feature: "build", tools: ["tcli"], optional: true, note: "Thunderstore packaging only." },
+    ],
+    processNames: ["valheim.exe", "valheim_server.exe"],
+    guidance: "Mods are BepInEx 5 plugins ordered by their own [BepInDependency] declarations; there is " +
+        "no order file, so load_order is unsupported here by design and the sequence of 'Loading " +
+        "[...]' lines in LogOutput.log is an observation of the last run, not a plan. Plugin " +
+        "collisions are on GUID, not path. The community's BepInEx is denikson's BepInExPack_Valheim, " +
+        "which differs from stock in ways that matter (SemVer plugin versions accepted, console on); " +
+        "an r2modman profile keeps its own BepInEx under AppData, so the game folder can look " +
+        "unmodded while the profile is fully modded. A project declares its folders by source kind: " +
+        "'package' for the Thunderstore package root (manifest.json, icon.png, README.md and the " +
+        "BepInEx routes), 'source' for the plugin's C# tree. Valheim left early access on 2026-09-09 with a " +
+        "Unity engine upgrade, and most plugins were broken by it at the time of writing. Nothing " +
+        "here has run against an installed game.",
+};
+export async function installKind(root) {
+    if (await pathExists(path.join(root, "valheim_server.exe")))
+        return "server";
+    if (await pathExists(path.join(root, "valheim.exe")))
+        return "client";
+    try {
+        const entries = await fs.readdir(root);
+        if (entries.some((e) => e.toLowerCase() === "valheim_server_data"))
+            return "server";
+        if (entries.some((e) => e.toLowerCase() === "valheim_data"))
+            return "client";
+    }
+    catch {
+    }
+    return undefined;
+}
+export function diskLoggingDisabled(cfgText) {
+    let section = "";
+    for (const raw of cfgText.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const sec = /^\[(.+)\]$/.exec(line);
+        if (sec) {
+            section = sec[1].trim().toLowerCase();
+            continue;
+        }
+        if (section !== "logging.disk")
+            continue;
+        const m = /^enabled\s*=\s*(\w+)/i.exec(line);
+        if (m)
+            return m[1].toLowerCase() === "false";
+    }
+    return false;
+}

package/dist/surfaces/valheim/validators/packaging.js

@@ -0,0 +1,218 @@
+import { promises as fs } from "node:fs";
+import * as path from "node:path";
+import { walk } from "../../../core/fsutil.js";
+import { checkThunderstoreToml, ICON_SIZE, PACKAGE_OPTIONAL_ROOT_FILES, PACKAGE_ROOT_FILES, PACKAGE_ROUTES, parseThunderstoreManifest, readPngDimensions, routeOf } from "../packaging.js";
+export const PACKAGE_SOURCE_KIND = "package";
+const EVIDENCE = ["valheim.thunderstore.packaging.required-zip-contents", "valheim.thunderstore.packaging.manifest-fields", "valheim.thunderstore.packaging.dependency-string-format", "valheim.thunderstore.packaging.versions-are-immutable"];
+const ROOT_FILES_EVIDENCE = ["valheim.thunderstore.packaging.required-zip-contents", "valheim.toolchain.build.icon-must-be-a-256-png", "valheim.thunderstore.packaging.versions-are-immutable"];
+const ROUTES_EVIDENCE = ["valheim.thunderstore.packaging.bepinex-folder-routing", "valheim.thunderstore.packaging.ecosystem-install-rules"];
+const TOML_EVIDENCE = ["valheim.thunderstore.packaging.thunderstore-toml-dependency-shape-differs", "valheim.thunderstore.packaging.tcli-does-not-compile"];
+const DIST_EVIDENCE = ["valheim.jotunn.library.no-redistribution-of-game-assemblies", "valheim.install.layout.managed-assembly-set"];
+const appliesToPackages = (target, project) => target.kind === "project" && project.sources.some((s) => s.exists && s.kind === PACKAGE_SOURCE_KIND);
+const APPLIES = `the project, when it has a source of kind "${PACKAGE_SOURCE_KIND}"`;
+function packageSources(project) {
+    return project.sources.filter((s) => s.exists && s.kind === PACKAGE_SOURCE_KIND);
+}
+function rootFile(entries, expected) {
+    const exact = entries.find((e) => e === expected);
+    const nearMisses = entries.filter((e) => e !== expected && e.toLowerCase() === expected.toLowerCase());
+    return { ...(exact ? { exact } : {}), nearMisses };
+}
+const manifest = {
+    id: "valheim.packaging.manifest",
+    game: "valheim",
+    groups: ["packaging"],
+    modTypes: ["packaging"],
+    summary: "manifest.json sits at the package root with that exact spelling, parses, and its five fields follow Thunderstore's rules (name charset and length, description length, three-integer version_number, website_url present, {team}-{package}-{version} dependencies).",
+    appliesTo: appliesToPackages,
+    appliesToDescription: APPLIES,
+    needs: { project: true },
+    cost: "edit",
+    severity: "block",
+    evidence: EVIDENCE,
+    async run(ctx) {
+        const findings = [];
+        for (const source of packageSources(ctx.project)) {
+            const entries = await fs.readdir(source.absPath);
+            const { exact, nearMisses } = rootFile(entries, "manifest.json");
+            for (const miss of nearMisses) {
+                findings.push({ validatorId: this.id, severity: "block", file: path.join(source.absPath, miss), message: `Package "${source.id}" has ${miss} where Thunderstore requires manifest.json; file naming is case-sensitive and the upload is refused.`, fix: "Rename it to manifest.json.", evidence: EVIDENCE });
+            }
+            if (!exact) {
+                if (nearMisses.length === 0)
+                    findings.push({ validatorId: this.id, severity: "block", file: source.absPath, message: `Package "${source.id}" has no manifest.json at its root; Thunderstore requires manifest.json, icon.png and README.md there.`, evidence: EVIDENCE });
+                continue;
+            }
+            const file = path.join(source.absPath, exact);
+            let text;
+            try {
+                text = await ctx.readText(file);
+            }
+            catch (err) {
+                findings.push({ validatorId: this.id, severity: "block", file, message: `manifest.json could not be read: ${err.message}`, evidence: EVIDENCE });
+                continue;
+            }
+            try {
+                const { problems } = parseThunderstoreManifest(text);
+                for (const p of problems) {
+                    findings.push({ validatorId: this.id, severity: "block", file, message: `manifest.json in "${source.id}": ${p.message}.`, fix: "Thunderstore rejects the upload; fix the field before publishing, since a published version cannot be edited.", evidence: EVIDENCE });
+                }
+            }
+            catch (err) {
+                findings.push({ validatorId: this.id, severity: "block", file, message: `manifest.json in "${source.id}" is not valid JSON: ${err.message}`, evidence: EVIDENCE });
+            }
+        }
+        return findings;
+    },
+};
+const rootFiles = {
+    id: "valheim.packaging.root-files",
+    game: "valheim",
+    groups: ["packaging"],
+    modTypes: ["packaging"],
+    summary: "icon.png (a 256x256 PNG) and README.md sit at the package root with exactly those names; CHANGELOG.md is optional.",
+    appliesTo: appliesToPackages,
+    appliesToDescription: APPLIES,
+    needs: { project: true },
+    cost: "edit",
+    severity: "block",
+    evidence: ROOT_FILES_EVIDENCE,
+    async run(ctx) {
+        const findings = [];
+        for (const source of packageSources(ctx.project)) {
+            const entries = await fs.readdir(source.absPath);
+            for (const expected of ["icon.png", "README.md"]) {
+                const { exact, nearMisses } = rootFile(entries, expected);
+                for (const miss of nearMisses) {
+                    findings.push({ validatorId: this.id, severity: "block", file: path.join(source.absPath, miss), message: `Package "${source.id}" has ${miss} where Thunderstore requires ${expected}; file naming is case-sensitive.`, fix: `Rename it to ${expected}.`, evidence: ROOT_FILES_EVIDENCE });
+                }
+                if (!exact) {
+                    if (nearMisses.length === 0)
+                        findings.push({ validatorId: this.id, severity: "block", file: source.absPath, message: `Package "${source.id}" has no ${expected} at its root; Thunderstore requires it.`, evidence: ROOT_FILES_EVIDENCE });
+                    continue;
+                }
+                if (expected === "icon.png") {
+                    const file = path.join(source.absPath, exact);
+                    const dims = await readPngDimensions(file).catch(() => undefined);
+                    if (!dims) {
+                        findings.push({ validatorId: this.id, severity: "block", file, message: `icon.png in "${source.id}" is not a PNG (no PNG signature and IHDR chunk); Thunderstore requires a PNG exactly ${ICON_SIZE}x${ICON_SIZE}.`, evidence: ROOT_FILES_EVIDENCE });
+                    }
+                    else if (dims.width !== ICON_SIZE || dims.height !== ICON_SIZE) {
+                        findings.push({ validatorId: this.id, severity: "block", file, message: `icon.png in "${source.id}" is ${dims.width}x${dims.height}; Thunderstore requires exactly ${ICON_SIZE}x${ICON_SIZE}.`, fix: `Resize the icon to ${ICON_SIZE}x${ICON_SIZE}.`, evidence: ROOT_FILES_EVIDENCE });
+                    }
+                }
+            }
+            for (const optional of PACKAGE_OPTIONAL_ROOT_FILES) {
+                for (const miss of rootFile(entries, optional).nearMisses) {
+                    findings.push({ validatorId: this.id, severity: "warn", file: path.join(source.absPath, miss), message: `Package "${source.id}" has ${miss}; Thunderstore reads the optional changelog only as ${optional}.`, evidence: ROOT_FILES_EVIDENCE });
+                }
+            }
+        }
+        return findings;
+    },
+};
+const routes = {
+    id: "valheim.packaging.routes",
+    game: "valheim",
+    groups: ["packaging"],
+    modTypes: ["packaging"],
+    summary: `Every file in the package beyond the root files lands under one of the folders the managers preserve (${PACKAGE_ROUTES.join(", ")}, with or without the BepInEx/ prefix); anything else is flattened into plugins, and nothing ships into core.`,
+    appliesTo: appliesToPackages,
+    appliesToDescription: APPLIES,
+    needs: { project: true },
+    cost: "build",
+    severity: "warn",
+    evidence: ROUTES_EVIDENCE,
+    async run(ctx) {
+        const findings = [];
+        const rootNames = new Set([...PACKAGE_ROOT_FILES, ...PACKAGE_OPTIONAL_ROOT_FILES].map((n) => n.toLowerCase()));
+        for (const source of packageSources(ctx.project)) {
+            const { files, truncated } = await walk(source.absPath);
+            if (truncated)
+                findings.push({ validatorId: this.id, severity: "info", file: source.absPath, message: `Package "${source.id}" has more files than this scan's limit; the route check may be incomplete.`, evidence: ROUTES_EVIDENCE });
+            for (const rel of files) {
+                const file = path.join(source.absPath, rel);
+                const segments = rel.split(/[\\/]+/);
+                if (segments.length === 1) {
+                    if (!rootNames.has(segments[0].toLowerCase())) {
+                        findings.push({ validatorId: this.id, severity: "warn", file, message: `${rel} sits at the root of package "${source.id}"; the managers flatten it into BepInEx/plugins, which is rarely where it belongs.`, fix: "Move it under plugins/<Mod>/ (or the route it is for), or drop it from the package.", evidence: ROUTES_EVIDENCE });
+                    }
+                    continue;
+                }
+                const route = routeOf(rel);
+                if (!route) {
+                    findings.push({ validatorId: this.id, severity: "warn", file, message: `${rel} in package "${source.id}" is outside every route the managers preserve (${PACKAGE_ROUTES.join(", ")}); r2modman and the Thunderstore app flatten it into BepInEx/plugins.`, fix: "Put it under plugins/<Mod>/ if it belongs with the plugin, or config/ for a shipped config file.", evidence: ROUTES_EVIDENCE });
+                }
+                else if (route.route === "core") {
+                    findings.push({ validatorId: this.id, severity: "warn", file, message: `${rel} in package "${source.id}" ships into BepInEx/core, which holds BepInEx's own assemblies and is never a mod's deploy target.`, fix: "A mod that needs a library ships it beside its own DLL under plugins/<Mod>/.", evidence: ROUTES_EVIDENCE });
+                }
+            }
+        }
+        return findings;
+    },
+};
+const thunderstoreToml = {
+    id: "valheim.packaging.thunderstore-toml",
+    game: "valheim",
+    groups: ["packaging"],
+    modTypes: ["packaging"],
+    summary: "A thunderstore.toml beside the project parses, and its [package.dependencies] is a table of \"Team-Name\" = \"version\", not manifest.json's flat list.",
+    appliesTo: (target, project) => target.kind === "file" && path.basename(target.path).toLowerCase() === "thunderstore.toml" && (path.dirname(target.path) === project.root || project.sources.some((s) => s.exists && path.dirname(target.path) === s.absPath)),
+    appliesToDescription: "thunderstore.toml at the project root or at a source root",
+    needs: { project: true },
+    cost: "edit",
+    severity: "block",
+    evidence: TOML_EVIDENCE,
+    async run(ctx) {
+        if (ctx.target.kind !== "file")
+            return [];
+        const file = ctx.target.path;
+        const check = checkThunderstoreToml(await ctx.readText(file));
+        return check.problems.map((p) => ({
+            validatorId: this.id,
+            severity: "block",
+            file,
+            message: `thunderstore.toml: ${p}; tcli build assembles manifest.json from this file and fails on the wrong shape.`,
+            evidence: TOML_EVIDENCE,
+        }));
+    },
+};
+export const GAME_ASSEMBLY_RE = /^(?:assembly_[a-z0-9]+|.+_publicized|SoftReferenceableAssets|gui_framework|UnityEngine(?:\.[A-Za-z0-9]+)*|mscorlib|System(?:\.[A-Za-z0-9]+)*)\.dll$/i;
+const dist = {
+    id: "valheim.dist.no-game-assemblies",
+    game: "valheim",
+    groups: ["packaging"],
+    modTypes: ["packaging"],
+    summary: "No game or engine assembly (assembly_*.dll, *_publicized.dll, SoftReferenceableAssets.dll, gui_framework.dll, UnityEngine*.dll, mscorlib, System.*) and nothing from valheim_Data/Managed is inside a package.",
+    appliesTo: appliesToPackages,
+    appliesToDescription: APPLIES,
+    needs: { project: true },
+    cost: "build",
+    severity: "block",
+    evidence: DIST_EVIDENCE,
+    async run(ctx) {
+        const findings = [];
+        for (const source of packageSources(ctx.project)) {
+            const { files, truncated } = await walk(source.absPath);
+            if (truncated)
+                findings.push({ validatorId: this.id, severity: "info", file: source.absPath, message: `Package "${source.id}" has more files than this scan's limit; the never-ships sweep may be incomplete for it.`, evidence: DIST_EVIDENCE });
+            for (const rel of files) {
+                const file = path.join(source.absPath, rel);
+                const base = path.basename(file);
+                const underManaged = /(^|[\\/])valheim(?:_server)?_Data[\\/]Managed[\\/]/i.test(rel);
+                if (!GAME_ASSEMBLY_RE.test(base) && !underManaged)
+                    continue;
+                findings.push({
+                    validatorId: this.id,
+                    severity: "block",
+                    file,
+                    message: `${rel} in package "${source.id}" is a game or engine assembly; the community's norm is that patchers ship and assemblies do not (the JotunnModStub README calls them copyrighted material), and a publicized copy is a per-install build artifact regenerated after every patch.`,
+                    fix: "Remove it from the package; reference it from the developer's own valheim_Data/Managed (or publicized_assemblies) at build time only.",
+                    evidence: DIST_EVIDENCE,
+                });
+            }
+        }
+        return findings;
+    },
+};
+export const PACKAGING_VALIDATORS = [manifest, rootFiles, routes, thunderstoreToml, dist];