stillmade-sdk 0.1.35 → 0.1.36

package/blocks/connected-app/versions/1.6.0/view.js

@@ -0,0 +1,27 @@
+// 1.6.0 (October 24, 2026): an app's workspace note is an (i) beside the Task heading, not a
+// heading and paragraph; its developer settings are not shown and rare ones fold into More options.
+import {taskSelectionView} from '../1.5.0/task-selection.js';
+import {connectedAppView as originalView} from '../1.0.0/view.js';
+import {metaTestView,metaTestContract} from '../../../meta-ads/versions/1.2.0/workspace.js';
+import {gmailWorkspaceView} from '../../../gmail/versions/1.1.0/workspace.js';
+const DEVELOPER_FIELDS=/^(page_?token|next_?page_?token|cursor|verbose|include_?payload|ids_?only)$/i;
+// Result tables from the shared preview: scroll sideways instead of squeezing.
+const RESULT_CSS='.connection-task-head{display:flex;align-items:center;gap:4px}.connection-task-head h3{margin:0}.sm-field:has(>input[type="checkbox"]){display:flex;align-items:center;gap:8px}.sm-field>input[type="checkbox"]{width:20px;height:20px;margin:0;flex:none}.connection-table{overflow-x:auto;display:grid;gap:4px}#connection-result table{border-collapse:collapse;width:100%;font-size:14px}#connection-result th,#connection-result td{text-align:left;vertical-align:top;padding:6px 8px;border-bottom:1px solid var(--border);overflow-wrap:break-word}#connection-result thead th{font-weight:600;white-space:nowrap}.connection-fields th{width:35%;font-weight:500}#connection-result details{border-top:1px solid var(--border);padding:6px 0}#connection-result summary{cursor:pointer;font-weight:500}';
+export function connectedAppWorkspace(appId,schema,bindings){
+ if(appId==='app:meta-ads')return {sharedWork:metaTestContract,view:metaTestView()};
+ if(appId==='app:gmail')return gmailWorkspaceView(schema,bindings);
+ return {};
+}
+export function connectedAppView(schema,bindings,{appId}={}){
+ const workspace=connectedAppWorkspace(appId,schema,bindings),view=originalView(workspace.schema||schema,bindings);
+ view.javascript=view.javascript.replace('canEdit=true','canEdit=false').replace("[{tag:'h3',text:'Result'},{tag:'output',className:'connection-result',text:JSON.stringify(shared.outputs.result,null,2).slice(0,10000)}]",'StillMade.schemaFields.preview(shared.outputs.result)');
+ if(workspace.view){view.html=workspace.view.html+view.html;view.css=workspace.view.css+'\n'+view.css;view.javascript+='\n'+workspace.view.javascript;}
+ // An app's workspace note is an (i) beside the Task heading.
+ const note=workspace.heading?'<details class="sm-hint"><summary aria-label="About this '+workspace.heading.toLowerCase()+' task" title="About this '+workspace.heading.toLowerCase()+' task"></summary><p>'+workspace.description+'</p></details>':'';
+ if(workspace.heading)view.html=view.html.replace('Review and run task',workspace.runLabel);
+ // Paging and debugging settings of any app are for developers: they keep the app's default.
+ const fields=Object.keys((workspace.schema||schema).properties||{}),required=new Set((workspace.schema||schema).required||[]);
+ const hide=[...new Set([...(workspace.hide||[]),...fields.filter(key=>!required.has(key)&&DEVELOPER_FIELDS.test(key))])],more=(workspace.more||[]).filter(key=>!hide.includes(key));
+ if(hide.length||more.length)view.javascript=view.javascript.replace('StillMade.schemaFields.controls(schema,bindings,draft,{canEdit,busy})','StillMade.schemaFields.controls(schema,bindings,draft,{canEdit,busy,more:'+JSON.stringify(more)+',hide:'+JSON.stringify(hide)+'})');
+ const tasks=taskSelectionView();view.javascript=view.javascript.replace('if(busy||!canEdit)return;try{draft=StillMade.schemaFields.change','if(busy||!canEdit||!actions.some(item=>item.id===event.action))return;try{draft=StillMade.schemaFields.change');return {html:(note?tasks.html.replace('<h3>Task</h3>','<div class="sm-label connection-task-head"><h3>Task</h3>'+note+'</div>'):tasks.html)+view.html,css:tasks.css+'\n'+view.css+'\n'+RESULT_CSS,javascript:view.javascript+'\n'+tasks.javascript};
+}

package/blocks/gmail/versions/1.1.0/workspace.js

@@ -0,0 +1,15 @@
+// 1.1.0 (October 24, 2026, owner: "so much text… this better not be what regular users see"): the
+// workspace note is one sentence behind an (i); Gmail's API settings (user id, page token, payload,
+// label ids, format, verbose) are not shown and keep Gmail's defaults; a rarely changed choice folds
+// into More options. Draft controls remain in the existing project-local view state. Reusing a
+// mailbox grants neither cross-project draft access nor permission to send.
+const TITLES={to:'To',recipient:'To',recipients:'To',recipient_email:'To',extra_recipients:'More recipients',cc:'Cc',bcc:'Bcc',subject:'Subject',body:'Message',message_body:'Message',text_body:'Message',html_body:'HTML message',is_html:'Send as HTML',attachment:'Attachment',thread_id:'Selected thread',threadId:'Selected thread',message_id:'Email',messageId:'Email',query:'Search',max_results:'How many',include_spam_trash:'Spam and trash too'};
+const KNOWN=['to','recipient','recipients','recipient_email','subject','body','message_body','text_body','html_body','thread_id','threadId'];
+const MAIN=new Set([...KNOWN,'cc','bcc','attachment','query','max_results','message_id','messageId']);
+// Settings for developers, never for people: Gmail's own defaults are right.
+const HIDDEN=new Set(['user_id','userId','page_token','pageToken','include_payload','verbose','ids_only','format','metadata_headers','label_ids','labelIds']);
+export function gmailWorkspaceView(schema,bindings){
+ const fieldNames=Object.keys(schema.properties||{}),required=new Set(schema.required||[]),ordered=[...KNOWN.filter(key=>fieldNames.includes(key)),...fieldNames.filter(key=>!KNOWN.includes(key))],copy={...schema,properties:Object.fromEntries(ordered.map(key=>[key,{...schema.properties[key],title:TITLES[key]||schema.properties[key].title||key}]))};
+ const hide=ordered.filter(key=>!required.has(key)&&HIDDEN.has(key));
+ return {schema:copy,heading:'Email',description:'Reading or attaching a thread never lets this Step send, and each project keeps its own draft.',runLabel:'Review email task',hide,more:ordered.filter(key=>!required.has(key)&&!MAIN.has(key)&&!HIDDEN.has(key))};
+}

package/blocks/native/sm.when/versions/1.1.0/package.js

@@ -0,0 +1,216 @@
+// Generated by scripts/build-owned-blocks.mjs. Edit the owned source files.
+export default {
+  "manifest": {
+    "schemaVersion": 1,
+    "sdkVersion": "0.1.0",
+    "id": "sm.when",
+    "version": "1.1.0",
+    "name": "Automation",
+    "description": "Start an automation and choose which items go through: a schedule, a new item in a connected app, a webhook, another project finishing or only by hand starts each run, and Only if rules (a quick check on the item, or an AI check in plain words) let through only the items you want. The item that started a run goes to the next Step.",
+    "kind": "task",
+    "runtime": "javascript",
+    "license": "MIT",
+    "provenance": {
+      "notice": "Original source (authorship declared by the packager)\nLicense: MIT\nChanges: Original implementation declared by the packager; no reused repository or dependency code.\nFiles: LICENSE, src/run.js\n\nMIT License\n\nCopyright (c) 2026 StillMade contributors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n",
+      "portableSources": [
+        {
+          "kind": "original",
+          "license": "MIT",
+          "paths": [
+            "LICENSE",
+            "src/run.js"
+          ],
+          "evidence": [
+            "upstream/0/LICENSE",
+            "upstream/0/src/run.js"
+          ],
+          "changes": "Original implementation declared by the packager; no reused repository or dependency code."
+        }
+      ]
+    },
+    "inputs": {
+      "event": {
+        "type": "object",
+        "semantic": "workflow_event",
+        "schema": {
+          "id": "string",
+          "kind": "string",
+          "occurredAt": "string",
+          "preview": "boolean",
+          "data": "object"
+        },
+        "sources": [
+          "project"
+        ],
+        "description": "The schedule time, app event, webhook call or finished project that started this run. Absent when you run the step by hand.",
+        "required": false
+      },
+      "start": {
+        "type": "object",
+        "schema": "object",
+        "semantic": "automation_start",
+        "required": false,
+        "description": "A suggested start for the Automation page, such as {\"app\":\"app:gmail\",\"event\":\"GMAIL_NEW_GMAIL_MESSAGE\"}. What starts a run is what you turn on there."
+      },
+      "only_if": {
+        "type": "text",
+        "semantic": "automation_condition",
+        "required": false,
+        "description": "A suggested AI check in plain words for the Automation page, for example: Is it a sales lead? What runs is what you turn on there."
+      }
+    },
+    "outputs": {
+      "item": {
+        "type": "object",
+        "primary": true,
+        "semantic": "external_data",
+        "schema": "object",
+        "required": false,
+        "description": "The item that started this run, such as a new email, lead or order. Missing for a schedule, a run by hand, or an item the AI check turned down."
+      },
+      "trigger": {
+        "type": "object",
+        "semantic": "automation_trigger",
+        "schema": {
+          "kind": "string",
+          "at": "string",
+          "source": "string"
+        },
+        "description": "What started this run and when: a schedule time, an app event, or a manual run."
+      },
+      "check": {
+        "type": "object",
+        "semantic": "ai_decision",
+        "schema": {
+          "yes": "boolean",
+          "score": "integer",
+          "label": "string",
+          "reason": "string"
+        },
+        "required": false,
+        "description": "The AI check’s answer about the item: yes or no, a score from 0 to 100, a short label and the reason."
+      }
+    },
+    "permissions": {
+      "project": []
+    },
+    "ui": []
+  },
+  "code": "const e = input.event;\nif (!e) return { trigger: { kind: 'manual', at: '', source: 'manual' } };\nconst data = e.data && typeof e.data === 'object' && !Array.isArray(e.data) ? e.data : {};\nconst trigger = { kind: e.kind, at: typeof data.scheduledAt === 'string' ? data.scheduledAt : e.occurredAt, source: e.id };\n// A schedule carries no item. An app's event holds its own payload under data ({type, data}); a\n// webhook or another project finishing is the item itself.\nif (e.kind === 'schedule.tick') return { trigger };\nconst own = data.data && typeof data.data === 'object' && !Array.isArray(data.data) && typeof data.type === 'string';\nreturn { trigger, item: own ? data.data : data };\n",
+  "tests": [
+    {
+      "name": "Manual run",
+      "input": {},
+      "expected": {
+        "trigger": {
+          "kind": "manual",
+          "at": "",
+          "source": "manual"
+        }
+      }
+    },
+    {
+      "name": "Schedule tick has no item",
+      "input": {
+        "event": {
+          "id": "schedule:2026-10-12T13:00:00.000Z",
+          "kind": "schedule.tick",
+          "occurredAt": "2026-10-12T13:00:04.000Z",
+          "preview": false,
+          "data": {
+            "scheduledAt": "2026-10-12T13:00:00.000Z"
+          }
+        }
+      },
+      "expected": {
+        "trigger": {
+          "kind": "schedule.tick",
+          "at": "2026-10-12T13:00:00.000Z",
+          "source": "schedule:2026-10-12T13:00:00.000Z"
+        }
+      }
+    },
+    {
+      "name": "An app event hands on its own payload",
+      "input": {
+        "event": {
+          "id": "msg-1",
+          "kind": "external.updated",
+          "occurredAt": "2026-10-22T09:00:00.000Z",
+          "preview": false,
+          "data": {
+            "type": "gmail_new_gmail_message",
+            "data": {
+              "sender": "ana@example.com",
+              "subject": "Pricing for 20 seats"
+            }
+          }
+        }
+      },
+      "expected": {
+        "trigger": {
+          "kind": "external.updated",
+          "at": "2026-10-22T09:00:00.000Z",
+          "source": "msg-1"
+        },
+        "item": {
+          "sender": "ana@example.com",
+          "subject": "Pricing for 20 seats"
+        }
+      }
+    },
+    {
+      "name": "A webhook call is the item",
+      "input": {
+        "event": {
+          "id": "order-7",
+          "kind": "external.updated",
+          "occurredAt": "2026-10-22T09:05:00.000Z",
+          "preview": false,
+          "data": {
+            "order": "7",
+            "total": 42
+          }
+        }
+      },
+      "expected": {
+        "trigger": {
+          "kind": "external.updated",
+          "at": "2026-10-22T09:05:00.000Z",
+          "source": "order-7"
+        },
+        "item": {
+          "order": "7",
+          "total": 42
+        }
+      }
+    }
+  ],
+  "portable": {
+    "format": "stillmade-block/1",
+    "dependencies": [],
+    "sources": [
+      {
+        "kind": "original",
+        "license": "MIT",
+        "paths": [
+          "LICENSE",
+          "src/run.js"
+        ],
+        "evidence": [
+          "upstream/0/LICENSE",
+          "upstream/0/src/run.js"
+        ],
+        "changes": "Original implementation declared by the packager; no reused repository or dependency code."
+      }
+    ],
+    "files": {
+      "upstream/0/LICENSE": "MIT License\n\nCopyright (c) 2026 StillMade contributors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n",
+      "upstream/0/src/run.js": "const e = input.event;\nif (!e) return { trigger: { kind: 'manual', at: '', source: 'manual' } };\nconst data = e.data && typeof e.data === 'object' && !Array.isArray(e.data) ? e.data : {};\nconst trigger = { kind: e.kind, at: typeof data.scheduledAt === 'string' ? data.scheduledAt : e.occurredAt, source: e.id };\n// A schedule carries no item. An app's event holds its own payload under data ({type, data}); a\n// webhook or another project finishing is the item itself.\nif (e.kind === 'schedule.tick') return { trigger };\nconst own = data.data && typeof data.data === 'object' && !Array.isArray(data.data) && typeof data.type === 'string';\nreturn { trigger, item: own ? data.data : data };\n"
+    },
+    "lineage": {
+      "parents": [],
+      "changes": "Packaged original Block source for StillMade."
+    }
+  }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stillmade-sdk",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "description": "StillMade Block SDK, CLI and examples",
   "license": "PolyForm-Shield-1.0.0",
   "type": "module",

package/packages/block-cli/cli.js

@@ -3,8 +3,9 @@ import {blockFeatures} from '../block-sdk/feature-map.js';
 import {assertRemixReady} from '../block-sdk/remix-policy.js';
 import {remixBlock,bundledRemixSource,assertRemixAttribution} from '../block-platform/block-remix.js';
 import {verifyPortableSources} from '../block-sdk/portable-github.js';
-import {VIEW_SOURCE_FILES,VIEW_CONFIG_FILE,viewFromSource} from '../block-sdk/view-source.js';
-import {describeViewFiles} from '../block-sdk/view.js';
+import {packageFromFolder} from '../block-sdk/folder-package.js';
+import {permissionUsage,fixPermissions} from '../block-sdk/permission-usage.js';
+import {summarizePermissions} from '../block-sdk/permission-summary.js';
 import {createRequire} from 'node:module';
 import {randomBytes} from 'node:crypto';
 import {readdir,lstat} from 'node:fs/promises';
@@ -35,7 +36,7 @@ import {textGenerate} from '../block-sdk/capability-example.js';
 import {scanPackage} from '../block-sdk/admission.js';
 import {admitLocalPackage} from '../block-sdk/local-admission.js';
 import {requiresDesktopExecution} from '../block-sdk/desktop-execution.js';
-import {digest} from '../block-sdk/contracts.js';
+import {digest,validateManifest} from '../block-sdk/contracts.js';
 import { testPackage, validatePackage } from '../block-sdk/testing.js';
 import { runPackageAsync } from '../block-sdk/runtime.js';
 import { validateProjectType } from '../block-platform/project-types.js';
@@ -46,7 +47,7 @@ import {defineBrowserApplicationSource} from '../block-sdk/browser-application-e
 import { BUILTIN_BLOCKS } from '../block-platform/catalog.js';
 import { RECIPE_TYPE_EXAMPLE, typeWorkspaceSupport } from '../block-platform/type-workspace.js';
 import {PLATFORM_CHECK_POLICY,PLATFORM_CHECK_TARGETS,PLATFORM_CHECK_THEMES} from '../block-sdk/platform-checks.js';
-import {describeModuleFiles,MODULE_LIMITS} from '../block-sdk/module-runtime.js';
+import {MODULE_LIMITS} from '../block-sdk/module-runtime.js';
 import {createModuleBundle,readModuleBundle,hasDigestFiles,MODULE_BUNDLE_SUFFIX} from '../block-sdk/module-bundle.js';
 import {createNodeModuleExecutor} from '../block-sdk/module-node.js';
 import {createMockHost,standInFixtures,validateMocks,MOCKS_FILE} from '../block-sdk/mock-host.js';
@@ -58,10 +59,6 @@ import {HELP,formatResult,formatError} from './format.js';
 // The bytes stay beside the package: tests and previews run them locally, and
 // pack writes one .stillmade-module.json for StillMade to import and upload.
 const moduleFiles=new WeakMap();
-async function readModuleFolder(folder,entry){
- const files=await readFolderBytes(folder);
- return {module:await describeModuleFiles(entry,files),files};
-}
 async function readFolderBytes(folder){
  const files={};let total=0;
  const walk=async(dir,prefix='')=>{for(const item of await readdir(dir,{withFileTypes:true})){
@@ -169,28 +166,12 @@ export async function readPackage(path) {
     moduleFiles.set(bundle.package,files);return bundle.package;
   }
   if (!info.isDirectory()) { if (info.size > 4000000) throw new Error('Package exceeds 4 MB'); return JSON.parse(await readFile(path, 'utf8')); }
-  const read = async file => { const full = join(path, file); const info = await stat(full); if (info.size > 4000000) throw new Error('Package file exceeds 4 MB'); return JSON.parse(await readFile(full, 'utf8')); };
-  const manifest = await read('stillmade.block.json');
-  let source,localModule;
-  if (manifest.runtime === 'module') {
-    let entry='main.js';try{entry=(await read('module.json')).entry;}catch(error){if(error.code!=='ENOENT')throw error;}
-    localModule=await readModuleFolder(join(path,'module'),entry);source={module:localModule.module};
-  } else if (manifest.runtime === 'javascript') {
-    const codePath = join(path, 'src/run.js');
-    if ((await stat(codePath)).size > 262144) throw new Error('JavaScript exceeds 256 KiB');
-    source = { code: await readFile(codePath, 'utf8') };
-  } else if(manifest.runtime === 'comfyui') source = { comfyui: await read('src/comfyui.json') };
-  else if(manifest.runtime === 'capability') source = { capability: await read('src/capability.json') };
-  else source = { recipe: await read('src/recipe.json') };
-  // A frame view's script may be a framework bundle (up to 4 MiB).
-  const sources={};for(const name of ['view.json',VIEW_CONFIG_FILE,...Object.keys(VIEW_SOURCE_FILES)]){try{const file=join(path,'src',name);if((await stat(file)).size>(name==='view.js'?4194304:262144))throw new Error(`Interface source ${name} is too large`);sources[name]=await readFile(file,'utf8');}catch(error){if(error.code!=='ENOENT')throw error;}}
-  const view=viewFromSource(sources);
-  // A frame view's assets live in src/view-files/ and are named by SHA-256.
-  let viewFiles=null;
-  if(view?.runtime==='frame'){try{const bytes=await readFolderBytes(join(path,'src','view-files'));view.files=await describeViewFiles(bytes);viewFiles=Object.fromEntries(Object.entries(bytes).map(([name,value])=>[`view:${name}`,value]));}catch(error){if(error.code!=='ENOENT')throw error;}}
-  let desktop;try{desktop=await read('src/desktop.json');}catch(error){if(error.code!=='ENOENT')throw error;}
-  const pkg={ manifest, ...source, ...(desktop!==undefined?{desktop}:{}), ...(view!==undefined?{view}:{}), tests: await read('tests/fixtures.json') };
-  if(localModule||viewFiles)moduleFiles.set(pkg,{...(localModule?.files||{}),...(viewFiles||{})});
+  // The folder layout is read by the SDK's shared reader, the same one the app's Import folder uses.
+  const {pkg,files}=await packageFromFolder({
+   read:async file=>{const full=join(path,file);let info;try{info=await lstat(full);}catch(error){if(error.code==='ENOENT')return undefined;throw error;}if(info.isSymbolicLink())throw new Error('Package symlinks are unavailable');if(!info.isFile())return undefined;return new Uint8Array(await readFile(full));},
+   list:async prefix=>{try{return await readFolderBytes(join(path,prefix));}catch(error){if(error.code==='ENOENT')return {};throw error;}},
+  });
+  if(files)moduleFiles.set(pkg,files);
   return pkg;
 }
 export const MODULE_EXECUTION_REQUIRED_MESSAGE='This Block runs code, so the gate a hook starts does not run it. Run `stillmade-block gate .` (`npx stillmade-block gate .` in an npm project) yourself and report the status it prints.';
@@ -236,7 +217,7 @@ export async function main(rawArgs) {
    const file=join(path,'stillmade-env.d.ts');await writeFile(file,blockTypeDeclarations(manifest));
    return {types:file,inputs:Object.keys(manifest.inputs||{}),outputs:Object.keys(manifest.outputs||{})};
   }
-  if (!['validate', 'test', 'preview', 'pack', 'inspect', 'remix', 'ready'].includes(command)) throw Object.assign(new Error(`Unknown command ${command}. Run stillmade-block --help for the commands.`),{code:'USAGE'});
+  if (!['validate', 'test', 'preview', 'pack', 'inspect', 'remix', 'ready', 'permissions'].includes(command)) throw Object.assign(new Error(`Unknown command ${command}. Run stillmade-block --help for the commands.`),{code:'USAGE'});
   let pkg = await readPackage(path);
   if(args.includes('--original')){
     if(command!=='pack'||!extra||extra.startsWith('--'))throw new Error('Use pack <source> <output.stillmade-block> --original only for your own original implementation.');
@@ -279,6 +260,7 @@ export async function main(rawArgs) {
     const review=hosted ? {reviewRequired:true,liveVerified:false,workflowComplete:false,workflowStatus:'deferred'} : {};
     if (command === 'validate') return { valid: true, id: pkg.id,...(args.includes('--mobile')?{mobileProfile:mobileProfile()}:{}),...(hosted ? {tests:0,...review} : {}) };
     if (command === 'inspect') return { id: pkg.id, version: pkg.version, stages: pkg.stages, workspace: typeWorkspaceSupport(pkg) };
+    if(command==='permissions')return {id:pkg.id,blocks:(pkg.packages||[]).map(block=>({id:block.manifest.id,summary:summarizePermissions(block.manifest)}))};
     if (command === 'preview') return previewProjectType(pkg,{inputs:extra ? JSON.parse(await readFile(resolve(extra),'utf8')) : {}});
     // Export source without executing local or hosted code. This is not an
     // admission report; every embedded package still needs host review later.
@@ -298,6 +280,18 @@ export async function main(rawArgs) {
     await writeFile(output, JSON.stringify(pkg, null, 2), { flag: 'wx' });
     return { file: output, digest: report.digest, tests: (pkg.packages || []).reduce((count,dependency)=>count+dependency.tests.length,0), workflowComplete:report.workflowComplete, workflowStatus:report.workflowStatus };
   }
+  // permissions: what the Block can do in plain words, and what its source uses that
+  // the manifest does not declare (or declares and never uses). --fix corrects the
+  // manifest; it runs before validation so it can repair one that does not validate.
+  if(command==='permissions'){
+   const usage=permissionUsage(pkg,moduleFiles.get(pkg)||{});
+   if(!args.includes('--fix'))return {id:pkg.manifest.id,summary:summarizePermissions(pkg.manifest),usage};
+   if(!(await lstat(path)).isDirectory())throw Object.assign(new Error('permissions --fix changes stillmade.block.json in a Block folder.'),{code:'USAGE'});
+   const file=join(path,'stillmade.block.json'),manifest=fixPermissions(JSON.parse(await readFile(file,'utf8')),usage);
+   const checked=validateManifest(manifest);if(!checked.valid)throw Object.assign(new Error(checked.errors.map(error=>error.message).join('. ')),{code:'PERMISSIONS'});
+   await writeFile(file,JSON.stringify(manifest,null,2)+'\n');
+   return {id:pkg.manifest.id,fixed:true,file,added:usage.undeclared,removed:usage.unused,summary:summarizePermissions(manifest)};
+  }
   validatePackage(pkg);
   if (['validate','test','pack'].includes(command)) assertRemixReady(pkg);
   if(pkg.manifest.provenance?.remixedFrom&&['validate','test','pack','preview'].includes(command)){const original=await bundledRemixSource(pkg),expected=await remixBlock(original,{checkPreference:false});assertRemixAttribution(pkg,expected.content);}
@@ -315,7 +309,8 @@ export async function main(rawArgs) {
    }
   }
   const advice=command !== 'preview'?appearanceAdvice(pkg.view):null;
-  if (command === 'validate') return { valid: true, id: pkg.manifest.id,...(advice?{appearanceAdvice:advice}:{}),...(args.includes('--mobile')?{mobileProfile:mobileProfile()}:{}),...(pkg.manifest.runtime==='capability'||requiresDesktopExecution(pkg)?{tests:0,fixtureContracts:pkg.tests.length,execution:'not-run',reviewRequired:true,liveVerified:false}:{}) };
+  const usage=command==='validate'?permissionUsage(pkg,moduleFiles.get(pkg)||{}):null,permissionAdvice=usage&&(usage.undeclared.length||usage.unused.length)?usage:null;
+  if (command === 'validate') return { valid: true, id: pkg.manifest.id,...(advice?{appearanceAdvice:advice}:{}),...(permissionAdvice?{permissionAdvice}:{}),...(args.includes('--mobile')?{mobileProfile:mobileProfile()}:{}),...(pkg.manifest.runtime==='capability'||requiresDesktopExecution(pkg)?{tests:0,fixtureContracts:pkg.tests.length,execution:'not-run',reviewRequired:true,liveVerified:false}:{}) };
   if (command === 'inspect') return { manifest: pkg.manifest, operations: pkg.recipe?.steps.map(s => s.op) || [], platforms: {phone:'not_verified',browser:'not_verified',desktop:'not_verified'}, runtime: pkg.manifest.runtime };
   if (command === 'preview') {
     let inputPath,statePath,savePath;