CLI: manifest command; defineSettings({ contributed: false }) for sections an extension only reads

CHANGELOG.md

@@ -82,6 +82,26 @@ Pre-1.0 releases followed it in spirit; their breaking changes are marked **Brea
   it concerns, and the JSON that would settle it when the fix is mechanical.
   The assertion is unchanged and built on top of it.
 
+- **`vscode-ext-kit manifest`: the manifest check, from the command line.**
+  It compares the plan an extension compiles with its `package.json` — the
+  comparison `assertManifestMatches` makes in a test — and reports every
+  disagreement, as text or JSON, with exit code 1 when there is one. `--apply`
+  adds what the manifest is missing and the source can supply: commands and
+  settings, complete in everything mechanical and with placeholder titles and
+  descriptions a person has to replace. What a person has to decide is
+  reported and left alone: a view needs a container the declaration does not
+  name, a drifted default has two candidates, and an entry only the manifest
+  has may be there on purpose.
+
+- **`defineSettings({ contributed: false })`, for a section the extension only
+  reads.** `editor.tabSize` belongs to VS Code. An extension that declares it,
+  to read it through the same typed accessor as its own settings, was
+  indistinguishable from one that owns it — so the manifest check asked
+  `package.json` for it. The declaration now says which it is: `describePlan`
+  carries the answer as `contributed`, and `diffManifest`,
+  `assertManifestMatches` and the command line leave a section that is not
+  contributed out of the comparison.
+
 - **An API reference, generated from the JSDoc.** `npm run docs:api` renders
   every public entry point with TypeDoc, and CI runs it with warnings as
   errors. Setting that up found what the warnings exist to find: types that

README.md

@@ -266,16 +266,27 @@ public signature names but the package does not export cannot ship.
 
 ## Command Line
 
-The package ships one command. It reads the plan an extension compiles at
-import time and prints it, so what the extension registers can be reviewed,
-diffed and drawn without starting VS Code.
+The package ships one command with two subcommands. Both read the plan an
+extension compiles at import time, so what the extension registers can be
+reviewed, diffed, drawn and checked against `package.json` without starting
+VS Code.
 
 ```bash
 npx vscode-ext-kit plan ./out/extension.js                    # the plan as JSON
 npx vscode-ext-kit plan ./out/extension.js --format mermaid   # modules, services and their edges
 npx vscode-ext-kit plan ./out/extension.js --check            # exit 1 with every problem preflight found
+
+npx vscode-ext-kit manifest ./out/extension.js                # every disagreement with package.json
+npx vscode-ext-kit manifest ./out/extension.js --apply        # add the commands and settings it is missing
 ```
 
+`manifest` makes the comparison `assertManifestMatches` makes in a test, from
+the command line. `--apply` adds what the manifest is missing and the source
+can supply — commands and settings, with placeholder titles and descriptions
+marked `TODO` — and reports what a person has to decide: a view without a
+container, a default the two sides disagree on, an entry only the manifest
+has.
+
 The entry module is evaluated with a stand-in for `vscode`, which only exists
 inside an extension host. That works because nothing in this package touches
 VS Code before `activate` — and it means module-scope code in the extension