/// Every app command the webview can call. build.rs turns each into an `allow-<name>` permission (underscores become
/// dashes); capabilities/main.json grants them to the `main` window only; tests/security.rs checks both lists match.
pub const COMMANDS: &[&str] = &[
    "app_info",
    "sidecar_status",
    "sidecar_call",
    "cache_get",
    "cache_clear",
    "job_cancel",
    "write_with_confirm",
    "projects_list",
    "project_add",
    "project_init",
    "project_remove",
    "project_set_accounts",
    "accounts_list",
    "account_add_play",
    "account_add_apple",
    "account_remove",
    "portfolio_status",
    "open_external",
    "tools_info",
    "tools_install",
    "tools_uninstall",
    "workspace_get",
    "studio_save",
    "studio_remove",
    "studio_logo",
    "account_update",
    "account_check",
    "store_apps_refresh",
    "store_apps_cached",
    "overrides_set",
    "settings_set",
    "cache_info",
    "data_reveal",
    "notify",
    "app_reset",
    "update_check",
    "update_install",
    "project_import_fastlane",
    "export_save",
    "price_sheet_pick",
    "image_pick",
    "project_reveal",
    "project_locate",
    "state_reset",
    "log_webview",
    "ai_fix_info",
    "ai_fix_run",
    "ai_fix_undo",
];