# Vim Command Module
`vim::command` owns the pure state and parsing for Vim `:` input. It does not
execute commands and it does not touch buffers, windows, files, or ECS state.
The boundary is:
```text
prompt text -> VimCommandText -> CommandCatalog -> VimCommand -> ECS CommandRequested
```
`VimCommandText` stores untrusted user input without the leading colon. It is
bounded to 256 Unicode scalar values and renders prompt text through
`StatusInfoText`, so control characters and bidi controls do not enter status
UI directly.
`CommandCatalog` is the typed command front door. Each `CommandSpec` records the
canonical command name, accepted aliases, argument schema, and required
authority class. The catalog currently accepts write, quit, write-quit, exit,
and the typed transparency options `:set opaque` and `:set transparent`.
`VimCommand` is the parsed semantic command. It is intentionally small and
copyable because owner systems may carry it in ECS messages and rejection
events. Adding a command should extend the catalog first, then add an owner
boundary handler that validates authority and maps failures to redacted status
errors.
Command execution lives in `ecs::buffer::command`. Persistence commands write
only through `BufferFile` and `fs_utils`. Presentation commands mutate
`ResolvedTheme` and the primary window at the command owner boundary. Lifecycle
commands emit typed shutdown requests. No command parser path should gain raw
filesystem, process, clipboard, plugin, or ECS authority.
Diagnostics follow the normal Alma rule: Vim semantic errors may render as Vim
status text, while lower-boundary errors preserve source shape for diagnostics
and map to stable user-facing errors.