@ai-plugin-marketplace/core 0.1.0 → 0.3.0

package/dist/targets/codex/scaffold.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Scaffold templates for the OpenAI Codex CLI target.
+ *
+ * `scaffoldCodexFiles` is a pure function returning the skeleton files this target contributes
+ * to a new plugin. Codex is an in-place marketplace target like Cursor: it has no mechanical
+ * transform in v0.1.0, but it still owns a manifest (`.codex-plugin/plugin.json`). Every manifest
+ * carries `schemaVersion: "0.1.0"` (§12.2). No generated-file sentinels — these are
+ * author-authored skeleton files (§4.3).
+ *
+ * Intentionally duplicated from the Cursor scaffold rather than shared: per §3.4 no file in this
+ * folder may import from a sibling target folder, and §13 Phase A keeps target schemas free to
+ * diverge later.
+ *
+ * @see https://developers.openai.com/codex/plugins/build
+ * @see docs/specs/architecture.md §4 (plugin source layout)
+ * @see docs/specs/architecture.md §6.4 (compatibility-assist)
+ * @see docs/specs/architecture.md §12.2 (schemaVersion on every manifest)
+ * @see docs/specs/architecture.md §12.5 (per-target scaffold.ts)
+ */
+import { type ScaffoldedFile, type TargetScaffoldOptions } from '../scaffold-kit.js';
+/**
+ * Produce the Codex skeleton files for a plugin.
+ *
+ * The minimum required artifact (`TARGET_MIN_REQUIRED.codex`) is `.codex-plugin/plugin.json`.
+ *
+ * @param pluginName - Plugin identity; written verbatim as the manifest `name`.
+ * @param opts - Optional description and add-target placeholder behaviour.
+ * @returns Files contributed by this target, with paths relative to the plugin directory.
+ */
+export declare function scaffoldCodexFiles(pluginName: string, opts?: TargetScaffoldOptions): ScaffoldedFile[];
+//# sourceMappingURL=scaffold.d.ts.map

package/dist/targets/codex/scaffold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../../src/targets/codex/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC3B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,qBAA0B,GAC/B,cAAc,EAAE,CAiBlB"}

package/dist/targets/codex/scaffold.js

@@ -0,0 +1,47 @@
+/**
+ * Scaffold templates for the OpenAI Codex CLI target.
+ *
+ * `scaffoldCodexFiles` is a pure function returning the skeleton files this target contributes
+ * to a new plugin. Codex is an in-place marketplace target like Cursor: it has no mechanical
+ * transform in v0.1.0, but it still owns a manifest (`.codex-plugin/plugin.json`). Every manifest
+ * carries `schemaVersion: "0.1.0"` (§12.2). No generated-file sentinels — these are
+ * author-authored skeleton files (§4.3).
+ *
+ * Intentionally duplicated from the Cursor scaffold rather than shared: per §3.4 no file in this
+ * folder may import from a sibling target folder, and §13 Phase A keeps target schemas free to
+ * diverge later.
+ *
+ * @see https://developers.openai.com/codex/plugins/build
+ * @see docs/specs/architecture.md §4 (plugin source layout)
+ * @see docs/specs/architecture.md §6.4 (compatibility-assist)
+ * @see docs/specs/architecture.md §12.2 (schemaVersion on every manifest)
+ * @see docs/specs/architecture.md §12.5 (per-target scaffold.ts)
+ */
+import { resolveDescription, SCHEMA_VERSION, } from '../scaffold-kit.js';
+/**
+ * Produce the Codex skeleton files for a plugin.
+ *
+ * The minimum required artifact (`TARGET_MIN_REQUIRED.codex`) is `.codex-plugin/plugin.json`.
+ *
+ * @param pluginName - Plugin identity; written verbatim as the manifest `name`.
+ * @param opts - Optional description and add-target placeholder behaviour.
+ * @returns Files contributed by this target, with paths relative to the plugin directory.
+ */
+export function scaffoldCodexFiles(pluginName, opts = {}) {
+    const description = resolveDescription(pluginName, opts);
+    const manifest = {
+        schemaVersion: SCHEMA_VERSION,
+        name: pluginName,
+        version: '0.0.1',
+        // `description` is optional and constrained to min length 1; omit it in placeholder mode
+        // (add-target) so the skeleton stays schema-valid while leaving the field for the author.
+        ...(description !== '' ? { description } : {}),
+    };
+    return [
+        {
+            path: '.codex-plugin/plugin.json',
+            content: `${JSON.stringify(manifest, null, 2)}\n`,
+        },
+    ];
+}
+//# sourceMappingURL=scaffold.js.map

package/dist/targets/codex/scaffold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.js","sourceRoot":"","sources":["../../../src/targets/codex/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,kBAAkB,EAClB,cAAc,GAGf,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAkB,EAClB,OAA8B,EAAE;IAEhC,MAAM,WAAW,GAAG,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAA4B;QACxC,aAAa,EAAE,cAAc;QAC7B,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,OAAO;QAChB,yFAAyF;QACzF,0FAA0F;QAC1F,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;IAEF,OAAO;QACL;YACE,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;SAClD;KACF,CAAC;AACJ,CAAC"}

package/dist/targets/codex/schemas.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Zod schemas for the OpenAI Codex CLI target manifests.
+ *
+ * These schemas are internal to @ai-plugin-marketplace/core — they are not exported from the
+ * package root. Per §3.4 of the architecture spec, this module must not import from any sibling
+ * targets/<other>/ folder, so the shapes are intentionally duplicated from the Claude target
+ * (rather than imported) and may diverge independently in the future.
+ *
+ * Codex is an in-place marketplace target like Claude/Cursor: its plugin manifest lives at
+ * `.codex-plugin/plugin.json` and is consumed in place (no `dist/` bundle, no mechanical
+ * transform). The field list mirrors Claude's `.claude-plugin/plugin.json` with two
+ * Codex-specific additions documented at developers.openai.com/codex/plugins/build:
+ *
+ *   - `interface` — an optional loose object describing the plugin's presentation in the Codex
+ *     marketplace UI (displayName, category, capabilities, …). Loose because the field set is
+ *     UI-driven and free to grow.
+ *   - `apps` — an optional relative path string pointing at an apps directory.
+ *
+ * `skills`/`agents`/`commands`/`hooks` accept exactly what Claude accepts (relative path string,
+ * array of relative path strings, or — for hooks/commands — an inline object), plus Codex's
+ * tolerance for a plain string wherever Claude already accepts one.
+ *
+ * @see https://developers.openai.com/codex/plugins/build
+ */
+import { z } from 'zod';
+/**
+ * Schema for `.codex-plugin/plugin.json`.
+ *
+ * Mirrors Claude's plugin manifest (same `name` pattern, optional `version`/`description`/etc.)
+ * with Codex's optional `interface` (loose object) and `apps` (relative path string) fields.
+ * Strict (`additionalProperties: false`) at the top level so unknown keys are rejected.
+ * `schemaVersion` is accepted but not validated (§9.4 / §12.2).
+ */
+export declare const codexPluginManifestSchema: z.ZodObject<{
+    schemaVersion: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+    version: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    author: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        url: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    homepage: z.ZodOptional<z.ZodString>;
+    repository: z.ZodOptional<z.ZodString>;
+    license: z.ZodOptional<z.ZodString>;
+    keywords: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hooks: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+    commands: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+    agents: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    skills: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    mcpServers: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>]>>;
+    apps: z.ZodOptional<z.ZodString>;
+    interface: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+}, z.core.$strict>;
+/**
+ * Schema for `.mcp.json` (the MCP configuration Codex reads — identical to Claude's format).
+ *
+ * `mcpServers` maps server name → server config. Strict at the top level.
+ * `schemaVersion` accepted but not validated per §9.4 / §12.2.
+ */
+export declare const codexMcpConfigSchema: z.ZodObject<{
+    schemaVersion: z.ZodOptional<z.ZodString>;
+    mcpServers: z.ZodRecord<z.ZodString, z.ZodObject<{
+        command: z.ZodString;
+        args: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/targets/codex/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/targets/codex/schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsBxB;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;kBA4F3B,CAAC;AAkBZ;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;;;kBAOtB,CAAC"}

package/dist/targets/codex/schemas.js

@@ -0,0 +1,153 @@
+/**
+ * Zod schemas for the OpenAI Codex CLI target manifests.
+ *
+ * These schemas are internal to @ai-plugin-marketplace/core — they are not exported from the
+ * package root. Per §3.4 of the architecture spec, this module must not import from any sibling
+ * targets/<other>/ folder, so the shapes are intentionally duplicated from the Claude target
+ * (rather than imported) and may diverge independently in the future.
+ *
+ * Codex is an in-place marketplace target like Claude/Cursor: its plugin manifest lives at
+ * `.codex-plugin/plugin.json` and is consumed in place (no `dist/` bundle, no mechanical
+ * transform). The field list mirrors Claude's `.claude-plugin/plugin.json` with two
+ * Codex-specific additions documented at developers.openai.com/codex/plugins/build:
+ *
+ *   - `interface` — an optional loose object describing the plugin's presentation in the Codex
+ *     marketplace UI (displayName, category, capabilities, …). Loose because the field set is
+ *     UI-driven and free to grow.
+ *   - `apps` — an optional relative path string pointing at an apps directory.
+ *
+ * `skills`/`agents`/`commands`/`hooks` accept exactly what Claude accepts (relative path string,
+ * array of relative path strings, or — for hooks/commands — an inline object), plus Codex's
+ * tolerance for a plain string wherever Claude already accepts one.
+ *
+ * @see https://developers.openai.com/codex/plugins/build
+ */
+import { z } from 'zod';
+// ---------------------------------------------------------------------------
+// Shared sub-schemas
+// ---------------------------------------------------------------------------
+/**
+ * Author object in the plugin manifest. Strict per the canonical JSON Schema
+ * (`additionalProperties: false`).
+ */
+const codexPluginAuthorSchema = z
+    .object({
+    name: z.string(),
+    email: z.string().optional(),
+    url: z.string().optional(),
+})
+    .strict();
+// ---------------------------------------------------------------------------
+// codexPluginManifestSchema
+// ---------------------------------------------------------------------------
+/**
+ * Schema for `.codex-plugin/plugin.json`.
+ *
+ * Mirrors Claude's plugin manifest (same `name` pattern, optional `version`/`description`/etc.)
+ * with Codex's optional `interface` (loose object) and `apps` (relative path string) fields.
+ * Strict (`additionalProperties: false`) at the top level so unknown keys are rejected.
+ * `schemaVersion` is accepted but not validated (§9.4 / §12.2).
+ */
+export const codexPluginManifestSchema = z
+    .object({
+    /** Reserved for future migrex adoption. Accepted but not validated in v0.1.0. */
+    schemaVersion: z.string().optional(),
+    /** Plugin name: lowercase, hyphens, no spaces; must start with a letter. Max 64 chars. */
+    name: z
+        .string()
+        .regex(/^[a-z][a-z0-9-]*$/, 'name must be lowercase alphanumeric with hyphens, starting with a letter')
+        .max(64),
+    /** Semantic version string (optional). */
+    version: z
+        .string()
+        .regex(/^\d+\.\d+\.\d+/, 'version must be a valid semver string')
+        .optional(),
+    /** What this plugin does. */
+    description: z.string().min(1).max(1024).optional(),
+    /** Plugin author information. */
+    author: codexPluginAuthorSchema.optional(),
+    /** Plugin homepage URL. */
+    homepage: z.string().optional(),
+    /** Source repository URL or shorthand. */
+    repository: z.string().optional(),
+    /** SPDX license identifier. */
+    license: z.string().optional(),
+    /** Discovery keywords. */
+    keywords: z.array(z.string()).optional(),
+    /**
+     * Hooks configuration — relative path to a `.json` file (must start with `./` and end
+     * with `.json`), or an inline hooks configuration object. Codex hook generation is out of
+     * scope for v0.1.0; the field is accepted but not exercised by the scaffolder.
+     */
+    hooks: z
+        .union([z.string().regex(/^\.\/.*\.json$/), z.record(z.string(), z.unknown())])
+        .optional(),
+    /**
+     * Commands — relative path starting with `./`, an array of such paths, or a record of
+     * command name → command object.
+     */
+    commands: z
+        .union([
+        z.string().regex(/^\.\//),
+        z.array(z.string().regex(/^\.\//)),
+        z.record(z.string(), z.unknown()),
+    ])
+        .optional(),
+    /**
+     * Agent definitions — relative `.md` path or array of such paths.
+     * Must start with `./` and end with `.md`.
+     */
+    agents: z
+        .union([z.string().regex(/^\.\/.+\.md$/), z.array(z.string().regex(/^\.\/.+\.md$/))])
+        .optional(),
+    /**
+     * Skill definitions — relative path to a skill directory or array of such paths.
+     * Must start with `./`. Codex tolerates a single string (e.g. "./skills/") as well as the
+     * array form Claude uses.
+     */
+    skills: z.union([z.string().regex(/^\.\//), z.array(z.string().regex(/^\.\//))]).optional(),
+    /**
+     * MCP server configuration — relative path string to a `.mcp.json` (Codex consumes the
+     * shared Claude/Cursor format) or an inline record of server configs.
+     */
+    mcpServers: z.union([z.string().regex(/^\.\//), z.record(z.string(), z.unknown())]).optional(),
+    /**
+     * Apps — relative path string to an apps directory (Codex-specific). Must start with `./`.
+     */
+    apps: z.string().regex(/^\.\//).optional(),
+    /**
+     * Marketplace presentation metadata (displayName, category, capabilities, websiteURL,
+     * defaultPrompt, brandColor, logo, screenshots, …). Loose: the field set is UI-driven and
+     * free to grow, so unknown keys are tolerated rather than rejected.
+     */
+    interface: z.object({}).loose().optional(),
+})
+    .strict();
+// ---------------------------------------------------------------------------
+// codexMcpConfigSchema
+// ---------------------------------------------------------------------------
+/**
+ * Schema for a single MCP server entry. Strict: only `command`, `args`, and `env` are
+ * accepted — matching the shared `.mcp.json` format Codex reuses from Claude/Cursor.
+ */
+const codexMcpServerSchema = z
+    .object({
+    command: z.string(),
+    args: z.array(z.string()).optional(),
+    env: z.record(z.string(), z.string()).optional(),
+})
+    .strict();
+/**
+ * Schema for `.mcp.json` (the MCP configuration Codex reads — identical to Claude's format).
+ *
+ * `mcpServers` maps server name → server config. Strict at the top level.
+ * `schemaVersion` accepted but not validated per §9.4 / §12.2.
+ */
+export const codexMcpConfigSchema = z
+    .object({
+    /** Reserved for future migrex adoption. Accepted but not validated in v0.1.0. */
+    schemaVersion: z.string().optional(),
+    mcpServers: z.record(z.string(), codexMcpServerSchema),
+})
+    .strict();
+//# sourceMappingURL=schemas.js.map

package/dist/targets/codex/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/targets/codex/schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,uBAAuB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,iFAAiF;IACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEpC,0FAA0F;IAC1F,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,KAAK,CACJ,mBAAmB,EACnB,0EAA0E,CAC3E;SACA,GAAG,CAAC,EAAE,CAAC;IAEV,0CAA0C;IAC1C,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,EAAE,uCAAuC,CAAC;SAChE,QAAQ,EAAE;IAEb,6BAA6B;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAEnD,iCAAiC;IACjC,MAAM,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAE1C,2BAA2B;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,0CAA0C;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjC,+BAA+B;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE9B,0BAA0B;IAC1B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAExC;;;;OAIG;IACH,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;SAC9E,QAAQ,EAAE;IAEb;;;OAGG;IACH,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC;QACL,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;KAClC,CAAC;SACD,QAAQ,EAAE;IAEb;;;OAGG;IACH,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;SACpF,QAAQ,EAAE;IAEb;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE3F;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE9F;;OAEG;IACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAE1C;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,iFAAiF;IACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEpC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC;CACvD,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/targets/codex/validate.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Per-target validator for the OpenAI Codex CLI target.
+ *
+ * Responsibilities (v0.1.0):
+ *   1. Manifest file refs resolve — checks that paths in .codex-plugin/plugin.json exist on disk
+ *      with the correct type (directory for skills, .md for agents, either for commands). Hooks
+ *      and apps refs are intentionally excluded: Codex hook/app generation is out of scope for
+ *      v0.1.0, so those paths are not guaranteed to exist in a Codex-only build context.
+ *
+ * Cross-target concerns (envelope adherence, name consistency, MCP key sync, marketplace
+ * registration, freshness) are NOT checked here.
+ *
+ * @see https://developers.openai.com/codex/plugins/build
+ * @see packages/core/docs/specs/architecture.md §10 (validation contract)
+ * @see packages/core/docs/specs/architecture.md §8.1 (Finding, FindingCode)
+ */
+import type { Finding } from '../../pipeline/types.js';
+/**
+ * Run all Codex-specific validators against a plugin directory.
+ *
+ * `pluginDir` is the absolute path to a `plugins/<name>/` directory.
+ * All findings use `plugin: path.basename(pluginDir)`.
+ */
+export declare function validateCodexPlugin(pluginDir: string): Finding[];
+//# sourceMappingURL=validate.d.ts.map

package/dist/targets/codex/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../../src/targets/codex/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AA4IvD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,EAAE,CAGhE"}

package/dist/targets/codex/validate.js

@@ -0,0 +1,117 @@
+/**
+ * Per-target validator for the OpenAI Codex CLI target.
+ *
+ * Responsibilities (v0.1.0):
+ *   1. Manifest file refs resolve — checks that paths in .codex-plugin/plugin.json exist on disk
+ *      with the correct type (directory for skills, .md for agents, either for commands). Hooks
+ *      and apps refs are intentionally excluded: Codex hook/app generation is out of scope for
+ *      v0.1.0, so those paths are not guaranteed to exist in a Codex-only build context.
+ *
+ * Cross-target concerns (envelope adherence, name consistency, MCP key sync, marketplace
+ * registration, freshness) are NOT checked here.
+ *
+ * @see https://developers.openai.com/codex/plugins/build
+ * @see packages/core/docs/specs/architecture.md §10 (validation contract)
+ * @see packages/core/docs/specs/architecture.md §8.1 (Finding, FindingCode)
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { codexPluginManifestSchema } from './schemas.js';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function makeInvalid(plugin, message, hint) {
+    const finding = { severity: 'hard', code: 'schema-invalid', plugin, message };
+    if (hint !== undefined)
+        finding.hint = hint;
+    return finding;
+}
+/**
+ * Normalise a manifest field that may be a single string path, an array of string paths, or an
+ * inline object (which has no resolvable paths). Returns only the string path entries.
+ */
+function normalisePathField(value) {
+    if (value === undefined)
+        return [];
+    if (typeof value === 'string')
+        return [value];
+    if (Array.isArray(value))
+        return value.filter((v) => typeof v === 'string');
+    // Inline object (record of commands, inline hooks object) — no paths to check.
+    return [];
+}
+// ---------------------------------------------------------------------------
+// Manifest file-ref validation
+// ---------------------------------------------------------------------------
+function validateManifestFileRefs(pluginDir, pluginName) {
+    const manifestPath = path.join(pluginDir, '.codex-plugin', 'plugin.json');
+    if (!fs.existsSync(manifestPath))
+        return [];
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
+    }
+    catch {
+        return [
+            makeInvalid(pluginName, `.codex-plugin/plugin.json is not valid JSON`, 'Ensure the file is well-formed JSON.'),
+        ];
+    }
+    const parsed = codexPluginManifestSchema.safeParse(raw);
+    if (!parsed.success) {
+        const issues = parsed.error.issues.map((i) => i.message).join('; ');
+        return [
+            makeInvalid(pluginName, `.codex-plugin/plugin.json failed schema validation: ${issues}`, 'Verify the manifest fields match the codex plugin manifest schema.'),
+        ];
+    }
+    const manifest = parsed.data;
+    const findings = [];
+    // Ref groups: skills → directory, agents → .md file, commands → either.
+    // hooks/apps are intentionally excluded — Codex hook/app generation is out of scope for
+    // v0.1.0, so those paths are not guaranteed present in a Codex-only build context.
+    const refGroups = [
+        { field: 'skills', paths: normalisePathField(manifest.skills), mustBeDir: true },
+        { field: 'agents', paths: normalisePathField(manifest.agents), mustBeDir: false },
+        { field: 'commands', paths: normalisePathField(manifest.commands) },
+    ];
+    for (const { field, paths: refPaths, mustBeDir } of refGroups) {
+        for (const refPath of refPaths) {
+            // All manifest paths must start with "./"
+            if (!refPath.startsWith('./')) {
+                findings.push(makeInvalid(pluginName, `.codex-plugin/plugin.json: ${field} path must start with "./": ${refPath}`, `Change the path to start with "./" (e.g. "./${refPath.replace(/^\/+/, '')}").`));
+                continue;
+            }
+            // Paths must not contain ".." segments (path traversal guard)
+            if (refPath.includes('..')) {
+                findings.push(makeInvalid(pluginName, `.codex-plugin/plugin.json: ${field} path must not contain "..": ${refPath}`, 'Use a path relative to the plugin root without ".." traversal.'));
+                continue;
+            }
+            const resolved = path.join(pluginDir, refPath.slice(2));
+            if (!fs.existsSync(resolved)) {
+                findings.push(makeInvalid(pluginName, `.codex-plugin/plugin.json: ${field} references non-existent path: ${refPath}`, `Create the missing ${field === 'skills' ? 'directory' : 'file'} at ${resolved}.`));
+                continue;
+            }
+            const stat = fs.statSync(resolved);
+            if (mustBeDir === true && !stat.isDirectory()) {
+                findings.push(makeInvalid(pluginName, `.codex-plugin/plugin.json: ${field} path must be a directory, but a file was found: ${refPath}`, `The ${field} field expects a directory path, not a file path.`));
+            }
+            else if (mustBeDir === false && !stat.isFile()) {
+                findings.push(makeInvalid(pluginName, `.codex-plugin/plugin.json: ${field} path must be a file, but a directory was found: ${refPath}`, `The ${field} field expects a file path, not a directory path.`));
+            }
+        }
+    }
+    return findings;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Run all Codex-specific validators against a plugin directory.
+ *
+ * `pluginDir` is the absolute path to a `plugins/<name>/` directory.
+ * All findings use `plugin: path.basename(pluginDir)`.
+ */
+export function validateCodexPlugin(pluginDir) {
+    const pluginName = path.basename(pluginDir);
+    return [...validateManifestFileRefs(pluginDir, pluginName)];
+}
+//# sourceMappingURL=validate.js.map

package/dist/targets/codex/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/targets/codex/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,WAAW,CAAC,MAAc,EAAE,OAAe,EAAE,IAAa;IACjE,MAAM,OAAO,GAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACvF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAC5C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CACzB,KAA8D;IAE9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACzF,+EAA+E;IAC/E,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,SAAS,wBAAwB,CAAC,SAAiB,EAAE,UAAkB;IACrE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IAC1E,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IAE5C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,WAAW,CACT,UAAU,EACV,6CAA6C,EAC7C,sCAAsC,CACvC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO;YACL,WAAW,CACT,UAAU,EACV,uDAAuD,MAAM,EAAE,EAC/D,oEAAoE,CACrE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,wEAAwE;IACxE,wFAAwF;IACxF,mFAAmF;IACnF,MAAM,SAAS,GAA8D;QAC3E,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE;QAChF,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;QACjF,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KACpE,CAAC;IAEF,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,SAAS,EAAE,CAAC;QAC9D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,0CAA0C;YAC1C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CACX,WAAW,CACT,UAAU,EACV,8BAA8B,KAAK,+BAA+B,OAAO,EAAE,EAC3E,+CAA+C,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAChF,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YAED,8DAA8D;YAC9D,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CACX,WAAW,CACT,UAAU,EACV,8BAA8B,KAAK,gCAAgC,OAAO,EAAE,EAC5E,gEAAgE,CACjE,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAExD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CACX,WAAW,CACT,UAAU,EACV,8BAA8B,KAAK,kCAAkC,OAAO,EAAE,EAC9E,sBAAsB,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,OAAO,QAAQ,GAAG,CAClF,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEnC,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CACX,WAAW,CACT,UAAU,EACV,8BAA8B,KAAK,oDAAoD,OAAO,EAAE,EAChG,OAAO,KAAK,mDAAmD,CAChE,CACF,CAAC;YACJ,CAAC;iBAAM,IAAI,SAAS,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACjD,QAAQ,CAAC,IAAI,CACX,WAAW,CACT,UAAU,EACV,8BAA8B,KAAK,oDAAoD,OAAO,EAAE,EAChG,OAAO,KAAK,mDAAmD,CAChE,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,wBAAwB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-plugin-marketplace/core",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Core build pipeline, validation, and scaffolding for the AI plugin marketplace toolkit.",
   "type": "module",
   "author": "Mike North <michael.l.north@gmail.com>",