@aiwg/cli 2026.10.5 → 2026.10.7

package/dist/src/extensions/manifest.js

@@ -13,6 +13,7 @@
  * @architecture .aiwg/architecture/design-manifest-schema.md
  */
 import { z } from 'zod';
+import { integer, dateTime, url } from '../schema/zod-validation.mjs';
 import { PlatformCompatibilitySchema, DeploymentConfigSchema, MemoryFootprintSchema, DeprecationSchema, } from './validation.js';
 // ============================================
 // Limits (from #1042 threat model + #1044 design)
@@ -58,7 +59,7 @@ const ArtifactListsSchema = z.object({
     behaviors: z.array(z.string()).max(50).optional(),
     gatePacks: z.array(z.string().min(1).max(128)).max(50).optional(),
 });
-const EntryPathsSchema = z.object({
+const EntryPathsSchema = z.strictObject({
     agents: safeRelativePath.optional(),
     skills: safeRelativePath.optional(),
     rules: safeRelativePath.optional(),
@@ -68,37 +69,37 @@ const EntryPathsSchema = z.object({
     commands: safeRelativePath.optional(),
     behaviors: safeRelativePath.optional(),
     gatePacks: safeRelativePath.optional(),
-}).strict();
-export const AddonConfigSchema = z.object({
+});
+export const AddonConfigSchema = z.strictObject({
     entry: EntryPathsSchema.optional(),
     ...ArtifactListsSchema.shape,
     core: z.boolean().optional(),
     autoInstall: z.boolean().optional(),
-}).strict();
-export const FrameworkConfigSchema = z.object({
+});
+export const FrameworkConfigSchema = z.strictObject({
     path: safeRelativePath.optional(),
     files: z.array(safeRelativePath).max(100).optional(),
     ignore: z.array(safeRelativePath).max(100).optional(),
     gatePacks: z.array(z.string().min(1).max(128)).max(50).optional(),
-    entry: z.object({
+    entry: z.strictObject({
         gatePacks: safeRelativePath.optional(),
-    }).strict().optional(),
-    contextContributions: z.object({
+    }).optional(),
+    contextContributions: z.strictObject({
         hookFragment: safeRelativePath.optional(),
         sectionsDir: safeRelativePath.optional(),
         sectionsManifest: safeRelativePath.optional(),
-        priority: z.number().int().min(0).max(100).optional(),
+        priority: integer().min(0).max(100).optional(),
         description: z.string().max(512).optional(),
-    }).strict().optional(),
-}).strict();
-export const ExtensionConfigSchema = z.object({
+    }).optional(),
+});
+export const ExtensionConfigSchema = z.strictObject({
     entry: EntryPathsSchema.optional(),
     ...ArtifactListsSchema.shape,
-}).strict();
-export const PluginConfigSchema = z.object({
+});
+export const PluginConfigSchema = z.strictObject({
     payloadType: z.enum(['addon', 'framework', 'extension']),
     payloadPath: safeRelativePath,
-}).strict();
+});
 const ProviderCapabilityFeatureSchema = z.enum([
     'cron',
     'agent_teams',
@@ -116,11 +117,11 @@ const ProviderCapabilityEmulationSchema = z.enum([
     'aiwg-daemon',
     'external-trigger',
 ]).nullable();
-const ProviderCapabilityOverridesSchema = z.object({
-    nativeFeatures: z.record(ProviderCapabilityFeatureSchema, z.boolean()).optional(),
-    emulation: z.record(ProviderCapabilityFeatureSchema, ProviderCapabilityEmulationSchema).optional(),
-}).strict();
-export const ProviderConfigSchema = z.object({
+const ProviderCapabilityOverridesSchema = z.strictObject({
+    nativeFeatures: z.partialRecord(ProviderCapabilityFeatureSchema, z.boolean()).optional(),
+    emulation: z.partialRecord(ProviderCapabilityFeatureSchema, ProviderCapabilityEmulationSchema).optional(),
+});
+export const ProviderConfigSchema = z.strictObject({
     extends: z.enum([
         'claude',
         'codex',
@@ -142,7 +143,7 @@ export const ProviderConfigSchema = z.object({
     displayName: z.string().min(1).max(128).optional(),
     aliases: z.array(z.string().min(1).max(64)).max(20).optional(),
     capabilities: ProviderCapabilityOverridesSchema.optional(),
-}).strict();
+});
 /**
  * Review attestation for one gate metric provider (#2831).
  *
@@ -152,11 +153,11 @@ export const ProviderConfigSchema = z.object({
  * registration refuses absent attestations and digest mismatches. Null or
  * unknown digests never verify: they fail closed.
  */
-export const GateProviderReviewSchema = z.object({
+export const GateProviderReviewSchema = z.strictObject({
     reviewer: z.string().min(1).max(128),
-    reviewedAt: z.string().datetime(),
+    reviewedAt: dateTime(),
     codeDigest: z.string().regex(/^sha256:[0-9a-f]{64}$/, 'must be a sha256 digest'),
-}).strict();
+});
 /**
  * One addon/extension gate metric provider declared by a bundle manifest
  * (#2831). The module is loaded ONLY through the gates registry from this
@@ -165,16 +166,16 @@ export const GateProviderReviewSchema = z.object({
  * providers remain the default; this field is optional and disabled unless
  * the caller explicitly enables bundle providers.
  */
-export const GateProviderEntrySchema = z.object({
+export const GateProviderEntrySchema = z.strictObject({
     id: z.string().min(1).max(128).regex(/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/, 'must be a namespaced provider id <scope>/<name> (alphanumeric plus . _ -)'),
     version: z.string().regex(/^\d+\.\d+\.\d+/, 'CalVer or SemVer (X.Y.Z[...])'),
     module: safeModuleFile,
     description: z.string().min(1).max(512),
     review: GateProviderReviewSchema.optional(),
     reviewFile: safeJsonFile.optional(),
-}).strict().refine((entry) => (entry.review !== undefined) !== (entry.reviewFile !== undefined), { message: 'exactly one of review or reviewFile is required' });
-export const GateProvidersSchema = z.array(GateProviderEntrySchema).max(20).refine((entries) => new Set(entries.map((entry) => entry.id)).size === entries.length, { message: 'gate provider ids must be unique within a bundle' }).refine((entries) => new Set(entries.map((entry) => entry.module)).size === entries.length, { message: 'gate provider modules must be unique within a bundle' });
-export const CliCommandsSchema = z.object({
+}).refine((entry) => (entry.review !== undefined) !== (entry.reviewFile !== undefined), { error: 'exactly one of review or reviewFile is required' });
+export const GateProvidersSchema = z.array(GateProviderEntrySchema).max(20).refine((entries) => new Set(entries.map((entry) => entry.id)).size === entries.length, { error: 'gate provider ids must be unique within a bundle' }).refine((entries) => new Set(entries.map((entry) => entry.module)).size === entries.length, { error: 'gate provider modules must be unique within a bundle' });
+export const CliCommandsSchema = z.strictObject({
     namespace: z.string()
         .min(1)
         .max(64)
@@ -184,7 +185,7 @@ export const CliCommandsSchema = z.object({
     subcommands: z.record(z.string()
         .min(1)
         .max(64)
-        .regex(bundleNamePattern, 'kebab-case alphanumeric, no leading/trailing hyphen'), z.object({
+        .regex(bundleNamePattern, 'kebab-case alphanumeric, no leading/trailing hyphen'), z.strictObject({
         file: safeModuleFile,
         description: z.string().min(1).max(512),
         hook_event: z.enum([
@@ -195,14 +196,14 @@ export const CliCommandsSchema = z.object({
             'PostToolUse',
             'FeatureComplete',
         ]).optional(),
-    }).strict()).refine((commands) => Object.keys(commands).length > 0, {
-        message: 'at least one CLI subcommand is required',
+    })).refine((commands) => Object.keys(commands).length > 0, {
+        error: 'at least one CLI subcommand is required',
     }),
-}).strict();
+});
 // ============================================
 // Top-level BundleManifestSchema
 // ============================================
-export const BundleManifestSchema = z.object({
+export const BundleManifestSchema = z.strictObject({
     // Required core fields
     id: z.string()
         .min(1)
@@ -219,7 +220,7 @@ export const BundleManifestSchema = z.object({
     // Optional standard metadata
     author: z.string().max(128).optional(),
     license: z.string().max(64).optional(),
-    repository: z.string().url().max(512).optional(),
+    repository: url().max(512).optional(),
     // Type-discriminated nested config (exactly one matches `type`)
     addonConfig: AddonConfigSchema.optional(),
     frameworkConfig: FrameworkConfigSchema.optional(),
@@ -242,7 +243,6 @@ export const BundleManifestSchema = z.object({
     // providers remain the default when this field is absent.
     gateProviders: GateProvidersSchema.optional(),
 })
-    .strict()
     .refine((m) => {
     // Discriminator alignment: type must match the present *Config block(s)
     const present = {
@@ -258,18 +258,45 @@ export const BundleManifestSchema = z.object({
         return presentCount === 0 || (presentCount === 1 && present.extension);
     }
     return presentCount === 1 && present[m.type];
-}, { message: 'type must match its corresponding *Config block (addon→addonConfig, framework→frameworkConfig, plugin→pluginConfig, provider→providerConfig; extension may omit extensionConfig)' });
+}, { error: 'type must match its corresponding *Config block (addon→addonConfig, framework→frameworkConfig, plugin→pluginConfig, provider→providerConfig; extension may omit extensionConfig)' });
 /**
  * Convert a Zod error into the structured ManifestValidationError shape used
  * by discovery and `aiwg validate-metadata`.
  */
-export function zodErrorToValidationErrors(err, manifestPath) {
-    return err.errors.map((issue) => ({
-        path: manifestPath,
-        field: issue.path.join('.') || '(root)',
-        expected: issue.message,
-        actual: 'received' in issue ? String(issue.received) : 'invalid',
-        severity: 'error',
-    }));
+export function zodErrorToValidationErrors(err, manifestPath, input) {
+    const hasInput = arguments.length >= 3;
+    const issues = err.issues.flatMap(issue => {
+        // Partial enum maps report unknown keys at the map in v4; discovery's
+        // existing field contract identifies each rejected capability key.
+        if (issue.code === 'unrecognized_keys'
+            && issue.path.length === 3 && issue.path[0] === 'providerConfig'
+            && issue.path[1] === 'capabilities'
+            && ['nativeFeatures', 'emulation'].includes(String(issue.path[2]))) {
+            return issue.keys.map(key => ({ ...issue, path: [...issue.path, key] }));
+        }
+        return [issue];
+    });
+    return issues.map((issue) => {
+        let actual = 'invalid';
+        if (issue.code === 'invalid_type' && hasInput) {
+            let value = input;
+            for (const segment of issue.path) {
+                value = value !== null && typeof value === 'object' && Object.hasOwn(value, segment)
+                    ? value[segment] : undefined;
+            }
+            // Emit only the former type classification, never rejected values.
+            actual = value === null ? 'null' : Array.isArray(value) ? 'array'
+                : typeof value === 'number' && Number.isNaN(value) ? 'nan'
+                    : issue.expected === 'int' && typeof value === 'number' ? 'float'
+                        : typeof value;
+        }
+        return {
+            path: manifestPath,
+            field: issue.path.join('.') || '(root)',
+            expected: issue.message,
+            actual,
+            severity: 'error',
+        };
+    });
 }
 //# sourceMappingURL=manifest.js.map

package/dist/src/extensions/project-local-discovery.js

@@ -228,7 +228,7 @@ export async function loadAndValidateManifest(manifestPath, expectedType, projec
     }
     const result = BundleManifestSchema.safeParse(parsed);
     if (!result.success) {
-        return { errors: zodErrorToValidationErrors(result.error, manifestPath) };
+        return { errors: zodErrorToValidationErrors(result.error, manifestPath, parsed) };
     }
     const manifest = result.data;
     // Cross-check: manifest declared type must match the directory it lives in.

package/dist/src/extensions/project-local-gitignore.js

@@ -21,6 +21,7 @@
 import { readFile, writeFile, access } from 'fs/promises';
 import { join } from 'path';
 import { execFile } from 'child_process';
+import { helperEnvironment } from '../process/cli-command.mjs';
 import { promisify } from 'util';
 const execFileP = promisify(execFile);
 /**
@@ -166,6 +167,7 @@ export async function checkBundleManifestIgnored(projectDir, manifestRelPath) {
         // 1 if not ignored, 128 on error. We want a tristate.
         await execFileP('git', ['check-ignore', '-q', manifestRelPath], {
             cwd: projectDir,
+            env: helperEnvironment(),
         });
         // exit 0 → ignored
         return true;

package/dist/src/extensions/project-quickref.js

@@ -10,6 +10,7 @@ import { access, mkdir, readFile, readdir, rm, writeFile } from 'fs/promises';
 import { basename, dirname, isAbsolute, join, resolve } from 'path';
 import { homedir } from 'os';
 import { z } from 'zod';
+import { integer } from '../schema/zod-validation.mjs';
 import { getProviderDefinition, normalizeProviderDefinitionId, } from '../providers/provider-definitions.js';
 import { resolveHermesHome } from '../providers/hermes-home.js';
 import { OPERATIONAL_SHOW_TYPES } from '../artifacts/types.js';
@@ -18,45 +19,45 @@ import { appendAiwgSourceTrackBlock } from './project-local-gitignore.js';
 import { discoverProjectLocalBundles } from './project-local-discovery.js';
 import { enumerateBundleArtifacts } from './shadow-resolver.js';
 const OWNERSHIP_MARKER = '.aiwg-project-quickref.json';
-const ShowHintSchema = z.object({
+const ShowHintSchema = z.strictObject({
     type: z.enum(OPERATIONAL_SHOW_TYPES),
     name: z.string().min(1).max(128),
-}).strict();
-const QuickrefEntrySchema = z.object({
+});
+const QuickrefEntrySchema = z.strictObject({
     title: z.string().min(1).max(128),
     summary: z.string().min(1).max(512),
     discover: z.array(z.string().min(1).max(256)).max(10).default([]),
     show: z.array(ShowHintSchema).max(20).default([]),
-}).strict().refine(entry => entry.discover.length > 0 || entry.show.length > 0, { message: 'each entry must provide at least one discover or show hint' });
-export const ProjectQuickrefSchema = z.object({
+}).refine(entry => entry.discover.length > 0 || entry.show.length > 0, { error: 'each entry must provide at least one discover or show hint' });
+export const ProjectQuickrefSchema = z.strictObject({
     version: z.literal('1'),
-    project: z.object({
+    project: z.strictObject({
         id: z.string().regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, 'must be kebab-case'),
         name: z.string().min(1).max(128),
         description: z.string().min(1).max(512),
-    }).strict(),
+    }),
     precedence: z.string().min(1).max(1024),
     entries: z.array(QuickrefEntrySchema).min(1).max(50),
-}).strict();
-const QuickrefOverrideSchema = z.object({
+});
+const QuickrefOverrideSchema = z.strictObject({
     title: z.string().min(1).max(128).optional(),
     summary: z.string().min(1).max(512).optional(),
     discover: z.array(z.string().min(1).max(256)).max(10).optional(),
     show: z.array(ShowHintSchema).max(20).optional(),
     hidden: z.boolean().optional(),
-    order: z.number().int().optional(),
-}).strict();
-export const ProjectQuickrefConfigSchema = z.object({
+    order: integer().optional(),
+});
+export const ProjectQuickrefConfigSchema = z.strictObject({
     version: z.literal('1'),
     project: ProjectQuickrefSchema.shape.project.optional(),
     precedence: z.string().min(1).max(1024).optional(),
     entries: z.array(QuickrefEntrySchema).max(50).default([]),
-    discovery: z.object({
+    discovery: z.strictObject({
         enabled: z.boolean().default(true),
         excludeBundles: z.array(z.string().min(1)).max(200).default([]),
-        overrides: z.record(z.string(), QuickrefOverrideSchema).default({}),
-    }).strict().default({ enabled: true, excludeBundles: [], overrides: {} }),
-}).strict();
+        overrides: z.record(z.string(), QuickrefOverrideSchema).prefault({}),
+    }).prefault({ enabled: true, excludeBundles: [], overrides: {} }),
+});
 function sha256(content) {
     return createHash('sha256').update(content).digest('hex');
 }
@@ -281,7 +282,7 @@ export function renderProjectQuickref(definition) {
             lines.push(`- Discover: \`aiwg discover ${JSON.stringify(phrase)}\``);
         }
         for (const hint of entry.show) {
-            lines.push(`- Fetch: \`aiwg show ${hint.type} ${hint.name}\``);
+            lines.push(`- Fetch: \`aiwg show ${hint.type} ${hint.name} --body\``);
         }
         lines.push('');
     }

package/dist/src/extensions/validation.js

@@ -10,6 +10,7 @@
  * @version 1.0.0
  */
 import { z } from 'zod';
+import { integer, dateTime, url, number } from '../schema/zod-validation.mjs';
 // ============================================
 // Core Enums & Primitives
 // ============================================
@@ -77,13 +78,13 @@ export const PlatformCompatibilitySchema = z.object({
     codex: PlatformSupportSchema.optional(),
     opencode: PlatformSupportSchema.optional(),
     generic: PlatformSupportSchema.optional(),
-}).refine((data) => Object.values(data).some((val) => val !== undefined), { message: 'At least one platform must be specified' });
+}).refine((data) => Object.values(data).some((val) => val !== undefined), { error: 'At least one platform must be specified' });
 /**
  * Deployment configuration
  */
 export const DeploymentConfigSchema = z.object({
     pathTemplate: z.string().min(1, 'Path template is required'),
-    pathOverrides: z.record(z.string()).optional(),
+    pathOverrides: z.record(z.string(), z.string()).optional(),
     additionalFiles: z.array(z.string()).optional(),
     autoInstall: z.boolean().optional().default(false),
     core: z.boolean().optional().default(false),
@@ -106,7 +107,7 @@ export const MemoryFootprintSchema = z.object({
  * Deprecation information
  */
 export const DeprecationSchema = z.object({
-    date: z.string().datetime({ message: 'Date must be ISO 8601 format' }),
+    date: dateTime({ error: 'Date must be ISO 8601 format' }),
     successor: z.string().optional(),
     reason: z.string().min(1, 'Deprecation reason is required'),
 });
@@ -114,7 +115,7 @@ export const DeprecationSchema = z.object({
  * Installation state
  */
 export const InstallationSchema = z.object({
-    installedAt: z.string().datetime({ message: 'Install timestamp must be ISO 8601 format' }),
+    installedAt: dateTime({ error: 'Install timestamp must be ISO 8601 format' }),
     installedFrom: z.enum(['builtin', 'registry', 'local', 'git']),
     installedPath: z.string().min(1),
     enabled: z.boolean(),
@@ -142,7 +143,7 @@ export const AgentMetadataSchema = z.object({
     }),
     tools: z.array(z.string()).min(1, 'At least one tool is required'),
     template: z.string().optional(),
-    maxTools: z.number().int().positive().optional(),
+    maxTools: integer().positive().optional(),
     canDelegate: z.boolean().optional(),
     readOnly: z.boolean().optional(),
     workflow: z.array(z.string()).optional(),
@@ -157,8 +158,8 @@ export const CommandArgumentSchema = z.object({
     description: z.string().min(1),
     required: z.boolean(),
     type: z.enum(['string', 'number', 'boolean']),
-    default: z.union([z.string(), z.number(), z.boolean()]).optional(),
-    position: z.number().int().nonnegative().optional(),
+    default: z.union([z.string(), number(), z.boolean()]).optional(),
+    position: integer().nonnegative().optional(),
 });
 /**
  * Command option definition
@@ -167,7 +168,7 @@ export const CommandOptionSchema = z.object({
     name: z.string().min(1),
     description: z.string().min(1),
     type: z.enum(['string', 'boolean', 'number', 'array']),
-    default: z.union([z.string(), z.boolean(), z.number()]).optional(),
+    default: z.union([z.string(), z.boolean(), number()]).optional(),
     short: z.string().length(1).optional(),
     long: z.string().min(2).optional(),
 });
@@ -229,11 +230,13 @@ export const SkillReferenceSchema = z.object({
  * natural-language invocation. Do NOT relax this rule — a blank description
  * is what caused the 107-file regression we are guarding against.
  */
-export const SkillFrontmatterSchema = z.object({
+export const SkillFrontmatterSchema = z.looseObject({
     name: z.string().min(1, 'Skill name is required'),
     description: z
         .string({
-        required_error: 'Description is required (Codex rejects SKILL.md without it)',
+        error: issue => issue.input === undefined
+            ? 'Description is required (Codex rejects SKILL.md without it)'
+            : undefined,
     })
         .min(1, 'Description is required and must be non-empty'),
     version: z.string().regex(/^\d+\.\d+\.\d+/, 'Version must be semver or CalVer format (e.g., 1.0.0)').optional(),
@@ -247,7 +250,7 @@ export const SkillFrontmatterSchema = z.object({
     triggers: z
         .array(z
         .string()
-        .refine((s) => s.trim().length > 0, { message: 'trigger phrases must be non-empty' }))
+        .refine((s) => s.trim().length > 0, { error: 'trigger phrases must be non-empty' }))
         .min(1, 'triggers is declared but empty — add at least one phrase or remove the field (empty-triggers anti-pattern, #1623)')
         .optional(),
     aliases: z.array(z.string()).optional(),
@@ -263,8 +266,8 @@ export const SkillFrontmatterSchema = z.object({
     context: z.enum(['fork', 'inherit']).optional(),
     author: z.string().optional(),
     license: z.string().optional(),
-    metadata: z.record(z.unknown()).optional(),
-}).passthrough();
+    metadata: z.record(z.string(), z.unknown()).optional(),
+});
 /**
  * Validate SKILL.md frontmatter.
  *
@@ -313,10 +316,10 @@ export const SkillMetadataSchema = z.object({
 export const HookMetadataSchema = z.object({
     type: z.literal('hook'),
     event: HookEventSchema,
-    priority: z.number().int().optional().default(100),
+    priority: integer().optional().default(100),
     canModify: z.boolean().optional().default(false),
     canBlock: z.boolean().optional().default(false),
-    configSchema: z.record(z.unknown()).optional(),
+    configSchema: z.record(z.string(), z.unknown()).optional(),
 });
 /**
  * Tool-specific metadata
@@ -326,11 +329,11 @@ export const ToolMetadataSchema = z.object({
     category: z.enum(['core', 'languages', 'utilities', 'custom']),
     executable: z.string().min(1, 'Executable path is required'),
     verificationStatus: z.enum(['verified', 'unverified']).optional(),
-    lastVerified: z.string().datetime().optional(),
+    lastVerified: dateTime().optional(),
     manPage: z.string().optional(),
     aliases: z.array(z.string()).optional(),
     relatedTools: z.array(z.string()).optional(),
-    platformNotes: z.record(z.string()).optional(),
+    platformNotes: z.record(z.string(), z.string()).optional(),
     installHint: z.string().optional(),
 });
 /**
@@ -348,7 +351,7 @@ export const MCPServerMetadataSchema = z.object({
     type: z.literal('mcp-server'),
     mcpVersion: z.string().min(1, 'MCP version is required'),
     transport: z.enum(['stdio', 'http']),
-    port: z.number().int().positive().optional(),
+    port: integer().positive().optional(),
     capabilities: z.object({
         tools: z.boolean(),
         resources: z.boolean(),
@@ -358,9 +361,9 @@ export const MCPServerMetadataSchema = z.object({
     }),
     sourceType: z.enum(['cli', 'api', 'catalog', 'nl', 'extension']),
     sourceCommand: z.string().optional(),
-    sourceBaseUrl: z.string().url().optional(),
+    sourceBaseUrl: url().optional(),
     workingDirectory: z.string().optional(),
-    environment: z.record(z.string()).optional(),
+    environment: z.record(z.string(), z.string()).optional(),
     tools: z.array(MCPToolSummarySchema).optional(),
     resources: z.array(z.string()).optional(),
     prompts: z.array(z.string()).optional(),
@@ -379,8 +382,8 @@ export const FrameworkMetadataSchema = z.object({
         templates: z.array(z.string()).optional(),
         prompts: z.array(z.string()).optional(),
     }),
-    configSchema: z.record(z.unknown()).optional(),
-    defaultConfig: z.record(z.unknown()).optional(),
+    configSchema: z.record(z.string(), z.unknown()).optional(),
+    defaultConfig: z.record(z.string(), z.unknown()).optional(),
 });
 /**
  * Addon-specific metadata
@@ -476,15 +479,15 @@ export const ExtensionSchema = z.object({
     requires: z.array(z.string()).optional(),
     recommends: z.array(z.string()).optional(),
     conflicts: z.array(z.string()).optional(),
-    systemDependencies: z.record(z.string()).optional(),
+    systemDependencies: z.record(z.string(), z.string()).optional(),
     // Metadata & Documentation
     author: z.string().optional(),
     license: z.string().optional(),
-    repository: z.string().url().optional(),
-    homepage: z.string().url().optional(),
-    bugs: z.string().url().optional(),
-    documentation: z.record(z.string()).optional(),
-    researchCompliance: z.record(z.array(z.string())).optional(),
+    repository: url().optional(),
+    homepage: url().optional(),
+    bugs: url().optional(),
+    documentation: z.record(z.string(), z.string()).optional(),
+    researchCompliance: z.record(z.string(), z.array(z.string())).optional(),
     memory: MemoryFootprintSchema.optional(),
     // Type-Specific Data
     metadata: ExtensionMetadataSchema,
@@ -495,7 +498,7 @@ export const ExtensionSchema = z.object({
     // Validation & Quality
     checksum: z.string().optional(),
     signature: SignatureSchema.optional(),
-}).refine((data) => data.type === data.metadata.type, { message: 'Extension type must match metadata type' });
+}).refine((data) => data.type === data.metadata.type, { error: 'Extension type must match metadata type' });
 /**
  * Validate an extension manifest
  *