@conduction/nextcloud-vue 0.1.0-beta.14 → 0.1.0-beta.16

package/src/schemas/app-manifest.schema.json

@@ -0,0 +1,153 @@
+{
+	"$schema": "https://json-schema.org/draft/2020-12/schema",
+	"$id": "https://raw.githubusercontent.com/ConductionNL/nextcloud-vue/main/src/schemas/app-manifest.schema.json",
+	"title": "Conduction App Manifest",
+	"description": "Schema for the JSON-driven page and navigation manifest consumed by @conduction/nextcloud-vue. Each Conduction Nextcloud app declares its routes, menu, page types, widget configuration, and required app dependencies in a single src/manifest.json validated against this schema.",
+	"version": "1.0.0",
+	"type": "object",
+	"required": ["version", "menu", "pages"],
+	"additionalProperties": false,
+	"properties": {
+		"$schema": {
+			"type": "string",
+			"format": "uri",
+			"description": "Optional URL of the schema this manifest validates against. Enables editor auto-validation."
+		},
+		"version": {
+			"type": "string",
+			"pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$",
+			"description": "Semver of the manifest content. Bump when the manifest changes meaningfully. Used for cache busting and app-builder migration tracking. Distinct from the schema's own version."
+		},
+		"dependencies": {
+			"type": "array",
+			"default": [],
+			"items": { "type": "string" },
+			"description": "Nextcloud app IDs that MUST be installed and enabled for this app to function. CnAppRoot checks each via useAppStatus(appId)."
+		},
+		"menu": {
+			"type": "array",
+			"items": { "$ref": "#/$defs/menuItem" },
+			"description": "Top-level navigation entries rendered by CnAppNav."
+		},
+		"pages": {
+			"type": "array",
+			"items": { "$ref": "#/$defs/page" },
+			"description": "Page definitions dispatched by CnPageRenderer. Each page's id is also its vue-router route name. Ids MUST be unique across the array; uniqueness is enforced by useAppManifest at validation time."
+		}
+	},
+	"$defs": {
+		"menuItem": {
+			"type": "object",
+			"required": ["id", "label"],
+			"additionalProperties": false,
+			"description": "A top-level navigation entry. May contain one level of nested children.",
+			"properties": {
+				"id": {
+					"type": "string",
+					"description": "Unique identifier for this menu entry."
+				},
+				"label": {
+					"type": "string",
+					"description": "i18n translation key resolved by the consuming app's t() function at render time."
+				},
+				"icon": {
+					"type": "string",
+					"description": "CSS class for the icon (e.g. 'icon-checkmark')."
+				},
+				"route": {
+					"type": "string",
+					"description": "Vue-router route name (matches a pages[].id) that this entry navigates to."
+				},
+				"order": {
+					"type": "integer",
+					"description": "Display order in the menu. Items without an order render last."
+				},
+				"permission": {
+					"type": "string",
+					"description": "Permission string the user must hold for this entry to render. CnAppNav filters items whose permission is not present in its permissions prop."
+				},
+				"section": {
+					"type": "string",
+					"enum": ["main", "settings"],
+					"default": "main",
+					"description": "Where the entry renders inside CnAppNav. \"main\" (default) places it in the top list. \"settings\" places it inside the NcAppNavigationSettings footer group, below the separator. Use \"settings\" for items that act on app configuration, help/docs links, or anything that belongs near Settings."
+				},
+				"href": {
+					"type": "string",
+					"description": "External URL. When set, the entry opens the URL in a new tab via window.open() instead of dispatching a vue-router navigation. `route` is ignored when `href` is present. Useful for documentation / help links."
+				},
+				"children": {
+					"type": "array",
+					"items": { "$ref": "#/$defs/menuItemLeaf" },
+					"description": "Nested entries. Only one level of nesting is supported (children cannot themselves have children)."
+				}
+			}
+		},
+		"menuItemLeaf": {
+			"type": "object",
+			"required": ["id", "label"],
+			"additionalProperties": false,
+			"description": "A nested menu entry. Has no further children.",
+			"properties": {
+				"id": { "type": "string" },
+				"label": { "type": "string" },
+				"icon": { "type": "string" },
+				"route": { "type": "string" },
+				"order": { "type": "integer" },
+				"permission": { "type": "string" },
+				"section": {
+					"type": "string",
+					"enum": ["main", "settings"],
+					"default": "main"
+				},
+				"href": { "type": "string" }
+			}
+		},
+		"page": {
+			"type": "object",
+			"required": ["id", "route", "type", "title"],
+			"additionalProperties": false,
+			"description": "A page definition. CnPageRenderer dispatches by `type` and matches by $route.name === page.id.",
+			"properties": {
+				"id": {
+					"type": "string",
+					"description": "Vue-router route name. MUST be unique across pages[]. CnPageRenderer matches the current route by id only (not by path)."
+				},
+				"route": {
+					"type": "string",
+					"description": "Path pattern (e.g. '/decisions', '/decisions/:id'). Used by the consuming app when generating its vue-router config from the manifest."
+				},
+				"type": {
+					"type": "string",
+					"description": "Page type. Must match a key in the renderer's `pageTypes` registry (library defaults: \"index\", \"detail\", \"dashboard\") OR be \"custom\" — in which case `component` resolves against the customComponents registry. Library extensions add their built-in types to `defaultPageTypes`; consumer apps pass a merged map via the `pageTypes` prop on CnAppRoot / CnPageRenderer."
+				},
+				"title": {
+					"type": "string",
+					"description": "i18n translation key for the page title."
+				},
+				"config": {
+					"type": "object",
+					"description": "Type-specific configuration. For type='index': { register, schema, columns, actions }. For type='detail': { register, schema, tabs }. For type='dashboard': { widgets, layout }. For type='custom': any shape the custom component expects.",
+					"additionalProperties": true
+				},
+				"component": {
+					"type": "string",
+					"description": "For type='custom': name resolved against the app-provided customComponents registry that is passed to CnAppRoot at boot."
+				},
+				"headerComponent": {
+					"type": "string",
+					"description": "Optional registry name for a component injected into the page's #header slot. Enables partial bailout without going full type='custom'."
+				},
+				"actionsComponent": {
+					"type": "string",
+					"description": "Optional registry name for a component injected into the page's #actions slot. Enables partial bailout without going full type='custom'. Equivalent to `slots.actions`; takes precedence when both are set."
+				},
+				"slots": {
+					"type": "object",
+					"description": "Generic slot-override map. Each key is the name of a scoped slot exposed by the dispatched page component (e.g. 'create-dialog', 'form-fields', 'row-actions', 'empty'); each value is a registry component name resolved against the customComponents registry passed to CnAppRoot. CnPageRenderer creates a scoped-slot template for each entry and forwards all slot-scope props to the resolved component. Use this to preserve every slot override the underlying Cn*Page supports without writing a wrapper component.",
+					"additionalProperties": { "type": "string" }
+				}
+			}
+		}
+	}
+}

package/src/types/index.d.ts

@@ -34,6 +34,15 @@ export type { TFile } from './file'
 export type { TTask, TTaskPriority, TTaskStatus } from './task'
 export type { TNotification, TNotificationType, TNotificationPriority } from './notification'
 
+// Manifest types (json-manifest-renderer capability)
+export type {
+	TManifest,
+	TManifestMenuItem,
+	TManifestMenuItemLeaf,
+	TManifestPage,
+	TPageType,
+} from './manifest'
+
 // Runtime exports from the store factory. The implementation is in
 // `../store/createCrudStore.js`; its companion `createCrudStore.d.ts`
 // provides full generic types (entity inference, feature-flag gating,

package/src/types/manifest.d.ts

@@ -0,0 +1,88 @@
+/**
+ * TypeScript type definitions for the Conduction app manifest.
+ *
+ * The shape mirrors `src/schemas/app-manifest.schema.json` (JSON Schema
+ * draft 2020-12). Apps consume these types when authoring their
+ * `src/manifest.json` and when interacting with `useAppManifest`.
+ *
+ * @example
+ * import type { TManifest, TManifestPage } from '@conduction/nextcloud-vue'
+ */
+
+/**
+ * Built-in page types shipped by the library. The `type` field of a
+ * manifest page is a string that should match a key in the resolved
+ * `pageTypes` registry (library defaults plus any consumer extensions)
+ * OR be `"custom"`, in which case `component` is resolved against the
+ * customComponents registry.
+ *
+ * Apps with custom built-in types declare those keys in their own
+ * pageTypes map and may extend this string union locally for type
+ * safety.
+ */
+export type TPageType = 'index' | 'detail' | 'dashboard' | 'custom' | (string & {})
+
+/** Where a menu entry renders inside CnAppNav. */
+export type TManifestMenuSection = 'main' | 'settings'
+
+/** A nested menu entry. Cannot have further children. */
+export interface TManifestMenuItemLeaf {
+	id: string
+	label: string
+	icon?: string
+	route?: string
+	order?: number
+	permission?: string
+	/**
+	 * Placement within CnAppNav. `"main"` (default) renders in the top
+	 * list; `"settings"` renders inside the NcAppNavigationSettings
+	 * footer group.
+	 */
+	section?: TManifestMenuSection
+	/**
+	 * External URL. When set, the item opens this URL in a new tab and
+	 * `route` is ignored.
+	 */
+	href?: string
+}
+
+/** A top-level menu entry. May contain one level of nested children. */
+export interface TManifestMenuItem extends TManifestMenuItemLeaf {
+	children?: TManifestMenuItemLeaf[]
+}
+
+/**
+ * A page definition. `id` doubles as the vue-router route name; the
+ * renderer matches by `$route.name === page.id`. `route` is the path
+ * pattern, used when the consuming app builds its router config.
+ */
+export interface TManifestPage {
+	id: string
+	route: string
+	type: TPageType
+	title: string
+	config?: Record<string, unknown>
+	component?: string
+	headerComponent?: string
+	actionsComponent?: string
+	/**
+	 * Generic slot-override map: slot name → registry component name.
+	 * Forwarded by CnPageRenderer to the dispatched page component as
+	 * scoped slots, preserving every override the underlying Cn*Page
+	 * exposes (`#create-dialog`, `#form-fields`, `#row-actions`, etc.).
+	 */
+	slots?: Record<string, string>
+}
+
+/**
+ * Top-level manifest shape. `version` is the semver of the manifest
+ * content (distinct from the schema's own version). `dependencies`
+ * lists Nextcloud app IDs that must be installed and enabled.
+ */
+export interface TManifest {
+	$schema?: string
+	version: string
+	dependencies?: string[]
+	menu: TManifestMenuItem[]
+	pages: TManifestPage[]
+}

package/src/utils/index.js

@@ -1,4 +1,4 @@
 export { buildHeaders, buildQueryString } from './headers.js'
 export { parseResponseError, networkError, genericError } from './errors.js'
-export { columnsFromSchema, formatValue, filtersFromSchema, fieldsFromSchema } from './schema.js'
+export { columnsFromSchema, formatValue, filtersFromSchema, fieldsFromSchema, validateValue } from './schema.js'
 export { filterWidgetsByVisibility, isWidgetVisible, getCurrentUserId, getCurrentUserGroups, resetVisibilityCache } from './widgetVisibility.js'

package/src/utils/schema.js

@@ -152,9 +152,13 @@ export function formatValue(value, property = {}, options = {}) {
 		return `${value.slice(0, 3).join(', ')} +${value.length - 3}`
 	}
 
-	// Object (shouldn't normally appear in tables)
+	// Object — render as JSON; tables truncate, multi-line value cells wrap with `<pre>`.
 	if (type === 'object' || (typeof value === 'object' && value !== null)) {
-		return '[Object]'
+		try {
+			return truncateString(JSON.stringify(value, null, 2), truncate)
+		} catch {
+			return '[Object]'
+		}
 	}
 
 	// String types
@@ -421,3 +425,154 @@ export function filtersFromSchema(schema) {
 			return filter
 		})
 }
+
+/**
+ * URL-like string formats — values must parse as a `URL` to be considered valid.
+ */
+const URL_FORMATS = new Set([
+	'url', 'uri', 'uri-reference', 'iri', 'iri-reference', 'uri-template',
+	'accessUrl', 'shareUrl', 'downloadUrl',
+])
+
+/**
+ * Regex-based validators for additional standard string formats.
+ */
+const FORMAT_PATTERNS = {
+	email: /^[^\s@]+@[^\s@]+\.[^\s@]+$/i,
+	'idn-email': /^[^\s@]+@[^\s@]+\.[^\s@]+$/i,
+	uuid: /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,
+	ipv4: /^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}$/,
+	ipv6: /^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/i,
+	hostname: /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i,
+	semver: /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/,
+	'color-hex': /^#[0-9a-f]{6}$/i,
+	'color-hex-alpha': /^#[0-9a-f]{8}$/i,
+	'color-rgb': /^rgb\(\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*\d{1,3}\s*\)$/i,
+	'color-rgba': /^rgba\(\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*[\d.]+\s*\)$/i,
+	'color-hsl': /^hsl\(\s*\d{1,3}\s*,\s*\d{1,3}%\s*,\s*\d{1,3}%\s*\)$/i,
+	'color-hsla': /^hsla\(\s*\d{1,3}\s*,\s*\d{1,3}%\s*,\s*\d{1,3}%\s*,\s*[\d.]+\s*\)$/i,
+}
+
+/**
+ * Validate a single value against a JSON-Schema-style property definition.
+ *
+ * Returns null when the value is valid, otherwise a short English error
+ * message describing the violation (caller is responsible for translation).
+ * An empty value (`null`/`undefined`/`''`) is considered valid here unless
+ * `options.required` is set; required-ness is typically enforced separately
+ * by the form so an empty input doesn't show a redundant inline error.
+ *
+ * @param {*} value The value to validate.
+ * @param {object} [property] The schema property definition.
+ * @param {object} [options] Extra checks.
+ * @param {boolean} [options.required] When true, an empty value is reported.
+ * @return {string|null}
+ */
+export function validateValue(value, property = {}, options = {}) {
+	const { required = false } = options
+	const empty = value === null || value === undefined || value === ''
+		|| (Array.isArray(value) && value.length === 0)
+	if (empty) {
+		return required ? 'This field is required.' : null
+	}
+	const type = property.type || 'string'
+	if (type === 'integer') {
+		if (typeof value !== 'number' || !Number.isInteger(value)) return 'Value must be an integer.'
+	} else if (type === 'number') {
+		if (typeof value !== 'number' || Number.isNaN(value)) return 'Value must be a number.'
+	}
+	if (type === 'integer' || type === 'number') {
+		if (typeof property.minimum === 'number' && value < property.minimum) {
+			return `Value must be at least ${property.minimum}.`
+		}
+		if (typeof property.maximum === 'number' && value > property.maximum) {
+			return `Value must be at most ${property.maximum}.`
+		}
+	}
+	if (type === 'string') {
+		if (typeof value !== 'string') return 'Value must be a string.'
+		if (typeof property.minLength === 'number' && value.length < property.minLength) {
+			return `Must be at least ${property.minLength} characters.`
+		}
+		if (typeof property.maxLength === 'number' && value.length > property.maxLength) {
+			return `Must be at most ${property.maxLength} characters.`
+		}
+		if (property.pattern) {
+			try {
+				if (!new RegExp(property.pattern).test(value)) {
+					return 'Value does not match the required pattern.'
+				}
+			} catch {
+				// Ignore broken schema patterns.
+			}
+		}
+		if (property.const !== undefined && value !== property.const) {
+			return `Value must be '${property.const}'.`
+		}
+		const fmtErr = validateStringFormat(property.format, value)
+		if (fmtErr) return fmtErr
+	}
+	if (type === 'array') {
+		if (!Array.isArray(value)) return 'Value must be a list.'
+		if (typeof property.minItems === 'number' && value.length < property.minItems) {
+			return `Select at least ${property.minItems} items.`
+		}
+		if (typeof property.maxItems === 'number' && value.length > property.maxItems) {
+			return `Select at most ${property.maxItems} items.`
+		}
+		if (property.items && typeof property.items === 'object') {
+			for (let i = 0; i < value.length; i++) {
+				const itemErr = validateValue(value[i], property.items)
+				if (itemErr) return `Item ${i + 1}: ${itemErr}`
+			}
+		}
+	}
+	if (type === 'boolean' && typeof value !== 'boolean') return 'Value must be a boolean.'
+	if (Array.isArray(property.enum) && property.enum.length > 0 && !property.enum.includes(value)) {
+		return 'Value must be one of the allowed options.'
+	}
+	return null
+}
+
+/**
+ * Validate a string value against a JSON-Schema `format`.
+ * @param {string} format Schema format identifier.
+ * @param {string} value String value to validate.
+ * @return {string|null} Error message or null when valid.
+ */
+function validateStringFormat(format, value) {
+	if (!format) return null
+	if (format === 'time') {
+		// HTML5 `<input type="time">` produces `HH:MM` or `HH:MM:SS[.sss]`.
+		// `new Date()` won't parse a bare time, so check the shape directly.
+		return /^([01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?$/.test(value)
+			? null
+			: 'Value must be a valid time.'
+	}
+	if (format === 'date' || format === 'date-time') {
+		return Number.isNaN(new Date(value).getTime()) ? `Value must be a valid ${format}.` : null
+	}
+	if (URL_FORMATS.has(format)) {
+		// Accept fully-qualified URLs (`https://example.com`) and protocol-less
+		// shorthand (`example.com/path`) by retrying with an `https://` prefix.
+		// Reject obviously non-URL inputs (whitespace, missing dots / authority).
+		if (/\s/.test(value)) return 'Value must be a valid URL.'
+		try {
+			/* eslint-disable-next-line no-new */
+			new URL(value)
+			return null
+		} catch {
+			// Fall through to the prefix retry.
+		}
+		try {
+			const parsed = new URL('https://' + value)
+			if (parsed.hostname && parsed.hostname.includes('.')) return null
+		} catch {
+			// Fall through to the rejection below.
+		}
+		return 'Value must be a valid URL.'
+	}
+	const re = FORMAT_PATTERNS[format]
+	if (re && !re.test(value)) return `Value must be a valid '${format}'.`
+	return null
+}

package/src/utils/validateManifest.js

@@ -0,0 +1,113 @@
+/**
+ * Validate a manifest object against the manifest JSON Schema.
+ *
+ * Hand-rolled minimal validator covering the rules required by
+ * REQ-JMR-001 of the json-manifest-renderer spec:
+ *  - Top-level `version`, `menu`, `pages` are required.
+ *  - `version` matches the semver pattern.
+ *  - `pages[].type` is a non-empty string. Whether the type resolves
+ *    to a real component is checked by CnPageRenderer at render time
+ *    against the consumer-resolved `pageTypes` map; the validator
+ *    cannot enforce that without knowing the runtime registry.
+ *  - `pages[].id` is unique across the array.
+ *  - Required fields on menu items and pages are present.
+ *  - `dependencies` (when present) is an array of strings.
+ *  - `pages[].component` is required when `type` is "custom".
+ *
+ * The richer schema constraints (`additionalProperties: false`, `format`
+ * URI, etc.) are enforced by the BE / hydra CI validators that consume
+ * the same schema file with Ajv. The FE validator is intentionally
+ * narrow so a FE-only failure produces tight, actionable messages.
+ *
+ * @param {object} manifest The manifest object to validate.
+ * @param {object} [options] Optional validation options.
+ * @param {Array<string>} [options.allowedTypes] When provided, restrict
+ *   the allowed `pages[].type` values to this list (plus `"custom"`).
+ *   Useful in CI / build-time checks where the consumer's full
+ *   `pageTypes` registry is known up-front. When omitted, any
+ *   non-empty string is accepted; the runtime renderer logs a warning
+ *   for unknown types.
+ * @return {{ valid: boolean, errors: string[] }}
+ */
+export function validateManifest(manifest, options = {}) {
+	const errors = []
+
+	if (!isPlainObject(manifest)) {
+		return { valid: false, errors: ['manifest must be an object'] }
+	}
+
+	const versionPattern = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/
+
+	if (typeof manifest.version !== 'string') {
+		errors.push('/version must be a string')
+	} else if (!versionPattern.test(manifest.version)) {
+		errors.push(`/version "${manifest.version}" must match semver pattern`)
+	}
+
+	if (!Array.isArray(manifest.menu)) {
+		errors.push('/menu must be an array')
+	} else {
+		manifest.menu.forEach((item, index) => {
+			if (!isPlainObject(item)) {
+				errors.push(`/menu/${index} must be an object`)
+				return
+			}
+			if (typeof item.id !== 'string') errors.push(`/menu/${index}/id must be a string`)
+			if (typeof item.label !== 'string') errors.push(`/menu/${index}/label must be a string`)
+			if (item.children !== undefined && !Array.isArray(item.children)) {
+				errors.push(`/menu/${index}/children must be an array`)
+			}
+		})
+	}
+
+	const allowedTypes = Array.isArray(options.allowedTypes)
+		? Array.from(new Set([...options.allowedTypes, 'custom']))
+		: null
+
+	if (!Array.isArray(manifest.pages)) {
+		errors.push('/pages must be an array')
+	} else {
+		const seenIds = new Set()
+		manifest.pages.forEach((page, index) => {
+			if (!isPlainObject(page)) {
+				errors.push(`/pages/${index} must be an object`)
+				return
+			}
+			if (typeof page.id !== 'string') {
+				errors.push(`/pages/${index}/id must be a string`)
+			} else if (seenIds.has(page.id)) {
+				errors.push(`/pages/${index}/id "${page.id}" must be unique within pages[]`)
+			} else {
+				seenIds.add(page.id)
+			}
+			if (typeof page.route !== 'string') errors.push(`/pages/${index}/route must be a string`)
+			if (typeof page.title !== 'string') errors.push(`/pages/${index}/title must be a string`)
+			if (typeof page.type !== 'string' || page.type.length === 0) {
+				errors.push(`/pages/${index}/type must be a non-empty string`)
+			} else if (allowedTypes && !allowedTypes.includes(page.type)) {
+				errors.push(`/pages/${index}/type "${page.type}" must be one of: ${allowedTypes.join(', ')}`)
+			}
+			if (page.type === 'custom' && typeof page.component !== 'string') {
+				errors.push(`/pages/${index}/component is required when type is "custom"`)
+			}
+		})
+	}
+
+	if (manifest.dependencies !== undefined) {
+		if (!Array.isArray(manifest.dependencies)) {
+			errors.push('/dependencies must be an array of strings')
+		} else {
+			manifest.dependencies.forEach((dep, index) => {
+				if (typeof dep !== 'string') {
+					errors.push(`/dependencies/${index} must be a string`)
+				}
+			})
+		}
+	}
+
+	return { valid: errors.length === 0, errors }
+}
+
+function isPlainObject(value) {
+	return value !== null && typeof value === 'object' && !Array.isArray(value)
+}