@devtrack-solution/codesdd 1.2.2 → 1.2.4-rc3

package/dist/core/sdd/plugin-evidence.js

@@ -0,0 +1,307 @@
+import { z } from 'zod';
+import { pluginArtifactManifestSchema, } from './plugin-broker.js';
+import { pluginManifestSchema } from './plugin-manifest.js';
+import { pluginPolicyEvaluationSchema } from './plugin-policy.js';
+import { pluginPolicyPackEvaluationSchema, } from './plugin-policy-pack.js';
+const FEATURE_REF_PATTERN = /^FEAT-\d{4}$/;
+const OPERATION_ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+const jsonObjectSchema = z.record(z.string(), z.unknown());
+export const pluginValidationEvidenceSchema = z.object({
+    command: z.string().min(1),
+    status: z.enum(['pending', 'passed', 'failed', 'skipped']),
+    evidence_ref: z.string().optional(),
+    coverage: z
+        .object({
+        statements: z.number().min(0).max(100).optional(),
+        branches: z.number().min(0).max(100).optional(),
+        functions: z.number().min(0).max(100).optional(),
+        lines: z.number().min(0).max(100).optional(),
+    })
+        .optional(),
+});
+export const pluginValidationManifestSchema = z.object({
+    schema_version: z.literal(1),
+    operation_id: z.string().regex(OPERATION_ID_PATTERN),
+    generated_at: z.string().datetime(),
+    feature_ref: z.string().regex(FEATURE_REF_PATTERN),
+    plugin_ref: z.object({
+        id: z.string().min(1),
+        version: z.string().min(1),
+    }),
+    capability: z.string().min(1),
+    status: z.enum(['pending', 'passed', 'failed', 'partial']),
+    validations: z.array(pluginValidationEvidenceSchema).default([]),
+});
+export const pluginEvidenceManifestSchema = z.object({
+    schema_version: z.literal(1),
+    operation_id: z.string().regex(OPERATION_ID_PATTERN),
+    generated_at: z.string().datetime(),
+    feature_ref: z.string().regex(FEATURE_REF_PATTERN),
+    plugin_ref: z.object({
+        id: z.string().min(1),
+        version: z.string().min(1),
+    }),
+    capability: z.string().min(1),
+    artifact_manifest: pluginArtifactManifestSchema,
+    validation_manifest: pluginValidationManifestSchema,
+    policy_evaluation: pluginPolicyEvaluationSchema.optional(),
+    policy_pack_evaluation: pluginPolicyPackEvaluationSchema.optional(),
+    traceability_refs: z.array(z.string().min(1)).default([]),
+    quality_refs: z.array(z.string().min(1)).default([]),
+    residual_risks: z
+        .array(z.object({
+        code: z.string().min(1),
+        severity: z.enum(['low', 'medium', 'high', 'critical']),
+        description: z.string().min(1),
+        mitigation: z.string().min(1).optional(),
+    }))
+        .default([]),
+    metadata: jsonObjectSchema.default({}),
+});
+export const pluginComplianceCriterionSchema = z.object({
+    id: z.string().min(1),
+    label: z.string().min(1),
+    status: z.enum(['pass', 'warn', 'fail']),
+    score: z.number().min(0),
+    max_score: z.number().positive(),
+    evidence: z.string().min(1),
+    issues: z.array(z.string().min(1)).default([]),
+});
+export const pluginComplianceIndexSchema = z.object({
+    schema_version: z.literal(1),
+    generated_at: z.string().datetime(),
+    feature_ref: z.string().regex(FEATURE_REF_PATTERN),
+    operation_id: z.string().regex(OPERATION_ID_PATTERN),
+    plugin_ref: z.object({
+        id: z.string().min(1),
+        version: z.string().min(1),
+    }),
+    capability: z.string().min(1),
+    score: z.number().min(0).max(100),
+    decision: z.enum(['compliant', 'warning', 'non-compliant']),
+    criteria: z.array(pluginComplianceCriterionSchema).min(1),
+    evidence_refs: z.array(z.string().min(1)).default([]),
+});
+export function buildPluginEvidenceManifest(input) {
+    const artifactManifest = pluginArtifactManifestSchema.parse(input.artifact_manifest);
+    const validationManifest = input.validation_manifest ??
+        buildDefaultValidationManifestFromArtifact(artifactManifest, artifactManifest.generated_at);
+    return pluginEvidenceManifestSchema.parse({
+        schema_version: 1,
+        operation_id: artifactManifest.operation_id,
+        generated_at: artifactManifest.generated_at,
+        feature_ref: artifactManifest.feature_ref,
+        plugin_ref: artifactManifest.plugin_ref,
+        capability: artifactManifest.capability,
+        artifact_manifest: artifactManifest,
+        validation_manifest: validationManifest,
+        policy_evaluation: input.policy_evaluation,
+        policy_pack_evaluation: input.policy_pack_evaluation,
+        traceability_refs: input.traceability_refs ?? [],
+        quality_refs: input.quality_refs ?? [],
+        residual_risks: input.residual_risks ?? [],
+        metadata: input.metadata ?? {},
+    });
+}
+export function buildPluginComplianceIndex(input) {
+    const manifest = pluginManifestSchema.parse(input.manifest);
+    const evidence = pluginEvidenceManifestSchema.parse(input.evidence_manifest);
+    assertEvidenceMatchesManifest(manifest, evidence);
+    const criteria = [
+        manifestValidityCriterion(manifest),
+        policyGateCriterion(evidence.policy_evaluation),
+        policyPackCriterion(evidence.policy_pack_evaluation),
+        trustTierCriterion(manifest),
+        dryRunApplyCoverageCriterion(manifest),
+        artifactTraceabilityCriterion(evidence.artifact_manifest),
+        validationEvidenceCriterion(evidence.validation_manifest),
+        supplyChainDependencyCriterion(manifest),
+        residualRiskCriterion(evidence),
+    ];
+    const score = roundScore(criteria.reduce((total, criterion) => total + criterion.score, 0));
+    return pluginComplianceIndexSchema.parse({
+        schema_version: 1,
+        generated_at: input.generated_at ?? evidence.generated_at,
+        feature_ref: evidence.feature_ref,
+        operation_id: evidence.operation_id,
+        plugin_ref: evidence.plugin_ref,
+        capability: evidence.capability,
+        score,
+        decision: score >= 90 && criteria.every((criterion) => criterion.status === 'pass')
+            ? 'compliant'
+            : score >= 70 && !criteria.some((criterion) => criterion.status === 'fail')
+                ? 'warning'
+                : 'non-compliant',
+        criteria,
+        evidence_refs: [
+            `artifact:${evidence.operation_id}`,
+            `validation:${evidence.operation_id}`,
+            ...evidence.quality_refs,
+            ...evidence.traceability_refs,
+        ],
+    });
+}
+function buildDefaultValidationManifestFromArtifact(artifactManifest, generatedAt) {
+    return pluginValidationManifestSchema.parse({
+        schema_version: 1,
+        operation_id: artifactManifest.operation_id,
+        generated_at: generatedAt,
+        feature_ref: artifactManifest.feature_ref,
+        plugin_ref: artifactManifest.plugin_ref,
+        capability: artifactManifest.capability,
+        status: resolveValidationStatus(artifactManifest.validation_evidence),
+        validations: artifactManifest.validation_evidence.map((validation) => ({
+            command: validation.command,
+            status: validation.status,
+            evidence_ref: validation.evidence_ref,
+        })),
+    });
+}
+function assertEvidenceMatchesManifest(manifest, evidence) {
+    const expectedPluginRef = `${manifest.id}@${manifest.version}`;
+    const evidencePluginRef = `${evidence.plugin_ref.id}@${evidence.plugin_ref.version}`;
+    if (expectedPluginRef !== evidencePluginRef) {
+        throw new Error(`Evidence plugin reference ${evidencePluginRef} does not match manifest ${expectedPluginRef}.`);
+    }
+    if (!manifest.capabilities.some((capability) => capability.name === evidence.capability)) {
+        throw new Error(`Evidence capability ${evidence.capability} is not declared by ${expectedPluginRef}.`);
+    }
+}
+function manifestValidityCriterion(manifest) {
+    return criterion('manifest-validity', 'Manifest validity', 10, 10, 'pass', `${manifest.id}@${manifest.version} is schema-valid.`);
+}
+function policyGateCriterion(policy) {
+    if (!policy) {
+        return criterion('policy-gate', 'Runtime policy gate', 0, 15, 'fail', 'No runtime policy evaluation was attached.', [
+            'POLICY_EVALUATION_MISSING',
+        ]);
+    }
+    if (policy.decision === 'allow') {
+        return criterion('policy-gate', 'Runtime policy gate', 15, 15, 'pass', 'Runtime policy decision is allow.');
+    }
+    if (policy.decision === 'warn') {
+        return criterion('policy-gate', 'Runtime policy gate', 9, 15, 'warn', 'Runtime policy decision is warn.', issueCodes(policy.issues));
+    }
+    return criterion('policy-gate', 'Runtime policy gate', 0, 15, 'fail', 'Runtime policy decision is deny.', issueCodes(policy.issues));
+}
+function policyPackCriterion(evaluation) {
+    if (!evaluation) {
+        return criterion('policy-pack', 'Policy pack evaluation', 0, 15, 'fail', 'No policy pack evaluation was attached.', [
+            'POLICY_PACK_EVALUATION_MISSING',
+        ]);
+    }
+    if (evaluation.decision === 'allow') {
+        return criterion('policy-pack', 'Policy pack evaluation', 15, 15, 'pass', 'Policy pack decision is allow.');
+    }
+    if (evaluation.decision === 'warn') {
+        return criterion('policy-pack', 'Policy pack evaluation', 9, 15, 'warn', 'Policy pack decision is warn.', issueCodes(evaluation.issues));
+    }
+    return criterion('policy-pack', 'Policy pack evaluation', 0, 15, 'fail', 'Policy pack decision is deny.', issueCodes(evaluation.issues));
+}
+function trustTierCriterion(manifest) {
+    const scoreByTrustTier = {
+        'enterprise-approved': 10,
+        'local-dev': 6,
+        experimental: 3,
+        blocked: 0,
+    };
+    const score = scoreByTrustTier[manifest.governance.trust_tier];
+    return criterion('trust-tier', 'Trust tier', score, 10, score >= 10 ? 'pass' : score > 0 ? 'warn' : 'fail', `Trust tier is ${manifest.governance.trust_tier}.`);
+}
+function dryRunApplyCoverageCriterion(manifest) {
+    const mutatingCapabilities = manifest.capabilities.filter((capability) => capability.write_scope.length > 0);
+    const missingDryRun = mutatingCapabilities.filter((capability) => !capability.supports_dry_run).map((capability) => capability.name);
+    const applyWithoutRollback = mutatingCapabilities
+        .filter((capability) => capability.supports_apply && !capability.supports_rollback)
+        .map((capability) => capability.name);
+    const issues = [
+        ...missingDryRun.map((name) => `MISSING_DRY_RUN:${name}`),
+        ...applyWithoutRollback.map((name) => `APPLY_WITHOUT_ROLLBACK:${name}`),
+    ];
+    if (issues.length === 0) {
+        return criterion('dry-run-apply-coverage', 'Dry-run and apply coverage', 10, 10, 'pass', 'All mutating capabilities support dry-run and apply-capable capabilities declare rollback.');
+    }
+    return criterion('dry-run-apply-coverage', 'Dry-run and apply coverage', 4, 10, 'warn', 'Some mutating capabilities have incomplete mode coverage.', issues);
+}
+function artifactTraceabilityCriterion(artifactManifest) {
+    const missingReasons = artifactManifest.artifacts.filter((artifact) => artifact.reason.trim().length === 0);
+    if (artifactManifest.artifacts.length === 0) {
+        return criterion('artifact-traceability', 'Artifact traceability', 0, 15, 'fail', 'Artifact manifest contains no artifacts.', [
+            'ARTIFACTS_MISSING',
+        ]);
+    }
+    if (missingReasons.length > 0) {
+        return criterion('artifact-traceability', 'Artifact traceability', 8, 15, 'warn', 'Some artifacts are missing reasons.', [
+            'ARTIFACT_REASON_MISSING',
+        ]);
+    }
+    return criterion('artifact-traceability', 'Artifact traceability', 15, 15, 'pass', `${artifactManifest.artifacts.length} artifacts are traceable.`);
+}
+function validationEvidenceCriterion(validationManifest) {
+    if (validationManifest.validations.length === 0) {
+        return criterion('validation-evidence', 'Validation evidence', 0, 10, 'fail', 'No validation evidence was attached.', [
+            'VALIDATION_EVIDENCE_MISSING',
+        ]);
+    }
+    if (validationManifest.status === 'passed') {
+        return criterion('validation-evidence', 'Validation evidence', 10, 10, 'pass', 'All validations passed.');
+    }
+    if (validationManifest.status === 'pending' || validationManifest.status === 'partial') {
+        return criterion('validation-evidence', 'Validation evidence', 6, 10, 'warn', `Validation status is ${validationManifest.status}.`);
+    }
+    return criterion('validation-evidence', 'Validation evidence', 0, 10, 'fail', 'One or more validations failed.', [
+        'VALIDATION_FAILED',
+    ]);
+}
+function supplyChainDependencyCriterion(manifest) {
+    const missing = [
+        ...(manifest.supply_chain.checksum ? [] : ['CHECKSUM_MISSING']),
+        ...(manifest.supply_chain.signature || manifest.supply_chain.provenance ? [] : ['SIGNATURE_OR_PROVENANCE_MISSING']),
+        ...(manifest.supply_chain.sbom ? [] : ['SBOM_MISSING']),
+        ...(manifest.validation.security_checks.length > 0 ? [] : ['SECURITY_CHECKS_MISSING']),
+        ...(manifest.validation.dependency_checks.length > 0 ? [] : ['DEPENDENCY_CHECKS_MISSING']),
+    ];
+    if (missing.length === 0) {
+        return criterion('supply-chain-dependencies', 'Supply-chain and dependency evidence', 10, 10, 'pass', 'Supply-chain, security, and dependency evidence is declared.');
+    }
+    return criterion('supply-chain-dependencies', 'Supply-chain and dependency evidence', 4, 10, 'warn', 'Supply-chain or dependency evidence is incomplete.', missing);
+}
+function residualRiskCriterion(evidence) {
+    const criticalOrHigh = evidence.residual_risks.filter((risk) => risk.severity === 'critical' || risk.severity === 'high');
+    if (criticalOrHigh.length > 0) {
+        return criterion('residual-risks', 'Residual risks', 0, 5, 'fail', 'High or critical residual risks remain.', criticalOrHigh.map((risk) => risk.code));
+    }
+    if (evidence.residual_risks.length > 0) {
+        return criterion('residual-risks', 'Residual risks', 3, 5, 'warn', 'Low or medium residual risks remain.', evidence.residual_risks.map((risk) => risk.code));
+    }
+    return criterion('residual-risks', 'Residual risks', 5, 5, 'pass', 'No residual risks were reported.');
+}
+function criterion(id, label, score, maxScore, status, evidence, issues = []) {
+    return pluginComplianceCriterionSchema.parse({
+        id,
+        label,
+        score,
+        max_score: maxScore,
+        status,
+        evidence,
+        issues,
+    });
+}
+function resolveValidationStatus(validations) {
+    if (validations.length === 0)
+        return 'pending';
+    if (validations.some((validation) => validation.status === 'failed'))
+        return 'failed';
+    if (validations.every((validation) => validation.status === 'passed'))
+        return 'passed';
+    if (validations.every((validation) => validation.status === 'pending'))
+        return 'pending';
+    return 'partial';
+}
+function issueCodes(issues) {
+    return issues.map((issue) => issue.code);
+}
+function roundScore(value) {
+    return Math.round(value * 100) / 100;
+}
+//# sourceMappingURL=plugin-evidence.js.map

package/dist/core/sdd/plugin-manifest.d.ts

@@ -0,0 +1,232 @@
+import { z } from 'zod';
+export declare const pluginCapabilitySchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+    input_schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    output_schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    deterministic: z.ZodBoolean;
+    idempotent: z.ZodBoolean;
+    supports_dry_run: z.ZodBoolean;
+    supports_apply: z.ZodBoolean;
+    supports_rollback: z.ZodDefault<z.ZodBoolean>;
+    write_scope: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    risk_tier: z.ZodDefault<z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+        critical: "critical";
+    }>>;
+    approval: z.ZodDefault<z.ZodEnum<{
+        none: "none";
+        maintainer: "maintainer";
+        security: "security";
+        "architecture-board": "architecture-board";
+    }>>;
+}, z.core.$strip>;
+export declare const pluginCompressionConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    engine: z.ZodDefault<z.ZodEnum<{
+        none: "none";
+        rtk: "rtk";
+        headroom: "headroom";
+        builtin: "builtin";
+    }>>;
+    mode: z.ZodDefault<z.ZodLiteral<"pretooluse">>;
+    exclude_commands: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    tee: z.ZodDefault<z.ZodEnum<{
+        never: "never";
+        failures: "failures";
+        always: "always";
+    }>>;
+    max_output_tokens: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+export declare const pluginManifestSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    version: z.ZodString;
+    contract_version: z.ZodLiteral<1>;
+    vendor: z.ZodString;
+    codesdd_compat: z.ZodObject<{
+        versions: z.ZodString;
+        sdd_contract_versions: z.ZodArray<z.ZodNumber>;
+    }, z.core.$strip>;
+    technology: z.ZodObject<{
+        language: z.ZodString;
+        framework: z.ZodOptional<z.ZodString>;
+        runtime: z.ZodOptional<z.ZodString>;
+        package_manager: z.ZodOptional<z.ZodString>;
+        min_versions: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>;
+    package_governance: z.ZodOptional<z.ZodObject<{
+        package_name: z.ZodString;
+        sdk_package: z.ZodDefault<z.ZodString>;
+        sdk_version: z.ZodDefault<z.ZodString>;
+        package_kind: z.ZodEnum<{
+            frontend: "frontend";
+            backend: "backend";
+            "full-stack": "full-stack";
+            generator: "generator";
+            validator: "validator";
+            evidence: "evidence";
+            "agent-adapter": "agent-adapter";
+            "policy-pack": "policy-pack";
+        }>;
+        versioning: z.ZodDefault<z.ZodLiteral<"semver">>;
+        registry: z.ZodDefault<z.ZodEnum<{
+            custom: "custom";
+            workspace: "workspace";
+            npm: "npm";
+            "private-npm": "private-npm";
+            "artifact-registry": "artifact-registry";
+        }>>;
+        keywords: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        internal_package: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    language_runtime: z.ZodOptional<z.ZodObject<{
+        language: z.ZodEnum<{
+            shell: "shell";
+            other: "other";
+            typescript: "typescript";
+            javascript: "javascript";
+            python: "python";
+            java: "java";
+            go: "go";
+            rust: "rust";
+            csharp: "csharp";
+            php: "php";
+            ruby: "ruby";
+        }>;
+        runtime: z.ZodString;
+        bridge: z.ZodEnum<{
+            "node-library": "node-library";
+            "stdio-json": "stdio-json";
+            "process-cli": "process-cli";
+            "http-local": "http-local";
+            container: "container";
+            wasm: "wasm";
+        }>;
+        input_transport: z.ZodEnum<{
+            "sdk-call": "sdk-call";
+            "stdin-json": "stdin-json";
+            "stdout-json": "stdout-json";
+            "file-envelope": "file-envelope";
+            "http-json": "http-json";
+        }>;
+        output_transport: z.ZodEnum<{
+            "sdk-call": "sdk-call";
+            "stdin-json": "stdin-json";
+            "stdout-json": "stdout-json";
+            "file-envelope": "file-envelope";
+            "http-json": "http-json";
+        }>;
+        command: z.ZodOptional<z.ZodString>;
+        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        package_manager: z.ZodOptional<z.ZodString>;
+        min_versions: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        env_allowlist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    capabilities: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodString;
+        input_schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        output_schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        deterministic: z.ZodBoolean;
+        idempotent: z.ZodBoolean;
+        supports_dry_run: z.ZodBoolean;
+        supports_apply: z.ZodBoolean;
+        supports_rollback: z.ZodDefault<z.ZodBoolean>;
+        write_scope: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        risk_tier: z.ZodDefault<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+            critical: "critical";
+        }>>;
+        approval: z.ZodDefault<z.ZodEnum<{
+            none: "none";
+            maintainer: "maintainer";
+            security: "security";
+            "architecture-board": "architecture-board";
+        }>>;
+    }, z.core.$strip>>;
+    execution: z.ZodObject<{
+        command: z.ZodString;
+        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        timeout_seconds: z.ZodDefault<z.ZodNumber>;
+        env_allowlist: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        network: z.ZodDefault<z.ZodEnum<{
+            disabled: "disabled";
+            enabled: "enabled";
+            restricted: "restricted";
+        }>>;
+        process_spawn: z.ZodDefault<z.ZodEnum<{
+            forbidden: "forbidden";
+            declared: "declared";
+        }>>;
+        working_directory: z.ZodDefault<z.ZodString>;
+    }, z.core.$strip>;
+    artifacts: z.ZodObject<{
+        writes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        forbidden_writes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        naming_conventions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    supply_chain: z.ZodObject<{
+        checksum: z.ZodOptional<z.ZodString>;
+        signature: z.ZodOptional<z.ZodString>;
+        provenance: z.ZodOptional<z.ZodString>;
+        sbom: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    governance: z.ZodObject<{
+        owner: z.ZodString;
+        support_sla: z.ZodString;
+        deprecation_window: z.ZodString;
+        policy_packs: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        trust_tier: z.ZodEnum<{
+            experimental: "experimental";
+            blocked: "blocked";
+            "local-dev": "local-dev";
+            "enterprise-approved": "enterprise-approved";
+        }>;
+        allowed_domains: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        risk_tier: z.ZodDefault<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+            critical: "critical";
+        }>>;
+    }, z.core.$strip>;
+    validation: z.ZodObject<{
+        commands: z.ZodArray<z.ZodString>;
+        coverage_target: z.ZodDefault<z.ZodNumber>;
+        security_checks: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        dependency_checks: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    compression: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        engine: z.ZodDefault<z.ZodEnum<{
+            none: "none";
+            rtk: "rtk";
+            headroom: "headroom";
+            builtin: "builtin";
+        }>>;
+        mode: z.ZodDefault<z.ZodLiteral<"pretooluse">>;
+        exclude_commands: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        tee: z.ZodDefault<z.ZodEnum<{
+            never: "never";
+            failures: "failures";
+            always: "always";
+        }>>;
+        max_output_tokens: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type PluginCapability = z.infer<typeof pluginCapabilitySchema>;
+export type PluginManifest = z.infer<typeof pluginManifestSchema>;
+export declare class PluginManifestValidationError extends Error {
+    readonly issues: string[];
+    constructor(sourceLabel: string, issues: string[]);
+}
+export declare function parsePluginManifest(content: string, sourceLabel?: string): PluginManifest;
+export declare function loadPluginManifest(filePath: string): Promise<PluginManifest>;
+export declare function validatePluginManifest(value: unknown, sourceLabel?: string): PluginManifest;
+export declare function buildPluginManifestJsonSchema(): Record<string, unknown>;
+//# sourceMappingURL=plugin-manifest.d.ts.map