npm - @frockbot/plugin-authoring - Versions diffs - 0.3.1 → 0.3.3 - Mend

@frockbot/plugin-authoring 0.3.1 → 0.3.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@frockbot/plugin-authoring",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "private": false,
   "type": "module",
   "exports": {
@@ -21,7 +21,7 @@
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@frockbot/kernel-contracts": "0.3.1",
+    "@frockbot/kernel-contracts": "0.3.3",
     "cordis": "4.0.0-rc.8"
   },
   "devDependencies": {

package/src/agent.test.ts CHANGED Viewed

@@ -115,7 +115,7 @@ describe("the package_author tool", () => {
     await dispose();
   });
-  test("includes the UI HTML hash and declared hooks in the effect identity", async () => {
+  test("includes every UI page hash and declared hooks in the effect identity", async () => {
     const { sessions, dispose } = await openSession();
     const effectInputs: Parameters<PackageAuthoringHost["effectIdFor"]>[0][] =
       [];
@@ -138,8 +138,18 @@ describe("the package_author tool", () => {
         ...INPUT,
         hooks: ["agent/tool-exposure"],
         ui: {
-          html,
-          mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+          pages: [
+            {
+              id: "main",
+              html,
+              mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+            },
+            {
+              id: "board",
+              html: "<!doctype html><h1>Board</h1>",
+              mounts: [{ slot: "frockbot.right-panel" }],
+            },
+          ],
         },
       },
       CONTEXT,
@@ -149,7 +159,13 @@ describe("the package_author tool", () => {
       {
         packageId: "weather-lookup",
         sourceHash: await sha256HexV1(INPUT.source),
-        uiHtmlHash: await sha256HexV1(html),
+        uiPageHashes: [
+          { id: "main", htmlHash: await sha256HexV1(html) },
+          {
+            id: "board",
+            htmlHash: await sha256HexV1("<!doctype html><h1>Board</h1>"),
+          },
+        ],
         hooks: ["agent/tool-exposure"],
       },
     ]);

package/src/agent.ts CHANGED Viewed

@@ -57,7 +57,7 @@ export interface PackageAuthoringHost {
   effectIdFor(input: {
     packageId: string;
     sourceHash: string;
-    uiHtmlHash?: string;
+    uiPageHashes?: Array<{ id: string; htmlHash: string }>;
     hooks?: AuthorPackageInputV1["hooks"];
   }): Promise<string>;
   author(request: AuthorPackageRequestV1): Promise<AuthorPackageOutcomeV1>;
@@ -119,6 +119,7 @@ export function createPackageAuthorTool(
 ): ToolDefinition {
   return {
     name: "package_author",
+    namespace: "frockbot",
     // A general work tool: the full toolset an `executor` subagent gets, and
     // not part of the narrow reach of `browserUse`, `computerUse`, or the two
     // video roles. See `@frockbot/plugin-subagents` `SUBAGENT_TOOL_REACH_V1`.
@@ -154,13 +155,18 @@ export function createPackageAuthorTool(
         };
       }
       const sourceHash = await sha256HexV1(decoded.source);
-      const uiHtmlHash = decoded.ui
-        ? await sha256HexV1(decoded.ui.html)
+      const uiPageHashes = decoded.ui
+        ? await Promise.all(
+            decoded.ui.pages.map(async (page) => ({
+              id: page.id,
+              htmlHash: await sha256HexV1(page.html),
+            })),
+          )
         : undefined;
       const effectId = await host.effectIdFor({
         packageId: decoded.packageId,
         sourceHash,
-        ...(uiHtmlHash === undefined ? {} : { uiHtmlHash }),
+        ...(uiPageHashes === undefined ? {} : { uiPageHashes }),
         ...(decoded.hooks === undefined ? {} : { hooks: decoded.hooks }),
       });
       const position = openTurnPositionV1(session);
@@ -207,6 +213,7 @@ export function createPackageUndoTool(
 ): ToolDefinition {
   return {
     name: "package_undo",
+    namespace: "frockbot",
     admission: { subagentRoles: ["executor"] },
     description:
       "Undo your latest Package setup change, or restore an earlier Composition generation. This only changes Package setup; it never undoes actions taken through Connections. The resulting generation activates on the next Turn.",
@@ -285,6 +292,7 @@ export function createPackageInspectSelfTool(
 ): ToolDefinition {
   return {
     name: "package_inspect_self",
+    namespace: "frockbot",
     admission: { subagentRoles: ["executor"] },
     description:
       "Read your exact Package execution context contract, current Composition (including your stored Package source), and latest authoring or activation failure per authored Package.",

package/src/shared.test.ts CHANGED Viewed

@@ -83,14 +83,36 @@ describe("decodeAuthorPackageInputV1", () => {
     ).toThrow();
   });
-  test("accepts one inline iframe page and refuses external resources or an oversized page", () => {
-    const ui = {
+  test("accepts inline iframe pages with entries and refuses external resources or an oversized page", () => {
+    const main = {
+      id: "main",
       html: "<!doctype html><style>body{color:red}</style><script>window.frockbot.resize()</script>",
       mounts: [
         { slot: "frockbot.tool-result:weather_lookup", order: 10 },
         { slot: "frockbot.bot-settings-sections" },
       ],
     };
+    const board = {
+      id: "board",
+      html: "<!doctype html><h1>Board</h1>",
+      mounts: [
+        { slot: "frockbot.surface:board" },
+        { slot: "frockbot.right-panel" },
+      ],
+    };
+    const ui = {
+      pages: [main, board],
+      entries: [
+        {
+          id: "open",
+          slot: "frockbot.sidebar-actions" as const,
+          order: 5,
+          label: "Weather board",
+          icon: "sparkle",
+          opens: { kind: "surface" as const, page: "board" },
+        },
+      ],
+    };
     expect(
       decodeAuthorPackageInputV1({
         ...VALID,
@@ -98,18 +120,70 @@ describe("decodeAuthorPackageInputV1", () => {
         ui,
       }),
     ).toMatchObject({ hooks: ["agent/tool-exposure"], ui });
+    const withPages = (pages: unknown) => ({ ...VALID, ui: { pages } });
+    expect(() =>
+      decodeAuthorPackageInputV1(
+        withPages([
+          {
+            ...main,
+            html: '<script src="https://example.com/x.js"></script>',
+          },
+        ]),
+      ),
+    ).toThrow("inline resources only");
+    expect(() =>
+      decodeAuthorPackageInputV1(
+        withPages([{ ...main, html: "a".repeat(256 * 1024 + 1) }]),
+      ),
+    ).toThrow();
+    expect(() => decodeAuthorPackageInputV1(withPages([]))).toThrow(
+      "non-empty bounded array",
+    );
+    expect(() =>
+      decodeAuthorPackageInputV1(withPages([main, { ...board, id: "main" }])),
+    ).toThrow("duplicate ids");
+    expect(() =>
+      decodeAuthorPackageInputV1(withPages([{ ...main, id: "Main" }])),
+    ).toThrow("id is invalid");
+    expect(() =>
+      decodeAuthorPackageInputV1(
+        withPages([{ ...main, mounts: [{ slot: "frockbot.surface:absent" }] }]),
+      ),
+    ).toThrow("not iframe-safe");
+    expect(() =>
+      decodeAuthorPackageInputV1(
+        withPages([
+          { ...main, mounts: [{ slot: "frockbot.tool-result:unknown_tool" }] },
+        ]),
+      ),
+    ).toThrow("not iframe-safe");
     expect(() =>
       decodeAuthorPackageInputV1({
         ...VALID,
-        ui: { ...ui, html: '<script src="https://example.com/x.js"></script>' },
+        ui: {
+          pages: [main, board],
+          entries: [
+            { ...ui.entries[0]!, opens: { kind: "surface", page: "main" } },
+          ],
+        },
       }),
-    ).toThrow("inline resources only");
+    ).toThrow("names no page with a matching surface mount");
+    expect(() =>
+      decodeAuthorPackageInputV1({
+        ...VALID,
+        ui: {
+          pages: [main, board],
+          entries: [{ ...ui.entries[0]!, label: "x".repeat(33) }],
+        },
+      }),
+    ).toThrow("label must be a bounded non-empty string");
+    // The retired single-page shape is not honoured backward.
     expect(() =>
       decodeAuthorPackageInputV1({
         ...VALID,
-        ui: { ...ui, html: "a".repeat(256 * 1024 + 1) },
+        ui: { html: main.html, mounts: main.mounts },
       }),
-    ).toThrow();
+    ).toThrow("has invalid fields");
   });
 });
@@ -140,8 +214,38 @@ describe("authoring identity", () => {
       runId: "run-1",
       packageId: VALID.packageId,
       sourceHash,
-      uiHtmlHash: await sha256HexV1("<!doctype html><h1>Weather</h1>"),
+      uiPageHashes: [
+        {
+          id: "main",
+          htmlHash: await sha256HexV1("<!doctype html><h1>Weather</h1>"),
+        },
+      ],
+    });
+    const otherUiPageId = await authoringEffectIdV1({
+      runId: "run-1",
+      packageId: VALID.packageId,
+      sourceHash,
+      uiPageHashes: [
+        {
+          id: "board",
+          htmlHash: await sha256HexV1("<!doctype html><h1>Weather</h1>"),
+        },
+      ],
+    });
+    expect(otherUi).not.toBe(otherUiPageId);
+    const twoPages = await authoringEffectIdV1({
+      runId: "run-1",
+      packageId: VALID.packageId,
+      sourceHash,
+      uiPageHashes: [
+        {
+          id: "main",
+          htmlHash: await sha256HexV1("<!doctype html><h1>Weather</h1>"),
+        },
+        { id: "board", htmlHash: await sha256HexV1("<!doctype html>b") },
+      ],
     });
+    expect(twoPages).not.toBe(otherUi);
     const otherHooks = await authoringEffectIdV1({
       runId: "run-1",
       packageId: VALID.packageId,
@@ -215,18 +319,56 @@ describe("authoring identity", () => {
       version: "0.0.1",
       tools: VALID.tools,
       ui: {
-        artifact,
-        mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+        pages: [
+          {
+            id: "main",
+            artifact,
+            mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+          },
+          {
+            id: "board",
+            artifact: { ...artifact, contentHash: "b".repeat(64) },
+            mounts: [{ slot: "frockbot.surface:board" }],
+          },
+        ],
+        entries: [
+          {
+            id: "open",
+            slot: "frockbot.sidebar-actions",
+            label: "Weather board",
+            icon: "sparkle",
+            opens: { kind: "surface", page: "board" },
+          },
+        ],
       },
     });
     expect(manifest).toMatchObject({
-      schemaVersion: 3,
+      schemaVersion: 5,
       contributions: {
         runtime: { host: "bot-isolate" },
         client: {
           kind: "iframe",
-          artifact,
-          mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+          pages: [
+            {
+              id: "main",
+              artifact,
+              mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+            },
+            {
+              id: "board",
+              artifact: { ...artifact, contentHash: "b".repeat(64) },
+              mounts: [{ slot: "frockbot.surface:board" }],
+            },
+          ],
+          entries: [
+            {
+              id: "open",
+              slot: "frockbot.sidebar-actions",
+              label: "Weather board",
+              icon: "sparkle",
+              opens: { kind: "surface", page: "board" },
+            },
+          ],
         },
       },
     });

package/src/shared.ts CHANGED Viewed

@@ -9,7 +9,13 @@
 import {
   BOT_ISOLATE_HOOK_EVENTS_V1,
   isBotIsolateHookEventNameV1,
+  iframePageSlotAllowedV1,
   PACKAGE_BUNDLE_MAX_SOURCE_BYTES,
+  PACKAGE_IFRAME_ENTRY_LABEL_MAX_V1,
+  PACKAGE_IFRAME_ENTRY_SLOT_V1,
+  PACKAGE_IFRAME_ID_V1,
+  PACKAGE_IFRAME_MAX_ENTRIES_V1,
+  PACKAGE_IFRAME_MAX_PAGES_V1,
   type BotIsolateHookEventNameV1,
 } from "@frockbot/kernel-contracts";
@@ -24,10 +30,21 @@ export interface AuthorPackageInputV1 {
   hooks?: BotIsolateHookEventNameV1[];
   /** TypeScript text; exactly one `package.ts`. */
   source: string;
-  /** Optional sandboxed page. All CSS and JavaScript must be inline. */
+  /** Optional sandboxed pages. All CSS and JavaScript must be inline. */
   ui?: {
-    html: string;
-    mounts: Array<{ slot: string; order?: number }>;
+    pages: Array<{
+      id: string;
+      html: string;
+      mounts: Array<{ slot: string; order?: number }>;
+    }>;
+    entries?: Array<{
+      id: string;
+      slot: "frockbot.sidebar-actions";
+      order?: number;
+      label: string;
+      icon: string;
+      opens: { kind: "surface"; page: string };
+    }>;
   };
 }
@@ -259,62 +276,165 @@ export function decodeAuthorPackageInputV1(
   let ui: AuthorPackageInputV1["ui"];
   if (value.ui !== undefined) {
     const rawUi = record(value.ui, `${label}.ui`);
-    exactKeys(rawUi, ["html", "mounts"], [], `${label}.ui`);
-    const html = boundedString(
-      rawUi.html,
-      `${label}.ui.html`,
-      PACKAGE_BUNDLE_MAX_SOURCE_BYTES,
-    );
+    exactKeys(rawUi, ["pages"], ["entries"], `${label}.ui`);
     if (
-      new TextEncoder().encode(html).byteLength >
-      PACKAGE_BUNDLE_MAX_SOURCE_BYTES
+      !Array.isArray(rawUi.pages) ||
+      rawUi.pages.length === 0 ||
+      rawUi.pages.length > PACKAGE_IFRAME_MAX_PAGES_V1
     ) {
-      throw new Error(`${label}.ui.html exceeds the per-Package source quota`);
+      throw new Error(`${label}.ui.pages must be a non-empty bounded array`);
     }
-    if (
-      /<(?:script|iframe|img|audio|video|source|embed|input)\b[^>]*\bsrc\s*=\s*["'](?!data:)/i.test(
-        html,
-      ) ||
-      /<object\b[^>]*\bdata\s*=\s*["'](?!data:)/i.test(html) ||
-      /\bsrcset\s*=/i.test(html) ||
-      /<link\b/i.test(html) ||
-      /@import\b/i.test(html) ||
-      /<meta\b[^>]*http-equiv\s*=\s*["']?refresh/i.test(html) ||
-      /url\(\s*["']?(?!data:|["']?\s*\))/i.test(html)
-    ) {
-      throw new Error(`${label}.ui.html may contain inline resources only`);
-    }
-    if (
-      !Array.isArray(rawUi.mounts) ||
-      rawUi.mounts.length === 0 ||
-      rawUi.mounts.length > 64
-    ) {
-      throw new Error(`${label}.ui.mounts must be a non-empty bounded array`);
+    const pageIds = rawUi.pages.map((candidate, index) => {
+      const page = record(candidate, `${label}.ui.pages[${index}]`);
+      const id = boundedString(page.id, `${label}.ui.pages[${index}].id`, 32);
+      if (!PACKAGE_IFRAME_ID_V1.test(id)) {
+        throw new Error(`${label}.ui.pages[${index}].id is invalid`);
+      }
+      return id;
+    });
+    if (new Set(pageIds).size !== pageIds.length) {
+      throw new Error(`${label}.ui.pages contains duplicate ids`);
     }
-    const mounts = rawUi.mounts.map((candidate, index) => {
-      const mount = record(candidate, `${label}.ui.mounts[${index}]`);
-      exactKeys(mount, ["slot"], ["order"], `${label}.ui.mounts[${index}]`);
-      const slot = boundedString(
-        mount.slot,
-        `${label}.ui.mounts[${index}].slot`,
-        160,
+    const declaredTools = tools.map((tool) => tool.name);
+    const pages = rawUi.pages.map((candidate, index) => {
+      const pageLabel = `${label}.ui.pages[${index}]`;
+      const page = record(candidate, pageLabel);
+      exactKeys(page, ["id", "html", "mounts"], [], pageLabel);
+      const html = boundedString(
+        page.html,
+        `${pageLabel}.html`,
+        PACKAGE_BUNDLE_MAX_SOURCE_BYTES,
       );
       if (
-        slot !== "frockbot.bot-settings-sections" &&
-        !slot.startsWith("frockbot.tool-result:")
+        new TextEncoder().encode(html).byteLength >
+        PACKAGE_BUNDLE_MAX_SOURCE_BYTES
+      ) {
+        throw new Error(
+          `${pageLabel}.html exceeds the per-Package source quota`,
+        );
+      }
+      if (
+        /<(?:script|iframe|img|audio|video|source|embed|input)\b[^>]*\bsrc\s*=\s*["'](?!data:)/i.test(
+          html,
+        ) ||
+        /<object\b[^>]*\bdata\s*=\s*["'](?!data:)/i.test(html) ||
+        /\bsrcset\s*=/i.test(html) ||
+        /<link\b/i.test(html) ||
+        /@import\b/i.test(html) ||
+        /<meta\b[^>]*http-equiv\s*=\s*["']?refresh/i.test(html) ||
+        /url\(\s*["']?(?!data:|["']?\s*\))/i.test(html)
       ) {
-        throw new Error(`${label}.ui.mounts[${index}].slot is not iframe-safe`);
+        throw new Error(`${pageLabel}.html may contain inline resources only`);
       }
-      const order = mount.order;
       if (
-        order !== undefined &&
-        (typeof order !== "number" || !Number.isFinite(order))
+        !Array.isArray(page.mounts) ||
+        page.mounts.length === 0 ||
+        page.mounts.length > 64
       ) {
-        throw new Error(`${label}.ui.mounts[${index}].order must be finite`);
+        throw new Error(
+          `${pageLabel}.mounts must be a non-empty bounded array`,
+        );
       }
-      return { slot, ...(order === undefined ? {} : { order }) };
+      const mounts = page.mounts.map((candidateMount, mountIndex) => {
+        const mount = record(
+          candidateMount,
+          `${pageLabel}.mounts[${mountIndex}]`,
+        );
+        exactKeys(
+          mount,
+          ["slot"],
+          ["order"],
+          `${pageLabel}.mounts[${mountIndex}]`,
+        );
+        const slot = boundedString(
+          mount.slot,
+          `${pageLabel}.mounts[${mountIndex}].slot`,
+          160,
+        );
+        if (!iframePageSlotAllowedV1(slot, { declaredTools, pageIds })) {
+          throw new Error(
+            `${pageLabel}.mounts[${mountIndex}].slot is not iframe-safe`,
+          );
+        }
+        const order = mount.order;
+        if (
+          order !== undefined &&
+          (typeof order !== "number" || !Number.isFinite(order))
+        ) {
+          throw new Error(
+            `${pageLabel}.mounts[${mountIndex}].order must be finite`,
+          );
+        }
+        return { slot, ...(order === undefined ? {} : { order }) };
+      });
+      return { id: pageIds[index]!, html, mounts };
     });
-    ui = { html, mounts };
+    let entries: NonNullable<AuthorPackageInputV1["ui"]>["entries"];
+    if (rawUi.entries !== undefined) {
+      if (
+        !Array.isArray(rawUi.entries) ||
+        rawUi.entries.length > PACKAGE_IFRAME_MAX_ENTRIES_V1
+      ) {
+        throw new Error(`${label}.ui.entries must be a bounded array`);
+      }
+      entries = rawUi.entries.map((candidate, index) => {
+        const entryLabel = `${label}.ui.entries[${index}]`;
+        const entry = record(candidate, entryLabel);
+        exactKeys(
+          entry,
+          ["id", "slot", "label", "icon", "opens"],
+          ["order"],
+          entryLabel,
+        );
+        const id = boundedString(entry.id, `${entryLabel}.id`, 32);
+        if (!PACKAGE_IFRAME_ID_V1.test(id)) {
+          throw new Error(`${entryLabel}.id is invalid`);
+        }
+        if (entry.slot !== PACKAGE_IFRAME_ENTRY_SLOT_V1) {
+          throw new Error(`${entryLabel}.slot is invalid`);
+        }
+        const order = entry.order;
+        if (
+          order !== undefined &&
+          (typeof order !== "number" || !Number.isFinite(order))
+        ) {
+          throw new Error(`${entryLabel}.order must be finite`);
+        }
+        const opens = record(entry.opens, `${entryLabel}.opens`);
+        exactKeys(opens, ["kind", "page"], [], `${entryLabel}.opens`);
+        if (opens.kind !== "surface") {
+          throw new Error(`${entryLabel}.opens.kind is invalid`);
+        }
+        const page = boundedString(opens.page, `${entryLabel}.opens.page`, 32);
+        const target = pages.find((candidatePage) => candidatePage.id === page);
+        if (
+          !target ||
+          !target.mounts.some(
+            (mount) => mount.slot === `frockbot.surface:${page}`,
+          )
+        ) {
+          throw new Error(
+            `${entryLabel}.opens.page names no page with a matching surface mount`,
+          );
+        }
+        return {
+          id,
+          slot: PACKAGE_IFRAME_ENTRY_SLOT_V1 as "frockbot.sidebar-actions",
+          ...(order === undefined ? {} : { order }),
+          label: boundedString(
+            entry.label,
+            `${entryLabel}.label`,
+            PACKAGE_IFRAME_ENTRY_LABEL_MAX_V1,
+          ),
+          icon: boundedString(entry.icon, `${entryLabel}.icon`, 64),
+          opens: { kind: "surface" as const, page },
+        };
+      });
+      if (new Set(entries.map((entry) => entry.id)).size !== entries.length) {
+        throw new Error(`${label}.ui.entries contains duplicate ids`);
+      }
+    }
+    ui = { pages, ...(entries ? { entries } : {}) };
   }
   return {
     packageId,
@@ -370,28 +490,81 @@ export const AUTHOR_PACKAGE_INPUT_SCHEMA_V1 = {
     ui: {
       type: "object",
       additionalProperties: false,
-      required: ["html", "mounts"],
+      required: ["pages"],
       properties: {
-        html: {
-          type: "string",
+        pages: {
+          type: "array",
+          minItems: 1,
+          maxItems: PACKAGE_IFRAME_MAX_PAGES_V1,
           description:
-            "One ui.html page (maximum 256 KB). CSS and JavaScript must be inline; images may use data: URLs.",
+            "Up to 8 sandboxed HTML pages, each mounted into one or more slots.",
+          items: {
+            type: "object",
+            additionalProperties: false,
+            required: ["id", "html", "mounts"],
+            properties: {
+              id: {
+                type: "string",
+                description:
+                  "Lowercase page id, /^[a-z][a-z0-9-]{0,31}$/, unique in this Package.",
+              },
+              html: {
+                type: "string",
+                description:
+                  "One HTML page (maximum 256 KB). CSS and JavaScript must be inline; images may use data: URLs.",
+              },
+              mounts: {
+                type: "array",
+                minItems: 1,
+                maxItems: 64,
+                items: {
+                  type: "object",
+                  additionalProperties: false,
+                  required: ["slot"],
+                  properties: {
+                    slot: {
+                      type: "string",
+                      description:
+                        "frockbot.bot-settings-sections, frockbot.tool-result:<declaredToolName>, frockbot.right-panel, or frockbot.surface:<pageId>",
+                    },
+                    order: { type: "number" },
+                  },
+                },
+              },
+            },
+          },
         },
-        mounts: {
+        entries: {
           type: "array",
-          minItems: 1,
-          maxItems: 64,
+          maxItems: PACKAGE_IFRAME_MAX_ENTRIES_V1,
+          description:
+            "Up to 4 sidebar launchers. Each opens one of your pages as an overlay surface; that page must mount frockbot.surface:<its own id>.",
           items: {
             type: "object",
             additionalProperties: false,
-            required: ["slot"],
+            required: ["id", "slot", "label", "icon", "opens"],
             properties: {
-              slot: {
+              id: {
                 type: "string",
                 description:
-                  "frockbot.bot-settings-sections or frockbot.tool-result:<declaredToolName>",
+                  "Lowercase entry id, /^[a-z][a-z0-9-]{0,31}$/, unique in this Package.",
               },
+              slot: { type: "string", enum: [PACKAGE_IFRAME_ENTRY_SLOT_V1] },
               order: { type: "number" },
+              label: {
+                type: "string",
+                maxLength: PACKAGE_IFRAME_ENTRY_LABEL_MAX_V1,
+              },
+              icon: { type: "string", description: "A FrockBot UiIcon name." },
+              opens: {
+                type: "object",
+                additionalProperties: false,
+                required: ["kind", "page"],
+                properties: {
+                  kind: { type: "string", enum: ["surface"] },
+                  page: { type: "string" },
+                },
+              },
             },
           },
         },
@@ -449,7 +622,8 @@ export async function authoringEffectIdV1(input: {
   runId: string;
   packageId: string;
   sourceHash: string;
-  uiHtmlHash?: string;
+  /** Every page the bundler is asked for, in declaration order. */
+  uiPageHashes?: Array<{ id: string; htmlHash: string }>;
   hooks?: BotIsolateHookEventNameV1[];
 }): Promise<string> {
   const digest = await sha256HexV1(
@@ -457,7 +631,7 @@ export async function authoringEffectIdV1(input: {
       input.runId,
       input.packageId,
       input.sourceHash,
-      input.uiHtmlHash ?? null,
+      (input.uiPageHashes ?? []).map((page) => [page.id, page.htmlHash]),
       input.hooks ?? [],
     ]),
   );
@@ -502,17 +676,21 @@ export function authoredManifestV1(input: {
   tools: AuthorPackageInputV1["tools"];
   hooks?: AuthorPackageInputV1["hooks"];
   ui?: {
-    artifact: {
-      contentHash: string;
-      size: number;
-      mediaType: "text/html";
-      bundlerVersion: string;
-    };
-    mounts: Array<{ slot: string; order?: number }>;
+    pages: Array<{
+      id: string;
+      artifact: {
+        contentHash: string;
+        size: number;
+        mediaType: "text/html";
+        bundlerVersion: string;
+      };
+      mounts: Array<{ slot: string; order?: number }>;
+    }>;
+    entries?: NonNullable<AuthorPackageInputV1["ui"]>["entries"];
   };
 }): Record<string, unknown> {
   return {
-    schemaVersion: 3,
+    schemaVersion: 5,
     id: input.packageId,
     displayName: input.displayName,
     version: input.version,
@@ -524,8 +702,19 @@ export function authoredManifestV1(input: {
         ? {
             client: {
               kind: "iframe",
-              artifact: { ...input.ui.artifact },
-              mounts: input.ui.mounts.map((mount) => ({ ...mount })),
+              pages: input.ui.pages.map((page) => ({
+                id: page.id,
+                artifact: { ...page.artifact },
+                mounts: page.mounts.map((mount) => ({ ...mount })),
+              })),
+              ...(input.ui.entries
+                ? {
+                    entries: input.ui.entries.map((entry) => ({
+                      ...entry,
+                      opens: { ...entry.opens },
+                    })),
+                  }
+                : {}),
             },
           }
         : {}),