@hyprcart/app-manifest 1.0.0 → 1.0.2

package/dist/index.js

@@ -3,16 +3,331 @@ var supportedSurfaces = [
   "storefront_block",
   "admin_surface",
   "checkout_ui",
+  "deterministic_function",
   "checkout_function",
   "pixel",
+  "event_subscription",
+  "background_job",
   "event",
   "flow",
   "mcp"
 ];
+var storefrontBlockRenderTiers = ["static", "edge_render", "edge_stream"];
+var legacyStorefrontBlockRenderTiers = ["edge-function", "edge-stream"];
+var hydrationTriggers = ["load", "visible", "interaction", "idle", "manual"];
 var defaultRequiredLocales = ["en", "de"];
 function isSupportedSurface(value) {
   return supportedSurfaces.includes(value);
 }
+function normalizeStorefrontBlockRenderTier(value) {
+  if (value === "edge-function") return "edge_render";
+  if (value === "edge-stream") return "edge_stream";
+  if (storefrontBlockRenderTiers.includes(value)) return value;
+  return "static";
+}
+
+// src/customer-privacy/privacy-manifest.ts
+import * as z from "zod";
+import { en } from "zod/locales";
+z.config(en());
+var key = z.string().min(1).max(120).regex(/^[a-zA-Z0-9._:-]+$/);
+var messageKey = z.string().min(1).max(160).regex(/^[a-zA-Z0-9._-]+$/);
+var safeEndpoint = z.string().url().refine((value) => {
+  return value.startsWith("https://") && !/^https:\/\/[^/]*@/u.test(value);
+}, "privacy.endpoint.invalid");
+var terminalAccessSchema = z.object({
+  type: z.enum([
+    "cookie",
+    "local_storage",
+    "session_storage",
+    "indexed_db",
+    "cache_storage",
+    "device_access",
+    "memory"
+  ]),
+  key,
+  durationSeconds: z.number().int().nonnegative().max(315576e3).nullable(),
+  removable: z.boolean()
+}).strict();
+var recipientSchema = z.object({
+  id: key,
+  endpoint: safeEndpoint,
+  retentionDays: z.number().int().nonnegative().max(3650)
+}).strict();
+var boundedOperationSchema = z.object({
+  id: key,
+  eventClasses: z.array(key).min(1).max(100),
+  fieldKeys: z.array(key).min(1).max(100),
+  limits: z.object({
+    eventCount: z.number().int().positive().max(1e4),
+    byteCount: z.number().int().positive().max(1e7),
+    maximumAgeSeconds: z.number().int().positive().max(86400)
+  }).strict(),
+  cleanupTriggers: z.array(key).min(1).max(32)
+}).strict();
+var privacyManifestCapabilitySchema = z.object({
+  key,
+  type: z.enum([
+    "app_block",
+    "client_island",
+    "checkout_extension",
+    "pixel",
+    "server_event",
+    "background_delivery",
+    "analytics_destination",
+    "platform_feature"
+  ]),
+  purposes: z.array(key).min(1).max(16),
+  dataCategories: z.array(key).min(1).max(32),
+  terminalAccess: z.array(terminalAccessSchema).max(32),
+  recipients: z.array(recipientSchema).max(32),
+  boundedOperations: z.array(boundedOperationSchema).max(16).optional(),
+  regions: z.array(z.string().min(1).max(16)).min(1).max(64),
+  fallbackMessageKey: messageKey,
+  cleanup: z.object({
+    supported: z.boolean(),
+    callback: key.nullable().optional()
+  }).strict(),
+  exportSupport: z.enum(["supported", "unsupported", "not_applicable"]),
+  erasureSupport: z.enum(["supported", "unsupported", "not_applicable"]),
+  strictNecessity: z.object({
+    claimed: z.boolean(),
+    justification: z.string().min(1).max(2e3),
+    platformApprovalId: key.nullable()
+  }).strict().optional()
+}).strict();
+var privacyManifestSchema = z.object({
+  schemaVersion: z.literal("2026-07-01"),
+  messageKeys: z.object({
+    benefit: messageKey,
+    refusal: messageKey,
+    fallback: messageKey
+  }).strict(),
+  capabilities: z.array(privacyManifestCapabilitySchema).max(64),
+  removed: z.literal(true).optional()
+}).strict().superRefine((value, context) => {
+  if (value.removed !== true && value.capabilities.length === 0) {
+    context.addIssue({
+      code: "custom",
+      message: "privacy.manifest.capability_required",
+      path: ["capabilities"]
+    });
+  }
+});
+function validatePrivacyManifest(input, catalogs, options = {}) {
+  const parsed = privacyManifestSchema.safeParse(input);
+  const issues = [];
+  if (!parsed.success) {
+    for (const issue5 of parsed.error.issues) {
+      const code = issue5.message === "privacy.endpoint.invalid" ? "privacy.endpoint.invalid" : "privacy.manifest.invalid";
+      issues.push({ code, path: issue5.path.join(".") });
+    }
+  }
+  const candidate = parsed.success ? parsed.data : input && typeof input === "object" ? input : null;
+  if (candidate?.capabilities) {
+    for (const [index, capability] of candidate.capabilities.entries()) {
+      if (capability.strictNecessity?.claimed && !capability.strictNecessity.platformApprovalId && !options.allowPendingNecessityReview) {
+        issues.push({
+          code: "privacy.necessity.approval_required",
+          path: `capabilities.${index}.strictNecessity.platformApprovalId`
+        });
+      }
+    }
+  }
+  const requiredKeys = candidate?.messageKeys ? Object.values(candidate.messageKeys) : [];
+  for (const capability of candidate?.capabilities ?? []) {
+    if (capability.fallbackMessageKey)
+      requiredKeys.push(capability.fallbackMessageKey);
+  }
+  for (const [locale, catalog] of Object.entries(catalogs)) {
+    for (const requiredKey of new Set(requiredKeys)) {
+      if (!catalog[requiredKey]?.trim()) {
+        issues.push({
+          code: "privacy.message.missing",
+          path: `${locale}.${requiredKey}`
+        });
+      }
+    }
+  }
+  return { valid: issues.length === 0, issues };
+}
+function classifyPrivacyManifestChange(previous, next) {
+  const before = privacyManifestSchema.parse(previous);
+  const after = privacyManifestSchema.parse(next);
+  const reasons = /* @__PURE__ */ new Set();
+  const byKey = new Map(
+    before.capabilities.map((capability) => [capability.key, capability])
+  );
+  const afterKeys = new Set(
+    after.capabilities.map((capability) => capability.key)
+  );
+  if (before.removed !== after.removed || before.capabilities.some((capability) => !afterKeys.has(capability.key))) {
+    reasons.add("capabilities");
+  }
+  for (const capability of after.capabilities) {
+    const prior = byKey.get(capability.key);
+    if (!prior) {
+      reasons.add("capabilities");
+      continue;
+    }
+    for (const field of [
+      "purposes",
+      "dataCategories",
+      "terminalAccess",
+      "recipients",
+      "regions",
+      "boundedOperations"
+    ]) {
+      if (JSON.stringify(prior[field]) !== JSON.stringify(capability[field])) {
+        reasons.add(field === "dataCategories" ? "fields" : field);
+      }
+    }
+  }
+  return { material: reasons.size > 0, reasons: [...reasons].sort() };
+}
+
+// src/surface-contracts.ts
+function validateExtensionSurfaceDeclarations(manifest) {
+  return (manifest.surfaces ?? []).map((surface, index) => validateExtensionSurface(surface, `surfaces.${index}`));
+}
+function validateExtensionSurface(surface, basePath = "surface") {
+  const diagnostics = [];
+  if (!surface.label || Object.keys(surface.label).length === 0) {
+    diagnostics.push(diagnostic("surface.label.missing", "blocking", `${basePath}.label`, "Surface must declare localized labels."));
+  }
+  if (!surface.entry?.trim()) {
+    diagnostics.push(diagnostic("surface.entry.missing", "blocking", `${basePath}.entry`, "Surface must declare an entry file."));
+  }
+  if (surface.type === "admin_surface") validateAdminSurface(surface, basePath, diagnostics);
+  if (surface.type === "checkout_ui") validateCheckoutSurface(surface, basePath, diagnostics);
+  if (surface.type === "deterministic_function" || surface.type === "checkout_function") validateDeterministicFunction(surface, basePath, diagnostics);
+  if (surface.type === "pixel") validatePixel(surface, basePath, diagnostics);
+  if (surface.type === "event_subscription") validateEventSubscription(surface, basePath, diagnostics);
+  if (surface.type === "background_job") validateBackgroundJob(surface, basePath, diagnostics);
+  if (surface.type === "flow" || surface.type === "event") {
+    diagnostics.push(
+      diagnostic(
+        "surface.flow.deferred_to_075a",
+        "warning",
+        `${basePath}.type`,
+        "Flow trigger/action declarations are owned by 075a and are not activated by 049c.",
+        "https://hyprcart.com/docs/app-platform/storefront-app-blocks-internal"
+      )
+    );
+  }
+  const blocking = diagnostics.some((entry) => entry.severity === "blocking");
+  return {
+    surfaceId: surface.id,
+    surfaceType: surface.type,
+    status: blocking ? "rejected" : surface.type === "storefront_block" ? "active" : surface.type === "flow" || surface.type === "event" ? "deferred" : "preview",
+    runtimeOwner: ownerForSurface(surface.type),
+    diagnostics
+  };
+}
+function validateAdminSurface(surface, basePath, diagnostics) {
+  if (!surface.adminSurfaceType) {
+    diagnostics.push(diagnostic("surface.admin.type_missing", "blocking", `${basePath}.adminSurfaceType`, "Admin surfaces must declare a specific admin surface type."));
+  }
+  if (!surface.placement && !surface.compatibleSlots?.length) {
+    diagnostics.push(diagnostic("surface.admin.placement_missing", "blocking", `${basePath}.placement`, "Admin surfaces must declare placement targets."));
+  }
+  if (!surface.scopes?.length) {
+    diagnostics.push(diagnostic("surface.admin.scopes_missing", "blocking", `${basePath}.scopes`, "Admin surfaces must declare required scopes."));
+  }
+  if (!surface.componentKit?.minVersion || !surface.componentKit.components.length) {
+    diagnostics.push(diagnostic("surface.admin.component_kit_missing", "blocking", `${basePath}.componentKit`, "Admin surfaces must declare Hyprcart admin component kit version and components."));
+  }
+  if (surface.adminSurfaceType === "admin_ui_block") {
+    const removal = new Set(surface.removalBehavior ?? []);
+    if (!removal.has("remove_on_disable") || !removal.has("remove_on_uninstall")) {
+      diagnostics.push(diagnostic("surface.admin_block.removal_missing", "blocking", `${basePath}.removalBehavior`, "Admin UI blocks must remove placements on disable and uninstall without tombstones."));
+    }
+    if (!surface.dimensions) {
+      diagnostics.push(diagnostic("surface.admin_block.dimensions_missing", "blocking", `${basePath}.dimensions`, "Admin UI blocks must reserve stable dimensions."));
+    }
+  }
+  if (!surface.inputSchema && !surface.outputSchema) {
+    diagnostics.push(diagnostic("surface.admin.schema_missing", "warning", `${basePath}.inputSchema`, "Admin surfaces should declare typed input or output schemas."));
+  }
+  if (!surface.sandboxPolicy) {
+    diagnostics.push(diagnostic("surface.admin.sandbox_missing", "warning", `${basePath}.sandboxPolicy`, "Admin surfaces should declare a sandbox policy."));
+  }
+}
+function validateCheckoutSurface(surface, basePath, diagnostics) {
+  const sandbox = surface.sandboxPolicy ?? {};
+  if (sandbox.allowArbitraryDom === true || sandbox.allowScripts === true || sandbox.allowPaymentBypass === true) {
+    diagnostics.push(diagnostic("surface.checkout.unsupported_behavior", "blocking", `${basePath}.sandboxPolicy`, "Checkout UI extensions cannot declare arbitrary DOM, scripts, or payment bypass behavior."));
+  }
+  if (!surface.placement && !surface.compatibleSlots?.length) {
+    diagnostics.push(diagnostic("surface.checkout.placement_missing", "blocking", `${basePath}.placement`, "Checkout UI extensions must declare placement targets."));
+  }
+}
+function validateDeterministicFunction(surface, basePath, diagnostics) {
+  if (surface.determinism?.networkAccess) {
+    diagnostics.push(diagnostic("surface.function.network_forbidden", "blocking", `${basePath}.determinism.networkAccess`, "Deterministic functions cannot use arbitrary network access."));
+  }
+  if (surface.determinism?.mutationSideEffects) {
+    diagnostics.push(diagnostic("surface.function.side_effects_forbidden", "blocking", `${basePath}.determinism.mutationSideEffects`, "Deterministic functions cannot perform direct mutation side effects."));
+  }
+  if (!surface.inputSchema || !surface.outputSchema) {
+    diagnostics.push(diagnostic("surface.function.schema_missing", "blocking", `${basePath}.inputSchema`, "Deterministic functions require typed input and output schemas."));
+  }
+}
+function validatePixel(surface, basePath, diagnostics) {
+  const sandbox = surface.sandboxPolicy ?? {};
+  if (sandbox.domRead === true || sandbox.domWrite === true || sandbox.allowDomScrape === true || sandbox.allowDomWrite === true) {
+    diagnostics.push(diagnostic("surface.pixel.dom_access_forbidden", "blocking", `${basePath}.sandboxPolicy`, "Pixels cannot scrape or write storefront DOM."));
+  }
+  if (surface.consent?.bypass === true || sandbox.consentBypass === true) {
+    diagnostics.push(diagnostic("surface.pixel.consent_bypass_forbidden", "blocking", `${basePath}.consent`, "Pixels cannot bypass consent checks."));
+  }
+  if (!surface.consent?.category) {
+    diagnostics.push(diagnostic("surface.pixel.consent_missing", "blocking", `${basePath}.consent.category`, "Pixels must declare a consent category."));
+  }
+  if (!surface.consent?.events?.length) {
+    diagnostics.push(diagnostic("surface.pixel.events_missing", "blocking", `${basePath}.consent.events`, "Pixels must declare events."));
+  }
+  if (!surface.consent?.destinations?.length) {
+    diagnostics.push(diagnostic("surface.pixel.destinations_missing", "blocking", `${basePath}.consent.destinations`, "Pixels must declare destinations."));
+  }
+  if (!surface.consent?.regions?.length) {
+    diagnostics.push(diagnostic("surface.pixel.regions_missing", "warning", `${basePath}.consent.regions`, "Pixels should declare regional availability."));
+  }
+  const fields = surface.consent?.fields ?? [];
+  if (!fields.length || fields.some((field) => /email|phone|name|address|token|secret|session|payment|card/i.test(field))) {
+    diagnostics.push(diagnostic("surface.pixel.field_selection_invalid", "blocking", `${basePath}.consent.fields`, "Pixels must declare minimized buyer-safe fields only."));
+  }
+}
+function validateEventSubscription(surface, basePath, diagnostics) {
+  if (!surface.consent?.events?.length && !surface.requiredContexts?.length) {
+    diagnostics.push(diagnostic("surface.event.events_missing", "blocking", `${basePath}.requiredContexts`, "Event subscriptions must declare subscribed event names."));
+  }
+  if (!surface.scopes?.length) {
+    diagnostics.push(diagnostic("surface.event.scopes_missing", "blocking", `${basePath}.scopes`, "Event subscriptions must declare required scopes."));
+  }
+}
+function validateBackgroundJob(surface, basePath, diagnostics) {
+  if (!surface.retryPolicy) {
+    diagnostics.push(diagnostic("surface.background_job.retry_missing", "blocking", `${basePath}.retryPolicy`, "Background jobs must declare bounded retry policy."));
+  }
+  if ((surface.adminSurfaceType === "bulk_action" || surface.type === "background_job") && surface.overlapPolicy === void 0) {
+    diagnostics.push(diagnostic("surface.background_job.overlap_missing", "blocking", `${basePath}.overlapPolicy`, "Background jobs must declare overlap policy."));
+  }
+  if (!surface.quotaClass) {
+    diagnostics.push(diagnostic("surface.background_job.quota_missing", "warning", `${basePath}.quotaClass`, "Background jobs should declare a quota class."));
+  }
+}
+function ownerForSurface(surface) {
+  if (surface === "storefront_block") return "049c";
+  if (surface === "flow" || surface === "event") return "075a";
+  if (surface === "admin_surface" || surface === "checkout_ui" || surface === "checkout_function" || surface === "deterministic_function" || surface === "pixel" || surface === "event_subscription" || surface === "background_job") {
+    return "049e";
+  }
+  return "deferred";
+}
+function diagnostic(code, severity, path, message, docsUrl) {
+  return { code, severity, path, message, docsUrl };
+}
 
 // src/validation.ts
 var riskyDependencyPatterns = [/child_process/i, /node:fs/i, /eval\(/i];
@@ -66,7 +381,25 @@ function validateManifest(manifest, options = {}) {
         )
       );
     }
+    if (surface.type === "storefront_block") {
+      validateStorefrontBlockSurface(surface, basePath, issues);
+    }
   });
+  for (const surfaceResult of validateExtensionSurfaceDeclarations(manifest)) {
+    for (const diagnostic2 of surfaceResult.diagnostics) {
+      issues.push(
+        issue(
+          diagnostic2.code,
+          diagnostic2.severity === "blocking" ? "blocker" : diagnostic2.severity === "error" ? "error" : diagnostic2.severity === "warning" ? "warning" : "info",
+          diagnostic2.path,
+          diagnostic2.message,
+          void 0,
+          diagnostic2.docsUrl
+        )
+      );
+    }
+  }
+  validateCustomerPrivacyDeclarations(manifest, requiredLocales, issues);
   const translationStatus = getTranslationStatus(manifest, requiredLocales);
   for (const gap of translationStatus.missing) {
     issues.push(
@@ -115,6 +448,90 @@ function validateManifest(manifest, options = {}) {
     translationStatus
   };
 }
+function validateCustomerPrivacyDeclarations(manifest, requiredLocales, issues) {
+  const relevantSurfaces = (manifest.surfaces ?? []).filter(
+    (surface) => surface.type === "pixel" || typeof surface.consent?.category === "string" && surface.consent.category !== "necessary" || (surface.clientIslands ?? []).some(
+      (island) => Boolean(island.consentCategory) && island.consentCategory !== "necessary"
+    )
+  );
+  if (relevantSurfaces.length > 0 && !manifest.customerPrivacy) {
+    issues.push(issue(
+      "privacy.manifest.required",
+      "blocker",
+      "customerPrivacy",
+      "Privacy-relevant app surfaces require a customer privacy manifest.",
+      "Declare each buyer-facing storage or processing capability."
+    ));
+    return;
+  }
+  if (!manifest.customerPrivacy) return;
+  const catalogs = Object.fromEntries(
+    requiredLocales.map((locale) => [
+      locale,
+      manifest.translations?.[locale] ?? {}
+    ])
+  );
+  const validation = validatePrivacyManifest(
+    manifest.customerPrivacy,
+    catalogs,
+    { allowPendingNecessityReview: true }
+  );
+  for (const privacyIssue of validation.issues) {
+    issues.push(issue(
+      privacyIssue.code,
+      "blocker",
+      `customerPrivacy.${privacyIssue.path}`,
+      "The customer privacy declaration is incomplete or invalid.",
+      "Correct the declaration and provide every localized buyer message."
+    ));
+  }
+  const declaredKeys = new Set(
+    manifest.customerPrivacy.capabilities.map((capability) => capability.key)
+  );
+  for (const surface of relevantSurfaces) {
+    if (!declaredKeys.has(surface.id)) {
+      issues.push(issue(
+        "privacy.surface.capability_missing",
+        "blocker",
+        `surfaces.${surface.id}.consent`,
+        `Privacy-relevant surface "${surface.id}" has no matching capability declaration.`,
+        `Add customerPrivacy.capabilities entry "${surface.id}".`
+      ));
+    }
+  }
+}
+function validateStorefrontBlockSurface(surface, basePath, issues) {
+  const renderTier = normalizeStorefrontBlockRenderTier(surface.renderTier ?? surface.tier);
+  if (renderTier === "edge_stream" && (!surface.placeholder?.width || !surface.placeholder?.height || !surface.placeholder?.skeleton)) {
+    issues.push(
+      issue(
+        "storefront_block.placeholder.missing",
+        "blocker",
+        `${basePath}.placeholder`,
+        "Streaming app blocks must declare placeholder width, height, and skeleton before install.",
+        "Add exact placeholder dimensions and skeleton type.",
+        "https://developer.hyprcart.com/docs/app-platform/surfaces"
+      )
+    );
+  }
+  for (const island of surface.clientIslands ?? []) {
+    if (island.compressedSizeBytes > 32 * 1024 && !island.exceptionId) {
+      issues.push(
+        issue(
+          "client_island.bundle_budget.exceeded",
+          "blocker",
+          `${basePath}.clientIslands`,
+          "Client island bundle exceeds the 32 KB compressed budget.",
+          "Reduce bundle size or request a platform exception.",
+          "https://developer.hyprcart.com/docs/app-platform/surfaces"
+        )
+      );
+    }
+    if (!island.domBoundarySelector?.startsWith("[data-hc-app-block")) {
+      issues.push(issue("client_island.dom_boundary.invalid", "blocker", `${basePath}.clientIslands`, "Client island DOM boundary must stay inside the app block wrapper."));
+    }
+  }
+}
 function getTranslationStatus(manifest, requiredLocales) {
   const missing = [];
   const completeLocales = [];
@@ -147,27 +564,40 @@ function isCompatibleSdk(version, supportedMajor) {
   return Number.isFinite(major) && major === supportedMajor;
 }
 function hashObject(value) {
-  const json = JSON.stringify(value, Object.keys(value).sort());
+  const json = stableStringify(value);
   let hash = 0;
   for (let index = 0; index < json.length; index += 1) {
     hash = hash * 31 + json.charCodeAt(index) >>> 0;
   }
   return `mf_${hash.toString(16).padStart(8, "0")}`;
 }
+function stableStringify(value) {
+  return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+  if (Array.isArray(value)) return value.map(sortValue);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key2, entry]) => [key2, sortValue(entry)])
+  );
+}
 
 // src/contract-generation.ts
 function generateContracts(manifest, schemaVersion = "2026-06-06") {
   const surfaces = manifest.surfaces.map(renderSurfaceContract).join("\n\n");
+  const surfaceMetadata = validateExtensionSurfaceDeclarations(manifest);
   const content = [
     "/* Generated by Hyprcart app tooling. */",
     `export const schemaVersion = ${JSON.stringify(schemaVersion)};`,
     `export const sdkVersion = ${JSON.stringify(manifest.sdkVersion)};`,
+    `export const surfaceContracts = ${JSON.stringify(surfaceMetadata, null, 2)} as const;`,
     surfaces
   ].join("\n");
   return {
     manifestHash: stableHash(JSON.stringify(manifest)),
     schemaVersion,
     sdkVersion: manifest.sdkVersion,
+    surfaces: surfaceMetadata,
     files: [
       {
         path: "generated/hyprcart.contracts.ts",
@@ -266,15 +696,359 @@ var developerToolingOperationMetadata = [
     stability: "preview"
   }
 ];
+
+// src/admin-component-kit.ts
+var defaultSupportedComponents = [
+  "Page",
+  "Section",
+  "Stack",
+  "InlineStack",
+  "Grid",
+  "ResourcePanel",
+  "AdminBlock",
+  "Modal",
+  "Sheet",
+  "Text",
+  "Heading",
+  "Badge",
+  "Status",
+  "DescriptionList",
+  "DataTable",
+  "Timeline",
+  "Metric",
+  "EmptyState",
+  "Skeleton",
+  "Form",
+  "TextField",
+  "NumberField",
+  "Select",
+  "Combobox",
+  "Checkbox",
+  "RadioGroup",
+  "DatePicker",
+  "FilePicker",
+  "ResourcePicker",
+  "ValidationMessage",
+  "Button",
+  "IconButton",
+  "Banner",
+  "Toast",
+  "InlineError",
+  "Progress",
+  "Spinner",
+  "Tooltip",
+  "ConfirmDialog",
+  "TitleBar",
+  "Breadcrumbs",
+  "Tabs",
+  "ActionList",
+  "ContextualSaveBar",
+  "CommandAction",
+  "SearchResult"
+];
+var supportedAdminComponentKitComponents = [...defaultSupportedComponents];
+function validateAdminComponentKitManifest(input) {
+  const diagnostics = [];
+  if (!input.minVersion) {
+    diagnostics.push({ code: "admin_component_kit.version_missing", path: "componentKit.minVersion", message: "Admin component kit minimum version is required." });
+  }
+  const supported = new Set(input.supportedComponents ?? supportedAdminComponentKitComponents);
+  for (const component of input.components ?? []) {
+    if (!supported.has(component)) {
+      diagnostics.push({ code: "admin_component_kit.component_unsupported", path: "componentKit.components", message: `${component} is not an approved admin component.` });
+    }
+  }
+  for (const [key2, value] of Object.entries(input.tokens ?? {})) {
+    if (/(?:#[0-9a-f]{3,8}\b|rgba?\(|font|radius|shadow)/i.test(`${key2}:${String(value)}`)) {
+      diagnostics.push({ code: "admin_component_kit.token_forbidden", path: `componentKit.tokens.${key2}`, message: "Apps cannot declare custom visual tokens outside the platform kit." });
+    }
+  }
+  if (input.css && /(?:font-family|border-radius|box-shadow|position\s*:\s*fixed)/i.test(input.css)) {
+    diagnostics.push({ code: "admin_component_kit.css_forbidden", path: "componentKit.css", message: "Apps cannot inject global CSS or incompatible visual rules into admin surfaces." });
+  }
+  return { valid: diagnostics.length === 0, diagnostics };
+}
+
+// src/capability-declarations.ts
+var appGovernanceCapabilityTypes = [
+  "api_operation",
+  "storefront_block",
+  "admin_surface",
+  "checkout_surface",
+  "pixel",
+  "event_subscription",
+  "mcp_tool",
+  "mcp_resource",
+  "mcp_resource_template",
+  "mcp_prompt",
+  "background_job"
+];
+var appGovernanceDataClasses = ["public", "merchant_operational", "restricted_customer", "payment_adjacent", "auth_sensitive", "security", "operator_only"];
+var appGovernanceRiskClasses = ["low", "medium", "high", "critical"];
+var appGovernanceCostClasses = ["free", "low", "medium", "high", "operator"];
+var appGovernanceApprovalPolicies = ["required", "optional", "operator_only", "automation_policy_required", "not_approvable"];
+function validateAppCapabilityDeclarations(input) {
+  const issues = [];
+  const capabilityKeys = /* @__PURE__ */ new Set();
+  for (const [index, capability] of (input.capabilities ?? []).entries()) {
+    const path = `capabilities.${index}`;
+    if (!capability.key?.trim()) issues.push(issue2("capability.key.missing", `${path}.key`, "Capability key is required."));
+    if (capabilityKeys.has(capability.key)) issues.push(issue2("capability.key.duplicate", `${path}.key`, "Capability key must be unique."));
+    capabilityKeys.add(capability.key);
+    if (!isOneOf(capability.type, appGovernanceCapabilityTypes)) issues.push(issue2("capability.type.invalid", `${path}.type`, "Capability type is not supported."));
+    if (!isOneOf(capability.dataClass, appGovernanceDataClasses)) issues.push(issue2("capability.data_class.invalid", `${path}.dataClass`, "Data class is not supported."));
+    if (!isOneOf(capability.riskClass, appGovernanceRiskClasses)) issues.push(issue2("capability.risk_class.invalid", `${path}.riskClass`, "Risk class is not supported."));
+    if (!isOneOf(capability.costClass, appGovernanceCostClasses)) issues.push(issue2("capability.cost_class.invalid", `${path}.costClass`, "Cost class is not supported."));
+    if (!isOneOf(capability.approvalPolicy, appGovernanceApprovalPolicies)) issues.push(issue2("capability.approval_policy.invalid", `${path}.approvalPolicy`, "Approval policy is not supported."));
+    if (capability.mutating && capability.riskClass === "low") {
+      issues.push(issue2("capability.mutating.low_risk", `${path}.riskClass`, "Mutating capabilities must be medium risk or higher."));
+    }
+  }
+  for (const [index, egress] of (input.egress ?? []).entries()) {
+    const path = `egress.${index}`;
+    for (const host of egress.hosts ?? []) {
+      if (!isNormalizedHostPattern(host)) issues.push(issue2("egress.host.invalid", `${path}.hosts`, "Egress host must be normalized and must not contain credentials, path, query, or fragment."));
+    }
+    for (const capabilityKey of egress.requiredForCapabilities ?? []) {
+      if (!capabilityKeys.has(capabilityKey)) issues.push(issue2("egress.capability.unknown", `${path}.requiredForCapabilities`, `Unknown capability ${capabilityKey}.`));
+    }
+  }
+  for (const [index, retention] of (input.dataRetention ?? []).entries()) {
+    const path = `dataRetention.${index}`;
+    if (retention.merchantVisible !== true) {
+      issues.push(issue2("retention.visibility.required", `${path}.merchantVisible`, "Retention policy must be visible to merchants at install and uninstall."));
+    }
+    for (const capabilityKey of retention.appliesTo ?? []) {
+      if (!capabilityKeys.has(capabilityKey)) issues.push(issue2("retention.capability.unknown", `${path}.appliesTo`, `Unknown capability ${capabilityKey}.`));
+    }
+  }
+  return { valid: issues.length === 0, issues };
+}
+function isNormalizedHostPattern(host) {
+  if (!host || host.includes("@") || host.includes("/") || host.includes("?") || host.includes("#")) return false;
+  return /^[a-z0-9*.-]+(?::\d+)?$/i.test(host);
+}
+function isOneOf(value, values) {
+  return values.includes(value);
+}
+function issue2(code, path, message) {
+  return { code, path, message };
+}
+
+// src/ai-mcp-metadata.ts
+var aiMcpDescriptorTypes = ["tool", "resource", "resource_template", "prompt"];
+var aiMcpHumanApprovalPolicies = ["not_required", "required", "required_for_mutation", "automation_policy_allowed"];
+var unsafeAuthorityPattern = /(ignore previous|system prompt|act as admin|bypass|override policy|grant .*scope|no approval)/i;
+function validateAiMcpDescriptorMetadata(descriptors) {
+  const issues = [];
+  const names = /* @__PURE__ */ new Set();
+  descriptors.forEach((descriptor, index) => {
+    const path = `ai.mcp.${descriptor.descriptorType}.${index}`;
+    if (!descriptor.name?.trim()) issues.push(issue3("ai_mcp.name.missing", `${path}.name`, "Descriptor name is required."));
+    if (names.has(descriptor.name)) issues.push(issue3("ai_mcp.name.duplicate", `${path}.name`, "Descriptor name must be unique per app installation."));
+    names.add(descriptor.name);
+    if (!aiMcpDescriptorTypes.includes(descriptor.descriptorType)) issues.push(issue3("ai_mcp.type.invalid", `${path}.descriptorType`, "Descriptor type is not supported."));
+    if (!aiMcpHumanApprovalPolicies.includes(descriptor.humanApprovalPolicy)) issues.push(issue3("ai_mcp.approval.invalid", `${path}.humanApprovalPolicy`, "Human approval policy is not supported."));
+    if (descriptor.mutating && descriptor.humanApprovalPolicy === "not_required") {
+      issues.push(issue3("ai_mcp.mutating.approval_required", `${path}.humanApprovalPolicy`, "Mutating descriptors require human approval or automation policy."));
+    }
+    if (descriptor.resourceUriTemplate && /token|secret|bearer/i.test(descriptor.resourceUriTemplate)) {
+      issues.push(issue3("ai_mcp.resource_template.secret", `${path}.resourceUriTemplate`, "Resource URI templates must not embed tokens or secrets."));
+    }
+    for (const text of [descriptor.description, descriptor.promptTemplate].filter((value) => Boolean(value))) {
+      if (unsafeAuthorityPattern.test(text)) {
+        issues.push(issue3("ai_mcp.metadata.untrusted_authority", path, "Descriptor text is untrusted metadata and cannot claim platform authority."));
+      }
+    }
+  });
+  return { valid: issues.length === 0, issues };
+}
+function classifyAiMcpMetadataAuthority(text) {
+  return unsafeAuthorityPattern.test(text) ? "untrusted_authority_claim" : "safe_descriptor";
+}
+function issue3(code, path, message) {
+  return { code, path, message };
+}
+
+// src/launch-readiness.ts
+var REQUIRED_LOCALES = ["en", "de"];
+function validateLaunchReadinessManifest(manifest) {
+  const issues = [];
+  const launch = manifest.launch;
+  if (!launch) {
+    return issue4("launch.missing", "launch", "Launch readiness declaration is required.");
+  }
+  validateAdminApi(launch, issues);
+  validateAppData(launch, issues);
+  validateEnvironments(launch, issues);
+  validateSecrets(launch, issues);
+  validateSettings(launch, issues);
+  validateConsent(launch, issues);
+  validateLifecycleCallbacks(launch, issues);
+  validateAssets(launch, issues);
+  validateSandbox(launch, issues);
+  validateEvidence(launch, issues);
+  validateCompatibility(launch, issues);
+  return { valid: issues.length === 0, issues };
+}
+function assertLaunchReadinessManifest(manifest) {
+  const result = validateLaunchReadinessManifest(manifest);
+  if (!result.valid) {
+    throw new Error(result.issues.map((entry) => `${entry.code}:${entry.path}`).join(", "));
+  }
+}
+function validateAdminApi(launch, issues) {
+  if (!launch.adminApi?.minApiVersion) addIssue(issues, "launch.admin_api.missing", "launch.adminApi", "Admin API declaration is required.");
+  if (!launch.adminApi?.operations?.length) addIssue(issues, "launch.admin_api.operations_missing", "launch.adminApi.operations", "At least one Admin API operation declaration is required.");
+}
+function validateAppData(launch, issues) {
+  if (!launch.appData?.length) addIssue(issues, "launch.app_data.missing", "launch.appData", "App data declarations are required.");
+  for (const [index, declaration] of (launch.appData ?? []).entries()) {
+    if (!declaration.namespace) addIssue(issues, "launch.app_data.namespace_missing", `launch.appData.${index}.namespace`, "App data namespace is required.");
+    if (declaration.visibility === "storefront_public" && !declaration.storefrontMaterialization?.cacheTags?.length) {
+      addIssue(issues, "launch.app_data.cache_tags_missing", `launch.appData.${index}.storefrontMaterialization.cacheTags`, "Storefront-public app data requires cache tags.");
+    }
+  }
+}
+function validateEnvironments(launch, issues) {
+  const keys = new Set((launch.environments ?? []).map((environment) => environment.key));
+  for (const key2 of ["development", "staging", "production"]) {
+    if (!keys.has(key2)) addIssue(issues, "launch.environment.missing", `launch.environments.${key2}`, `${key2} environment is required.`);
+  }
+  const production = (launch.environments ?? []).find((environment) => environment.key === "production");
+  if (production && !production.promotionRequiresCertification) {
+    addIssue(issues, "launch.environment.production_certification", "launch.environments.production", "Production environment must require certification.");
+  }
+}
+function validateSecrets(launch, issues) {
+  if (!launch.secrets?.length) addIssue(issues, "launch.secrets.missing", "launch.secrets", "At least one secret declaration is required.");
+  for (const [index, secret] of (launch.secrets ?? []).entries()) {
+    if (secret.runtimeExposure === "runtime_only" && secret.key.toLowerCase().startsWith("next_public")) {
+      addIssue(issues, "launch.secrets.client_bundle", `launch.secrets.${index}.key`, "Secrets cannot target client bundles.");
+    }
+  }
+}
+function validateSettings(launch, issues) {
+  if (!launch.settings?.length) addIssue(issues, "launch.settings.missing", "launch.settings", "Merchant settings declaration is required.");
+  for (const [index, setting] of (launch.settings ?? []).entries()) {
+    for (const locale of REQUIRED_LOCALES) {
+      if (!setting.label[locale]) addIssue(issues, "launch.settings.locale_missing", `launch.settings.${index}.label.${locale}`, "Setting labels require English and German.");
+    }
+  }
+}
+function validateConsent(launch, issues) {
+  const consent = launch.consent;
+  if (!consent) {
+    addIssue(issues, "launch.consent.missing", "launch.consent", "Consent metadata is required.");
+    return;
+  }
+  for (const [field, value] of Object.entries({
+    appIcon: consent.appIcon,
+    developerName: consent.developerName,
+    supportUrl: consent.supportUrl,
+    privacyPolicyUrl: consent.privacyPolicyUrl,
+    termsUrl: consent.termsUrl,
+    reviewerInstructions: consent.reviewerInstructions
+  })) {
+    if (!value) addIssue(issues, "launch.consent.field_missing", `launch.consent.${field}`, "Consent metadata field is required.");
+  }
+  if (!consent.screenshots.length) addIssue(issues, "launch.consent.screenshots_missing", "launch.consent.screenshots", "At least one screenshot is required.");
+  if (!consent.dataCategories.length) addIssue(issues, "launch.consent.data_categories_missing", "launch.consent.dataCategories", "Data categories are required.");
+}
+function validateLifecycleCallbacks(launch, issues) {
+  if (!launch.lifecycleCallbacks?.length) addIssue(issues, "launch.callbacks.missing", "launch.lifecycleCallbacks", "Lifecycle callback declarations are required.");
+}
+function validateAssets(launch, issues) {
+  const kinds = new Set((launch.assets ?? []).map((asset) => asset.kind));
+  for (const kind of ["icon", "screenshot"]) {
+    if (!kinds.has(kind)) addIssue(issues, "launch.assets.required_missing", `launch.assets.${kind}`, `${kind} asset is required.`);
+  }
+}
+function validateSandbox(launch, issues) {
+  if (!launch.sandbox?.fixturePackId) addIssue(issues, "launch.sandbox.missing", "launch.sandbox", "Sandbox fixture declaration is required.");
+  if (launch.sandbox && !launch.sandbox.anonymizationRequired) {
+    addIssue(issues, "launch.sandbox.anonymization_required", "launch.sandbox.anonymizationRequired", "Sandbox fixtures must require anonymization.");
+  }
+}
+function validateEvidence(launch, issues) {
+  if (!launch.evidence?.testCommand) addIssue(issues, "launch.evidence.test_missing", "launch.evidence.testCommand", "Evidence test command is required.");
+  if (!launch.evidence?.buildCommand) addIssue(issues, "launch.evidence.build_missing", "launch.evidence.buildCommand", "Evidence build command is required.");
+}
+function validateCompatibility(launch, issues) {
+  if (!launch.compatibility?.adminApiVersion) addIssue(issues, "launch.compatibility.missing", "launch.compatibility", "Compatibility declaration is required.");
+}
+function addIssue(issues, code, path, message) {
+  issues.push({ code, path, message });
+}
+function issue4(code, path, message) {
+  return { valid: false, issues: [{ code, path, message }] };
+}
+
+// src/preview-validation.ts
+function validateNoDeployPreviewManifest(manifest) {
+  const validation = validateManifest(manifest);
+  const diagnostics = validation.issues.map((issue5) => ({
+    code: `manifest.${issue5.code}`,
+    message: issue5.message,
+    path: issue5.path
+  }));
+  if (manifest.surfaces.length === 0) {
+    diagnostics.push({
+      code: "preview.surface_missing",
+      message: "No-deploy preview requires at least one app surface.",
+      path: "surfaces"
+    });
+  }
+  for (const surface of manifest.surfaces) {
+    if (!surface.entry) {
+      diagnostics.push({
+        code: "preview.surface_entry_missing",
+        message: "Preview surfaces must declare an entry point.",
+        path: `surfaces.${surface.id}.entry`
+      });
+    }
+  }
+  return {
+    status: diagnostics.length === 0 ? "valid" : "invalid",
+    createdProductionState: false,
+    diagnostics
+  };
+}
 export {
+  aiMcpDescriptorTypes,
+  aiMcpHumanApprovalPolicies,
+  appGovernanceApprovalPolicies,
+  appGovernanceCapabilityTypes,
+  appGovernanceCostClasses,
+  appGovernanceDataClasses,
+  appGovernanceRiskClasses,
+  assertLaunchReadinessManifest,
   checkCompatibility,
+  classifyAiMcpMetadataAuthority,
+  classifyPrivacyManifestChange,
   defaultRequiredLocales,
   developerToolingOperationMetadata,
   generateContracts,
   generateIdeMetadata,
   getTranslationStatus,
+  hydrationTriggers,
+  isNormalizedHostPattern,
   isSupportedSurface,
+  legacyStorefrontBlockRenderTiers,
+  normalizeStorefrontBlockRenderTier,
+  privacyManifestCapabilitySchema,
+  privacyManifestSchema,
+  storefrontBlockRenderTiers,
+  supportedAdminComponentKitComponents,
   supportedSurfaces,
-  validateManifest
+  validateAdminComponentKitManifest,
+  validateAiMcpDescriptorMetadata,
+  validateAppCapabilityDeclarations,
+  validateExtensionSurface,
+  validateExtensionSurfaceDeclarations,
+  validateLaunchReadinessManifest,
+  validateManifest,
+  validateNoDeployPreviewManifest,
+  validatePrivacyManifest
 };
 //# sourceMappingURL=index.js.map