@irogane/kaji 0.2.0-beta.11

package/contracts/integrations/conformance-invalid.json

@@ -0,0 +1,443 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "cases": [
+    {
+      "name": "environment auth missing env",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "env" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/auth",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "environment auth has unsafe lowercase env",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "env", "env": "api_key" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/auth",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "environment auth has OAuth fields",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "env", "env": "API_KEY", "scopes": ["read"] },
+        "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/auth",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "OAuth auth missing provider",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "oauth", "clientIdEnv": "GOOGLE_CLIENT_ID", "scopes": ["read"] }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/auth",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "OAuth auth missing client ID environment variable",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "oauth", "provider": "google", "scopes": ["read"] }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/auth",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "OAuth auth missing scopes",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "oauth", "provider": "google", "clientIdEnv": "GOOGLE_CLIENT_ID" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/auth",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "OAuth auth has empty scopes",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "oauth", "provider": "google", "clientIdEnv": "GOOGLE_CLIENT_ID", "scopes": [] }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/auth",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "OAuth auth has duplicate scopes",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "oauth", "provider": "google", "clientIdEnv": "GOOGLE_CLIENT_ID", "scopes": ["read", "read"] },
+        "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/auth",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "OAuth auth has env fields",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "oauth", "provider": "google", "clientIdEnv": "GOOGLE_CLIENT_ID", "scopes": ["read"], "env": "API_KEY" },
+        "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/auth",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "none auth has credential fields",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none", "env": "API_KEY" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/auth",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "invalid authentication docs URI",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "env", "env": "API_KEY", "docs": "not a uri" },
+        "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/auth",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool missing risk",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool missing name",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool missing parameters",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool missing parallel safe classification",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read" }]
+      },
+      "expectedPath": "/tools/0",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool has invalid Draft 2020-12 parameter schema",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": { "type": "not-a-json-type" }, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0/parameters/type",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool has unsupported parameter schema dialect",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": { "$schema": "https://json-schema.org/draft/2019-09/schema" }, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0/parameters/$schema",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool has invalid regular expression pattern",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": { "type": "object", "properties": { "value": { "type": "string", "pattern": "[" } } }, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0/parameters/properties/value/pattern",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool has invalid schema identifier",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": { "type": "object", "properties": { "value": { "$id": "not uri with spaces", "type": "object" } } }, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0/parameters/properties/value/$id",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool pattern uses ECMAScript named capture",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": { "type": "object", "properties": { "value": { "type": "string", "pattern": "(?<name>a)" } } }, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0/parameters/properties/value/pattern",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool pattern uses Python named capture",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": { "type": "object", "properties": { "value": { "type": "string", "pattern": "(?P<name>a)" } } }, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0/parameters/properties/value/pattern",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool pattern uses inline flags",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": { "type": "object", "properties": { "value": { "type": "string", "pattern": "(?i:a)" } } }, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0/parameters/properties/value/pattern",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool pattern uses atomic groups",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": { "type": "object", "properties": { "value": { "type": "string", "pattern": "(?>a)" } } }, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0/parameters/properties/value/pattern",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool pattern uses Python anchors",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": { "type": "object", "properties": { "value": { "type": "string", "pattern": "\\A[a-z]+\\Z" } } }, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0/parameters/properties/value/pattern",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool pattern uses Unicode properties",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": { "type": "object", "properties": { "value": { "type": "string", "pattern": "\\p{Letter}+" } } }, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0/parameters/properties/value/pattern",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool pattern uses backreferences",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": { "type": "object", "properties": { "value": { "type": "string", "pattern": "(a)\\1" } } }, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/tools/0/parameters/properties/value/pattern",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "tool has non-positive timeout",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false, "timeout_ms": 0 }]
+      },
+      "expectedPath": "/tools/0/timeout_ms",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "duplicate tool name",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts"],
+        "tools": [
+          { "name": "x", "description": "first", "parameters": {}, "risk": "read", "parallel_safe": false },
+          { "name": "x", "description": "second", "parameters": {}, "risk": "write", "parallel_safe": false }
+        ]
+      },
+      "expectedPath": "/tools/1/name",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "absolute manifest file path",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["/tmp/index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/files/0",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "parent traversal manifest file path",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["../index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/files/0",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "duplicate manifest file",
+      "target": "manifest",
+      "document": {
+        "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+        "auth": { "kind": "none" }, "files": ["index.ts", "index.ts"],
+        "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+      },
+      "expectedPath": "/files",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "index manifest path escapes registry",
+      "target": "index",
+      "document": {
+        "$schema": "./index.schema.json", "version": "0.1.0",
+        "integrations": {
+          "x": { "manifest": "../x/manifest.json", "stability": "beta", "runtimes": ["typescript"] }
+        }
+      },
+      "expectedPath": "/integrations/x/manifest",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "unknown stability tier",
+      "target": "index",
+      "document": {
+        "$schema": "./index.schema.json", "version": "0.1.0",
+        "integrations": {
+          "x": { "manifest": "x/manifest.json", "stability": "preview", "runtimes": ["typescript"] }
+        }
+      },
+      "expectedPath": "/integrations/x/stability",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "unknown integration runtime",
+      "target": "index",
+      "document": {
+        "$schema": "./index.schema.json", "version": "0.1.0",
+        "integrations": {
+          "x": { "manifest": "x/manifest.json", "stability": "beta", "runtimes": ["ruby"] }
+        }
+      },
+      "expectedPath": "/integrations/x/runtimes/0",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "index key does not match manifest name",
+      "target": "registry",
+      "index": {
+        "$schema": "./index.schema.json", "version": "0.1.0",
+        "integrations": {
+          "alias": { "manifest": "actual/manifest.json", "stability": "beta", "runtimes": ["typescript"] }
+        }
+      },
+      "manifests": {
+        "actual/manifest.json": {
+          "name": "actual", "version": "0.1.0", "namespace": "actual", "description": "actual",
+          "auth": { "kind": "none" }, "files": ["index.ts"],
+          "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+        }
+      },
+      "files": ["actual/index.ts"],
+      "expectedPath": "/name",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "index points to missing manifest",
+      "target": "registry",
+      "index": {
+        "$schema": "./index.schema.json", "version": "0.1.0",
+        "integrations": {
+          "ghost": { "manifest": "ghost/manifest.json", "stability": "experimental", "runtimes": ["typescript"] }
+        }
+      },
+      "manifests": {},
+      "files": [],
+      "expectedPath": "/integrations/ghost/manifest",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    },
+    {
+      "name": "manifest references missing file",
+      "target": "registry",
+      "index": {
+        "$schema": "./index.schema.json", "version": "0.1.0",
+        "integrations": {
+          "x": { "manifest": "x/manifest.json", "stability": "experimental", "runtimes": ["typescript"] }
+        }
+      },
+      "manifests": {
+        "x/manifest.json": {
+          "name": "x", "version": "0.1.0", "namespace": "x", "description": "x",
+          "auth": { "kind": "none" }, "files": ["missing.ts"],
+          "tools": [{ "name": "x", "description": "x", "parameters": {}, "risk": "read", "parallel_safe": false }]
+        }
+      },
+      "files": [],
+      "expectedPath": "/files/0",
+      "expectedCode": "INTEGRATION_SCHEMA_INVALID"
+    }
+  ]
+}

package/contracts/integrations/conformance-valid.json

@@ -0,0 +1,121 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "cases": [
+    {
+      "name": "manifest with no authentication",
+      "target": "manifest",
+      "document": {
+        "name": "echo",
+        "version": "0.1.0",
+        "namespace": "echo",
+        "description": "Echo text.",
+        "auth": { "kind": "none" },
+        "files": ["index.ts"],
+        "tools": [
+          {
+            "name": "say",
+            "description": "Echo text.",
+            "parameters": {
+              "$schema": "https://json-schema.org/draft/2020-12/schema",
+              "type": "object",
+              "properties": {
+                "message": {
+                  "$id": "https://kaji.dev/schemas/echo-message-v1.json",
+                  "type": "string",
+                  "pattern": "^[a-z]+$"
+                }
+              },
+              "required": ["message"],
+              "additionalProperties": false
+            },
+            "risk": "read",
+            "parallel_safe": false
+          }
+        ]
+      }
+    },
+    {
+      "name": "manifest with optional environment authentication",
+      "target": "manifest",
+      "document": {
+        "name": "search",
+        "version": "0.1.0",
+        "namespace": "search",
+        "description": "Search text.",
+        "auth": {
+          "kind": "env",
+          "env": "SEARCH_API_KEY",
+          "optional": true,
+          "docs": "https://example.com/auth"
+        },
+        "files": ["index.ts"],
+        "tools": [
+          {
+            "name": "search",
+            "description": "Search text.",
+            "parameters": {
+              "type": "object",
+              "properties": {
+                "query": {
+                  "type": "string",
+                  "pattern": "^(red|blue)-[0-9]{1,3}$"
+                }
+              }
+            },
+            "risk": "read",
+            "parallel_safe": true,
+            "timeout_ms": 1000
+          }
+        ]
+      }
+    },
+    {
+      "name": "manifest with OAuth authentication",
+      "target": "manifest",
+      "document": {
+        "name": "mail",
+        "version": "0.1.0",
+        "namespace": "mail",
+        "description": "Read mail.",
+        "auth": {
+          "kind": "oauth",
+          "provider": "google",
+          "clientIdEnv": "GOOGLE_CLIENT_ID",
+          "clientSecretEnv": "GOOGLE_CLIENT_SECRET",
+          "scopes": ["https://www.googleapis.com/auth/gmail.readonly"],
+          "docs": "https://example.com/oauth"
+        },
+        "files": ["mail/index.ts"],
+        "tools": [
+          {
+            "name": "read",
+            "description": "Read mail.",
+            "parameters": { "type": "object" },
+            "risk": "read",
+            "parallel_safe": false
+          }
+        ]
+      }
+    },
+    {
+      "name": "registry index with beta and experimental entries",
+      "target": "index",
+      "document": {
+        "$schema": "./index.schema.json",
+        "version": "0.1.0",
+        "integrations": {
+          "echo": {
+            "manifest": "echo/manifest.json",
+            "stability": "beta",
+            "runtimes": ["python", "typescript"]
+          },
+          "http": {
+            "manifest": "http/manifest.json",
+            "stability": "experimental",
+            "runtimes": ["typescript"]
+          }
+        }
+      }
+    }
+  ]
+}

package/contracts/integrations/copy-provenance-v1.schema.json

@@ -0,0 +1,61 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://kaji.dev/schemas/integration-copy-provenance-v1.json",
+  "title": "Kaji copied integration bundle provenance",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "integration",
+    "sdkVersion",
+    "runtime",
+    "stability",
+    "registryEntrySha256",
+    "abiSha256",
+    "manifestSha256",
+    "license",
+    "files"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "1.0.0" },
+    "integration": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9_-]*$"
+    },
+    "sdkVersion": { "type": "string", "minLength": 1, "maxLength": 128 },
+    "runtime": { "enum": ["python", "typescript"] },
+    "stability": { "enum": ["experimental", "beta"] },
+    "registryEntrySha256": { "$ref": "#/$defs/sha256" },
+    "abiSha256": { "$ref": "#/$defs/sha256" },
+    "manifestSha256": { "$ref": "#/$defs/sha256" },
+    "license": {
+      "type": "object",
+      "required": ["identifier", "url", "sha256"],
+      "additionalProperties": false,
+      "properties": {
+        "identifier": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "url": { "type": "string", "format": "uri" },
+        "sha256": { "$ref": "#/$defs/sha256" }
+      }
+    },
+    "files": {
+      "type": "object",
+      "minProperties": 1,
+      "propertyNames": {
+        "allOf": [
+          {
+            "pattern": "^(?!/)(?![A-Za-z]:)(?!.*\\\\)(?!.*(?:^|/)\\.\\.?(?:/|$))[A-Za-z0-9_@.+-]+(?:/[A-Za-z0-9_@.+-]+)*$"
+          },
+          { "not": { "const": ".kaji-integration-provenance.json" } }
+        ]
+      },
+      "additionalProperties": { "$ref": "#/$defs/sha256" }
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    }
+  }
+}