@lesliechan721/aw-plugin-core 0.1.0-beta.5 → 0.1.0-beta.51

package/dist/manifest-contract.js

@@ -1,14 +1,16 @@
 import path from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import fs from 'fs-extra';
+import { computeAwCapabilitySetDigest, normalizeAwCapabilities, } from './aw-capabilities.js';
 import { normalizePluginManifestSchemaVersion, PLUGIN_MANIFEST_SCHEMA_VERSION, SOURCE_PLUGIN_MANIFEST_CONTRACT_VERSION, } from './manifest.js';
+import { getPluginConfigDependencyKeys, normalizePluginConfigDefinition } from './plugin-config.js';
 import { readJsonFile } from './read-json.js';
 import { parsePermissionCommand } from './permission-command.js';
 import { applyFileRules } from './file-rules.js';
 import { resolvePlatformEntries } from './platform-entries.js';
 import { validatePortableSkillDirectoriesRoot, validatePortableSkillName, } from './portable-skill-validation.js';
 import { assertHookMatcherAllowed, assertNativeHookEvent, assertPublicHookEvent, normalizeRenderedHookGroupIdentity, renderHookDefinitionGroup, resolvePlatformHookDefinitions, } from './hooks-contract.js';
-import { inferLifecycleScriptRunnerFromPath, isPluginLifecycleOsSelector, isPluginScriptRunner, PLUGIN_AUTO_RUNNER_EXTENSIONS, PLUGIN_LIFECYCLE_EVENTS, PLUGIN_SCRIPT_TIMEOUT_DEFAULT_MS, PLUGIN_SCRIPT_TIMEOUT_MAX_MS, PLUGIN_SCRIPT_TIMEOUT_MIN_MS, resolveLifecycleScriptForOs, } from './plugin-script-contract.js';
+import { PLUGIN_SCRIPT_TIMEOUT_MAX_MS, PLUGIN_SCRIPT_TIMEOUT_MIN_MS, } from './plugin-script-contract.js';
 import { DEFAULT_SLASH_COMMANDS_PATH, resolveSlashCommands, } from './slash-commands.js';
 import { isSkillAuthorOnlyPath } from './skill-authoring.js';
 import { assertPluginInputTree, validateRuntimeExportSource } from './runtime-export-source.js';
@@ -29,7 +31,6 @@ const PLATFORM_PRODUCT_BY_NAME = {
 };
 const PLUGIN_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
-export const DEFAULT_SOURCE_PLUGIN_AW_MIN_VERSION = '0.0.0';
 const STRICT_SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|(?:[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))(?:\.(?:0|[1-9]\d*|(?:[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
 export const STRICT_SEMVER_VALIDATION_CODE = 'invalidStrictSemVer';
 export class StrictSemVerValidationError extends Error {
@@ -265,30 +266,26 @@ function assertCatalogChannel(value, fieldName) {
     }
     return channel;
 }
-function createPluginCompatibility(minVersion) {
-    return {
-        aw: {
-            minVersion,
-        },
-    };
-}
-function normalizePluginCompatibility(value, fieldName, options) {
+function normalizePluginRequirements(value, fieldName, options) {
     if (value === undefined) {
-        if (options.allowMissing) {
-            return createPluginCompatibility(assertStrictSemVer(options.defaultMinVersion ?? DEFAULT_SOURCE_PLUGIN_AW_MIN_VERSION, `${fieldName}.aw.minVersion`));
-        }
-        throw new Error(`Invalid ${fieldName}.aw.minVersion: expected a strict SemVer 2.0.0 string. Received undefined.`);
+        if (options.allowMissing)
+            return undefined;
+        throw new Error(`Invalid ${fieldName}: expected an object.`);
     }
     const input = assertObject(value, fieldName);
     assertAllowedKeys(input, fieldName, ['aw']);
     const aw = assertObject(input.aw, `${fieldName}.aw`);
-    assertAllowedKeys(aw, `${fieldName}.aw`, ['minVersion']);
-    return createPluginCompatibility(assertStrictSemVer(aw.minVersion, `${fieldName}.aw.minVersion`));
-}
-function assertPluginMinVersionWithinCatalogBounds(options) {
-    if (compareStrictSemVer(options.pluginMinVersion, options.catalogMinVersion) > 0) {
-        throw new Error(`Invalid ${options.fieldName}: plugin "${options.pluginName}" requires aw ${options.pluginMinVersion}, which is higher than catalog minimum ${options.catalogMinVersion}.`);
+    assertAllowedKeys(aw, `${fieldName}.aw`, ['capabilities']);
+    if (aw.capabilities !== undefined && !Array.isArray(aw.capabilities)) {
+        throw new Error(`Invalid ${fieldName}.aw.capabilities: expected an array.`);
     }
+    return {
+        aw: {
+            ...(aw.capabilities === undefined
+                ? {}
+                : { capabilities: normalizeAwCapabilities(aw.capabilities, `${fieldName}.aw.capabilities`) }),
+        },
+    };
 }
 function normalizeMarketplaceProducts(value, fieldName) {
     if (value === undefined) {
@@ -619,15 +616,20 @@ function normalizeRuntimeExports(pluginRoot, value, fieldName) {
     return value.map((entry, index) => {
         const entryField = `${fieldName}[${index}]`;
         const input = assertObject(entry, entryField);
-        assertAllowedKeys(input, entryField, ['name', 'source']);
+        assertAllowedKeys(input, entryField, ['name', 'source', 'requires']);
         const name = normalizeRuntimeExportName(input.name, `${entryField}.name`);
         if (names.has(name)) {
             throw new Error(`Invalid ${fieldName}: duplicate export name "${name}".`);
         }
         names.add(name);
+        const requires = normalizePluginRequirements(input.requires, `${entryField}.requires`, { allowMissing: false });
+        if (requires.aw.capabilities === undefined) {
+            throw new Error(`Invalid ${entryField}.requires.aw.capabilities: expected an array.`);
+        }
         return {
             name,
             source: normalizeCanonicalPluginFilePath(pluginRoot, input.source, `${entryField}.source`),
+            requires: { aw: { capabilities: requires.aw.capabilities } },
         };
     });
 }
@@ -838,12 +840,6 @@ function ensureBoolean(value, fieldName) {
     }
     return value;
 }
-function ensureFiniteNumber(value, fieldName) {
-    if (typeof value !== 'number' || !Number.isFinite(value)) {
-        throw new Error(`Invalid ${fieldName}: expected a number.`);
-    }
-    return value;
-}
 function normalizeScriptTimeout(value, fieldName) {
     if (typeof value !== 'number' ||
         !Number.isInteger(value) ||
@@ -859,11 +855,6 @@ function assertNodeRunnablePath(value, fieldName) {
         throw new Error(`Invalid ${fieldName}: expected a Node runnable file extension (.js, .mjs, or .cjs).`);
     }
 }
-function assertAutoRunnablePath(value, fieldName) {
-    if (!inferLifecycleScriptRunnerFromPath(value)) {
-        throw new Error(`Invalid ${fieldName}: runner "auto" requires one of these file extensions: ${PLUGIN_AUTO_RUNNER_EXTENSIONS.join(', ')}.`);
-    }
-}
 function assertNotInlineCommandLike(value, fieldName) {
     if (/\s|[;&|<>`]/.test(value) || value.includes('$(')) {
         throw new Error(`Invalid ${fieldName}: inline command strings are not allowed.`);
@@ -874,7 +865,7 @@ function normalizePluginScriptPath(pluginRoot, value, fieldName) {
     assertNotInlineCommandLike(rawPath, fieldName);
     return normalizePluginRelativePath(pluginRoot, rawPath, fieldName);
 }
-function normalizeScriptEntry(pluginRoot, value, fieldName, options = {}) {
+function normalizeScriptEntry(pluginRoot, value, fieldName) {
     const input = assertObject(value, fieldName);
     if ('command' in input) {
         throw new Error(`Invalid ${fieldName}: inline command strings are not allowed.`);
@@ -884,69 +875,29 @@ function normalizeScriptEntry(pluginRoot, value, fieldName, options = {}) {
     }
     assertAllowedKeys(input, fieldName, ['runner', 'path', 'args']);
     const runner = ensureString(input.runner, `${fieldName}.runner`);
-    if (!isPluginScriptRunner(runner)) {
-        throw new Error(`Invalid ${fieldName}.runner: unsupported runner "${runner}".`);
-    }
-    if (options.requireNodeRunner && runner !== 'node') {
+    if (runner !== 'node') {
         throw new Error(`Invalid ${fieldName}.runner: expected "node".`);
     }
     const scriptPath = normalizePluginScriptPath(pluginRoot, input.path, `${fieldName}.path`);
-    if (runner === 'auto') {
-        assertAutoRunnablePath(scriptPath, `${fieldName}.path`);
-    }
     return {
-        runner,
+        runner: 'node',
         path: scriptPath,
         args: input.args === undefined
             ? undefined
             : ensureStringArray(input.args, `${fieldName}.args`),
     };
 }
-function normalizeLifecycleScriptDefinition(pluginRoot, value, fieldName) {
-    if (typeof value === 'string') {
-        const scriptPath = normalizePluginScriptPath(pluginRoot, value, fieldName);
-        assertAutoRunnablePath(scriptPath, fieldName);
-        return {
-            default: {
-                runner: 'auto',
-                path: scriptPath,
-            },
-        };
-    }
-    const input = assertObject(value, fieldName);
-    if ('runner' in input || 'path' in input || 'command' in input) {
-        throw new Error(`Invalid ${fieldName}: lifecycle scripts must be declared under OS selectors.`);
-    }
-    if ('timeoutMs' in input || 'timeout' in input) {
-        throw new Error(`Invalid ${fieldName}: per-event and per-selector timeouts are not supported.`);
-    }
-    for (const key of Object.keys(input)) {
-        if (!isPluginLifecycleOsSelector(key)) {
-            throw new Error(`Invalid ${fieldName}: unknown OS selector "${key}".`);
-        }
-    }
-    const output = {};
-    for (const [selector, entry] of Object.entries(input)) {
-        output[selector] = normalizeScriptEntry(pluginRoot, entry, `${fieldName}.${selector}`);
-    }
-    for (const osName of ['linux', 'darwin', 'win32']) {
-        if (!resolveLifecycleScriptForOs(output, osName)) {
-            throw new Error(`Invalid ${fieldName}: no lifecycle entry resolves on ${osName}.`);
-        }
-    }
-    return output;
-}
-function normalizeLifecycleScripts(pluginRoot, value, fieldName) {
+function normalizePreApplyScript(pluginRoot, value, fieldName) {
     const input = assertObject(value, fieldName);
-    assertAllowedKeys(input, fieldName, [...PLUGIN_LIFECYCLE_EVENTS]);
-    const output = {};
-    for (const event of PLUGIN_LIFECYCLE_EVENTS) {
-        if (input[event] === undefined) {
-            continue;
-        }
-        output[event] = normalizeLifecycleScriptDefinition(pluginRoot, input[event], `${fieldName}.${event}`);
-    }
-    return output;
+    assertAllowedKeys(input, fieldName, ['path', 'timeoutMs']);
+    const scriptPath = normalizePluginScriptPath(pluginRoot, input.path, `${fieldName}.path`);
+    assertNodeRunnablePath(scriptPath, `${fieldName}.path`);
+    return {
+        path: scriptPath,
+        ...(input.timeoutMs === undefined
+            ? {}
+            : { timeoutMs: normalizeScriptTimeout(input.timeoutMs, `${fieldName}.timeoutMs`) }),
+    };
 }
 function normalizeScriptHelpers(pluginRoot, value, fieldName) {
     const input = assertObject(value, fieldName);
@@ -959,9 +910,7 @@ function normalizeScriptHelpers(pluginRoot, value, fieldName) {
     return { config };
 }
 function normalizeNodeBuildScript(pluginRoot, value, fieldName) {
-    const entry = normalizeScriptEntry(pluginRoot, value, fieldName, {
-        requireNodeRunner: true,
-    });
+    const entry = normalizeScriptEntry(pluginRoot, value, fieldName);
     assertNodeRunnablePath(entry.path, `${fieldName}.path`);
     return {
         runner: 'node',
@@ -1060,9 +1009,7 @@ function normalizeScriptTests(value, fieldName) {
     };
 }
 function normalizeArtifactRenderScript(pluginRoot, value, fieldName) {
-    const entry = normalizeScriptEntry(pluginRoot, value, fieldName, {
-        requireNodeRunner: true,
-    });
+    const entry = normalizeScriptEntry(pluginRoot, value, fieldName);
     assertNodeRunnablePath(entry.path, `${fieldName}.path`);
     return {
         runner: 'node',
@@ -1081,14 +1028,10 @@ function normalizeArtifactScripts(pluginRoot, value, fieldName) {
 }
 function normalizePluginScripts(pluginRoot, value, fieldName) {
     const input = assertObject(value, fieldName);
-    assertAllowedKeys(input, fieldName, ['timeoutMs', 'lifecycle', 'helpers', 'node', 'artifacts', 'tests']);
-    const output = {
-        timeoutMs: input.timeoutMs === undefined
-            ? PLUGIN_SCRIPT_TIMEOUT_DEFAULT_MS
-            : normalizeScriptTimeout(input.timeoutMs, `${fieldName}.timeoutMs`),
-    };
-    if (input.lifecycle !== undefined) {
-        output.lifecycle = normalizeLifecycleScripts(pluginRoot, input.lifecycle, `${fieldName}.lifecycle`);
+    assertAllowedKeys(input, fieldName, ['preApply', 'helpers', 'node', 'artifacts', 'tests']);
+    const output = {};
+    if (input.preApply !== undefined) {
+        output.preApply = normalizePreApplyScript(pluginRoot, input.preApply, `${fieldName}.preApply`);
     }
     if (input.helpers !== undefined) {
         output.helpers = normalizeScriptHelpers(pluginRoot, input.helpers, `${fieldName}.helpers`);
@@ -1104,254 +1047,6 @@ function normalizePluginScripts(pluginRoot, value, fieldName) {
     }
     return output;
 }
-function validateConfigKey(key, fieldName) {
-    if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(key)) {
-        throw new Error(`Invalid ${fieldName}: config key "${key}" is not valid.`);
-    }
-}
-function validateConfigDefault(type, value, values, min, max, fieldName) {
-    if (type === 'string' || type === 'file' || type === 'directory') {
-        return ensureString(value, fieldName);
-    }
-    if (type === 'boolean') {
-        return ensureBoolean(value, fieldName);
-    }
-    if (type === 'number') {
-        const numberValue = ensureFiniteNumber(value, fieldName);
-        if (min !== undefined && numberValue < min) {
-            throw new Error(`Invalid ${fieldName}: default is smaller than min.`);
-        }
-        if (max !== undefined && numberValue > max) {
-            throw new Error(`Invalid ${fieldName}: default is greater than max.`);
-        }
-        return numberValue;
-    }
-    if (type === 'enum') {
-        const enumValue = ensureString(value, fieldName);
-        if (!values?.includes(enumValue)) {
-            throw new Error(`Invalid ${fieldName}: enum default must be one of values.`);
-        }
-        return enumValue;
-    }
-    throw new Error(`Invalid ${fieldName}: unsupported config type "${type}".`);
-}
-function normalizePluginConfigPresentation(value, schema, fieldName) {
-    const input = assertObject(value, fieldName);
-    assertAllowedKeys(input, fieldName, ['groups', 'fields', 'presets']);
-    const schemaKeys = new Set(Object.keys(schema));
-    const presentation = {};
-    if (input.groups !== undefined) {
-        if (!Array.isArray(input.groups)) {
-            throw new Error(`Invalid ${fieldName}.groups: expected an array.`);
-        }
-        const groupIds = new Set();
-        const groupedFields = new Set();
-        presentation.groups = input.groups.map((rawGroup, index) => {
-            const groupFieldName = `${fieldName}.groups[${index}]`;
-            const group = assertObject(rawGroup, groupFieldName);
-            assertAllowedKeys(group, groupFieldName, [
-                'id',
-                'title',
-                'description',
-                'fields',
-                'advanced',
-            ]);
-            const id = ensureString(group.id, `${groupFieldName}.id`);
-            if (groupIds.has(id)) {
-                throw new Error(`Invalid ${groupFieldName}.id: duplicate group id "${id}".`);
-            }
-            groupIds.add(id);
-            const fields = ensureStringArray(group.fields, `${groupFieldName}.fields`);
-            for (const [fieldIndex, key] of fields.entries()) {
-                if (!schemaKeys.has(key)) {
-                    throw new Error(`Invalid ${groupFieldName}.fields[${fieldIndex}]: unknown config key "${key}".`);
-                }
-                if (groupedFields.has(key)) {
-                    throw new Error(`Invalid ${groupFieldName}.fields[${fieldIndex}]: config key "${key}" is assigned to more than one group.`);
-                }
-                groupedFields.add(key);
-            }
-            return {
-                id,
-                title: ensureString(group.title, `${groupFieldName}.title`),
-                description: group.description === undefined
-                    ? undefined
-                    : ensureString(group.description, `${groupFieldName}.description`),
-                fields,
-                advanced: group.advanced === undefined
-                    ? undefined
-                    : ensureBoolean(group.advanced, `${groupFieldName}.advanced`),
-            };
-        });
-    }
-    if (input.fields !== undefined) {
-        const fieldsInput = assertObject(input.fields, `${fieldName}.fields`);
-        presentation.fields = {};
-        for (const [key, rawPresentationField] of Object.entries(fieldsInput)) {
-            if (!schemaKeys.has(key)) {
-                throw new Error(`Invalid ${fieldName}.fields: unknown config key "${key}".`);
-            }
-            const presentationFieldName = `${fieldName}.fields.${key}`;
-            const presentationField = assertObject(rawPresentationField, presentationFieldName);
-            assertAllowedKeys(presentationField, presentationFieldName, [
-                'valueLabels',
-                'recommendedValue',
-                'placeholder',
-                'unit',
-                'advanced',
-            ]);
-            const schemaField = schema[key];
-            let valueLabels;
-            if (presentationField.valueLabels !== undefined) {
-                if (schemaField.type !== 'enum') {
-                    throw new Error(`Invalid ${presentationFieldName}.valueLabels: valueLabels are only supported for enum config.`);
-                }
-                const labelsInput = assertObject(presentationField.valueLabels, `${presentationFieldName}.valueLabels`);
-                valueLabels = {};
-                for (const [token, rawLabel] of Object.entries(labelsInput)) {
-                    if (!schemaField.values?.includes(token)) {
-                        throw new Error(`Invalid ${presentationFieldName}.valueLabels: unknown enum token "${token}".`);
-                    }
-                    valueLabels[token] = ensureString(rawLabel, `${presentationFieldName}.valueLabels.${token}`);
-                }
-            }
-            presentation.fields[key] = {
-                valueLabels,
-                recommendedValue: presentationField.recommendedValue === undefined
-                    ? undefined
-                    : validateConfigDefault(schemaField.type, presentationField.recommendedValue, schemaField.values, schemaField.min, schemaField.max, `${presentationFieldName}.recommendedValue`),
-                placeholder: presentationField.placeholder === undefined
-                    ? undefined
-                    : ensureString(presentationField.placeholder, `${presentationFieldName}.placeholder`),
-                unit: presentationField.unit === undefined
-                    ? undefined
-                    : ensureString(presentationField.unit, `${presentationFieldName}.unit`),
-                advanced: presentationField.advanced === undefined
-                    ? undefined
-                    : ensureBoolean(presentationField.advanced, `${presentationFieldName}.advanced`),
-            };
-        }
-    }
-    if (input.presets !== undefined) {
-        if (!Array.isArray(input.presets)) {
-            throw new Error(`Invalid ${fieldName}.presets: expected an array.`);
-        }
-        const presetIds = new Set();
-        presentation.presets = input.presets.map((rawPreset, index) => {
-            const presetFieldName = `${fieldName}.presets[${index}]`;
-            const preset = assertObject(rawPreset, presetFieldName);
-            assertAllowedKeys(preset, presetFieldName, ['id', 'title', 'description', 'values']);
-            const id = ensureString(preset.id, `${presetFieldName}.id`);
-            if (presetIds.has(id)) {
-                throw new Error(`Invalid ${presetFieldName}.id: duplicate preset id "${id}".`);
-            }
-            presetIds.add(id);
-            const valuesInput = assertObject(preset.values, `${presetFieldName}.values`);
-            const values = {};
-            for (const [key, rawValue] of Object.entries(valuesInput)) {
-                const schemaField = schema[key];
-                if (!schemaField) {
-                    throw new Error(`Invalid ${presetFieldName}.values: unknown config key "${key}".`);
-                }
-                if (schemaField.sensitive === true
-                    || schemaField.type === 'file'
-                    || schemaField.type === 'directory') {
-                    throw new Error(`Invalid ${presetFieldName}.values.${key}: presets cannot contain sensitive, file, or directory config values.`);
-                }
-                values[key] = validateConfigDefault(schemaField.type, rawValue, schemaField.values, schemaField.min, schemaField.max, `${presetFieldName}.values.${key}`);
-            }
-            return {
-                id,
-                title: ensureString(preset.title, `${presetFieldName}.title`),
-                description: preset.description === undefined
-                    ? undefined
-                    : ensureString(preset.description, `${presetFieldName}.description`),
-                values,
-            };
-        });
-    }
-    return presentation;
-}
-function normalizePluginConfigSchema(value, fieldName) {
-    const input = assertObject(value, fieldName);
-    assertAllowedKeys(input, fieldName, ['schema', 'presentation']);
-    const schemaInput = assertObject(input.schema, `${fieldName}.schema`);
-    const schema = {};
-    const supportedTypes = new Set(['string', 'number', 'boolean', 'enum', 'file', 'directory']);
-    for (const [key, rawField] of Object.entries(schemaInput)) {
-        validateConfigKey(key, `${fieldName}.schema`);
-        const schemaFieldName = `${fieldName}.schema.${key}`;
-        const configField = assertObject(rawField, schemaFieldName);
-        assertAllowedKeys(configField, schemaFieldName, [
-            'type',
-            'title',
-            'description',
-            'default',
-            'required',
-            'sensitive',
-            'values',
-            'min',
-            'max',
-        ]);
-        const type = ensureString(configField.type, `${schemaFieldName}.type`);
-        if (!supportedTypes.has(type)) {
-            throw new Error(`Invalid ${schemaFieldName}.type: expected string, number, boolean, enum, file, or directory.`);
-        }
-        const required = configField.required === undefined
-            ? undefined
-            : ensureBoolean(configField.required, `${schemaFieldName}.required`);
-        const sensitive = configField.sensitive === undefined
-            ? undefined
-            : ensureBoolean(configField.sensitive, `${schemaFieldName}.sensitive`);
-        const values = configField.values === undefined
-            ? undefined
-            : ensureStringArray(configField.values, `${schemaFieldName}.values`);
-        if (type !== 'enum' && values !== undefined) {
-            throw new Error(`Invalid ${schemaFieldName}.values: values are only supported for enum config.`);
-        }
-        if (type === 'enum' && (!values || values.length === 0)) {
-            throw new Error(`Invalid ${schemaFieldName}.values: enum config requires at least one value.`);
-        }
-        if (values && new Set(values).size !== values.length) {
-            throw new Error(`Invalid ${schemaFieldName}.values: enum values must be unique.`);
-        }
-        const min = configField.min === undefined
-            ? undefined
-            : ensureFiniteNumber(configField.min, `${schemaFieldName}.min`);
-        const max = configField.max === undefined
-            ? undefined
-            : ensureFiniteNumber(configField.max, `${schemaFieldName}.max`);
-        if (type !== 'number' && (min !== undefined || max !== undefined)) {
-            throw new Error(`Invalid ${schemaFieldName}: min/max are only supported for number config.`);
-        }
-        if (min !== undefined && max !== undefined && min > max) {
-            throw new Error(`Invalid ${schemaFieldName}: min must be less than or equal to max.`);
-        }
-        schema[key] = {
-            type: type,
-            title: configField.title === undefined
-                ? undefined
-                : ensureString(configField.title, `${schemaFieldName}.title`),
-            description: configField.description === undefined
-                ? undefined
-                : ensureString(configField.description, `${schemaFieldName}.description`),
-            default: configField.default === undefined
-                ? undefined
-                : validateConfigDefault(type, configField.default, values, min, max, `${schemaFieldName}.default`),
-            required,
-            sensitive,
-            values,
-            min,
-            max,
-        };
-    }
-    return {
-        schema,
-        presentation: input.presentation === undefined
-            ? undefined
-            : normalizePluginConfigPresentation(input.presentation, schema, `${fieldName}.presentation`),
-    };
-}
 const ARTIFACT_TARGETS = new Set([
     'codex.developerInstructionsBlock',
     'codex.agentRole',
@@ -1394,13 +1089,24 @@ function normalizeArtifactRuntimeImports(value, fieldName, reservedImports) {
             const resolvedInput = assertObject(input.resolved, `${entryField}.resolved`);
             assertAllowedKeys(resolvedInput, `${entryField}.resolved`, [
                 'path', 'digest', 'providerPluginId', 'providerVersion', 'source',
+                'requiredCapabilities', 'capabilitySetDigest',
             ]);
+            if (!Array.isArray(resolvedInput.requiredCapabilities)) {
+                throw new Error(`Invalid ${entryField}.resolved.requiredCapabilities: expected an array.`);
+            }
+            const requiredCapabilities = normalizeAwCapabilities(resolvedInput.requiredCapabilities, `${entryField}.resolved.requiredCapabilities`);
+            const capabilitySetDigest = ensureDigestString(resolvedInput.capabilitySetDigest, `${entryField}.resolved.capabilitySetDigest`);
+            if (capabilitySetDigest !== computeAwCapabilitySetDigest(requiredCapabilities)) {
+                throw new Error(`Invalid ${entryField}.resolved.capabilitySetDigest: digest does not match requiredCapabilities.`);
+            }
             resolved = {
                 path: normalizePluginChildPath('', ensureString(resolvedInput.path, `${entryField}.resolved.path`), `${entryField}.resolved.path`),
                 digest: ensureDigestString(resolvedInput.digest, `${entryField}.resolved.digest`),
                 providerPluginId: ensureString(resolvedInput.providerPluginId, `${entryField}.resolved.providerPluginId`),
                 providerVersion: assertStrictSemVer(resolvedInput.providerVersion, `${entryField}.resolved.providerVersion`),
                 source: ensureString(resolvedInput.source, `${entryField}.resolved.source`),
+                requiredCapabilities,
+                capabilitySetDigest,
             };
         }
         return {
@@ -1458,7 +1164,7 @@ function normalizeArtifactStates(value, fieldName) {
 }
 function normalizeArtifactRefreshKeys(value, fieldName, schema) {
     const refreshKeys = ensureStringArray(value, fieldName);
-    const schemaKeys = new Set(Object.keys(schema?.schema ?? {}));
+    const schemaKeys = new Set(Object.keys(schema?.fields ?? {}));
     const normalized = [];
     for (const [index, key] of refreshKeys.entries()) {
         if (!schemaKeys.has(key)) {
@@ -1470,6 +1176,51 @@ function normalizeArtifactRefreshKeys(value, fieldName, schema) {
     }
     return normalized;
 }
+function configFieldContainsSensitiveValue(field) {
+    if (field.sensitive === true)
+        return true;
+    if (field.type !== 'object')
+        return false;
+    return ((field.properties
+        ? Object.values(field.properties).some((child) => child.sensitive === true)
+        : false)
+        || (field.additionalProperties !== false && field.additionalProperties?.sensitive === true));
+}
+function assertSkillRefreshKeysAreNotSensitive(options) {
+    const skillTarget = options.target === 'codex.skill'
+        || options.target === 'claude.skill'
+        || options.target === 'agent-skills.skill';
+    if (!skillTarget)
+        return;
+    for (const [index, key] of options.refreshKeys.entries()) {
+        const field = options.schema?.fields[key];
+        if (field && configFieldContainsSensitiveValue(field)) {
+            const native = options.delivery?.mode === 'codex-native';
+            throw new Error(`${native ? 'codexNativeRenderSensitiveRefreshKey' : 'skillRenderSensitiveRefreshKey'}: ` +
+                `Invalid ${options.fieldName}[${index}]: ` +
+                `${native ? 'codex-native renderers' : 'Skill renderers'} cannot read sensitive config field "${key}".`);
+        }
+    }
+}
+function normalizeCodexSkillDelivery(value, fieldName) {
+    const input = assertObject(value, fieldName);
+    const mode = ensureString(input.mode, `${fieldName}.mode`);
+    if (mode === 'aw-extension') {
+        assertAllowedKeys(input, fieldName, ['mode']);
+        return { mode };
+    }
+    if (mode === 'codex-native') {
+        assertAllowedKeys(input, fieldName, ['mode', 'identity', 'renderProfile']);
+        if (input.identity !== 'shared') {
+            throw new Error(`Invalid ${fieldName}.identity: expected "shared".`);
+        }
+        if (input.renderProfile !== 'user') {
+            throw new Error(`Invalid ${fieldName}.renderProfile: expected "user".`);
+        }
+        return { mode, identity: 'shared', renderProfile: 'user' };
+    }
+    throw new Error(`Invalid ${fieldName}.mode: expected "codex-native" or "aw-extension".`);
+}
 function normalizeDynamicArtifactKind(value, fieldName) {
     const kind = ensureString(value, fieldName);
     if (!DYNAMIC_ARTIFACT_KINDS.has(kind)) {
@@ -1510,16 +1261,24 @@ function normalizeArtifactTargetEntry(pluginRoot, entry, fieldName, schema, rese
         'projectManagedKind',
         'states',
         'refreshKeys',
+        'delivery',
         'requiresCodexProjectConfig',
         'roleKey',
         'skillKey',
         'sourceDirs',
         'distribution',
         'runtimeImports',
+        'runtimeConfig',
     ]);
     const id = ensureString(input.id, `${fieldName}.id`);
     validateArtifactId(id, `${fieldName}.id`);
     const target = normalizeArtifactTarget(input.target, `${fieldName}.target`);
+    const delivery = target === 'codex.skill'
+        ? normalizeCodexSkillDelivery(input.delivery, `${fieldName}.delivery`)
+        : undefined;
+    if (target !== 'codex.skill' && input.delivery !== undefined) {
+        throw new Error(`Invalid ${fieldName}.delivery: delivery is only supported for codex.skill targets.`);
+    }
     const portable = target === 'agent-skills.skill';
     const platform = portable ? undefined : normalizePlatformName(input.platform, `${fieldName}.platform`);
     const distribution = portable
@@ -1615,6 +1374,30 @@ function normalizeArtifactTargetEntry(pluginRoot, entry, fieldName, schema, rese
     if (!portable && input.runtimeImports !== undefined) {
         throw new Error(`Invalid ${fieldName}.runtimeImports: runtimeImports are only supported for agent-skills.skill targets.`);
     }
+    const refreshKeys = normalizeArtifactRefreshKeys(input.refreshKeys, `${fieldName}.refreshKeys`, schema);
+    assertSkillRefreshKeysAreNotSensitive({
+        target,
+        delivery,
+        refreshKeys,
+        schema,
+        fieldName: `${fieldName}.refreshKeys`,
+    });
+    let runtimeConfig;
+    if (input.runtimeConfig !== undefined) {
+        if (target !== 'codex.skill' && target !== 'claude.skill') {
+            throw new Error(`Invalid ${fieldName}.runtimeConfig: only native platform Skill targets support installed runtime config.`);
+        }
+        const runtime = assertObject(input.runtimeConfig, `${fieldName}.runtimeConfig`);
+        assertAllowedKeys(runtime, `${fieldName}.runtimeConfig`, ['keys']);
+        const keys = ensureStringArray(runtime.keys, `${fieldName}.runtimeConfig.keys`);
+        if (keys.length === 0 || new Set(keys).size !== keys.length || keys.some((key) => !refreshKeys.includes(key))) {
+            throw new Error(`Invalid ${fieldName}.runtimeConfig.keys: expected unique non-empty keys from refreshKeys.`);
+        }
+        if (!schema || getPluginConfigDependencyKeys(schema, keys).some((key) => !schema.fields[key] || configFieldContainsSensitiveValue(schema.fields[key]))) {
+            throw new Error(`runtimeConfigKeyDenied: Invalid ${fieldName}.runtimeConfig.keys: dependency fields must be declared and non-sensitive.`);
+        }
+        runtimeConfig = { keys: [keys[0], ...keys.slice(1)] };
+    }
     return {
         id,
         platform,
@@ -1624,12 +1407,14 @@ function normalizeArtifactTargetEntry(pluginRoot, entry, fieldName, schema, rese
         kind,
         projectManagedKind,
         states: normalizeArtifactStates(input.states, `${fieldName}.states`),
-        refreshKeys: normalizeArtifactRefreshKeys(input.refreshKeys, `${fieldName}.refreshKeys`, schema),
+        refreshKeys,
+        delivery,
         requiresCodexProjectConfig: input.requiresCodexProjectConfig === undefined
             ? undefined
             : ensureBoolean(input.requiresCodexProjectConfig, `${fieldName}.requiresCodexProjectConfig`),
         roleKey,
         skillKey,
+        runtimeConfig,
         sourceDirs,
         runtimeImports: normalizeArtifactRuntimeImports(input.runtimeImports, `${fieldName}.runtimeImports`, reservedImports),
     };
@@ -1644,15 +1429,19 @@ function normalizeArtifacts(pluginRoot, value, fieldName, schema, reservedImport
             if (!Array.isArray(targetsInput)) {
                 throw new Error(`Invalid ${fieldName}.targets: expected an array.`);
             }
-            const seen = new Set();
+            const seenIdsBySurfaceScope = new Set();
             const seenSkillOwners = new Set();
+            const seenNativeIds = new Set();
+            const seenNativeSkillKeys = new Set();
             return targetsInput.map((entry, index) => {
                 const target = normalizeArtifactTargetEntry(pluginRoot, entry, `${fieldName}.targets[${index}]`, schema, reservedImports);
-                const key = `${target.id}:${target.target}`;
-                if (seen.has(key)) {
-                    throw new Error(`Invalid ${fieldName}.targets[${index}]: duplicate artifact id + target "${key}".`);
+                for (const scope of target.scopes) {
+                    const surfaceScopeId = `${target.platform ?? target.distribution}:${scope}:${target.id}`;
+                    if (seenIdsBySurfaceScope.has(surfaceScopeId)) {
+                        throw new Error(`Invalid ${fieldName}.targets[${index}]: duplicate artifact id "${target.id}" for surface/scope "${target.platform ?? target.distribution}:${scope}".`);
+                    }
+                    seenIdsBySurfaceScope.add(surfaceScopeId);
                 }
-                seen.add(key);
                 if ((target.target === 'codex.skill' || target.target === 'claude.skill' || target.target === 'agent-skills.skill') && target.skillKey) {
                     for (const scope of target.scopes) {
                         const ownerKey = `${target.platform ?? target.distribution}:${scope}:${target.skillKey}`;
@@ -1662,11 +1451,60 @@ function normalizeArtifacts(pluginRoot, value, fieldName, schema, reservedImport
                         seenSkillOwners.add(ownerKey);
                     }
                 }
+                if (target.delivery?.mode === 'codex-native') {
+                    if (seenNativeIds.has(target.id)) {
+                        throw new Error(`Invalid ${fieldName}.targets[${index}]: duplicate codex-native artifact id "${target.id}" in the shared projection.`);
+                    }
+                    if (target.skillKey && seenNativeSkillKeys.has(target.skillKey)) {
+                        throw new Error(`Invalid ${fieldName}.targets[${index}]: duplicate codex-native skillKey "${target.skillKey}" in the shared projection.`);
+                    }
+                    seenNativeIds.add(target.id);
+                    if (target.skillKey)
+                        seenNativeSkillKeys.add(target.skillKey);
+                }
                 return target;
             });
         })();
     return { targets };
 }
+function canonicalScopeSet(scopes) {
+    return [...scopes].sort().join(',');
+}
+function assertCodexSharedNativeScopeConsistency(manifest) {
+    if (!supportsPlatform(manifest, 'codex'))
+        return;
+    const nativeComponents = [];
+    if (manifest.skills) {
+        nativeComponents.push({ key: 'skills', scopes: ['project', 'user'] });
+    }
+    if (manifest.mcpServers) {
+        nativeComponents.push({ key: 'mcpServers', scopes: ['project', 'user'] });
+    }
+    if (resolvePlatformHookDefinitions(manifest, 'codex').length > 0) {
+        nativeComponents.push({ key: 'hooks', scopes: ['project', 'user'] });
+    }
+    if (manifest.apps) {
+        nativeComponents.push({ key: 'apps', scopes: ['project', 'user'] });
+    }
+    for (const [index, target] of (manifest.artifacts?.targets ?? []).entries()) {
+        if (target.delivery?.mode === 'codex-native') {
+            nativeComponents.push({
+                key: `artifacts.targets[${index}]`,
+                scopes: [...target.scopes],
+            });
+        }
+    }
+    const expected = nativeComponents[0];
+    if (!expected)
+        return;
+    const expectedScopes = canonicalScopeSet(expected.scopes);
+    const mismatch = nativeComponents.find((component) => canonicalScopeSet(component.scopes) !== expectedScopes);
+    if (mismatch) {
+        throw new Error(`codexSharedNativeScopeMismatch: Codex native component scope sets must match exactly; ` +
+            `${expected.key} has {${expectedScopes}} but ${mismatch.key} has ` +
+            `{${canonicalScopeSet(mismatch.scopes)}}.`);
+    }
+}
 function normalizePlatformAgentOverrides(value, fieldName, normalizer) {
     const input = assertObject(value, fieldName);
     assertAllowedKeys(input, fieldName, ['claude', 'codex']);
@@ -2006,7 +1844,7 @@ export async function assertActualNativePluginCapability(pluginRoot, manifest, m
         }
     }
     if (!skills && !slashCommands && !mcpServers && !apps && !bundled) {
-        throw new Error('Invalid plugin manifest: portable-only plugins are not supported in V1. Declare at least one non-empty native capability.');
+        throw new Error('Invalid plugin manifest: portable-only plugins are not supported. Declare at least one non-empty native capability.');
     }
 }
 export function validatePluginManifest(pluginRoot, rawManifest, options = {}) {
@@ -2020,7 +1858,7 @@ export function validatePluginManifest(pluginRoot, rawManifest, options = {}) {
         'version',
         'description',
         'dependencies',
-        'compatibility',
+        'requires',
         'skills',
         'slashCommands',
         'mcpServers',
@@ -2039,12 +1877,11 @@ export function validatePluginManifest(pluginRoot, rawManifest, options = {}) {
         name: ensureString(input.name, 'name'),
         version: assertStrictSemVer(input.version, 'plugin manifest.version'),
         description: ensureString(input.description, 'description'),
-        compatibility: normalizePluginCompatibility(input.compatibility, 'compatibility', {
-            allowMissing: (options.compatibilityMode ?? 'defaulted') === 'defaulted',
-            defaultMinVersion: options.defaultMinVersion,
-        }),
         marketplace: normalizeMarketplaceMeta(input.marketplace, 'marketplace'),
     };
+    const requires = normalizePluginRequirements(input.requires, 'requires', { allowMissing: true });
+    if (requires !== undefined)
+        manifest.requires = requires;
     if (input.dependencies !== undefined) {
         const dependencies = ensureStringArray(input.dependencies, 'dependencies');
         if (dependencies.length > 64) {
@@ -2115,7 +1952,7 @@ export function validatePluginManifest(pluginRoot, rawManifest, options = {}) {
         throw new Error('Invalid buildConfig.cacheable: true requires scripts.node.build.');
     }
     if (input.config !== undefined) {
-        manifest.config = normalizePluginConfigSchema(input.config, 'config');
+        manifest.config = normalizePluginConfigDefinition(input.config, 'config');
     }
     if (input.artifacts !== undefined) {
         manifest.artifacts = normalizeArtifacts(pluginRoot, input.artifacts, 'artifacts', manifest.config, options.reservedImports);
@@ -2125,6 +1962,7 @@ export function validatePluginManifest(pluginRoot, rawManifest, options = {}) {
         throw new Error('Invalid artifacts.targets: agent-skills targets require distributions.agentSkills declaration.');
     }
     assertManifestPlatformSupport(manifest.name, manifest);
+    assertCodexSharedNativeScopeConsistency(manifest);
     return manifest;
 }
 async function validateDeclaredNativeAssets(pluginRoot, manifest) {
@@ -2204,6 +2042,14 @@ async function validateSourceSkillInventory(pluginRoot, manifest) {
         .filter((skillKey) => Boolean(skillKey))
         .sort();
     const dynamicSkillNameSet = new Set(dynamicSkillNames);
+    for (const [index, target] of (manifest.artifacts?.targets ?? []).entries()) {
+        if (target.target === 'codex.skill'
+            && target.delivery?.mode === 'codex-native'
+            && target.skillKey
+            && staticSkillNameSet.has(target.skillKey)) {
+            throw new Error(`Invalid artifacts.targets[${index}].skillKey: native dynamic Skill "${target.skillKey}" conflicts with a static Skill of the same name.`);
+        }
+    }
     const portableSkillsRoot = manifest.distributions?.agentSkills?.skills
         ? path.join(pluginRoot, stripDotSlash(manifest.distributions.agentSkills.skills))
         : null;
@@ -2289,18 +2135,7 @@ async function validateSourceJsonNativeAsset(pluginRoot, manifest, field) {
 }
 export async function validateSourcePluginManifest(pluginRoot, rawManifest, options = {}) {
     await assertPluginInputTree(pluginRoot);
-    const distributionsInput = rawManifest !== null
-        && typeof rawManifest === 'object'
-        && !Array.isArray(rawManifest)
-        ? rawManifest.distributions
-        : undefined;
-    const requiresExplicitMinVersion = distributionsInput !== null
-        && typeof distributionsInput === 'object'
-        && !Array.isArray(distributionsInput)
-        && Object.hasOwn(distributionsInput, 'agentSkills');
     const manifest = validatePluginManifest(pluginRoot, rawManifest, {
-        compatibilityMode: requiresExplicitMinVersion ? 'required' : 'defaulted',
-        defaultMinVersion: DEFAULT_SOURCE_PLUGIN_AW_MIN_VERSION,
         reservedImports: options.reservedImports,
     });
     const parsedVersion = parseStrictSemVer(manifest.version, 'plugin manifest.version');
@@ -2337,10 +2172,7 @@ export async function readPluginManifest(pluginRoot, options = {}) {
         ? await validateSourcePluginManifest(pluginRoot, rawManifest, {
             reservedImports: options.reservedImports,
         })
-        : validatePluginManifest(pluginRoot, rawManifest, {
-            compatibilityMode: 'required',
-            reservedImports: options.reservedImports,
-        });
+        : validatePluginManifest(pluginRoot, rawManifest, { reservedImports: options.reservedImports });
     if (mode === 'bundle')
         await assertActualNativePluginCapability(pluginRoot, manifest, 'bundle');
     return {
@@ -2438,9 +2270,6 @@ function assertCatalogChannelVersionContract(options) {
 }
 function normalizeCatalogManifestEntry(value, fieldName) {
     const input = assertObject(value, fieldName);
-    if (Object.hasOwn(input, 'dependencies')) {
-        throw new Error(`Invalid ${fieldName}: "dependencies" is unsupported.`);
-    }
     assertAllowedKeys(input, fieldName, [
         'name',
         'version',
@@ -2450,7 +2279,8 @@ function normalizeCatalogManifestEntry(value, fieldName) {
         'tags',
         'strict',
         'policy',
-        'compatibility',
+        'dependencies',
+        'requires',
         'source',
         'artifactDigest',
         'manifestDigest',
@@ -2462,7 +2292,11 @@ function normalizeCatalogManifestEntry(value, fieldName) {
         category: ensureString(input.category, `${fieldName}.category`),
         strict: ensureBoolean(input.strict, `${fieldName}.strict`),
         policy: normalizeMarketplacePolicy(input.policy, `${fieldName}.policy`),
-        compatibility: normalizePluginCompatibility(input.compatibility, `${fieldName}.compatibility`, {
+        dependencies: input.dependencies === undefined
+            ? []
+            : normalizeComparableStringArray(ensureStringArray(input.dependencies, `${fieldName}.dependencies`))
+                .map((dependency, index) => ensurePluginName(dependency, `${fieldName}.dependencies[${index}]`)),
+        requires: normalizePluginRequirements(input.requires, `${fieldName}.requires`, {
             allowMissing: false,
         }),
         source: normalizeCatalogRelativePath(input.source, `${fieldName}.source`),
@@ -2486,8 +2320,8 @@ export function normalizeCatalogManifestBase(input, fieldName) {
         fieldName: `${fieldName}.catalogVersion`,
         kind: 'catalog',
     });
-    const compatibility = normalizePluginCompatibility(input.compatibility, `${fieldName}.compatibility`, { allowMissing: false });
-    return { catalogVersion, channel, compatibility };
+    const requires = normalizePluginRequirements(input.requires, `${fieldName}.requires`, { allowMissing: false });
+    return { catalogVersion, channel, requires };
 }
 export function normalizeCatalogManifestEntries(rawEntries, base, fieldName) {
     if (!Array.isArray(rawEntries)) {
@@ -2508,16 +2342,10 @@ export function normalizeCatalogManifestEntries(rawEntries, base, fieldName) {
                 kind: 'plugin',
             });
         }
-        assertPluginMinVersionWithinCatalogBounds({
-            pluginName: entry.name,
-            pluginMinVersion: entry.compatibility.aw.minVersion,
-            catalogMinVersion: base.compatibility.aw.minVersion,
-            fieldName: `${fieldName}.entries.${entry.name}.compatibility.aw.minVersion`,
-        });
     }
     return entries;
 }
-export function createBundleSourceManifest(plugin) {
+export function createBundleSourceManifest(plugin, requiredCapabilities) {
     const scripts = plugin.manifest.scripts
         ? structuredClone(plugin.manifest.scripts)
         : undefined;
@@ -2543,9 +2371,12 @@ export function createBundleSourceManifest(plugin) {
     return {
         ...plugin.manifest,
         buildConfig,
-        compatibility: plugin.manifest.compatibility
-            ? structuredClone(plugin.manifest.compatibility)
-            : createPluginCompatibility(DEFAULT_SOURCE_PLUGIN_AW_MIN_VERSION),
+        distributions: plugin.manifest.distributions
+            ? structuredClone(plugin.manifest.distributions)
+            : undefined,
+        requires: requiredCapabilities === undefined
+            ? structuredClone(plugin.manifest.requires)
+            : { aw: { capabilities: normalizeAwCapabilities(requiredCapabilities) } },
         extensions: plugin.manifest.extensions
             ? {
                 instructions: plugin.manifest.extensions.instructions
@@ -2580,11 +2411,6 @@ export function createPlatformManifestBase(plugin) {
         name: plugin.manifest.name,
         version: plugin.manifest.version,
         description: plugin.manifest.description,
-        compatibility: structuredClone(plugin.manifest.compatibility ?? {
-            aw: {
-                minVersion: '0.0.0',
-            },
-        }),
         interface: plugin.manifest.interface,
     };
 }