@morit/cli 1.1.1 → 1.3.0

package/src/cli.js

@@ -7,6 +7,7 @@ import { clearCredential, loadCredential, saveCredential } from "./secure-store.
 import {
   buildProjectDirectory,
   internal as sdkInternal,
+  previewProjectDirectory,
   readProjectDirectory,
   scaffoldProjectDirectory,
   validateProjectDirectory,
@@ -21,6 +22,7 @@ Usage:
   morit plugin setup [directory] --id <plugin.id> --name <name> --publisher <publisher>
   morit plugin add [directory]
   morit plugin validate [directory]
+  morit plugin preview [directory] [--output <file.html>]
   morit plugin build [directory] [--output <file.mplg>]
   morit plugin sync [directory] [--pull] [--force]
   morit plugin deploy [directory] [--visibility private|public] [--file-name <file.mplg>]
@@ -359,6 +361,13 @@ export async function runCli(argv, options = {}) {
       output(stdout, await validateProjectDirectory(root), json);
       return 0;
     }
+    if (action === "preview") {
+      output(stdout, await previewProjectDirectory(
+        root,
+        parsed.flags.output ? resolve(cwd, parsed.flags.output) : undefined,
+      ), json);
+      return 0;
+    }
     if (action === "build") {
       output(stdout, await buildProjectDirectory(root, {
         output: parsed.flags.output ? resolve(cwd, parsed.flags.output) : undefined,

package/src/preview.js

@@ -0,0 +1,132 @@
+const HEX = /^#(?:[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/;
+
+const COLORS = {
+  light: {
+    primary: "#006B58", on_primary: "#FFFFFF", primary_container: "#7CF8D6",
+    on_primary_container: "#002019", secondary_container: "#CDE9DE",
+    on_secondary_container: "#072019", tertiary_container: "#C2E8FC",
+    on_tertiary_container: "#001F29", error_container: "#FFDAD6",
+    on_error_container: "#410002", surface: "#F5FBF8", on_surface: "#171D1B",
+    surface_variant: "#DBE5E0", on_surface_variant: "#3F4945",
+    outline: "#6F7975", outline_variant: "#BEC9C4",
+  },
+  dark: {
+    primary: "#5CDBBA", on_primary: "#00382D", primary_container: "#005142",
+    on_primary_container: "#7CF8D6", secondary_container: "#344C45",
+    on_secondary_container: "#CDE9DE", tertiary_container: "#264B5B",
+    on_tertiary_container: "#C2E8FC", error_container: "#93000A",
+    on_error_container: "#FFDAD6", surface: "#0F1513", on_surface: "#DFE4E1",
+    surface_variant: "#3F4945", on_surface_variant: "#BEC9C4",
+    outline: "#89938F", outline_variant: "#3F4945",
+  },
+};
+
+function escape(value) {
+  return String(value ?? "")
+    .replaceAll("&", "&")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&#39;");
+}
+
+function cssColor(value) {
+  if (typeof value !== "string" || !HEX.test(value)) return null;
+  return value.length === 9 ? "#" + value.slice(3) + value.slice(1, 3) : value;
+}
+
+function themeVariables(config) {
+  const theme = config?.theme || {};
+  const values = [];
+  for (const mode of ["light", "dark"]) {
+    const variant = { ...theme, ...(theme[mode] || {}) };
+    const colors = { ...COLORS[mode], ...(theme.color_scheme || {}), ...(variant.color_scheme || {}) };
+    for (const [role, fallback] of Object.entries(COLORS[mode])) {
+      values.push("--" + mode + "-" + role.replaceAll("_", "-") + ":" + (cssColor(colors[role]) || fallback));
+    }
+    values.push("--" + mode + "-radius:" + Number(variant.border?.radius ?? variant.radius ?? 18) + "px");
+    values.push("--" + mode + "-space:" + Number(variant.spacing ?? 12) + "px");
+    values.push("--" + mode + "-scale:" + Number(variant.typography?.scale ?? 1));
+  }
+  return values.join(";");
+}
+
+function nodeHtml(node) {
+  if (!node || typeof node !== "object") return "";
+  const type = String(node.type || "surface");
+  const props = node.props && typeof node.props === "object" ? node.props : {};
+  const children = Array.isArray(node.children) ? node.children.map(nodeHtml).join("") : "";
+  const label = escape(props.label || props.title || type);
+  const action = node.action ? ' data-action="' + escape(node.action.type) + '"' : "";
+  if (type === "text") return '<p class="ui-text ' + escape(props.style) + '">' + escape(props.text) + "</p>";
+  if (type === "icon") return '<span class="ui-icon" role="img" aria-label="' + escape(props.semantic_label || props.icon) + '">' + escape(props.icon) + "</span>";
+  if (type === "image") return '<div class="ui-image" role="img" aria-label="' + escape(props.semantic_label || "image") + '">🖼 ' + escape(props.asset || props.url || "image") + "</div>";
+  if (type === "avatar") return '<span class="ui-avatar">' + escape(props.label || "M").slice(0, 1) + "</span>";
+  if (type === "badge") return '<span class="ui-badge">' + label + children + "</span>";
+  if (type === "divider") return "<hr>";
+  if (type === "spacer") return '<span class="ui-spacer" aria-hidden="true"></span>';
+  if (type === "button") return "<button" + action + ">" + (props.icon ? escape(props.icon) + " " : "") + label + "</button>";
+  if (type === "chip") return '<span class="ui-chip"' + action + ">" + label + "</span>";
+  if (type === "metric") return '<div class="ui-metric"><strong>' + escape(props.value) + "</strong><span>" + label + "</span></div>";
+  if (type === "progress") return '<div class="ui-progress"><span>' + label + '</span><progress value="' + Number(props.value ?? .5) + '" max="1"></progress></div>';
+  if (type === "field") return '<label class="ui-field">' + label + '<input disabled placeholder="' + escape(props.hint || props.placeholder) + '"></label>';
+  if (type === "select") return '<label class="ui-field">' + label + '<select disabled><option>' + escape(props.placeholder || "선택") + "</option></select></label>";
+  if (type === "switch") return '<label class="ui-switch"><input type="checkbox" disabled> ' + label + "</label>";
+  if (type === "empty") return '<div class="ui-empty"><strong>' + escape(props.title || "표시할 내용이 없어요.") + "</strong><p>" + escape(props.supporting) + "</p></div>";
+  if (["list", "timeline", "calendar", "chart", "table"].includes(type)) {
+    return '<section class="ui-collection"><small>' + escape(type + (props.source ? " · " + props.source : "")) + "</small>" + (children || '<p>' + escape(props.empty_text || "데이터가 연결되면 표시됩니다.") + "</p>") + "</section>";
+  }
+  if (["dialog", "sheet"].includes(type)) return '<details class="ui-surface"><summary>' + label + "</summary>" + children + "</details>";
+  const layout = ["row", "wrap", "grid", "stack", "column"].includes(type);
+  const surface = ["card", "surface", "section", "form"].includes(type);
+  const className = layout ? "ui-layout " + type : surface ? "ui-surface " + type : "ui-layout " + type;
+  const heading = surface && (props.title || props.label)
+    ? "<h3>" + label + "</h3>" + (props.subtitle ? "<p>" + escape(props.subtitle) + "</p>" : "")
+    : "";
+  return '<div class="' + className + '"' + action + ">" + heading + children + "</div>";
+}
+
+function chromeHtml(config) {
+  const appBar = config.app_bar;
+  const navigation = config.navigation;
+  const bar = appBar
+    ? '<header class="app-bar"><div><strong>' + escape(appBar.title) + "</strong>" +
+      (appBar.subtitle ? "<small>" + escape(appBar.subtitle) + "</small>" : "") +
+      '</div><div class="app-actions">' + (appBar.actions || []).map((item) => "<button>" + escape(item.icon || item.label) + "</button>").join("") + "</div></header>"
+    : "";
+  const nav = navigation
+    ? '<nav class="ui-nav" aria-label="Plugin navigation">' + navigation.items.map((item) => '<span class="ui-chip">' + escape(item.icon ? item.icon + " " + item.label : item.label) + "</span>").join("") + "</nav>"
+    : "";
+  return bar + nav;
+}
+
+const CSS = [
+  "*{box-sizing:border-box}body{margin:0;font:15px/1.5 system-ui,sans-serif;background:#0d1211}",
+  ".theme-toggle{position:fixed;right:18px;top:16px;z-index:3;padding:9px 13px;border-radius:999px;background:#fff;color:#17211f;box-shadow:0 4px 18px #0003;cursor:pointer}",
+  "#preview-dark{position:fixed;opacity:0}.preview{min-height:100vh;padding:72px 20px 56px;background:#eef3f1}",
+  ".preview-head{max-width:980px;margin:0 auto 22px}.preview-head h1{margin:0}.screens{display:grid;gap:24px;max-width:980px;margin:auto}",
+  ".screen{--primary:var(--light-primary);--on-primary:var(--light-on-primary);--primary-container:var(--light-primary-container);--on-primary-container:var(--light-on-primary-container);--secondary-container:var(--light-secondary-container);--on-secondary-container:var(--light-on-secondary-container);--tertiary-container:var(--light-tertiary-container);--on-tertiary-container:var(--light-on-tertiary-container);--error-container:var(--light-error-container);--on-error-container:var(--light-on-error-container);--surface:var(--light-surface);--on-surface:var(--light-on-surface);--surface-variant:var(--light-surface-variant);--on-surface-variant:var(--light-on-surface-variant);--outline:var(--light-outline);--outline-variant:var(--light-outline-variant);--radius:var(--light-radius);--space:var(--light-space);--scale:var(--light-scale);overflow:hidden;border:1px solid var(--outline-variant);border-radius:calc(var(--radius) + 6px);background:var(--surface);color:var(--on-surface);font-size:calc(1rem * var(--scale));box-shadow:0 12px 34px #0002}",
+  "#preview-dark:checked~.preview{background:#090d0c;color:#e1e5e2}#preview-dark:checked~.preview .screen{--primary:var(--dark-primary);--on-primary:var(--dark-on-primary);--primary-container:var(--dark-primary-container);--on-primary-container:var(--dark-on-primary-container);--secondary-container:var(--dark-secondary-container);--on-secondary-container:var(--dark-on-secondary-container);--tertiary-container:var(--dark-tertiary-container);--on-tertiary-container:var(--dark-on-tertiary-container);--error-container:var(--dark-error-container);--on-error-container:var(--dark-on-error-container);--surface:var(--dark-surface);--on-surface:var(--dark-on-surface);--surface-variant:var(--dark-surface-variant);--on-surface-variant:var(--dark-on-surface-variant);--outline:var(--dark-outline);--outline-variant:var(--dark-outline-variant);--radius:var(--dark-radius);--space:var(--dark-space);--scale:var(--dark-scale)}",
+  ".screen-meta,.app-bar,.screen-body,.ui-nav{padding:var(--space)}.screen-meta{display:flex;gap:8px;background:var(--surface-variant);color:var(--on-surface-variant)}.screen-meta span{margin-right:auto}.app-bar{display:flex;align-items:center;border-bottom:1px solid var(--outline-variant)}.app-bar div:first-child{display:grid}.app-bar small{color:var(--on-surface-variant)}.app-actions{margin-left:auto;display:flex;gap:6px}",
+  ".screen-body,.ui-layout,.ui-surface,.ui-collection{display:flex;flex-direction:column;gap:var(--space)}.ui-layout.row{flex-direction:row;align-items:center}.ui-layout.wrap,.ui-nav{display:flex;flex-flow:row wrap;gap:8px}.ui-layout.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(140px,1fr))}.ui-surface,.ui-collection,.ui-empty{padding:var(--space);border:1px solid var(--outline-variant);border-radius:var(--radius);background:color-mix(in srgb,var(--surface),var(--primary-container) 9%)}",
+  "h3,p{margin:0}.ui-text.heading{font-size:1.25em;font-weight:750}.ui-text.caption,small{color:var(--on-surface-variant)}button,.ui-chip{border:0;border-radius:999px;padding:8px 13px;background:var(--primary-container);color:var(--on-primary-container);font:inherit}.ui-icon{font:600 .75em monospace;color:var(--primary)}.ui-image{min-height:90px;display:grid;place-items:center;border-radius:var(--radius);background:var(--surface-variant);color:var(--on-surface-variant)}.ui-avatar{display:grid;place-items:center;width:42px;height:42px;border-radius:50%;background:var(--primary);color:var(--on-primary)}.ui-badge{padding:3px 7px;border-radius:99px;background:var(--error-container);color:var(--on-error-container)}.ui-metric{display:grid;padding:12px;border-radius:var(--radius);background:var(--secondary-container);color:var(--on-secondary-container)}.ui-metric strong{font-size:1.35em}.ui-field{display:grid;gap:5px}input,select{width:100%;padding:11px;border:1px solid var(--outline);border-radius:var(--radius);background:var(--surface);color:var(--on-surface)}progress{accent-color:var(--primary);width:100%}hr{width:100%;border:0;border-top:1px solid var(--outline-variant)}.ui-spacer{min-height:12px}.ui-nav{border-top:1px solid var(--outline-variant)}",
+].join("");
+
+export function renderPreviewHtml(manifest) {
+  const extensions = manifest.ui_extensions.filter((item) => item.config?.ui_schema === 2);
+  const screens = extensions.length
+    ? extensions.map((extension) => {
+      const config = extension.config;
+      return '<article class="screen" style="' + themeVariables(config) + '">' +
+        '<div class="screen-meta"><span>' + escape(extension.point) + "</span><strong>" + escape(extension.title) + "</strong></div>" +
+        chromeHtml(config) + '<main class="screen-body">' + nodeHtml(config.view) + "</main></article>";
+    }).join("")
+    : '<article class="screen"><div class="ui-empty"><strong>UI extension 없음</strong><p>UI Runtime v2 화면을 추가하면 여기에 표시됩니다.</p></div></article>';
+  const title = escape(manifest.name);
+  const content = '<!doctype html><html lang="ko"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>' +
+    title + " preview</title><style>" + CSS +
+    '</style></head><body><input id="preview-dark" type="checkbox"><label class="theme-toggle" for="preview-dark">☀︎ / ☾</label><div class="preview"><header class="preview-head"><small>Morit UI Runtime v2 · 안전한 계약 Preview</small><h1>' +
+    title + "</h1><p>" + escape(manifest.description || "") +
+    '</p></header><section class="screens">' + screens + "</section></div></body></html>";
+  return Buffer.from(content, "utf8");
+}

package/src/workspace.js

@@ -22,6 +22,7 @@ import {
   signEntries,
   verifySignedEntries,
 } from "./archive.js";
+import { renderPreviewHtml } from "./preview.js";
 
 const contract = JSON.parse(
   readFileSync(new URL("../assets/plugin_contract.json", import.meta.url), "utf8"),
@@ -63,6 +64,10 @@ const CONNECTOR_FIELDS = new Set(contract.object_fields.connector);
 const DEPENDENCY_FIELDS = new Set(contract.object_fields.dependency);
 const DEVELOPER_FIELDS = new Set(contract.object_fields.developer);
 const REQUIRED_SECRET_FIELDS = new Set(contract.object_fields.required_secret);
+const STORAGE_FIELDS = new Set(contract.object_fields.storage);
+const STORAGE_NAMESPACE_FIELDS = new Set(contract.object_fields.storage_namespace);
+const STORAGE_MIGRATION_FIELDS = new Set(contract.object_fields.storage_migration);
+const STORAGE_TOOLS = new Set(contract.storage_tools);
 const CAPABILITY_RUNTIME_SHORTHAND = contract.capability_runtime_shorthand;
 const UI_POINTS = new Set(contract.ui_points);
 const RUNTIME_ADAPTERS = new Set(contract.runtime_adapters);
@@ -147,7 +152,7 @@ export class LocalWorkspace {
       version: "1.0.0",
       cloud_project_id: null,
       required_secrets: [],
-      min_morit_version: "1.7.6",
+      min_morit_version: "1.7.8",
       max_morit_version: "1.999.999",
       permissions: [],
       capabilities: [],
@@ -269,6 +274,7 @@ export class LocalWorkspace {
       revision: project.revision,
       valid: true,
       message: `validated ${manifest.id} ${manifest.version} (${packageEntries.size} package entries)`,
+      warnings: collectThemeWarnings(manifest),
       workspace_path: project.workspace_path,
     };
   }
@@ -515,6 +521,7 @@ export async function verifyPackageFile(packagePath) {
     size_bytes: content.length,
     sha256: sha256(content),
     signature: verified.signature,
+    warnings: collectThemeWarnings(verified.manifest),
   };
 }
 
@@ -535,6 +542,7 @@ function projectDirectoryResult({ root, manifest, entries }) {
     publisher: manifest.publisher,
     version: manifest.version,
     package_entries: entries.size + 1,
+    warnings: collectThemeWarnings(manifest),
   };
 }
 
@@ -719,14 +727,10 @@ async function signingKeyForPublisher(keyDirectory, publisher) {
   }
 }
 
-function previewHtml(manifest) {
-  const serialized = JSON.stringify(manifest, null, 2).replaceAll("<", "\\u003c");
-  return Buffer.from(
-    `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escapeHtml(manifest.name)} preview</title><style>body{font:15px system-ui;margin:0;background:#f5f7fb;color:#182033}.wrap{max-width:960px;margin:auto;padding:32px}.card{background:white;border-radius:18px;padding:24px;box-shadow:0 8px 30px #17203a18}pre{white-space:pre-wrap;overflow-wrap:anywhere;background:#101727;color:#e8eefc;padding:18px;border-radius:12px}</style></head><body><main class="wrap"><section class="card"><h1>${escapeHtml(manifest.name)}</h1><p>${escapeHtml(manifest.description || "")}</p><p>${manifest.capabilities.length} capabilities · ${manifest.ui_extensions.length} UI extensions</p><pre>${escapeHtml(serialized)}</pre></section></main></body></html>`,
-    "utf8",
-  );
-}
-
+function previewHtml(manifest) {
+  return renderPreviewHtml(manifest);
+}
+
 function validateMetadata(pluginId, name, publisher, description) {
   if (!PLUGIN_ID.test(pluginId) || pluginId.length > 120) throw new Error("plugin_id must be a reverse-domain lowercase identifier");
   if (typeof name !== "string" || name.trim().length < 1 || name.trim().length > 80) throw new Error("name must contain 1 to 80 characters");
@@ -790,6 +794,7 @@ function validateManifest(manifest, files) {
   for (const capability of capabilities) {
     rejectUnknownFields(capability, CAPABILITY_FIELDS, "capability");
     requireUniqueIdentifier(capability.id, capabilityIds, "capability");
+    if (STORAGE_TOOLS.has(capability.id)) throw new Error(`capability ${capability.id} is reserved by Morit`);
     capabilityIds.add(capability.id);
     if (!CAPABILITY_KINDS.has(capability.kind)) throw new Error(`unknown capability kind: ${capability.kind}`);
     requireText(capability.title, 80, `capability ${capability.id} title`);
@@ -832,7 +837,8 @@ function validateManifest(manifest, files) {
     // level before semantic UI validation runs.
     assertJsonSize(extensionConfig, 32 * 1024, `UI ${extension.id} config`, 40);
   }
-  for (const extension of uiExtensions) validateUiConfig(extension, capabilities, uiIds, files);
+  const storage = validateStorage(manifest, requestedPermissions);
+  for (const extension of uiExtensions) validateUiConfig(extension, capabilities, uiIds, files, storage !== null);
 
   const credentialIds = validateCredentials(credentials, requestedPermissions);
   const secretIds = validateRequiredSecrets(requiredSecrets);
@@ -879,6 +885,79 @@ function validatePermissions(values, label) {
   return new Set(values);
 }
 
+function validateStorage(manifest, permissions) {
+  if (manifest.storage === undefined) {
+    if (permissions.has("ai_storage")) throw new Error("ai_storage requires manifest.storage");
+    return permissions.has("storage") ? { version: 1, namespaces: [{ id: "default", max_bytes: 128 * 1024, ai_access: "none" }], migrations: [] } : null;
+  }
+  if (manifest.schema_version !== 2 || !permissions.has("storage")) {
+    throw new Error("manifest.storage requires schema 2 and storage permission");
+  }
+  const storage = manifest.storage;
+  assertObject(storage, "manifest.storage");
+  rejectUnknownFields(storage, STORAGE_FIELDS, "manifest.storage");
+  if (!Number.isInteger(storage.version) || storage.version < 1 || storage.version > 1000) {
+    throw new Error("manifest.storage.version is invalid");
+  }
+  const namespaces = objectCollection(storage.namespaces, "manifest.storage.namespaces", 16);
+  if (!namespaces.length) throw new Error("manifest.storage.namespaces must not be empty");
+  const namespaceIds = new Set();
+  let hasAiAccess = false;
+  for (const namespace of namespaces) {
+    rejectUnknownFields(namespace, STORAGE_NAMESPACE_FIELDS, "storage namespace");
+    requireUniqueIdentifier(namespace.id, namespaceIds, "storage namespace");
+    namespaceIds.add(namespace.id);
+    const maxBytes = namespace.max_bytes === undefined ? 128 * 1024 : namespace.max_bytes;
+    if (!Number.isInteger(maxBytes) || maxBytes < 1024 || maxBytes > 256 * 1024) {
+      throw new Error(`storage namespace ${namespace.id} max_bytes is invalid`);
+    }
+    const aiAccess = namespace.ai_access === undefined ? "none" : namespace.ai_access;
+    if (!contract.storage_ai_access.includes(aiAccess)) throw new Error(`storage namespace ${namespace.id} ai_access is invalid`);
+    hasAiAccess ||= aiAccess !== "none";
+  }
+  const migrations = objectCollection(storage.migrations === undefined ? [] : storage.migrations, "manifest.storage.migrations", 64);
+  const migrationSteps = new Set();
+  for (const migration of migrations) {
+    rejectUnknownFields(migration, STORAGE_MIGRATION_FIELDS, "storage migration");
+    if (!Number.isInteger(migration.from) || migration.from < 1 || migration.to !== migration.from + 1 || migration.to > storage.version) {
+      throw new Error("storage migration version is invalid");
+    }
+    if (!namespaceIds.has(migration.namespace)) throw new Error("storage migration namespace is unknown");
+    const step = `${migration.from}\0${migration.namespace}`;
+    if (migrationSteps.has(step)) throw new Error("storage migration step is duplicated");
+    migrationSteps.add(step);
+    const rename = migration.rename === undefined ? {} : migration.rename;
+    assertObject(rename, "storage migration rename");
+    const deleted = migration.delete === undefined ? [] : migration.delete;
+    if (Object.keys(rename).length > 32 || !Array.isArray(deleted) || deleted.length > 32 || new Set(deleted).size !== deleted.length) {
+      throw new Error("storage migration operations are invalid");
+    }
+    const targets = new Set();
+    for (const [source, target] of Object.entries(rename)) {
+      validateStorageKey(source);
+      validateStorageKey(target);
+      if (source === target || targets.has(target) || deleted.includes(source)) throw new Error("storage migration rename is invalid");
+      targets.add(target);
+    }
+    for (const key of deleted) validateStorageKey(key);
+  }
+  if (permissions.has("ai_storage") !== hasAiAccess) {
+    throw new Error("AI-accessible storage and ai_storage permission must be declared together");
+  }
+  return storage;
+}
+
+function validateStorageKey(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,79}$/.test(value) || value.startsWith("_")) {
+    throw new Error("storage key is invalid");
+  }
+  const compact = value.toLowerCase().replace(/[^a-z0-9]/g, "");
+  if (/(^|[_.-])(authorization|credential|password|secret|token|api[_-]?key|private[_-]?key)($|[_.-])/i.test(value)
+    || ["authorization", "credential", "credentials", "password", "secret", "token", "accesstoken", "refreshtoken", "apikey", "privatekey"].includes(compact)) {
+    throw new Error("credential-shaped storage keys are not allowed");
+  }
+}
+
 function assertObject(value, label) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     throw new Error(`${label} must be an object`);
@@ -1160,12 +1239,15 @@ function validateRuntimeReferences(capabilities, connectors, connectorIds, depen
   }
 }
 
-function validateUiConfig(extension, capabilities, routeIds, files) {
+function validateUiConfig(extension, capabilities, routeIds, files, hasStorage = false) {
   const config = extension.config === undefined ? {} : extension.config;
   const executable = new Set(capabilities.filter((value) => ["tool", "skill", "provider", "notification"].includes(value.kind)).map((value) => value.id));
+  if (hasStorage) for (const capability of STORAGE_TOOLS) executable.add(capability);
+  if (extension.point === "response" && config.ui_schema !== 2) throw new Error("response UI requires UI Runtime v2");
   if (config.ui_schema === 2) {
     if (config.placement != null && !["card", "action"].includes(extension.point)) throw new Error("UI placement is only valid for home extensions");
     validateUiRuntimeV2(config, executable, routeIds);
+    validateResponseComponent(config, extension.point === "response");
     for (const asset of uiRuntimeAssetPaths(config.view)) {
       if (!(asset in files)) throw new Error(`UI image asset is not packaged: ${asset}`);
     }
@@ -1199,6 +1281,72 @@ function validateUiConfig(extension, capabilities, routeIds, files) {
   if (config.form !== undefined) validateLegacyUiForm(config.form, executable, extension.id);
 }
 
+function validateResponseComponent(config, responsePoint) {
+  if (!responsePoint) {
+    if (Object.hasOwn(config, "a2ui")) throw new Error("A2UI metadata is only valid for response UI");
+    return;
+  }
+  const value = config.a2ui;
+  assertObject(value, "response A2UI metadata");
+  rejectUnknownFields(value, new Set(["version", "description", "schema"]), "response A2UI metadata");
+  if (Object.keys(value).length !== 3 || value.version !== "v0.9") throw new Error("response UI requires complete A2UI v0.9 metadata");
+  requireText(value.description, 500, "response A2UI description");
+  assertObject(value.schema, "response A2UI schema");
+  if (Buffer.byteLength(JSON.stringify(value.schema), "utf8") > 16 * 1024) throw new Error("response A2UI schema is too large");
+  validateResponseSchema(value.schema, 0, true);
+}
+
+function validateResponseSchema(schema, depth, root = false) {
+  const fields = new Set([
+    "type", "properties", "required", "additionalProperties", "items", "enum",
+    "minItems", "maxItems", "minLength", "maxLength", "minimum", "maximum",
+  ]);
+  if (depth > 6) throw new Error("response A2UI schema is too deep");
+  rejectUnknownFields(schema, fields, "response A2UI schema");
+  const types = new Set(["object", "array", "string", "number", "integer", "boolean", "null"]);
+  if (!types.has(schema.type) || (root && schema.type !== "object")) throw new Error("response A2UI schema type is invalid");
+  if (schema.enum !== undefined) {
+    if (!Array.isArray(schema.enum) || schema.enum.length < 1 || schema.enum.length > 32 || schema.enum.some((item) => item !== null && typeof item === "object")) throw new Error("response A2UI schema enum is invalid");
+    for (const item of schema.enum) validateUiJson(item, 0);
+  }
+  const byType = {
+    object: new Set(["properties", "required", "additionalProperties"]),
+    array: new Set(["items", "minItems", "maxItems"]),
+    string: new Set(["minLength", "maxLength"]),
+    number: new Set(["minimum", "maximum"]),
+    integer: new Set(["minimum", "maximum"]),
+    boolean: new Set(),
+    null: new Set(),
+  }[schema.type];
+  if (Object.keys(schema).some((key) => !["type", "enum"].includes(key) && !byType.has(key))) throw new Error("response A2UI schema keyword does not match its type");
+  if (schema.type === "object") {
+    const properties = schema.properties === undefined ? {} : schema.properties;
+    const required = schema.required === undefined ? [] : schema.required;
+    const additional = schema.additionalProperties === undefined ? true : schema.additionalProperties;
+    assertObject(properties, "response A2UI properties");
+    if (Object.keys(properties).length > 64 || !Array.isArray(required) || required.length > 64 || new Set(required).size !== required.length || typeof additional !== "boolean") throw new Error("response A2UI object schema is invalid");
+    for (const [key, child] of Object.entries(properties)) {
+      if (!UI_STATE_KEY.test(key)) throw new Error("response A2UI property is invalid");
+      assertObject(child, "response A2UI property schema");
+      validateResponseSchema(child, depth + 1);
+    }
+    if (required.some((key) => typeof key !== "string" || !Object.hasOwn(properties, key))) throw new Error("response A2UI required property is invalid");
+  } else if (schema.type === "array") {
+    assertObject(schema.items, "response A2UI item schema");
+    const minimum = schema.minItems === undefined ? 0 : schema.minItems;
+    const maximum = schema.maxItems === undefined ? 64 : schema.maxItems;
+    if (!Number.isInteger(minimum) || !Number.isInteger(maximum) || minimum < 0 || minimum > maximum || maximum > 64) throw new Error("response A2UI array schema is invalid");
+    validateResponseSchema(schema.items, depth + 1);
+  } else if (schema.type === "string") {
+    const minimum = schema.minLength === undefined ? 0 : schema.minLength;
+    const maximum = schema.maxLength === undefined ? 2000 : schema.maxLength;
+    if (!Number.isInteger(minimum) || !Number.isInteger(maximum) || minimum < 0 || minimum > maximum || maximum > 2000) throw new Error("response A2UI string schema is invalid");
+  } else if (["number", "integer"].includes(schema.type)) {
+    for (const bound of [schema.minimum, schema.maximum]) if (bound !== undefined && (typeof bound !== "number" || !Number.isFinite(bound))) throw new Error("response A2UI number bound is invalid");
+    if (schema.minimum !== undefined && schema.maximum !== undefined && schema.minimum > schema.maximum) throw new Error("response A2UI number range is invalid");
+  }
+}
+
 function validateLegacyUiForm(form, executable, extensionId) {
   rejectUnknownFields(form, new Set(["submit_capability", "submit_label", "fields"]), `UI ${extensionId} form`);
   if (!executable.has(form.submit_capability)) throw new Error(`UI ${extensionId} form targets an unknown capability`);
@@ -1283,9 +1431,9 @@ function validateUiRuntimeV2(config, executable, routes) {
   validateUiNode(config.view, 0, { value: 0 }, executable, routes, sourceIds, stateKeys, null);
 }
 
-function validateUiTheme(theme) {
+function validateUiTheme(theme, variant = false) {
   if (theme == null) return;
-  rejectUnknownFields(theme, new Set(contract.ui_runtime.theme_fields), "UI theme");
+  rejectUnknownFields(theme, new Set(variant ? contract.ui_runtime.theme_variant_fields : contract.ui_runtime.theme_fields), "UI theme");
   const colors = theme.color_scheme === undefined ? {} : theme.color_scheme;
   assertObject(colors, "UI color scheme");
   const roles = new Set([...UI_COLOR_TOKENS].filter((value) => value !== "transparent"));
@@ -1297,6 +1445,79 @@ function validateUiTheme(theme) {
   if (theme.spacing !== undefined) validateUiNumber(theme.spacing, "UI theme spacing", 0, 32);
   const density = theme.density === undefined ? "standard" : theme.density;
   if (!["compact", "standard", "comfortable"].includes(density)) throw new Error("UI theme density is invalid");
+  const typography = theme.typography === undefined ? {} : theme.typography;
+  rejectUnknownFields(typography, new Set(contract.ui_runtime.theme_typography_fields), "UI theme typography");
+  if (typography.scale !== undefined) validateUiNumber(typography.scale, "UI theme typography scale", 0.8, 1.4);
+  for (const key of ["body_weight", "title_weight"]) {
+    if (typography[key] !== undefined && ![400, 500, 600, 700].includes(typography[key])) throw new Error("UI theme typography weight is invalid");
+  }
+  validateThemeComponent(theme.surface, contract.ui_runtime.theme_surface_fields, ["color", "container_color"], { elevation: [0, 24] }, "surface");
+  validateThemeComponent(theme.border, contract.ui_runtime.theme_border_fields, ["color"], { width: [0, 8], radius: [0, 64] }, "border");
+  validateThemeComponent(theme.icon, contract.ui_runtime.theme_icon_fields, ["color"], { size: [12, 64] }, "icon");
+  validateThemeComponent(theme.states, contract.ui_runtime.theme_state_fields, ["selected_color", "focus_color"], { disabled_opacity: [0.2, 0.8] }, "states");
+  if (!variant) for (const mode of ["light", "dark"]) if (theme[mode] !== undefined) validateUiTheme(theme[mode], true);
+  validateThemeContrast(theme);
+}
+
+function validateThemeComponent(value, fields, colors, numbers, label) {
+  if (value === undefined) return;
+  rejectUnknownFields(value, new Set(fields), `UI theme ${label}`);
+  for (const key of colors) if (value[key] !== undefined && (typeof value[key] !== "string" || !UI_HEX_COLOR.test(value[key]))) throw new Error(`UI theme ${label} color is invalid`);
+  for (const [key, [minimum, maximum]] of Object.entries(numbers)) if (value[key] !== undefined) validateUiNumber(value[key], `UI theme ${label} ${key}`, minimum, maximum);
+}
+
+function hexRgb(value) {
+  if (typeof value !== "string" || !UI_HEX_COLOR.test(value)) return null;
+  let raw = value.slice(1);
+  if (raw.length === 8) {
+    if (Number.parseInt(raw.slice(0, 2), 16) < 242) return null;
+    raw = raw.slice(2);
+  }
+  return [0, 2, 4].map((index) => Number.parseInt(raw.slice(index, index + 2), 16) / 255);
+}
+
+function contrastRatio(first, second) {
+  const values = [hexRgb(first), hexRgb(second)];
+  if (values.some((value) => value === null)) return null;
+  const luminance = (rgb) => {
+    const [r, g, b] = rgb.map((value) => value <= 0.04045 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4);
+    return 0.2126 * r + 0.7152 * g + 0.0722 * b;
+  };
+  const [one, two] = values.map(luminance);
+  return (Math.max(one, two) + 0.05) / (Math.min(one, two) + 0.05);
+}
+
+const THEME_CONTRAST_PAIRS = [
+  ["primary", "on_primary"], ["primary_container", "on_primary_container"],
+  ["secondary", "on_secondary"], ["secondary_container", "on_secondary_container"],
+  ["tertiary", "on_tertiary"], ["error", "on_error"],
+  ["error_container", "on_error_container"], ["surface", "on_surface"],
+  ["surface_variant", "on_surface_variant"],
+];
+
+function validateThemeContrast(theme) {
+  const colors = theme.color_scheme || {};
+  for (const [background, foreground] of THEME_CONTRAST_PAIRS) {
+    const ratio = contrastRatio(colors[background], colors[foreground]);
+    if (ratio !== null && ratio < 1.5) throw new Error(`UI theme ${foreground} is not visible on ${background}`);
+  }
+}
+
+function collectThemeWarnings(manifest) {
+  const warnings = [];
+  for (const extension of manifest.ui_extensions || []) {
+    const theme = extension?.config?.theme;
+    if (!theme || typeof theme !== "object" || Array.isArray(theme)) continue;
+    for (const [mode, variant] of [["base", theme], ["light", theme.light], ["dark", theme.dark]]) {
+      if (!variant || typeof variant !== "object" || Array.isArray(variant)) continue;
+      const colors = variant.color_scheme || {};
+      for (const [background, foreground] of [["primary", "on_primary"], ["surface", "on_surface"]]) {
+        const ratio = contrastRatio(colors[background], colors[foreground]);
+        if (ratio !== null && ratio < 4.5) warnings.push(`${extension.id} ${mode} theme ${foreground}/${background} contrast is ${ratio.toFixed(2)}:1; verify text accessibility`);
+      }
+    }
+  }
+  return warnings;
 }
 
 function validateUiAppBar(appBar, executable, routes, sources, stateKeys) {
@@ -1385,7 +1606,7 @@ function validateUiNode(node, depth, counter, executable, routes, sources, state
   validateUiAction(node.action, executable, routes, sources, stateKeys);
   const children = node.children === undefined ? [] : node.children;
   if (!Array.isArray(children) || children.length > 32) throw new Error("UI component children are invalid");
-  const leaves = new Set(["text", "icon", "image", "avatar", "divider", "spacer", "button", "chip", "metric", "progress", "calendar", "chart", "field", "select", "switch", "empty"]);
+  const leaves = new Set(["text", "icon", "image", "avatar", "divider", "spacer", "button", "chip", "metric", "progress", "calendar", "chart", "table", "field", "select", "switch", "empty"]);
   if (leaves.has(node.type) && children.length) throw new Error("leaf UI component cannot have children");
   if (["list", "timeline"].includes(node.type) && children.length !== 1) throw new Error("list UI component requires one item template");
   if (["positioned", "scroll", "padding", "center", "expanded", "badge"].includes(node.type) && children.length !== 1) throw new Error("UI component requires exactly one child");
@@ -1460,11 +1681,11 @@ function validateUiProps(nodeType, props, sources, stateKeys) {
   if (nodeType !== "positioned" && ["left", "top", "right", "bottom"].some((key) => props[key] !== undefined)) throw new Error("position offsets require a positioned UI component");
   if (nodeType !== "expanded" && props.flex !== undefined) throw new Error("flex requires an expanded UI component");
   if (nodeType !== "scroll" && ["scroll_direction", "shrink_wrap"].some((key) => props[key] !== undefined)) throw new Error("scroll properties require a scroll UI component");
-  if (["list", "timeline", "calendar", "chart"].includes(nodeType)) {
+  if (["list", "timeline", "calendar", "chart", "table"].includes(nodeType)) {
     if (typeof props.source !== "string" || !UI_BINDING.test(props.source) || !props.source.startsWith("data.") || !sources.has(props.source.split(".")[1])) throw new Error("UI list source is invalid");
   }
   const chartType = props.chart_type === undefined ? "bar" : props.chart_type;
-  if (nodeType === "chart" && !["bar", "line", "donut"].includes(chartType)) throw new Error("UI chart type is invalid");
+  if (nodeType === "chart" && !["bar", "line", "donut", "scatter"].includes(chartType)) throw new Error("UI chart type is invalid");
   if (nodeType === "calendar" && props.state_key != null && !stateKeys.has(props.state_key)) throw new Error("UI calendar state is unknown");
   if (["field", "select", "switch"].includes(nodeType) && !stateKeys.has(props.state_key)) throw new Error("UI state field is unknown");
   if (props.options != null) {
@@ -1832,6 +2053,7 @@ function escapeHtml(value) {
 
 export const internal = {
   artifactFileName,
+  collectThemeWarnings,
   compileManifest,
   normalizeEntrypointPath,
   projectFileBytes,