@openchamber/sdk 1.23.2-preview.1

package/dist/parse.d.ts

@@ -0,0 +1,279 @@
+import { z } from 'zod';
+import { type ServicePermissions, type ParseManifestResult, type SocketBinding } from './manifest.ts';
+export declare const openChamberManifestSchema: z.ZodObject<{
+    apiVersion: z.ZodLiteral<1>;
+    engines: z.ZodOptional<z.ZodObject<{
+        openchamber: z.ZodString;
+    }, z.core.$strict>>;
+    contributes: z.ZodObject<{
+        panel: z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            icon: z.ZodString;
+            entry: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        attach: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+            panel: "panel";
+            dialog: "dialog";
+        }>, z.ZodObject<{
+            mode: z.ZodEnum<{
+                panel: "panel";
+                dialog: "dialog";
+            }>;
+            entry: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>]>>;
+        page: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<true>, z.ZodObject<{
+            entry: z.ZodString;
+            title: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>]>>;
+        capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            sessions: "sessions";
+            prompt: "prompt";
+            files: "files";
+            model: "model";
+        }>>>;
+        integration: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            description: z.ZodString;
+            oauth: z.ZodOptional<z.ZodObject<{
+                authorizeUrl: z.ZodString;
+                tokenUrl: z.ZodString;
+                apiOrigin: z.ZodString;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                account: z.ZodOptional<z.ZodObject<{
+                    path: z.ZodString;
+                    name: z.ZodString;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            token: z.ZodOptional<z.ZodObject<{
+                apiOrigin: z.ZodString;
+                account: z.ZodOptional<z.ZodObject<{
+                    path: z.ZodString;
+                    name: z.ZodString;
+                }, z.core.$strip>>;
+                scheme: z.ZodOptional<z.ZodEnum<{
+                    raw: "raw";
+                    bearer: "bearer";
+                    basic: "basic";
+                }>>;
+                usernameLabel: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            host: z.ZodOptional<z.ZodObject<{
+                provider: z.ZodEnum<{
+                    linear: "linear";
+                }>;
+            }, z.core.$strip>>;
+            settings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                label: z.ZodString;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+        service: z.ZodOptional<z.ZodObject<{
+            entry: z.ZodString;
+            runtime: z.ZodLiteral<"host">;
+            permissions: z.ZodOptional<z.ZodPipe<z.ZodObject<{
+                sockets: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<SocketBinding, string>>, z.ZodPipe<z.ZodObject<{
+                    id: z.ZodString;
+                    path: z.ZodOptional<z.ZodString>;
+                    candidates: z.ZodOptional<z.ZodObject<{
+                        linux: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                        darwin: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                        win32: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>, z.ZodTransform<SocketBinding, {
+                    id: string;
+                    path?: string | undefined;
+                    candidates?: {
+                        linux?: string[] | undefined;
+                        darwin?: string[] | undefined;
+                        win32?: string[] | undefined;
+                    } | undefined;
+                }>>]>>>;
+                exec: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>, z.ZodTransform<ServicePermissions, {
+                sockets?: SocketBinding[] | undefined;
+                exec?: string[] | undefined;
+            }>>>;
+        }, z.core.$strip>>;
+        filesystem: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        actions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+            icon: z.ZodOptional<z.ZodString>;
+            where: z.ZodEnum<{
+                message: "message";
+                session: "session";
+            }>;
+            roles: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                user: "user";
+                assistant: "assistant";
+            }>>>;
+            payload: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                messages: "messages";
+            }>>>;
+        }, z.core.$strip>>>;
+        commands: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+        tools: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            match: z.ZodString;
+            name: z.ZodOptional<z.ZodString>;
+            icon: z.ZodOptional<z.ZodString>;
+            title: z.ZodOptional<z.ZodString>;
+            subtitle: z.ZodOptional<z.ZodString>;
+            output: z.ZodOptional<z.ZodEnum<{
+                code: "code";
+                text: "text";
+                auto: "auto";
+                json: "json";
+                markdown: "markdown";
+                table: "table";
+            }>>;
+            language: z.ZodOptional<z.ZodString>;
+            columns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const PACKAGE_VERSION_PATTERN: RegExp;
+export declare const packageManifestSchema: z.ZodObject<{
+    version: z.ZodOptional<z.ZodString>;
+    openchamber: z.ZodObject<{
+        apiVersion: z.ZodLiteral<1>;
+        engines: z.ZodOptional<z.ZodObject<{
+            openchamber: z.ZodString;
+        }, z.core.$strict>>;
+        contributes: z.ZodObject<{
+            panel: z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                icon: z.ZodString;
+                entry: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            attach: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+                panel: "panel";
+                dialog: "dialog";
+            }>, z.ZodObject<{
+                mode: z.ZodEnum<{
+                    panel: "panel";
+                    dialog: "dialog";
+                }>;
+                entry: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>]>>;
+            page: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<true>, z.ZodObject<{
+                entry: z.ZodString;
+                title: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>]>>;
+            capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                sessions: "sessions";
+                prompt: "prompt";
+                files: "files";
+                model: "model";
+            }>>>;
+            integration: z.ZodOptional<z.ZodObject<{
+                name: z.ZodString;
+                description: z.ZodString;
+                oauth: z.ZodOptional<z.ZodObject<{
+                    authorizeUrl: z.ZodString;
+                    tokenUrl: z.ZodString;
+                    apiOrigin: z.ZodString;
+                    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    account: z.ZodOptional<z.ZodObject<{
+                        path: z.ZodString;
+                        name: z.ZodString;
+                    }, z.core.$strip>>;
+                }, z.core.$strip>>;
+                token: z.ZodOptional<z.ZodObject<{
+                    apiOrigin: z.ZodString;
+                    account: z.ZodOptional<z.ZodObject<{
+                        path: z.ZodString;
+                        name: z.ZodString;
+                    }, z.core.$strip>>;
+                    scheme: z.ZodOptional<z.ZodEnum<{
+                        raw: "raw";
+                        bearer: "bearer";
+                        basic: "basic";
+                    }>>;
+                    usernameLabel: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+                host: z.ZodOptional<z.ZodObject<{
+                    provider: z.ZodEnum<{
+                        linear: "linear";
+                    }>;
+                }, z.core.$strip>>;
+                settings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    id: z.ZodString;
+                    label: z.ZodString;
+                }, z.core.$strip>>>;
+            }, z.core.$strip>>;
+            service: z.ZodOptional<z.ZodObject<{
+                entry: z.ZodString;
+                runtime: z.ZodLiteral<"host">;
+                permissions: z.ZodOptional<z.ZodPipe<z.ZodObject<{
+                    sockets: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<SocketBinding, string>>, z.ZodPipe<z.ZodObject<{
+                        id: z.ZodString;
+                        path: z.ZodOptional<z.ZodString>;
+                        candidates: z.ZodOptional<z.ZodObject<{
+                            linux: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                            darwin: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                            win32: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                        }, z.core.$strict>>;
+                    }, z.core.$strict>, z.ZodTransform<SocketBinding, {
+                        id: string;
+                        path?: string | undefined;
+                        candidates?: {
+                            linux?: string[] | undefined;
+                            darwin?: string[] | undefined;
+                            win32?: string[] | undefined;
+                        } | undefined;
+                    }>>]>>>;
+                    exec: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                }, z.core.$strict>, z.ZodTransform<ServicePermissions, {
+                    sockets?: SocketBinding[] | undefined;
+                    exec?: string[] | undefined;
+                }>>>;
+            }, z.core.$strip>>;
+            filesystem: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            actions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                label: z.ZodString;
+                icon: z.ZodOptional<z.ZodString>;
+                where: z.ZodEnum<{
+                    message: "message";
+                    session: "session";
+                }>;
+                roles: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    user: "user";
+                    assistant: "assistant";
+                }>>>;
+                payload: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    messages: "messages";
+                }>>>;
+            }, z.core.$strip>>>;
+            commands: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                description: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>>;
+            tools: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                match: z.ZodString;
+                name: z.ZodOptional<z.ZodString>;
+                icon: z.ZodOptional<z.ZodString>;
+                title: z.ZodOptional<z.ZodString>;
+                subtitle: z.ZodOptional<z.ZodString>;
+                output: z.ZodOptional<z.ZodEnum<{
+                    code: "code";
+                    text: "text";
+                    auto: "auto";
+                    json: "json";
+                    markdown: "markdown";
+                    table: "table";
+                }>>;
+                language: z.ZodOptional<z.ZodString>;
+                columns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ManifestDocument = z.input<typeof openChamberManifestSchema> | z.input<typeof packageManifestSchema>;
+export declare const parseManifest: (document: ManifestDocument) => ParseManifestResult;
+export declare const parseManifestJson: (json: string) => ParseManifestResult;

package/dist/parse.js

@@ -0,0 +1,379 @@
+import { z } from 'zod';
+import { OPENCHAMBER_SDK_MANIFEST_API_VERSIONS } from "./api-version.js";
+import { OPENCHAMBER_ENGINE_PATTERN } from "./host-version.js";
+import { DECLARED_GUEST_CAPABILITIES, GUEST_ACTIONS_MAX, GUEST_ACTION_LABEL_MAX, GUEST_COMMANDS_MAX, GUEST_COMMAND_DESCRIPTION_MAX, GUEST_COMMAND_NAME, GUEST_FILESYSTEM_PATTERNS_MAX, GUEST_FILESYSTEM_PATTERN_MAX, GUEST_TOOLS_MAX, GUEST_TOOL_COLUMNS_MAX, GUEST_TOOL_COLUMN_MAX, GUEST_TOOL_LANGUAGE_MAX, GUEST_TOOL_MATCH, GUEST_TOOL_MATCH_MAX, GUEST_TOOL_NAME_MAX, GUEST_TOOL_OUTPUTS, GUEST_TOOL_TEMPLATE_MAX, PANEL_ID, hasGuestPage, isGuestFilesystemPattern, isGuestPackageSvgIcon, isSafeAssetPath, resolveIntegrationAuth, } from "./manifest.js";
+const isPanelIcon = (value) => (PANEL_ID.test(value) || isGuestPackageSvgIcon(value));
+const isHttpsUrl = (value) => {
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === 'https:' && parsed.username === '' && parsed.password === '';
+    }
+    catch {
+        return false;
+    }
+};
+const isHttpsOrigin = (value) => {
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === 'https:'
+            && parsed.username === ''
+            && parsed.password === ''
+            && parsed.pathname === '/'
+            && parsed.search === ''
+            && parsed.hash === ''
+            && value === parsed.origin;
+    }
+    catch {
+        return false;
+    }
+};
+const isSafeApiPath = (value) => {
+    if (!value.startsWith('/') || value.includes('\0') || value.includes('\\') || value.includes('://')) {
+        return false;
+    }
+    const segments = value.split('/');
+    return !segments.some((segment) => segment === '.' || segment === '..');
+};
+const ACCOUNT_NAME = /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)*$/;
+const attachModeSchema = z.enum(['panel', 'dialog']);
+// `entry` only means something for the dialog; a panel-mode object naming one
+// is a misconfiguration and fails closed rather than carrying a dead field.
+const attachObjectSchema = z.object({
+    mode: attachModeSchema,
+    entry: z.string().trim().refine(isSafeAssetPath).optional(),
+}).refine((value) => value.mode === 'dialog' || value.entry === undefined, { path: ['entry'] });
+const attachSchema = z.union([z.boolean(), attachModeSchema, attachObjectSchema]);
+const panelSchema = z.object({
+    id: z.string().trim().regex(PANEL_ID),
+    name: z.string().trim().min(1),
+    icon: z.string().trim().refine(isPanelIcon),
+    entry: z.string().trim().refine(isSafeAssetPath).optional(),
+});
+const integrationSettingSchema = z.object({
+    id: z.string().trim().regex(PANEL_ID),
+    label: z.string().trim().min(1),
+});
+const integrationOauthSchema = z.object({
+    authorizeUrl: z.string().trim().refine(isHttpsUrl),
+    tokenUrl: z.string().trim().refine(isHttpsUrl),
+    apiOrigin: z.string().trim().refine(isHttpsOrigin),
+    scopes: z.array(z.string().trim().min(1)).optional(),
+    account: z.object({
+        path: z.string().trim().refine(isSafeApiPath),
+        name: z.string().trim().regex(ACCOUNT_NAME),
+    }).optional(),
+});
+const integrationTokenSchema = z.object({
+    apiOrigin: z.string().trim().refine(isHttpsOrigin),
+    account: z.object({
+        path: z.string().trim().refine(isSafeApiPath),
+        name: z.string().trim().regex(ACCOUNT_NAME),
+    }).optional(),
+    scheme: z.enum(['raw', 'bearer', 'basic']).optional(),
+    usernameLabel: z.string().trim().min(1).max(64).optional(),
+});
+const integrationHostSchema = z.object({
+    provider: z.enum(['linear']),
+});
+const integrationSchema = z.object({
+    name: z.string().trim().min(1),
+    description: z.string().trim().min(1),
+    oauth: integrationOauthSchema.optional(),
+    token: integrationTokenSchema.optional(),
+    host: integrationHostSchema.optional(),
+    settings: z.array(integrationSettingSchema).optional(),
+}).refine((value) => resolveIntegrationAuth(value) !== null, { path: ['oauth'] });
+const SOCKET_PLATFORMS = ['linux', 'darwin', 'win32'];
+const socketPathSchema = z.string().trim().min(1).max(512);
+const socketCandidatesSchema = z.object({
+    linux: z.array(socketPathSchema).max(16).optional(),
+    darwin: z.array(socketPathSchema).max(16).optional(),
+    win32: z.array(socketPathSchema).max(16).optional(),
+}).strict();
+const socketBindingObjectSchema = z.object({
+    id: z.string().trim().regex(PANEL_ID).max(64),
+    path: socketPathSchema.optional(),
+    candidates: socketCandidatesSchema.optional(),
+}).strict().refine((value) => Boolean(value.path) || Boolean(value.candidates), { message: 'socket binding needs path or candidates' });
+const normalizeSocketObject = (entry) => {
+    const candidatesByPlatform = {};
+    if (entry.candidates) {
+        for (const platform of SOCKET_PLATFORMS) {
+            const list = entry.candidates[platform];
+            if (list && list.length > 0) {
+                candidatesByPlatform[platform] = [...list];
+            }
+        }
+    }
+    else if (entry.path) {
+        for (const platform of SOCKET_PLATFORMS) {
+            candidatesByPlatform[platform] = [entry.path];
+        }
+    }
+    return { id: entry.id, candidatesByPlatform };
+};
+const socketEntrySchema = z.union([
+    socketPathSchema.transform((path) => ({
+        id: path,
+        candidatesByPlatform: {
+            linux: [path],
+            darwin: [path],
+            win32: [path],
+        },
+    })),
+    socketBindingObjectSchema.transform(normalizeSocketObject),
+]);
+const servicePermissionsSchema = z.object({
+    sockets: z.array(socketEntrySchema).max(32).optional(),
+    exec: z.array(z.string().trim().min(1).max(128)).max(32).optional(),
+}).strict().transform((value) => {
+    const next = {};
+    if (value.sockets && value.sockets.length > 0) {
+        next.sockets = value.sockets;
+    }
+    if (value.exec && value.exec.length > 0) {
+        next.exec = [...value.exec];
+    }
+    return next;
+});
+const serviceSchema = z.object({
+    entry: z.string().trim().refine(isSafeAssetPath),
+    runtime: z.literal('host'),
+    permissions: servicePermissionsSchema.optional(),
+});
+const uniqueBy = (items, key) => (new Set(items.map(key)).size === items.length);
+// `roles` only means something on a message action and `payload` only on a
+// session action; a dead field is a misconfiguration and fails closed.
+const actionSchema = z.object({
+    id: z.string().trim().regex(PANEL_ID).max(64),
+    label: z.string().trim().min(1).max(GUEST_ACTION_LABEL_MAX),
+    icon: z.string().trim().refine(isPanelIcon).optional(),
+    where: z.enum(['message', 'session']),
+    roles: z.array(z.enum(['user', 'assistant'])).min(1).max(2).optional(),
+    payload: z.array(z.enum(['messages'])).max(1).optional(),
+}).refine((value) => value.where === 'message' || value.roles === undefined, { path: ['roles'] })
+    .refine((value) => value.where === 'session' || value.payload === undefined, { path: ['payload'] });
+const actionsSchema = z.array(actionSchema).min(1).max(GUEST_ACTIONS_MAX)
+    .refine((actions) => uniqueBy(actions, (action) => action.id), { message: 'action ids must be unique' });
+const commandSchema = z.object({
+    name: z.string().trim().regex(GUEST_COMMAND_NAME),
+    description: z.string().trim().min(1).max(GUEST_COMMAND_DESCRIPTION_MAX).optional(),
+});
+const commandsSchema = z.array(commandSchema).min(1).max(GUEST_COMMANDS_MAX)
+    .refine((commands) => uniqueBy(commands, (command) => command.name), { message: 'command names must be unique' });
+// `language` only means something for `code` and `columns` only for `table`;
+// a table without columns has nothing to draw. Each is a misconfiguration
+// that fails closed instead of carrying a dead field.
+const toolSchema = z.object({
+    match: z.string().trim().min(1).max(GUEST_TOOL_MATCH_MAX).regex(GUEST_TOOL_MATCH),
+    name: z.string().trim().min(1).max(GUEST_TOOL_NAME_MAX).optional(),
+    icon: z.string().trim().refine(isPanelIcon).optional(),
+    title: z.string().trim().min(1).max(GUEST_TOOL_TEMPLATE_MAX).optional(),
+    subtitle: z.string().trim().min(1).max(GUEST_TOOL_TEMPLATE_MAX).optional(),
+    output: z.enum(GUEST_TOOL_OUTPUTS).optional(),
+    language: z.string().trim().min(1).max(GUEST_TOOL_LANGUAGE_MAX).optional(),
+    columns: z.array(z.string().trim().min(1).max(GUEST_TOOL_COLUMN_MAX)).min(1).max(GUEST_TOOL_COLUMNS_MAX).optional(),
+}).refine((value) => value.output === 'code' || value.language === undefined, { path: ['language'] })
+    .refine((value) => (value.output === 'table') === (value.columns !== undefined), { path: ['columns'] });
+const toolsSchema = z.array(toolSchema).min(1).max(GUEST_TOOLS_MAX);
+const contributesSchema = z.object({
+    panel: panelSchema,
+    attach: attachSchema.optional(),
+    page: z.union([z.literal(true), z.object({
+            entry: z.string().trim().refine(isSafeAssetPath),
+            title: z.string().trim().min(1).max(200).optional(),
+        })]).optional(),
+    capabilities: z.array(z.enum(DECLARED_GUEST_CAPABILITIES)).max(8).optional(),
+    integration: integrationSchema.optional(),
+    service: serviceSchema.optional(),
+    filesystem: z.array(z.string().max(GUEST_FILESYSTEM_PATTERN_MAX).refine(isGuestFilesystemPattern)).min(1).max(GUEST_FILESYSTEM_PATTERNS_MAX).optional(),
+    actions: actionsSchema.optional(),
+    commands: commandsSchema.optional(),
+    tools: toolsSchema.optional(),
+});
+/**
+ * Everything that only makes sense with an iframe to mount. Without
+ * `panel.entry` there is nothing to open from the rail, the + menu, a menu
+ * action, or a slash command, and nothing to hand a capability, a service,
+ * an integration, or a filesystem grant to; only `tools` stays meaningful.
+ */
+const pageOnlyContributions = (contributes) => {
+    const declared = [];
+    if (contributes.page !== undefined)
+        declared.push('page');
+    if (contributes.attach !== undefined && contributes.attach !== false)
+        declared.push('attach');
+    if (contributes.capabilities && contributes.capabilities.length > 0)
+        declared.push('capabilities');
+    if (contributes.integration !== undefined)
+        declared.push('integration');
+    if (contributes.service !== undefined)
+        declared.push('service');
+    if (contributes.filesystem !== undefined)
+        declared.push('filesystem');
+    if (contributes.actions !== undefined)
+        declared.push('actions');
+    if (contributes.commands !== undefined)
+        declared.push('commands');
+    return declared;
+};
+export const openChamberManifestSchema = z.object({
+    apiVersion: z.literal(OPENCHAMBER_SDK_MANIFEST_API_VERSIONS[0]),
+    engines: z.object({
+        openchamber: z.string().trim().regex(OPENCHAMBER_ENGINE_PATTERN),
+    }).strict().optional(),
+    contributes: contributesSchema.superRefine((contributes, ctx) => {
+        if (hasGuestPage(contributes))
+            return;
+        const needsPage = pageOnlyContributions(contributes);
+        if (needsPage.length === 0)
+            return;
+        ctx.addIssue({
+            code: 'custom',
+            path: ['panel'],
+            message: `${needsPage.map((key) => `contributes.${key}`).join(', ')} needs panel.entry; an extension without a page may only declare tools.`,
+        });
+    }),
+});
+export const PACKAGE_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const packageVersionSchema = z.string().trim().regex(PACKAGE_VERSION_PATTERN).max(64);
+export const packageManifestSchema = z.object({
+    version: packageVersionSchema.optional(),
+    openchamber: openChamberManifestSchema,
+});
+const packageEnvelopeSchema = z.union([
+    z.object({ openchamber: z.null() }),
+    z.object({ openchamber: z.object({}).passthrough() }),
+]);
+const fail = (code, message) => ({
+    ok: false,
+    code,
+    message,
+});
+const failureFromIssue = (issue) => {
+    // Paths are reported relative to the `openchamber` block whether the
+    // document was a bare manifest or a package.json envelope.
+    const segments = issue.path.map(String);
+    const path = (segments[0] === 'openchamber' ? segments.slice(1) : segments).join('.');
+    const isPackageEnvelope = segments[0] === 'openchamber';
+    if (!path && issue.code === 'invalid_type') {
+        return isPackageEnvelope
+            ? fail('missing-openchamber', 'package.json openchamber must be a plain object.')
+            : fail('not-object', 'Manifest must be a plain object.');
+    }
+    if (segments.length === 1 && segments[0] === 'version') {
+        return fail('invalid-version', 'package.json version must be semver like 1.0.0.');
+    }
+    if (path === 'apiVersion') {
+        return fail('unsupported-api-version', `Unsupported apiVersion. This host accepts ${OPENCHAMBER_SDK_MANIFEST_API_VERSIONS.join(' and ')}.`);
+    }
+    if (path === 'engines' || path.startsWith('engines.')) {
+        return fail('invalid-engines', 'engines.openchamber must be a version like 1.22.0 or >=1.22.0.');
+    }
+    if (path === 'contributes.panel' && issue.code === 'custom') {
+        return fail('invalid-panel', issue.message);
+    }
+    if (path === 'contributes' || path === 'contributes.panel') {
+        return fail('missing-panel', 'contributes.panel is required.');
+    }
+    switch (path) {
+        case 'contributes.panel.id':
+            return fail('invalid-panel-id', 'panel.id must be kebab-case starting with a letter.');
+        case 'contributes.panel.name':
+            return fail('invalid-panel-name', 'panel.name must be a non-empty string.');
+        case 'contributes.panel.icon':
+            return fail('invalid-panel-icon', 'panel.icon must be a Remixicon name or a package .svg path.');
+        case 'contributes.panel.entry':
+            return fail('invalid-panel-entry', 'panel.entry must be a relative path inside the package.');
+        case 'contributes.capabilities':
+            return fail('invalid-capabilities', 'contributes.capabilities may list "prompt", "sessions", and "files".');
+        default:
+            break;
+    }
+    if (path === 'contributes.page' || path.startsWith('contributes.page.')) {
+        return fail('invalid-page', 'contributes.page must be true or { entry: "<package HTML>", title?: "Page title" }.');
+    }
+    if (path === 'contributes.attach' || path.startsWith('contributes.attach.')) {
+        return fail('invalid-attach', 'contributes.attach must be true, false, "panel", "dialog", or { "mode": "panel" | "dialog", "entry"?: "<html inside the package, dialog only>" }.');
+    }
+    if (path.startsWith('contributes.capabilities')) {
+        return fail('invalid-capabilities', 'contributes.capabilities may list "prompt", "sessions", and "files".');
+    }
+    if (path.startsWith('contributes.filesystem')) {
+        return fail('invalid-filesystem', 'contributes.filesystem lists 1 to 16 patterns starting with "/" or "~/", without "..", empty segments, or backslashes.');
+    }
+    if (path.startsWith('contributes.actions')) {
+        return fail('invalid-actions', 'contributes.actions lists up to 8 entries with a unique kebab-case id, a label of 1 to 40 characters, where "message" or "session", optional roles (message only), and optional payload ["messages"] (session only).');
+    }
+    if (path.startsWith('contributes.commands')) {
+        return fail('invalid-commands', 'contributes.commands lists up to 8 entries with a unique name matching /^[a-z][a-z0-9-]{0,23}$/ and an optional description of 1 to 80 characters.');
+    }
+    if (path.startsWith('contributes.tools')) {
+        return fail('invalid-tools', 'contributes.tools lists up to 16 entries with a match of 1 to 128 characters ([A-Za-z0-9_.:-], "*" only at the end), optional name (1 to 40), icon (Remixicon name or package .svg path), title and subtitle templates (1 to 200), output "auto" | "text" | "json" | "markdown" | "code" | "table", language (code only), and columns (table only, 1 to 16).');
+    }
+    if (path.startsWith('contributes.integration')) {
+        return fail('invalid-integration', 'contributes.integration needs a name, description, and oauth, token, or host.');
+    }
+    if (path.startsWith('contributes.service')) {
+        return fail('invalid-service', 'contributes.service needs entry, runtime "host", and optional permissions.');
+    }
+    return fail('missing-panel', 'contributes.panel is required.');
+};
+const decodeManifest = (parsed) => {
+    if (parsed.success) {
+        return { ok: true, manifest: parsed.data };
+    }
+    const issue = parsed.error.issues[0];
+    if (!issue) {
+        return fail('not-object', 'Manifest must be a plain object.');
+    }
+    return failureFromIssue(issue);
+};
+export const parseManifest = (document) => {
+    if ('openchamber' in document) {
+        const parsed = packageManifestSchema.safeParse(document);
+        if (parsed.success) {
+            const success = {
+                ok: true,
+                manifest: parsed.data.openchamber,
+            };
+            if (parsed.data.version) {
+                success.version = parsed.data.version;
+            }
+            return success;
+        }
+        const issue = parsed.error.issues[0];
+        if (!issue) {
+            return fail('not-object', 'Manifest must be a plain object.');
+        }
+        return failureFromIssue(issue);
+    }
+    return decodeManifest(openChamberManifestSchema.safeParse(document));
+};
+export const parseManifestJson = (json) => {
+    try {
+        const raw = JSON.parse(json);
+        if (packageEnvelopeSchema.safeParse(raw).success) {
+            const parsed = packageManifestSchema.safeParse(raw);
+            if (parsed.success) {
+                const success = {
+                    ok: true,
+                    manifest: parsed.data.openchamber,
+                };
+                if (parsed.data.version) {
+                    success.version = parsed.data.version;
+                }
+                return success;
+            }
+            const issue = parsed.error.issues[0];
+            if (!issue) {
+                return fail('not-object', 'Manifest must be a plain object.');
+            }
+            return failureFromIssue(issue);
+        }
+        return decodeManifest(openChamberManifestSchema.safeParse(raw));
+    }
+    catch {
+        return fail('not-object', 'Manifest must be a plain object.');
+    }
+};