@openhands/agent-canvas 1.14.0 → 1.16.0

package/dist/manifests/manifest-validation.js

@@ -1,27 +1,27 @@
 import { SETUP_PLACEHOLDER_NAMESPACES as e } from "./types.js";
 //#region src/manifests/manifest-validation.ts
-var t = /^[a-z0-9]+(-[a-z0-9]+)*$/, n = /^[a-z][A-Za-z0-9]*$/, r = /<[A-Za-z/!]/, i = RegExp(`\\{\\{(?!(?:${e.join("|")})\\.[A-Za-z0-9_.]+\\}\\})`), a = ["direct", "assisted"], o = [
+var t = /^[a-z0-9]+(-[a-z0-9]+)*$/, n = /^[a-z][A-Za-z0-9]*$/, r = /<[A-Za-z/!]/, i = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*)?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/, a = /^[A-Za-z0-9 ._/-]+$/, o = /^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/, s = /^(skills|automations)\/[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/, c = RegExp(`\\{\\{(?!(?:${e.join("|")})\\.[A-Za-z0-9_.]+\\}\\})`), l = ["direct", "assisted"], u = [
 	"text",
 	"textarea",
 	"select",
 	"cron",
 	"timezone",
 	"repo-picker"
-], s = [
+], d = [
 	"github",
 	"gitlab",
 	"bitbucket"
-], c = ["cron", "event"], l = ["safeExpressionLiteral"], u = 2e3;
-function d(e) {
+], f = ["cron", "event"], p = ["safeExpressionLiteral"], m = 2e3;
+function h(e) {
 	return typeof e == "object" && !!e && !Array.isArray(e);
 }
-function f(e, t) {
+function g(e, t) {
 	return typeof e == "string" && t.includes(e);
 }
-function p(e, t) {
+function _(e, t) {
 	return typeof e == "number" && Number.isInteger(e) && e >= t;
 }
-var m = class {
+var v = class {
 	errors = [];
 	fail(e, t) {
 		return this.errors.push(`${e}: ${t}`), !1;
@@ -30,7 +30,7 @@ var m = class {
 		return typeof e != "string" || e.length === 0 ? this.fail(t, "must be a non-empty string") : r.test(e) ? this.fail(t, "must not contain markup") : !0;
 	}
 	placeholders(e, t) {
-		return i.test(e) ? this.fail(t, "uses an unknown placeholder namespace") : !0;
+		return c.test(e) ? this.fail(t, "uses an unknown placeholder namespace") : !0;
 	}
 	templateCopy(e, t) {
 		return this.copy(e, t) && this.placeholders(e, t);
@@ -42,93 +42,126 @@ var m = class {
 		return t in e ? this.fail(`${n}.${t}`, r) : !0;
 	}
 };
-function h(e, t) {
-	if (!d(t)) {
+function y(e, t) {
+	return typeof e == "string" && t.test(e) && !e.split("/").some((e) => e === "." || e === "..");
+}
+function b(e) {
+	if (typeof e != "string" || !a.test(e)) return !1;
+	let t = e.split(" ").filter((e) => e.length > 0);
+	return t.length > 0 && t.every((e) => !e.startsWith("/") && !e.split("/").some((e) => e === ".."));
+}
+function x(e, t) {
+	if (!h(t)) {
 		e.fail("requires", "must be an object");
 		return;
 	}
 	let { integrations: n, features: r } = t;
-	!d(n) || Object.keys(n).length === 0 ? e.fail("requires.integrations", "must be a non-empty object") : Object.entries(n).forEach(([t, n]) => {
+	h(n) ? Object.entries(n).forEach(([t, n]) => {
 		let r = `requires.integrations.${t}`;
-		if (!d(n)) {
+		if (!h(n)) {
 			e.fail(r, "must be an object");
 			return;
 		}
 		e.copy(n.message, `${r}.message`), "required" in n && n.required !== !1 && e.fail(`${r}.required`, "may only be false");
 		let i = ["message", "required"];
 		Object.keys(n).filter((e) => !i.includes(e)).forEach((t) => e.fail(`${r}.${t}`, "is not allowed"));
-	}), r !== void 0 && (!Array.isArray(r) || r.length === 0 ? e.fail("requires.features", "must be a non-empty array") : r.forEach((t, n) => {
+	}) : e.fail("requires.integrations", "must be an object"), r !== void 0 && (!Array.isArray(r) || r.length === 0 ? e.fail("requires.features", "must be a non-empty array") : r.forEach((t, n) => {
 		(typeof t != "string" || t.length === 0) && e.fail(`requires.features[${n}]`, "must be a non-empty string");
 	}));
 }
-function g(e, t, n) {
-	if (!d(t) || Object.keys(t).length === 0) {
+function S(e, t, n) {
+	if (!h(t) || Object.keys(t).length === 0) {
 		e.fail(n, "must be a non-empty object");
 		return;
 	}
 	let { minLength: r, maxLength: i, format: a } = t;
-	r !== void 0 && !p(r, 0) && e.fail(`${n}.minLength`, "must be a non-negative integer"), i !== void 0 && !p(i, 1) && e.fail(`${n}.maxLength`, "must be a positive integer"), a !== void 0 && !f(a, l) && e.fail(`${n}.format`, "is not a supported format");
+	r !== void 0 && !_(r, 0) && e.fail(`${n}.minLength`, "must be a non-negative integer"), i !== void 0 && !_(i, 1) && e.fail(`${n}.maxLength`, "must be a positive integer"), a !== void 0 && !g(a, p) && e.fail(`${n}.format`, "is not a supported format");
 }
-function _(e, t, n) {
-	if (!d(t)) {
+function C(e, t, n) {
+	if (!h(t)) {
 		e.fail(n, "must be an object");
 		return;
 	}
-	let { type: r, label: i, help: a, placeholder: c, required: l, provider: u, options: p } = t;
-	f(r, o) || e.fail(`${n}.type`, "is not a supported field type"), e.copy(i, `${n}.label`), e.copy(a, `${n}.help`), c !== void 0 && e.copy(c, `${n}.placeholder`), t.default !== void 0 && typeof t.default != "string" && e.fail(`${n}.default`, "must be a string"), typeof l != "boolean" && e.fail(`${n}.required`, "must be a boolean"), u !== void 0 && !f(u, s) && e.fail(`${n}.provider`, "is not a supported provider"), r === "repo-picker" && u === void 0 && e.fail(`${n}.provider`, "is required for a repository field"), p !== void 0 && (r === "select" ? !Array.isArray(p) || p.length === 0 ? e.fail(`${n}.options`, "must be a non-empty array") : p.forEach((t, r) => {
+	let { type: r, label: i, help: a, placeholder: o, required: s, provider: c, options: l } = t;
+	g(r, u) || e.fail(`${n}.type`, "is not a supported field type"), e.copy(i, `${n}.label`), e.copy(a, `${n}.help`), o !== void 0 && e.copy(o, `${n}.placeholder`), t.default !== void 0 && typeof t.default != "string" && e.fail(`${n}.default`, "must be a string"), typeof s != "boolean" && e.fail(`${n}.required`, "must be a boolean"), c !== void 0 && !g(c, d) && e.fail(`${n}.provider`, "is not a supported provider"), r === "repo-picker" && c === void 0 && e.fail(`${n}.provider`, "is required for a repository field"), t.multiple !== void 0 && (t.multiple !== !0 || r !== "repo-picker") && e.fail(`${n}.multiple`, "may only be true, and only on a repository field"), l !== void 0 && (r === "select" ? !Array.isArray(l) || l.length === 0 ? e.fail(`${n}.options`, "must be a non-empty array") : l.forEach((t, r) => {
 		let i = `${n}.options[${r}]`;
-		if (!d(t)) {
+		if (!h(t)) {
 			e.fail(i, "must be an object");
 			return;
 		}
 		(typeof t.value != "string" || t.value.length === 0) && e.fail(`${i}.value`, "must be a non-empty string"), e.copy(t.label, `${i}.label`);
-	}) : e.fail(`${n}.options`, "is only allowed on a select field")), t.constraints !== void 0 && g(e, t.constraints, `${n}.constraints`);
+	}) : e.fail(`${n}.options`, "is only allowed on a select field")), t.constraints !== void 0 && S(e, t.constraints, `${n}.constraints`);
 }
-function v(e, t, r) {
-	return !d(t) || Object.keys(t).length === 0 ? (e.fail(r, "must be a non-empty object"), []) : Object.entries(t).map(([t, i]) => (n.test(t) || e.fail(`${r}.${t}`, "is not a valid field name"), _(e, i, `${r}.${t}`), t));
+function w(e, t, r) {
+	return !h(t) || Object.keys(t).length === 0 ? (e.fail(r, "must be a non-empty object"), []) : Object.entries(t).map(([t, i]) => (n.test(t) || e.fail(`${r}.${t}`, "is not a valid field name"), C(e, i, `${r}.${t}`), t));
 }
-function y(e, t) {
-	if (!d(t)) return e.fail("setup.form", "must be an object"), [];
+function T(e, t) {
+	if (!h(t)) return e.fail("setup.form", "must be an object"), [];
 	t.note !== void 0 && e.copy(t.note, "setup.form.note");
-	let n = v(e, t.args, "setup.form.args"), r = [];
-	t.triggers !== void 0 && (!d(t.triggers) || Object.keys(t.triggers).length === 0 ? e.fail("setup.form.triggers", "must be a non-empty object") : Object.entries(t.triggers).forEach(([t, i]) => {
-		if (!f(t, c)) {
+	let n = w(e, t.args, "setup.form.args"), r = [];
+	t.triggers !== void 0 && (!h(t.triggers) || Object.keys(t.triggers).length === 0 ? e.fail("setup.form.triggers", "must be a non-empty object") : Object.entries(t.triggers).forEach(([t, i]) => {
+		if (!g(t, f)) {
 			e.fail(`setup.form.triggers.${t}`, "is not a trigger kind");
 			return;
 		}
-		r.push(t), n.push(...v(e, i, `setup.form.triggers.${t}`));
+		r.push(t), n.push(...w(e, i, `setup.form.triggers.${t}`));
 	}));
 	let i = n.filter((e, t) => n.indexOf(e) !== t);
 	return Array.from(new Set(i)).forEach((t) => e.fail(`setup.form.${t}`, "is declared more than once")), r;
 }
-function b(e) {
-	return d(e) ? [e.args, ...Object.values(d(e.triggers) ? e.triggers : {})].some((e) => d(e) && Object.values(e).some((e) => d(e) && e.type === "repo-picker")) : !1;
+function E(e) {
+	return h(e) ? [e.args, ...Object.values(h(e.triggers) ? e.triggers : {})].some((e) => h(e) && Object.values(e).some((e) => h(e) && e.type === "repo-picker")) : !1;
 }
-function x(e, t) {
-	e.templateCopy(t, "setup.message") && t.length > u && e.fail("setup.message", `must be at most ${u} characters`);
+function D(e, t) {
+	e.templateCopy(t, "setup.message") && t.length > m && e.fail("setup.message", `must be at most ${m} characters`);
 }
-function S(e, t, n) {
-	if (!f(t.mode, a)) {
+function O(e, t) {
+	if (!h(t)) {
+		e.fail("setup.bundle", "must be an object");
+		return;
+	}
+	(typeof t.version != "string" || !i.test(t.version)) && e.fail("setup.bundle.version", "must be a semantic version"), b(t.entrypoint) || e.fail("setup.bundle.entrypoint", "must be a plain command that stays inside the archive"), t.setupScript !== void 0 && !y(t.setupScript, o) && e.fail("setup.bundle.setupScript", "must be a relative path"), t.timeout !== void 0 && !_(t.timeout, 1) && e.fail("setup.bundle.timeout", "must be a positive integer"), !h(t.files) || Object.keys(t.files).length === 0 ? e.fail("setup.bundle.files", "must be a non-empty object") : (Object.entries(t.files).forEach(([t, n]) => {
+		y(t, o) || e.fail(`setup.bundle.files.${t}`, "is not a packed path"), t === "config.json" && e.fail(`setup.bundle.files.${t}`, "is the name the rendered config is packed under"), y(n, s) || e.fail(`setup.bundle.files.${t}`, "must name a file under skills/ or automations/");
+	}), typeof t.setupScript == "string" && !(t.setupScript in t.files) && e.fail("setup.bundle.setupScript", "must name a packed file")), !h(t.config) || Object.keys(t.config).length === 0 ? e.fail("setup.bundle.config", "must be a non-empty object") : k(e, t.config, "setup.bundle.config");
+}
+function k(e, t, n) {
+	if (typeof t == "string") {
+		e.templateValue(t, n);
+		return;
+	}
+	if (Array.isArray(t)) {
+		t.forEach((t, r) => k(e, t, `${n}[${r}]`));
+		return;
+	}
+	if (h(t)) {
+		Object.entries(t).forEach(([t, r]) => k(e, r, `${n}.${t}`));
+		return;
+	}
+	t !== null && typeof t != "number" && typeof t != "boolean" && e.fail(n, "must be a string, number, boolean, null, array or object");
+}
+function A(e, t, n) {
+	if (!g(t.mode, l)) {
 		e.fail("setup.mode", "is not a supported mode");
 		return;
 	}
 	if (t.mode === "direct") {
-		e.templateValue(t.prompt, "setup.prompt"), t.message !== void 0 && x(e, t.message), n.length !== 1 && e.fail("setup.form.triggers", "must declare exactly one trigger kind"), n.includes("event") && !b(t.form) && e.fail("setup.form", "must declare a repository field for an event trigger"), t.filter !== void 0 && (n.includes("event") ? e.templateValue(t.filter, "setup.filter") : e.fail("setup.filter", "is only allowed for an event trigger"));
+		let r = t.prompt !== void 0, i = t.bundle !== void 0;
+		r === i ? e.fail("setup", "must declare exactly one of prompt or bundle for direct setup") : i ? O(e, t.bundle) : e.templateValue(t.prompt, "setup.prompt"), t.message !== void 0 && D(e, t.message), n.length !== 1 && e.fail("setup.form.triggers", "must declare exactly one trigger kind"), n.includes("event") && !E(t.form) && e.fail("setup.form", "must declare a repository field for an event trigger"), t.filter !== void 0 && (n.includes("event") ? e.templateValue(t.filter, "setup.filter") : e.fail("setup.filter", "is only allowed for an event trigger"));
 		return;
 	}
-	x(e, t.message), e.absent(t, "prompt", "setup", "is only allowed for direct setup"), e.absent(t, "filter", "setup", "is only allowed for direct setup");
+	D(e, t.message), e.absent(t, "prompt", "setup", "is only allowed for direct setup"), e.absent(t, "bundle", "setup", "is only allowed for direct setup"), e.absent(t, "filter", "setup", "is only allowed for direct setup");
 }
-function C(e) {
-	return d(e) && e.setup !== void 0;
+function j(e) {
+	return h(e) && e.setup !== void 0;
 }
-function w(e) {
-	let n = new m();
-	if (!d(e)) return {
+function M(e) {
+	let n = new v();
+	if (!h(e)) return {
 		valid: !1,
 		errors: ["manifest: must be an object"]
 	};
 	let { setup: r } = e;
-	return d(r) ? r.version === "1.0" ? ((typeof e.id != "string" || !t.test(e.id)) && n.fail("id", "must be a lowercase slug"), n.copy(e.name, "name"), n.copy(e.description, "description"), e.skill !== void 0 && (typeof e.skill != "string" || !t.test(e.skill)) && n.fail("skill", "must be a lowercase slug"), h(n, e.requires), S(n, r, y(n, r.form)), {
+	return h(r) ? r.version === "1.0" ? ((typeof e.id != "string" || !t.test(e.id)) && n.fail("id", "must be a lowercase slug"), n.copy(e.name, "name"), n.copy(e.description, "description"), e.version !== void 0 && (typeof e.version != "string" || !i.test(e.version)) && n.fail("version", "must be a semantic version"), e.skill !== void 0 && (typeof e.skill != "string" || !t.test(e.skill)) && n.fail("skill", "must be a lowercase slug"), x(n, e.requires), A(n, r, T(n, r.form)), {
 		valid: n.errors.length === 0,
 		errors: n.errors
 	}) : {
@@ -140,6 +173,6 @@ function w(e) {
 	};
 }
 //#endregion
-export { C as hasSetupBlock, w as validateSetupEntry };
+export { j as hasSetupBlock, M as validateSetupEntry };
 
 //# sourceMappingURL=manifest-validation.js.map

package/dist/manifests/manifest-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-validation.js","names":[],"sources":["../../src/manifests/manifest-validation.ts"],"sourcesContent":["/**\n * Admission policy for extension-authored catalog manifests.\n *\n * A manifest is data authored in a different repository that instructs this host\n * to render copy and compose a request. The host therefore decides what a\n * manifest is *permitted* to do rather than trusting the file — validation here\n * is a trust boundary, not a convenience check, and it deliberately does not\n * defer to a schema shipped alongside the manifests it would be validating.\n *\n * Beyond mirroring the published schema, this adds the invariants the host's own\n * derivation depends on: a single trigger kind to read, a repository field for\n * an event trigger's source, and field names unique across the form. Without\n * them the derived request body would be silently wrong rather than rejected.\n *\n * A manifest that fails any check is rejected outright. It never renders a\n * partial UI, because everything downstream treats its content as instructions.\n */\n\nimport { SETUP_PLACEHOLDER_NAMESPACES, SETUP_VERSION } from \"./types\";\n\nconst ENTRY_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;\nconst FIELD_NAME_PATTERN = /^[a-z][A-Za-z0-9]*$/;\n/** Copy must never be able to inject markup into the host. */\nconst MARKUP_PATTERN = /<[A-Za-z/!]/;\n/** Every `{{` must open a known namespace and close immediately. */\nconst UNKNOWN_PLACEHOLDER_PATTERN = new RegExp(\n  `\\\\{\\\\{(?!(?:${SETUP_PLACEHOLDER_NAMESPACES.join(\"|\")})\\\\.[A-Za-z0-9_.]+\\\\}\\\\})`,\n);\n\nconst SETUP_MODES = [\"direct\", \"assisted\"] as const;\nconst FIELD_TYPES = [\n  \"text\",\n  \"textarea\",\n  \"select\",\n  \"cron\",\n  \"timezone\",\n  \"repo-picker\",\n] as const;\nconst GIT_PROVIDERS = [\"github\", \"gitlab\", \"bitbucket\"] as const;\nconst TRIGGER_KINDS = [\"cron\", \"event\"] as const;\nconst CONSTRAINT_FORMATS = [\"safeExpressionLiteral\"] as const;\n\n/** Setup context only, so this can never become a channel for runtime instructions. */\nconst MAX_MESSAGE_LENGTH = 2000;\n\nexport interface SetupValidationResult {\n  valid: boolean;\n  errors: string[];\n}\n\ntype Rec = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is Rec {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isOneOf<T extends readonly string[]>(\n  value: unknown,\n  allowed: T,\n): value is T[number] {\n  return (\n    typeof value === \"string\" && (allowed as readonly string[]).includes(value)\n  );\n}\n\nfunction isInteger(value: unknown, minimum: number): boolean {\n  return (\n    typeof value === \"number\" && Number.isInteger(value) && value >= minimum\n  );\n}\n\nclass SetupChecker {\n  readonly errors: string[] = [];\n\n  fail(path: string, reason: string): false {\n    this.errors.push(`${path}: ${reason}`);\n    return false;\n  }\n\n  /** Literal user-visible copy. Carries no markup. */\n  copy(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    if (MARKUP_PATTERN.test(value)) {\n      return this.fail(path, \"must not contain markup\");\n    }\n    return true;\n  }\n\n  placeholders(value: string, path: string): boolean {\n    if (UNKNOWN_PLACEHOLDER_PATTERN.test(value)) {\n      return this.fail(path, \"uses an unknown placeholder namespace\");\n    }\n    return true;\n  }\n\n  /** Copy that may embed `{{namespace.key}}` placeholders. */\n  templateCopy(value: unknown, path: string): boolean {\n    return this.copy(value, path) && this.placeholders(value as string, path);\n  }\n\n  /**\n   * A request-body string that may embed placeholders. Never rendered, so\n   * expression syntax such as a JMESPath filter is allowed through.\n   */\n  templateValue(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    return this.placeholders(value, path);\n  }\n\n  absent(container: Rec, key: string, path: string, reason: string): boolean {\n    if (key in container) return this.fail(`${path}.${key}`, reason);\n    return true;\n  }\n}\n\nfunction checkRequires(check: SetupChecker, requires: unknown): void {\n  if (!isRecord(requires)) {\n    check.fail(\"requires\", \"must be an object\");\n    return;\n  }\n\n  const { integrations, features } = requires;\n  if (!isRecord(integrations) || Object.keys(integrations).length === 0) {\n    check.fail(\"requires.integrations\", \"must be a non-empty object\");\n  } else {\n    Object.entries(integrations).forEach(([id, requirement]) => {\n      const path = `requires.integrations.${id}`;\n      if (!isRecord(requirement)) {\n        check.fail(path, \"must be an object\");\n        return;\n      }\n      check.copy(requirement.message, `${path}.message`);\n      if (\"required\" in requirement && requirement.required !== false) {\n        check.fail(`${path}.required`, \"may only be false\");\n      }\n      const allowed = [\"message\", \"required\"];\n      Object.keys(requirement)\n        .filter((key) => !allowed.includes(key))\n        .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n    });\n  }\n\n  if (features !== undefined) {\n    if (!Array.isArray(features) || features.length === 0) {\n      check.fail(\"requires.features\", \"must be a non-empty array\");\n    } else {\n      features.forEach((feature, index) => {\n        if (typeof feature !== \"string\" || feature.length === 0) {\n          check.fail(\n            `requires.features[${index}]`,\n            \"must be a non-empty string\",\n          );\n        }\n      });\n    }\n  }\n}\n\nfunction checkConstraints(\n  check: SetupChecker,\n  constraints: unknown,\n  path: string,\n): void {\n  if (!isRecord(constraints) || Object.keys(constraints).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return;\n  }\n\n  const { minLength, maxLength, format } = constraints;\n  if (minLength !== undefined && !isInteger(minLength, 0)) {\n    check.fail(`${path}.minLength`, \"must be a non-negative integer\");\n  }\n  if (maxLength !== undefined && !isInteger(maxLength, 1)) {\n    check.fail(`${path}.maxLength`, \"must be a positive integer\");\n  }\n  if (format !== undefined && !isOneOf(format, CONSTRAINT_FORMATS)) {\n    check.fail(`${path}.format`, \"is not a supported format\");\n  }\n}\n\nfunction checkField(check: SetupChecker, field: unknown, path: string): void {\n  if (!isRecord(field)) {\n    check.fail(path, \"must be an object\");\n    return;\n  }\n\n  const { type, label, help, placeholder, required, provider, options } = field;\n\n  if (!isOneOf(type, FIELD_TYPES)) {\n    check.fail(`${path}.type`, \"is not a supported field type\");\n  }\n  check.copy(label, `${path}.label`);\n  check.copy(help, `${path}.help`);\n  if (placeholder !== undefined) check.copy(placeholder, `${path}.placeholder`);\n  if (field.default !== undefined && typeof field.default !== \"string\") {\n    check.fail(`${path}.default`, \"must be a string\");\n  }\n  if (typeof required !== \"boolean\") {\n    check.fail(`${path}.required`, \"must be a boolean\");\n  }\n  if (provider !== undefined && !isOneOf(provider, GIT_PROVIDERS)) {\n    check.fail(`${path}.provider`, \"is not a supported provider\");\n  }\n  if (type === \"repo-picker\" && provider === undefined) {\n    check.fail(`${path}.provider`, \"is required for a repository field\");\n  }\n\n  if (options !== undefined) {\n    if (type !== \"select\") {\n      check.fail(`${path}.options`, \"is only allowed on a select field\");\n    } else if (!Array.isArray(options) || options.length === 0) {\n      check.fail(`${path}.options`, \"must be a non-empty array\");\n    } else {\n      options.forEach((option, index) => {\n        const optionPath = `${path}.options[${index}]`;\n        if (!isRecord(option)) {\n          check.fail(optionPath, \"must be an object\");\n          return;\n        }\n        if (typeof option.value !== \"string\" || option.value.length === 0) {\n          check.fail(`${optionPath}.value`, \"must be a non-empty string\");\n        }\n        check.copy(option.label, `${optionPath}.label`);\n      });\n    }\n  }\n\n  if (field.constraints !== undefined) {\n    checkConstraints(check, field.constraints, `${path}.constraints`);\n  }\n}\n\n/** Returns the declared field names, so the caller can check them for collisions. */\nfunction checkFields(\n  check: SetupChecker,\n  fields: unknown,\n  path: string,\n): string[] {\n  if (!isRecord(fields) || Object.keys(fields).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return [];\n  }\n\n  return Object.entries(fields).map(([name, field]) => {\n    if (!FIELD_NAME_PATTERN.test(name)) {\n      check.fail(`${path}.${name}`, \"is not a valid field name\");\n    }\n    checkField(check, field, `${path}.${name}`);\n    return name;\n  });\n}\n\n/** Returns the trigger kinds declared, in order. */\nfunction checkForm(check: SetupChecker, form: unknown): string[] {\n  if (!isRecord(form)) {\n    check.fail(\"setup.form\", \"must be an object\");\n    return [];\n  }\n\n  if (form.note !== undefined) check.copy(form.note, \"setup.form.note\");\n\n  const names = checkFields(check, form.args, \"setup.form.args\");\n  const kinds: string[] = [];\n\n  if (form.triggers !== undefined) {\n    if (!isRecord(form.triggers) || Object.keys(form.triggers).length === 0) {\n      check.fail(\"setup.form.triggers\", \"must be a non-empty object\");\n    } else {\n      Object.entries(form.triggers).forEach(([kind, fields]) => {\n        if (!isOneOf(kind, TRIGGER_KINDS)) {\n          check.fail(`setup.form.triggers.${kind}`, \"is not a trigger kind\");\n          return;\n        }\n        kinds.push(kind);\n        names.push(\n          ...checkFields(check, fields, `setup.form.triggers.${kind}`),\n        );\n      });\n    }\n  }\n\n  // The host merges both halves into one value map, so a repeated name would\n  // silently shadow a field and misaddress every error reported against it.\n  const duplicates = names.filter(\n    (name, index) => names.indexOf(name) !== index,\n  );\n  Array.from(new Set(duplicates)).forEach((name) =>\n    check.fail(`setup.form.${name}`, \"is declared more than once\"),\n  );\n\n  return kinds;\n}\n\nfunction hasRepoPicker(form: unknown): boolean {\n  if (!isRecord(form)) return false;\n  const groups = [\n    form.args,\n    ...Object.values(isRecord(form.triggers) ? form.triggers : {}),\n  ];\n  return groups.some(\n    (group) =>\n      isRecord(group) &&\n      Object.values(group).some(\n        (field) => isRecord(field) && field.type === \"repo-picker\",\n      ),\n  );\n}\n\nfunction checkMessage(check: SetupChecker, message: unknown): void {\n  if (check.templateCopy(message, \"setup.message\")) {\n    if ((message as string).length > MAX_MESSAGE_LENGTH) {\n      check.fail(\n        \"setup.message\",\n        `must be at most ${MAX_MESSAGE_LENGTH} characters`,\n      );\n    }\n  }\n}\n\nfunction checkMode(check: SetupChecker, setup: Rec, kinds: string[]): void {\n  if (!isOneOf(setup.mode, SETUP_MODES)) {\n    check.fail(\"setup.mode\", \"is not a supported mode\");\n    return;\n  }\n\n  if (setup.mode === \"direct\") {\n    check.templateValue(setup.prompt, \"setup.prompt\");\n    // A direct entry may carry a fallback-conversation seed for deployments\n    // that cannot run the direct path, held to the same rules as an assisted\n    // message.\n    if (setup.message !== undefined) checkMessage(check, setup.message);\n\n    // The derivation reads a single trigger kind, and an event trigger takes\n    // its source from the repository field's provider.\n    if (kinds.length !== 1) {\n      check.fail(\n        \"setup.form.triggers\",\n        \"must declare exactly one trigger kind\",\n      );\n    }\n    if (kinds.includes(\"event\") && !hasRepoPicker(setup.form)) {\n      check.fail(\n        \"setup.form\",\n        \"must declare a repository field for an event trigger\",\n      );\n    }\n    if (setup.filter !== undefined) {\n      if (!kinds.includes(\"event\")) {\n        check.fail(\"setup.filter\", \"is only allowed for an event trigger\");\n      } else {\n        check.templateValue(setup.filter, \"setup.filter\");\n      }\n    }\n    return;\n  }\n\n  checkMessage(check, setup.message);\n  check.absent(setup, \"prompt\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"filter\", \"setup\", \"is only allowed for direct setup\");\n}\n\n/** Whether a catalog entry ships a setup experience at all. It is optional. */\nexport function hasSetupBlock(candidate: unknown): boolean {\n  return isRecord(candidate) && candidate.setup !== undefined;\n}\n\n/**\n * Decide whether this host will act on a catalog manifest.\n *\n * The version is checked first and fails closed: a format this host does not\n * recognise is refused rather than interpreted with today's rules.\n */\nexport function validateSetupEntry(candidate: unknown): SetupValidationResult {\n  const check = new SetupChecker();\n\n  if (!isRecord(candidate)) {\n    return { valid: false, errors: [\"manifest: must be an object\"] };\n  }\n\n  const { setup } = candidate;\n  if (!isRecord(setup)) {\n    return { valid: false, errors: [\"setup: must be an object\"] };\n  }\n  if (setup.version !== SETUP_VERSION) {\n    return {\n      valid: false,\n      errors: [`setup.version: must be \"${SETUP_VERSION}\"`],\n    };\n  }\n\n  if (\n    typeof candidate.id !== \"string\" ||\n    !ENTRY_ID_PATTERN.test(candidate.id)\n  ) {\n    check.fail(\"id\", \"must be a lowercase slug\");\n  }\n  check.copy(candidate.name, \"name\");\n  check.copy(candidate.description, \"description\");\n  if (\n    candidate.skill !== undefined &&\n    (typeof candidate.skill !== \"string\" ||\n      !ENTRY_ID_PATTERN.test(candidate.skill))\n  ) {\n    check.fail(\"skill\", \"must be a lowercase slug\");\n  }\n\n  checkRequires(check, candidate.requires);\n  const kinds = checkForm(check, setup.form);\n  checkMode(check, setup, kinds);\n\n  return { valid: check.errors.length === 0, errors: check.errors };\n}\n"],"mappings":";;AAoBA,IAAM,IAAmB,4BACnB,IAAqB,uBAErB,IAAiB,eAEjB,IAAkC,OACtC,eAAe,EAA6B,KAAK,GAAG,EAAE,0BACxD,GAEM,IAAc,CAAC,UAAU,UAAU,GACnC,IAAc;CAClB;CACA;CACA;CACA;CACA;CACA;AACF,GACM,IAAgB;CAAC;CAAU;CAAU;AAAW,GAChD,IAAgB,CAAC,QAAQ,OAAO,GAChC,IAAqB,CAAC,uBAAuB,GAG7C,IAAqB;AAS3B,SAAS,EAAS,GAA8B;CAC9C,OAAO,OAAO,KAAU,cAAY,KAAkB,CAAC,MAAM,QAAQ,CAAK;AAC5E;AAEA,SAAS,EACP,GACA,GACoB;CACpB,OACE,OAAO,KAAU,YAAa,EAA8B,SAAS,CAAK;AAE9E;AAEA,SAAS,EAAU,GAAgB,GAA0B;CAC3D,OACE,OAAO,KAAU,YAAY,OAAO,UAAU,CAAK,KAAK,KAAS;AAErE;AAEA,IAAM,IAAN,MAAmB;CACjB,SAA4B,CAAC;CAE7B,KAAK,GAAc,GAAuB;EAExC,OADA,KAAK,OAAO,KAAK,GAAG,EAAK,IAAI,GAAQ,GAC9B;CACT;CAGA,KAAK,GAAgB,GAAuB;EAO1C,OANI,OAAO,KAAU,YAAY,EAAM,WAAW,IACzC,KAAK,KAAK,GAAM,4BAA4B,IAEjD,EAAe,KAAK,CAAK,IACpB,KAAK,KAAK,GAAM,yBAAyB,IAE3C;CACT;CAEA,aAAa,GAAe,GAAuB;EAIjD,OAHI,EAA4B,KAAK,CAAK,IACjC,KAAK,KAAK,GAAM,uCAAuC,IAEzD;CACT;CAGA,aAAa,GAAgB,GAAuB;EAClD,OAAO,KAAK,KAAK,GAAO,CAAI,KAAK,KAAK,aAAa,GAAiB,CAAI;CAC1E;CAMA,cAAc,GAAgB,GAAuB;EAInD,OAHI,OAAO,KAAU,YAAY,EAAM,WAAW,IACzC,KAAK,KAAK,GAAM,4BAA4B,IAE9C,KAAK,aAAa,GAAO,CAAI;CACtC;CAEA,OAAO,GAAgB,GAAa,GAAc,GAAyB;EAEzE,OADI,KAAO,IAAkB,KAAK,KAAK,GAAG,EAAK,GAAG,KAAO,CAAM,IACxD;CACT;AACF;AAEA,SAAS,EAAc,GAAqB,GAAyB;CACnE,IAAI,CAAC,EAAS,CAAQ,GAAG;EACvB,EAAM,KAAK,YAAY,mBAAmB;EAC1C;CACF;CAEA,IAAM,EAAE,iBAAc,gBAAa;CAqBnC,AApBI,CAAC,EAAS,CAAY,KAAK,OAAO,KAAK,CAAY,EAAE,WAAW,IAClE,EAAM,KAAK,yBAAyB,4BAA4B,IAEhE,OAAO,QAAQ,CAAY,EAAE,SAAS,CAAC,GAAI,OAAiB;EAC1D,IAAM,IAAO,yBAAyB;EACtC,IAAI,CAAC,EAAS,CAAW,GAAG;GAC1B,EAAM,KAAK,GAAM,mBAAmB;GACpC;EACF;EAEA,AADA,EAAM,KAAK,EAAY,SAAS,GAAG,EAAK,SAAS,GAC7C,cAAc,KAAe,EAAY,aAAa,MACxD,EAAM,KAAK,GAAG,EAAK,YAAY,mBAAmB;EAEpD,IAAM,IAAU,CAAC,WAAW,UAAU;EACtC,OAAO,KAAK,CAAW,EACpB,QAAQ,MAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,SAAS,MAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,KAAO,gBAAgB,CAAC;CACpE,CAAC,GAGC,MAAa,KAAA,MACX,CAAC,MAAM,QAAQ,CAAQ,KAAK,EAAS,WAAW,IAClD,EAAM,KAAK,qBAAqB,2BAA2B,IAE3D,EAAS,SAAS,GAAS,MAAU;EACnC,CAAI,OAAO,KAAY,YAAY,EAAQ,WAAW,MACpD,EAAM,KACJ,qBAAqB,EAAM,IAC3B,4BACF;CAEJ,CAAC;AAGP;AAEA,SAAS,EACP,GACA,GACA,GACM;CACN,IAAI,CAAC,EAAS,CAAW,KAAK,OAAO,KAAK,CAAW,EAAE,WAAW,GAAG;EACnE,EAAM,KAAK,GAAM,4BAA4B;EAC7C;CACF;CAEA,IAAM,EAAE,cAAW,cAAW,cAAW;CAOzC,AANI,MAAc,KAAA,KAAa,CAAC,EAAU,GAAW,CAAC,KACpD,EAAM,KAAK,GAAG,EAAK,aAAa,gCAAgC,GAE9D,MAAc,KAAA,KAAa,CAAC,EAAU,GAAW,CAAC,KACpD,EAAM,KAAK,GAAG,EAAK,aAAa,4BAA4B,GAE1D,MAAW,KAAA,KAAa,CAAC,EAAQ,GAAQ,CAAkB,KAC7D,EAAM,KAAK,GAAG,EAAK,UAAU,2BAA2B;AAE5D;AAEA,SAAS,EAAW,GAAqB,GAAgB,GAAoB;CAC3E,IAAI,CAAC,EAAS,CAAK,GAAG;EACpB,EAAM,KAAK,GAAM,mBAAmB;EACpC;CACF;CAEA,IAAM,EAAE,SAAM,UAAO,SAAM,gBAAa,aAAU,aAAU,eAAY;CAyCxE,AAvCK,EAAQ,GAAM,CAAW,KAC5B,EAAM,KAAK,GAAG,EAAK,QAAQ,+BAA+B,GAE5D,EAAM,KAAK,GAAO,GAAG,EAAK,OAAO,GACjC,EAAM,KAAK,GAAM,GAAG,EAAK,MAAM,GAC3B,MAAgB,KAAA,KAAW,EAAM,KAAK,GAAa,GAAG,EAAK,aAAa,GACxE,EAAM,YAAY,KAAA,KAAa,OAAO,EAAM,WAAY,YAC1D,EAAM,KAAK,GAAG,EAAK,WAAW,kBAAkB,GAE9C,OAAO,KAAa,aACtB,EAAM,KAAK,GAAG,EAAK,YAAY,mBAAmB,GAEhD,MAAa,KAAA,KAAa,CAAC,EAAQ,GAAU,CAAa,KAC5D,EAAM,KAAK,GAAG,EAAK,YAAY,6BAA6B,GAE1D,MAAS,iBAAiB,MAAa,KAAA,KACzC,EAAM,KAAK,GAAG,EAAK,YAAY,oCAAoC,GAGjE,MAAY,KAAA,MACV,MAAS,WAEF,CAAC,MAAM,QAAQ,CAAO,KAAK,EAAQ,WAAW,IACvD,EAAM,KAAK,GAAG,EAAK,WAAW,2BAA2B,IAEzD,EAAQ,SAAS,GAAQ,MAAU;EACjC,IAAM,IAAa,GAAG,EAAK,WAAW,EAAM;EAC5C,IAAI,CAAC,EAAS,CAAM,GAAG;GACrB,EAAM,KAAK,GAAY,mBAAmB;GAC1C;EACF;EAIA,CAHI,OAAO,EAAO,SAAU,YAAY,EAAO,MAAM,WAAW,MAC9D,EAAM,KAAK,GAAG,EAAW,SAAS,4BAA4B,GAEhE,EAAM,KAAK,EAAO,OAAO,GAAG,EAAW,OAAO;CAChD,CAAC,IAdD,EAAM,KAAK,GAAG,EAAK,WAAW,mCAAmC,IAkBjE,EAAM,gBAAgB,KAAA,KACxB,EAAiB,GAAO,EAAM,aAAa,GAAG,EAAK,aAAa;AAEpE;AAGA,SAAS,EACP,GACA,GACA,GACU;CAMV,OALI,CAAC,EAAS,CAAM,KAAK,OAAO,KAAK,CAAM,EAAE,WAAW,KACtD,EAAM,KAAK,GAAM,4BAA4B,GACtC,CAAC,KAGH,OAAO,QAAQ,CAAM,EAAE,KAAK,CAAC,GAAM,QACnC,EAAmB,KAAK,CAAI,KAC/B,EAAM,KAAK,GAAG,EAAK,GAAG,KAAQ,2BAA2B,GAE3D,EAAW,GAAO,GAAO,GAAG,EAAK,GAAG,GAAM,GACnC,EACR;AACH;AAGA,SAAS,EAAU,GAAqB,GAAyB;CAC/D,IAAI,CAAC,EAAS,CAAI,GAEhB,OADA,EAAM,KAAK,cAAc,mBAAmB,GACrC,CAAC;CAGV,AAAI,EAAK,SAAS,KAAA,KAAW,EAAM,KAAK,EAAK,MAAM,iBAAiB;CAEpE,IAAM,IAAQ,EAAY,GAAO,EAAK,MAAM,iBAAiB,GACvD,IAAkB,CAAC;CAEzB,AAAI,EAAK,aAAa,KAAA,MAChB,CAAC,EAAS,EAAK,QAAQ,KAAK,OAAO,KAAK,EAAK,QAAQ,EAAE,WAAW,IACpE,EAAM,KAAK,uBAAuB,4BAA4B,IAE9D,OAAO,QAAQ,EAAK,QAAQ,EAAE,SAAS,CAAC,GAAM,OAAY;EACxD,IAAI,CAAC,EAAQ,GAAM,CAAa,GAAG;GACjC,EAAM,KAAK,uBAAuB,KAAQ,uBAAuB;GACjE;EACF;EAEA,AADA,EAAM,KAAK,CAAI,GACf,EAAM,KACJ,GAAG,EAAY,GAAO,GAAQ,uBAAuB,GAAM,CAC7D;CACF,CAAC;CAML,IAAM,IAAa,EAAM,QACtB,GAAM,MAAU,EAAM,QAAQ,CAAI,MAAM,CAC3C;CAKA,OAJA,MAAM,KAAK,IAAI,IAAI,CAAU,CAAC,EAAE,SAAS,MACvC,EAAM,KAAK,cAAc,KAAQ,4BAA4B,CAC/D,GAEO;AACT;AAEA,SAAS,EAAc,GAAwB;CAM7C,OALK,EAAS,CAAI,IAKX,CAHL,EAAK,MACL,GAAG,OAAO,OAAO,EAAS,EAAK,QAAQ,IAAI,EAAK,WAAW,CAAC,CAAC,CAExD,EAAO,MACX,MACC,EAAS,CAAK,KACd,OAAO,OAAO,CAAK,EAAE,MAClB,MAAU,EAAS,CAAK,KAAK,EAAM,SAAS,aAC/C,CACJ,IAX4B;AAY9B;AAEA,SAAS,EAAa,GAAqB,GAAwB;CACjE,AAAI,EAAM,aAAa,GAAS,eAAe,KACxC,EAAmB,SAAS,KAC/B,EAAM,KACJ,iBACA,mBAAmB,EAAmB,YACxC;AAGN;AAEA,SAAS,EAAU,GAAqB,GAAY,GAAuB;CACzE,IAAI,CAAC,EAAQ,EAAM,MAAM,CAAW,GAAG;EACrC,EAAM,KAAK,cAAc,yBAAyB;EAClD;CACF;CAEA,IAAI,EAAM,SAAS,UAAU;EAqB3B,AApBA,EAAM,cAAc,EAAM,QAAQ,cAAc,GAI5C,EAAM,YAAY,KAAA,KAAW,EAAa,GAAO,EAAM,OAAO,GAI9D,EAAM,WAAW,KACnB,EAAM,KACJ,uBACA,uCACF,GAEE,EAAM,SAAS,OAAO,KAAK,CAAC,EAAc,EAAM,IAAI,KACtD,EAAM,KACJ,cACA,sDACF,GAEE,EAAM,WAAW,KAAA,MACd,EAAM,SAAS,OAAO,IAGzB,EAAM,cAAc,EAAM,QAAQ,cAAc,IAFhD,EAAM,KAAK,gBAAgB,sCAAsC;EAKrE;CACF;CAIA,AAFA,EAAa,GAAO,EAAM,OAAO,GACjC,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC,GACzE,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC;AAC3E;AAGA,SAAgB,EAAc,GAA6B;CACzD,OAAO,EAAS,CAAS,KAAK,EAAU,UAAU,KAAA;AACpD;AAQA,SAAgB,EAAmB,GAA2C;CAC5E,IAAM,IAAQ,IAAI,EAAa;CAE/B,IAAI,CAAC,EAAS,CAAS,GACrB,OAAO;EAAE,OAAO;EAAO,QAAQ,CAAC,6BAA6B;CAAE;CAGjE,IAAM,EAAE,aAAU;CA+BlB,OA9BK,EAAS,CAAK,IAGf,EAAM,YAAA,UAQR,OAAO,EAAU,MAAO,YACxB,CAAC,EAAiB,KAAK,EAAU,EAAE,MAEnC,EAAM,KAAK,MAAM,0BAA0B,GAE7C,EAAM,KAAK,EAAU,MAAM,MAAM,GACjC,EAAM,KAAK,EAAU,aAAa,aAAa,GAE7C,EAAU,UAAU,KAAA,MACnB,OAAO,EAAU,SAAU,YAC1B,CAAC,EAAiB,KAAK,EAAU,KAAK,MAExC,EAAM,KAAK,SAAS,0BAA0B,GAGhD,EAAc,GAAO,EAAU,QAAQ,GAEvC,EAAU,GAAO,GADH,EAAU,GAAO,EAAM,IACb,CAAK,GAEtB;EAAE,OAAO,EAAM,OAAO,WAAW;EAAG,QAAQ,EAAM;CAAO,KA1BvD;EACL,OAAO;EACP,QAAQ,CAAC,gCAA2C;CACtD,IANO;EAAE,OAAO;EAAO,QAAQ,CAAC,0BAA0B;CAAE;AA8BhE"}
+{"version":3,"file":"manifest-validation.js","names":[],"sources":["../../src/manifests/manifest-validation.ts"],"sourcesContent":["/**\n * Admission policy for extension-authored catalog manifests.\n *\n * A manifest is data authored in a different repository that instructs this host\n * to render copy and compose a request. The host therefore decides what a\n * manifest is *permitted* to do rather than trusting the file — validation here\n * is a trust boundary, not a convenience check, and it deliberately does not\n * defer to a schema shipped alongside the manifests it would be validating.\n *\n * Beyond mirroring the published schema, this adds the invariants the host's own\n * derivation depends on: a single trigger kind to read, a repository field for\n * an event trigger's source, and field names unique across the form. Without\n * them the derived request body would be silently wrong rather than rejected.\n *\n * A manifest that fails any check is rejected outright. It never renders a\n * partial UI, because everything downstream treats its content as instructions.\n */\n\nimport {\n  BUNDLE_CONFIG_FILENAME,\n  SETUP_PLACEHOLDER_NAMESPACES,\n  SETUP_VERSION,\n} from \"./types\";\n\nconst ENTRY_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;\nconst FIELD_NAME_PATTERN = /^[a-z][A-Za-z0-9]*$/;\n/** Copy must never be able to inject markup into the host. */\nconst MARKUP_PATTERN = /<[A-Za-z/!]/;\n/**\n * A template version, declared as `version` by a prompt entry and as\n * `setup.bundle.version` by a bundle one. Sent to the service as template\n * provenance, so it is checked at admission. Full semver, as the spec at\n * semver.org states it: a catalog entry published with a pre-release or build\n * suffix is still a version this host may forward, and refusing one would drop\n * the entry from the registry outright.\n */\nconst TEMPLATE_VERSION_PATTERN =\n  /^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*)?(?:\\+[0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*)?$/;\n// The characters a command of plain words and paths is made of. No shell\n// metacharacters, which the service rejects anyway and a bundle has no reason\n// to need; where those words may point is `isPlainCommand`'s to say.\nconst BUNDLE_COMMAND_PATTERN = /^[A-Za-z0-9 ._/-]+$/;\nconst BUNDLE_PATH_PATTERN = /^[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)*$/;\nconst BUNDLE_SOURCE_PATTERN =\n  /^(skills|automations)\\/[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)*$/;\n/** Every `{{` must open a known namespace and close immediately. */\nconst UNKNOWN_PLACEHOLDER_PATTERN = new RegExp(\n  `\\\\{\\\\{(?!(?:${SETUP_PLACEHOLDER_NAMESPACES.join(\"|\")})\\\\.[A-Za-z0-9_.]+\\\\}\\\\})`,\n);\n\nconst SETUP_MODES = [\"direct\", \"assisted\"] as const;\nconst FIELD_TYPES = [\n  \"text\",\n  \"textarea\",\n  \"select\",\n  \"cron\",\n  \"timezone\",\n  \"repo-picker\",\n] as const;\nconst GIT_PROVIDERS = [\"github\", \"gitlab\", \"bitbucket\"] as const;\nconst TRIGGER_KINDS = [\"cron\", \"event\"] as const;\nconst CONSTRAINT_FORMATS = [\"safeExpressionLiteral\"] as const;\n\n/** Setup context only, so this can never become a channel for runtime instructions. */\nconst MAX_MESSAGE_LENGTH = 2000;\n\nexport interface SetupValidationResult {\n  valid: boolean;\n  errors: string[];\n}\n\ntype Rec = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is Rec {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isOneOf<T extends readonly string[]>(\n  value: unknown,\n  allowed: T,\n): value is T[number] {\n  return (\n    typeof value === \"string\" && (allowed as readonly string[]).includes(value)\n  );\n}\n\nfunction isInteger(value: unknown, minimum: number): boolean {\n  return (\n    typeof value === \"number\" && Number.isInteger(value) && value >= minimum\n  );\n}\n\nclass SetupChecker {\n  readonly errors: string[] = [];\n\n  fail(path: string, reason: string): false {\n    this.errors.push(`${path}: ${reason}`);\n    return false;\n  }\n\n  /** Literal user-visible copy. Carries no markup. */\n  copy(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    if (MARKUP_PATTERN.test(value)) {\n      return this.fail(path, \"must not contain markup\");\n    }\n    return true;\n  }\n\n  placeholders(value: string, path: string): boolean {\n    if (UNKNOWN_PLACEHOLDER_PATTERN.test(value)) {\n      return this.fail(path, \"uses an unknown placeholder namespace\");\n    }\n    return true;\n  }\n\n  /** Copy that may embed `{{namespace.key}}` placeholders. */\n  templateCopy(value: unknown, path: string): boolean {\n    return this.copy(value, path) && this.placeholders(value as string, path);\n  }\n\n  /**\n   * A request-body string that may embed placeholders. Never rendered, so\n   * expression syntax such as a JMESPath filter is allowed through.\n   */\n  templateValue(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    return this.placeholders(value, path);\n  }\n\n  absent(container: Rec, key: string, path: string, reason: string): boolean {\n    if (key in container) return this.fail(`${path}.${key}`, reason);\n    return true;\n  }\n}\n\n/**\n * A relative path that stays inside the archive it names.\n *\n * The character class alone is not enough: `.` and `..` are made of allowed\n * characters, so a segment check is what actually keeps a packed file from\n * climbing out of the directory it is extracted into.\n */\nfunction isRelativePath(value: unknown, pattern: RegExp): value is string {\n  return (\n    typeof value === \"string\" &&\n    pattern.test(value) &&\n    !value.split(\"/\").some((segment) => segment === \".\" || segment === \"..\")\n  );\n}\n\n/**\n * A command whose every word stays inside the archive it is run in.\n *\n * The character class is not what keeps it there: `/` and `.` are allowed\n * characters, so `/bin/sh setup.sh` and `python3 ../../etc/x.py` are made of\n * them and each names something outside the extracted directory. The segment\n * rule packed paths are held to is what refuses those, and requiring a word at\n * all is what refuses an entrypoint of nothing but spaces.\n */\nfunction isPlainCommand(value: unknown): value is string {\n  if (typeof value !== \"string\" || !BUNDLE_COMMAND_PATTERN.test(value)) {\n    return false;\n  }\n  const words = value.split(\" \").filter((word) => word.length > 0);\n  return (\n    words.length > 0 &&\n    words.every(\n      (word) =>\n        !word.startsWith(\"/\") &&\n        !word.split(\"/\").some((segment) => segment === \"..\"),\n    )\n  );\n}\n\nfunction checkRequires(check: SetupChecker, requires: unknown): void {\n  if (!isRecord(requires)) {\n    check.fail(\"requires\", \"must be an object\");\n    return;\n  }\n\n  const { integrations, features } = requires;\n  // Empty is meaningful rather than malformed: an automation that needs no\n  // credential connects to nothing, and the key stays required so that saying\n  // so is a deliberate statement instead of an omission.\n  if (!isRecord(integrations)) {\n    check.fail(\"requires.integrations\", \"must be an object\");\n  } else {\n    Object.entries(integrations).forEach(([id, requirement]) => {\n      const path = `requires.integrations.${id}`;\n      if (!isRecord(requirement)) {\n        check.fail(path, \"must be an object\");\n        return;\n      }\n      check.copy(requirement.message, `${path}.message`);\n      if (\"required\" in requirement && requirement.required !== false) {\n        check.fail(`${path}.required`, \"may only be false\");\n      }\n      const allowed = [\"message\", \"required\"];\n      Object.keys(requirement)\n        .filter((key) => !allowed.includes(key))\n        .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n    });\n  }\n\n  if (features !== undefined) {\n    if (!Array.isArray(features) || features.length === 0) {\n      check.fail(\"requires.features\", \"must be a non-empty array\");\n    } else {\n      features.forEach((feature, index) => {\n        if (typeof feature !== \"string\" || feature.length === 0) {\n          check.fail(\n            `requires.features[${index}]`,\n            \"must be a non-empty string\",\n          );\n        }\n      });\n    }\n  }\n}\n\nfunction checkConstraints(\n  check: SetupChecker,\n  constraints: unknown,\n  path: string,\n): void {\n  if (!isRecord(constraints) || Object.keys(constraints).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return;\n  }\n\n  const { minLength, maxLength, format } = constraints;\n  if (minLength !== undefined && !isInteger(minLength, 0)) {\n    check.fail(`${path}.minLength`, \"must be a non-negative integer\");\n  }\n  if (maxLength !== undefined && !isInteger(maxLength, 1)) {\n    check.fail(`${path}.maxLength`, \"must be a positive integer\");\n  }\n  if (format !== undefined && !isOneOf(format, CONSTRAINT_FORMATS)) {\n    check.fail(`${path}.format`, \"is not a supported format\");\n  }\n}\n\nfunction checkField(check: SetupChecker, field: unknown, path: string): void {\n  if (!isRecord(field)) {\n    check.fail(path, \"must be an object\");\n    return;\n  }\n\n  const { type, label, help, placeholder, required, provider, options } = field;\n\n  if (!isOneOf(type, FIELD_TYPES)) {\n    check.fail(`${path}.type`, \"is not a supported field type\");\n  }\n  check.copy(label, `${path}.label`);\n  check.copy(help, `${path}.help`);\n  if (placeholder !== undefined) check.copy(placeholder, `${path}.placeholder`);\n  if (field.default !== undefined && typeof field.default !== \"string\") {\n    check.fail(`${path}.default`, \"must be a string\");\n  }\n  if (typeof required !== \"boolean\") {\n    check.fail(`${path}.required`, \"must be a boolean\");\n  }\n  if (provider !== undefined && !isOneOf(provider, GIT_PROVIDERS)) {\n    check.fail(`${path}.provider`, \"is not a supported provider\");\n  }\n  if (type === \"repo-picker\" && provider === undefined) {\n    check.fail(`${path}.provider`, \"is required for a repository field\");\n  }\n  // The host branches on this key to decide whether a field's value is a list,\n  // so a field declaring it anywhere else would be seeded with a list and\n  // rendered as a string.\n  if (\n    field.multiple !== undefined &&\n    (field.multiple !== true || type !== \"repo-picker\")\n  ) {\n    check.fail(\n      `${path}.multiple`,\n      \"may only be true, and only on a repository field\",\n    );\n  }\n\n  if (options !== undefined) {\n    if (type !== \"select\") {\n      check.fail(`${path}.options`, \"is only allowed on a select field\");\n    } else if (!Array.isArray(options) || options.length === 0) {\n      check.fail(`${path}.options`, \"must be a non-empty array\");\n    } else {\n      options.forEach((option, index) => {\n        const optionPath = `${path}.options[${index}]`;\n        if (!isRecord(option)) {\n          check.fail(optionPath, \"must be an object\");\n          return;\n        }\n        if (typeof option.value !== \"string\" || option.value.length === 0) {\n          check.fail(`${optionPath}.value`, \"must be a non-empty string\");\n        }\n        check.copy(option.label, `${optionPath}.label`);\n      });\n    }\n  }\n\n  if (field.constraints !== undefined) {\n    checkConstraints(check, field.constraints, `${path}.constraints`);\n  }\n}\n\n/** Returns the declared field names, so the caller can check them for collisions. */\nfunction checkFields(\n  check: SetupChecker,\n  fields: unknown,\n  path: string,\n): string[] {\n  if (!isRecord(fields) || Object.keys(fields).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return [];\n  }\n\n  return Object.entries(fields).map(([name, field]) => {\n    if (!FIELD_NAME_PATTERN.test(name)) {\n      check.fail(`${path}.${name}`, \"is not a valid field name\");\n    }\n    checkField(check, field, `${path}.${name}`);\n    return name;\n  });\n}\n\n/** Returns the trigger kinds declared, in order. */\nfunction checkForm(check: SetupChecker, form: unknown): string[] {\n  if (!isRecord(form)) {\n    check.fail(\"setup.form\", \"must be an object\");\n    return [];\n  }\n\n  if (form.note !== undefined) check.copy(form.note, \"setup.form.note\");\n\n  const names = checkFields(check, form.args, \"setup.form.args\");\n  const kinds: string[] = [];\n\n  if (form.triggers !== undefined) {\n    if (!isRecord(form.triggers) || Object.keys(form.triggers).length === 0) {\n      check.fail(\"setup.form.triggers\", \"must be a non-empty object\");\n    } else {\n      Object.entries(form.triggers).forEach(([kind, fields]) => {\n        if (!isOneOf(kind, TRIGGER_KINDS)) {\n          check.fail(`setup.form.triggers.${kind}`, \"is not a trigger kind\");\n          return;\n        }\n        kinds.push(kind);\n        names.push(\n          ...checkFields(check, fields, `setup.form.triggers.${kind}`),\n        );\n      });\n    }\n  }\n\n  // The host merges both halves into one value map, so a repeated name would\n  // silently shadow a field and misaddress every error reported against it.\n  const duplicates = names.filter(\n    (name, index) => names.indexOf(name) !== index,\n  );\n  Array.from(new Set(duplicates)).forEach((name) =>\n    check.fail(`setup.form.${name}`, \"is declared more than once\"),\n  );\n\n  return kinds;\n}\n\nfunction hasRepoPicker(form: unknown): boolean {\n  if (!isRecord(form)) return false;\n  const groups = [\n    form.args,\n    ...Object.values(isRecord(form.triggers) ? form.triggers : {}),\n  ];\n  return groups.some(\n    (group) =>\n      isRecord(group) &&\n      Object.values(group).some(\n        (field) => isRecord(field) && field.type === \"repo-picker\",\n      ),\n  );\n}\n\nfunction checkMessage(check: SetupChecker, message: unknown): void {\n  if (check.templateCopy(message, \"setup.message\")) {\n    if ((message as string).length > MAX_MESSAGE_LENGTH) {\n      check.fail(\n        \"setup.message\",\n        `must be at most ${MAX_MESSAGE_LENGTH} characters`,\n      );\n    }\n  }\n}\n\n/**\n * The script tarball a direct entry may ship.\n *\n * The strings here are commands and paths this host acts on, so they are held\n * to a closed character set rather than the placeholder rules copy uses: an\n * entrypoint with a shell metacharacter, or a packed path that escapes the\n * archive, is refused here rather than by the service.\n */\nfunction checkBundle(check: SetupChecker, bundle: unknown): void {\n  if (!isRecord(bundle)) {\n    check.fail(\"setup.bundle\", \"must be an object\");\n    return;\n  }\n\n  if (\n    typeof bundle.version !== \"string\" ||\n    !TEMPLATE_VERSION_PATTERN.test(bundle.version)\n  ) {\n    check.fail(\"setup.bundle.version\", \"must be a semantic version\");\n  }\n  if (!isPlainCommand(bundle.entrypoint)) {\n    check.fail(\n      \"setup.bundle.entrypoint\",\n      \"must be a plain command that stays inside the archive\",\n    );\n  }\n  if (\n    bundle.setupScript !== undefined &&\n    !isRelativePath(bundle.setupScript, BUNDLE_PATH_PATTERN)\n  ) {\n    check.fail(\"setup.bundle.setupScript\", \"must be a relative path\");\n  }\n  if (bundle.timeout !== undefined && !isInteger(bundle.timeout, 1)) {\n    check.fail(\"setup.bundle.timeout\", \"must be a positive integer\");\n  }\n\n  if (!isRecord(bundle.files) || Object.keys(bundle.files).length === 0) {\n    check.fail(\"setup.bundle.files\", \"must be a non-empty object\");\n  } else {\n    Object.entries(bundle.files).forEach(([packedPath, source]) => {\n      if (!isRelativePath(packedPath, BUNDLE_PATH_PATTERN)) {\n        check.fail(`setup.bundle.files.${packedPath}`, \"is not a packed path\");\n      }\n      // The rendered config is packed under this name too, and a tar carrying\n      // the name twice leaves which one the script reads to whichever\n      // extractor unpacks it.\n      if (packedPath === BUNDLE_CONFIG_FILENAME) {\n        check.fail(\n          `setup.bundle.files.${packedPath}`,\n          \"is the name the rendered config is packed under\",\n        );\n      }\n      if (!isRelativePath(source, BUNDLE_SOURCE_PATTERN)) {\n        check.fail(\n          `setup.bundle.files.${packedPath}`,\n          \"must name a file under skills/ or automations/\",\n        );\n      }\n    });\n\n    // A setup script the archive does not carry is a create request the\n    // service accepts and the first run fails on, and it is also the only\n    // thing packed executable - naming an unpacked file makes that rule\n    // unreachable.\n    if (\n      typeof bundle.setupScript === \"string\" &&\n      !(bundle.setupScript in bundle.files)\n    ) {\n      check.fail(\"setup.bundle.setupScript\", \"must name a packed file\");\n    }\n  }\n\n  if (!isRecord(bundle.config) || Object.keys(bundle.config).length === 0) {\n    check.fail(\"setup.bundle.config\", \"must be a non-empty object\");\n  } else {\n    checkBundleConfig(check, bundle.config, \"setup.bundle.config\");\n  }\n}\n\n/** Every string leaf of the config is a payload value: placeholders, no markup rule. */\nfunction checkBundleConfig(\n  check: SetupChecker,\n  node: unknown,\n  path: string,\n): void {\n  if (typeof node === \"string\") {\n    check.templateValue(node, path);\n    return;\n  }\n  if (Array.isArray(node)) {\n    node.forEach((item, index) =>\n      checkBundleConfig(check, item, `${path}[${index}]`),\n    );\n    return;\n  }\n  if (isRecord(node)) {\n    Object.entries(node).forEach(([key, value]) =>\n      checkBundleConfig(check, value, `${path}.${key}`),\n    );\n    return;\n  }\n  if (node !== null && typeof node !== \"number\" && typeof node !== \"boolean\") {\n    check.fail(\n      path,\n      \"must be a string, number, boolean, null, array or object\",\n    );\n  }\n}\n\nfunction checkMode(check: SetupChecker, setup: Rec, kinds: string[]): void {\n  if (!isOneOf(setup.mode, SETUP_MODES)) {\n    check.fail(\"setup.mode\", \"is not a supported mode\");\n    return;\n  }\n\n  if (setup.mode === \"direct\") {\n    // A direct entry produces one of two things: a prompt, or a script bundle\n    // the host packs and uploads. Both would be ambiguous, neither is nothing\n    // to create.\n    const hasPrompt = setup.prompt !== undefined;\n    const hasBundle = setup.bundle !== undefined;\n    if (hasPrompt === hasBundle) {\n      check.fail(\n        \"setup\",\n        \"must declare exactly one of prompt or bundle for direct setup\",\n      );\n    } else if (hasBundle) {\n      checkBundle(check, setup.bundle);\n    } else {\n      check.templateValue(setup.prompt, \"setup.prompt\");\n    }\n    // A direct entry may carry a fallback-conversation seed for deployments\n    // that cannot run the direct path, held to the same rules as an assisted\n    // message.\n    if (setup.message !== undefined) checkMessage(check, setup.message);\n\n    // The derivation reads a single trigger kind, and an event trigger takes\n    // its source from the repository field's provider.\n    if (kinds.length !== 1) {\n      check.fail(\n        \"setup.form.triggers\",\n        \"must declare exactly one trigger kind\",\n      );\n    }\n    if (kinds.includes(\"event\") && !hasRepoPicker(setup.form)) {\n      check.fail(\n        \"setup.form\",\n        \"must declare a repository field for an event trigger\",\n      );\n    }\n    if (setup.filter !== undefined) {\n      if (!kinds.includes(\"event\")) {\n        check.fail(\"setup.filter\", \"is only allowed for an event trigger\");\n      } else {\n        check.templateValue(setup.filter, \"setup.filter\");\n      }\n    }\n    return;\n  }\n\n  checkMessage(check, setup.message);\n  check.absent(setup, \"prompt\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"bundle\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"filter\", \"setup\", \"is only allowed for direct setup\");\n}\n\n/** Whether a catalog entry ships a setup experience at all. It is optional. */\nexport function hasSetupBlock(candidate: unknown): boolean {\n  return isRecord(candidate) && candidate.setup !== undefined;\n}\n\n/**\n * Decide whether this host will act on a catalog manifest.\n *\n * The version is checked first and fails closed: a format this host does not\n * recognise is refused rather than interpreted with today's rules.\n */\nexport function validateSetupEntry(candidate: unknown): SetupValidationResult {\n  const check = new SetupChecker();\n\n  if (!isRecord(candidate)) {\n    return { valid: false, errors: [\"manifest: must be an object\"] };\n  }\n\n  const { setup } = candidate;\n  if (!isRecord(setup)) {\n    return { valid: false, errors: [\"setup: must be an object\"] };\n  }\n  if (setup.version !== SETUP_VERSION) {\n    return {\n      valid: false,\n      errors: [`setup.version: must be \"${SETUP_VERSION}\"`],\n    };\n  }\n\n  if (\n    typeof candidate.id !== \"string\" ||\n    !ENTRY_ID_PATTERN.test(candidate.id)\n  ) {\n    check.fail(\"id\", \"must be a lowercase slug\");\n  }\n  check.copy(candidate.name, \"name\");\n  check.copy(candidate.description, \"description\");\n  if (\n    candidate.version !== undefined &&\n    (typeof candidate.version !== \"string\" ||\n      !TEMPLATE_VERSION_PATTERN.test(candidate.version))\n  ) {\n    check.fail(\"version\", \"must be a semantic version\");\n  }\n  if (\n    candidate.skill !== undefined &&\n    (typeof candidate.skill !== \"string\" ||\n      !ENTRY_ID_PATTERN.test(candidate.skill))\n  ) {\n    check.fail(\"skill\", \"must be a lowercase slug\");\n  }\n\n  checkRequires(check, candidate.requires);\n  const kinds = checkForm(check, setup.form);\n  checkMode(check, setup, kinds);\n\n  return { valid: check.errors.length === 0, errors: check.errors };\n}\n"],"mappings":";;AAwBA,IAAM,IAAmB,4BACnB,IAAqB,uBAErB,IAAiB,eASjB,IACJ,yLAII,IAAyB,uBACzB,IAAsB,yCACtB,IACJ,+DAEI,IAAkC,OACtC,eAAe,EAA6B,KAAK,GAAG,EAAE,0BACxD,GAEM,IAAc,CAAC,UAAU,UAAU,GACnC,IAAc;CAClB;CACA;CACA;CACA;CACA;CACA;AACF,GACM,IAAgB;CAAC;CAAU;CAAU;AAAW,GAChD,IAAgB,CAAC,QAAQ,OAAO,GAChC,IAAqB,CAAC,uBAAuB,GAG7C,IAAqB;AAS3B,SAAS,EAAS,GAA8B;CAC9C,OAAO,OAAO,KAAU,cAAY,KAAkB,CAAC,MAAM,QAAQ,CAAK;AAC5E;AAEA,SAAS,EACP,GACA,GACoB;CACpB,OACE,OAAO,KAAU,YAAa,EAA8B,SAAS,CAAK;AAE9E;AAEA,SAAS,EAAU,GAAgB,GAA0B;CAC3D,OACE,OAAO,KAAU,YAAY,OAAO,UAAU,CAAK,KAAK,KAAS;AAErE;AAEA,IAAM,IAAN,MAAmB;CACjB,SAA4B,CAAC;CAE7B,KAAK,GAAc,GAAuB;EAExC,OADA,KAAK,OAAO,KAAK,GAAG,EAAK,IAAI,GAAQ,GAC9B;CACT;CAGA,KAAK,GAAgB,GAAuB;EAO1C,OANI,OAAO,KAAU,YAAY,EAAM,WAAW,IACzC,KAAK,KAAK,GAAM,4BAA4B,IAEjD,EAAe,KAAK,CAAK,IACpB,KAAK,KAAK,GAAM,yBAAyB,IAE3C;CACT;CAEA,aAAa,GAAe,GAAuB;EAIjD,OAHI,EAA4B,KAAK,CAAK,IACjC,KAAK,KAAK,GAAM,uCAAuC,IAEzD;CACT;CAGA,aAAa,GAAgB,GAAuB;EAClD,OAAO,KAAK,KAAK,GAAO,CAAI,KAAK,KAAK,aAAa,GAAiB,CAAI;CAC1E;CAMA,cAAc,GAAgB,GAAuB;EAInD,OAHI,OAAO,KAAU,YAAY,EAAM,WAAW,IACzC,KAAK,KAAK,GAAM,4BAA4B,IAE9C,KAAK,aAAa,GAAO,CAAI;CACtC;CAEA,OAAO,GAAgB,GAAa,GAAc,GAAyB;EAEzE,OADI,KAAO,IAAkB,KAAK,KAAK,GAAG,EAAK,GAAG,KAAO,CAAM,IACxD;CACT;AACF;AASA,SAAS,EAAe,GAAgB,GAAkC;CACxE,OACE,OAAO,KAAU,YACjB,EAAQ,KAAK,CAAK,KAClB,CAAC,EAAM,MAAM,GAAG,EAAE,MAAM,MAAY,MAAY,OAAO,MAAY,IAAI;AAE3E;AAWA,SAAS,EAAe,GAAiC;CACvD,IAAI,OAAO,KAAU,YAAY,CAAC,EAAuB,KAAK,CAAK,GACjE,OAAO;CAET,IAAM,IAAQ,EAAM,MAAM,GAAG,EAAE,QAAQ,MAAS,EAAK,SAAS,CAAC;CAC/D,OACE,EAAM,SAAS,KACf,EAAM,OACH,MACC,CAAC,EAAK,WAAW,GAAG,KACpB,CAAC,EAAK,MAAM,GAAG,EAAE,MAAM,MAAY,MAAY,IAAI,CACvD;AAEJ;AAEA,SAAS,EAAc,GAAqB,GAAyB;CACnE,IAAI,CAAC,EAAS,CAAQ,GAAG;EACvB,EAAM,KAAK,YAAY,mBAAmB;EAC1C;CACF;CAEA,IAAM,EAAE,iBAAc,gBAAa;CAwBnC,AApBK,EAAS,CAAY,IAGxB,OAAO,QAAQ,CAAY,EAAE,SAAS,CAAC,GAAI,OAAiB;EAC1D,IAAM,IAAO,yBAAyB;EACtC,IAAI,CAAC,EAAS,CAAW,GAAG;GAC1B,EAAM,KAAK,GAAM,mBAAmB;GACpC;EACF;EAEA,AADA,EAAM,KAAK,EAAY,SAAS,GAAG,EAAK,SAAS,GAC7C,cAAc,KAAe,EAAY,aAAa,MACxD,EAAM,KAAK,GAAG,EAAK,YAAY,mBAAmB;EAEpD,IAAM,IAAU,CAAC,WAAW,UAAU;EACtC,OAAO,KAAK,CAAW,EACpB,QAAQ,MAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,SAAS,MAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,KAAO,gBAAgB,CAAC;CACpE,CAAC,IAhBD,EAAM,KAAK,yBAAyB,mBAAmB,GAmBrD,MAAa,KAAA,MACX,CAAC,MAAM,QAAQ,CAAQ,KAAK,EAAS,WAAW,IAClD,EAAM,KAAK,qBAAqB,2BAA2B,IAE3D,EAAS,SAAS,GAAS,MAAU;EACnC,CAAI,OAAO,KAAY,YAAY,EAAQ,WAAW,MACpD,EAAM,KACJ,qBAAqB,EAAM,IAC3B,4BACF;CAEJ,CAAC;AAGP;AAEA,SAAS,EACP,GACA,GACA,GACM;CACN,IAAI,CAAC,EAAS,CAAW,KAAK,OAAO,KAAK,CAAW,EAAE,WAAW,GAAG;EACnE,EAAM,KAAK,GAAM,4BAA4B;EAC7C;CACF;CAEA,IAAM,EAAE,cAAW,cAAW,cAAW;CAOzC,AANI,MAAc,KAAA,KAAa,CAAC,EAAU,GAAW,CAAC,KACpD,EAAM,KAAK,GAAG,EAAK,aAAa,gCAAgC,GAE9D,MAAc,KAAA,KAAa,CAAC,EAAU,GAAW,CAAC,KACpD,EAAM,KAAK,GAAG,EAAK,aAAa,4BAA4B,GAE1D,MAAW,KAAA,KAAa,CAAC,EAAQ,GAAQ,CAAkB,KAC7D,EAAM,KAAK,GAAG,EAAK,UAAU,2BAA2B;AAE5D;AAEA,SAAS,EAAW,GAAqB,GAAgB,GAAoB;CAC3E,IAAI,CAAC,EAAS,CAAK,GAAG;EACpB,EAAM,KAAK,GAAM,mBAAmB;EACpC;CACF;CAEA,IAAM,EAAE,SAAM,UAAO,SAAM,gBAAa,aAAU,aAAU,eAAY;CAqDxE,AAnDK,EAAQ,GAAM,CAAW,KAC5B,EAAM,KAAK,GAAG,EAAK,QAAQ,+BAA+B,GAE5D,EAAM,KAAK,GAAO,GAAG,EAAK,OAAO,GACjC,EAAM,KAAK,GAAM,GAAG,EAAK,MAAM,GAC3B,MAAgB,KAAA,KAAW,EAAM,KAAK,GAAa,GAAG,EAAK,aAAa,GACxE,EAAM,YAAY,KAAA,KAAa,OAAO,EAAM,WAAY,YAC1D,EAAM,KAAK,GAAG,EAAK,WAAW,kBAAkB,GAE9C,OAAO,KAAa,aACtB,EAAM,KAAK,GAAG,EAAK,YAAY,mBAAmB,GAEhD,MAAa,KAAA,KAAa,CAAC,EAAQ,GAAU,CAAa,KAC5D,EAAM,KAAK,GAAG,EAAK,YAAY,6BAA6B,GAE1D,MAAS,iBAAiB,MAAa,KAAA,KACzC,EAAM,KAAK,GAAG,EAAK,YAAY,oCAAoC,GAMnE,EAAM,aAAa,KAAA,MAClB,EAAM,aAAa,MAAQ,MAAS,kBAErC,EAAM,KACJ,GAAG,EAAK,YACR,kDACF,GAGE,MAAY,KAAA,MACV,MAAS,WAEF,CAAC,MAAM,QAAQ,CAAO,KAAK,EAAQ,WAAW,IACvD,EAAM,KAAK,GAAG,EAAK,WAAW,2BAA2B,IAEzD,EAAQ,SAAS,GAAQ,MAAU;EACjC,IAAM,IAAa,GAAG,EAAK,WAAW,EAAM;EAC5C,IAAI,CAAC,EAAS,CAAM,GAAG;GACrB,EAAM,KAAK,GAAY,mBAAmB;GAC1C;EACF;EAIA,CAHI,OAAO,EAAO,SAAU,YAAY,EAAO,MAAM,WAAW,MAC9D,EAAM,KAAK,GAAG,EAAW,SAAS,4BAA4B,GAEhE,EAAM,KAAK,EAAO,OAAO,GAAG,EAAW,OAAO;CAChD,CAAC,IAdD,EAAM,KAAK,GAAG,EAAK,WAAW,mCAAmC,IAkBjE,EAAM,gBAAgB,KAAA,KACxB,EAAiB,GAAO,EAAM,aAAa,GAAG,EAAK,aAAa;AAEpE;AAGA,SAAS,EACP,GACA,GACA,GACU;CAMV,OALI,CAAC,EAAS,CAAM,KAAK,OAAO,KAAK,CAAM,EAAE,WAAW,KACtD,EAAM,KAAK,GAAM,4BAA4B,GACtC,CAAC,KAGH,OAAO,QAAQ,CAAM,EAAE,KAAK,CAAC,GAAM,QACnC,EAAmB,KAAK,CAAI,KAC/B,EAAM,KAAK,GAAG,EAAK,GAAG,KAAQ,2BAA2B,GAE3D,EAAW,GAAO,GAAO,GAAG,EAAK,GAAG,GAAM,GACnC,EACR;AACH;AAGA,SAAS,EAAU,GAAqB,GAAyB;CAC/D,IAAI,CAAC,EAAS,CAAI,GAEhB,OADA,EAAM,KAAK,cAAc,mBAAmB,GACrC,CAAC;CAGV,AAAI,EAAK,SAAS,KAAA,KAAW,EAAM,KAAK,EAAK,MAAM,iBAAiB;CAEpE,IAAM,IAAQ,EAAY,GAAO,EAAK,MAAM,iBAAiB,GACvD,IAAkB,CAAC;CAEzB,AAAI,EAAK,aAAa,KAAA,MAChB,CAAC,EAAS,EAAK,QAAQ,KAAK,OAAO,KAAK,EAAK,QAAQ,EAAE,WAAW,IACpE,EAAM,KAAK,uBAAuB,4BAA4B,IAE9D,OAAO,QAAQ,EAAK,QAAQ,EAAE,SAAS,CAAC,GAAM,OAAY;EACxD,IAAI,CAAC,EAAQ,GAAM,CAAa,GAAG;GACjC,EAAM,KAAK,uBAAuB,KAAQ,uBAAuB;GACjE;EACF;EAEA,AADA,EAAM,KAAK,CAAI,GACf,EAAM,KACJ,GAAG,EAAY,GAAO,GAAQ,uBAAuB,GAAM,CAC7D;CACF,CAAC;CAML,IAAM,IAAa,EAAM,QACtB,GAAM,MAAU,EAAM,QAAQ,CAAI,MAAM,CAC3C;CAKA,OAJA,MAAM,KAAK,IAAI,IAAI,CAAU,CAAC,EAAE,SAAS,MACvC,EAAM,KAAK,cAAc,KAAQ,4BAA4B,CAC/D,GAEO;AACT;AAEA,SAAS,EAAc,GAAwB;CAM7C,OALK,EAAS,CAAI,IAKX,CAHL,EAAK,MACL,GAAG,OAAO,OAAO,EAAS,EAAK,QAAQ,IAAI,EAAK,WAAW,CAAC,CAAC,CAExD,EAAO,MACX,MACC,EAAS,CAAK,KACd,OAAO,OAAO,CAAK,EAAE,MAClB,MAAU,EAAS,CAAK,KAAK,EAAM,SAAS,aAC/C,CACJ,IAX4B;AAY9B;AAEA,SAAS,EAAa,GAAqB,GAAwB;CACjE,AAAI,EAAM,aAAa,GAAS,eAAe,KACxC,EAAmB,SAAS,KAC/B,EAAM,KACJ,iBACA,mBAAmB,EAAmB,YACxC;AAGN;AAUA,SAAS,EAAY,GAAqB,GAAuB;CAC/D,IAAI,CAAC,EAAS,CAAM,GAAG;EACrB,EAAM,KAAK,gBAAgB,mBAAmB;EAC9C;CACF;CA4DA,CAzDE,OAAO,EAAO,WAAY,YAC1B,CAAC,EAAyB,KAAK,EAAO,OAAO,MAE7C,EAAM,KAAK,wBAAwB,4BAA4B,GAE5D,EAAe,EAAO,UAAU,KACnC,EAAM,KACJ,2BACA,uDACF,GAGA,EAAO,gBAAgB,KAAA,KACvB,CAAC,EAAe,EAAO,aAAa,CAAmB,KAEvD,EAAM,KAAK,4BAA4B,yBAAyB,GAE9D,EAAO,YAAY,KAAA,KAAa,CAAC,EAAU,EAAO,SAAS,CAAC,KAC9D,EAAM,KAAK,wBAAwB,4BAA4B,GAG7D,CAAC,EAAS,EAAO,KAAK,KAAK,OAAO,KAAK,EAAO,KAAK,EAAE,WAAW,IAClE,EAAM,KAAK,sBAAsB,4BAA4B,KAE7D,OAAO,QAAQ,EAAO,KAAK,EAAE,SAAS,CAAC,GAAY,OAAY;EAa7D,AAZK,EAAe,GAAY,CAAmB,KACjD,EAAM,KAAK,sBAAsB,KAAc,sBAAsB,GAKnE,MAAA,iBACF,EAAM,KACJ,sBAAsB,KACtB,iDACF,GAEG,EAAe,GAAQ,CAAqB,KAC/C,EAAM,KACJ,sBAAsB,KACtB,gDACF;CAEJ,CAAC,GAOC,OAAO,EAAO,eAAgB,YAC9B,EAAE,EAAO,eAAe,EAAO,UAE/B,EAAM,KAAK,4BAA4B,yBAAyB,IAIhE,CAAC,EAAS,EAAO,MAAM,KAAK,OAAO,KAAK,EAAO,MAAM,EAAE,WAAW,IACpE,EAAM,KAAK,uBAAuB,4BAA4B,IAE9D,EAAkB,GAAO,EAAO,QAAQ,qBAAqB;AAEjE;AAGA,SAAS,EACP,GACA,GACA,GACM;CACN,IAAI,OAAO,KAAS,UAAU;EAC5B,EAAM,cAAc,GAAM,CAAI;EAC9B;CACF;CACA,IAAI,MAAM,QAAQ,CAAI,GAAG;EACvB,EAAK,SAAS,GAAM,MAClB,EAAkB,GAAO,GAAM,GAAG,EAAK,GAAG,EAAM,EAAE,CACpD;EACA;CACF;CACA,IAAI,EAAS,CAAI,GAAG;EAClB,OAAO,QAAQ,CAAI,EAAE,SAAS,CAAC,GAAK,OAClC,EAAkB,GAAO,GAAO,GAAG,EAAK,GAAG,GAAK,CAClD;EACA;CACF;CACA,AAAI,MAAS,QAAQ,OAAO,KAAS,YAAY,OAAO,KAAS,aAC/D,EAAM,KACJ,GACA,0DACF;AAEJ;AAEA,SAAS,EAAU,GAAqB,GAAY,GAAuB;CACzE,IAAI,CAAC,EAAQ,EAAM,MAAM,CAAW,GAAG;EACrC,EAAM,KAAK,cAAc,yBAAyB;EAClD;CACF;CAEA,IAAI,EAAM,SAAS,UAAU;EAI3B,IAAM,IAAY,EAAM,WAAW,KAAA,GAC7B,IAAY,EAAM,WAAW,KAAA;EA8BnC,AA7BI,MAAc,IAChB,EAAM,KACJ,SACA,+DACF,IACS,IACT,EAAY,GAAO,EAAM,MAAM,IAE/B,EAAM,cAAc,EAAM,QAAQ,cAAc,GAK9C,EAAM,YAAY,KAAA,KAAW,EAAa,GAAO,EAAM,OAAO,GAI9D,EAAM,WAAW,KACnB,EAAM,KACJ,uBACA,uCACF,GAEE,EAAM,SAAS,OAAO,KAAK,CAAC,EAAc,EAAM,IAAI,KACtD,EAAM,KACJ,cACA,sDACF,GAEE,EAAM,WAAW,KAAA,MACd,EAAM,SAAS,OAAO,IAGzB,EAAM,cAAc,EAAM,QAAQ,cAAc,IAFhD,EAAM,KAAK,gBAAgB,sCAAsC;EAKrE;CACF;CAKA,AAHA,EAAa,GAAO,EAAM,OAAO,GACjC,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC,GACzE,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC,GACzE,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC;AAC3E;AAGA,SAAgB,EAAc,GAA6B;CACzD,OAAO,EAAS,CAAS,KAAK,EAAU,UAAU,KAAA;AACpD;AAQA,SAAgB,EAAmB,GAA2C;CAC5E,IAAM,IAAQ,IAAI,EAAa;CAE/B,IAAI,CAAC,EAAS,CAAS,GACrB,OAAO;EAAE,OAAO;EAAO,QAAQ,CAAC,6BAA6B;CAAE;CAGjE,IAAM,EAAE,aAAU;CAsClB,OArCK,EAAS,CAAK,IAGf,EAAM,YAAA,UAQR,OAAO,EAAU,MAAO,YACxB,CAAC,EAAiB,KAAK,EAAU,EAAE,MAEnC,EAAM,KAAK,MAAM,0BAA0B,GAE7C,EAAM,KAAK,EAAU,MAAM,MAAM,GACjC,EAAM,KAAK,EAAU,aAAa,aAAa,GAE7C,EAAU,YAAY,KAAA,MACrB,OAAO,EAAU,WAAY,YAC5B,CAAC,EAAyB,KAAK,EAAU,OAAO,MAElD,EAAM,KAAK,WAAW,4BAA4B,GAGlD,EAAU,UAAU,KAAA,MACnB,OAAO,EAAU,SAAU,YAC1B,CAAC,EAAiB,KAAK,EAAU,KAAK,MAExC,EAAM,KAAK,SAAS,0BAA0B,GAGhD,EAAc,GAAO,EAAU,QAAQ,GAEvC,EAAU,GAAO,GADH,EAAU,GAAO,EAAM,IACb,CAAK,GAEtB;EAAE,OAAO,EAAM,OAAO,WAAW;EAAG,QAAQ,EAAM;CAAO,KAjCvD;EACL,OAAO;EACP,QAAQ,CAAC,gCAA2C;CACtD,IANO;EAAE,OAAO;EAAO,QAAQ,CAAC,0BAA0B;CAAE;AAqChE"}

package/dist/manifests/types.cjs

@@ -1,2 +1,2 @@
-require("../_virtual/_rolldown/runtime.cjs");var e=[`form`,`automation`],t=[`list`,`templates`],n=[`layout-dashboard`,`sparkles`,`bot`,`circle-alert`,`activity`,`timer`],r=[`automations`,`needs-attention`,`total-runs`,`average-duration`],i={automations:[`active`],"needs-attention":[],"total-runs":[],"average-duration":[]},a={status:[`all`,`active`,`failing`,`disabled`],trigger:[`all`,`schedule`,`event`]},o=Object.keys(a),s=[`last-run`,`runs`,`name`];exports.DASHBOARD_FILTER_IDS=o,exports.DASHBOARD_FILTER_VALUES=a,exports.DASHBOARD_SORT_VALUES=s,exports.INTERFACE_ICON_SLUGS=n,exports.INTERFACE_SUB_PAGE_IDS=t,exports.OVERVIEW_METRICS=r,exports.OVERVIEW_TILE_PLACEHOLDERS=i,exports.SETUP_PLACEHOLDER_NAMESPACES=e;
+require("../_virtual/_rolldown/runtime.cjs");var e=[`form`,`automation`],t=`config.json`,n=[`list`,`templates`],r=[`layout-dashboard`,`sparkles`,`library`,`bot`,`circle-alert`,`activity`,`timer`],i=[`automations`,`needs-attention`,`total-runs`,`average-duration`],a={automations:[`active`],"needs-attention":[],"total-runs":[],"average-duration":[]},o={status:[`all`,`active`,`failing`,`disabled`],trigger:[`all`,`schedule`,`event`]},s=Object.keys(o),c=[`last-run`,`runs`,`name`];exports.BUNDLE_CONFIG_FILENAME=t,exports.DASHBOARD_FILTER_IDS=s,exports.DASHBOARD_FILTER_VALUES=o,exports.DASHBOARD_SORT_VALUES=c,exports.INTERFACE_ICON_SLUGS=r,exports.INTERFACE_SUB_PAGE_IDS=n,exports.OVERVIEW_METRICS=i,exports.OVERVIEW_TILE_PLACEHOLDERS=a,exports.SETUP_PLACEHOLDER_NAMESPACES=e;
 //# sourceMappingURL=types.cjs.map

package/dist/manifests/types.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.cjs","names":[],"sources":["../../src/manifests/types.ts"],"sourcesContent":["/**\n * Host-owned shape of an extension-authored setup experience.\n *\n * A catalog entry is declarative data published by `@openhands/extensions`. Its\n * optional `setup` block says what to ask a user for; everything derivable from\n * that — the request to send, the route, the review screen, the analytics — is\n * this host's to generate, so none of it appears here.\n *\n * The names mirror `@openhands/extensions/automations`' own declarations, so an\n * entry from the published package assigns without an adapter.\n */\n\nexport const SETUP_VERSION = \"1.0\";\n\nexport type SetupMode = \"direct\" | \"assisted\";\n\nexport type SetupFieldType =\n  | \"text\"\n  | \"textarea\"\n  | \"select\"\n  | \"cron\"\n  | \"timezone\"\n  | \"repo-picker\";\n\nexport type SetupGitProvider = \"github\" | \"gitlab\" | \"bitbucket\";\n\nexport type SetupTriggerKind = \"cron\" | \"event\";\n\n/** Placeholder namespaces a setup block may reference inside `{{...}}`. */\nexport const SETUP_PLACEHOLDER_NAMESPACES = [\"form\", \"automation\"] as const;\n\nexport interface SetupFieldOption {\n  value: string;\n  label: string;\n}\n\nexport interface SetupFieldConstraints {\n  minLength?: number;\n  maxLength?: number;\n  /**\n   * A host-implemented check named from a closed set. Entries supply no regex\n   * of their own, so they cannot hand the host a pathological pattern.\n   */\n  format?: \"safeExpressionLiteral\";\n}\n\nexport interface SetupFormField {\n  type: SetupFieldType;\n  label: string;\n  help: string;\n  placeholder?: string;\n  default?: string;\n  required: boolean;\n  provider?: SetupGitProvider;\n  options?: SetupFieldOption[];\n  constraints?: SetupFieldConstraints;\n}\n\n/** Keyed by field name, which is what `{{form.<name>}}` resolves against. */\nexport type SetupFormFields = Record<string, SetupFormField>;\n\nexport interface SetupForm {\n  note?: string;\n  /** Inputs that decide when the automation runs, keyed by trigger kind. */\n  triggers?: Partial<Record<SetupTriggerKind, SetupFormFields>>;\n  /** Every other input: the arguments to the automation itself. */\n  args: SetupFormFields;\n}\n\nexport interface SetupBlock {\n  version: typeof SETUP_VERSION;\n  mode: SetupMode;\n  form: SetupForm;\n  /** direct only. What the automation is told to do. */\n  prompt?: string;\n  /** direct only, event trigger only. Which delivered events belong to it. */\n  filter?: string;\n  /**\n   * Setup context for the conversation that finishes setup. Required for\n   * assisted mode. Optional for direct mode, where it seeds the fallback\n   * conversation offered when the deployment cannot run the direct path.\n   */\n  message?: string;\n}\n\nexport interface SetupIntegrationRequirement {\n  /** Why this entry needs the integration. */\n  message: string;\n  /** Defaults to true. `false` lets setup continue while it is unconnected. */\n  required?: false;\n}\n\nexport interface SetupPrerequisites {\n  /** Keyed by integration catalog id. */\n  integrations: Record<string, SetupIntegrationRequirement>;\n  /** Deployment capabilities this entry cannot run without. */\n  features?: string[];\n}\n\n/**\n * The part of a catalog entry this host reads. An admitted entry always has a\n * `setup` block; entries without one are simply not setup entries.\n */\nexport interface SetupEntry {\n  id: string;\n  name: string;\n  description: string;\n  requires: SetupPrerequisites;\n  /** The skill that owns the launch command. Defaults to `id`. */\n  skill?: string;\n  setup: SetupBlock;\n}\n\nexport type SetupPayloadValue =\n  | string\n  | number\n  | boolean\n  | null\n  | SetupPayloadValue[]\n  | { [key: string]: SetupPayloadValue };\n\nexport interface SetupRequestBody {\n  [key: string]: SetupPayloadValue;\n}\n\n/** Form values are collected as strings; the payload mapping shapes them. */\nexport type SetupFormValues = Record<string, string>;\n\n/** `GET /v1/capabilities` — what this deployment supports. */\nexport interface DeploymentCapabilities {\n  ready: boolean;\n  /** Absolute timeout ceiling enforced by this deployment's automation API. */\n  maxAutomationTimeoutSeconds?: number;\n  triggerKinds: string[];\n  eventSources: string[];\n  eventTypes: string[];\n  triggers: {\n    cron?: { minIntervalSeconds: number; timezones: string[] };\n    event?: { filterLanguage: string; filterFunctions: string[] };\n  };\n  features: string[];\n}\n\n/** A single problem with a draft, addressed to the field that caused it. */\nexport interface DraftValidationError {\n  /** Dotted path into the draft. Null when the problem spans the whole draft. */\n  field: string | null;\n  code: string;\n  message: string;\n}\n\n/** `POST /v1/validate` — an invalid draft is still a 200. */\nexport interface ValidateDraftResponse {\n  valid: boolean;\n  errors: DraftValidationError[];\n  sampleEventMatched?: boolean | null;\n}\n\n/**\n * Host-owned shape of the production Automation interface manifest, published\n * by `@openhands/extensions/automations` as `AUTOMATION_INTERFACE`.\n *\n * The catalog states what varies per automation; this states the domain-level\n * facts of the interface itself. As with setup entries, the published data is\n * validated at admission rather than trusted, and a package that predates the\n * manifest simply leaves the host on its own defaults.\n */\n\nexport const INTERFACE_VERSION = \"1.0\";\n\n/** The closed set of runtime-model properties a client may offer for setting. */\nexport type AutomationAttributeName =\n  | \"name\"\n  | \"prompt\"\n  | \"model\"\n  | \"timeout\"\n  | \"schedule\";\n\nexport type InterfaceAttributeType =\n  | \"text\"\n  | \"textarea\"\n  | \"number\"\n  | \"llm-profile\"\n  | \"schedule\";\n\n/** How one settable attribute of an existing Automation is offered. */\nexport interface InterfaceAttribute {\n  type: InterfaceAttributeType;\n  label: string;\n  help?: string;\n  required: boolean;\n  /** Only a `number` attribute carries constraints. */\n  constraints?: { min?: number; max?: number };\n}\n\nexport interface InterfaceRoutes {\n  list: string;\n  /** Carries the `:automationId` segment the host substitutes. */\n  setup: string;\n  /** Carries the `:automationId` segment the host substitutes. */\n  detail: string;\n  /** The templates sub-page. Static: there is no parameter to substitute. */\n  templates?: string;\n}\n\n/**\n * Service-relative paths the host calls. The base path, methods, headers, and\n * auth remain the host's. `{id}` marks where the automation id is substituted.\n */\nexport interface InterfaceEndpoints {\n  list: string;\n  detail: string;\n  dispatch: string;\n  runs: string;\n  tarball: string;\n  health: string;\n  capabilities: string;\n  validate: string;\n  createPrompt: string;\n  createPlugin: string;\n}\n\nexport type InterfaceEndpointName = keyof InterfaceEndpoints;\n\nexport interface InterfaceImportExport {\n  fileKind: string;\n  fileVersion: number;\n  filenameSuffix: string;\n  importDefaults: {\n    /** Provider inferred for short owner/repo repository URLs on import. */\n    repoProvider: SetupGitProvider;\n    /** Event source of the placeholder trigger that keeps an import inert. */\n    placeholderEventSource: string;\n  };\n}\n\n/**\n * The sub-page surface: navigation, overview tiles, filters, sort, and run\n * insights for the list page, and a templates page. Every value below names\n * something this host implements from a closed set — a metric it computes, a\n * predicate it applies, a comparator it runs, an icon it ships — and the\n * manifest picks and captions it, never defines it. The host carries no\n * definitions of its own for this surface, so a manifest without it simply\n * leaves the sub-pages unrendered.\n */\n\nexport const INTERFACE_SUB_PAGE_IDS = [\"list\", \"templates\"] as const;\n\nexport type InterfaceSubPageId = (typeof INTERFACE_SUB_PAGE_IDS)[number];\n\n/** Icon names this host maps to artwork. A manifest cannot supply its own. */\nexport const INTERFACE_ICON_SLUGS = [\n  \"layout-dashboard\",\n  \"sparkles\",\n  \"bot\",\n  \"circle-alert\",\n  \"activity\",\n  \"timer\",\n] as const;\n\nexport type InterfaceIconSlug = (typeof INTERFACE_ICON_SLUGS)[number];\n\nexport interface InterfaceSubPageNavItem {\n  /** The `pages` entry this item navigates to; its route comes from `routes`. */\n  page: InterfaceSubPageId;\n  label: string;\n  icon: InterfaceIconSlug;\n}\n\n/** Values this host computes over the loaded automations and their runs. */\nexport const OVERVIEW_METRICS = [\n  \"automations\",\n  \"needs-attention\",\n  \"total-runs\",\n  \"average-duration\",\n] as const;\n\nexport type OverviewMetric = (typeof OVERVIEW_METRICS)[number];\n\n/**\n * Placeholder names a tile's `detail`/`zeroDetail` copy may reference inside\n * `{{...}}`, per metric. Plain substitution, like setup copy.\n */\nexport const OVERVIEW_TILE_PLACEHOLDERS: Record<\n  OverviewMetric,\n  readonly string[]\n> = {\n  automations: [\"active\"],\n  \"needs-attention\": [],\n  \"total-runs\": [],\n  \"average-duration\": [],\n};\n\nexport interface InterfaceOverviewTile {\n  metric: OverviewMetric;\n  label: string;\n  /** Caption under the value. */\n  detail: string;\n  /** Replaces `detail` while the metric's value is zero. */\n  zeroDetail?: string;\n  icon: InterfaceIconSlug;\n}\n\nexport interface InterfaceOverview {\n  /** Names the tiles section for assistive technology. */\n  label: string;\n  tiles: InterfaceOverviewTile[];\n}\n\n/** Filter values name predicates this host implements, per filter id. */\nexport const DASHBOARD_FILTER_VALUES = {\n  status: [\"all\", \"active\", \"failing\", \"disabled\"],\n  trigger: [\"all\", \"schedule\", \"event\"],\n} as const;\n\nexport type DashboardFilterId = keyof typeof DASHBOARD_FILTER_VALUES;\n\nexport const DASHBOARD_FILTER_IDS = Object.keys(\n  DASHBOARD_FILTER_VALUES,\n) as readonly DashboardFilterId[];\n\nexport type DashboardStatusValue =\n  (typeof DASHBOARD_FILTER_VALUES.status)[number];\n\nexport type DashboardTriggerValue =\n  (typeof DASHBOARD_FILTER_VALUES.trigger)[number];\n\nexport interface InterfaceStatusFilter {\n  id: \"status\";\n  /** The control's accessible name. */\n  label: string;\n  options: { value: DashboardStatusValue; label: string }[];\n}\n\nexport interface InterfaceTriggerFilter {\n  id: \"trigger\";\n  /** The control's accessible name. */\n  label: string;\n  options: { value: DashboardTriggerValue; label: string }[];\n}\n\nexport type InterfaceDashboardFilter =\n  | InterfaceStatusFilter\n  | InterfaceTriggerFilter;\n\n/** Sort values name comparators this host implements. */\nexport const DASHBOARD_SORT_VALUES = [\"last-run\", \"runs\", \"name\"] as const;\n\nexport type DashboardSortValue = (typeof DASHBOARD_SORT_VALUES)[number];\n\nexport interface InterfaceDashboardSort {\n  /** The control's accessible name. */\n  label: string;\n  options: { value: DashboardSortValue; label: string }[];\n  /** One of the declared option values. */\n  default: DashboardSortValue;\n}\n\n/**\n * Copy for the per-automation run insights on cards and rows. The states,\n * precedence, sampling, and value formatting are this host's; the manifest\n * names them.\n */\nexport interface InterfaceListInsights {\n  health: {\n    healthy: string;\n    failing: string;\n    running: string;\n    disabled: string;\n    neverRun: string;\n    checking: string;\n  };\n  lastRun: { label: string; never: string; justNow: string };\n  stats: { runs: string; recentSuccess: string; averageDuration: string };\n}\n\n/**\n * The templates sub-page identity. Its body — the catalog cards and their\n * launch behavior — is this host's existing catalog surface.\n */\nexport interface InterfaceTemplatesPage {\n  title: string;\n  description: string;\n}\n\nexport interface InterfaceManifest {\n  version: typeof INTERFACE_VERSION;\n  routes: InterfaceRoutes;\n  navigation: {\n    sidebar: { label: string };\n    commandMenu: { title: string; description: string; keywords: string };\n    /** The ordered sub-page navigation of the interface. */\n    subPages?: InterfaceSubPageNavItem[];\n  };\n  pages: {\n    list: {\n      title: string;\n      subtitle: string;\n      overview?: InterfaceOverview;\n      /** The filter dropdowns of the list page, in render order. */\n      filters?: InterfaceDashboardFilter[];\n      sort?: InterfaceDashboardSort;\n      insights?: InterfaceListInsights;\n    };\n    detail: { backLabel: string };\n    edit: { title: string };\n    templates?: InterfaceTemplatesPage;\n  };\n  docsUrl: string;\n  /**\n   * The input surface of an existing Automation, keyed by the runtime-model\n   * property the host sends. Rendering it as an edit dialog is this host's\n   * choice, not stated here.\n   */\n  attributes: Partial<Record<AutomationAttributeName, InterfaceAttribute>>;\n  importExport: InterfaceImportExport;\n  endpoints: InterfaceEndpoints;\n  featuredAutomationIds: string[];\n  responderIntegrationIds: string[];\n}\n"],"mappings":"6CA6BA,IAAa,EAA+B,CAAC,OAAQ,YAAY,EAyNpD,EAAyB,CAAC,OAAQ,WAAW,EAK7C,EAAuB,CAClC,mBACA,WACA,MACA,eACA,WACA,OACF,EAYa,EAAmB,CAC9B,cACA,kBACA,aACA,kBACF,EAQa,EAGT,CACF,YAAa,CAAC,QAAQ,EACtB,kBAAmB,CAAC,EACpB,aAAc,CAAC,EACf,mBAAoB,CAAC,CACvB,EAmBa,EAA0B,CACrC,OAAQ,CAAC,MAAO,SAAU,UAAW,UAAU,EAC/C,QAAS,CAAC,MAAO,WAAY,OAAO,CACtC,EAIa,EAAuB,OAAO,KACzC,CACF,EA2Ba,EAAwB,CAAC,WAAY,OAAQ,MAAM"}
+{"version":3,"file":"types.cjs","names":[],"sources":["../../src/manifests/types.ts"],"sourcesContent":["/**\n * Host-owned shape of an extension-authored setup experience.\n *\n * A catalog entry is declarative data published by `@openhands/extensions`. Its\n * optional `setup` block says what to ask a user for; everything derivable from\n * that — the request to send, the route, the review screen, the analytics — is\n * this host's to generate, so none of it appears here.\n *\n * The names mirror `@openhands/extensions/automations`' own declarations, so an\n * entry from the published package assigns without an adapter.\n */\n\nexport const SETUP_VERSION = \"1.0\";\n\nexport type SetupMode = \"direct\" | \"assisted\";\n\nexport type SetupFieldType =\n  | \"text\"\n  | \"textarea\"\n  | \"select\"\n  | \"cron\"\n  | \"timezone\"\n  | \"repo-picker\";\n\nexport type SetupGitProvider = \"github\" | \"gitlab\" | \"bitbucket\";\n\nexport type SetupTriggerKind = \"cron\" | \"event\";\n\n/** Placeholder namespaces a setup block may reference inside `{{...}}`. */\nexport const SETUP_PLACEHOLDER_NAMESPACES = [\"form\", \"automation\"] as const;\n\nexport interface SetupFieldOption {\n  value: string;\n  label: string;\n}\n\nexport interface SetupFieldConstraints {\n  minLength?: number;\n  maxLength?: number;\n  /**\n   * A host-implemented check named from a closed set. Entries supply no regex\n   * of their own, so they cannot hand the host a pathological pattern.\n   */\n  format?: \"safeExpressionLiteral\";\n}\n\nexport interface SetupFormField {\n  type: SetupFieldType;\n  label: string;\n  help: string;\n  placeholder?: string;\n  default?: string;\n  required: boolean;\n  provider?: SetupGitProvider;\n  /**\n   * repo-picker only. The field collects several repositories rather than one,\n   * and its value is a list. A placeholder that is the whole value resolves to\n   * that list, so a payload can state one and get an array.\n   */\n  multiple?: true;\n  options?: SetupFieldOption[];\n  constraints?: SetupFieldConstraints;\n}\n\n/** Keyed by field name, which is what `{{form.<name>}}` resolves against. */\nexport type SetupFormFields = Record<string, SetupFormField>;\n\nexport interface SetupForm {\n  note?: string;\n  /** Inputs that decide when the automation runs, keyed by trigger kind. */\n  triggers?: Partial<Record<SetupTriggerKind, SetupFormFields>>;\n  /** Every other input: the arguments to the automation itself. */\n  args: SetupFormFields;\n}\n\n/** A config.json leaf: templated string, number, boolean, null, or a nesting. */\nexport type SetupBundleConfigValue =\n  | string\n  | number\n  | boolean\n  | null\n  | SetupBundleConfigValue[]\n  | { [key: string]: SetupBundleConfigValue };\n\n/**\n * The name the rendered configuration is packed under, which is therefore a\n * name a bundle's own files may not claim. Stated here rather than beside the\n * packing, so admission can refuse the collision without importing it.\n */\nexport const BUNDLE_CONFIG_FILENAME = \"config.json\";\n\n/**\n * The script tarball a direct entry may ship instead of a prompt, for an\n * automation that is deterministic machinery rather than judgement.\n *\n * `files` maps a path inside the archive to the repository path the extensions\n * package read it from; the contents themselves come from that package's\n * `getAutomationBundleFiles`, because this host has the package and not the\n * repository.\n */\nexport interface SetupBundle {\n  /** Provenance recorded on the created automation, alongside the entry id. */\n  version: string;\n  /** The command the service runs inside the extracted tarball. */\n  entrypoint: string;\n  /** Script run once before the entrypoint. Absent when nothing to install. */\n  setupScript?: string;\n  /** Seconds a run may take, when the service default is not enough. */\n  timeout?: number;\n  files: Record<string, string>;\n  /** Rendered from the form and packed as config.json. */\n  config: Record<string, SetupBundleConfigValue>;\n}\n\nexport interface SetupBlock {\n  version: typeof SETUP_VERSION;\n  mode: SetupMode;\n  form: SetupForm;\n  /** direct only. What the automation is told to do. */\n  prompt?: string;\n  /** direct only, and the alternative to `prompt`. Exactly one is present. */\n  bundle?: SetupBundle;\n  /** direct only, event trigger only. Which delivered events belong to it. */\n  filter?: string;\n  /**\n   * Setup context for the conversation that finishes setup. Required for\n   * assisted mode. Optional for direct mode, where it seeds the fallback\n   * conversation offered when the deployment cannot run the direct path.\n   */\n  message?: string;\n}\n\nexport interface SetupIntegrationRequirement {\n  /** Why this entry needs the integration. */\n  message: string;\n  /** Defaults to true. `false` lets setup continue while it is unconnected. */\n  required?: false;\n}\n\nexport interface SetupPrerequisites {\n  /** Keyed by integration catalog id. */\n  integrations: Record<string, SetupIntegrationRequirement>;\n  /** Deployment capabilities this entry cannot run without. */\n  features?: string[];\n}\n\n/**\n * The part of a catalog entry this host reads. An admitted entry always has a\n * `setup` block; entries without one are simply not setup entries.\n */\nexport interface SetupEntry {\n  id: string;\n  name: string;\n  description: string;\n  /**\n   * Version of the template this entry publishes, sent with the create request\n   * as provenance. A bundle declares its own at `setup.bundle.version`; a\n   * prompt entry declares it here. Absent means the entry sends none, so the\n   * service records no template for what it creates.\n   */\n  version?: string;\n  requires: SetupPrerequisites;\n  /** The skill that owns the launch command. Defaults to `id`. */\n  skill?: string;\n  setup: SetupBlock;\n}\n\nexport type SetupPayloadValue =\n  | string\n  | number\n  | boolean\n  | null\n  | SetupPayloadValue[]\n  | { [key: string]: SetupPayloadValue };\n\nexport interface SetupRequestBody {\n  [key: string]: SetupPayloadValue;\n}\n\n/**\n * Form values as collected; the payload mapping shapes them.\n *\n * A field collecting several values holds a list. Everything else holds a\n * string, including fields whose value is a number to the service - the\n * payload mapping is where a value stops being what was typed.\n */\nexport type SetupFormValue = string | string[];\nexport type SetupFormValues = Record<string, SetupFormValue>;\n\n/** `GET /v1/capabilities` — what this deployment supports. */\nexport interface DeploymentCapabilities {\n  ready: boolean;\n  /** Absolute timeout ceiling enforced by this deployment's automation API. */\n  maxAutomationTimeoutSeconds?: number;\n  triggerKinds: string[];\n  eventSources: string[];\n  eventTypes: string[];\n  triggers: {\n    cron?: { minIntervalSeconds: number; timezones: string[] };\n    event?: { filterLanguage: string; filterFunctions: string[] };\n  };\n  features: string[];\n}\n\n/** A single problem with a draft, addressed to the field that caused it. */\nexport interface DraftValidationError {\n  /** Dotted path into the draft. Null when the problem spans the whole draft. */\n  field: string | null;\n  code: string;\n  message: string;\n}\n\n/** `POST /v1/validate` — an invalid draft is still a 200. */\nexport interface ValidateDraftResponse {\n  valid: boolean;\n  errors: DraftValidationError[];\n  sampleEventMatched?: boolean | null;\n}\n\n/**\n * Host-owned shape of the production Automation interface manifest, published\n * by `@openhands/extensions/automations` as `AUTOMATION_INTERFACE`.\n *\n * The catalog states what varies per automation; this states the domain-level\n * facts of the interface itself. As with setup entries, the published data is\n * validated at admission rather than trusted, and a package that predates the\n * manifest simply leaves the host on its own defaults.\n */\n\nexport const INTERFACE_VERSION = \"1.0\";\n\n/** The closed set of runtime-model properties a client may offer for setting. */\nexport type AutomationAttributeName =\n  | \"name\"\n  | \"prompt\"\n  | \"model\"\n  | \"timeout\"\n  | \"schedule\";\n\nexport type InterfaceAttributeType =\n  | \"text\"\n  | \"textarea\"\n  | \"number\"\n  | \"llm-profile\"\n  | \"schedule\";\n\n/** How one settable attribute of an existing Automation is offered. */\nexport interface InterfaceAttribute {\n  type: InterfaceAttributeType;\n  label: string;\n  help?: string;\n  required: boolean;\n  /** Only a `number` attribute carries constraints. */\n  constraints?: { min?: number; max?: number };\n}\n\nexport interface InterfaceRoutes {\n  list: string;\n  /** Carries the `:automationId` segment the host substitutes. */\n  setup: string;\n  /** Carries the `:automationId` segment the host substitutes. */\n  detail: string;\n  /** The templates sub-page. Static: there is no parameter to substitute. */\n  templates?: string;\n}\n\n/**\n * Service-relative paths the host calls. The base path, methods, headers, and\n * auth remain the host's. `{id}` marks where the automation id is substituted.\n */\nexport interface InterfaceEndpoints {\n  list: string;\n  detail: string;\n  dispatch: string;\n  runs: string;\n  tarball: string;\n  health: string;\n  capabilities: string;\n  validate: string;\n  createPrompt: string;\n  createPlugin: string;\n  /**\n   * The raw create endpoint, which a bundle entry is created through, and\n   * where its tarball is uploaded first. Optional: a manifest published before\n   * bundles existed declares neither, and is still admitted.\n   */\n  createBundle?: string;\n  uploads?: string;\n}\n\nexport type InterfaceEndpointName = keyof InterfaceEndpoints;\n\nexport interface InterfaceImportExport {\n  fileKind: string;\n  fileVersion: number;\n  filenameSuffix: string;\n  importDefaults: {\n    /** Provider inferred for short owner/repo repository URLs on import. */\n    repoProvider: SetupGitProvider;\n    /** Event source of the placeholder trigger that keeps an import inert. */\n    placeholderEventSource: string;\n  };\n}\n\n/**\n * The sub-page surface: navigation, overview tiles, filters, sort, and run\n * insights for the list page, and a templates page. Every value below names\n * something this host implements from a closed set — a metric it computes, a\n * predicate it applies, a comparator it runs, an icon it ships — and the\n * manifest picks and captions it, never defines it. The host carries no\n * definitions of its own for this surface, so a manifest without it simply\n * leaves the sub-pages unrendered.\n */\n\nexport const INTERFACE_SUB_PAGE_IDS = [\"list\", \"templates\"] as const;\n\nexport type InterfaceSubPageId = (typeof INTERFACE_SUB_PAGE_IDS)[number];\n\n/** Icon names this host maps to artwork. A manifest cannot supply its own. */\nexport const INTERFACE_ICON_SLUGS = [\n  \"layout-dashboard\",\n  \"sparkles\",\n  \"library\",\n  \"bot\",\n  \"circle-alert\",\n  \"activity\",\n  \"timer\",\n] as const;\n\nexport type InterfaceIconSlug = (typeof INTERFACE_ICON_SLUGS)[number];\n\nexport interface InterfaceSubPageNavItem {\n  /** The `pages` entry this item navigates to; its route comes from `routes`. */\n  page: InterfaceSubPageId;\n  label: string;\n  icon: InterfaceIconSlug;\n}\n\n/** Values this host computes over the loaded automations and their runs. */\nexport const OVERVIEW_METRICS = [\n  \"automations\",\n  \"needs-attention\",\n  \"total-runs\",\n  \"average-duration\",\n] as const;\n\nexport type OverviewMetric = (typeof OVERVIEW_METRICS)[number];\n\n/**\n * Placeholder names a tile's `detail`/`zeroDetail` copy may reference inside\n * `{{...}}`, per metric. Plain substitution, like setup copy.\n */\nexport const OVERVIEW_TILE_PLACEHOLDERS: Record<\n  OverviewMetric,\n  readonly string[]\n> = {\n  automations: [\"active\"],\n  \"needs-attention\": [],\n  \"total-runs\": [],\n  \"average-duration\": [],\n};\n\nexport interface InterfaceOverviewTile {\n  metric: OverviewMetric;\n  label: string;\n  /** Caption under the value. */\n  detail: string;\n  /** Replaces `detail` while the metric's value is zero. */\n  zeroDetail?: string;\n  icon: InterfaceIconSlug;\n}\n\nexport interface InterfaceOverview {\n  /** Names the tiles section for assistive technology. */\n  label: string;\n  tiles: InterfaceOverviewTile[];\n}\n\n/** Filter values name predicates this host implements, per filter id. */\nexport const DASHBOARD_FILTER_VALUES = {\n  status: [\"all\", \"active\", \"failing\", \"disabled\"],\n  trigger: [\"all\", \"schedule\", \"event\"],\n} as const;\n\nexport type DashboardFilterId = keyof typeof DASHBOARD_FILTER_VALUES;\n\nexport const DASHBOARD_FILTER_IDS = Object.keys(\n  DASHBOARD_FILTER_VALUES,\n) as readonly DashboardFilterId[];\n\nexport type DashboardStatusValue =\n  (typeof DASHBOARD_FILTER_VALUES.status)[number];\n\nexport type DashboardTriggerValue =\n  (typeof DASHBOARD_FILTER_VALUES.trigger)[number];\n\nexport interface InterfaceStatusFilter {\n  id: \"status\";\n  /** The control's accessible name. */\n  label: string;\n  options: { value: DashboardStatusValue; label: string }[];\n}\n\nexport interface InterfaceTriggerFilter {\n  id: \"trigger\";\n  /** The control's accessible name. */\n  label: string;\n  options: { value: DashboardTriggerValue; label: string }[];\n}\n\nexport type InterfaceDashboardFilter =\n  | InterfaceStatusFilter\n  | InterfaceTriggerFilter;\n\n/** Sort values name comparators this host implements. */\nexport const DASHBOARD_SORT_VALUES = [\"last-run\", \"runs\", \"name\"] as const;\n\nexport type DashboardSortValue = (typeof DASHBOARD_SORT_VALUES)[number];\n\nexport interface InterfaceDashboardSort {\n  /** The control's accessible name. */\n  label: string;\n  options: { value: DashboardSortValue; label: string }[];\n  /** One of the declared option values. */\n  default: DashboardSortValue;\n}\n\n/**\n * Copy for the per-automation run insights on cards and rows. The states,\n * precedence, sampling, and value formatting are this host's; the manifest\n * names them.\n */\nexport interface InterfaceListInsights {\n  health: {\n    healthy: string;\n    failing: string;\n    running: string;\n    disabled: string;\n    neverRun: string;\n    checking: string;\n  };\n  lastRun: { label: string; never: string; justNow: string };\n  stats: { runs: string; recentSuccess: string; averageDuration: string };\n}\n\n/**\n * The templates sub-page identity. Its body — the catalog cards and their\n * launch behavior — is this host's existing catalog surface.\n */\nexport interface InterfaceTemplatesPage {\n  title: string;\n  description: string;\n}\n\nexport interface InterfaceManifest {\n  version: typeof INTERFACE_VERSION;\n  routes: InterfaceRoutes;\n  navigation: {\n    sidebar: { label: string };\n    commandMenu: { title: string; description: string; keywords: string };\n    /** The ordered sub-page navigation of the interface. */\n    subPages?: InterfaceSubPageNavItem[];\n  };\n  pages: {\n    list: {\n      title: string;\n      subtitle: string;\n      overview?: InterfaceOverview;\n      /** The filter dropdowns of the list page, in render order. */\n      filters?: InterfaceDashboardFilter[];\n      sort?: InterfaceDashboardSort;\n      insights?: InterfaceListInsights;\n    };\n    detail: { backLabel: string };\n    edit: { title: string };\n    templates?: InterfaceTemplatesPage;\n  };\n  docsUrl: string;\n  /**\n   * The input surface of an existing Automation, keyed by the runtime-model\n   * property the host sends. Rendering it as an edit dialog is this host's\n   * choice, not stated here.\n   */\n  attributes: Partial<Record<AutomationAttributeName, InterfaceAttribute>>;\n  importExport: InterfaceImportExport;\n  endpoints: InterfaceEndpoints;\n  featuredAutomationIds: string[];\n  responderIntegrationIds: string[];\n}\n"],"mappings":"6CA6BA,IAAa,EAA+B,CAAC,OAAQ,YAAY,EA4DpD,EAAyB,cAiOzB,EAAyB,CAAC,OAAQ,WAAW,EAK7C,EAAuB,CAClC,mBACA,WACA,UACA,MACA,eACA,WACA,OACF,EAYa,EAAmB,CAC9B,cACA,kBACA,aACA,kBACF,EAQa,EAGT,CACF,YAAa,CAAC,QAAQ,EACtB,kBAAmB,CAAC,EACpB,aAAc,CAAC,EACf,mBAAoB,CAAC,CACvB,EAmBa,EAA0B,CACrC,OAAQ,CAAC,MAAO,SAAU,UAAW,UAAU,EAC/C,QAAS,CAAC,MAAO,WAAY,OAAO,CACtC,EAIa,EAAuB,OAAO,KACzC,CACF,EA2Ba,EAAwB,CAAC,WAAY,OAAQ,MAAM"}

package/dist/manifests/types.d.ts

@@ -37,6 +37,12 @@ export interface SetupFormField {
     default?: string;
     required: boolean;
     provider?: SetupGitProvider;
+    /**
+     * repo-picker only. The field collects several repositories rather than one,
+     * and its value is a list. A placeholder that is the whole value resolves to
+     * that list, so a payload can state one and get an array.
+     */
+    multiple?: true;
     options?: SetupFieldOption[];
     constraints?: SetupFieldConstraints;
 }
@@ -49,12 +55,46 @@ export interface SetupForm {
     /** Every other input: the arguments to the automation itself. */
     args: SetupFormFields;
 }
+/** A config.json leaf: templated string, number, boolean, null, or a nesting. */
+export type SetupBundleConfigValue = string | number | boolean | null | SetupBundleConfigValue[] | {
+    [key: string]: SetupBundleConfigValue;
+};
+/**
+ * The name the rendered configuration is packed under, which is therefore a
+ * name a bundle's own files may not claim. Stated here rather than beside the
+ * packing, so admission can refuse the collision without importing it.
+ */
+export declare const BUNDLE_CONFIG_FILENAME = "config.json";
+/**
+ * The script tarball a direct entry may ship instead of a prompt, for an
+ * automation that is deterministic machinery rather than judgement.
+ *
+ * `files` maps a path inside the archive to the repository path the extensions
+ * package read it from; the contents themselves come from that package's
+ * `getAutomationBundleFiles`, because this host has the package and not the
+ * repository.
+ */
+export interface SetupBundle {
+    /** Provenance recorded on the created automation, alongside the entry id. */
+    version: string;
+    /** The command the service runs inside the extracted tarball. */
+    entrypoint: string;
+    /** Script run once before the entrypoint. Absent when nothing to install. */
+    setupScript?: string;
+    /** Seconds a run may take, when the service default is not enough. */
+    timeout?: number;
+    files: Record<string, string>;
+    /** Rendered from the form and packed as config.json. */
+    config: Record<string, SetupBundleConfigValue>;
+}
 export interface SetupBlock {
     version: typeof SETUP_VERSION;
     mode: SetupMode;
     form: SetupForm;
     /** direct only. What the automation is told to do. */
     prompt?: string;
+    /** direct only, and the alternative to `prompt`. Exactly one is present. */
+    bundle?: SetupBundle;
     /** direct only, event trigger only. Which delivered events belong to it. */
     filter?: string;
     /**
@@ -84,6 +124,13 @@ export interface SetupEntry {
     id: string;
     name: string;
     description: string;
+    /**
+     * Version of the template this entry publishes, sent with the create request
+     * as provenance. A bundle declares its own at `setup.bundle.version`; a
+     * prompt entry declares it here. Absent means the entry sends none, so the
+     * service records no template for what it creates.
+     */
+    version?: string;
     requires: SetupPrerequisites;
     /** The skill that owns the launch command. Defaults to `id`. */
     skill?: string;
@@ -95,8 +142,15 @@ export type SetupPayloadValue = string | number | boolean | null | SetupPayloadV
 export interface SetupRequestBody {
     [key: string]: SetupPayloadValue;
 }
-/** Form values are collected as strings; the payload mapping shapes them. */
-export type SetupFormValues = Record<string, string>;
+/**
+ * Form values as collected; the payload mapping shapes them.
+ *
+ * A field collecting several values holds a list. Everything else holds a
+ * string, including fields whose value is a number to the service - the
+ * payload mapping is where a value stops being what was typed.
+ */
+export type SetupFormValue = string | string[];
+export type SetupFormValues = Record<string, SetupFormValue>;
 /** `GET /v1/capabilities` — what this deployment supports. */
 export interface DeploymentCapabilities {
     ready: boolean;
@@ -179,6 +233,13 @@ export interface InterfaceEndpoints {
     validate: string;
     createPrompt: string;
     createPlugin: string;
+    /**
+     * The raw create endpoint, which a bundle entry is created through, and
+     * where its tarball is uploaded first. Optional: a manifest published before
+     * bundles existed declares neither, and is still admitted.
+     */
+    createBundle?: string;
+    uploads?: string;
 }
 export type InterfaceEndpointName = keyof InterfaceEndpoints;
 export interface InterfaceImportExport {
@@ -204,7 +265,7 @@ export interface InterfaceImportExport {
 export declare const INTERFACE_SUB_PAGE_IDS: readonly ["list", "templates"];
 export type InterfaceSubPageId = (typeof INTERFACE_SUB_PAGE_IDS)[number];
 /** Icon names this host maps to artwork. A manifest cannot supply its own. */
-export declare const INTERFACE_ICON_SLUGS: readonly ["layout-dashboard", "sparkles", "bot", "circle-alert", "activity", "timer"];
+export declare const INTERFACE_ICON_SLUGS: readonly ["layout-dashboard", "sparkles", "library", "bot", "circle-alert", "activity", "timer"];
 export type InterfaceIconSlug = (typeof INTERFACE_ICON_SLUGS)[number];
 export interface InterfaceSubPageNavItem {
     /** The `pages` entry this item navigates to; its route comes from `routes`. */

package/dist/manifests/types.js

@@ -1,22 +1,23 @@
 //#region src/manifests/types.ts
-var e = ["form", "automation"], t = ["list", "templates"], n = [
+var e = ["form", "automation"], t = "config.json", n = ["list", "templates"], r = [
 	"layout-dashboard",
 	"sparkles",
+	"library",
 	"bot",
 	"circle-alert",
 	"activity",
 	"timer"
-], r = [
+], i = [
 	"automations",
 	"needs-attention",
 	"total-runs",
 	"average-duration"
-], i = {
+], a = {
 	automations: ["active"],
 	"needs-attention": [],
 	"total-runs": [],
 	"average-duration": []
-}, a = {
+}, o = {
 	status: [
 		"all",
 		"active",
@@ -28,12 +29,12 @@ var e = ["form", "automation"], t = ["list", "templates"], n = [
 		"schedule",
 		"event"
 	]
-}, o = Object.keys(a), s = [
+}, s = Object.keys(o), c = [
 	"last-run",
 	"runs",
 	"name"
 ];
 //#endregion
-export { o as DASHBOARD_FILTER_IDS, a as DASHBOARD_FILTER_VALUES, s as DASHBOARD_SORT_VALUES, n as INTERFACE_ICON_SLUGS, t as INTERFACE_SUB_PAGE_IDS, r as OVERVIEW_METRICS, i as OVERVIEW_TILE_PLACEHOLDERS, e as SETUP_PLACEHOLDER_NAMESPACES };
+export { t as BUNDLE_CONFIG_FILENAME, s as DASHBOARD_FILTER_IDS, o as DASHBOARD_FILTER_VALUES, c as DASHBOARD_SORT_VALUES, r as INTERFACE_ICON_SLUGS, n as INTERFACE_SUB_PAGE_IDS, i as OVERVIEW_METRICS, a as OVERVIEW_TILE_PLACEHOLDERS, e as SETUP_PLACEHOLDER_NAMESPACES };
 
 //# sourceMappingURL=types.js.map