@openhands/agent-canvas 1.16.0 → 1.17.0

package/dist/manifests/manifest-validation.cjs

@@ -1,2 +1,2 @@
-require("../_virtual/_rolldown/runtime.cjs");const e=require("./types.cjs");var t=/^[a-z0-9]+(-[a-z0-9]+)*$/,n=/^[a-z][A-Za-z0-9]*$/,r=/<[A-Za-z/!]/,i=/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*)?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/,a=/^[A-Za-z0-9 ._/-]+$/,o=/^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/,s=/^(skills|automations)\/[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/,c=RegExp(`\\{\\{(?!(?:${e.SETUP_PLACEHOLDER_NAMESPACES.join(`|`)})\\.[A-Za-z0-9_.]+\\}\\})`),l=[`direct`,`assisted`],u=[`text`,`textarea`,`select`,`cron`,`timezone`,`repo-picker`],d=[`github`,`gitlab`,`bitbucket`],f=[`cron`,`event`],p=[`safeExpressionLiteral`],m=2e3;function h(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function g(e,t){return typeof e==`string`&&t.includes(e)}function _(e,t){return typeof e==`number`&&Number.isInteger(e)&&e>=t}var v=class{errors=[];fail(e,t){return this.errors.push(`${e}: ${t}`),!1}copy(e,t){return typeof e!=`string`||e.length===0?this.fail(t,`must be a non-empty string`):r.test(e)?this.fail(t,`must not contain markup`):!0}placeholders(e,t){return c.test(e)?this.fail(t,`uses an unknown placeholder namespace`):!0}templateCopy(e,t){return this.copy(e,t)&&this.placeholders(e,t)}templateValue(e,t){return typeof e!=`string`||e.length===0?this.fail(t,`must be a non-empty string`):this.placeholders(e,t)}absent(e,t,n,r){return t in e?this.fail(`${n}.${t}`,r):!0}};function y(e,t){return typeof e==`string`&&t.test(e)&&!e.split(`/`).some(e=>e===`.`||e===`..`)}function b(e){if(typeof e!=`string`||!a.test(e))return!1;let t=e.split(` `).filter(e=>e.length>0);return t.length>0&&t.every(e=>!e.startsWith(`/`)&&!e.split(`/`).some(e=>e===`..`))}function x(e,t){if(!h(t)){e.fail(`requires`,`must be an object`);return}let{integrations:n,features:r}=t;h(n)?Object.entries(n).forEach(([t,n])=>{let r=`requires.integrations.${t}`;if(!h(n)){e.fail(r,`must be an object`);return}e.copy(n.message,`${r}.message`),`required`in n&&n.required!==!1&&e.fail(`${r}.required`,`may only be false`);let i=[`message`,`required`];Object.keys(n).filter(e=>!i.includes(e)).forEach(t=>e.fail(`${r}.${t}`,`is not allowed`))}):e.fail(`requires.integrations`,`must be an object`),r!==void 0&&(!Array.isArray(r)||r.length===0?e.fail(`requires.features`,`must be a non-empty array`):r.forEach((t,n)=>{(typeof t!=`string`||t.length===0)&&e.fail(`requires.features[${n}]`,`must be a non-empty string`)}))}function S(e,t,n){if(!h(t)||Object.keys(t).length===0){e.fail(n,`must be a non-empty object`);return}let{minLength:r,maxLength:i,format:a}=t;r!==void 0&&!_(r,0)&&e.fail(`${n}.minLength`,`must be a non-negative integer`),i!==void 0&&!_(i,1)&&e.fail(`${n}.maxLength`,`must be a positive integer`),a!==void 0&&!g(a,p)&&e.fail(`${n}.format`,`is not a supported format`)}function C(e,t,n){if(!h(t)){e.fail(n,`must be an object`);return}let{type:r,label:i,help:a,placeholder:o,required:s,provider:c,options:l}=t;g(r,u)||e.fail(`${n}.type`,`is not a supported field type`),e.copy(i,`${n}.label`),e.copy(a,`${n}.help`),o!==void 0&&e.copy(o,`${n}.placeholder`),t.default!==void 0&&typeof t.default!=`string`&&e.fail(`${n}.default`,`must be a string`),typeof s!=`boolean`&&e.fail(`${n}.required`,`must be a boolean`),c!==void 0&&!g(c,d)&&e.fail(`${n}.provider`,`is not a supported provider`),r===`repo-picker`&&c===void 0&&e.fail(`${n}.provider`,`is required for a repository field`),t.multiple!==void 0&&(t.multiple!==!0||r!==`repo-picker`)&&e.fail(`${n}.multiple`,`may only be true, and only on a repository field`),l!==void 0&&(r===`select`?!Array.isArray(l)||l.length===0?e.fail(`${n}.options`,`must be a non-empty array`):l.forEach((t,r)=>{let i=`${n}.options[${r}]`;if(!h(t)){e.fail(i,`must be an object`);return}(typeof t.value!=`string`||t.value.length===0)&&e.fail(`${i}.value`,`must be a non-empty string`),e.copy(t.label,`${i}.label`)}):e.fail(`${n}.options`,`is only allowed on a select field`)),t.constraints!==void 0&&S(e,t.constraints,`${n}.constraints`)}function w(e,t,r){return!h(t)||Object.keys(t).length===0?(e.fail(r,`must be a non-empty object`),[]):Object.entries(t).map(([t,i])=>(n.test(t)||e.fail(`${r}.${t}`,`is not a valid field name`),C(e,i,`${r}.${t}`),t))}function T(e,t){if(!h(t))return e.fail(`setup.form`,`must be an object`),[];t.note!==void 0&&e.copy(t.note,`setup.form.note`);let n=w(e,t.args,`setup.form.args`),r=[];t.triggers!==void 0&&(!h(t.triggers)||Object.keys(t.triggers).length===0?e.fail(`setup.form.triggers`,`must be a non-empty object`):Object.entries(t.triggers).forEach(([t,i])=>{if(!g(t,f)){e.fail(`setup.form.triggers.${t}`,`is not a trigger kind`);return}r.push(t),n.push(...w(e,i,`setup.form.triggers.${t}`))}));let i=n.filter((e,t)=>n.indexOf(e)!==t);return Array.from(new Set(i)).forEach(t=>e.fail(`setup.form.${t}`,`is declared more than once`)),r}function E(e){return h(e)?[e.args,...Object.values(h(e.triggers)?e.triggers:{})].some(e=>h(e)&&Object.values(e).some(e=>h(e)&&e.type===`repo-picker`)):!1}function D(e,t){e.templateCopy(t,`setup.message`)&&t.length>m&&e.fail(`setup.message`,`must be at most ${m} characters`)}function O(e,t){if(!h(t)){e.fail(`setup.bundle`,`must be an object`);return}(typeof t.version!=`string`||!i.test(t.version))&&e.fail(`setup.bundle.version`,`must be a semantic version`),b(t.entrypoint)||e.fail(`setup.bundle.entrypoint`,`must be a plain command that stays inside the archive`),t.setupScript!==void 0&&!y(t.setupScript,o)&&e.fail(`setup.bundle.setupScript`,`must be a relative path`),t.timeout!==void 0&&!_(t.timeout,1)&&e.fail(`setup.bundle.timeout`,`must be a positive integer`),!h(t.files)||Object.keys(t.files).length===0?e.fail(`setup.bundle.files`,`must be a non-empty object`):(Object.entries(t.files).forEach(([t,n])=>{y(t,o)||e.fail(`setup.bundle.files.${t}`,`is not a packed path`),t===`config.json`&&e.fail(`setup.bundle.files.${t}`,`is the name the rendered config is packed under`),y(n,s)||e.fail(`setup.bundle.files.${t}`,`must name a file under skills/ or automations/`)}),typeof t.setupScript==`string`&&!(t.setupScript in t.files)&&e.fail(`setup.bundle.setupScript`,`must name a packed file`)),!h(t.config)||Object.keys(t.config).length===0?e.fail(`setup.bundle.config`,`must be a non-empty object`):k(e,t.config,`setup.bundle.config`)}function k(e,t,n){if(typeof t==`string`){e.templateValue(t,n);return}if(Array.isArray(t)){t.forEach((t,r)=>k(e,t,`${n}[${r}]`));return}if(h(t)){Object.entries(t).forEach(([t,r])=>k(e,r,`${n}.${t}`));return}t!==null&&typeof t!=`number`&&typeof t!=`boolean`&&e.fail(n,`must be a string, number, boolean, null, array or object`)}function A(e,t,n){if(!g(t.mode,l)){e.fail(`setup.mode`,`is not a supported mode`);return}if(t.mode===`direct`){let r=t.prompt!==void 0,i=t.bundle!==void 0;r===i?e.fail(`setup`,`must declare exactly one of prompt or bundle for direct setup`):i?O(e,t.bundle):e.templateValue(t.prompt,`setup.prompt`),t.message!==void 0&&D(e,t.message),n.length!==1&&e.fail(`setup.form.triggers`,`must declare exactly one trigger kind`),n.includes(`event`)&&!E(t.form)&&e.fail(`setup.form`,`must declare a repository field for an event trigger`),t.filter!==void 0&&(n.includes(`event`)?e.templateValue(t.filter,`setup.filter`):e.fail(`setup.filter`,`is only allowed for an event trigger`));return}D(e,t.message),e.absent(t,`prompt`,`setup`,`is only allowed for direct setup`),e.absent(t,`bundle`,`setup`,`is only allowed for direct setup`),e.absent(t,`filter`,`setup`,`is only allowed for direct setup`)}function j(e){return h(e)&&e.setup!==void 0}function M(e){let n=new v;if(!h(e))return{valid:!1,errors:[`manifest: must be an object`]};let{setup:r}=e;return h(r)?r.version===`1.0`?((typeof e.id!=`string`||!t.test(e.id))&&n.fail(`id`,`must be a lowercase slug`),n.copy(e.name,`name`),n.copy(e.description,`description`),e.version!==void 0&&(typeof e.version!=`string`||!i.test(e.version))&&n.fail(`version`,`must be a semantic version`),e.skill!==void 0&&(typeof e.skill!=`string`||!t.test(e.skill))&&n.fail(`skill`,`must be a lowercase slug`),x(n,e.requires),A(n,r,T(n,r.form)),{valid:n.errors.length===0,errors:n.errors}):{valid:!1,errors:[`setup.version: must be "1.0"`]}:{valid:!1,errors:[`setup: must be an object`]}}exports.hasSetupBlock=j,exports.validateSetupEntry=M;
+require("../_virtual/_rolldown/runtime.cjs");const e=require("./types.cjs");var t=/^[a-z0-9]+(-[a-z0-9]+)*$/,n=/^[a-z][A-Za-z0-9]*$/,r=/<[A-Za-z/!]/,i=/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*)?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/,a=/^[A-Za-z0-9 ._/-]+$/,o=/^[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/,s=/^(skills|automations)\/[A-Za-z0-9._-]+(\/[A-Za-z0-9._-]+)*$/,c=RegExp(`\\{\\{(?!(?:${e.SETUP_PLACEHOLDER_NAMESPACES.join(`|`)})\\.[A-Za-z0-9_.]+\\}\\})`),l=[`direct`,`assisted`],u=[`text`,`textarea`,`select`,`number`,`cron`,`timezone`,`repo-picker`,`llm-profile`,`event-source`,`event-type`,`plugin-sources`,`tarball-upload`],d=[`github`,`gitlab`,`bitbucket`],f=[`cron`,`event`],p=[`safeExpressionLiteral`],m=2e3;function h(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function g(e,t){return typeof e==`string`&&t.includes(e)}function _(e,t){return typeof e==`number`&&Number.isInteger(e)&&e>=t}var v=class{errors=[];fail(e,t){return this.errors.push(`${e}: ${t}`),!1}copy(e,t){return typeof e!=`string`||e.length===0?this.fail(t,`must be a non-empty string`):r.test(e)?this.fail(t,`must not contain markup`):!0}placeholders(e,t){return c.test(e)?this.fail(t,`uses an unknown placeholder namespace`):!0}templateCopy(e,t){return this.copy(e,t)&&this.placeholders(e,t)}templateValue(e,t){return typeof e!=`string`||e.length===0?this.fail(t,`must be a non-empty string`):this.placeholders(e,t)}absent(e,t,n,r){return t in e?this.fail(`${n}.${t}`,r):!0}};function y(e,t){return typeof e==`string`&&t.test(e)&&!e.split(`/`).some(e=>e===`.`||e===`..`)}function b(e){if(typeof e!=`string`||!a.test(e))return!1;let t=e.split(` `).filter(e=>e.length>0);return t.length>0&&t.every(e=>!e.startsWith(`/`)&&!e.split(`/`).some(e=>e===`..`))}function x(e,t){if(!h(t)){e.fail(`requires`,`must be an object`);return}let{integrations:n,features:r}=t;h(n)?Object.entries(n).forEach(([t,n])=>{let r=`requires.integrations.${t}`;if(!h(n)){e.fail(r,`must be an object`);return}e.copy(n.message,`${r}.message`),`required`in n&&n.required!==!1&&e.fail(`${r}.required`,`may only be false`);let i=[`message`,`required`];Object.keys(n).filter(e=>!i.includes(e)).forEach(t=>e.fail(`${r}.${t}`,`is not allowed`))}):e.fail(`requires.integrations`,`must be an object`),r!==void 0&&(!Array.isArray(r)||r.length===0?e.fail(`requires.features`,`must be a non-empty array`):r.forEach((t,n)=>{(typeof t!=`string`||t.length===0)&&e.fail(`requires.features[${n}]`,`must be a non-empty string`)}))}function S(e,t,n){if(!h(t)||Object.keys(t).length===0){e.fail(n,`must be a non-empty object`);return}let{minLength:r,maxLength:i,min:a,max:o,format:s}=t;r!==void 0&&!_(r,0)&&e.fail(`${n}.minLength`,`must be a non-negative integer`),i!==void 0&&!_(i,1)&&e.fail(`${n}.maxLength`,`must be a positive integer`),a!==void 0&&!_(a,0)&&e.fail(`${n}.min`,`must be a non-negative integer`),o!==void 0&&!_(o,1)&&e.fail(`${n}.max`,`must be a positive integer`),s!==void 0&&!g(s,p)&&e.fail(`${n}.format`,`is not a supported format`)}function C(e,t,n){if(!h(t)){e.fail(n,`must be an object`);return}let{type:r,label:i,help:a,placeholder:o,required:s,provider:c,options:l}=t;g(r,u)||e.fail(`${n}.type`,`is not a supported field type`),e.copy(i,`${n}.label`),e.copy(a,`${n}.help`),o!==void 0&&e.copy(o,`${n}.placeholder`),t.default!==void 0&&typeof t.default!=`string`&&typeof t.default!=`number`&&typeof t.default!=`boolean`&&t.default!==null&&e.fail(`${n}.default`,`must be a string, number, boolean or null`),typeof s!=`boolean`&&e.fail(`${n}.required`,`must be a boolean`),c!==void 0&&!g(c,d)&&e.fail(`${n}.provider`,`is not a supported provider`),r===`repo-picker`&&c===void 0&&e.fail(`${n}.provider`,`is required for a repository field`),t.multiple!==void 0&&(t.multiple!==!0||r!==`repo-picker`)&&e.fail(`${n}.multiple`,`may only be true, and only on a repository field`),l!==void 0&&(r===`select`?!Array.isArray(l)||l.length===0?e.fail(`${n}.options`,`must be a non-empty array`):l.forEach((t,r)=>{let i=`${n}.options[${r}]`;if(!h(t)){e.fail(i,`must be an object`);return}(typeof t.value!=`string`||t.value.length===0)&&e.fail(`${i}.value`,`must be a non-empty string`),e.copy(t.label,`${i}.label`)}):e.fail(`${n}.options`,`is only allowed on a select field`)),t.constraints!==void 0&&S(e,t.constraints,`${n}.constraints`)}function w(e,t,r){return!h(t)||Object.keys(t).length===0?(e.fail(r,`must be a non-empty object`),[]):Object.entries(t).map(([t,i])=>(n.test(t)||e.fail(`${r}.${t}`,`is not a valid field name`),C(e,i,`${r}.${t}`),t))}function T(e,t){if(!h(t))return e.fail(`setup.form`,`must be an object`),{kinds:[],fieldNames:[]};t.note!==void 0&&e.copy(t.note,`setup.form.note`);let n=w(e,t.args,`setup.form.args`),r=[];t.triggers!==void 0&&(!h(t.triggers)||Object.keys(t.triggers).length===0?e.fail(`setup.form.triggers`,`must be a non-empty object`):Object.entries(t.triggers).forEach(([t,i])=>{if(!g(t,f)){e.fail(`setup.form.triggers.${t}`,`is not a trigger kind`);return}r.push(t),n.push(...w(e,i,`setup.form.triggers.${t}`))}));let i=n.filter((e,t)=>n.indexOf(e)!==t);return Array.from(new Set(i)).forEach(t=>e.fail(`setup.form.${t}`,`is declared more than once`)),{kinds:r,fieldNames:n}}function E(e,t,n){if(!Array.isArray(t)||t.length===0){e.fail(n,`must be a non-empty array`);return}t.forEach((t,r)=>{(typeof t!=`string`||t.length===0)&&e.fail(`${n}[${r}]`,`must be a non-empty string`)})}function D(e,t,n,r){let i=`setup.actions.${t}`;if(!h(n)){e.fail(i,`must be an object`);return}e.copy(n.label,`${i}.label`),e.copy(n.help,`${i}.help`),E(e,n.features,`${i}.features`),w(e,n.args,`${i}.args`).filter(e=>r.includes(e)).forEach(t=>e.fail(`${i}.args.${t}`,`is already declared by the form`)),t===`prompt`?e.templateValue(n.prompt,`${i}.prompt`):t===`plugin`?(e.templateValue(n.prompt,`${i}.prompt`),e.templateValue(n.plugins,`${i}.plugins`)):t===`upload`?(e.templateValue(n.tarballPath,`${i}.tarballPath`),e.templateValue(n.entrypoint,`${i}.entrypoint`),n.setupScript!==void 0&&e.templateValue(n.setupScript,`${i}.setupScript`)):e.fail(i,`is not a supported action kind`);let a={prompt:[`label`,`help`,`features`,`args`,`prompt`],plugin:[`label`,`help`,`features`,`args`,`prompt`,`plugins`],upload:[`label`,`help`,`features`,`args`,`tarballPath`,`entrypoint`,`setupScript`]}[t]??[];Object.keys(n).filter(e=>!a.includes(e)).forEach(t=>e.fail(`${i}.${t}`,`is not allowed`))}function O(e,t,n){if(!h(t)||Object.keys(t).length===0){e.fail(`setup.actions`,`must be a non-empty object`);return}Object.entries(t).forEach(([t,r])=>D(e,t,r,n))}function k(e,t){return h(e)?Object.values(e).some(e=>h(e)&&e.type===t):!1}function A(e){return h(e)&&k(e.args,`repo-picker`)}function j(e){let t=h(e.form)?e.form:{},n=h(t.triggers)?t.triggers:{},r=n.event;return k(r,`event-source`)||`event`in n&&Object.keys(n).length===1&&k(r,`repo-picker`)||k(t.args,`repo-picker`)?!0:!h(e.actions)||Object.keys(e.actions).length===0?!1:Object.values(e.actions).every(A)}function M(e,t){e.templateCopy(t,`setup.message`)&&t.length>m&&e.fail(`setup.message`,`must be at most ${m} characters`)}function N(e,t){if(!h(t)){e.fail(`setup.bundle`,`must be an object`);return}(typeof t.version!=`string`||!i.test(t.version))&&e.fail(`setup.bundle.version`,`must be a semantic version`),b(t.entrypoint)||e.fail(`setup.bundle.entrypoint`,`must be a plain command that stays inside the archive`),t.setupScript!==void 0&&!y(t.setupScript,o)&&e.fail(`setup.bundle.setupScript`,`must be a relative path`),t.timeout!==void 0&&!_(t.timeout,1)&&e.fail(`setup.bundle.timeout`,`must be a positive integer`),!h(t.files)||Object.keys(t.files).length===0?e.fail(`setup.bundle.files`,`must be a non-empty object`):(Object.entries(t.files).forEach(([t,n])=>{y(t,o)||e.fail(`setup.bundle.files.${t}`,`is not a packed path`),t===`config.json`&&e.fail(`setup.bundle.files.${t}`,`is the name the rendered config is packed under`),y(n,s)||e.fail(`setup.bundle.files.${t}`,`must name a file under skills/ or automations/`)}),typeof t.setupScript==`string`&&!(t.setupScript in t.files)&&e.fail(`setup.bundle.setupScript`,`must name a packed file`)),!h(t.config)||Object.keys(t.config).length===0?e.fail(`setup.bundle.config`,`must be a non-empty object`):P(e,t.config,`setup.bundle.config`)}function P(e,t,n){if(typeof t==`string`){e.templateValue(t,n);return}if(Array.isArray(t)){t.forEach((t,r)=>P(e,t,`${n}[${r}]`));return}if(h(t)){Object.entries(t).forEach(([t,r])=>P(e,r,`${n}.${t}`));return}t!==null&&typeof t!=`number`&&typeof t!=`boolean`&&e.fail(n,`must be a string, number, boolean, null, array or object`)}function F(e,t,n,r){if(!g(t.mode,l)){e.fail(`setup.mode`,`is not a supported mode`);return}if(t.mode===`direct`){let i=t.prompt!==void 0,a=t.bundle!==void 0,o=t.actions!==void 0;[i,a,o].filter(Boolean).length===1?a?N(e,t.bundle):o?O(e,t.actions,r):e.templateValue(t.prompt,`setup.prompt`):e.fail(`setup`,`must declare exactly one of prompt, bundle or actions for direct setup`),t.message!==void 0&&M(e,t.message),n.length===0&&e.fail(`setup.form.triggers`,`must declare at least one trigger kind`),n.includes(`event`)&&!j(t)&&e.fail(`setup.form.triggers.event`,`must declare an event source field or repository picker`),t.filter!==void 0&&(n.includes(`event`)?e.templateValue(t.filter,`setup.filter`):e.fail(`setup.filter`,`is only allowed for an event trigger`));return}M(e,t.message),e.absent(t,`prompt`,`setup`,`is only allowed for direct setup`),e.absent(t,`bundle`,`setup`,`is only allowed for direct setup`),e.absent(t,`actions`,`setup`,`is only allowed for direct setup`),e.absent(t,`filter`,`setup`,`is only allowed for direct setup`)}function I(e){return h(e)&&e.setup!==void 0}function L(e){let n=new v;if(!h(e))return{valid:!1,errors:[`manifest: must be an object`]};let{setup:r}=e;if(!h(r))return{valid:!1,errors:[`setup: must be an object`]};if(r.version!==`1.0`)return{valid:!1,errors:[`setup.version: must be "1.0"`]};(typeof e.id!=`string`||!t.test(e.id))&&n.fail(`id`,`must be a lowercase slug`),n.copy(e.name,`name`),n.copy(e.description,`description`),e.version!==void 0&&(typeof e.version!=`string`||!i.test(e.version))&&n.fail(`version`,`must be a semantic version`),e.skill!==void 0&&(typeof e.skill!=`string`||!t.test(e.skill))&&n.fail(`skill`,`must be a lowercase slug`),x(n,e.requires);let{kinds:a,fieldNames:o}=T(n,r.form);return F(n,r,a,o),{valid:n.errors.length===0,errors:n.errors}}exports.hasSetupBlock=I,exports.validateSetupEntry=L;
 //# sourceMappingURL=manifest-validation.cjs.map

package/dist/manifests/manifest-validation.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-validation.cjs","names":[],"sources":["../../src/manifests/manifest-validation.ts"],"sourcesContent":["/**\n * Admission policy for extension-authored catalog manifests.\n *\n * A manifest is data authored in a different repository that instructs this host\n * to render copy and compose a request. The host therefore decides what a\n * manifest is *permitted* to do rather than trusting the file — validation here\n * is a trust boundary, not a convenience check, and it deliberately does not\n * defer to a schema shipped alongside the manifests it would be validating.\n *\n * Beyond mirroring the published schema, this adds the invariants the host's own\n * derivation depends on: a single trigger kind to read, a repository field for\n * an event trigger's source, and field names unique across the form. Without\n * them the derived request body would be silently wrong rather than rejected.\n *\n * A manifest that fails any check is rejected outright. It never renders a\n * partial UI, because everything downstream treats its content as instructions.\n */\n\nimport {\n  BUNDLE_CONFIG_FILENAME,\n  SETUP_PLACEHOLDER_NAMESPACES,\n  SETUP_VERSION,\n} from \"./types\";\n\nconst ENTRY_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;\nconst FIELD_NAME_PATTERN = /^[a-z][A-Za-z0-9]*$/;\n/** Copy must never be able to inject markup into the host. */\nconst MARKUP_PATTERN = /<[A-Za-z/!]/;\n/**\n * A template version, declared as `version` by a prompt entry and as\n * `setup.bundle.version` by a bundle one. Sent to the service as template\n * provenance, so it is checked at admission. Full semver, as the spec at\n * semver.org states it: a catalog entry published with a pre-release or build\n * suffix is still a version this host may forward, and refusing one would drop\n * the entry from the registry outright.\n */\nconst TEMPLATE_VERSION_PATTERN =\n  /^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*)?(?:\\+[0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*)?$/;\n// The characters a command of plain words and paths is made of. No shell\n// metacharacters, which the service rejects anyway and a bundle has no reason\n// to need; where those words may point is `isPlainCommand`'s to say.\nconst BUNDLE_COMMAND_PATTERN = /^[A-Za-z0-9 ._/-]+$/;\nconst BUNDLE_PATH_PATTERN = /^[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)*$/;\nconst BUNDLE_SOURCE_PATTERN =\n  /^(skills|automations)\\/[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)*$/;\n/** Every `{{` must open a known namespace and close immediately. */\nconst UNKNOWN_PLACEHOLDER_PATTERN = new RegExp(\n  `\\\\{\\\\{(?!(?:${SETUP_PLACEHOLDER_NAMESPACES.join(\"|\")})\\\\.[A-Za-z0-9_.]+\\\\}\\\\})`,\n);\n\nconst SETUP_MODES = [\"direct\", \"assisted\"] as const;\nconst FIELD_TYPES = [\n  \"text\",\n  \"textarea\",\n  \"select\",\n  \"cron\",\n  \"timezone\",\n  \"repo-picker\",\n] as const;\nconst GIT_PROVIDERS = [\"github\", \"gitlab\", \"bitbucket\"] as const;\nconst TRIGGER_KINDS = [\"cron\", \"event\"] as const;\nconst CONSTRAINT_FORMATS = [\"safeExpressionLiteral\"] as const;\n\n/** Setup context only, so this can never become a channel for runtime instructions. */\nconst MAX_MESSAGE_LENGTH = 2000;\n\nexport interface SetupValidationResult {\n  valid: boolean;\n  errors: string[];\n}\n\ntype Rec = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is Rec {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isOneOf<T extends readonly string[]>(\n  value: unknown,\n  allowed: T,\n): value is T[number] {\n  return (\n    typeof value === \"string\" && (allowed as readonly string[]).includes(value)\n  );\n}\n\nfunction isInteger(value: unknown, minimum: number): boolean {\n  return (\n    typeof value === \"number\" && Number.isInteger(value) && value >= minimum\n  );\n}\n\nclass SetupChecker {\n  readonly errors: string[] = [];\n\n  fail(path: string, reason: string): false {\n    this.errors.push(`${path}: ${reason}`);\n    return false;\n  }\n\n  /** Literal user-visible copy. Carries no markup. */\n  copy(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    if (MARKUP_PATTERN.test(value)) {\n      return this.fail(path, \"must not contain markup\");\n    }\n    return true;\n  }\n\n  placeholders(value: string, path: string): boolean {\n    if (UNKNOWN_PLACEHOLDER_PATTERN.test(value)) {\n      return this.fail(path, \"uses an unknown placeholder namespace\");\n    }\n    return true;\n  }\n\n  /** Copy that may embed `{{namespace.key}}` placeholders. */\n  templateCopy(value: unknown, path: string): boolean {\n    return this.copy(value, path) && this.placeholders(value as string, path);\n  }\n\n  /**\n   * A request-body string that may embed placeholders. Never rendered, so\n   * expression syntax such as a JMESPath filter is allowed through.\n   */\n  templateValue(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    return this.placeholders(value, path);\n  }\n\n  absent(container: Rec, key: string, path: string, reason: string): boolean {\n    if (key in container) return this.fail(`${path}.${key}`, reason);\n    return true;\n  }\n}\n\n/**\n * A relative path that stays inside the archive it names.\n *\n * The character class alone is not enough: `.` and `..` are made of allowed\n * characters, so a segment check is what actually keeps a packed file from\n * climbing out of the directory it is extracted into.\n */\nfunction isRelativePath(value: unknown, pattern: RegExp): value is string {\n  return (\n    typeof value === \"string\" &&\n    pattern.test(value) &&\n    !value.split(\"/\").some((segment) => segment === \".\" || segment === \"..\")\n  );\n}\n\n/**\n * A command whose every word stays inside the archive it is run in.\n *\n * The character class is not what keeps it there: `/` and `.` are allowed\n * characters, so `/bin/sh setup.sh` and `python3 ../../etc/x.py` are made of\n * them and each names something outside the extracted directory. The segment\n * rule packed paths are held to is what refuses those, and requiring a word at\n * all is what refuses an entrypoint of nothing but spaces.\n */\nfunction isPlainCommand(value: unknown): value is string {\n  if (typeof value !== \"string\" || !BUNDLE_COMMAND_PATTERN.test(value)) {\n    return false;\n  }\n  const words = value.split(\" \").filter((word) => word.length > 0);\n  return (\n    words.length > 0 &&\n    words.every(\n      (word) =>\n        !word.startsWith(\"/\") &&\n        !word.split(\"/\").some((segment) => segment === \"..\"),\n    )\n  );\n}\n\nfunction checkRequires(check: SetupChecker, requires: unknown): void {\n  if (!isRecord(requires)) {\n    check.fail(\"requires\", \"must be an object\");\n    return;\n  }\n\n  const { integrations, features } = requires;\n  // Empty is meaningful rather than malformed: an automation that needs no\n  // credential connects to nothing, and the key stays required so that saying\n  // so is a deliberate statement instead of an omission.\n  if (!isRecord(integrations)) {\n    check.fail(\"requires.integrations\", \"must be an object\");\n  } else {\n    Object.entries(integrations).forEach(([id, requirement]) => {\n      const path = `requires.integrations.${id}`;\n      if (!isRecord(requirement)) {\n        check.fail(path, \"must be an object\");\n        return;\n      }\n      check.copy(requirement.message, `${path}.message`);\n      if (\"required\" in requirement && requirement.required !== false) {\n        check.fail(`${path}.required`, \"may only be false\");\n      }\n      const allowed = [\"message\", \"required\"];\n      Object.keys(requirement)\n        .filter((key) => !allowed.includes(key))\n        .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n    });\n  }\n\n  if (features !== undefined) {\n    if (!Array.isArray(features) || features.length === 0) {\n      check.fail(\"requires.features\", \"must be a non-empty array\");\n    } else {\n      features.forEach((feature, index) => {\n        if (typeof feature !== \"string\" || feature.length === 0) {\n          check.fail(\n            `requires.features[${index}]`,\n            \"must be a non-empty string\",\n          );\n        }\n      });\n    }\n  }\n}\n\nfunction checkConstraints(\n  check: SetupChecker,\n  constraints: unknown,\n  path: string,\n): void {\n  if (!isRecord(constraints) || Object.keys(constraints).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return;\n  }\n\n  const { minLength, maxLength, format } = constraints;\n  if (minLength !== undefined && !isInteger(minLength, 0)) {\n    check.fail(`${path}.minLength`, \"must be a non-negative integer\");\n  }\n  if (maxLength !== undefined && !isInteger(maxLength, 1)) {\n    check.fail(`${path}.maxLength`, \"must be a positive integer\");\n  }\n  if (format !== undefined && !isOneOf(format, CONSTRAINT_FORMATS)) {\n    check.fail(`${path}.format`, \"is not a supported format\");\n  }\n}\n\nfunction checkField(check: SetupChecker, field: unknown, path: string): void {\n  if (!isRecord(field)) {\n    check.fail(path, \"must be an object\");\n    return;\n  }\n\n  const { type, label, help, placeholder, required, provider, options } = field;\n\n  if (!isOneOf(type, FIELD_TYPES)) {\n    check.fail(`${path}.type`, \"is not a supported field type\");\n  }\n  check.copy(label, `${path}.label`);\n  check.copy(help, `${path}.help`);\n  if (placeholder !== undefined) check.copy(placeholder, `${path}.placeholder`);\n  if (field.default !== undefined && typeof field.default !== \"string\") {\n    check.fail(`${path}.default`, \"must be a string\");\n  }\n  if (typeof required !== \"boolean\") {\n    check.fail(`${path}.required`, \"must be a boolean\");\n  }\n  if (provider !== undefined && !isOneOf(provider, GIT_PROVIDERS)) {\n    check.fail(`${path}.provider`, \"is not a supported provider\");\n  }\n  if (type === \"repo-picker\" && provider === undefined) {\n    check.fail(`${path}.provider`, \"is required for a repository field\");\n  }\n  // The host branches on this key to decide whether a field's value is a list,\n  // so a field declaring it anywhere else would be seeded with a list and\n  // rendered as a string.\n  if (\n    field.multiple !== undefined &&\n    (field.multiple !== true || type !== \"repo-picker\")\n  ) {\n    check.fail(\n      `${path}.multiple`,\n      \"may only be true, and only on a repository field\",\n    );\n  }\n\n  if (options !== undefined) {\n    if (type !== \"select\") {\n      check.fail(`${path}.options`, \"is only allowed on a select field\");\n    } else if (!Array.isArray(options) || options.length === 0) {\n      check.fail(`${path}.options`, \"must be a non-empty array\");\n    } else {\n      options.forEach((option, index) => {\n        const optionPath = `${path}.options[${index}]`;\n        if (!isRecord(option)) {\n          check.fail(optionPath, \"must be an object\");\n          return;\n        }\n        if (typeof option.value !== \"string\" || option.value.length === 0) {\n          check.fail(`${optionPath}.value`, \"must be a non-empty string\");\n        }\n        check.copy(option.label, `${optionPath}.label`);\n      });\n    }\n  }\n\n  if (field.constraints !== undefined) {\n    checkConstraints(check, field.constraints, `${path}.constraints`);\n  }\n}\n\n/** Returns the declared field names, so the caller can check them for collisions. */\nfunction checkFields(\n  check: SetupChecker,\n  fields: unknown,\n  path: string,\n): string[] {\n  if (!isRecord(fields) || Object.keys(fields).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return [];\n  }\n\n  return Object.entries(fields).map(([name, field]) => {\n    if (!FIELD_NAME_PATTERN.test(name)) {\n      check.fail(`${path}.${name}`, \"is not a valid field name\");\n    }\n    checkField(check, field, `${path}.${name}`);\n    return name;\n  });\n}\n\n/** Returns the trigger kinds declared, in order. */\nfunction checkForm(check: SetupChecker, form: unknown): string[] {\n  if (!isRecord(form)) {\n    check.fail(\"setup.form\", \"must be an object\");\n    return [];\n  }\n\n  if (form.note !== undefined) check.copy(form.note, \"setup.form.note\");\n\n  const names = checkFields(check, form.args, \"setup.form.args\");\n  const kinds: string[] = [];\n\n  if (form.triggers !== undefined) {\n    if (!isRecord(form.triggers) || Object.keys(form.triggers).length === 0) {\n      check.fail(\"setup.form.triggers\", \"must be a non-empty object\");\n    } else {\n      Object.entries(form.triggers).forEach(([kind, fields]) => {\n        if (!isOneOf(kind, TRIGGER_KINDS)) {\n          check.fail(`setup.form.triggers.${kind}`, \"is not a trigger kind\");\n          return;\n        }\n        kinds.push(kind);\n        names.push(\n          ...checkFields(check, fields, `setup.form.triggers.${kind}`),\n        );\n      });\n    }\n  }\n\n  // The host merges both halves into one value map, so a repeated name would\n  // silently shadow a field and misaddress every error reported against it.\n  const duplicates = names.filter(\n    (name, index) => names.indexOf(name) !== index,\n  );\n  Array.from(new Set(duplicates)).forEach((name) =>\n    check.fail(`setup.form.${name}`, \"is declared more than once\"),\n  );\n\n  return kinds;\n}\n\nfunction hasRepoPicker(form: unknown): boolean {\n  if (!isRecord(form)) return false;\n  const groups = [\n    form.args,\n    ...Object.values(isRecord(form.triggers) ? form.triggers : {}),\n  ];\n  return groups.some(\n    (group) =>\n      isRecord(group) &&\n      Object.values(group).some(\n        (field) => isRecord(field) && field.type === \"repo-picker\",\n      ),\n  );\n}\n\nfunction checkMessage(check: SetupChecker, message: unknown): void {\n  if (check.templateCopy(message, \"setup.message\")) {\n    if ((message as string).length > MAX_MESSAGE_LENGTH) {\n      check.fail(\n        \"setup.message\",\n        `must be at most ${MAX_MESSAGE_LENGTH} characters`,\n      );\n    }\n  }\n}\n\n/**\n * The script tarball a direct entry may ship.\n *\n * The strings here are commands and paths this host acts on, so they are held\n * to a closed character set rather than the placeholder rules copy uses: an\n * entrypoint with a shell metacharacter, or a packed path that escapes the\n * archive, is refused here rather than by the service.\n */\nfunction checkBundle(check: SetupChecker, bundle: unknown): void {\n  if (!isRecord(bundle)) {\n    check.fail(\"setup.bundle\", \"must be an object\");\n    return;\n  }\n\n  if (\n    typeof bundle.version !== \"string\" ||\n    !TEMPLATE_VERSION_PATTERN.test(bundle.version)\n  ) {\n    check.fail(\"setup.bundle.version\", \"must be a semantic version\");\n  }\n  if (!isPlainCommand(bundle.entrypoint)) {\n    check.fail(\n      \"setup.bundle.entrypoint\",\n      \"must be a plain command that stays inside the archive\",\n    );\n  }\n  if (\n    bundle.setupScript !== undefined &&\n    !isRelativePath(bundle.setupScript, BUNDLE_PATH_PATTERN)\n  ) {\n    check.fail(\"setup.bundle.setupScript\", \"must be a relative path\");\n  }\n  if (bundle.timeout !== undefined && !isInteger(bundle.timeout, 1)) {\n    check.fail(\"setup.bundle.timeout\", \"must be a positive integer\");\n  }\n\n  if (!isRecord(bundle.files) || Object.keys(bundle.files).length === 0) {\n    check.fail(\"setup.bundle.files\", \"must be a non-empty object\");\n  } else {\n    Object.entries(bundle.files).forEach(([packedPath, source]) => {\n      if (!isRelativePath(packedPath, BUNDLE_PATH_PATTERN)) {\n        check.fail(`setup.bundle.files.${packedPath}`, \"is not a packed path\");\n      }\n      // The rendered config is packed under this name too, and a tar carrying\n      // the name twice leaves which one the script reads to whichever\n      // extractor unpacks it.\n      if (packedPath === BUNDLE_CONFIG_FILENAME) {\n        check.fail(\n          `setup.bundle.files.${packedPath}`,\n          \"is the name the rendered config is packed under\",\n        );\n      }\n      if (!isRelativePath(source, BUNDLE_SOURCE_PATTERN)) {\n        check.fail(\n          `setup.bundle.files.${packedPath}`,\n          \"must name a file under skills/ or automations/\",\n        );\n      }\n    });\n\n    // A setup script the archive does not carry is a create request the\n    // service accepts and the first run fails on, and it is also the only\n    // thing packed executable - naming an unpacked file makes that rule\n    // unreachable.\n    if (\n      typeof bundle.setupScript === \"string\" &&\n      !(bundle.setupScript in bundle.files)\n    ) {\n      check.fail(\"setup.bundle.setupScript\", \"must name a packed file\");\n    }\n  }\n\n  if (!isRecord(bundle.config) || Object.keys(bundle.config).length === 0) {\n    check.fail(\"setup.bundle.config\", \"must be a non-empty object\");\n  } else {\n    checkBundleConfig(check, bundle.config, \"setup.bundle.config\");\n  }\n}\n\n/** Every string leaf of the config is a payload value: placeholders, no markup rule. */\nfunction checkBundleConfig(\n  check: SetupChecker,\n  node: unknown,\n  path: string,\n): void {\n  if (typeof node === \"string\") {\n    check.templateValue(node, path);\n    return;\n  }\n  if (Array.isArray(node)) {\n    node.forEach((item, index) =>\n      checkBundleConfig(check, item, `${path}[${index}]`),\n    );\n    return;\n  }\n  if (isRecord(node)) {\n    Object.entries(node).forEach(([key, value]) =>\n      checkBundleConfig(check, value, `${path}.${key}`),\n    );\n    return;\n  }\n  if (node !== null && typeof node !== \"number\" && typeof node !== \"boolean\") {\n    check.fail(\n      path,\n      \"must be a string, number, boolean, null, array or object\",\n    );\n  }\n}\n\nfunction checkMode(check: SetupChecker, setup: Rec, kinds: string[]): void {\n  if (!isOneOf(setup.mode, SETUP_MODES)) {\n    check.fail(\"setup.mode\", \"is not a supported mode\");\n    return;\n  }\n\n  if (setup.mode === \"direct\") {\n    // A direct entry produces one of two things: a prompt, or a script bundle\n    // the host packs and uploads. Both would be ambiguous, neither is nothing\n    // to create.\n    const hasPrompt = setup.prompt !== undefined;\n    const hasBundle = setup.bundle !== undefined;\n    if (hasPrompt === hasBundle) {\n      check.fail(\n        \"setup\",\n        \"must declare exactly one of prompt or bundle for direct setup\",\n      );\n    } else if (hasBundle) {\n      checkBundle(check, setup.bundle);\n    } else {\n      check.templateValue(setup.prompt, \"setup.prompt\");\n    }\n    // A direct entry may carry a fallback-conversation seed for deployments\n    // that cannot run the direct path, held to the same rules as an assisted\n    // message.\n    if (setup.message !== undefined) checkMessage(check, setup.message);\n\n    // The derivation reads a single trigger kind, and an event trigger takes\n    // its source from the repository field's provider.\n    if (kinds.length !== 1) {\n      check.fail(\n        \"setup.form.triggers\",\n        \"must declare exactly one trigger kind\",\n      );\n    }\n    if (kinds.includes(\"event\") && !hasRepoPicker(setup.form)) {\n      check.fail(\n        \"setup.form\",\n        \"must declare a repository field for an event trigger\",\n      );\n    }\n    if (setup.filter !== undefined) {\n      if (!kinds.includes(\"event\")) {\n        check.fail(\"setup.filter\", \"is only allowed for an event trigger\");\n      } else {\n        check.templateValue(setup.filter, \"setup.filter\");\n      }\n    }\n    return;\n  }\n\n  checkMessage(check, setup.message);\n  check.absent(setup, \"prompt\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"bundle\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"filter\", \"setup\", \"is only allowed for direct setup\");\n}\n\n/** Whether a catalog entry ships a setup experience at all. It is optional. */\nexport function hasSetupBlock(candidate: unknown): boolean {\n  return isRecord(candidate) && candidate.setup !== undefined;\n}\n\n/**\n * Decide whether this host will act on a catalog manifest.\n *\n * The version is checked first and fails closed: a format this host does not\n * recognise is refused rather than interpreted with today's rules.\n */\nexport function validateSetupEntry(candidate: unknown): SetupValidationResult {\n  const check = new SetupChecker();\n\n  if (!isRecord(candidate)) {\n    return { valid: false, errors: [\"manifest: must be an object\"] };\n  }\n\n  const { setup } = candidate;\n  if (!isRecord(setup)) {\n    return { valid: false, errors: [\"setup: must be an object\"] };\n  }\n  if (setup.version !== SETUP_VERSION) {\n    return {\n      valid: false,\n      errors: [`setup.version: must be \"${SETUP_VERSION}\"`],\n    };\n  }\n\n  if (\n    typeof candidate.id !== \"string\" ||\n    !ENTRY_ID_PATTERN.test(candidate.id)\n  ) {\n    check.fail(\"id\", \"must be a lowercase slug\");\n  }\n  check.copy(candidate.name, \"name\");\n  check.copy(candidate.description, \"description\");\n  if (\n    candidate.version !== undefined &&\n    (typeof candidate.version !== \"string\" ||\n      !TEMPLATE_VERSION_PATTERN.test(candidate.version))\n  ) {\n    check.fail(\"version\", \"must be a semantic version\");\n  }\n  if (\n    candidate.skill !== undefined &&\n    (typeof candidate.skill !== \"string\" ||\n      !ENTRY_ID_PATTERN.test(candidate.skill))\n  ) {\n    check.fail(\"skill\", \"must be a lowercase slug\");\n  }\n\n  checkRequires(check, candidate.requires);\n  const kinds = checkForm(check, setup.form);\n  checkMode(check, setup, kinds);\n\n  return { valid: check.errors.length === 0, errors: check.errors };\n}\n"],"mappings":"4EAwBA,IAAM,EAAmB,2BACnB,EAAqB,sBAErB,EAAiB,cASjB,EACJ,wLAII,EAAyB,sBACzB,EAAsB,wCACtB,EACJ,8DAEI,EAAkC,OACtC,eAAe,EAAA,6BAA6B,KAAK,GAAG,EAAE,0BACxD,EAEM,EAAc,CAAC,SAAU,UAAU,EACnC,EAAc,CAClB,OACA,WACA,SACA,OACA,WACA,aACF,EACM,EAAgB,CAAC,SAAU,SAAU,WAAW,EAChD,EAAgB,CAAC,OAAQ,OAAO,EAChC,EAAqB,CAAC,uBAAuB,EAG7C,EAAqB,IAS3B,SAAS,EAAS,EAA8B,CAC9C,OAAO,OAAO,GAAU,YAAY,GAAkB,CAAC,MAAM,QAAQ,CAAK,CAC5E,CAEA,SAAS,EACP,EACA,EACoB,CACpB,OACE,OAAO,GAAU,UAAa,EAA8B,SAAS,CAAK,CAE9E,CAEA,SAAS,EAAU,EAAgB,EAA0B,CAC3D,OACE,OAAO,GAAU,UAAY,OAAO,UAAU,CAAK,GAAK,GAAS,CAErE,CAEA,IAAM,EAAN,KAAmB,CACjB,OAA4B,CAAC,EAE7B,KAAK,EAAc,EAAuB,CAExC,OADA,KAAK,OAAO,KAAK,GAAG,EAAK,IAAI,GAAQ,EAC9B,EACT,CAGA,KAAK,EAAgB,EAAuB,CAO1C,OANI,OAAO,GAAU,UAAY,EAAM,SAAW,EACzC,KAAK,KAAK,EAAM,4BAA4B,EAEjD,EAAe,KAAK,CAAK,EACpB,KAAK,KAAK,EAAM,yBAAyB,EAE3C,EACT,CAEA,aAAa,EAAe,EAAuB,CAIjD,OAHI,EAA4B,KAAK,CAAK,EACjC,KAAK,KAAK,EAAM,uCAAuC,EAEzD,EACT,CAGA,aAAa,EAAgB,EAAuB,CAClD,OAAO,KAAK,KAAK,EAAO,CAAI,GAAK,KAAK,aAAa,EAAiB,CAAI,CAC1E,CAMA,cAAc,EAAgB,EAAuB,CAInD,OAHI,OAAO,GAAU,UAAY,EAAM,SAAW,EACzC,KAAK,KAAK,EAAM,4BAA4B,EAE9C,KAAK,aAAa,EAAO,CAAI,CACtC,CAEA,OAAO,EAAgB,EAAa,EAAc,EAAyB,CAEzE,OADI,KAAO,EAAkB,KAAK,KAAK,GAAG,EAAK,GAAG,IAAO,CAAM,EACxD,EACT,CACF,EASA,SAAS,EAAe,EAAgB,EAAkC,CACxE,OACE,OAAO,GAAU,UACjB,EAAQ,KAAK,CAAK,GAClB,CAAC,EAAM,MAAM,GAAG,EAAE,KAAM,GAAY,IAAY,KAAO,IAAY,IAAI,CAE3E,CAWA,SAAS,EAAe,EAAiC,CACvD,GAAI,OAAO,GAAU,UAAY,CAAC,EAAuB,KAAK,CAAK,EACjE,MAAO,GAET,IAAM,EAAQ,EAAM,MAAM,GAAG,EAAE,OAAQ,GAAS,EAAK,OAAS,CAAC,EAC/D,OACE,EAAM,OAAS,GACf,EAAM,MACH,GACC,CAAC,EAAK,WAAW,GAAG,GACpB,CAAC,EAAK,MAAM,GAAG,EAAE,KAAM,GAAY,IAAY,IAAI,CACvD,CAEJ,CAEA,SAAS,EAAc,EAAqB,EAAyB,CACnE,GAAI,CAAC,EAAS,CAAQ,EAAG,CACvB,EAAM,KAAK,WAAY,mBAAmB,EAC1C,MACF,CAEA,GAAM,CAAE,eAAc,YAAa,EAI9B,EAAS,CAAY,EAGxB,OAAO,QAAQ,CAAY,EAAE,SAAS,CAAC,EAAI,KAAiB,CAC1D,IAAM,EAAO,yBAAyB,IACtC,GAAI,CAAC,EAAS,CAAW,EAAG,CAC1B,EAAM,KAAK,EAAM,mBAAmB,EACpC,MACF,CACA,EAAM,KAAK,EAAY,QAAS,GAAG,EAAK,SAAS,EAC7C,aAAc,GAAe,EAAY,WAAa,IACxD,EAAM,KAAK,GAAG,EAAK,WAAY,mBAAmB,EAEpD,IAAM,EAAU,CAAC,UAAW,UAAU,EACtC,OAAO,KAAK,CAAW,EACpB,OAAQ,GAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,QAAS,GAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,IAAO,gBAAgB,CAAC,CACpE,CAAC,EAhBD,EAAM,KAAK,wBAAyB,mBAAmB,EAmBrD,IAAa,IAAA,KACX,CAAC,MAAM,QAAQ,CAAQ,GAAK,EAAS,SAAW,EAClD,EAAM,KAAK,oBAAqB,2BAA2B,EAE3D,EAAS,SAAS,EAAS,IAAU,EAC/B,OAAO,GAAY,UAAY,EAAQ,SAAW,IACpD,EAAM,KACJ,qBAAqB,EAAM,GAC3B,4BACF,CAEJ,CAAC,EAGP,CAEA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,CAAC,EAAS,CAAW,GAAK,OAAO,KAAK,CAAW,EAAE,SAAW,EAAG,CACnE,EAAM,KAAK,EAAM,4BAA4B,EAC7C,MACF,CAEA,GAAM,CAAE,YAAW,YAAW,UAAW,EACrC,IAAc,IAAA,IAAa,CAAC,EAAU,EAAW,CAAC,GACpD,EAAM,KAAK,GAAG,EAAK,YAAa,gCAAgC,EAE9D,IAAc,IAAA,IAAa,CAAC,EAAU,EAAW,CAAC,GACpD,EAAM,KAAK,GAAG,EAAK,YAAa,4BAA4B,EAE1D,IAAW,IAAA,IAAa,CAAC,EAAQ,EAAQ,CAAkB,GAC7D,EAAM,KAAK,GAAG,EAAK,SAAU,2BAA2B,CAE5D,CAEA,SAAS,EAAW,EAAqB,EAAgB,EAAoB,CAC3E,GAAI,CAAC,EAAS,CAAK,EAAG,CACpB,EAAM,KAAK,EAAM,mBAAmB,EACpC,MACF,CAEA,GAAM,CAAE,OAAM,QAAO,OAAM,cAAa,WAAU,WAAU,WAAY,EAEnE,EAAQ,EAAM,CAAW,GAC5B,EAAM,KAAK,GAAG,EAAK,OAAQ,+BAA+B,EAE5D,EAAM,KAAK,EAAO,GAAG,EAAK,OAAO,EACjC,EAAM,KAAK,EAAM,GAAG,EAAK,MAAM,EAC3B,IAAgB,IAAA,IAAW,EAAM,KAAK,EAAa,GAAG,EAAK,aAAa,EACxE,EAAM,UAAY,IAAA,IAAa,OAAO,EAAM,SAAY,UAC1D,EAAM,KAAK,GAAG,EAAK,UAAW,kBAAkB,EAE9C,OAAO,GAAa,WACtB,EAAM,KAAK,GAAG,EAAK,WAAY,mBAAmB,EAEhD,IAAa,IAAA,IAAa,CAAC,EAAQ,EAAU,CAAa,GAC5D,EAAM,KAAK,GAAG,EAAK,WAAY,6BAA6B,EAE1D,IAAS,eAAiB,IAAa,IAAA,IACzC,EAAM,KAAK,GAAG,EAAK,WAAY,oCAAoC,EAMnE,EAAM,WAAa,IAAA,KAClB,EAAM,WAAa,IAAQ,IAAS,gBAErC,EAAM,KACJ,GAAG,EAAK,WACR,kDACF,EAGE,IAAY,IAAA,KACV,IAAS,SAEF,CAAC,MAAM,QAAQ,CAAO,GAAK,EAAQ,SAAW,EACvD,EAAM,KAAK,GAAG,EAAK,UAAW,2BAA2B,EAEzD,EAAQ,SAAS,EAAQ,IAAU,CACjC,IAAM,EAAa,GAAG,EAAK,WAAW,EAAM,GAC5C,GAAI,CAAC,EAAS,CAAM,EAAG,CACrB,EAAM,KAAK,EAAY,mBAAmB,EAC1C,MACF,EACI,OAAO,EAAO,OAAU,UAAY,EAAO,MAAM,SAAW,IAC9D,EAAM,KAAK,GAAG,EAAW,QAAS,4BAA4B,EAEhE,EAAM,KAAK,EAAO,MAAO,GAAG,EAAW,OAAO,CAChD,CAAC,EAdD,EAAM,KAAK,GAAG,EAAK,UAAW,mCAAmC,GAkBjE,EAAM,cAAgB,IAAA,IACxB,EAAiB,EAAO,EAAM,YAAa,GAAG,EAAK,aAAa,CAEpE,CAGA,SAAS,EACP,EACA,EACA,EACU,CAMV,MALI,CAAC,EAAS,CAAM,GAAK,OAAO,KAAK,CAAM,EAAE,SAAW,GACtD,EAAM,KAAK,EAAM,4BAA4B,EACtC,CAAC,GAGH,OAAO,QAAQ,CAAM,EAAE,KAAK,CAAC,EAAM,MACnC,EAAmB,KAAK,CAAI,GAC/B,EAAM,KAAK,GAAG,EAAK,GAAG,IAAQ,2BAA2B,EAE3D,EAAW,EAAO,EAAO,GAAG,EAAK,GAAG,GAAM,EACnC,EACR,CACH,CAGA,SAAS,EAAU,EAAqB,EAAyB,CAC/D,GAAI,CAAC,EAAS,CAAI,EAEhB,OADA,EAAM,KAAK,aAAc,mBAAmB,EACrC,CAAC,EAGN,EAAK,OAAS,IAAA,IAAW,EAAM,KAAK,EAAK,KAAM,iBAAiB,EAEpE,IAAM,EAAQ,EAAY,EAAO,EAAK,KAAM,iBAAiB,EACvD,EAAkB,CAAC,EAErB,EAAK,WAAa,IAAA,KAChB,CAAC,EAAS,EAAK,QAAQ,GAAK,OAAO,KAAK,EAAK,QAAQ,EAAE,SAAW,EACpE,EAAM,KAAK,sBAAuB,4BAA4B,EAE9D,OAAO,QAAQ,EAAK,QAAQ,EAAE,SAAS,CAAC,EAAM,KAAY,CACxD,GAAI,CAAC,EAAQ,EAAM,CAAa,EAAG,CACjC,EAAM,KAAK,uBAAuB,IAAQ,uBAAuB,EACjE,MACF,CACA,EAAM,KAAK,CAAI,EACf,EAAM,KACJ,GAAG,EAAY,EAAO,EAAQ,uBAAuB,GAAM,CAC7D,CACF,CAAC,GAML,IAAM,EAAa,EAAM,QACtB,EAAM,IAAU,EAAM,QAAQ,CAAI,IAAM,CAC3C,EAKA,OAJA,MAAM,KAAK,IAAI,IAAI,CAAU,CAAC,EAAE,QAAS,GACvC,EAAM,KAAK,cAAc,IAAQ,4BAA4B,CAC/D,EAEO,CACT,CAEA,SAAS,EAAc,EAAwB,CAM7C,OALK,EAAS,CAAI,EAKX,CAHL,EAAK,KACL,GAAG,OAAO,OAAO,EAAS,EAAK,QAAQ,EAAI,EAAK,SAAW,CAAC,CAAC,CAExD,EAAO,KACX,GACC,EAAS,CAAK,GACd,OAAO,OAAO,CAAK,EAAE,KAClB,GAAU,EAAS,CAAK,GAAK,EAAM,OAAS,aAC/C,CACJ,EAX4B,EAY9B,CAEA,SAAS,EAAa,EAAqB,EAAwB,CAC7D,EAAM,aAAa,EAAS,eAAe,GACxC,EAAmB,OAAS,GAC/B,EAAM,KACJ,gBACA,mBAAmB,EAAmB,YACxC,CAGN,CAUA,SAAS,EAAY,EAAqB,EAAuB,CAC/D,GAAI,CAAC,EAAS,CAAM,EAAG,CACrB,EAAM,KAAK,eAAgB,mBAAmB,EAC9C,MACF,EAGE,OAAO,EAAO,SAAY,UAC1B,CAAC,EAAyB,KAAK,EAAO,OAAO,IAE7C,EAAM,KAAK,uBAAwB,4BAA4B,EAE5D,EAAe,EAAO,UAAU,GACnC,EAAM,KACJ,0BACA,uDACF,EAGA,EAAO,cAAgB,IAAA,IACvB,CAAC,EAAe,EAAO,YAAa,CAAmB,GAEvD,EAAM,KAAK,2BAA4B,yBAAyB,EAE9D,EAAO,UAAY,IAAA,IAAa,CAAC,EAAU,EAAO,QAAS,CAAC,GAC9D,EAAM,KAAK,uBAAwB,4BAA4B,EAG7D,CAAC,EAAS,EAAO,KAAK,GAAK,OAAO,KAAK,EAAO,KAAK,EAAE,SAAW,EAClE,EAAM,KAAK,qBAAsB,4BAA4B,GAE7D,OAAO,QAAQ,EAAO,KAAK,EAAE,SAAS,CAAC,EAAY,KAAY,CACxD,EAAe,EAAY,CAAmB,GACjD,EAAM,KAAK,sBAAsB,IAAc,sBAAsB,EAKnE,IAAA,eACF,EAAM,KACJ,sBAAsB,IACtB,iDACF,EAEG,EAAe,EAAQ,CAAqB,GAC/C,EAAM,KACJ,sBAAsB,IACtB,gDACF,CAEJ,CAAC,EAOC,OAAO,EAAO,aAAgB,UAC9B,EAAE,EAAO,eAAe,EAAO,QAE/B,EAAM,KAAK,2BAA4B,yBAAyB,GAIhE,CAAC,EAAS,EAAO,MAAM,GAAK,OAAO,KAAK,EAAO,MAAM,EAAE,SAAW,EACpE,EAAM,KAAK,sBAAuB,4BAA4B,EAE9D,EAAkB,EAAO,EAAO,OAAQ,qBAAqB,CAEjE,CAGA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,OAAO,GAAS,SAAU,CAC5B,EAAM,cAAc,EAAM,CAAI,EAC9B,MACF,CACA,GAAI,MAAM,QAAQ,CAAI,EAAG,CACvB,EAAK,SAAS,EAAM,IAClB,EAAkB,EAAO,EAAM,GAAG,EAAK,GAAG,EAAM,EAAE,CACpD,EACA,MACF,CACA,GAAI,EAAS,CAAI,EAAG,CAClB,OAAO,QAAQ,CAAI,EAAE,SAAS,CAAC,EAAK,KAClC,EAAkB,EAAO,EAAO,GAAG,EAAK,GAAG,GAAK,CAClD,EACA,MACF,CACI,IAAS,MAAQ,OAAO,GAAS,UAAY,OAAO,GAAS,WAC/D,EAAM,KACJ,EACA,0DACF,CAEJ,CAEA,SAAS,EAAU,EAAqB,EAAY,EAAuB,CACzE,GAAI,CAAC,EAAQ,EAAM,KAAM,CAAW,EAAG,CACrC,EAAM,KAAK,aAAc,yBAAyB,EAClD,MACF,CAEA,GAAI,EAAM,OAAS,SAAU,CAI3B,IAAM,EAAY,EAAM,SAAW,IAAA,GAC7B,EAAY,EAAM,SAAW,IAAA,GAC/B,IAAc,EAChB,EAAM,KACJ,QACA,+DACF,EACS,EACT,EAAY,EAAO,EAAM,MAAM,EAE/B,EAAM,cAAc,EAAM,OAAQ,cAAc,EAK9C,EAAM,UAAY,IAAA,IAAW,EAAa,EAAO,EAAM,OAAO,EAI9D,EAAM,SAAW,GACnB,EAAM,KACJ,sBACA,uCACF,EAEE,EAAM,SAAS,OAAO,GAAK,CAAC,EAAc,EAAM,IAAI,GACtD,EAAM,KACJ,aACA,sDACF,EAEE,EAAM,SAAW,IAAA,KACd,EAAM,SAAS,OAAO,EAGzB,EAAM,cAAc,EAAM,OAAQ,cAAc,EAFhD,EAAM,KAAK,eAAgB,sCAAsC,GAKrE,MACF,CAEA,EAAa,EAAO,EAAM,OAAO,EACjC,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,EACzE,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,EACzE,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,CAC3E,CAGA,SAAgB,EAAc,EAA6B,CACzD,OAAO,EAAS,CAAS,GAAK,EAAU,QAAU,IAAA,EACpD,CAQA,SAAgB,EAAmB,EAA2C,CAC5E,IAAM,EAAQ,IAAI,EAElB,GAAI,CAAC,EAAS,CAAS,EACrB,MAAO,CAAE,MAAO,GAAO,OAAQ,CAAC,6BAA6B,CAAE,EAGjE,GAAM,CAAE,SAAU,EAsClB,OArCK,EAAS,CAAK,EAGf,EAAM,UAAA,QAQR,OAAO,EAAU,IAAO,UACxB,CAAC,EAAiB,KAAK,EAAU,EAAE,IAEnC,EAAM,KAAK,KAAM,0BAA0B,EAE7C,EAAM,KAAK,EAAU,KAAM,MAAM,EACjC,EAAM,KAAK,EAAU,YAAa,aAAa,EAE7C,EAAU,UAAY,IAAA,KACrB,OAAO,EAAU,SAAY,UAC5B,CAAC,EAAyB,KAAK,EAAU,OAAO,IAElD,EAAM,KAAK,UAAW,4BAA4B,EAGlD,EAAU,QAAU,IAAA,KACnB,OAAO,EAAU,OAAU,UAC1B,CAAC,EAAiB,KAAK,EAAU,KAAK,IAExC,EAAM,KAAK,QAAS,0BAA0B,EAGhD,EAAc,EAAO,EAAU,QAAQ,EAEvC,EAAU,EAAO,EADH,EAAU,EAAO,EAAM,IACb,CAAK,EAEtB,CAAE,MAAO,EAAM,OAAO,SAAW,EAAG,OAAQ,EAAM,MAAO,GAjCvD,CACL,MAAO,GACP,OAAQ,CAAC,8BAA2C,CACtD,EANO,CAAE,MAAO,GAAO,OAAQ,CAAC,0BAA0B,CAAE,CAqChE"}
+{"version":3,"file":"manifest-validation.cjs","names":[],"sources":["../../src/manifests/manifest-validation.ts"],"sourcesContent":["/**\n * Admission policy for extension-authored catalog manifests.\n *\n * A manifest is data authored in a different repository that instructs this host\n * to render copy and compose a request. The host therefore decides what a\n * manifest is *permitted* to do rather than trusting the file — validation here\n * is a trust boundary, not a convenience check, and it deliberately does not\n * defer to a schema shipped alongside the manifests it would be validating.\n *\n * Beyond mirroring the published schema, this adds the invariants the host's own\n * derivation depends on: a single trigger kind to read, a repository field for\n * an event trigger's source, and field names unique across the form. Without\n * them the derived request body would be silently wrong rather than rejected.\n *\n * A manifest that fails any check is rejected outright. It never renders a\n * partial UI, because everything downstream treats its content as instructions.\n */\n\nimport {\n  BUNDLE_CONFIG_FILENAME,\n  SETUP_PLACEHOLDER_NAMESPACES,\n  SETUP_VERSION,\n} from \"./types\";\n\nconst ENTRY_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;\nconst FIELD_NAME_PATTERN = /^[a-z][A-Za-z0-9]*$/;\n/** Copy must never be able to inject markup into the host. */\nconst MARKUP_PATTERN = /<[A-Za-z/!]/;\n/**\n * A template version, declared as `version` by a prompt entry and as\n * `setup.bundle.version` by a bundle one. Sent to the service as template\n * provenance, so it is checked at admission. Full semver, as the spec at\n * semver.org states it: a catalog entry published with a pre-release or build\n * suffix is still a version this host may forward, and refusing one would drop\n * the entry from the registry outright.\n */\nconst TEMPLATE_VERSION_PATTERN =\n  /^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*)?(?:\\+[0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*)?$/;\n// The characters a command of plain words and paths is made of. No shell\n// metacharacters, which the service rejects anyway and a bundle has no reason\n// to need; where those words may point is `isPlainCommand`'s to say.\nconst BUNDLE_COMMAND_PATTERN = /^[A-Za-z0-9 ._/-]+$/;\nconst BUNDLE_PATH_PATTERN = /^[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)*$/;\nconst BUNDLE_SOURCE_PATTERN =\n  /^(skills|automations)\\/[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)*$/;\n/** Every `{{` must open a known namespace and close immediately. */\nconst UNKNOWN_PLACEHOLDER_PATTERN = new RegExp(\n  `\\\\{\\\\{(?!(?:${SETUP_PLACEHOLDER_NAMESPACES.join(\"|\")})\\\\.[A-Za-z0-9_.]+\\\\}\\\\})`,\n);\n\nconst SETUP_MODES = [\"direct\", \"assisted\"] as const;\nconst FIELD_TYPES = [\n  \"text\",\n  \"textarea\",\n  \"select\",\n  \"number\",\n  \"cron\",\n  \"timezone\",\n  \"repo-picker\",\n  \"llm-profile\",\n  \"event-source\",\n  \"event-type\",\n  \"plugin-sources\",\n  \"tarball-upload\",\n] as const;\nconst GIT_PROVIDERS = [\"github\", \"gitlab\", \"bitbucket\"] as const;\nconst TRIGGER_KINDS = [\"cron\", \"event\"] as const;\nconst CONSTRAINT_FORMATS = [\"safeExpressionLiteral\"] as const;\n\n/** Setup context only, so this can never become a channel for runtime instructions. */\nconst MAX_MESSAGE_LENGTH = 2000;\n\nexport interface SetupValidationResult {\n  valid: boolean;\n  errors: string[];\n}\n\ntype Rec = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is Rec {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isOneOf<T extends readonly string[]>(\n  value: unknown,\n  allowed: T,\n): value is T[number] {\n  return (\n    typeof value === \"string\" && (allowed as readonly string[]).includes(value)\n  );\n}\n\nfunction isInteger(value: unknown, minimum: number): boolean {\n  return (\n    typeof value === \"number\" && Number.isInteger(value) && value >= minimum\n  );\n}\n\nclass SetupChecker {\n  readonly errors: string[] = [];\n\n  fail(path: string, reason: string): false {\n    this.errors.push(`${path}: ${reason}`);\n    return false;\n  }\n\n  /** Literal user-visible copy. Carries no markup. */\n  copy(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    if (MARKUP_PATTERN.test(value)) {\n      return this.fail(path, \"must not contain markup\");\n    }\n    return true;\n  }\n\n  placeholders(value: string, path: string): boolean {\n    if (UNKNOWN_PLACEHOLDER_PATTERN.test(value)) {\n      return this.fail(path, \"uses an unknown placeholder namespace\");\n    }\n    return true;\n  }\n\n  /** Copy that may embed `{{namespace.key}}` placeholders. */\n  templateCopy(value: unknown, path: string): boolean {\n    return this.copy(value, path) && this.placeholders(value as string, path);\n  }\n\n  /**\n   * A request-body string that may embed placeholders. Never rendered, so\n   * expression syntax such as a JMESPath filter is allowed through.\n   */\n  templateValue(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    return this.placeholders(value, path);\n  }\n\n  absent(container: Rec, key: string, path: string, reason: string): boolean {\n    if (key in container) return this.fail(`${path}.${key}`, reason);\n    return true;\n  }\n}\n\n/**\n * A relative path that stays inside the archive it names.\n *\n * The character class alone is not enough: `.` and `..` are made of allowed\n * characters, so a segment check is what actually keeps a packed file from\n * climbing out of the directory it is extracted into.\n */\nfunction isRelativePath(value: unknown, pattern: RegExp): value is string {\n  return (\n    typeof value === \"string\" &&\n    pattern.test(value) &&\n    !value.split(\"/\").some((segment) => segment === \".\" || segment === \"..\")\n  );\n}\n\n/**\n * A command whose every word stays inside the archive it is run in.\n *\n * The character class is not what keeps it there: `/` and `.` are allowed\n * characters, so `/bin/sh setup.sh` and `python3 ../../etc/x.py` are made of\n * them and each names something outside the extracted directory. The segment\n * rule packed paths are held to is what refuses those, and requiring a word at\n * all is what refuses an entrypoint of nothing but spaces.\n */\nfunction isPlainCommand(value: unknown): value is string {\n  if (typeof value !== \"string\" || !BUNDLE_COMMAND_PATTERN.test(value)) {\n    return false;\n  }\n  const words = value.split(\" \").filter((word) => word.length > 0);\n  return (\n    words.length > 0 &&\n    words.every(\n      (word) =>\n        !word.startsWith(\"/\") &&\n        !word.split(\"/\").some((segment) => segment === \"..\"),\n    )\n  );\n}\n\nfunction checkRequires(check: SetupChecker, requires: unknown): void {\n  if (!isRecord(requires)) {\n    check.fail(\"requires\", \"must be an object\");\n    return;\n  }\n\n  const { integrations, features } = requires;\n  // Empty is meaningful rather than malformed: an automation that needs no\n  // credential connects to nothing, and the key stays required so that saying\n  // so is a deliberate statement instead of an omission.\n  if (!isRecord(integrations)) {\n    check.fail(\"requires.integrations\", \"must be an object\");\n  } else {\n    Object.entries(integrations).forEach(([id, requirement]) => {\n      const path = `requires.integrations.${id}`;\n      if (!isRecord(requirement)) {\n        check.fail(path, \"must be an object\");\n        return;\n      }\n      check.copy(requirement.message, `${path}.message`);\n      if (\"required\" in requirement && requirement.required !== false) {\n        check.fail(`${path}.required`, \"may only be false\");\n      }\n      const allowed = [\"message\", \"required\"];\n      Object.keys(requirement)\n        .filter((key) => !allowed.includes(key))\n        .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n    });\n  }\n\n  if (features !== undefined) {\n    if (!Array.isArray(features) || features.length === 0) {\n      check.fail(\"requires.features\", \"must be a non-empty array\");\n    } else {\n      features.forEach((feature, index) => {\n        if (typeof feature !== \"string\" || feature.length === 0) {\n          check.fail(\n            `requires.features[${index}]`,\n            \"must be a non-empty string\",\n          );\n        }\n      });\n    }\n  }\n}\n\nfunction checkConstraints(\n  check: SetupChecker,\n  constraints: unknown,\n  path: string,\n): void {\n  if (!isRecord(constraints) || Object.keys(constraints).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return;\n  }\n\n  const { minLength, maxLength, min, max, format } = constraints;\n  if (minLength !== undefined && !isInteger(minLength, 0)) {\n    check.fail(`${path}.minLength`, \"must be a non-negative integer\");\n  }\n  if (maxLength !== undefined && !isInteger(maxLength, 1)) {\n    check.fail(`${path}.maxLength`, \"must be a positive integer\");\n  }\n  if (min !== undefined && !isInteger(min, 0)) {\n    check.fail(`${path}.min`, \"must be a non-negative integer\");\n  }\n  if (max !== undefined && !isInteger(max, 1)) {\n    check.fail(`${path}.max`, \"must be a positive integer\");\n  }\n  if (format !== undefined && !isOneOf(format, CONSTRAINT_FORMATS)) {\n    check.fail(`${path}.format`, \"is not a supported format\");\n  }\n}\n\nfunction checkField(check: SetupChecker, field: unknown, path: string): void {\n  if (!isRecord(field)) {\n    check.fail(path, \"must be an object\");\n    return;\n  }\n\n  const { type, label, help, placeholder, required, provider, options } = field;\n\n  if (!isOneOf(type, FIELD_TYPES)) {\n    check.fail(`${path}.type`, \"is not a supported field type\");\n  }\n  check.copy(label, `${path}.label`);\n  check.copy(help, `${path}.help`);\n  if (placeholder !== undefined) check.copy(placeholder, `${path}.placeholder`);\n  if (\n    field.default !== undefined &&\n    typeof field.default !== \"string\" &&\n    typeof field.default !== \"number\" &&\n    typeof field.default !== \"boolean\" &&\n    field.default !== null\n  ) {\n    check.fail(`${path}.default`, \"must be a string, number, boolean or null\");\n  }\n  if (typeof required !== \"boolean\") {\n    check.fail(`${path}.required`, \"must be a boolean\");\n  }\n  if (provider !== undefined && !isOneOf(provider, GIT_PROVIDERS)) {\n    check.fail(`${path}.provider`, \"is not a supported provider\");\n  }\n  if (type === \"repo-picker\" && provider === undefined) {\n    check.fail(`${path}.provider`, \"is required for a repository field\");\n  }\n  // The host branches on this key to decide whether a field's value is a list,\n  // so a field declaring it anywhere else would be seeded with a list and\n  // rendered as a string.\n  if (\n    field.multiple !== undefined &&\n    (field.multiple !== true || type !== \"repo-picker\")\n  ) {\n    check.fail(\n      `${path}.multiple`,\n      \"may only be true, and only on a repository field\",\n    );\n  }\n\n  if (options !== undefined) {\n    if (type !== \"select\") {\n      check.fail(`${path}.options`, \"is only allowed on a select field\");\n    } else if (!Array.isArray(options) || options.length === 0) {\n      check.fail(`${path}.options`, \"must be a non-empty array\");\n    } else {\n      options.forEach((option, index) => {\n        const optionPath = `${path}.options[${index}]`;\n        if (!isRecord(option)) {\n          check.fail(optionPath, \"must be an object\");\n          return;\n        }\n        if (typeof option.value !== \"string\" || option.value.length === 0) {\n          check.fail(`${optionPath}.value`, \"must be a non-empty string\");\n        }\n        check.copy(option.label, `${optionPath}.label`);\n      });\n    }\n  }\n\n  if (field.constraints !== undefined) {\n    checkConstraints(check, field.constraints, `${path}.constraints`);\n  }\n}\n\n/** Returns the declared field names, so the caller can check them for collisions. */\nfunction checkFields(\n  check: SetupChecker,\n  fields: unknown,\n  path: string,\n): string[] {\n  if (!isRecord(fields) || Object.keys(fields).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return [];\n  }\n\n  return Object.entries(fields).map(([name, field]) => {\n    if (!FIELD_NAME_PATTERN.test(name)) {\n      check.fail(`${path}.${name}`, \"is not a valid field name\");\n    }\n    checkField(check, field, `${path}.${name}`);\n    return name;\n  });\n}\n\n/** Returns the trigger kinds declared, in order. */\nfunction checkForm(\n  check: SetupChecker,\n  form: unknown,\n): { kinds: string[]; fieldNames: string[] } {\n  if (!isRecord(form)) {\n    check.fail(\"setup.form\", \"must be an object\");\n    return { kinds: [], fieldNames: [] };\n  }\n\n  if (form.note !== undefined) check.copy(form.note, \"setup.form.note\");\n\n  const names = checkFields(check, form.args, \"setup.form.args\");\n  const kinds: string[] = [];\n\n  if (form.triggers !== undefined) {\n    if (!isRecord(form.triggers) || Object.keys(form.triggers).length === 0) {\n      check.fail(\"setup.form.triggers\", \"must be a non-empty object\");\n    } else {\n      Object.entries(form.triggers).forEach(([kind, fields]) => {\n        if (!isOneOf(kind, TRIGGER_KINDS)) {\n          check.fail(`setup.form.triggers.${kind}`, \"is not a trigger kind\");\n          return;\n        }\n        kinds.push(kind);\n        names.push(\n          ...checkFields(check, fields, `setup.form.triggers.${kind}`),\n        );\n      });\n    }\n  }\n\n  // The host merges both halves into one value map, so a repeated name would\n  // silently shadow a field and misaddress every error reported against it.\n  const duplicates = names.filter(\n    (name, index) => names.indexOf(name) !== index,\n  );\n  Array.from(new Set(duplicates)).forEach((name) =>\n    check.fail(`setup.form.${name}`, \"is declared more than once\"),\n  );\n\n  return { kinds, fieldNames: names };\n}\n\nfunction checkActionFeatures(\n  check: SetupChecker,\n  features: unknown,\n  path: string,\n): void {\n  if (!Array.isArray(features) || features.length === 0) {\n    check.fail(path, \"must be a non-empty array\");\n    return;\n  }\n  features.forEach((feature, index) => {\n    if (typeof feature !== \"string\" || feature.length === 0) {\n      check.fail(`${path}[${index}]`, \"must be a non-empty string\");\n    }\n  });\n}\n\nfunction checkAction(\n  check: SetupChecker,\n  kind: string,\n  action: unknown,\n  commonFieldNames: string[],\n): void {\n  const path = `setup.actions.${kind}`;\n  if (!isRecord(action)) {\n    check.fail(path, \"must be an object\");\n    return;\n  }\n\n  check.copy(action.label, `${path}.label`);\n  check.copy(action.help, `${path}.help`);\n  checkActionFeatures(check, action.features, `${path}.features`);\n  const actionFieldNames = checkFields(check, action.args, `${path}.args`);\n  actionFieldNames\n    .filter((name) => commonFieldNames.includes(name))\n    .forEach((name) =>\n      check.fail(`${path}.args.${name}`, \"is already declared by the form\"),\n    );\n\n  if (kind === \"prompt\") {\n    check.templateValue(action.prompt, `${path}.prompt`);\n  } else if (kind === \"plugin\") {\n    check.templateValue(action.prompt, `${path}.prompt`);\n    check.templateValue(action.plugins, `${path}.plugins`);\n  } else if (kind === \"upload\") {\n    check.templateValue(action.tarballPath, `${path}.tarballPath`);\n    check.templateValue(action.entrypoint, `${path}.entrypoint`);\n    if (action.setupScript !== undefined) {\n      check.templateValue(action.setupScript, `${path}.setupScript`);\n    }\n  } else {\n    check.fail(path, \"is not a supported action kind\");\n  }\n\n  const allowedByKind: Record<string, string[]> = {\n    prompt: [\"label\", \"help\", \"features\", \"args\", \"prompt\"],\n    plugin: [\"label\", \"help\", \"features\", \"args\", \"prompt\", \"plugins\"],\n    upload: [\n      \"label\",\n      \"help\",\n      \"features\",\n      \"args\",\n      \"tarballPath\",\n      \"entrypoint\",\n      \"setupScript\",\n    ],\n  };\n  const allowed = allowedByKind[kind] ?? [];\n  Object.keys(action)\n    .filter((key) => !allowed.includes(key))\n    .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n}\n\nfunction checkActions(\n  check: SetupChecker,\n  actions: unknown,\n  commonFieldNames: string[],\n): void {\n  if (!isRecord(actions) || Object.keys(actions).length === 0) {\n    check.fail(\"setup.actions\", \"must be a non-empty object\");\n    return;\n  }\n  Object.entries(actions).forEach(([kind, action]) =>\n    checkAction(check, kind, action, commonFieldNames),\n  );\n}\n\nfunction fieldsContainType(fields: unknown, type: string): boolean {\n  if (!isRecord(fields)) return false;\n  return Object.values(fields).some(\n    (field) => isRecord(field) && field.type === type,\n  );\n}\n\nfunction actionHasRepoPicker(action: unknown): boolean {\n  return isRecord(action) && fieldsContainType(action.args, \"repo-picker\");\n}\n\n/**\n * Whether an event trigger's `source` is derivable for every selectable action.\n *\n * `buildTrigger` fills `source` from a field named `source` in the event\n * trigger, or failing that from the selected action's repo-picker provider. A\n * picker in another trigger group (such as `cron`) is never collected for the\n * event trigger, and a picker in only some actions is invisible when one of the\n * others is selected — so neither may satisfy this check, or the user can end\n * up with an empty `source` no form field can fix.\n */\nfunction setupSuppliesEventSource(setup: Rec): boolean {\n  const form = isRecord(setup.form) ? setup.form : {};\n  const triggers = isRecord(form.triggers) ? form.triggers : {};\n  const eventFields = triggers.event;\n\n  // An explicit event-source field fills `source` directly, regardless of which\n  // action is selected.\n  if (fieldsContainType(eventFields, \"event-source\")) return true;\n\n  // A repo-picker in the event trigger is only collected when `event` is the\n  // sole trigger kind; with a sibling trigger the derivation reads no trigger\n  // fields for the picker. `form.args` is shared across every selection, so a\n  // picker there is always available.\n  const singleEventTrigger =\n    \"event\" in triggers && Object.keys(triggers).length === 1;\n  if (\n    (singleEventTrigger && fieldsContainType(eventFields, \"repo-picker\")) ||\n    fieldsContainType(form.args, \"repo-picker\")\n  ) {\n    return true;\n  }\n\n  // Without a shared or event-trigger picker, every selectable action must\n  // carry its own repo-picker; otherwise selecting an action without one\n  // derives `source: \"\"`.\n  if (!isRecord(setup.actions) || Object.keys(setup.actions).length === 0) {\n    return false;\n  }\n  return Object.values(setup.actions).every(actionHasRepoPicker);\n}\n\nfunction checkMessage(check: SetupChecker, message: unknown): void {\n  if (check.templateCopy(message, \"setup.message\")) {\n    if ((message as string).length > MAX_MESSAGE_LENGTH) {\n      check.fail(\n        \"setup.message\",\n        `must be at most ${MAX_MESSAGE_LENGTH} characters`,\n      );\n    }\n  }\n}\n\n/**\n * The script tarball a direct entry may ship.\n *\n * The strings here are commands and paths this host acts on, so they are held\n * to a closed character set rather than the placeholder rules copy uses: an\n * entrypoint with a shell metacharacter, or a packed path that escapes the\n * archive, is refused here rather than by the service.\n */\nfunction checkBundle(check: SetupChecker, bundle: unknown): void {\n  if (!isRecord(bundle)) {\n    check.fail(\"setup.bundle\", \"must be an object\");\n    return;\n  }\n\n  if (\n    typeof bundle.version !== \"string\" ||\n    !TEMPLATE_VERSION_PATTERN.test(bundle.version)\n  ) {\n    check.fail(\"setup.bundle.version\", \"must be a semantic version\");\n  }\n  if (!isPlainCommand(bundle.entrypoint)) {\n    check.fail(\n      \"setup.bundle.entrypoint\",\n      \"must be a plain command that stays inside the archive\",\n    );\n  }\n  if (\n    bundle.setupScript !== undefined &&\n    !isRelativePath(bundle.setupScript, BUNDLE_PATH_PATTERN)\n  ) {\n    check.fail(\"setup.bundle.setupScript\", \"must be a relative path\");\n  }\n  if (bundle.timeout !== undefined && !isInteger(bundle.timeout, 1)) {\n    check.fail(\"setup.bundle.timeout\", \"must be a positive integer\");\n  }\n\n  if (!isRecord(bundle.files) || Object.keys(bundle.files).length === 0) {\n    check.fail(\"setup.bundle.files\", \"must be a non-empty object\");\n  } else {\n    Object.entries(bundle.files).forEach(([packedPath, source]) => {\n      if (!isRelativePath(packedPath, BUNDLE_PATH_PATTERN)) {\n        check.fail(`setup.bundle.files.${packedPath}`, \"is not a packed path\");\n      }\n      // The rendered config is packed under this name too, and a tar carrying\n      // the name twice leaves which one the script reads to whichever\n      // extractor unpacks it.\n      if (packedPath === BUNDLE_CONFIG_FILENAME) {\n        check.fail(\n          `setup.bundle.files.${packedPath}`,\n          \"is the name the rendered config is packed under\",\n        );\n      }\n      if (!isRelativePath(source, BUNDLE_SOURCE_PATTERN)) {\n        check.fail(\n          `setup.bundle.files.${packedPath}`,\n          \"must name a file under skills/ or automations/\",\n        );\n      }\n    });\n\n    // A setup script the archive does not carry is a create request the\n    // service accepts and the first run fails on, and it is also the only\n    // thing packed executable - naming an unpacked file makes that rule\n    // unreachable.\n    if (\n      typeof bundle.setupScript === \"string\" &&\n      !(bundle.setupScript in bundle.files)\n    ) {\n      check.fail(\"setup.bundle.setupScript\", \"must name a packed file\");\n    }\n  }\n\n  if (!isRecord(bundle.config) || Object.keys(bundle.config).length === 0) {\n    check.fail(\"setup.bundle.config\", \"must be a non-empty object\");\n  } else {\n    checkBundleConfig(check, bundle.config, \"setup.bundle.config\");\n  }\n}\n\n/** Every string leaf of the config is a payload value: placeholders, no markup rule. */\nfunction checkBundleConfig(\n  check: SetupChecker,\n  node: unknown,\n  path: string,\n): void {\n  if (typeof node === \"string\") {\n    check.templateValue(node, path);\n    return;\n  }\n  if (Array.isArray(node)) {\n    node.forEach((item, index) =>\n      checkBundleConfig(check, item, `${path}[${index}]`),\n    );\n    return;\n  }\n  if (isRecord(node)) {\n    Object.entries(node).forEach(([key, value]) =>\n      checkBundleConfig(check, value, `${path}.${key}`),\n    );\n    return;\n  }\n  if (node !== null && typeof node !== \"number\" && typeof node !== \"boolean\") {\n    check.fail(\n      path,\n      \"must be a string, number, boolean, null, array or object\",\n    );\n  }\n}\n\nfunction checkMode(\n  check: SetupChecker,\n  setup: Rec,\n  kinds: string[],\n  commonFieldNames: string[],\n): void {\n  if (!isOneOf(setup.mode, SETUP_MODES)) {\n    check.fail(\"setup.mode\", \"is not a supported mode\");\n    return;\n  }\n\n  if (setup.mode === \"direct\") {\n    // A direct entry produces one of three things: a prompt, a script bundle\n    // the host packs and uploads, or a selectable set of action variants.\n    // More than one would be ambiguous, and none is nothing to create.\n    const hasPrompt = setup.prompt !== undefined;\n    const hasBundle = setup.bundle !== undefined;\n    const hasActions = setup.actions !== undefined;\n    const variants = [hasPrompt, hasBundle, hasActions].filter(Boolean);\n    if (variants.length !== 1) {\n      check.fail(\n        \"setup\",\n        \"must declare exactly one of prompt, bundle or actions for direct setup\",\n      );\n    } else if (hasBundle) {\n      checkBundle(check, setup.bundle);\n    } else if (hasActions) {\n      checkActions(check, setup.actions, commonFieldNames);\n    } else {\n      check.templateValue(setup.prompt, \"setup.prompt\");\n    }\n    // A direct entry may carry a fallback-conversation seed for deployments\n    // that cannot run the direct path, held to the same rules as an assisted\n    // message.\n    if (setup.message !== undefined) checkMessage(check, setup.message);\n\n    if (kinds.length === 0) {\n      check.fail(\n        \"setup.form.triggers\",\n        \"must declare at least one trigger kind\",\n      );\n    }\n    if (kinds.includes(\"event\") && !setupSuppliesEventSource(setup)) {\n      check.fail(\n        \"setup.form.triggers.event\",\n        \"must declare an event source field or repository picker\",\n      );\n    }\n    if (setup.filter !== undefined) {\n      if (!kinds.includes(\"event\")) {\n        check.fail(\"setup.filter\", \"is only allowed for an event trigger\");\n      } else {\n        check.templateValue(setup.filter, \"setup.filter\");\n      }\n    }\n    return;\n  }\n\n  checkMessage(check, setup.message);\n  check.absent(setup, \"prompt\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"bundle\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"actions\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"filter\", \"setup\", \"is only allowed for direct setup\");\n}\n\n/** Whether a catalog entry ships a setup experience at all. It is optional. */\nexport function hasSetupBlock(candidate: unknown): boolean {\n  return isRecord(candidate) && candidate.setup !== undefined;\n}\n\n/**\n * Decide whether this host will act on a catalog manifest.\n *\n * The version is checked first and fails closed: a format this host does not\n * recognise is refused rather than interpreted with today's rules.\n */\nexport function validateSetupEntry(candidate: unknown): SetupValidationResult {\n  const check = new SetupChecker();\n\n  if (!isRecord(candidate)) {\n    return { valid: false, errors: [\"manifest: must be an object\"] };\n  }\n\n  const { setup } = candidate;\n  if (!isRecord(setup)) {\n    return { valid: false, errors: [\"setup: must be an object\"] };\n  }\n  if (setup.version !== SETUP_VERSION) {\n    return {\n      valid: false,\n      errors: [`setup.version: must be \"${SETUP_VERSION}\"`],\n    };\n  }\n\n  if (\n    typeof candidate.id !== \"string\" ||\n    !ENTRY_ID_PATTERN.test(candidate.id)\n  ) {\n    check.fail(\"id\", \"must be a lowercase slug\");\n  }\n  check.copy(candidate.name, \"name\");\n  check.copy(candidate.description, \"description\");\n  if (\n    candidate.version !== undefined &&\n    (typeof candidate.version !== \"string\" ||\n      !TEMPLATE_VERSION_PATTERN.test(candidate.version))\n  ) {\n    check.fail(\"version\", \"must be a semantic version\");\n  }\n  if (\n    candidate.skill !== undefined &&\n    (typeof candidate.skill !== \"string\" ||\n      !ENTRY_ID_PATTERN.test(candidate.skill))\n  ) {\n    check.fail(\"skill\", \"must be a lowercase slug\");\n  }\n\n  checkRequires(check, candidate.requires);\n  const { kinds, fieldNames } = checkForm(check, setup.form);\n  checkMode(check, setup, kinds, fieldNames);\n\n  return { valid: check.errors.length === 0, errors: check.errors };\n}\n"],"mappings":"4EAwBA,IAAM,EAAmB,2BACnB,EAAqB,sBAErB,EAAiB,cASjB,EACJ,wLAII,EAAyB,sBACzB,EAAsB,wCACtB,EACJ,8DAEI,EAAkC,OACtC,eAAe,EAAA,6BAA6B,KAAK,GAAG,EAAE,0BACxD,EAEM,EAAc,CAAC,SAAU,UAAU,EACnC,EAAc,CAClB,OACA,WACA,SACA,SACA,OACA,WACA,cACA,cACA,eACA,aACA,iBACA,gBACF,EACM,EAAgB,CAAC,SAAU,SAAU,WAAW,EAChD,EAAgB,CAAC,OAAQ,OAAO,EAChC,EAAqB,CAAC,uBAAuB,EAG7C,EAAqB,IAS3B,SAAS,EAAS,EAA8B,CAC9C,OAAO,OAAO,GAAU,YAAY,GAAkB,CAAC,MAAM,QAAQ,CAAK,CAC5E,CAEA,SAAS,EACP,EACA,EACoB,CACpB,OACE,OAAO,GAAU,UAAa,EAA8B,SAAS,CAAK,CAE9E,CAEA,SAAS,EAAU,EAAgB,EAA0B,CAC3D,OACE,OAAO,GAAU,UAAY,OAAO,UAAU,CAAK,GAAK,GAAS,CAErE,CAEA,IAAM,EAAN,KAAmB,CACjB,OAA4B,CAAC,EAE7B,KAAK,EAAc,EAAuB,CAExC,OADA,KAAK,OAAO,KAAK,GAAG,EAAK,IAAI,GAAQ,EAC9B,EACT,CAGA,KAAK,EAAgB,EAAuB,CAO1C,OANI,OAAO,GAAU,UAAY,EAAM,SAAW,EACzC,KAAK,KAAK,EAAM,4BAA4B,EAEjD,EAAe,KAAK,CAAK,EACpB,KAAK,KAAK,EAAM,yBAAyB,EAE3C,EACT,CAEA,aAAa,EAAe,EAAuB,CAIjD,OAHI,EAA4B,KAAK,CAAK,EACjC,KAAK,KAAK,EAAM,uCAAuC,EAEzD,EACT,CAGA,aAAa,EAAgB,EAAuB,CAClD,OAAO,KAAK,KAAK,EAAO,CAAI,GAAK,KAAK,aAAa,EAAiB,CAAI,CAC1E,CAMA,cAAc,EAAgB,EAAuB,CAInD,OAHI,OAAO,GAAU,UAAY,EAAM,SAAW,EACzC,KAAK,KAAK,EAAM,4BAA4B,EAE9C,KAAK,aAAa,EAAO,CAAI,CACtC,CAEA,OAAO,EAAgB,EAAa,EAAc,EAAyB,CAEzE,OADI,KAAO,EAAkB,KAAK,KAAK,GAAG,EAAK,GAAG,IAAO,CAAM,EACxD,EACT,CACF,EASA,SAAS,EAAe,EAAgB,EAAkC,CACxE,OACE,OAAO,GAAU,UACjB,EAAQ,KAAK,CAAK,GAClB,CAAC,EAAM,MAAM,GAAG,EAAE,KAAM,GAAY,IAAY,KAAO,IAAY,IAAI,CAE3E,CAWA,SAAS,EAAe,EAAiC,CACvD,GAAI,OAAO,GAAU,UAAY,CAAC,EAAuB,KAAK,CAAK,EACjE,MAAO,GAET,IAAM,EAAQ,EAAM,MAAM,GAAG,EAAE,OAAQ,GAAS,EAAK,OAAS,CAAC,EAC/D,OACE,EAAM,OAAS,GACf,EAAM,MACH,GACC,CAAC,EAAK,WAAW,GAAG,GACpB,CAAC,EAAK,MAAM,GAAG,EAAE,KAAM,GAAY,IAAY,IAAI,CACvD,CAEJ,CAEA,SAAS,EAAc,EAAqB,EAAyB,CACnE,GAAI,CAAC,EAAS,CAAQ,EAAG,CACvB,EAAM,KAAK,WAAY,mBAAmB,EAC1C,MACF,CAEA,GAAM,CAAE,eAAc,YAAa,EAI9B,EAAS,CAAY,EAGxB,OAAO,QAAQ,CAAY,EAAE,SAAS,CAAC,EAAI,KAAiB,CAC1D,IAAM,EAAO,yBAAyB,IACtC,GAAI,CAAC,EAAS,CAAW,EAAG,CAC1B,EAAM,KAAK,EAAM,mBAAmB,EACpC,MACF,CACA,EAAM,KAAK,EAAY,QAAS,GAAG,EAAK,SAAS,EAC7C,aAAc,GAAe,EAAY,WAAa,IACxD,EAAM,KAAK,GAAG,EAAK,WAAY,mBAAmB,EAEpD,IAAM,EAAU,CAAC,UAAW,UAAU,EACtC,OAAO,KAAK,CAAW,EACpB,OAAQ,GAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,QAAS,GAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,IAAO,gBAAgB,CAAC,CACpE,CAAC,EAhBD,EAAM,KAAK,wBAAyB,mBAAmB,EAmBrD,IAAa,IAAA,KACX,CAAC,MAAM,QAAQ,CAAQ,GAAK,EAAS,SAAW,EAClD,EAAM,KAAK,oBAAqB,2BAA2B,EAE3D,EAAS,SAAS,EAAS,IAAU,EAC/B,OAAO,GAAY,UAAY,EAAQ,SAAW,IACpD,EAAM,KACJ,qBAAqB,EAAM,GAC3B,4BACF,CAEJ,CAAC,EAGP,CAEA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,CAAC,EAAS,CAAW,GAAK,OAAO,KAAK,CAAW,EAAE,SAAW,EAAG,CACnE,EAAM,KAAK,EAAM,4BAA4B,EAC7C,MACF,CAEA,GAAM,CAAE,YAAW,YAAW,MAAK,MAAK,UAAW,EAC/C,IAAc,IAAA,IAAa,CAAC,EAAU,EAAW,CAAC,GACpD,EAAM,KAAK,GAAG,EAAK,YAAa,gCAAgC,EAE9D,IAAc,IAAA,IAAa,CAAC,EAAU,EAAW,CAAC,GACpD,EAAM,KAAK,GAAG,EAAK,YAAa,4BAA4B,EAE1D,IAAQ,IAAA,IAAa,CAAC,EAAU,EAAK,CAAC,GACxC,EAAM,KAAK,GAAG,EAAK,MAAO,gCAAgC,EAExD,IAAQ,IAAA,IAAa,CAAC,EAAU,EAAK,CAAC,GACxC,EAAM,KAAK,GAAG,EAAK,MAAO,4BAA4B,EAEpD,IAAW,IAAA,IAAa,CAAC,EAAQ,EAAQ,CAAkB,GAC7D,EAAM,KAAK,GAAG,EAAK,SAAU,2BAA2B,CAE5D,CAEA,SAAS,EAAW,EAAqB,EAAgB,EAAoB,CAC3E,GAAI,CAAC,EAAS,CAAK,EAAG,CACpB,EAAM,KAAK,EAAM,mBAAmB,EACpC,MACF,CAEA,GAAM,CAAE,OAAM,QAAO,OAAM,cAAa,WAAU,WAAU,WAAY,EAEnE,EAAQ,EAAM,CAAW,GAC5B,EAAM,KAAK,GAAG,EAAK,OAAQ,+BAA+B,EAE5D,EAAM,KAAK,EAAO,GAAG,EAAK,OAAO,EACjC,EAAM,KAAK,EAAM,GAAG,EAAK,MAAM,EAC3B,IAAgB,IAAA,IAAW,EAAM,KAAK,EAAa,GAAG,EAAK,aAAa,EAE1E,EAAM,UAAY,IAAA,IAClB,OAAO,EAAM,SAAY,UACzB,OAAO,EAAM,SAAY,UACzB,OAAO,EAAM,SAAY,WACzB,EAAM,UAAY,MAElB,EAAM,KAAK,GAAG,EAAK,UAAW,2CAA2C,EAEvE,OAAO,GAAa,WACtB,EAAM,KAAK,GAAG,EAAK,WAAY,mBAAmB,EAEhD,IAAa,IAAA,IAAa,CAAC,EAAQ,EAAU,CAAa,GAC5D,EAAM,KAAK,GAAG,EAAK,WAAY,6BAA6B,EAE1D,IAAS,eAAiB,IAAa,IAAA,IACzC,EAAM,KAAK,GAAG,EAAK,WAAY,oCAAoC,EAMnE,EAAM,WAAa,IAAA,KAClB,EAAM,WAAa,IAAQ,IAAS,gBAErC,EAAM,KACJ,GAAG,EAAK,WACR,kDACF,EAGE,IAAY,IAAA,KACV,IAAS,SAEF,CAAC,MAAM,QAAQ,CAAO,GAAK,EAAQ,SAAW,EACvD,EAAM,KAAK,GAAG,EAAK,UAAW,2BAA2B,EAEzD,EAAQ,SAAS,EAAQ,IAAU,CACjC,IAAM,EAAa,GAAG,EAAK,WAAW,EAAM,GAC5C,GAAI,CAAC,EAAS,CAAM,EAAG,CACrB,EAAM,KAAK,EAAY,mBAAmB,EAC1C,MACF,EACI,OAAO,EAAO,OAAU,UAAY,EAAO,MAAM,SAAW,IAC9D,EAAM,KAAK,GAAG,EAAW,QAAS,4BAA4B,EAEhE,EAAM,KAAK,EAAO,MAAO,GAAG,EAAW,OAAO,CAChD,CAAC,EAdD,EAAM,KAAK,GAAG,EAAK,UAAW,mCAAmC,GAkBjE,EAAM,cAAgB,IAAA,IACxB,EAAiB,EAAO,EAAM,YAAa,GAAG,EAAK,aAAa,CAEpE,CAGA,SAAS,EACP,EACA,EACA,EACU,CAMV,MALI,CAAC,EAAS,CAAM,GAAK,OAAO,KAAK,CAAM,EAAE,SAAW,GACtD,EAAM,KAAK,EAAM,4BAA4B,EACtC,CAAC,GAGH,OAAO,QAAQ,CAAM,EAAE,KAAK,CAAC,EAAM,MACnC,EAAmB,KAAK,CAAI,GAC/B,EAAM,KAAK,GAAG,EAAK,GAAG,IAAQ,2BAA2B,EAE3D,EAAW,EAAO,EAAO,GAAG,EAAK,GAAG,GAAM,EACnC,EACR,CACH,CAGA,SAAS,EACP,EACA,EAC2C,CAC3C,GAAI,CAAC,EAAS,CAAI,EAEhB,OADA,EAAM,KAAK,aAAc,mBAAmB,EACrC,CAAE,MAAO,CAAC,EAAG,WAAY,CAAC,CAAE,EAGjC,EAAK,OAAS,IAAA,IAAW,EAAM,KAAK,EAAK,KAAM,iBAAiB,EAEpE,IAAM,EAAQ,EAAY,EAAO,EAAK,KAAM,iBAAiB,EACvD,EAAkB,CAAC,EAErB,EAAK,WAAa,IAAA,KAChB,CAAC,EAAS,EAAK,QAAQ,GAAK,OAAO,KAAK,EAAK,QAAQ,EAAE,SAAW,EACpE,EAAM,KAAK,sBAAuB,4BAA4B,EAE9D,OAAO,QAAQ,EAAK,QAAQ,EAAE,SAAS,CAAC,EAAM,KAAY,CACxD,GAAI,CAAC,EAAQ,EAAM,CAAa,EAAG,CACjC,EAAM,KAAK,uBAAuB,IAAQ,uBAAuB,EACjE,MACF,CACA,EAAM,KAAK,CAAI,EACf,EAAM,KACJ,GAAG,EAAY,EAAO,EAAQ,uBAAuB,GAAM,CAC7D,CACF,CAAC,GAML,IAAM,EAAa,EAAM,QACtB,EAAM,IAAU,EAAM,QAAQ,CAAI,IAAM,CAC3C,EAKA,OAJA,MAAM,KAAK,IAAI,IAAI,CAAU,CAAC,EAAE,QAAS,GACvC,EAAM,KAAK,cAAc,IAAQ,4BAA4B,CAC/D,EAEO,CAAE,QAAO,WAAY,CAAM,CACpC,CAEA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,CAAC,MAAM,QAAQ,CAAQ,GAAK,EAAS,SAAW,EAAG,CACrD,EAAM,KAAK,EAAM,2BAA2B,EAC5C,MACF,CACA,EAAS,SAAS,EAAS,IAAU,EAC/B,OAAO,GAAY,UAAY,EAAQ,SAAW,IACpD,EAAM,KAAK,GAAG,EAAK,GAAG,EAAM,GAAI,4BAA4B,CAEhE,CAAC,CACH,CAEA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EAAO,iBAAiB,IAC9B,GAAI,CAAC,EAAS,CAAM,EAAG,CACrB,EAAM,KAAK,EAAM,mBAAmB,EACpC,MACF,CAEA,EAAM,KAAK,EAAO,MAAO,GAAG,EAAK,OAAO,EACxC,EAAM,KAAK,EAAO,KAAM,GAAG,EAAK,MAAM,EACtC,EAAoB,EAAO,EAAO,SAAU,GAAG,EAAK,UAAU,EAE9D,EADqC,EAAO,EAAO,KAAM,GAAG,EAAK,MACjE,EACG,OAAQ,GAAS,EAAiB,SAAS,CAAI,CAAC,EAChD,QAAS,GACR,EAAM,KAAK,GAAG,EAAK,QAAQ,IAAQ,iCAAiC,CACtE,EAEE,IAAS,SACX,EAAM,cAAc,EAAO,OAAQ,GAAG,EAAK,QAAQ,EAC1C,IAAS,UAClB,EAAM,cAAc,EAAO,OAAQ,GAAG,EAAK,QAAQ,EACnD,EAAM,cAAc,EAAO,QAAS,GAAG,EAAK,SAAS,GAC5C,IAAS,UAClB,EAAM,cAAc,EAAO,YAAa,GAAG,EAAK,aAAa,EAC7D,EAAM,cAAc,EAAO,WAAY,GAAG,EAAK,YAAY,EACvD,EAAO,cAAgB,IAAA,IACzB,EAAM,cAAc,EAAO,YAAa,GAAG,EAAK,aAAa,GAG/D,EAAM,KAAK,EAAM,gCAAgC,EAgBnD,IAAM,EAAU,CAZd,OAAQ,CAAC,QAAS,OAAQ,WAAY,OAAQ,QAAQ,EACtD,OAAQ,CAAC,QAAS,OAAQ,WAAY,OAAQ,SAAU,SAAS,EACjE,OAAQ,CACN,QACA,OACA,WACA,OACA,cACA,aACA,aACF,CAEc,EAAc,IAAS,CAAC,EACxC,OAAO,KAAK,CAAM,EACf,OAAQ,GAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,QAAS,GAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,IAAO,gBAAgB,CAAC,CACpE,CAEA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,CAAC,EAAS,CAAO,GAAK,OAAO,KAAK,CAAO,EAAE,SAAW,EAAG,CAC3D,EAAM,KAAK,gBAAiB,4BAA4B,EACxD,MACF,CACA,OAAO,QAAQ,CAAO,EAAE,SAAS,CAAC,EAAM,KACtC,EAAY,EAAO,EAAM,EAAQ,CAAgB,CACnD,CACF,CAEA,SAAS,EAAkB,EAAiB,EAAuB,CAEjE,OADK,EAAS,CAAM,EACb,OAAO,OAAO,CAAM,EAAE,KAC1B,GAAU,EAAS,CAAK,GAAK,EAAM,OAAS,CAC/C,EAH8B,EAIhC,CAEA,SAAS,EAAoB,EAA0B,CACrD,OAAO,EAAS,CAAM,GAAK,EAAkB,EAAO,KAAM,aAAa,CACzE,CAYA,SAAS,EAAyB,EAAqB,CACrD,IAAM,EAAO,EAAS,EAAM,IAAI,EAAI,EAAM,KAAO,CAAC,EAC5C,EAAW,EAAS,EAAK,QAAQ,EAAI,EAAK,SAAW,CAAC,EACtD,EAAc,EAAS,MAyB7B,OArBI,EAAkB,EAAa,cAAc,GAO/C,UAAW,GAAY,OAAO,KAAK,CAAQ,EAAE,SAAW,GAEjC,EAAkB,EAAa,aAAa,GACnE,EAAkB,EAAK,KAAM,aAAa,EAEnC,GAML,CAAC,EAAS,EAAM,OAAO,GAAK,OAAO,KAAK,EAAM,OAAO,EAAE,SAAW,EAC7D,GAEF,OAAO,OAAO,EAAM,OAAO,EAAE,MAAM,CAAmB,CAC/D,CAEA,SAAS,EAAa,EAAqB,EAAwB,CAC7D,EAAM,aAAa,EAAS,eAAe,GACxC,EAAmB,OAAS,GAC/B,EAAM,KACJ,gBACA,mBAAmB,EAAmB,YACxC,CAGN,CAUA,SAAS,EAAY,EAAqB,EAAuB,CAC/D,GAAI,CAAC,EAAS,CAAM,EAAG,CACrB,EAAM,KAAK,eAAgB,mBAAmB,EAC9C,MACF,EAGE,OAAO,EAAO,SAAY,UAC1B,CAAC,EAAyB,KAAK,EAAO,OAAO,IAE7C,EAAM,KAAK,uBAAwB,4BAA4B,EAE5D,EAAe,EAAO,UAAU,GACnC,EAAM,KACJ,0BACA,uDACF,EAGA,EAAO,cAAgB,IAAA,IACvB,CAAC,EAAe,EAAO,YAAa,CAAmB,GAEvD,EAAM,KAAK,2BAA4B,yBAAyB,EAE9D,EAAO,UAAY,IAAA,IAAa,CAAC,EAAU,EAAO,QAAS,CAAC,GAC9D,EAAM,KAAK,uBAAwB,4BAA4B,EAG7D,CAAC,EAAS,EAAO,KAAK,GAAK,OAAO,KAAK,EAAO,KAAK,EAAE,SAAW,EAClE,EAAM,KAAK,qBAAsB,4BAA4B,GAE7D,OAAO,QAAQ,EAAO,KAAK,EAAE,SAAS,CAAC,EAAY,KAAY,CACxD,EAAe,EAAY,CAAmB,GACjD,EAAM,KAAK,sBAAsB,IAAc,sBAAsB,EAKnE,IAAA,eACF,EAAM,KACJ,sBAAsB,IACtB,iDACF,EAEG,EAAe,EAAQ,CAAqB,GAC/C,EAAM,KACJ,sBAAsB,IACtB,gDACF,CAEJ,CAAC,EAOC,OAAO,EAAO,aAAgB,UAC9B,EAAE,EAAO,eAAe,EAAO,QAE/B,EAAM,KAAK,2BAA4B,yBAAyB,GAIhE,CAAC,EAAS,EAAO,MAAM,GAAK,OAAO,KAAK,EAAO,MAAM,EAAE,SAAW,EACpE,EAAM,KAAK,sBAAuB,4BAA4B,EAE9D,EAAkB,EAAO,EAAO,OAAQ,qBAAqB,CAEjE,CAGA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,OAAO,GAAS,SAAU,CAC5B,EAAM,cAAc,EAAM,CAAI,EAC9B,MACF,CACA,GAAI,MAAM,QAAQ,CAAI,EAAG,CACvB,EAAK,SAAS,EAAM,IAClB,EAAkB,EAAO,EAAM,GAAG,EAAK,GAAG,EAAM,EAAE,CACpD,EACA,MACF,CACA,GAAI,EAAS,CAAI,EAAG,CAClB,OAAO,QAAQ,CAAI,EAAE,SAAS,CAAC,EAAK,KAClC,EAAkB,EAAO,EAAO,GAAG,EAAK,GAAG,GAAK,CAClD,EACA,MACF,CACI,IAAS,MAAQ,OAAO,GAAS,UAAY,OAAO,GAAS,WAC/D,EAAM,KACJ,EACA,0DACF,CAEJ,CAEA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,GAAI,CAAC,EAAQ,EAAM,KAAM,CAAW,EAAG,CACrC,EAAM,KAAK,aAAc,yBAAyB,EAClD,MACF,CAEA,GAAI,EAAM,OAAS,SAAU,CAI3B,IAAM,EAAY,EAAM,SAAW,IAAA,GAC7B,EAAY,EAAM,SAAW,IAAA,GAC7B,EAAa,EAAM,UAAY,IAAA,GACpB,CAAC,EAAW,EAAW,CAAU,EAAE,OAAO,OACvD,EAAS,SAAW,EAKb,EACT,EAAY,EAAO,EAAM,MAAM,EACtB,EACT,EAAa,EAAO,EAAM,QAAS,CAAgB,EAEnD,EAAM,cAAc,EAAM,OAAQ,cAAc,EAThD,EAAM,KACJ,QACA,wEACF,EAWE,EAAM,UAAY,IAAA,IAAW,EAAa,EAAO,EAAM,OAAO,EAE9D,EAAM,SAAW,GACnB,EAAM,KACJ,sBACA,wCACF,EAEE,EAAM,SAAS,OAAO,GAAK,CAAC,EAAyB,CAAK,GAC5D,EAAM,KACJ,4BACA,yDACF,EAEE,EAAM,SAAW,IAAA,KACd,EAAM,SAAS,OAAO,EAGzB,EAAM,cAAc,EAAM,OAAQ,cAAc,EAFhD,EAAM,KAAK,eAAgB,sCAAsC,GAKrE,MACF,CAEA,EAAa,EAAO,EAAM,OAAO,EACjC,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,EACzE,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,EACzE,EAAM,OAAO,EAAO,UAAW,QAAS,kCAAkC,EAC1E,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,CAC3E,CAGA,SAAgB,EAAc,EAA6B,CACzD,OAAO,EAAS,CAAS,GAAK,EAAU,QAAU,IAAA,EACpD,CAQA,SAAgB,EAAmB,EAA2C,CAC5E,IAAM,EAAQ,IAAI,EAElB,GAAI,CAAC,EAAS,CAAS,EACrB,MAAO,CAAE,MAAO,GAAO,OAAQ,CAAC,6BAA6B,CAAE,EAGjE,GAAM,CAAE,SAAU,EAClB,GAAI,CAAC,EAAS,CAAK,EACjB,MAAO,CAAE,MAAO,GAAO,OAAQ,CAAC,0BAA0B,CAAE,EAE9D,GAAI,EAAM,UAAA,MACR,MAAO,CACL,MAAO,GACP,OAAQ,CAAC,8BAA2C,CACtD,GAIA,OAAO,EAAU,IAAO,UACxB,CAAC,EAAiB,KAAK,EAAU,EAAE,IAEnC,EAAM,KAAK,KAAM,0BAA0B,EAE7C,EAAM,KAAK,EAAU,KAAM,MAAM,EACjC,EAAM,KAAK,EAAU,YAAa,aAAa,EAE7C,EAAU,UAAY,IAAA,KACrB,OAAO,EAAU,SAAY,UAC5B,CAAC,EAAyB,KAAK,EAAU,OAAO,IAElD,EAAM,KAAK,UAAW,4BAA4B,EAGlD,EAAU,QAAU,IAAA,KACnB,OAAO,EAAU,OAAU,UAC1B,CAAC,EAAiB,KAAK,EAAU,KAAK,IAExC,EAAM,KAAK,QAAS,0BAA0B,EAGhD,EAAc,EAAO,EAAU,QAAQ,EACvC,GAAM,CAAE,QAAO,cAAe,EAAU,EAAO,EAAM,IAAI,EAGzD,OAFA,EAAU,EAAO,EAAO,EAAO,CAAU,EAElC,CAAE,MAAO,EAAM,OAAO,SAAW,EAAG,OAAQ,EAAM,MAAO,CAClE"}

package/dist/manifests/manifest-validation.js

@@ -4,9 +4,15 @@ var t = /^[a-z0-9]+(-[a-z0-9]+)*$/, n = /^[a-z][A-Za-z0-9]*$/, r = /<[A-Za-z/!]/
 	"text",
 	"textarea",
 	"select",
+	"number",
 	"cron",
 	"timezone",
-	"repo-picker"
+	"repo-picker",
+	"llm-profile",
+	"event-source",
+	"event-type",
+	"plugin-sources",
+	"tarball-upload"
 ], d = [
 	"github",
 	"gitlab",
@@ -74,8 +80,8 @@ function S(e, t, n) {
 		e.fail(n, "must be a non-empty object");
 		return;
 	}
-	let { minLength: r, maxLength: i, format: a } = t;
-	r !== void 0 && !_(r, 0) && e.fail(`${n}.minLength`, "must be a non-negative integer"), i !== void 0 && !_(i, 1) && e.fail(`${n}.maxLength`, "must be a positive integer"), a !== void 0 && !g(a, p) && e.fail(`${n}.format`, "is not a supported format");
+	let { minLength: r, maxLength: i, min: a, max: o, format: s } = t;
+	r !== void 0 && !_(r, 0) && e.fail(`${n}.minLength`, "must be a non-negative integer"), i !== void 0 && !_(i, 1) && e.fail(`${n}.maxLength`, "must be a positive integer"), a !== void 0 && !_(a, 0) && e.fail(`${n}.min`, "must be a non-negative integer"), o !== void 0 && !_(o, 1) && e.fail(`${n}.max`, "must be a positive integer"), s !== void 0 && !g(s, p) && e.fail(`${n}.format`, "is not a supported format");
 }
 function C(e, t, n) {
 	if (!h(t)) {
@@ -83,7 +89,7 @@ function C(e, t, n) {
 		return;
 	}
 	let { type: r, label: i, help: a, placeholder: o, required: s, provider: c, options: l } = t;
-	g(r, u) || e.fail(`${n}.type`, "is not a supported field type"), e.copy(i, `${n}.label`), e.copy(a, `${n}.help`), o !== void 0 && e.copy(o, `${n}.placeholder`), t.default !== void 0 && typeof t.default != "string" && e.fail(`${n}.default`, "must be a string"), typeof s != "boolean" && e.fail(`${n}.required`, "must be a boolean"), c !== void 0 && !g(c, d) && e.fail(`${n}.provider`, "is not a supported provider"), r === "repo-picker" && c === void 0 && e.fail(`${n}.provider`, "is required for a repository field"), t.multiple !== void 0 && (t.multiple !== !0 || r !== "repo-picker") && e.fail(`${n}.multiple`, "may only be true, and only on a repository field"), l !== void 0 && (r === "select" ? !Array.isArray(l) || l.length === 0 ? e.fail(`${n}.options`, "must be a non-empty array") : l.forEach((t, r) => {
+	g(r, u) || e.fail(`${n}.type`, "is not a supported field type"), e.copy(i, `${n}.label`), e.copy(a, `${n}.help`), o !== void 0 && e.copy(o, `${n}.placeholder`), t.default !== void 0 && typeof t.default != "string" && typeof t.default != "number" && typeof t.default != "boolean" && t.default !== null && e.fail(`${n}.default`, "must be a string, number, boolean or null"), typeof s != "boolean" && e.fail(`${n}.required`, "must be a boolean"), c !== void 0 && !g(c, d) && e.fail(`${n}.provider`, "is not a supported provider"), r === "repo-picker" && c === void 0 && e.fail(`${n}.provider`, "is required for a repository field"), t.multiple !== void 0 && (t.multiple !== !0 || r !== "repo-picker") && e.fail(`${n}.multiple`, "may only be true, and only on a repository field"), l !== void 0 && (r === "select" ? !Array.isArray(l) || l.length === 0 ? e.fail(`${n}.options`, "must be a non-empty array") : l.forEach((t, r) => {
 		let i = `${n}.options[${r}]`;
 		if (!h(t)) {
 			e.fail(i, "must be an object");
@@ -96,7 +102,10 @@ function w(e, t, r) {
 	return !h(t) || Object.keys(t).length === 0 ? (e.fail(r, "must be a non-empty object"), []) : Object.entries(t).map(([t, i]) => (n.test(t) || e.fail(`${r}.${t}`, "is not a valid field name"), C(e, i, `${r}.${t}`), t));
 }
 function T(e, t) {
-	if (!h(t)) return e.fail("setup.form", "must be an object"), [];
+	if (!h(t)) return e.fail("setup.form", "must be an object"), {
+		kinds: [],
+		fieldNames: []
+	};
 	t.note !== void 0 && e.copy(t.note, "setup.form.note");
 	let n = w(e, t.args, "setup.form.args"), r = [];
 	t.triggers !== void 0 && (!h(t.triggers) || Object.keys(t.triggers).length === 0 ? e.fail("setup.form.triggers", "must be a non-empty object") : Object.entries(t.triggers).forEach(([t, i]) => {
@@ -107,72 +116,141 @@ function T(e, t) {
 		r.push(t), n.push(...w(e, i, `setup.form.triggers.${t}`));
 	}));
 	let i = n.filter((e, t) => n.indexOf(e) !== t);
-	return Array.from(new Set(i)).forEach((t) => e.fail(`setup.form.${t}`, "is declared more than once")), r;
+	return Array.from(new Set(i)).forEach((t) => e.fail(`setup.form.${t}`, "is declared more than once")), {
+		kinds: r,
+		fieldNames: n
+	};
+}
+function E(e, t, n) {
+	if (!Array.isArray(t) || t.length === 0) {
+		e.fail(n, "must be a non-empty array");
+		return;
+	}
+	t.forEach((t, r) => {
+		(typeof t != "string" || t.length === 0) && e.fail(`${n}[${r}]`, "must be a non-empty string");
+	});
+}
+function D(e, t, n, r) {
+	let i = `setup.actions.${t}`;
+	if (!h(n)) {
+		e.fail(i, "must be an object");
+		return;
+	}
+	e.copy(n.label, `${i}.label`), e.copy(n.help, `${i}.help`), E(e, n.features, `${i}.features`), w(e, n.args, `${i}.args`).filter((e) => r.includes(e)).forEach((t) => e.fail(`${i}.args.${t}`, "is already declared by the form")), t === "prompt" ? e.templateValue(n.prompt, `${i}.prompt`) : t === "plugin" ? (e.templateValue(n.prompt, `${i}.prompt`), e.templateValue(n.plugins, `${i}.plugins`)) : t === "upload" ? (e.templateValue(n.tarballPath, `${i}.tarballPath`), e.templateValue(n.entrypoint, `${i}.entrypoint`), n.setupScript !== void 0 && e.templateValue(n.setupScript, `${i}.setupScript`)) : e.fail(i, "is not a supported action kind");
+	let a = {
+		prompt: [
+			"label",
+			"help",
+			"features",
+			"args",
+			"prompt"
+		],
+		plugin: [
+			"label",
+			"help",
+			"features",
+			"args",
+			"prompt",
+			"plugins"
+		],
+		upload: [
+			"label",
+			"help",
+			"features",
+			"args",
+			"tarballPath",
+			"entrypoint",
+			"setupScript"
+		]
+	}[t] ?? [];
+	Object.keys(n).filter((e) => !a.includes(e)).forEach((t) => e.fail(`${i}.${t}`, "is not allowed"));
+}
+function O(e, t, n) {
+	if (!h(t) || Object.keys(t).length === 0) {
+		e.fail("setup.actions", "must be a non-empty object");
+		return;
+	}
+	Object.entries(t).forEach(([t, r]) => D(e, t, r, n));
+}
+function k(e, t) {
+	return h(e) ? Object.values(e).some((e) => h(e) && e.type === t) : !1;
 }
-function E(e) {
-	return h(e) ? [e.args, ...Object.values(h(e.triggers) ? e.triggers : {})].some((e) => h(e) && Object.values(e).some((e) => h(e) && e.type === "repo-picker")) : !1;
+function A(e) {
+	return h(e) && k(e.args, "repo-picker");
 }
-function D(e, t) {
+function j(e) {
+	let t = h(e.form) ? e.form : {}, n = h(t.triggers) ? t.triggers : {}, r = n.event;
+	return k(r, "event-source") || "event" in n && Object.keys(n).length === 1 && k(r, "repo-picker") || k(t.args, "repo-picker") ? !0 : !h(e.actions) || Object.keys(e.actions).length === 0 ? !1 : Object.values(e.actions).every(A);
+}
+function M(e, t) {
 	e.templateCopy(t, "setup.message") && t.length > m && e.fail("setup.message", `must be at most ${m} characters`);
 }
-function O(e, t) {
+function N(e, t) {
 	if (!h(t)) {
 		e.fail("setup.bundle", "must be an object");
 		return;
 	}
 	(typeof t.version != "string" || !i.test(t.version)) && e.fail("setup.bundle.version", "must be a semantic version"), b(t.entrypoint) || e.fail("setup.bundle.entrypoint", "must be a plain command that stays inside the archive"), t.setupScript !== void 0 && !y(t.setupScript, o) && e.fail("setup.bundle.setupScript", "must be a relative path"), t.timeout !== void 0 && !_(t.timeout, 1) && e.fail("setup.bundle.timeout", "must be a positive integer"), !h(t.files) || Object.keys(t.files).length === 0 ? e.fail("setup.bundle.files", "must be a non-empty object") : (Object.entries(t.files).forEach(([t, n]) => {
 		y(t, o) || e.fail(`setup.bundle.files.${t}`, "is not a packed path"), t === "config.json" && e.fail(`setup.bundle.files.${t}`, "is the name the rendered config is packed under"), y(n, s) || e.fail(`setup.bundle.files.${t}`, "must name a file under skills/ or automations/");
-	}), typeof t.setupScript == "string" && !(t.setupScript in t.files) && e.fail("setup.bundle.setupScript", "must name a packed file")), !h(t.config) || Object.keys(t.config).length === 0 ? e.fail("setup.bundle.config", "must be a non-empty object") : k(e, t.config, "setup.bundle.config");
+	}), typeof t.setupScript == "string" && !(t.setupScript in t.files) && e.fail("setup.bundle.setupScript", "must name a packed file")), !h(t.config) || Object.keys(t.config).length === 0 ? e.fail("setup.bundle.config", "must be a non-empty object") : P(e, t.config, "setup.bundle.config");
 }
-function k(e, t, n) {
+function P(e, t, n) {
 	if (typeof t == "string") {
 		e.templateValue(t, n);
 		return;
 	}
 	if (Array.isArray(t)) {
-		t.forEach((t, r) => k(e, t, `${n}[${r}]`));
+		t.forEach((t, r) => P(e, t, `${n}[${r}]`));
 		return;
 	}
 	if (h(t)) {
-		Object.entries(t).forEach(([t, r]) => k(e, r, `${n}.${t}`));
+		Object.entries(t).forEach(([t, r]) => P(e, r, `${n}.${t}`));
 		return;
 	}
 	t !== null && typeof t != "number" && typeof t != "boolean" && e.fail(n, "must be a string, number, boolean, null, array or object");
 }
-function A(e, t, n) {
+function F(e, t, n, r) {
 	if (!g(t.mode, l)) {
 		e.fail("setup.mode", "is not a supported mode");
 		return;
 	}
 	if (t.mode === "direct") {
-		let r = t.prompt !== void 0, i = t.bundle !== void 0;
-		r === i ? e.fail("setup", "must declare exactly one of prompt or bundle for direct setup") : i ? O(e, t.bundle) : e.templateValue(t.prompt, "setup.prompt"), t.message !== void 0 && D(e, t.message), n.length !== 1 && e.fail("setup.form.triggers", "must declare exactly one trigger kind"), n.includes("event") && !E(t.form) && e.fail("setup.form", "must declare a repository field for an event trigger"), t.filter !== void 0 && (n.includes("event") ? e.templateValue(t.filter, "setup.filter") : e.fail("setup.filter", "is only allowed for an event trigger"));
+		let i = t.prompt !== void 0, a = t.bundle !== void 0, o = t.actions !== void 0;
+		[
+			i,
+			a,
+			o
+		].filter(Boolean).length === 1 ? a ? N(e, t.bundle) : o ? O(e, t.actions, r) : e.templateValue(t.prompt, "setup.prompt") : e.fail("setup", "must declare exactly one of prompt, bundle or actions for direct setup"), t.message !== void 0 && M(e, t.message), n.length === 0 && e.fail("setup.form.triggers", "must declare at least one trigger kind"), n.includes("event") && !j(t) && e.fail("setup.form.triggers.event", "must declare an event source field or repository picker"), t.filter !== void 0 && (n.includes("event") ? e.templateValue(t.filter, "setup.filter") : e.fail("setup.filter", "is only allowed for an event trigger"));
 		return;
 	}
-	D(e, t.message), e.absent(t, "prompt", "setup", "is only allowed for direct setup"), e.absent(t, "bundle", "setup", "is only allowed for direct setup"), e.absent(t, "filter", "setup", "is only allowed for direct setup");
+	M(e, t.message), e.absent(t, "prompt", "setup", "is only allowed for direct setup"), e.absent(t, "bundle", "setup", "is only allowed for direct setup"), e.absent(t, "actions", "setup", "is only allowed for direct setup"), e.absent(t, "filter", "setup", "is only allowed for direct setup");
 }
-function j(e) {
+function I(e) {
 	return h(e) && e.setup !== void 0;
 }
-function M(e) {
+function L(e) {
 	let n = new v();
 	if (!h(e)) return {
 		valid: !1,
 		errors: ["manifest: must be an object"]
 	};
 	let { setup: r } = e;
-	return h(r) ? r.version === "1.0" ? ((typeof e.id != "string" || !t.test(e.id)) && n.fail("id", "must be a lowercase slug"), n.copy(e.name, "name"), n.copy(e.description, "description"), e.version !== void 0 && (typeof e.version != "string" || !i.test(e.version)) && n.fail("version", "must be a semantic version"), e.skill !== void 0 && (typeof e.skill != "string" || !t.test(e.skill)) && n.fail("skill", "must be a lowercase slug"), x(n, e.requires), A(n, r, T(n, r.form)), {
-		valid: n.errors.length === 0,
-		errors: n.errors
-	}) : {
-		valid: !1,
-		errors: ["setup.version: must be \"1.0\""]
-	} : {
+	if (!h(r)) return {
 		valid: !1,
 		errors: ["setup: must be an object"]
 	};
+	if (r.version !== "1.0") return {
+		valid: !1,
+		errors: ["setup.version: must be \"1.0\""]
+	};
+	(typeof e.id != "string" || !t.test(e.id)) && n.fail("id", "must be a lowercase slug"), n.copy(e.name, "name"), n.copy(e.description, "description"), e.version !== void 0 && (typeof e.version != "string" || !i.test(e.version)) && n.fail("version", "must be a semantic version"), e.skill !== void 0 && (typeof e.skill != "string" || !t.test(e.skill)) && n.fail("skill", "must be a lowercase slug"), x(n, e.requires);
+	let { kinds: a, fieldNames: o } = T(n, r.form);
+	return F(n, r, a, o), {
+		valid: n.errors.length === 0,
+		errors: n.errors
+	};
 }
 //#endregion
-export { j as hasSetupBlock, M as validateSetupEntry };
+export { I as hasSetupBlock, L as validateSetupEntry };
 
 //# sourceMappingURL=manifest-validation.js.map