npm - @openhands/agent-canvas - Versions diffs - 1.16.0 → 1.18.0 - Mend

@openhands/agent-canvas 1.16.0 → 1.18.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1093) hide show

package/dist/manifests/manifest-validation.js CHANGED Viewed

@@ -4,9 +4,15 @@ var t = /^[a-z0-9]+(-[a-z0-9]+)*$/, n = /^[a-z][A-Za-z0-9]*$/, r = /<[A-Za-z/!]/
 	"text",
 	"textarea",
 	"select",
+	"number",
 	"cron",
 	"timezone",
-	"repo-picker"
+	"repo-picker",
+	"llm-profile",
+	"event-source",
+	"event-type",
+	"plugin-sources",
+	"tarball-upload"
 ], d = [
 	"github",
 	"gitlab",
@@ -74,8 +80,8 @@ function S(e, t, n) {
 		e.fail(n, "must be a non-empty object");
 		return;
 	}
-	let { minLength: r, maxLength: i, format: a } = t;
-	r !== void 0 && !_(r, 0) && e.fail(`${n}.minLength`, "must be a non-negative integer"), i !== void 0 && !_(i, 1) && e.fail(`${n}.maxLength`, "must be a positive integer"), a !== void 0 && !g(a, p) && e.fail(`${n}.format`, "is not a supported format");
+	let { minLength: r, maxLength: i, min: a, max: o, format: s } = t;
+	r !== void 0 && !_(r, 0) && e.fail(`${n}.minLength`, "must be a non-negative integer"), i !== void 0 && !_(i, 1) && e.fail(`${n}.maxLength`, "must be a positive integer"), a !== void 0 && !_(a, 0) && e.fail(`${n}.min`, "must be a non-negative integer"), o !== void 0 && !_(o, 1) && e.fail(`${n}.max`, "must be a positive integer"), s !== void 0 && !g(s, p) && e.fail(`${n}.format`, "is not a supported format");
 }
 function C(e, t, n) {
 	if (!h(t)) {
@@ -83,7 +89,7 @@ function C(e, t, n) {
 		return;
 	}
 	let { type: r, label: i, help: a, placeholder: o, required: s, provider: c, options: l } = t;
-	g(r, u) || e.fail(`${n}.type`, "is not a supported field type"), e.copy(i, `${n}.label`), e.copy(a, `${n}.help`), o !== void 0 && e.copy(o, `${n}.placeholder`), t.default !== void 0 && typeof t.default != "string" && e.fail(`${n}.default`, "must be a string"), typeof s != "boolean" && e.fail(`${n}.required`, "must be a boolean"), c !== void 0 && !g(c, d) && e.fail(`${n}.provider`, "is not a supported provider"), r === "repo-picker" && c === void 0 && e.fail(`${n}.provider`, "is required for a repository field"), t.multiple !== void 0 && (t.multiple !== !0 || r !== "repo-picker") && e.fail(`${n}.multiple`, "may only be true, and only on a repository field"), l !== void 0 && (r === "select" ? !Array.isArray(l) || l.length === 0 ? e.fail(`${n}.options`, "must be a non-empty array") : l.forEach((t, r) => {
+	g(r, u) || e.fail(`${n}.type`, "is not a supported field type"), e.copy(i, `${n}.label`), e.copy(a, `${n}.help`), o !== void 0 && e.copy(o, `${n}.placeholder`), t.default !== void 0 && typeof t.default != "string" && typeof t.default != "number" && typeof t.default != "boolean" && t.default !== null && e.fail(`${n}.default`, "must be a string, number, boolean or null"), typeof s != "boolean" && e.fail(`${n}.required`, "must be a boolean"), c !== void 0 && !g(c, d) && e.fail(`${n}.provider`, "is not a supported provider"), r === "repo-picker" && c === void 0 && e.fail(`${n}.provider`, "is required for a repository field"), t.multiple !== void 0 && (t.multiple !== !0 || r !== "repo-picker") && e.fail(`${n}.multiple`, "may only be true, and only on a repository field"), l !== void 0 && (r === "select" ? !Array.isArray(l) || l.length === 0 ? e.fail(`${n}.options`, "must be a non-empty array") : l.forEach((t, r) => {
 		let i = `${n}.options[${r}]`;
 		if (!h(t)) {
 			e.fail(i, "must be an object");
@@ -96,7 +102,10 @@ function w(e, t, r) {
 	return !h(t) || Object.keys(t).length === 0 ? (e.fail(r, "must be a non-empty object"), []) : Object.entries(t).map(([t, i]) => (n.test(t) || e.fail(`${r}.${t}`, "is not a valid field name"), C(e, i, `${r}.${t}`), t));
 }
 function T(e, t) {
-	if (!h(t)) return e.fail("setup.form", "must be an object"), [];
+	if (!h(t)) return e.fail("setup.form", "must be an object"), {
+		kinds: [],
+		fieldNames: []
+	};
 	t.note !== void 0 && e.copy(t.note, "setup.form.note");
 	let n = w(e, t.args, "setup.form.args"), r = [];
 	t.triggers !== void 0 && (!h(t.triggers) || Object.keys(t.triggers).length === 0 ? e.fail("setup.form.triggers", "must be a non-empty object") : Object.entries(t.triggers).forEach(([t, i]) => {
@@ -107,72 +116,141 @@ function T(e, t) {
 		r.push(t), n.push(...w(e, i, `setup.form.triggers.${t}`));
 	}));
 	let i = n.filter((e, t) => n.indexOf(e) !== t);
-	return Array.from(new Set(i)).forEach((t) => e.fail(`setup.form.${t}`, "is declared more than once")), r;
+	return Array.from(new Set(i)).forEach((t) => e.fail(`setup.form.${t}`, "is declared more than once")), {
+		kinds: r,
+		fieldNames: n
+	};
+}
+function E(e, t, n) {
+	if (!Array.isArray(t) || t.length === 0) {
+		e.fail(n, "must be a non-empty array");
+		return;
+	}
+	t.forEach((t, r) => {
+		(typeof t != "string" || t.length === 0) && e.fail(`${n}[${r}]`, "must be a non-empty string");
+	});
+}
+function D(e, t, n, r) {
+	let i = `setup.actions.${t}`;
+	if (!h(n)) {
+		e.fail(i, "must be an object");
+		return;
+	}
+	e.copy(n.label, `${i}.label`), e.copy(n.help, `${i}.help`), E(e, n.features, `${i}.features`), w(e, n.args, `${i}.args`).filter((e) => r.includes(e)).forEach((t) => e.fail(`${i}.args.${t}`, "is already declared by the form")), t === "prompt" ? e.templateValue(n.prompt, `${i}.prompt`) : t === "plugin" ? (e.templateValue(n.prompt, `${i}.prompt`), e.templateValue(n.plugins, `${i}.plugins`)) : t === "upload" ? (e.templateValue(n.tarballPath, `${i}.tarballPath`), e.templateValue(n.entrypoint, `${i}.entrypoint`), n.setupScript !== void 0 && e.templateValue(n.setupScript, `${i}.setupScript`)) : e.fail(i, "is not a supported action kind");
+	let a = {
+		prompt: [
+			"label",
+			"help",
+			"features",
+			"args",
+			"prompt"
+		],
+		plugin: [
+			"label",
+			"help",
+			"features",
+			"args",
+			"prompt",
+			"plugins"
+		],
+		upload: [
+			"label",
+			"help",
+			"features",
+			"args",
+			"tarballPath",
+			"entrypoint",
+			"setupScript"
+		]
+	}[t] ?? [];
+	Object.keys(n).filter((e) => !a.includes(e)).forEach((t) => e.fail(`${i}.${t}`, "is not allowed"));
+}
+function O(e, t, n) {
+	if (!h(t) || Object.keys(t).length === 0) {
+		e.fail("setup.actions", "must be a non-empty object");
+		return;
+	}
+	Object.entries(t).forEach(([t, r]) => D(e, t, r, n));
+}
+function k(e, t) {
+	return h(e) ? Object.values(e).some((e) => h(e) && e.type === t) : !1;
 }
-function E(e) {
-	return h(e) ? [e.args, ...Object.values(h(e.triggers) ? e.triggers : {})].some((e) => h(e) && Object.values(e).some((e) => h(e) && e.type === "repo-picker")) : !1;
+function A(e) {
+	return h(e) && k(e.args, "repo-picker");
 }
-function D(e, t) {
+function j(e) {
+	let t = h(e.form) ? e.form : {}, n = h(t.triggers) ? t.triggers : {}, r = n.event;
+	return k(r, "event-source") || "event" in n && Object.keys(n).length === 1 && k(r, "repo-picker") || k(t.args, "repo-picker") ? !0 : !h(e.actions) || Object.keys(e.actions).length === 0 ? !1 : Object.values(e.actions).every(A);
+}
+function M(e, t) {
 	e.templateCopy(t, "setup.message") && t.length > m && e.fail("setup.message", `must be at most ${m} characters`);
 }
-function O(e, t) {
+function N(e, t) {
 	if (!h(t)) {
 		e.fail("setup.bundle", "must be an object");
 		return;
 	}
 	(typeof t.version != "string" || !i.test(t.version)) && e.fail("setup.bundle.version", "must be a semantic version"), b(t.entrypoint) || e.fail("setup.bundle.entrypoint", "must be a plain command that stays inside the archive"), t.setupScript !== void 0 && !y(t.setupScript, o) && e.fail("setup.bundle.setupScript", "must be a relative path"), t.timeout !== void 0 && !_(t.timeout, 1) && e.fail("setup.bundle.timeout", "must be a positive integer"), !h(t.files) || Object.keys(t.files).length === 0 ? e.fail("setup.bundle.files", "must be a non-empty object") : (Object.entries(t.files).forEach(([t, n]) => {
 		y(t, o) || e.fail(`setup.bundle.files.${t}`, "is not a packed path"), t === "config.json" && e.fail(`setup.bundle.files.${t}`, "is the name the rendered config is packed under"), y(n, s) || e.fail(`setup.bundle.files.${t}`, "must name a file under skills/ or automations/");
-	}), typeof t.setupScript == "string" && !(t.setupScript in t.files) && e.fail("setup.bundle.setupScript", "must name a packed file")), !h(t.config) || Object.keys(t.config).length === 0 ? e.fail("setup.bundle.config", "must be a non-empty object") : k(e, t.config, "setup.bundle.config");
+	}), typeof t.setupScript == "string" && !(t.setupScript in t.files) && e.fail("setup.bundle.setupScript", "must name a packed file")), !h(t.config) || Object.keys(t.config).length === 0 ? e.fail("setup.bundle.config", "must be a non-empty object") : P(e, t.config, "setup.bundle.config");
 }
-function k(e, t, n) {
+function P(e, t, n) {
 	if (typeof t == "string") {
 		e.templateValue(t, n);
 		return;
 	}
 	if (Array.isArray(t)) {
-		t.forEach((t, r) => k(e, t, `${n}[${r}]`));
+		t.forEach((t, r) => P(e, t, `${n}[${r}]`));
 		return;
 	}
 	if (h(t)) {
-		Object.entries(t).forEach(([t, r]) => k(e, r, `${n}.${t}`));
+		Object.entries(t).forEach(([t, r]) => P(e, r, `${n}.${t}`));
 		return;
 	}
 	t !== null && typeof t != "number" && typeof t != "boolean" && e.fail(n, "must be a string, number, boolean, null, array or object");
 }
-function A(e, t, n) {
+function F(e, t, n, r) {
 	if (!g(t.mode, l)) {
 		e.fail("setup.mode", "is not a supported mode");
 		return;
 	}
 	if (t.mode === "direct") {
-		let r = t.prompt !== void 0, i = t.bundle !== void 0;
-		r === i ? e.fail("setup", "must declare exactly one of prompt or bundle for direct setup") : i ? O(e, t.bundle) : e.templateValue(t.prompt, "setup.prompt"), t.message !== void 0 && D(e, t.message), n.length !== 1 && e.fail("setup.form.triggers", "must declare exactly one trigger kind"), n.includes("event") && !E(t.form) && e.fail("setup.form", "must declare a repository field for an event trigger"), t.filter !== void 0 && (n.includes("event") ? e.templateValue(t.filter, "setup.filter") : e.fail("setup.filter", "is only allowed for an event trigger"));
+		let i = t.prompt !== void 0, a = t.bundle !== void 0, o = t.actions !== void 0;
+		[
+			i,
+			a,
+			o
+		].filter(Boolean).length === 1 ? a ? N(e, t.bundle) : o ? O(e, t.actions, r) : e.templateValue(t.prompt, "setup.prompt") : e.fail("setup", "must declare exactly one of prompt, bundle or actions for direct setup"), t.message !== void 0 && M(e, t.message), n.length === 0 && e.fail("setup.form.triggers", "must declare at least one trigger kind"), n.includes("event") && !j(t) && e.fail("setup.form.triggers.event", "must declare an event source field or repository picker"), t.filter !== void 0 && (n.includes("event") ? e.templateValue(t.filter, "setup.filter") : e.fail("setup.filter", "is only allowed for an event trigger"));
 		return;
 	}
-	D(e, t.message), e.absent(t, "prompt", "setup", "is only allowed for direct setup"), e.absent(t, "bundle", "setup", "is only allowed for direct setup"), e.absent(t, "filter", "setup", "is only allowed for direct setup");
+	M(e, t.message), e.absent(t, "prompt", "setup", "is only allowed for direct setup"), e.absent(t, "bundle", "setup", "is only allowed for direct setup"), e.absent(t, "actions", "setup", "is only allowed for direct setup"), e.absent(t, "filter", "setup", "is only allowed for direct setup");
 }
-function j(e) {
+function I(e) {
 	return h(e) && e.setup !== void 0;
 }
-function M(e) {
+function L(e) {
 	let n = new v();
 	if (!h(e)) return {
 		valid: !1,
 		errors: ["manifest: must be an object"]
 	};
 	let { setup: r } = e;
-	return h(r) ? r.version === "1.0" ? ((typeof e.id != "string" || !t.test(e.id)) && n.fail("id", "must be a lowercase slug"), n.copy(e.name, "name"), n.copy(e.description, "description"), e.version !== void 0 && (typeof e.version != "string" || !i.test(e.version)) && n.fail("version", "must be a semantic version"), e.skill !== void 0 && (typeof e.skill != "string" || !t.test(e.skill)) && n.fail("skill", "must be a lowercase slug"), x(n, e.requires), A(n, r, T(n, r.form)), {
-		valid: n.errors.length === 0,
-		errors: n.errors
-	}) : {
-		valid: !1,
-		errors: ["setup.version: must be \"1.0\""]
-	} : {
+	if (!h(r)) return {
 		valid: !1,
 		errors: ["setup: must be an object"]
 	};
+	if (r.version !== "1.0") return {
+		valid: !1,
+		errors: ["setup.version: must be \"1.0\""]
+	};
+	(typeof e.id != "string" || !t.test(e.id)) && n.fail("id", "must be a lowercase slug"), n.copy(e.name, "name"), n.copy(e.description, "description"), e.version !== void 0 && (typeof e.version != "string" || !i.test(e.version)) && n.fail("version", "must be a semantic version"), e.skill !== void 0 && (typeof e.skill != "string" || !t.test(e.skill)) && n.fail("skill", "must be a lowercase slug"), x(n, e.requires);
+	let { kinds: a, fieldNames: o } = T(n, r.form);
+	return F(n, r, a, o), {
+		valid: n.errors.length === 0,
+		errors: n.errors
+	};
 }
 //#endregion
-export { j as hasSetupBlock, M as validateSetupEntry };
+export { I as hasSetupBlock, L as validateSetupEntry };
 //# sourceMappingURL=manifest-validation.js.map

package/dist/manifests/manifest-validation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"manifest-validation.js","names":[],"sources":["../../src/manifests/manifest-validation.ts"],"sourcesContent":["/*\n Admission policy for extension-authored catalog manifests.\n \n A manifest is data authored in a different repository that instructs this host\n * to render copy and compose a request. The host therefore decides what a\n * manifest is permitted to do rather than trusting the file — validation here\n * is a trust boundary, not a convenience check, and it deliberately does not\n * defer to a schema shipped alongside the manifests it would be validating.\n \n Beyond mirroring the published schema, this adds the invariants the host's own\n * derivation depends on: a single trigger kind to read, a repository field for\n * an event trigger's source, and field names unique across the form. Without\n * them the derived request body would be silently wrong rather than rejected.\n \n A manifest that fails any check is rejected outright. It never renders a\n * partial UI, because everything downstream treats its content as instructions.\n /\n\nimport {\n BUNDLE_CONFIG_FILENAME,\n SETUP_PLACEHOLDER_NAMESPACES,\n SETUP_VERSION,\n} from \"./types\";\n\nconst ENTRY_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)$/;\nconst FIELD_NAME_PATTERN = /^[a-z][A-Za-z0-9]$/;\n/* Copy must never be able to inject markup into the host. /\nconst MARKUP_PATTERN = /<[A-Za-z/!]/;\n/\n A template version, declared as `version` by a prompt entry and as\n * `setup.bundle.version` by a bundle one. Sent to the service as template\n * provenance, so it is checked at admission. Full semver, as the spec at\n * semver.org states it: a catalog entry published with a pre-release or build\n * suffix is still a version this host may forward, and refusing one would drop\n * the entry from the registry outright.\n /\nconst TEMPLATE_VERSION_PATTERN =\n /^(?:0\|[1-9]\\d)\\.(?:0\|[1-9]\\d)\\.(?:0\|[1-9]\\d)(?:-(?:0\|[1-9]\\d\|\\d[a-zA-Z-][0-9a-zA-Z-])(?:\\.(?:0\|[1-9]\\d\|\\d[a-zA-Z-][0-9a-zA-Z-])))?(?:\\+[0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+))?$/;\n// The characters a command of plain words and paths is made of. No shell\n// metacharacters, which the service rejects anyway and a bundle has no reason\n// to need; where those words may point is `isPlainCommand`'s to say.\nconst BUNDLE_COMMAND_PATTERN = /^[A-Za-z0-9 ._/-]+$/;\nconst BUNDLE_PATH_PATTERN = /^[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)$/;\nconst BUNDLE_SOURCE_PATTERN =\n /^(skills\|automations)\\/[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)$/;\n/** Every `{{` must open a known namespace and close immediately. /\nconst UNKNOWN_PLACEHOLDER_PATTERN = new RegExp(\n `\\\\{\\\\{(?!(?:${SETUP_PLACEHOLDER_NAMESPACES.join(\"\|\")})\\\\.[A-Za-z0-9_.]+\\\\}\\\\})`,\n);\n\nconst SETUP_MODES = [\"direct\", \"assisted\"] as const;\nconst FIELD_TYPES = [\n \"text\",\n \"textarea\",\n \"select\",\n \"cron\",\n \"timezone\",\n \"repo-picker\",\n] as const;\nconst GIT_PROVIDERS = [\"github\", \"gitlab\", \"bitbucket\"] as const;\nconst TRIGGER_KINDS = [\"cron\", \"event\"] as const;\nconst CONSTRAINT_FORMATS = [\"safeExpressionLiteral\"] as const;\n\n/* Setup context only, so this can never become a channel for runtime instructions. /\nconst MAX_MESSAGE_LENGTH = 2000;\n\nexport interface SetupValidationResult {\n valid: boolean;\n errors: string[];\n}\n\ntype Rec = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is Rec {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isOneOf<T extends readonly string[]>(\n value: unknown,\n allowed: T,\n): value is T[number] {\n return (\n typeof value === \"string\" && (allowed as readonly string[]).includes(value)\n );\n}\n\nfunction isInteger(value: unknown, minimum: number): boolean {\n return (\n typeof value === \"number\" && Number.isInteger(value) && value >= minimum\n );\n}\n\nclass SetupChecker {\n readonly errors: string[] = [];\n\n fail(path: string, reason: string): false {\n this.errors.push(`${path}: ${reason}`);\n return false;\n }\n\n /* Literal user-visible copy. Carries no markup. /\n copy(value: unknown, path: string): boolean {\n if (typeof value !== \"string\" \|\| value.length === 0) {\n return this.fail(path, \"must be a non-empty string\");\n }\n if (MARKUP_PATTERN.test(value)) {\n return this.fail(path, \"must not contain markup\");\n }\n return true;\n }\n\n placeholders(value: string, path: string): boolean {\n if (UNKNOWN_PLACEHOLDER_PATTERN.test(value)) {\n return this.fail(path, \"uses an unknown placeholder namespace\");\n }\n return true;\n }\n\n /* Copy that may embed `{{namespace.key}}` placeholders. /\n templateCopy(value: unknown, path: string): boolean {\n return this.copy(value, path) && this.placeholders(value as string, path);\n }\n\n /\n A request-body string that may embed placeholders. Never rendered, so\n * expression syntax such as a JMESPath filter is allowed through.\n /\n templateValue(value: unknown, path: string): boolean {\n if (typeof value !== \"string\" \|\| value.length === 0) {\n return this.fail(path, \"must be a non-empty string\");\n }\n return this.placeholders(value, path);\n }\n\n absent(container: Rec, key: string, path: string, reason: string): boolean {\n if (key in container) return this.fail(`${path}.${key}`, reason);\n return true;\n }\n}\n\n/\n A relative path that stays inside the archive it names.\n \n The character class alone is not enough: `.` and `..` are made of allowed\n * characters, so a segment check is what actually keeps a packed file from\n * climbing out of the directory it is extracted into.\n /\nfunction isRelativePath(value: unknown, pattern: RegExp): value is string {\n return (\n typeof value === \"string\" &&\n pattern.test(value) &&\n !value.split(\"/\").some((segment) => segment === \".\" \|\| segment === \"..\")\n );\n}\n\n/\n A command whose every word stays inside the archive it is run in.\n \n The character class is not what keeps it there: `/` and `.` are allowed\n * characters, so `/bin/sh setup.sh` and `python3 ../../etc/x.py` are made of\n * them and each names something outside the extracted directory. The segment\n * rule packed paths are held to is what refuses those, and requiring a word at\n * all is what refuses an entrypoint of nothing but spaces.\n /\nfunction isPlainCommand(value: unknown): value is string {\n if (typeof value !== \"string\" \|\| !BUNDLE_COMMAND_PATTERN.test(value)) {\n return false;\n }\n const words = value.split(\" \").filter((word) => word.length > 0);\n return (\n words.length > 0 &&\n words.every(\n (word) =>\n !word.startsWith(\"/\") &&\n !word.split(\"/\").some((segment) => segment === \"..\"),\n )\n );\n}\n\nfunction checkRequires(check: SetupChecker, requires: unknown): void {\n if (!isRecord(requires)) {\n check.fail(\"requires\", \"must be an object\");\n return;\n }\n\n const { integrations, features } = requires;\n // Empty is meaningful rather than malformed: an automation that needs no\n // credential connects to nothing, and the key stays required so that saying\n // so is a deliberate statement instead of an omission.\n if (!isRecord(integrations)) {\n check.fail(\"requires.integrations\", \"must be an object\");\n } else {\n Object.entries(integrations).forEach(([id, requirement]) => {\n const path = `requires.integrations.${id}`;\n if (!isRecord(requirement)) {\n check.fail(path, \"must be an object\");\n return;\n }\n check.copy(requirement.message, `${path}.message`);\n if (\"required\" in requirement && requirement.required !== false) {\n check.fail(`${path}.required`, \"may only be false\");\n }\n const allowed = [\"message\", \"required\"];\n Object.keys(requirement)\n .filter((key) => !allowed.includes(key))\n .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n });\n }\n\n if (features !== undefined) {\n if (!Array.isArray(features) \|\| features.length === 0) {\n check.fail(\"requires.features\", \"must be a non-empty array\");\n } else {\n features.forEach((feature, index) => {\n if (typeof feature !== \"string\" \|\| feature.length === 0) {\n check.fail(\n `requires.features[${index}]`,\n \"must be a non-empty string\",\n );\n }\n });\n }\n }\n}\n\nfunction checkConstraints(\n check: SetupChecker,\n constraints: unknown,\n path: string,\n): void {\n if (!isRecord(constraints) \|\| Object.keys(constraints).length === 0) {\n check.fail(path, \"must be a non-empty object\");\n return;\n }\n\n const { minLength, maxLength, format } = constraints;\n if (minLength !== undefined && !isInteger(minLength, 0)) {\n check.fail(`${path}.minLength`, \"must be a non-negative integer\");\n }\n if (maxLength !== undefined && !isInteger(maxLength, 1)) {\n check.fail(`${path}.maxLength`, \"must be a positive integer\");\n }\n if (format !== undefined && !isOneOf(format, CONSTRAINT_FORMATS)) {\n check.fail(`${path}.format`, \"is not a supported format\");\n }\n}\n\nfunction checkField(check: SetupChecker, field: unknown, path: string): void {\n if (!isRecord(field)) {\n check.fail(path, \"must be an object\");\n return;\n }\n\n const { type, label, help, placeholder, required, provider, options } = field;\n\n if (!isOneOf(type, FIELD_TYPES)) {\n check.fail(`${path}.type`, \"is not a supported field type\");\n }\n check.copy(label, `${path}.label`);\n check.copy(help, `${path}.help`);\n if (placeholder !== undefined) check.copy(placeholder, `${path}.placeholder`);\n if (field.default !== undefined && typeof field.default !== \"string\") {\n check.fail(`${path}.default`, \"must be a string\");\n }\n if (typeof required !== \"boolean\") {\n check.fail(`${path}.required`, \"must be a boolean\");\n }\n if (provider !== undefined && !isOneOf(provider, GIT_PROVIDERS)) {\n check.fail(`${path}.provider`, \"is not a supported provider\");\n }\n if (type === \"repo-picker\" && provider === undefined) {\n check.fail(`${path}.provider`, \"is required for a repository field\");\n }\n // The host branches on this key to decide whether a field's value is a list,\n // so a field declaring it anywhere else would be seeded with a list and\n // rendered as a string.\n if (\n field.multiple !== undefined &&\n (field.multiple !== true \|\| type !== \"repo-picker\")\n ) {\n check.fail(\n `${path}.multiple`,\n \"may only be true, and only on a repository field\",\n );\n }\n\n if (options !== undefined) {\n if (type !== \"select\") {\n check.fail(`${path}.options`, \"is only allowed on a select field\");\n } else if (!Array.isArray(options) \|\| options.length === 0) {\n check.fail(`${path}.options`, \"must be a non-empty array\");\n } else {\n options.forEach((option, index) => {\n const optionPath = `${path}.options[${index}]`;\n if (!isRecord(option)) {\n check.fail(optionPath, \"must be an object\");\n return;\n }\n if (typeof option.value !== \"string\" \|\| option.value.length === 0) {\n check.fail(`${optionPath}.value`, \"must be a non-empty string\");\n }\n check.copy(option.label, `${optionPath}.label`);\n });\n }\n }\n\n if (field.constraints !== undefined) {\n checkConstraints(check, field.constraints, `${path}.constraints`);\n }\n}\n\n/* Returns the declared field names, so the caller can check them for collisions. /\nfunction checkFields(\n check: SetupChecker,\n fields: unknown,\n path: string,\n): string[] {\n if (!isRecord(fields) \|\| Object.keys(fields).length === 0) {\n check.fail(path, \"must be a non-empty object\");\n return [];\n }\n\n return Object.entries(fields).map(([name, field]) => {\n if (!FIELD_NAME_PATTERN.test(name)) {\n check.fail(`${path}.${name}`, \"is not a valid field name\");\n }\n checkField(check, field, `${path}.${name}`);\n return name;\n });\n}\n\n/* Returns the trigger kinds declared, in order. /\nfunction checkForm(check: SetupChecker, form: unknown): string[] {\n if (!isRecord(form)) {\n check.fail(\"setup.form\", \"must be an object\");\n return [];\n }\n\n if (form.note !== undefined) check.copy(form.note, \"setup.form.note\");\n\n const names = checkFields(check, form.args, \"setup.form.args\");\n const kinds: string[] = [];\n\n if (form.triggers !== undefined) {\n if (!isRecord(form.triggers) \|\| Object.keys(form.triggers).length === 0) {\n check.fail(\"setup.form.triggers\", \"must be a non-empty object\");\n } else {\n Object.entries(form.triggers).forEach(([kind, fields]) => {\n if (!isOneOf(kind, TRIGGER_KINDS)) {\n check.fail(`setup.form.triggers.${kind}`, \"is not a trigger kind\");\n return;\n }\n kinds.push(kind);\n names.push(\n ...checkFields(check, fields, `setup.form.triggers.${kind}`),\n );\n });\n }\n }\n\n // The host merges both halves into one value map, so a repeated name would\n // silently shadow a field and misaddress every error reported against it.\n const duplicates = names.filter(\n (name, index) => names.indexOf(name) !== index,\n );\n Array.from(new Set(duplicates)).forEach((name) =>\n check.fail(`setup.form.${name}`, \"is declared more than once\"),\n );\n\n return kinds;\n}\n\nfunction hasRepoPicker(form: unknown): boolean {\n if (!isRecord(form)) return false;\n const groups = [\n form.args,\n ...Object.values(isRecord(form.triggers) ? form.triggers : {}),\n ];\n return groups.some(\n (group) =>\n isRecord(group) &&\n Object.values(group).some(\n (field) => isRecord(field) && field.type === \"repo-picker\",\n ),\n );\n}\n\nfunction checkMessage(check: SetupChecker, message: unknown): void {\n if (check.templateCopy(message, \"setup.message\")) {\n if ((message as string).length > MAX_MESSAGE_LENGTH) {\n check.fail(\n \"setup.message\",\n `must be at most ${MAX_MESSAGE_LENGTH} characters`,\n );\n }\n }\n}\n\n/\n The script tarball a direct entry may ship.\n \n The strings here are commands and paths this host acts on, so they are held\n * to a closed character set rather than the placeholder rules copy uses: an\n * entrypoint with a shell metacharacter, or a packed path that escapes the\n * archive, is refused here rather than by the service.\n /\nfunction checkBundle(check: SetupChecker, bundle: unknown): void {\n if (!isRecord(bundle)) {\n check.fail(\"setup.bundle\", \"must be an object\");\n return;\n }\n\n if (\n typeof bundle.version !== \"string\" \|\|\n !TEMPLATE_VERSION_PATTERN.test(bundle.version)\n ) {\n check.fail(\"setup.bundle.version\", \"must be a semantic version\");\n }\n if (!isPlainCommand(bundle.entrypoint)) {\n check.fail(\n \"setup.bundle.entrypoint\",\n \"must be a plain command that stays inside the archive\",\n );\n }\n if (\n bundle.setupScript !== undefined &&\n !isRelativePath(bundle.setupScript, BUNDLE_PATH_PATTERN)\n ) {\n check.fail(\"setup.bundle.setupScript\", \"must be a relative path\");\n }\n if (bundle.timeout !== undefined && !isInteger(bundle.timeout, 1)) {\n check.fail(\"setup.bundle.timeout\", \"must be a positive integer\");\n }\n\n if (!isRecord(bundle.files) \|\| Object.keys(bundle.files).length === 0) {\n check.fail(\"setup.bundle.files\", \"must be a non-empty object\");\n } else {\n Object.entries(bundle.files).forEach(([packedPath, source]) => {\n if (!isRelativePath(packedPath, BUNDLE_PATH_PATTERN)) {\n check.fail(`setup.bundle.files.${packedPath}`, \"is not a packed path\");\n }\n // The rendered config is packed under this name too, and a tar carrying\n // the name twice leaves which one the script reads to whichever\n // extractor unpacks it.\n if (packedPath === BUNDLE_CONFIG_FILENAME) {\n check.fail(\n `setup.bundle.files.${packedPath}`,\n \"is the name the rendered config is packed under\",\n );\n }\n if (!isRelativePath(source, BUNDLE_SOURCE_PATTERN)) {\n check.fail(\n `setup.bundle.files.${packedPath}`,\n \"must name a file under skills/ or automations/\",\n );\n }\n });\n\n // A setup script the archive does not carry is a create request the\n // service accepts and the first run fails on, and it is also the only\n // thing packed executable - naming an unpacked file makes that rule\n // unreachable.\n if (\n typeof bundle.setupScript === \"string\" &&\n !(bundle.setupScript in bundle.files)\n ) {\n check.fail(\"setup.bundle.setupScript\", \"must name a packed file\");\n }\n }\n\n if (!isRecord(bundle.config) \|\| Object.keys(bundle.config).length === 0) {\n check.fail(\"setup.bundle.config\", \"must be a non-empty object\");\n } else {\n checkBundleConfig(check, bundle.config, \"setup.bundle.config\");\n }\n}\n\n/* Every string leaf of the config is a payload value: placeholders, no markup rule. /\nfunction checkBundleConfig(\n check: SetupChecker,\n node: unknown,\n path: string,\n): void {\n if (typeof node === \"string\") {\n check.templateValue(node, path);\n return;\n }\n if (Array.isArray(node)) {\n node.forEach((item, index) =>\n checkBundleConfig(check, item, `${path}[${index}]`),\n );\n return;\n }\n if (isRecord(node)) {\n Object.entries(node).forEach(([key, value]) =>\n checkBundleConfig(check, value, `${path}.${key}`),\n );\n return;\n }\n if (node !== null && typeof node !== \"number\" && typeof node !== \"boolean\") {\n check.fail(\n path,\n \"must be a string, number, boolean, null, array or object\",\n );\n }\n}\n\nfunction checkMode(check: SetupChecker, setup: Rec, kinds: string[]): void {\n if (!isOneOf(setup.mode, SETUP_MODES)) {\n check.fail(\"setup.mode\", \"is not a supported mode\");\n return;\n }\n\n if (setup.mode === \"direct\") {\n // A direct entry produces one of two things: a prompt, or a script bundle\n // the host packs and uploads. Both would be ambiguous, neither is nothing\n // to create.\n const hasPrompt = setup.prompt !== undefined;\n const hasBundle = setup.bundle !== undefined;\n if (hasPrompt === hasBundle) {\n check.fail(\n \"setup\",\n \"must declare exactly one of prompt or bundle for direct setup\",\n );\n } else if (hasBundle) {\n checkBundle(check, setup.bundle);\n } else {\n check.templateValue(setup.prompt, \"setup.prompt\");\n }\n // A direct entry may carry a fallback-conversation seed for deployments\n // that cannot run the direct path, held to the same rules as an assisted\n // message.\n if (setup.message !== undefined) checkMessage(check, setup.message);\n\n // The derivation reads a single trigger kind, and an event trigger takes\n // its source from the repository field's provider.\n if (kinds.length !== 1) {\n check.fail(\n \"setup.form.triggers\",\n \"must declare exactly one trigger kind\",\n );\n }\n if (kinds.includes(\"event\") && !hasRepoPicker(setup.form)) {\n check.fail(\n \"setup.form\",\n \"must declare a repository field for an event trigger\",\n );\n }\n if (setup.filter !== undefined) {\n if (!kinds.includes(\"event\")) {\n check.fail(\"setup.filter\", \"is only allowed for an event trigger\");\n } else {\n check.templateValue(setup.filter, \"setup.filter\");\n }\n }\n return;\n }\n\n checkMessage(check, setup.message);\n check.absent(setup, \"prompt\", \"setup\", \"is only allowed for direct setup\");\n check.absent(setup, \"bundle\", \"setup\", \"is only allowed for direct setup\");\n check.absent(setup, \"filter\", \"setup\", \"is only allowed for direct setup\");\n}\n\n/* Whether a catalog entry ships a setup experience at all. It is optional. /\nexport function hasSetupBlock(candidate: unknown): boolean {\n return isRecord(candidate) && candidate.setup !== undefined;\n}\n\n/\n Decide whether this host will act on a catalog manifest.\n \n The version is checked first and fails closed: a format this host does not\n * recognise is refused rather than interpreted with today's rules.\n */\nexport function validateSetupEntry(candidate: unknown): SetupValidationResult {\n const check = new SetupChecker();\n\n if (!isRecord(candidate)) {\n return { valid: false, errors: [\"manifest: must be an object\"] };\n }\n\n const { setup } = candidate;\n if (!isRecord(setup)) {\n return { valid: false, errors: [\"setup: must be an object\"] };\n }\n if (setup.version !== SETUP_VERSION) {\n return {\n valid: false,\n errors: [`setup.version: must be \"${SETUP_VERSION}\"`],\n };\n }\n\n if (\n typeof candidate.id !== \"string\" \|\|\n !ENTRY_ID_PATTERN.test(candidate.id)\n ) {\n check.fail(\"id\", \"must be a lowercase slug\");\n }\n check.copy(candidate.name, \"name\");\n check.copy(candidate.description, \"description\");\n if (\n candidate.version !== undefined &&\n (typeof candidate.version !== \"string\" \|\|\n !TEMPLATE_VERSION_PATTERN.test(candidate.version))\n ) {\n check.fail(\"version\", \"must be a semantic version\");\n }\n if (\n candidate.skill !== undefined &&\n (typeof candidate.skill !== \"string\" \|\|\n !ENTRY_ID_PATTERN.test(candidate.skill))\n ) {\n check.fail(\"skill\", \"must be a lowercase slug\");\n }\n\n checkRequires(check, candidate.requires);\n const kinds = checkForm(check, setup.form);\n checkMode(check, setup, kinds);\n\n return { valid: check.errors.length === 0, errors: check.errors };\n}\n"],"mappings":";;AAwBA,IAAM,IAAmB,4BACnB,IAAqB,uBAErB,IAAiB,eASjB,IACJ,yLAII,IAAyB,uBACzB,IAAsB,yCACtB,IACJ,+DAEI,IAAkC,OACtC,eAAe,EAA6B,KAAK,GAAG,EAAE,0BACxD,GAEM,IAAc,CAAC,UAAU,UAAU,GACnC,IAAc;CAClB;CACA;CACA;CACA;CACA;CACA;AACF,GACM,IAAgB;CAAC;CAAU;CAAU;AAAW,GAChD,IAAgB,CAAC,QAAQ,OAAO,GAChC,IAAqB,CAAC,uBAAuB,GAG7C,IAAqB;AAS3B,SAAS,EAAS,GAA8B;CAC9C,OAAO,OAAO,KAAU,cAAY,KAAkB,CAAC,MAAM,QAAQ,CAAK;AAC5E;AAEA,SAAS,EACP,GACA,GACoB;CACpB,OACE,OAAO,KAAU,YAAa,EAA8B,SAAS,CAAK;AAE9E;AAEA,SAAS,EAAU,GAAgB,GAA0B;CAC3D,OACE,OAAO,KAAU,YAAY,OAAO,UAAU,CAAK,KAAK,KAAS;AAErE;AAEA,IAAM,IAAN,MAAmB;CACjB,SAA4B,CAAC;CAE7B,KAAK,GAAc,GAAuB;EAExC,OADA,KAAK,OAAO,KAAK,GAAG,EAAK,IAAI,GAAQ,GAC9B;CACT;CAGA,KAAK,GAAgB,GAAuB;EAO1C,OANI,OAAO,KAAU,YAAY,EAAM,WAAW,IACzC,KAAK,KAAK,GAAM,4BAA4B,IAEjD,EAAe,KAAK,CAAK,IACpB,KAAK,KAAK,GAAM,yBAAyB,IAE3C;CACT;CAEA,aAAa,GAAe,GAAuB;EAIjD,OAHI,EAA4B,KAAK,CAAK,IACjC,KAAK,KAAK,GAAM,uCAAuC,IAEzD;CACT;CAGA,aAAa,GAAgB,GAAuB;EAClD,OAAO,KAAK,KAAK,GAAO,CAAI,KAAK,KAAK,aAAa,GAAiB,CAAI;CAC1E;CAMA,cAAc,GAAgB,GAAuB;EAInD,OAHI,OAAO,KAAU,YAAY,EAAM,WAAW,IACzC,KAAK,KAAK,GAAM,4BAA4B,IAE9C,KAAK,aAAa,GAAO,CAAI;CACtC;CAEA,OAAO,GAAgB,GAAa,GAAc,GAAyB;EAEzE,OADI,KAAO,IAAkB,KAAK,KAAK,GAAG,EAAK,GAAG,KAAO,CAAM,IACxD;CACT;AACF;AASA,SAAS,EAAe,GAAgB,GAAkC;CACxE,OACE,OAAO,KAAU,YACjB,EAAQ,KAAK,CAAK,KAClB,CAAC,EAAM,MAAM,GAAG,EAAE,MAAM,MAAY,MAAY,OAAO,MAAY,IAAI;AAE3E;AAWA,SAAS,EAAe,GAAiC;CACvD,IAAI,OAAO,KAAU,YAAY,CAAC,EAAuB,KAAK,CAAK,GACjE,OAAO;CAET,IAAM,IAAQ,EAAM,MAAM,GAAG,EAAE,QAAQ,MAAS,EAAK,SAAS,CAAC;CAC/D,OACE,EAAM,SAAS,KACf,EAAM,OACH,MACC,CAAC,EAAK,WAAW,GAAG,KACpB,CAAC,EAAK,MAAM,GAAG,EAAE,MAAM,MAAY,MAAY,IAAI,CACvD;AAEJ;AAEA,SAAS,EAAc,GAAqB,GAAyB;CACnE,IAAI,CAAC,EAAS,CAAQ,GAAG;EACvB,EAAM,KAAK,YAAY,mBAAmB;EAC1C;CACF;CAEA,IAAM,EAAE,iBAAc,gBAAa;CAwBnC,AApBK,EAAS,CAAY,IAGxB,OAAO,QAAQ,CAAY,EAAE,SAAS,CAAC,GAAI,OAAiB;EAC1D,IAAM,IAAO,yBAAyB;EACtC,IAAI,CAAC,EAAS,CAAW,GAAG;GAC1B,EAAM,KAAK,GAAM,mBAAmB;GACpC;EACF;EAEA,AADA,EAAM,KAAK,EAAY,SAAS,GAAG,EAAK,SAAS,GAC7C,cAAc,KAAe,EAAY,aAAa,MACxD,EAAM,KAAK,GAAG,EAAK,YAAY,mBAAmB;EAEpD,IAAM,IAAU,CAAC,WAAW,UAAU;EACtC,OAAO,KAAK,CAAW,EACpB,QAAQ,MAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,SAAS,MAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,KAAO,gBAAgB,CAAC;CACpE,CAAC,IAhBD,EAAM,KAAK,yBAAyB,mBAAmB,GAmBrD,MAAa,KAAA,MACX,CAAC,MAAM,QAAQ,CAAQ,KAAK,EAAS,WAAW,IAClD,EAAM,KAAK,qBAAqB,2BAA2B,IAE3D,EAAS,SAAS,GAAS,MAAU;EACnC,CAAI,OAAO,KAAY,YAAY,EAAQ,WAAW,MACpD,EAAM,KACJ,qBAAqB,EAAM,IAC3B,4BACF;CAEJ,CAAC;AAGP;AAEA,SAAS,EACP,GACA,GACA,GACM;CACN,IAAI,CAAC,EAAS,CAAW,KAAK,OAAO,KAAK,CAAW,EAAE,WAAW,GAAG;EACnE,EAAM,KAAK,GAAM,4BAA4B;EAC7C;CACF;CAEA,IAAM,EAAE,cAAW,cAAW,cAAW;CAOzC,AANI,MAAc,KAAA,KAAa,CAAC,EAAU,GAAW,CAAC,KACpD,EAAM,KAAK,GAAG,EAAK,aAAa,gCAAgC,GAE9D,MAAc,KAAA,KAAa,CAAC,EAAU,GAAW,CAAC,KACpD,EAAM,KAAK,GAAG,EAAK,aAAa,4BAA4B,GAE1D,MAAW,KAAA,KAAa,CAAC,EAAQ,GAAQ,CAAkB,KAC7D,EAAM,KAAK,GAAG,EAAK,UAAU,2BAA2B;AAE5D;AAEA,SAAS,EAAW,GAAqB,GAAgB,GAAoB;CAC3E,IAAI,CAAC,EAAS,CAAK,GAAG;EACpB,EAAM,KAAK,GAAM,mBAAmB;EACpC;CACF;CAEA,IAAM,EAAE,SAAM,UAAO,SAAM,gBAAa,aAAU,aAAU,eAAY;CAqDxE,AAnDK,EAAQ,GAAM,CAAW,KAC5B,EAAM,KAAK,GAAG,EAAK,QAAQ,+BAA+B,GAE5D,EAAM,KAAK,GAAO,GAAG,EAAK,OAAO,GACjC,EAAM,KAAK,GAAM,GAAG,EAAK,MAAM,GAC3B,MAAgB,KAAA,KAAW,EAAM,KAAK,GAAa,GAAG,EAAK,aAAa,GACxE,EAAM,YAAY,KAAA,KAAa,OAAO,EAAM,WAAY,YAC1D,EAAM,KAAK,GAAG,EAAK,WAAW,kBAAkB,GAE9C,OAAO,KAAa,aACtB,EAAM,KAAK,GAAG,EAAK,YAAY,mBAAmB,GAEhD,MAAa,KAAA,KAAa,CAAC,EAAQ,GAAU,CAAa,KAC5D,EAAM,KAAK,GAAG,EAAK,YAAY,6BAA6B,GAE1D,MAAS,iBAAiB,MAAa,KAAA,KACzC,EAAM,KAAK,GAAG,EAAK,YAAY,oCAAoC,GAMnE,EAAM,aAAa,KAAA,MAClB,EAAM,aAAa,MAAQ,MAAS,kBAErC,EAAM,KACJ,GAAG,EAAK,YACR,kDACF,GAGE,MAAY,KAAA,MACV,MAAS,WAEF,CAAC,MAAM,QAAQ,CAAO,KAAK,EAAQ,WAAW,IACvD,EAAM,KAAK,GAAG,EAAK,WAAW,2BAA2B,IAEzD,EAAQ,SAAS,GAAQ,MAAU;EACjC,IAAM,IAAa,GAAG,EAAK,WAAW,EAAM;EAC5C,IAAI,CAAC,EAAS,CAAM,GAAG;GACrB,EAAM,KAAK,GAAY,mBAAmB;GAC1C;EACF;EAIA,CAHI,OAAO,EAAO,SAAU,YAAY,EAAO,MAAM,WAAW,MAC9D,EAAM,KAAK,GAAG,EAAW,SAAS,4BAA4B,GAEhE,EAAM,KAAK,EAAO,OAAO,GAAG,EAAW,OAAO;CAChD,CAAC,IAdD,EAAM,KAAK,GAAG,EAAK,WAAW,mCAAmC,IAkBjE,EAAM,gBAAgB,KAAA,KACxB,EAAiB,GAAO,EAAM,aAAa,GAAG,EAAK,aAAa;AAEpE;AAGA,SAAS,EACP,GACA,GACA,GACU;CAMV,OALI,CAAC,EAAS,CAAM,KAAK,OAAO,KAAK,CAAM,EAAE,WAAW,KACtD,EAAM,KAAK,GAAM,4BAA4B,GACtC,CAAC,KAGH,OAAO,QAAQ,CAAM,EAAE,KAAK,CAAC,GAAM,QACnC,EAAmB,KAAK,CAAI,KAC/B,EAAM,KAAK,GAAG,EAAK,GAAG,KAAQ,2BAA2B,GAE3D,EAAW,GAAO,GAAO,GAAG,EAAK,GAAG,GAAM,GACnC,EACR;AACH;AAGA,SAAS,EAAU,GAAqB,GAAyB;CAC/D,IAAI,CAAC,EAAS,CAAI,GAEhB,OADA,EAAM,KAAK,cAAc,mBAAmB,GACrC,CAAC;CAGV,AAAI,EAAK,SAAS,KAAA,KAAW,EAAM,KAAK,EAAK,MAAM,iBAAiB;CAEpE,IAAM,IAAQ,EAAY,GAAO,EAAK,MAAM,iBAAiB,GACvD,IAAkB,CAAC;CAEzB,AAAI,EAAK,aAAa,KAAA,MAChB,CAAC,EAAS,EAAK,QAAQ,KAAK,OAAO,KAAK,EAAK,QAAQ,EAAE,WAAW,IACpE,EAAM,KAAK,uBAAuB,4BAA4B,IAE9D,OAAO,QAAQ,EAAK,QAAQ,EAAE,SAAS,CAAC,GAAM,OAAY;EACxD,IAAI,CAAC,EAAQ,GAAM,CAAa,GAAG;GACjC,EAAM,KAAK,uBAAuB,KAAQ,uBAAuB;GACjE;EACF;EAEA,AADA,EAAM,KAAK,CAAI,GACf,EAAM,KACJ,GAAG,EAAY,GAAO,GAAQ,uBAAuB,GAAM,CAC7D;CACF,CAAC;CAML,IAAM,IAAa,EAAM,QACtB,GAAM,MAAU,EAAM,QAAQ,CAAI,MAAM,CAC3C;CAKA,OAJA,MAAM,KAAK,IAAI,IAAI,CAAU,CAAC,EAAE,SAAS,MACvC,EAAM,KAAK,cAAc,KAAQ,4BAA4B,CAC/D,GAEO;AACT;AAEA,SAAS,EAAc,GAAwB;CAM7C,OALK,EAAS,CAAI,IAKX,CAHL,EAAK,MACL,GAAG,OAAO,OAAO,EAAS,EAAK,QAAQ,IAAI,EAAK,WAAW,CAAC,CAAC,CAExD,EAAO,MACX,MACC,EAAS,CAAK,KACd,OAAO,OAAO,CAAK,EAAE,MAClB,MAAU,EAAS,CAAK,KAAK,EAAM,SAAS,aAC/C,CACJ,IAX4B;AAY9B;AAEA,SAAS,EAAa,GAAqB,GAAwB;CACjE,AAAI,EAAM,aAAa,GAAS,eAAe,KACxC,EAAmB,SAAS,KAC/B,EAAM,KACJ,iBACA,mBAAmB,EAAmB,YACxC;AAGN;AAUA,SAAS,EAAY,GAAqB,GAAuB;CAC/D,IAAI,CAAC,EAAS,CAAM,GAAG;EACrB,EAAM,KAAK,gBAAgB,mBAAmB;EAC9C;CACF;CA4DA,CAzDE,OAAO,EAAO,WAAY,YAC1B,CAAC,EAAyB,KAAK,EAAO,OAAO,MAE7C,EAAM,KAAK,wBAAwB,4BAA4B,GAE5D,EAAe,EAAO,UAAU,KACnC,EAAM,KACJ,2BACA,uDACF,GAGA,EAAO,gBAAgB,KAAA,KACvB,CAAC,EAAe,EAAO,aAAa,CAAmB,KAEvD,EAAM,KAAK,4BAA4B,yBAAyB,GAE9D,EAAO,YAAY,KAAA,KAAa,CAAC,EAAU,EAAO,SAAS,CAAC,KAC9D,EAAM,KAAK,wBAAwB,4BAA4B,GAG7D,CAAC,EAAS,EAAO,KAAK,KAAK,OAAO,KAAK,EAAO,KAAK,EAAE,WAAW,IAClE,EAAM,KAAK,sBAAsB,4BAA4B,KAE7D,OAAO,QAAQ,EAAO,KAAK,EAAE,SAAS,CAAC,GAAY,OAAY;EAa7D,AAZK,EAAe,GAAY,CAAmB,KACjD,EAAM,KAAK,sBAAsB,KAAc,sBAAsB,GAKnE,MAAA,iBACF,EAAM,KACJ,sBAAsB,KACtB,iDACF,GAEG,EAAe,GAAQ,CAAqB,KAC/C,EAAM,KACJ,sBAAsB,KACtB,gDACF;CAEJ,CAAC,GAOC,OAAO,EAAO,eAAgB,YAC9B,EAAE,EAAO,eAAe,EAAO,UAE/B,EAAM,KAAK,4BAA4B,yBAAyB,IAIhE,CAAC,EAAS,EAAO,MAAM,KAAK,OAAO,KAAK,EAAO,MAAM,EAAE,WAAW,IACpE,EAAM,KAAK,uBAAuB,4BAA4B,IAE9D,EAAkB,GAAO,EAAO,QAAQ,qBAAqB;AAEjE;AAGA,SAAS,EACP,GACA,GACA,GACM;CACN,IAAI,OAAO,KAAS,UAAU;EAC5B,EAAM,cAAc,GAAM,CAAI;EAC9B;CACF;CACA,IAAI,MAAM,QAAQ,CAAI,GAAG;EACvB,EAAK,SAAS,GAAM,MAClB,EAAkB,GAAO,GAAM,GAAG,EAAK,GAAG,EAAM,EAAE,CACpD;EACA;CACF;CACA,IAAI,EAAS,CAAI,GAAG;EAClB,OAAO,QAAQ,CAAI,EAAE,SAAS,CAAC,GAAK,OAClC,EAAkB,GAAO,GAAO,GAAG,EAAK,GAAG,GAAK,CAClD;EACA;CACF;CACA,AAAI,MAAS,QAAQ,OAAO,KAAS,YAAY,OAAO,KAAS,aAC/D,EAAM,KACJ,GACA,0DACF;AAEJ;AAEA,SAAS,EAAU,GAAqB,GAAY,GAAuB;CACzE,IAAI,CAAC,EAAQ,EAAM,MAAM,CAAW,GAAG;EACrC,EAAM,KAAK,cAAc,yBAAyB;EAClD;CACF;CAEA,IAAI,EAAM,SAAS,UAAU;EAI3B,IAAM,IAAY,EAAM,WAAW,KAAA,GAC7B,IAAY,EAAM,WAAW,KAAA;EA8BnC,AA7BI,MAAc,IAChB,EAAM,KACJ,SACA,+DACF,IACS,IACT,EAAY,GAAO,EAAM,MAAM,IAE/B,EAAM,cAAc,EAAM,QAAQ,cAAc,GAK9C,EAAM,YAAY,KAAA,KAAW,EAAa,GAAO,EAAM,OAAO,GAI9D,EAAM,WAAW,KACnB,EAAM,KACJ,uBACA,uCACF,GAEE,EAAM,SAAS,OAAO,KAAK,CAAC,EAAc,EAAM,IAAI,KACtD,EAAM,KACJ,cACA,sDACF,GAEE,EAAM,WAAW,KAAA,MACd,EAAM,SAAS,OAAO,IAGzB,EAAM,cAAc,EAAM,QAAQ,cAAc,IAFhD,EAAM,KAAK,gBAAgB,sCAAsC;EAKrE;CACF;CAKA,AAHA,EAAa,GAAO,EAAM,OAAO,GACjC,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC,GACzE,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC,GACzE,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC;AAC3E;AAGA,SAAgB,EAAc,GAA6B;CACzD,OAAO,EAAS,CAAS,KAAK,EAAU,UAAU,KAAA;AACpD;AAQA,SAAgB,EAAmB,GAA2C;CAC5E,IAAM,IAAQ,IAAI,EAAa;CAE/B,IAAI,CAAC,EAAS,CAAS,GACrB,OAAO;EAAE,OAAO;EAAO,QAAQ,CAAC,6BAA6B;CAAE;CAGjE,IAAM,EAAE,aAAU;CAsClB,OArCK,EAAS,CAAK,IAGf,EAAM,YAAA,UAQR,OAAO,EAAU,MAAO,YACxB,CAAC,EAAiB,KAAK,EAAU,EAAE,MAEnC,EAAM,KAAK,MAAM,0BAA0B,GAE7C,EAAM,KAAK,EAAU,MAAM,MAAM,GACjC,EAAM,KAAK,EAAU,aAAa,aAAa,GAE7C,EAAU,YAAY,KAAA,MACrB,OAAO,EAAU,WAAY,YAC5B,CAAC,EAAyB,KAAK,EAAU,OAAO,MAElD,EAAM,KAAK,WAAW,4BAA4B,GAGlD,EAAU,UAAU,KAAA,MACnB,OAAO,EAAU,SAAU,YAC1B,CAAC,EAAiB,KAAK,EAAU,KAAK,MAExC,EAAM,KAAK,SAAS,0BAA0B,GAGhD,EAAc,GAAO,EAAU,QAAQ,GAEvC,EAAU,GAAO,GADH,EAAU,GAAO,EAAM,IACb,CAAK,GAEtB;EAAE,OAAO,EAAM,OAAO,WAAW;EAAG,QAAQ,EAAM;CAAO,KAjCvD;EACL,OAAO;EACP,QAAQ,CAAC,gCAA2C;CACtD,IANO;EAAE,OAAO;EAAO,QAAQ,CAAC,0BAA0B;CAAE;AAqChE"}
1	+ {"version":3,"file":"manifest-validation.js","names":[],"sources":["../../src/manifests/manifest-validation.ts"],"sourcesContent":["/*\n Admission policy for extension-authored catalog manifests.\n \n A manifest is data authored in a different repository that instructs this host\n * to render copy and compose a request. The host therefore decides what a\n * manifest is permitted to do rather than trusting the file — validation here\n * is a trust boundary, not a convenience check, and it deliberately does not\n * defer to a schema shipped alongside the manifests it would be validating.\n \n Beyond mirroring the published schema, this adds the invariants the host's own\n * derivation depends on: a single trigger kind to read, a repository field for\n * an event trigger's source, and field names unique across the form. Without\n * them the derived request body would be silently wrong rather than rejected.\n \n A manifest that fails any check is rejected outright. It never renders a\n * partial UI, because everything downstream treats its content as instructions.\n /\n\nimport {\n BUNDLE_CONFIG_FILENAME,\n SETUP_PLACEHOLDER_NAMESPACES,\n SETUP_VERSION,\n} from \"./types\";\n\nconst ENTRY_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)$/;\nconst FIELD_NAME_PATTERN = /^[a-z][A-Za-z0-9]$/;\n/* Copy must never be able to inject markup into the host. /\nconst MARKUP_PATTERN = /<[A-Za-z/!]/;\n/\n A template version, declared as `version` by a prompt entry and as\n * `setup.bundle.version` by a bundle one. Sent to the service as template\n * provenance, so it is checked at admission. Full semver, as the spec at\n * semver.org states it: a catalog entry published with a pre-release or build\n * suffix is still a version this host may forward, and refusing one would drop\n * the entry from the registry outright.\n /\nconst TEMPLATE_VERSION_PATTERN =\n /^(?:0\|[1-9]\\d)\\.(?:0\|[1-9]\\d)\\.(?:0\|[1-9]\\d)(?:-(?:0\|[1-9]\\d\|\\d[a-zA-Z-][0-9a-zA-Z-])(?:\\.(?:0\|[1-9]\\d\|\\d[a-zA-Z-][0-9a-zA-Z-])))?(?:\\+[0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+))?$/;\n// The characters a command of plain words and paths is made of. No shell\n// metacharacters, which the service rejects anyway and a bundle has no reason\n// to need; where those words may point is `isPlainCommand`'s to say.\nconst BUNDLE_COMMAND_PATTERN = /^[A-Za-z0-9 ._/-]+$/;\nconst BUNDLE_PATH_PATTERN = /^[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)$/;\nconst BUNDLE_SOURCE_PATTERN =\n /^(skills\|automations)\\/[A-Za-z0-9._-]+(\\/[A-Za-z0-9._-]+)$/;\n/** Every `{{` must open a known namespace and close immediately. /\nconst UNKNOWN_PLACEHOLDER_PATTERN = new RegExp(\n `\\\\{\\\\{(?!(?:${SETUP_PLACEHOLDER_NAMESPACES.join(\"\|\")})\\\\.[A-Za-z0-9_.]+\\\\}\\\\})`,\n);\n\nconst SETUP_MODES = [\"direct\", \"assisted\"] as const;\nconst FIELD_TYPES = [\n \"text\",\n \"textarea\",\n \"select\",\n \"number\",\n \"cron\",\n \"timezone\",\n \"repo-picker\",\n \"llm-profile\",\n \"event-source\",\n \"event-type\",\n \"plugin-sources\",\n \"tarball-upload\",\n] as const;\nconst GIT_PROVIDERS = [\"github\", \"gitlab\", \"bitbucket\"] as const;\nconst TRIGGER_KINDS = [\"cron\", \"event\"] as const;\nconst CONSTRAINT_FORMATS = [\"safeExpressionLiteral\"] as const;\n\n/* Setup context only, so this can never become a channel for runtime instructions. /\nconst MAX_MESSAGE_LENGTH = 2000;\n\nexport interface SetupValidationResult {\n valid: boolean;\n errors: string[];\n}\n\ntype Rec = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is Rec {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isOneOf<T extends readonly string[]>(\n value: unknown,\n allowed: T,\n): value is T[number] {\n return (\n typeof value === \"string\" && (allowed as readonly string[]).includes(value)\n );\n}\n\nfunction isInteger(value: unknown, minimum: number): boolean {\n return (\n typeof value === \"number\" && Number.isInteger(value) && value >= minimum\n );\n}\n\nclass SetupChecker {\n readonly errors: string[] = [];\n\n fail(path: string, reason: string): false {\n this.errors.push(`${path}: ${reason}`);\n return false;\n }\n\n /* Literal user-visible copy. Carries no markup. /\n copy(value: unknown, path: string): boolean {\n if (typeof value !== \"string\" \|\| value.length === 0) {\n return this.fail(path, \"must be a non-empty string\");\n }\n if (MARKUP_PATTERN.test(value)) {\n return this.fail(path, \"must not contain markup\");\n }\n return true;\n }\n\n placeholders(value: string, path: string): boolean {\n if (UNKNOWN_PLACEHOLDER_PATTERN.test(value)) {\n return this.fail(path, \"uses an unknown placeholder namespace\");\n }\n return true;\n }\n\n /* Copy that may embed `{{namespace.key}}` placeholders. /\n templateCopy(value: unknown, path: string): boolean {\n return this.copy(value, path) && this.placeholders(value as string, path);\n }\n\n /\n A request-body string that may embed placeholders. Never rendered, so\n * expression syntax such as a JMESPath filter is allowed through.\n /\n templateValue(value: unknown, path: string): boolean {\n if (typeof value !== \"string\" \|\| value.length === 0) {\n return this.fail(path, \"must be a non-empty string\");\n }\n return this.placeholders(value, path);\n }\n\n absent(container: Rec, key: string, path: string, reason: string): boolean {\n if (key in container) return this.fail(`${path}.${key}`, reason);\n return true;\n }\n}\n\n/\n A relative path that stays inside the archive it names.\n \n The character class alone is not enough: `.` and `..` are made of allowed\n * characters, so a segment check is what actually keeps a packed file from\n * climbing out of the directory it is extracted into.\n /\nfunction isRelativePath(value: unknown, pattern: RegExp): value is string {\n return (\n typeof value === \"string\" &&\n pattern.test(value) &&\n !value.split(\"/\").some((segment) => segment === \".\" \|\| segment === \"..\")\n );\n}\n\n/\n A command whose every word stays inside the archive it is run in.\n \n The character class is not what keeps it there: `/` and `.` are allowed\n * characters, so `/bin/sh setup.sh` and `python3 ../../etc/x.py` are made of\n * them and each names something outside the extracted directory. The segment\n * rule packed paths are held to is what refuses those, and requiring a word at\n * all is what refuses an entrypoint of nothing but spaces.\n /\nfunction isPlainCommand(value: unknown): value is string {\n if (typeof value !== \"string\" \|\| !BUNDLE_COMMAND_PATTERN.test(value)) {\n return false;\n }\n const words = value.split(\" \").filter((word) => word.length > 0);\n return (\n words.length > 0 &&\n words.every(\n (word) =>\n !word.startsWith(\"/\") &&\n !word.split(\"/\").some((segment) => segment === \"..\"),\n )\n );\n}\n\nfunction checkRequires(check: SetupChecker, requires: unknown): void {\n if (!isRecord(requires)) {\n check.fail(\"requires\", \"must be an object\");\n return;\n }\n\n const { integrations, features } = requires;\n // Empty is meaningful rather than malformed: an automation that needs no\n // credential connects to nothing, and the key stays required so that saying\n // so is a deliberate statement instead of an omission.\n if (!isRecord(integrations)) {\n check.fail(\"requires.integrations\", \"must be an object\");\n } else {\n Object.entries(integrations).forEach(([id, requirement]) => {\n const path = `requires.integrations.${id}`;\n if (!isRecord(requirement)) {\n check.fail(path, \"must be an object\");\n return;\n }\n check.copy(requirement.message, `${path}.message`);\n if (\"required\" in requirement && requirement.required !== false) {\n check.fail(`${path}.required`, \"may only be false\");\n }\n const allowed = [\"message\", \"required\"];\n Object.keys(requirement)\n .filter((key) => !allowed.includes(key))\n .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n });\n }\n\n if (features !== undefined) {\n if (!Array.isArray(features) \|\| features.length === 0) {\n check.fail(\"requires.features\", \"must be a non-empty array\");\n } else {\n features.forEach((feature, index) => {\n if (typeof feature !== \"string\" \|\| feature.length === 0) {\n check.fail(\n `requires.features[${index}]`,\n \"must be a non-empty string\",\n );\n }\n });\n }\n }\n}\n\nfunction checkConstraints(\n check: SetupChecker,\n constraints: unknown,\n path: string,\n): void {\n if (!isRecord(constraints) \|\| Object.keys(constraints).length === 0) {\n check.fail(path, \"must be a non-empty object\");\n return;\n }\n\n const { minLength, maxLength, min, max, format } = constraints;\n if (minLength !== undefined && !isInteger(minLength, 0)) {\n check.fail(`${path}.minLength`, \"must be a non-negative integer\");\n }\n if (maxLength !== undefined && !isInteger(maxLength, 1)) {\n check.fail(`${path}.maxLength`, \"must be a positive integer\");\n }\n if (min !== undefined && !isInteger(min, 0)) {\n check.fail(`${path}.min`, \"must be a non-negative integer\");\n }\n if (max !== undefined && !isInteger(max, 1)) {\n check.fail(`${path}.max`, \"must be a positive integer\");\n }\n if (format !== undefined && !isOneOf(format, CONSTRAINT_FORMATS)) {\n check.fail(`${path}.format`, \"is not a supported format\");\n }\n}\n\nfunction checkField(check: SetupChecker, field: unknown, path: string): void {\n if (!isRecord(field)) {\n check.fail(path, \"must be an object\");\n return;\n }\n\n const { type, label, help, placeholder, required, provider, options } = field;\n\n if (!isOneOf(type, FIELD_TYPES)) {\n check.fail(`${path}.type`, \"is not a supported field type\");\n }\n check.copy(label, `${path}.label`);\n check.copy(help, `${path}.help`);\n if (placeholder !== undefined) check.copy(placeholder, `${path}.placeholder`);\n if (\n field.default !== undefined &&\n typeof field.default !== \"string\" &&\n typeof field.default !== \"number\" &&\n typeof field.default !== \"boolean\" &&\n field.default !== null\n ) {\n check.fail(`${path}.default`, \"must be a string, number, boolean or null\");\n }\n if (typeof required !== \"boolean\") {\n check.fail(`${path}.required`, \"must be a boolean\");\n }\n if (provider !== undefined && !isOneOf(provider, GIT_PROVIDERS)) {\n check.fail(`${path}.provider`, \"is not a supported provider\");\n }\n if (type === \"repo-picker\" && provider === undefined) {\n check.fail(`${path}.provider`, \"is required for a repository field\");\n }\n // The host branches on this key to decide whether a field's value is a list,\n // so a field declaring it anywhere else would be seeded with a list and\n // rendered as a string.\n if (\n field.multiple !== undefined &&\n (field.multiple !== true \|\| type !== \"repo-picker\")\n ) {\n check.fail(\n `${path}.multiple`,\n \"may only be true, and only on a repository field\",\n );\n }\n\n if (options !== undefined) {\n if (type !== \"select\") {\n check.fail(`${path}.options`, \"is only allowed on a select field\");\n } else if (!Array.isArray(options) \|\| options.length === 0) {\n check.fail(`${path}.options`, \"must be a non-empty array\");\n } else {\n options.forEach((option, index) => {\n const optionPath = `${path}.options[${index}]`;\n if (!isRecord(option)) {\n check.fail(optionPath, \"must be an object\");\n return;\n }\n if (typeof option.value !== \"string\" \|\| option.value.length === 0) {\n check.fail(`${optionPath}.value`, \"must be a non-empty string\");\n }\n check.copy(option.label, `${optionPath}.label`);\n });\n }\n }\n\n if (field.constraints !== undefined) {\n checkConstraints(check, field.constraints, `${path}.constraints`);\n }\n}\n\n/* Returns the declared field names, so the caller can check them for collisions. /\nfunction checkFields(\n check: SetupChecker,\n fields: unknown,\n path: string,\n): string[] {\n if (!isRecord(fields) \|\| Object.keys(fields).length === 0) {\n check.fail(path, \"must be a non-empty object\");\n return [];\n }\n\n return Object.entries(fields).map(([name, field]) => {\n if (!FIELD_NAME_PATTERN.test(name)) {\n check.fail(`${path}.${name}`, \"is not a valid field name\");\n }\n checkField(check, field, `${path}.${name}`);\n return name;\n });\n}\n\n/* Returns the trigger kinds declared, in order. /\nfunction checkForm(\n check: SetupChecker,\n form: unknown,\n): { kinds: string[]; fieldNames: string[] } {\n if (!isRecord(form)) {\n check.fail(\"setup.form\", \"must be an object\");\n return { kinds: [], fieldNames: [] };\n }\n\n if (form.note !== undefined) check.copy(form.note, \"setup.form.note\");\n\n const names = checkFields(check, form.args, \"setup.form.args\");\n const kinds: string[] = [];\n\n if (form.triggers !== undefined) {\n if (!isRecord(form.triggers) \|\| Object.keys(form.triggers).length === 0) {\n check.fail(\"setup.form.triggers\", \"must be a non-empty object\");\n } else {\n Object.entries(form.triggers).forEach(([kind, fields]) => {\n if (!isOneOf(kind, TRIGGER_KINDS)) {\n check.fail(`setup.form.triggers.${kind}`, \"is not a trigger kind\");\n return;\n }\n kinds.push(kind);\n names.push(\n ...checkFields(check, fields, `setup.form.triggers.${kind}`),\n );\n });\n }\n }\n\n // The host merges both halves into one value map, so a repeated name would\n // silently shadow a field and misaddress every error reported against it.\n const duplicates = names.filter(\n (name, index) => names.indexOf(name) !== index,\n );\n Array.from(new Set(duplicates)).forEach((name) =>\n check.fail(`setup.form.${name}`, \"is declared more than once\"),\n );\n\n return { kinds, fieldNames: names };\n}\n\nfunction checkActionFeatures(\n check: SetupChecker,\n features: unknown,\n path: string,\n): void {\n if (!Array.isArray(features) \|\| features.length === 0) {\n check.fail(path, \"must be a non-empty array\");\n return;\n }\n features.forEach((feature, index) => {\n if (typeof feature !== \"string\" \|\| feature.length === 0) {\n check.fail(`${path}[${index}]`, \"must be a non-empty string\");\n }\n });\n}\n\nfunction checkAction(\n check: SetupChecker,\n kind: string,\n action: unknown,\n commonFieldNames: string[],\n): void {\n const path = `setup.actions.${kind}`;\n if (!isRecord(action)) {\n check.fail(path, \"must be an object\");\n return;\n }\n\n check.copy(action.label, `${path}.label`);\n check.copy(action.help, `${path}.help`);\n checkActionFeatures(check, action.features, `${path}.features`);\n const actionFieldNames = checkFields(check, action.args, `${path}.args`);\n actionFieldNames\n .filter((name) => commonFieldNames.includes(name))\n .forEach((name) =>\n check.fail(`${path}.args.${name}`, \"is already declared by the form\"),\n );\n\n if (kind === \"prompt\") {\n check.templateValue(action.prompt, `${path}.prompt`);\n } else if (kind === \"plugin\") {\n check.templateValue(action.prompt, `${path}.prompt`);\n check.templateValue(action.plugins, `${path}.plugins`);\n } else if (kind === \"upload\") {\n check.templateValue(action.tarballPath, `${path}.tarballPath`);\n check.templateValue(action.entrypoint, `${path}.entrypoint`);\n if (action.setupScript !== undefined) {\n check.templateValue(action.setupScript, `${path}.setupScript`);\n }\n } else {\n check.fail(path, \"is not a supported action kind\");\n }\n\n const allowedByKind: Record<string, string[]> = {\n prompt: [\"label\", \"help\", \"features\", \"args\", \"prompt\"],\n plugin: [\"label\", \"help\", \"features\", \"args\", \"prompt\", \"plugins\"],\n upload: [\n \"label\",\n \"help\",\n \"features\",\n \"args\",\n \"tarballPath\",\n \"entrypoint\",\n \"setupScript\",\n ],\n };\n const allowed = allowedByKind[kind] ?? [];\n Object.keys(action)\n .filter((key) => !allowed.includes(key))\n .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n}\n\nfunction checkActions(\n check: SetupChecker,\n actions: unknown,\n commonFieldNames: string[],\n): void {\n if (!isRecord(actions) \|\| Object.keys(actions).length === 0) {\n check.fail(\"setup.actions\", \"must be a non-empty object\");\n return;\n }\n Object.entries(actions).forEach(([kind, action]) =>\n checkAction(check, kind, action, commonFieldNames),\n );\n}\n\nfunction fieldsContainType(fields: unknown, type: string): boolean {\n if (!isRecord(fields)) return false;\n return Object.values(fields).some(\n (field) => isRecord(field) && field.type === type,\n );\n}\n\nfunction actionHasRepoPicker(action: unknown): boolean {\n return isRecord(action) && fieldsContainType(action.args, \"repo-picker\");\n}\n\n/\n Whether an event trigger's `source` is derivable for every selectable action.\n \n `buildTrigger` fills `source` from a field named `source` in the event\n * trigger, or failing that from the selected action's repo-picker provider. A\n * picker in another trigger group (such as `cron`) is never collected for the\n * event trigger, and a picker in only some actions is invisible when one of the\n * others is selected — so neither may satisfy this check, or the user can end\n * up with an empty `source` no form field can fix.\n /\nfunction setupSuppliesEventSource(setup: Rec): boolean {\n const form = isRecord(setup.form) ? setup.form : {};\n const triggers = isRecord(form.triggers) ? form.triggers : {};\n const eventFields = triggers.event;\n\n // An explicit event-source field fills `source` directly, regardless of which\n // action is selected.\n if (fieldsContainType(eventFields, \"event-source\")) return true;\n\n // A repo-picker in the event trigger is only collected when `event` is the\n // sole trigger kind; with a sibling trigger the derivation reads no trigger\n // fields for the picker. `form.args` is shared across every selection, so a\n // picker there is always available.\n const singleEventTrigger =\n \"event\" in triggers && Object.keys(triggers).length === 1;\n if (\n (singleEventTrigger && fieldsContainType(eventFields, \"repo-picker\")) \|\|\n fieldsContainType(form.args, \"repo-picker\")\n ) {\n return true;\n }\n\n // Without a shared or event-trigger picker, every selectable action must\n // carry its own repo-picker; otherwise selecting an action without one\n // derives `source: \"\"`.\n if (!isRecord(setup.actions) \|\| Object.keys(setup.actions).length === 0) {\n return false;\n }\n return Object.values(setup.actions).every(actionHasRepoPicker);\n}\n\nfunction checkMessage(check: SetupChecker, message: unknown): void {\n if (check.templateCopy(message, \"setup.message\")) {\n if ((message as string).length > MAX_MESSAGE_LENGTH) {\n check.fail(\n \"setup.message\",\n `must be at most ${MAX_MESSAGE_LENGTH} characters`,\n );\n }\n }\n}\n\n/\n The script tarball a direct entry may ship.\n \n The strings here are commands and paths this host acts on, so they are held\n * to a closed character set rather than the placeholder rules copy uses: an\n * entrypoint with a shell metacharacter, or a packed path that escapes the\n * archive, is refused here rather than by the service.\n /\nfunction checkBundle(check: SetupChecker, bundle: unknown): void {\n if (!isRecord(bundle)) {\n check.fail(\"setup.bundle\", \"must be an object\");\n return;\n }\n\n if (\n typeof bundle.version !== \"string\" \|\|\n !TEMPLATE_VERSION_PATTERN.test(bundle.version)\n ) {\n check.fail(\"setup.bundle.version\", \"must be a semantic version\");\n }\n if (!isPlainCommand(bundle.entrypoint)) {\n check.fail(\n \"setup.bundle.entrypoint\",\n \"must be a plain command that stays inside the archive\",\n );\n }\n if (\n bundle.setupScript !== undefined &&\n !isRelativePath(bundle.setupScript, BUNDLE_PATH_PATTERN)\n ) {\n check.fail(\"setup.bundle.setupScript\", \"must be a relative path\");\n }\n if (bundle.timeout !== undefined && !isInteger(bundle.timeout, 1)) {\n check.fail(\"setup.bundle.timeout\", \"must be a positive integer\");\n }\n\n if (!isRecord(bundle.files) \|\| Object.keys(bundle.files).length === 0) {\n check.fail(\"setup.bundle.files\", \"must be a non-empty object\");\n } else {\n Object.entries(bundle.files).forEach(([packedPath, source]) => {\n if (!isRelativePath(packedPath, BUNDLE_PATH_PATTERN)) {\n check.fail(`setup.bundle.files.${packedPath}`, \"is not a packed path\");\n }\n // The rendered config is packed under this name too, and a tar carrying\n // the name twice leaves which one the script reads to whichever\n // extractor unpacks it.\n if (packedPath === BUNDLE_CONFIG_FILENAME) {\n check.fail(\n `setup.bundle.files.${packedPath}`,\n \"is the name the rendered config is packed under\",\n );\n }\n if (!isRelativePath(source, BUNDLE_SOURCE_PATTERN)) {\n check.fail(\n `setup.bundle.files.${packedPath}`,\n \"must name a file under skills/ or automations/\",\n );\n }\n });\n\n // A setup script the archive does not carry is a create request the\n // service accepts and the first run fails on, and it is also the only\n // thing packed executable - naming an unpacked file makes that rule\n // unreachable.\n if (\n typeof bundle.setupScript === \"string\" &&\n !(bundle.setupScript in bundle.files)\n ) {\n check.fail(\"setup.bundle.setupScript\", \"must name a packed file\");\n }\n }\n\n if (!isRecord(bundle.config) \|\| Object.keys(bundle.config).length === 0) {\n check.fail(\"setup.bundle.config\", \"must be a non-empty object\");\n } else {\n checkBundleConfig(check, bundle.config, \"setup.bundle.config\");\n }\n}\n\n/* Every string leaf of the config is a payload value: placeholders, no markup rule. /\nfunction checkBundleConfig(\n check: SetupChecker,\n node: unknown,\n path: string,\n): void {\n if (typeof node === \"string\") {\n check.templateValue(node, path);\n return;\n }\n if (Array.isArray(node)) {\n node.forEach((item, index) =>\n checkBundleConfig(check, item, `${path}[${index}]`),\n );\n return;\n }\n if (isRecord(node)) {\n Object.entries(node).forEach(([key, value]) =>\n checkBundleConfig(check, value, `${path}.${key}`),\n );\n return;\n }\n if (node !== null && typeof node !== \"number\" && typeof node !== \"boolean\") {\n check.fail(\n path,\n \"must be a string, number, boolean, null, array or object\",\n );\n }\n}\n\nfunction checkMode(\n check: SetupChecker,\n setup: Rec,\n kinds: string[],\n commonFieldNames: string[],\n): void {\n if (!isOneOf(setup.mode, SETUP_MODES)) {\n check.fail(\"setup.mode\", \"is not a supported mode\");\n return;\n }\n\n if (setup.mode === \"direct\") {\n // A direct entry produces one of three things: a prompt, a script bundle\n // the host packs and uploads, or a selectable set of action variants.\n // More than one would be ambiguous, and none is nothing to create.\n const hasPrompt = setup.prompt !== undefined;\n const hasBundle = setup.bundle !== undefined;\n const hasActions = setup.actions !== undefined;\n const variants = [hasPrompt, hasBundle, hasActions].filter(Boolean);\n if (variants.length !== 1) {\n check.fail(\n \"setup\",\n \"must declare exactly one of prompt, bundle or actions for direct setup\",\n );\n } else if (hasBundle) {\n checkBundle(check, setup.bundle);\n } else if (hasActions) {\n checkActions(check, setup.actions, commonFieldNames);\n } else {\n check.templateValue(setup.prompt, \"setup.prompt\");\n }\n // A direct entry may carry a fallback-conversation seed for deployments\n // that cannot run the direct path, held to the same rules as an assisted\n // message.\n if (setup.message !== undefined) checkMessage(check, setup.message);\n\n if (kinds.length === 0) {\n check.fail(\n \"setup.form.triggers\",\n \"must declare at least one trigger kind\",\n );\n }\n if (kinds.includes(\"event\") && !setupSuppliesEventSource(setup)) {\n check.fail(\n \"setup.form.triggers.event\",\n \"must declare an event source field or repository picker\",\n );\n }\n if (setup.filter !== undefined) {\n if (!kinds.includes(\"event\")) {\n check.fail(\"setup.filter\", \"is only allowed for an event trigger\");\n } else {\n check.templateValue(setup.filter, \"setup.filter\");\n }\n }\n return;\n }\n\n checkMessage(check, setup.message);\n check.absent(setup, \"prompt\", \"setup\", \"is only allowed for direct setup\");\n check.absent(setup, \"bundle\", \"setup\", \"is only allowed for direct setup\");\n check.absent(setup, \"actions\", \"setup\", \"is only allowed for direct setup\");\n check.absent(setup, \"filter\", \"setup\", \"is only allowed for direct setup\");\n}\n\n/* Whether a catalog entry ships a setup experience at all. It is optional. /\nexport function hasSetupBlock(candidate: unknown): boolean {\n return isRecord(candidate) && candidate.setup !== undefined;\n}\n\n/\n Decide whether this host will act on a catalog manifest.\n \n The version is checked first and fails closed: a format this host does not\n * recognise is refused rather than interpreted with today's rules.\n */\nexport function validateSetupEntry(candidate: unknown): SetupValidationResult {\n const check = new SetupChecker();\n\n if (!isRecord(candidate)) {\n return { valid: false, errors: [\"manifest: must be an object\"] };\n }\n\n const { setup } = candidate;\n if (!isRecord(setup)) {\n return { valid: false, errors: [\"setup: must be an object\"] };\n }\n if (setup.version !== SETUP_VERSION) {\n return {\n valid: false,\n errors: [`setup.version: must be \"${SETUP_VERSION}\"`],\n };\n }\n\n if (\n typeof candidate.id !== \"string\" \|\|\n !ENTRY_ID_PATTERN.test(candidate.id)\n ) {\n check.fail(\"id\", \"must be a lowercase slug\");\n }\n check.copy(candidate.name, \"name\");\n check.copy(candidate.description, \"description\");\n if (\n candidate.version !== undefined &&\n (typeof candidate.version !== \"string\" \|\|\n !TEMPLATE_VERSION_PATTERN.test(candidate.version))\n ) {\n check.fail(\"version\", \"must be a semantic version\");\n }\n if (\n candidate.skill !== undefined &&\n (typeof candidate.skill !== \"string\" \|\|\n !ENTRY_ID_PATTERN.test(candidate.skill))\n ) {\n check.fail(\"skill\", \"must be a lowercase slug\");\n }\n\n checkRequires(check, candidate.requires);\n const { kinds, fieldNames } = checkForm(check, setup.form);\n checkMode(check, setup, kinds, fieldNames);\n\n return { valid: check.errors.length === 0, errors: check.errors };\n}\n"],"mappings":";;AAwBA,IAAM,IAAmB,4BACnB,IAAqB,uBAErB,IAAiB,eASjB,IACJ,yLAII,IAAyB,uBACzB,IAAsB,yCACtB,IACJ,+DAEI,IAAkC,OACtC,eAAe,EAA6B,KAAK,GAAG,EAAE,0BACxD,GAEM,IAAc,CAAC,UAAU,UAAU,GACnC,IAAc;CAClB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,GACM,IAAgB;CAAC;CAAU;CAAU;AAAW,GAChD,IAAgB,CAAC,QAAQ,OAAO,GAChC,IAAqB,CAAC,uBAAuB,GAG7C,IAAqB;AAS3B,SAAS,EAAS,GAA8B;CAC9C,OAAO,OAAO,KAAU,cAAY,KAAkB,CAAC,MAAM,QAAQ,CAAK;AAC5E;AAEA,SAAS,EACP,GACA,GACoB;CACpB,OACE,OAAO,KAAU,YAAa,EAA8B,SAAS,CAAK;AAE9E;AAEA,SAAS,EAAU,GAAgB,GAA0B;CAC3D,OACE,OAAO,KAAU,YAAY,OAAO,UAAU,CAAK,KAAK,KAAS;AAErE;AAEA,IAAM,IAAN,MAAmB;CACjB,SAA4B,CAAC;CAE7B,KAAK,GAAc,GAAuB;EAExC,OADA,KAAK,OAAO,KAAK,GAAG,EAAK,IAAI,GAAQ,GAC9B;CACT;CAGA,KAAK,GAAgB,GAAuB;EAO1C,OANI,OAAO,KAAU,YAAY,EAAM,WAAW,IACzC,KAAK,KAAK,GAAM,4BAA4B,IAEjD,EAAe,KAAK,CAAK,IACpB,KAAK,KAAK,GAAM,yBAAyB,IAE3C;CACT;CAEA,aAAa,GAAe,GAAuB;EAIjD,OAHI,EAA4B,KAAK,CAAK,IACjC,KAAK,KAAK,GAAM,uCAAuC,IAEzD;CACT;CAGA,aAAa,GAAgB,GAAuB;EAClD,OAAO,KAAK,KAAK,GAAO,CAAI,KAAK,KAAK,aAAa,GAAiB,CAAI;CAC1E;CAMA,cAAc,GAAgB,GAAuB;EAInD,OAHI,OAAO,KAAU,YAAY,EAAM,WAAW,IACzC,KAAK,KAAK,GAAM,4BAA4B,IAE9C,KAAK,aAAa,GAAO,CAAI;CACtC;CAEA,OAAO,GAAgB,GAAa,GAAc,GAAyB;EAEzE,OADI,KAAO,IAAkB,KAAK,KAAK,GAAG,EAAK,GAAG,KAAO,CAAM,IACxD;CACT;AACF;AASA,SAAS,EAAe,GAAgB,GAAkC;CACxE,OACE,OAAO,KAAU,YACjB,EAAQ,KAAK,CAAK,KAClB,CAAC,EAAM,MAAM,GAAG,EAAE,MAAM,MAAY,MAAY,OAAO,MAAY,IAAI;AAE3E;AAWA,SAAS,EAAe,GAAiC;CACvD,IAAI,OAAO,KAAU,YAAY,CAAC,EAAuB,KAAK,CAAK,GACjE,OAAO;CAET,IAAM,IAAQ,EAAM,MAAM,GAAG,EAAE,QAAQ,MAAS,EAAK,SAAS,CAAC;CAC/D,OACE,EAAM,SAAS,KACf,EAAM,OACH,MACC,CAAC,EAAK,WAAW,GAAG,KACpB,CAAC,EAAK,MAAM,GAAG,EAAE,MAAM,MAAY,MAAY,IAAI,CACvD;AAEJ;AAEA,SAAS,EAAc,GAAqB,GAAyB;CACnE,IAAI,CAAC,EAAS,CAAQ,GAAG;EACvB,EAAM,KAAK,YAAY,mBAAmB;EAC1C;CACF;CAEA,IAAM,EAAE,iBAAc,gBAAa;CAwBnC,AApBK,EAAS,CAAY,IAGxB,OAAO,QAAQ,CAAY,EAAE,SAAS,CAAC,GAAI,OAAiB;EAC1D,IAAM,IAAO,yBAAyB;EACtC,IAAI,CAAC,EAAS,CAAW,GAAG;GAC1B,EAAM,KAAK,GAAM,mBAAmB;GACpC;EACF;EAEA,AADA,EAAM,KAAK,EAAY,SAAS,GAAG,EAAK,SAAS,GAC7C,cAAc,KAAe,EAAY,aAAa,MACxD,EAAM,KAAK,GAAG,EAAK,YAAY,mBAAmB;EAEpD,IAAM,IAAU,CAAC,WAAW,UAAU;EACtC,OAAO,KAAK,CAAW,EACpB,QAAQ,MAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,SAAS,MAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,KAAO,gBAAgB,CAAC;CACpE,CAAC,IAhBD,EAAM,KAAK,yBAAyB,mBAAmB,GAmBrD,MAAa,KAAA,MACX,CAAC,MAAM,QAAQ,CAAQ,KAAK,EAAS,WAAW,IAClD,EAAM,KAAK,qBAAqB,2BAA2B,IAE3D,EAAS,SAAS,GAAS,MAAU;EACnC,CAAI,OAAO,KAAY,YAAY,EAAQ,WAAW,MACpD,EAAM,KACJ,qBAAqB,EAAM,IAC3B,4BACF;CAEJ,CAAC;AAGP;AAEA,SAAS,EACP,GACA,GACA,GACM;CACN,IAAI,CAAC,EAAS,CAAW,KAAK,OAAO,KAAK,CAAW,EAAE,WAAW,GAAG;EACnE,EAAM,KAAK,GAAM,4BAA4B;EAC7C;CACF;CAEA,IAAM,EAAE,cAAW,cAAW,QAAK,QAAK,cAAW;CAanD,AAZI,MAAc,KAAA,KAAa,CAAC,EAAU,GAAW,CAAC,KACpD,EAAM,KAAK,GAAG,EAAK,aAAa,gCAAgC,GAE9D,MAAc,KAAA,KAAa,CAAC,EAAU,GAAW,CAAC,KACpD,EAAM,KAAK,GAAG,EAAK,aAAa,4BAA4B,GAE1D,MAAQ,KAAA,KAAa,CAAC,EAAU,GAAK,CAAC,KACxC,EAAM,KAAK,GAAG,EAAK,OAAO,gCAAgC,GAExD,MAAQ,KAAA,KAAa,CAAC,EAAU,GAAK,CAAC,KACxC,EAAM,KAAK,GAAG,EAAK,OAAO,4BAA4B,GAEpD,MAAW,KAAA,KAAa,CAAC,EAAQ,GAAQ,CAAkB,KAC7D,EAAM,KAAK,GAAG,EAAK,UAAU,2BAA2B;AAE5D;AAEA,SAAS,EAAW,GAAqB,GAAgB,GAAoB;CAC3E,IAAI,CAAC,EAAS,CAAK,GAAG;EACpB,EAAM,KAAK,GAAM,mBAAmB;EACpC;CACF;CAEA,IAAM,EAAE,SAAM,UAAO,SAAM,gBAAa,aAAU,aAAU,eAAY;CA2DxE,AAzDK,EAAQ,GAAM,CAAW,KAC5B,EAAM,KAAK,GAAG,EAAK,QAAQ,+BAA+B,GAE5D,EAAM,KAAK,GAAO,GAAG,EAAK,OAAO,GACjC,EAAM,KAAK,GAAM,GAAG,EAAK,MAAM,GAC3B,MAAgB,KAAA,KAAW,EAAM,KAAK,GAAa,GAAG,EAAK,aAAa,GAE1E,EAAM,YAAY,KAAA,KAClB,OAAO,EAAM,WAAY,YACzB,OAAO,EAAM,WAAY,YACzB,OAAO,EAAM,WAAY,aACzB,EAAM,YAAY,QAElB,EAAM,KAAK,GAAG,EAAK,WAAW,2CAA2C,GAEvE,OAAO,KAAa,aACtB,EAAM,KAAK,GAAG,EAAK,YAAY,mBAAmB,GAEhD,MAAa,KAAA,KAAa,CAAC,EAAQ,GAAU,CAAa,KAC5D,EAAM,KAAK,GAAG,EAAK,YAAY,6BAA6B,GAE1D,MAAS,iBAAiB,MAAa,KAAA,KACzC,EAAM,KAAK,GAAG,EAAK,YAAY,oCAAoC,GAMnE,EAAM,aAAa,KAAA,MAClB,EAAM,aAAa,MAAQ,MAAS,kBAErC,EAAM,KACJ,GAAG,EAAK,YACR,kDACF,GAGE,MAAY,KAAA,MACV,MAAS,WAEF,CAAC,MAAM,QAAQ,CAAO,KAAK,EAAQ,WAAW,IACvD,EAAM,KAAK,GAAG,EAAK,WAAW,2BAA2B,IAEzD,EAAQ,SAAS,GAAQ,MAAU;EACjC,IAAM,IAAa,GAAG,EAAK,WAAW,EAAM;EAC5C,IAAI,CAAC,EAAS,CAAM,GAAG;GACrB,EAAM,KAAK,GAAY,mBAAmB;GAC1C;EACF;EAIA,CAHI,OAAO,EAAO,SAAU,YAAY,EAAO,MAAM,WAAW,MAC9D,EAAM,KAAK,GAAG,EAAW,SAAS,4BAA4B,GAEhE,EAAM,KAAK,EAAO,OAAO,GAAG,EAAW,OAAO;CAChD,CAAC,IAdD,EAAM,KAAK,GAAG,EAAK,WAAW,mCAAmC,IAkBjE,EAAM,gBAAgB,KAAA,KACxB,EAAiB,GAAO,EAAM,aAAa,GAAG,EAAK,aAAa;AAEpE;AAGA,SAAS,EACP,GACA,GACA,GACU;CAMV,OALI,CAAC,EAAS,CAAM,KAAK,OAAO,KAAK,CAAM,EAAE,WAAW,KACtD,EAAM,KAAK,GAAM,4BAA4B,GACtC,CAAC,KAGH,OAAO,QAAQ,CAAM,EAAE,KAAK,CAAC,GAAM,QACnC,EAAmB,KAAK,CAAI,KAC/B,EAAM,KAAK,GAAG,EAAK,GAAG,KAAQ,2BAA2B,GAE3D,EAAW,GAAO,GAAO,GAAG,EAAK,GAAG,GAAM,GACnC,EACR;AACH;AAGA,SAAS,EACP,GACA,GAC2C;CAC3C,IAAI,CAAC,EAAS,CAAI,GAEhB,OADA,EAAM,KAAK,cAAc,mBAAmB,GACrC;EAAE,OAAO,CAAC;EAAG,YAAY,CAAC;CAAE;CAGrC,AAAI,EAAK,SAAS,KAAA,KAAW,EAAM,KAAK,EAAK,MAAM,iBAAiB;CAEpE,IAAM,IAAQ,EAAY,GAAO,EAAK,MAAM,iBAAiB,GACvD,IAAkB,CAAC;CAEzB,AAAI,EAAK,aAAa,KAAA,MAChB,CAAC,EAAS,EAAK,QAAQ,KAAK,OAAO,KAAK,EAAK,QAAQ,EAAE,WAAW,IACpE,EAAM,KAAK,uBAAuB,4BAA4B,IAE9D,OAAO,QAAQ,EAAK,QAAQ,EAAE,SAAS,CAAC,GAAM,OAAY;EACxD,IAAI,CAAC,EAAQ,GAAM,CAAa,GAAG;GACjC,EAAM,KAAK,uBAAuB,KAAQ,uBAAuB;GACjE;EACF;EAEA,AADA,EAAM,KAAK,CAAI,GACf,EAAM,KACJ,GAAG,EAAY,GAAO,GAAQ,uBAAuB,GAAM,CAC7D;CACF,CAAC;CAML,IAAM,IAAa,EAAM,QACtB,GAAM,MAAU,EAAM,QAAQ,CAAI,MAAM,CAC3C;CAKA,OAJA,MAAM,KAAK,IAAI,IAAI,CAAU,CAAC,EAAE,SAAS,MACvC,EAAM,KAAK,cAAc,KAAQ,4BAA4B,CAC/D,GAEO;EAAE;EAAO,YAAY;CAAM;AACpC;AAEA,SAAS,EACP,GACA,GACA,GACM;CACN,IAAI,CAAC,MAAM,QAAQ,CAAQ,KAAK,EAAS,WAAW,GAAG;EACrD,EAAM,KAAK,GAAM,2BAA2B;EAC5C;CACF;CACA,EAAS,SAAS,GAAS,MAAU;EACnC,CAAI,OAAO,KAAY,YAAY,EAAQ,WAAW,MACpD,EAAM,KAAK,GAAG,EAAK,GAAG,EAAM,IAAI,4BAA4B;CAEhE,CAAC;AACH;AAEA,SAAS,EACP,GACA,GACA,GACA,GACM;CACN,IAAM,IAAO,iBAAiB;CAC9B,IAAI,CAAC,EAAS,CAAM,GAAG;EACrB,EAAM,KAAK,GAAM,mBAAmB;EACpC;CACF;CAYA,AAVA,EAAM,KAAK,EAAO,OAAO,GAAG,EAAK,OAAO,GACxC,EAAM,KAAK,EAAO,MAAM,GAAG,EAAK,MAAM,GACtC,EAAoB,GAAO,EAAO,UAAU,GAAG,EAAK,UAAU,GAE9D,EADqC,GAAO,EAAO,MAAM,GAAG,EAAK,MACjE,EACG,QAAQ,MAAS,EAAiB,SAAS,CAAI,CAAC,EAChD,SAAS,MACR,EAAM,KAAK,GAAG,EAAK,QAAQ,KAAQ,iCAAiC,CACtE,GAEE,MAAS,WACX,EAAM,cAAc,EAAO,QAAQ,GAAG,EAAK,QAAQ,IAC1C,MAAS,YAClB,EAAM,cAAc,EAAO,QAAQ,GAAG,EAAK,QAAQ,GACnD,EAAM,cAAc,EAAO,SAAS,GAAG,EAAK,SAAS,KAC5C,MAAS,YAClB,EAAM,cAAc,EAAO,aAAa,GAAG,EAAK,aAAa,GAC7D,EAAM,cAAc,EAAO,YAAY,GAAG,EAAK,YAAY,GACvD,EAAO,gBAAgB,KAAA,KACzB,EAAM,cAAc,EAAO,aAAa,GAAG,EAAK,aAAa,KAG/D,EAAM,KAAK,GAAM,gCAAgC;CAgBnD,IAAM,IAAU;EAZd,QAAQ;GAAC;GAAS;GAAQ;GAAY;GAAQ;EAAQ;EACtD,QAAQ;GAAC;GAAS;GAAQ;GAAY;GAAQ;GAAU;EAAS;EACjE,QAAQ;GACN;GACA;GACA;GACA;GACA;GACA;GACA;EACF;CAEc,EAAc,MAAS,CAAC;CACxC,OAAO,KAAK,CAAM,EACf,QAAQ,MAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,SAAS,MAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,KAAO,gBAAgB,CAAC;AACpE;AAEA,SAAS,EACP,GACA,GACA,GACM;CACN,IAAI,CAAC,EAAS,CAAO,KAAK,OAAO,KAAK,CAAO,EAAE,WAAW,GAAG;EAC3D,EAAM,KAAK,iBAAiB,4BAA4B;EACxD;CACF;CACA,OAAO,QAAQ,CAAO,EAAE,SAAS,CAAC,GAAM,OACtC,EAAY,GAAO,GAAM,GAAQ,CAAgB,CACnD;AACF;AAEA,SAAS,EAAkB,GAAiB,GAAuB;CAEjE,OADK,EAAS,CAAM,IACb,OAAO,OAAO,CAAM,EAAE,MAC1B,MAAU,EAAS,CAAK,KAAK,EAAM,SAAS,CAC/C,IAH8B;AAIhC;AAEA,SAAS,EAAoB,GAA0B;CACrD,OAAO,EAAS,CAAM,KAAK,EAAkB,EAAO,MAAM,aAAa;AACzE;AAYA,SAAS,EAAyB,GAAqB;CACrD,IAAM,IAAO,EAAS,EAAM,IAAI,IAAI,EAAM,OAAO,CAAC,GAC5C,IAAW,EAAS,EAAK,QAAQ,IAAI,EAAK,WAAW,CAAC,GACtD,IAAc,EAAS;CAyB7B,OArBI,EAAkB,GAAa,cAAc,KAO/C,WAAW,KAAY,OAAO,KAAK,CAAQ,EAAE,WAAW,KAEjC,EAAkB,GAAa,aAAa,KACnE,EAAkB,EAAK,MAAM,aAAa,IAEnC,KAML,CAAC,EAAS,EAAM,OAAO,KAAK,OAAO,KAAK,EAAM,OAAO,EAAE,WAAW,IAC7D,KAEF,OAAO,OAAO,EAAM,OAAO,EAAE,MAAM,CAAmB;AAC/D;AAEA,SAAS,EAAa,GAAqB,GAAwB;CACjE,AAAI,EAAM,aAAa,GAAS,eAAe,KACxC,EAAmB,SAAS,KAC/B,EAAM,KACJ,iBACA,mBAAmB,EAAmB,YACxC;AAGN;AAUA,SAAS,EAAY,GAAqB,GAAuB;CAC/D,IAAI,CAAC,EAAS,CAAM,GAAG;EACrB,EAAM,KAAK,gBAAgB,mBAAmB;EAC9C;CACF;CA4DA,CAzDE,OAAO,EAAO,WAAY,YAC1B,CAAC,EAAyB,KAAK,EAAO,OAAO,MAE7C,EAAM,KAAK,wBAAwB,4BAA4B,GAE5D,EAAe,EAAO,UAAU,KACnC,EAAM,KACJ,2BACA,uDACF,GAGA,EAAO,gBAAgB,KAAA,KACvB,CAAC,EAAe,EAAO,aAAa,CAAmB,KAEvD,EAAM,KAAK,4BAA4B,yBAAyB,GAE9D,EAAO,YAAY,KAAA,KAAa,CAAC,EAAU,EAAO,SAAS,CAAC,KAC9D,EAAM,KAAK,wBAAwB,4BAA4B,GAG7D,CAAC,EAAS,EAAO,KAAK,KAAK,OAAO,KAAK,EAAO,KAAK,EAAE,WAAW,IAClE,EAAM,KAAK,sBAAsB,4BAA4B,KAE7D,OAAO,QAAQ,EAAO,KAAK,EAAE,SAAS,CAAC,GAAY,OAAY;EAa7D,AAZK,EAAe,GAAY,CAAmB,KACjD,EAAM,KAAK,sBAAsB,KAAc,sBAAsB,GAKnE,MAAA,iBACF,EAAM,KACJ,sBAAsB,KACtB,iDACF,GAEG,EAAe,GAAQ,CAAqB,KAC/C,EAAM,KACJ,sBAAsB,KACtB,gDACF;CAEJ,CAAC,GAOC,OAAO,EAAO,eAAgB,YAC9B,EAAE,EAAO,eAAe,EAAO,UAE/B,EAAM,KAAK,4BAA4B,yBAAyB,IAIhE,CAAC,EAAS,EAAO,MAAM,KAAK,OAAO,KAAK,EAAO,MAAM,EAAE,WAAW,IACpE,EAAM,KAAK,uBAAuB,4BAA4B,IAE9D,EAAkB,GAAO,EAAO,QAAQ,qBAAqB;AAEjE;AAGA,SAAS,EACP,GACA,GACA,GACM;CACN,IAAI,OAAO,KAAS,UAAU;EAC5B,EAAM,cAAc,GAAM,CAAI;EAC9B;CACF;CACA,IAAI,MAAM,QAAQ,CAAI,GAAG;EACvB,EAAK,SAAS,GAAM,MAClB,EAAkB,GAAO,GAAM,GAAG,EAAK,GAAG,EAAM,EAAE,CACpD;EACA;CACF;CACA,IAAI,EAAS,CAAI,GAAG;EAClB,OAAO,QAAQ,CAAI,EAAE,SAAS,CAAC,GAAK,OAClC,EAAkB,GAAO,GAAO,GAAG,EAAK,GAAG,GAAK,CAClD;EACA;CACF;CACA,AAAI,MAAS,QAAQ,OAAO,KAAS,YAAY,OAAO,KAAS,aAC/D,EAAM,KACJ,GACA,0DACF;AAEJ;AAEA,SAAS,EACP,GACA,GACA,GACA,GACM;CACN,IAAI,CAAC,EAAQ,EAAM,MAAM,CAAW,GAAG;EACrC,EAAM,KAAK,cAAc,yBAAyB;EAClD;CACF;CAEA,IAAI,EAAM,SAAS,UAAU;EAI3B,IAAM,IAAY,EAAM,WAAW,KAAA,GAC7B,IAAY,EAAM,WAAW,KAAA,GAC7B,IAAa,EAAM,YAAY,KAAA;EA+BrC,AA9BiB;GAAC;GAAW;GAAW;EAAU,EAAE,OAAO,OACvD,EAAS,WAAW,IAKb,IACT,EAAY,GAAO,EAAM,MAAM,IACtB,IACT,EAAa,GAAO,EAAM,SAAS,CAAgB,IAEnD,EAAM,cAAc,EAAM,QAAQ,cAAc,IAThD,EAAM,KACJ,SACA,wEACF,GAWE,EAAM,YAAY,KAAA,KAAW,EAAa,GAAO,EAAM,OAAO,GAE9D,EAAM,WAAW,KACnB,EAAM,KACJ,uBACA,wCACF,GAEE,EAAM,SAAS,OAAO,KAAK,CAAC,EAAyB,CAAK,KAC5D,EAAM,KACJ,6BACA,yDACF,GAEE,EAAM,WAAW,KAAA,MACd,EAAM,SAAS,OAAO,IAGzB,EAAM,cAAc,EAAM,QAAQ,cAAc,IAFhD,EAAM,KAAK,gBAAgB,sCAAsC;EAKrE;CACF;CAMA,AAJA,EAAa,GAAO,EAAM,OAAO,GACjC,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC,GACzE,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC,GACzE,EAAM,OAAO,GAAO,WAAW,SAAS,kCAAkC,GAC1E,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC;AAC3E;AAGA,SAAgB,EAAc,GAA6B;CACzD,OAAO,EAAS,CAAS,KAAK,EAAU,UAAU,KAAA;AACpD;AAQA,SAAgB,EAAmB,GAA2C;CAC5E,IAAM,IAAQ,IAAI,EAAa;CAE/B,IAAI,CAAC,EAAS,CAAS,GACrB,OAAO;EAAE,OAAO;EAAO,QAAQ,CAAC,6BAA6B;CAAE;CAGjE,IAAM,EAAE,aAAU;CAClB,IAAI,CAAC,EAAS,CAAK,GACjB,OAAO;EAAE,OAAO;EAAO,QAAQ,CAAC,0BAA0B;CAAE;CAE9D,IAAI,EAAM,YAAA,OACR,OAAO;EACL,OAAO;EACP,QAAQ,CAAC,gCAA2C;CACtD;CA0BF,CAtBE,OAAO,EAAU,MAAO,YACxB,CAAC,EAAiB,KAAK,EAAU,EAAE,MAEnC,EAAM,KAAK,MAAM,0BAA0B,GAE7C,EAAM,KAAK,EAAU,MAAM,MAAM,GACjC,EAAM,KAAK,EAAU,aAAa,aAAa,GAE7C,EAAU,YAAY,KAAA,MACrB,OAAO,EAAU,WAAY,YAC5B,CAAC,EAAyB,KAAK,EAAU,OAAO,MAElD,EAAM,KAAK,WAAW,4BAA4B,GAGlD,EAAU,UAAU,KAAA,MACnB,OAAO,EAAU,SAAU,YAC1B,CAAC,EAAiB,KAAK,EAAU,KAAK,MAExC,EAAM,KAAK,SAAS,0BAA0B,GAGhD,EAAc,GAAO,EAAU,QAAQ;CACvC,IAAM,EAAE,UAAO,kBAAe,EAAU,GAAO,EAAM,IAAI;CAGzD,OAFA,EAAU,GAAO,GAAO,GAAO,CAAU,GAElC;EAAE,OAAO,EAAM,OAAO,WAAW;EAAG,QAAQ,EAAM;CAAO;AAClE"}

package/dist/manifests/types.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.cjs","names":[],"sources":["../../src/manifests/types.ts"],"sourcesContent":["/*\n Host-owned shape of an extension-authored setup experience.\n \n A catalog entry is declarative data published by `@openhands/extensions`. Its\n * optional `setup` block says what to ask a user for; everything derivable from\n * that — the request to send, the route, the review screen, the analytics — is\n * this host's to generate, so none of it appears here.\n \n The names mirror `@openhands/extensions/automations`' own declarations, so an\n * entry from the published package assigns without an adapter.\n /\n\nexport const SETUP_VERSION = \"1.0\";\n\nexport type SetupMode = \"direct\" \| \"assisted\";\n\nexport type SetupFieldType =\n \| \"text\"\n \| \"textarea\"\n \| \"select\"\n \| \"cron\"\n \| \"timezone\"\n \| \"repo-picker\";\n\nexport type SetupGitProvider = \"github\" \| \"gitlab\" \| \"bitbucket\";\n\nexport type SetupTriggerKind = \"cron\" \| \"event\";\n\n/* Placeholder namespaces a setup block may reference inside `{{...}}`. /\nexport const SETUP_PLACEHOLDER_NAMESPACES = [\"form\", \"automation\"] as const;\n\nexport interface SetupFieldOption {\n value: string;\n label: string;\n}\n\nexport interface SetupFieldConstraints {\n minLength?: number;\n maxLength?: number;\n /\n A host-implemented check named from a closed set. Entries supply no regex\n * of their own, so they cannot hand the host a pathological pattern.\n /\n format?: \"safeExpressionLiteral\";\n}\n\nexport interface SetupFormField {\n type: SetupFieldType;\n label: string;\n help: string;\n placeholder?: string;\n default?: string;\n required: boolean;\n provider?: SetupGitProvider;\n /\n repo-picker only. The field collects several repositories rather than one,\n * and its value is a list. A placeholder that is the whole value resolves to\n * that list, so a payload can state one and get an array.\n /\n multiple?: true;\n options?: SetupFieldOption[];\n constraints?: SetupFieldConstraints;\n}\n\n/* Keyed by field name, which is what `{{form.<name>}}` resolves against. /\nexport type SetupFormFields = Record<string, SetupFormField>;\n\nexport interface SetupForm {\n note?: string;\n /* Inputs that decide when the automation runs, keyed by trigger kind. /\n triggers?: Partial<Record<SetupTriggerKind, SetupFormFields>>;\n /* Every other input: the arguments to the automation itself. /\n args: SetupFormFields;\n}\n\n/* A config.json leaf: templated string, number, boolean, null, or a nesting. /\nexport type SetupBundleConfigValue =\n \| string\n \| number\n \| boolean\n \| null\n \| SetupBundleConfigValue[]\n \| { [key: string]: SetupBundleConfigValue };\n\n/\n The name the rendered configuration is packed under, which is therefore a\n * name a bundle's own files may not claim. Stated here rather than beside the\n * packing, so admission can refuse the collision without importing it.\n /\nexport const BUNDLE_CONFIG_FILENAME = \"config.json\";\n\n/\n The script tarball a direct entry may ship instead of a prompt, for an\n * automation that is deterministic machinery rather than judgement.\n \n `files` maps a path inside the archive to the repository path the extensions\n * package read it from; the contents themselves come from that package's\n * `getAutomationBundleFiles`, because this host has the package and not the\n * repository.\n /\nexport interface SetupBundle {\n /* Provenance recorded on the created automation, alongside the entry id. /\n version: string;\n /* The command the service runs inside the extracted tarball. /\n entrypoint: string;\n /* Script run once before the entrypoint. Absent when nothing to install. /\n setupScript?: string;\n /* Seconds a run may take, when the service default is not enough. /\n timeout?: number;\n files: Record<string, string>;\n /* Rendered from the form and packed as config.json. /\n config: Record<string, SetupBundleConfigValue>;\n}\n\nexport interface SetupBlock {\n version: typeof SETUP_VERSION;\n mode: SetupMode;\n form: SetupForm;\n /* direct only. What the automation is told to do. /\n prompt?: string;\n /* direct only, and the alternative to `prompt`. Exactly one is present. /\n bundle?: SetupBundle;\n /* direct only, event trigger only. Which delivered events belong to it. /\n filter?: string;\n /\n Setup context for the conversation that finishes setup. Required for\n * assisted mode. Optional for direct mode, where it seeds the fallback\n * conversation offered when the deployment cannot run the direct path.\n /\n message?: string;\n}\n\nexport interface SetupIntegrationRequirement {\n /* Why this entry needs the integration. /\n message: string;\n /* Defaults to true. `false` lets setup continue while it is unconnected. /\n required?: false;\n}\n\nexport interface SetupPrerequisites {\n /* Keyed by integration catalog id. /\n integrations: Record<string, SetupIntegrationRequirement>;\n /* Deployment capabilities this entry cannot run without. /\n features?: string[];\n}\n\n/\n The part of a catalog entry this host reads. An admitted entry always has a\n * `setup` block; entries without one are simply not setup entries.\n /\nexport interface SetupEntry {\n id: string;\n name: string;\n description: string;\n /\n Version of the template this entry publishes, sent with the create request\n * as provenance. A bundle declares its own at `setup.bundle.version`; a\n * prompt entry declares it here. Absent means the entry sends none, so the\n * service records no template for what it creates.\n /\n version?: string;\n requires: SetupPrerequisites;\n /* The skill that owns the launch command. Defaults to `id`. /\n skill?: string;\n setup: SetupBlock;\n}\n\nexport type SetupPayloadValue =\n \| string\n \| number\n \| boolean\n \| null\n \| SetupPayloadValue[]\n \| { [key: string]: SetupPayloadValue };\n\nexport interface SetupRequestBody {\n [key: string]: SetupPayloadValue;\n}\n\n/\n Form values as collected; the payload mapping shapes them.\n \n A field collecting several values holds a list. Everything else holds a\n * string, including fields whose value is a number to the service - the\n * payload mapping is where a value stops being what was typed.\n /\nexport type SetupFormValue = string \| string[];\nexport type SetupFormValues = Record<string, SetupFormValue>;\n\n/* `GET /v1/capabilities` — what this deployment supports. /\nexport interface DeploymentCapabilities {\n ready: boolean;\n /* Absolute timeout ceiling enforced by this deployment's automation API. /\n maxAutomationTimeoutSeconds?: number;\n triggerKinds: string[];\n eventSources: string[];\n eventTypes: string[];\n triggers: {\n cron?: { minIntervalSeconds: number; timezones: string[] };\n event?: { filterLanguage: string; filterFunctions: string[] };\n };\n features: string[];\n}\n\n/* A single problem with a draft, addressed to the field that caused it. /\nexport interface DraftValidationError {\n /* Dotted path into the draft. Null when the problem spans the whole draft. /\n field: string \| null;\n code: string;\n message: string;\n}\n\n/* `POST /v1/validate` — an invalid draft is still a 200. /\nexport interface ValidateDraftResponse {\n valid: boolean;\n errors: DraftValidationError[];\n sampleEventMatched?: boolean \| null;\n}\n\n/\n Host-owned shape of the production Automation interface manifest, published\n * by `@openhands/extensions/automations` as `AUTOMATION_INTERFACE`.\n \n The catalog states what varies per automation; this states the domain-level\n * facts of the interface itself. As with setup entries, the published data is\n * validated at admission rather than trusted, and a package that predates the\n * manifest simply leaves the host on its own defaults.\n /\n\nexport const INTERFACE_VERSION = \"1.0\";\n\n/* The closed set of runtime-model properties a client may offer for setting. /\nexport type AutomationAttributeName =\n \| \"name\"\n \| \"prompt\"\n \| \"model\"\n \| \"timeout\"\n \| \"schedule\";\n\nexport type InterfaceAttributeType =\n \| \"text\"\n \| \"textarea\"\n \| \"number\"\n \| \"llm-profile\"\n \| \"schedule\";\n\n/* How one settable attribute of an existing Automation is offered. /\nexport interface InterfaceAttribute {\n type: InterfaceAttributeType;\n label: string;\n help?: string;\n required: boolean;\n /* Only a `number` attribute carries constraints. /\n constraints?: { min?: number; max?: number };\n}\n\nexport interface InterfaceRoutes {\n list: string;\n /* Carries the `:automationId` segment the host substitutes. /\n setup: string;\n /* Carries the `:automationId` segment the host substitutes. /\n detail: string;\n /* The templates sub-page. Static: there is no parameter to substitute. /\n templates?: string;\n}\n\n/\n Service-relative paths the host calls. The base path, methods, headers, and\n * auth remain the host's. `{id}` marks where the automation id is substituted.\n /\nexport interface InterfaceEndpoints {\n list: string;\n detail: string;\n dispatch: string;\n runs: string;\n tarball: string;\n health: string;\n capabilities: string;\n validate: string;\n createPrompt: string;\n createPlugin: string;\n /\n The raw create endpoint, which a bundle entry is created through, and\n * where its tarball is uploaded first. Optional: a manifest published before\n * bundles existed declares neither, and is still admitted.\n /\n createBundle?: string;\n uploads?: string;\n}\n\nexport type InterfaceEndpointName = keyof InterfaceEndpoints;\n\nexport interface InterfaceImportExport {\n fileKind: string;\n fileVersion: number;\n filenameSuffix: string;\n importDefaults: {\n /* Provider inferred for short owner/repo repository URLs on import. /\n repoProvider: SetupGitProvider;\n /* Event source of the placeholder trigger that keeps an import inert. /\n placeholderEventSource: string;\n };\n}\n\n/\n The sub-page surface: navigation, overview tiles, filters, sort, and run\n * insights for the list page, and a templates page. Every value below names\n * something this host implements from a closed set — a metric it computes, a\n * predicate it applies, a comparator it runs, an icon it ships — and the\n * manifest picks and captions it, never defines it. The host carries no\n * definitions of its own for this surface, so a manifest without it simply\n * leaves the sub-pages unrendered.\n /\n\nexport const INTERFACE_SUB_PAGE_IDS = [\"list\", \"templates\"] as const;\n\nexport type InterfaceSubPageId = (typeof INTERFACE_SUB_PAGE_IDS)[number];\n\n/* Icon names this host maps to artwork. A manifest cannot supply its own. /\nexport const INTERFACE_ICON_SLUGS = [\n \"layout-dashboard\",\n \"sparkles\",\n \"library\",\n \"bot\",\n \"circle-alert\",\n \"activity\",\n \"timer\",\n] as const;\n\nexport type InterfaceIconSlug = (typeof INTERFACE_ICON_SLUGS)[number];\n\nexport interface InterfaceSubPageNavItem {\n /* The `pages` entry this item navigates to; its route comes from `routes`. /\n page: InterfaceSubPageId;\n label: string;\n icon: InterfaceIconSlug;\n}\n\n/* Values this host computes over the loaded automations and their runs. /\nexport const OVERVIEW_METRICS = [\n \"automations\",\n \"needs-attention\",\n \"total-runs\",\n \"average-duration\",\n] as const;\n\nexport type OverviewMetric = (typeof OVERVIEW_METRICS)[number];\n\n/\n Placeholder names a tile's `detail`/`zeroDetail` copy may reference inside\n * `{{...}}`, per metric. Plain substitution, like setup copy.\n /\nexport const OVERVIEW_TILE_PLACEHOLDERS: Record<\n OverviewMetric,\n readonly string[]\n> = {\n automations: [\"active\"],\n \"needs-attention\": [],\n \"total-runs\": [],\n \"average-duration\": [],\n};\n\nexport interface InterfaceOverviewTile {\n metric: OverviewMetric;\n label: string;\n /* Caption under the value. /\n detail: string;\n /* Replaces `detail` while the metric's value is zero. /\n zeroDetail?: string;\n icon: InterfaceIconSlug;\n}\n\nexport interface InterfaceOverview {\n /* Names the tiles section for assistive technology. /\n label: string;\n tiles: InterfaceOverviewTile[];\n}\n\n/* Filter values name predicates this host implements, per filter id. /\nexport const DASHBOARD_FILTER_VALUES = {\n status: [\"all\", \"active\", \"failing\", \"disabled\"],\n trigger: [\"all\", \"schedule\", \"event\"],\n} as const;\n\nexport type DashboardFilterId = keyof typeof DASHBOARD_FILTER_VALUES;\n\nexport const DASHBOARD_FILTER_IDS = Object.keys(\n DASHBOARD_FILTER_VALUES,\n) as readonly DashboardFilterId[];\n\nexport type DashboardStatusValue =\n (typeof DASHBOARD_FILTER_VALUES.status)[number];\n\nexport type DashboardTriggerValue =\n (typeof DASHBOARD_FILTER_VALUES.trigger)[number];\n\nexport interface InterfaceStatusFilter {\n id: \"status\";\n /* The control's accessible name. /\n label: string;\n options: { value: DashboardStatusValue; label: string }[];\n}\n\nexport interface InterfaceTriggerFilter {\n id: \"trigger\";\n /* The control's accessible name. /\n label: string;\n options: { value: DashboardTriggerValue; label: string }[];\n}\n\nexport type InterfaceDashboardFilter =\n \| InterfaceStatusFilter\n \| InterfaceTriggerFilter;\n\n/* Sort values name comparators this host implements. /\nexport const DASHBOARD_SORT_VALUES = [\"last-run\", \"runs\", \"name\"] as const;\n\nexport type DashboardSortValue = (typeof DASHBOARD_SORT_VALUES)[number];\n\nexport interface InterfaceDashboardSort {\n /* The control's accessible name. /\n label: string;\n options: { value: DashboardSortValue; label: string }[];\n /* One of the declared option values. /\n default: DashboardSortValue;\n}\n\n/\n Copy for the per-automation run insights on cards and rows. The states,\n * precedence, sampling, and value formatting are this host's; the manifest\n * names them.\n /\nexport interface InterfaceListInsights {\n health: {\n healthy: string;\n failing: string;\n running: string;\n disabled: string;\n neverRun: string;\n checking: string;\n };\n lastRun: { label: string; never: string; justNow: string };\n stats: { runs: string; recentSuccess: string; averageDuration: string };\n}\n\n/\n The templates sub-page identity. Its body — the catalog cards and their\n * launch behavior — is this host's existing catalog surface.\n /\nexport interface InterfaceTemplatesPage {\n title: string;\n description: string;\n}\n\nexport interface InterfaceManifest {\n version: typeof INTERFACE_VERSION;\n routes: InterfaceRoutes;\n navigation: {\n sidebar: { label: string };\n commandMenu: { title: string; description: string; keywords: string };\n /* The ordered sub-page navigation of the interface. /\n subPages?: InterfaceSubPageNavItem[];\n };\n pages: {\n list: {\n title: string;\n subtitle: string;\n overview?: InterfaceOverview;\n /* The filter dropdowns of the list page, in render order. /\n filters?: InterfaceDashboardFilter[];\n sort?: InterfaceDashboardSort;\n insights?: InterfaceListInsights;\n };\n detail: { backLabel: string };\n edit: { title: string };\n templates?: InterfaceTemplatesPage;\n };\n docsUrl: string;\n /\n The input surface of an existing Automation, keyed by the runtime-model\n * property the host sends. Rendering it as an edit dialog is this host's\n * choice, not stated here.\n */\n attributes: Partial<Record<AutomationAttributeName, InterfaceAttribute>>;\n importExport: InterfaceImportExport;\n endpoints: InterfaceEndpoints;\n featuredAutomationIds: string[];\n responderIntegrationIds: string[];\n}\n"],"mappings":"6CA6BA,IAAa,EAA+B,CAAC,OAAQ,YAAY,EA4DpD,EAAyB,cAiOzB,EAAyB,CAAC,OAAQ,WAAW,EAK7C,EAAuB,CAClC,mBACA,WACA,UACA,MACA,eACA,WACA,OACF,EAYa,EAAmB,CAC9B,cACA,kBACA,aACA,kBACF,EAQa,EAGT,CACF,YAAa,CAAC,QAAQ,EACtB,kBAAmB,CAAC,EACpB,aAAc,CAAC,EACf,mBAAoB,CAAC,CACvB,EAmBa,EAA0B,CACrC,OAAQ,CAAC,MAAO,SAAU,UAAW,UAAU,EAC/C,QAAS,CAAC,MAAO,WAAY,OAAO,CACtC,EAIa,EAAuB,OAAO,KACzC,CACF,EA2Ba,EAAwB,CAAC,WAAY,OAAQ,MAAM"}
1	+ {"version":3,"file":"types.cjs","names":[],"sources":["../../src/manifests/types.ts"],"sourcesContent":["/*\n Host-owned shape of an extension-authored setup experience.\n \n A catalog entry is declarative data published by `@openhands/extensions`. Its\n * optional `setup` block says what to ask a user for; everything derivable from\n * that — the request to send, the route, the review screen, the analytics — is\n * this host's to generate, so none of it appears here.\n \n The names mirror `@openhands/extensions/automations`' own declarations, so an\n * entry from the published package assigns without an adapter.\n /\n\nexport const SETUP_VERSION = \"1.0\";\n\nexport type SetupMode = \"direct\" \| \"assisted\";\n\nexport type SetupFieldType =\n \| \"text\"\n \| \"textarea\"\n \| \"select\"\n \| \"number\"\n \| \"cron\"\n \| \"timezone\"\n \| \"repo-picker\"\n \| \"llm-profile\"\n \| \"event-source\"\n \| \"event-type\"\n \| \"plugin-sources\"\n \| \"tarball-upload\";\n\nexport type SetupGitProvider = \"github\" \| \"gitlab\" \| \"bitbucket\";\n\nexport type SetupTriggerKind = \"cron\" \| \"event\";\n\n/* Placeholder namespaces a setup block may reference inside `{{...}}`. /\nexport const SETUP_PLACEHOLDER_NAMESPACES = [\"form\", \"automation\"] as const;\n\nexport interface SetupFieldOption {\n value: string;\n label: string;\n}\n\nexport interface SetupFieldConstraints {\n minLength?: number;\n maxLength?: number;\n min?: number;\n max?: number;\n /\n A host-implemented check named from a closed set. Entries supply no regex\n * of their own, so they cannot hand the host a pathological pattern.\n /\n format?: \"safeExpressionLiteral\";\n}\n\nexport interface SetupFormField {\n type: SetupFieldType;\n label: string;\n help: string;\n placeholder?: string;\n default?: string \| number \| boolean \| null;\n required: boolean;\n provider?: SetupGitProvider;\n /\n repo-picker only. The field collects several repositories rather than one,\n * and its value is a list. A placeholder that is the whole value resolves to\n * that list, so a payload can state one and get an array.\n /\n multiple?: true;\n options?: SetupFieldOption[];\n constraints?: SetupFieldConstraints;\n}\n\n/* Keyed by field name, which is what `{{form.<name>}}` resolves against. /\nexport type SetupFormFields = Record<string, SetupFormField>;\n\nexport interface SetupForm {\n note?: string;\n /* Inputs that decide when the automation runs, keyed by trigger kind. Multiple keys are selectable variants. /\n triggers?: Partial<Record<SetupTriggerKind, SetupFormFields>>;\n /* Every other input: the arguments to the automation itself. /\n args: SetupFormFields;\n}\n\n/* A config.json leaf: templated string, number, boolean, null, or a nesting. /\nexport type SetupBundleConfigValue =\n \| string\n \| number\n \| boolean\n \| null\n \| SetupBundleConfigValue[]\n \| { [key: string]: SetupBundleConfigValue };\n\n/\n The name the rendered configuration is packed under, which is therefore a\n * name a bundle's own files may not claim. Stated here rather than beside the\n * packing, so admission can refuse the collision without importing it.\n /\nexport const BUNDLE_CONFIG_FILENAME = \"config.json\";\n\n/\n The script tarball a direct entry may ship instead of a prompt, for an\n * automation that is deterministic machinery rather than judgement.\n \n `files` maps a path inside the archive to the repository path the extensions\n * package read it from; the contents themselves come from that package's\n * `getAutomationBundleFiles`, because this host has the package and not the\n * repository.\n /\nexport interface SetupBundle {\n /* Provenance recorded on the created automation, alongside the entry id. /\n version: string;\n /* The command the service runs inside the extracted tarball. /\n entrypoint: string;\n /* Script run once before the entrypoint. Absent when nothing to install. /\n setupScript?: string;\n /* Seconds a run may take, when the service default is not enough. /\n timeout?: number;\n files: Record<string, string>;\n /* Rendered from the form and packed as config.json. /\n config: Record<string, SetupBundleConfigValue>;\n}\n\nexport type SetupActionKind = \"prompt\" \| \"plugin\" \| \"upload\";\n\nexport interface SetupPromptAction {\n label: string;\n help: string;\n features: string[];\n args: SetupFormFields;\n prompt: string;\n}\n\nexport interface SetupPluginAction {\n label: string;\n help: string;\n features: string[];\n args: SetupFormFields;\n prompt: string;\n plugins: string;\n}\n\nexport interface SetupUploadAction {\n label: string;\n help: string;\n features: string[];\n args: SetupFormFields;\n tarballPath: string;\n entrypoint: string;\n setupScript?: string;\n}\n\nexport interface SetupActions {\n prompt?: SetupPromptAction;\n plugin?: SetupPluginAction;\n upload?: SetupUploadAction;\n}\n\nexport type SetupAction =\n \| SetupPromptAction\n \| SetupPluginAction\n \| SetupUploadAction;\n\nexport interface SetupBlock {\n version: typeof SETUP_VERSION;\n mode: SetupMode;\n form: SetupForm;\n /* direct only. What the automation is told to do. /\n prompt?: string;\n /* direct only, and the alternative to `prompt`. Exactly one is present. /\n bundle?: SetupBundle;\n /* direct only, and the alternative to `prompt` or `bundle`. /\n actions?: SetupActions;\n /* direct only, event trigger only. Which delivered events belong to it. /\n filter?: string;\n /\n Setup context for the conversation that finishes setup. Required for\n * assisted mode. Optional for direct mode, where it seeds the fallback\n * conversation offered when the deployment cannot run the direct path.\n /\n message?: string;\n}\n\nexport interface SetupIntegrationRequirement {\n /* Why this entry needs the integration. /\n message: string;\n /* Defaults to true. `false` lets setup continue while it is unconnected. /\n required?: false;\n}\n\nexport interface SetupPrerequisites {\n /* Keyed by integration catalog id. /\n integrations: Record<string, SetupIntegrationRequirement>;\n /* Deployment capabilities this entry cannot run without. /\n features?: string[];\n}\n\n/\n The part of a catalog entry this host reads. An admitted entry always has a\n * `setup` block; entries without one are simply not setup entries.\n /\nexport interface SetupEntry {\n id: string;\n name: string;\n description: string;\n /\n Version of the template this entry publishes, sent with the create request\n * as provenance. A bundle declares its own at `setup.bundle.version`; a\n * prompt entry declares it here. Absent means the entry sends none, so the\n * service records no template for what it creates.\n /\n version?: string;\n requires: SetupPrerequisites;\n /* The skill that owns the launch command. Defaults to `id`. /\n skill?: string;\n setup: SetupBlock;\n}\n\nexport type SetupPayloadValue =\n \| string\n \| number\n \| boolean\n \| null\n \| SetupPayloadValue[]\n \| { [key: string]: SetupPayloadValue };\n\nexport interface SetupRequestBody {\n [key: string]: SetupPayloadValue;\n}\n\n/\n Form values as collected; the payload mapping shapes them.\n \n A field collecting several values holds a list. Everything else holds a\n * string, including fields whose value is a number to the service - the\n * payload mapping is where a value stops being what was typed.\n /\nexport type SetupFormValue = string \| number \| boolean \| null \| string[] \| File;\nexport type SetupFormValues = Record<string, SetupFormValue>;\n\n/* `GET /v1/capabilities` — what this deployment supports. /\nexport interface DeploymentCapabilities {\n ready: boolean;\n /* Absolute timeout ceiling enforced by this deployment's automation API. /\n maxAutomationTimeoutSeconds?: number;\n triggerKinds: string[];\n eventSources: string[];\n eventTypes: string[];\n triggers: {\n cron?: { minIntervalSeconds: number; timezones: string[] };\n event?: { filterLanguage: string; filterFunctions: string[] };\n };\n features: string[];\n}\n\n/* A single problem with a draft, addressed to the field that caused it. /\nexport interface DraftValidationError {\n /* Dotted path into the draft. Null when the problem spans the whole draft. /\n field: string \| null;\n code: string;\n message: string;\n}\n\n/* `POST /v1/validate` — an invalid draft is still a 200. /\nexport interface ValidateDraftResponse {\n valid: boolean;\n errors: DraftValidationError[];\n sampleEventMatched?: boolean \| null;\n}\n\n/\n Host-owned shape of the production Automation interface manifest, published\n * by `@openhands/extensions/automations` as `AUTOMATION_INTERFACE`.\n \n The catalog states what varies per automation; this states the domain-level\n * facts of the interface itself. As with setup entries, the published data is\n * validated at admission rather than trusted, and a package that predates the\n * manifest simply leaves the host on its own defaults.\n /\n\nexport const INTERFACE_VERSION = \"1.0\";\n\n/* The closed set of runtime-model properties a client may offer for setting. /\nexport type AutomationAttributeName =\n \| \"name\"\n \| \"prompt\"\n \| \"model\"\n \| \"timeout\"\n \| \"schedule\";\n\nexport type InterfaceAttributeType =\n \| \"text\"\n \| \"textarea\"\n \| \"number\"\n \| \"llm-profile\"\n \| \"schedule\";\n\n/* How one settable attribute of an existing Automation is offered. /\nexport interface InterfaceAttribute {\n type: InterfaceAttributeType;\n label: string;\n help?: string;\n required: boolean;\n /* Only a `number` attribute carries constraints. /\n constraints?: { min?: number; max?: number };\n}\n\nexport interface InterfaceRoutes {\n list: string;\n /* Carries the `:automationId` segment the host substitutes. /\n setup: string;\n /* Carries the `:automationId` segment the host substitutes. /\n detail: string;\n /* The templates sub-page. Static: there is no parameter to substitute. /\n templates?: string;\n}\n\n/\n Service-relative paths the host calls. The base path, methods, headers, and\n * auth remain the host's. `{id}` marks where the automation id is substituted.\n /\nexport interface InterfaceEndpoints {\n list: string;\n detail: string;\n dispatch: string;\n runs: string;\n tarball: string;\n health: string;\n capabilities: string;\n validate: string;\n createPrompt: string;\n createPlugin: string;\n /\n The raw create endpoint, which a bundle entry is created through, and\n * where its tarball is uploaded first. Optional: a manifest published before\n * bundles existed declares neither, and is still admitted.\n /\n createBundle?: string;\n uploads?: string;\n}\n\nexport type InterfaceEndpointName = keyof InterfaceEndpoints;\n\nexport interface InterfaceImportExport {\n fileKind: string;\n fileVersion: number;\n filenameSuffix: string;\n importDefaults: {\n /* Provider inferred for short owner/repo repository URLs on import. /\n repoProvider: SetupGitProvider;\n /* Event source of the placeholder trigger that keeps an import inert. /\n placeholderEventSource: string;\n };\n}\n\n/\n The sub-page surface: navigation, overview tiles, filters, sort, and run\n * insights for the list page, and a templates page. Every value below names\n * something this host implements from a closed set — a metric it computes, a\n * predicate it applies, a comparator it runs, an icon it ships — and the\n * manifest picks and captions it, never defines it. The host carries no\n * definitions of its own for this surface, so a manifest without it simply\n * leaves the sub-pages unrendered.\n /\n\nexport const INTERFACE_SUB_PAGE_IDS = [\"list\", \"templates\"] as const;\n\nexport type InterfaceSubPageId = (typeof INTERFACE_SUB_PAGE_IDS)[number];\n\n/* Icon names this host maps to artwork. A manifest cannot supply its own. /\nexport const INTERFACE_ICON_SLUGS = [\n \"layout-dashboard\",\n \"sparkles\",\n \"library\",\n \"bot\",\n \"circle-alert\",\n \"activity\",\n \"timer\",\n] as const;\n\nexport type InterfaceIconSlug = (typeof INTERFACE_ICON_SLUGS)[number];\n\nexport interface InterfaceSubPageNavItem {\n /* The `pages` entry this item navigates to; its route comes from `routes`. /\n page: InterfaceSubPageId;\n label: string;\n icon: InterfaceIconSlug;\n}\n\n/* Values this host computes over the loaded automations and their runs. /\nexport const OVERVIEW_METRICS = [\n \"automations\",\n \"needs-attention\",\n \"total-runs\",\n \"average-duration\",\n] as const;\n\nexport type OverviewMetric = (typeof OVERVIEW_METRICS)[number];\n\n/\n Placeholder names a tile's `detail`/`zeroDetail` copy may reference inside\n * `{{...}}`, per metric. Plain substitution, like setup copy.\n /\nexport const OVERVIEW_TILE_PLACEHOLDERS: Record<\n OverviewMetric,\n readonly string[]\n> = {\n automations: [\"active\"],\n \"needs-attention\": [],\n \"total-runs\": [],\n \"average-duration\": [],\n};\n\nexport interface InterfaceOverviewTile {\n metric: OverviewMetric;\n label: string;\n /* Caption under the value. /\n detail: string;\n /* Replaces `detail` while the metric's value is zero. /\n zeroDetail?: string;\n icon: InterfaceIconSlug;\n}\n\nexport interface InterfaceOverview {\n /* Names the tiles section for assistive technology. /\n label: string;\n tiles: InterfaceOverviewTile[];\n}\n\n/* Filter values name predicates this host implements, per filter id. /\nexport const DASHBOARD_FILTER_VALUES = {\n status: [\"all\", \"active\", \"failing\", \"disabled\"],\n trigger: [\"all\", \"schedule\", \"event\"],\n} as const;\n\nexport type DashboardFilterId = keyof typeof DASHBOARD_FILTER_VALUES;\n\nexport const DASHBOARD_FILTER_IDS = Object.keys(\n DASHBOARD_FILTER_VALUES,\n) as readonly DashboardFilterId[];\n\nexport type DashboardStatusValue =\n (typeof DASHBOARD_FILTER_VALUES.status)[number];\n\nexport type DashboardTriggerValue =\n (typeof DASHBOARD_FILTER_VALUES.trigger)[number];\n\nexport interface InterfaceStatusFilter {\n id: \"status\";\n /* The control's accessible name. /\n label: string;\n options: { value: DashboardStatusValue; label: string }[];\n}\n\nexport interface InterfaceTriggerFilter {\n id: \"trigger\";\n /* The control's accessible name. /\n label: string;\n options: { value: DashboardTriggerValue; label: string }[];\n}\n\nexport type InterfaceDashboardFilter =\n \| InterfaceStatusFilter\n \| InterfaceTriggerFilter;\n\n/* Sort values name comparators this host implements. /\nexport const DASHBOARD_SORT_VALUES = [\"last-run\", \"runs\", \"name\"] as const;\n\nexport type DashboardSortValue = (typeof DASHBOARD_SORT_VALUES)[number];\n\nexport interface InterfaceDashboardSort {\n /* The control's accessible name. /\n label: string;\n options: { value: DashboardSortValue; label: string }[];\n /* One of the declared option values. /\n default: DashboardSortValue;\n}\n\n/\n Copy for the per-automation run insights on cards and rows. The states,\n * precedence, sampling, and value formatting are this host's; the manifest\n * names them.\n /\nexport interface InterfaceListInsights {\n health: {\n healthy: string;\n failing: string;\n running: string;\n disabled: string;\n neverRun: string;\n checking: string;\n };\n lastRun: { label: string; never: string; justNow: string };\n stats: { runs: string; recentSuccess: string; averageDuration: string };\n}\n\n/\n The templates sub-page identity. Its body — the catalog cards and their\n * launch behavior — is this host's existing catalog surface.\n /\nexport interface InterfaceTemplatesPage {\n title: string;\n description: string;\n}\n\nexport interface InterfaceManifest {\n version: typeof INTERFACE_VERSION;\n routes: InterfaceRoutes;\n navigation: {\n sidebar: { label: string };\n commandMenu: { title: string; description: string; keywords: string };\n /* The ordered sub-page navigation of the interface. /\n subPages?: InterfaceSubPageNavItem[];\n };\n pages: {\n list: {\n title: string;\n subtitle: string;\n overview?: InterfaceOverview;\n /* The filter dropdowns of the list page, in render order. /\n filters?: InterfaceDashboardFilter[];\n sort?: InterfaceDashboardSort;\n insights?: InterfaceListInsights;\n };\n detail: { backLabel: string };\n edit: { title: string };\n templates?: InterfaceTemplatesPage;\n };\n docsUrl: string;\n /\n The input surface of an existing Automation, keyed by the runtime-model\n * property the host sends. Rendering it as an edit dialog is this host's\n * choice, not stated here.\n */\n attributes: Partial<Record<AutomationAttributeName, InterfaceAttribute>>;\n importExport: InterfaceImportExport;\n endpoints: InterfaceEndpoints;\n featuredAutomationIds: string[];\n responderIntegrationIds: string[];\n}\n"],"mappings":"6CAmCA,IAAa,EAA+B,CAAC,OAAQ,YAAY,EA8DpD,EAAyB,cA2QzB,EAAyB,CAAC,OAAQ,WAAW,EAK7C,EAAuB,CAClC,mBACA,WACA,UACA,MACA,eACA,WACA,OACF,EAYa,EAAmB,CAC9B,cACA,kBACA,aACA,kBACF,EAQa,EAGT,CACF,YAAa,CAAC,QAAQ,EACtB,kBAAmB,CAAC,EACpB,aAAc,CAAC,EACf,mBAAoB,CAAC,CACvB,EAmBa,EAA0B,CACrC,OAAQ,CAAC,MAAO,SAAU,UAAW,UAAU,EAC/C,QAAS,CAAC,MAAO,WAAY,OAAO,CACtC,EAIa,EAAuB,OAAO,KACzC,CACF,EA2Ba,EAAwB,CAAC,WAAY,OAAQ,MAAM"}

package/dist/manifests/types.d.ts CHANGED Viewed

@@ -11,7 +11,7 @@
  */
 export declare const SETUP_VERSION = "1.0";
 export type SetupMode = "direct" | "assisted";
-export type SetupFieldType = "text" | "textarea" | "select" | "cron" | "timezone" | "repo-picker";
+export type SetupFieldType = "text" | "textarea" | "select" | "number" | "cron" | "timezone" | "repo-picker" | "llm-profile" | "event-source" | "event-type" | "plugin-sources" | "tarball-upload";
 export type SetupGitProvider = "github" | "gitlab" | "bitbucket";
 export type SetupTriggerKind = "cron" | "event";
 /** Placeholder namespaces a setup block may reference inside `{{...}}`. */
@@ -23,6 +23,8 @@ export interface SetupFieldOption {
 export interface SetupFieldConstraints {
     minLength?: number;
     maxLength?: number;
+    min?: number;
+    max?: number;
     /**
      * A host-implemented check named from a closed set. Entries supply no regex
      * of their own, so they cannot hand the host a pathological pattern.
@@ -34,7 +36,7 @@ export interface SetupFormField {
     label: string;
     help: string;
     placeholder?: string;
-    default?: string;
+    default?: string | number | boolean | null;
     required: boolean;
     provider?: SetupGitProvider;
     /**
@@ -50,7 +52,7 @@ export interface SetupFormField {
 export type SetupFormFields = Record<string, SetupFormField>;
 export interface SetupForm {
     note?: string;
-    /** Inputs that decide when the automation runs, keyed by trigger kind. */
+    /** Inputs that decide when the automation runs, keyed by trigger kind. Multiple keys are selectable variants. */
     triggers?: Partial<Record<SetupTriggerKind, SetupFormFields>>;
     /** Every other input: the arguments to the automation itself. */
     args: SetupFormFields;
@@ -87,6 +89,37 @@ export interface SetupBundle {
     /** Rendered from the form and packed as config.json. */
     config: Record<string, SetupBundleConfigValue>;
 }
+export type SetupActionKind = "prompt" | "plugin" | "upload";
+export interface SetupPromptAction {
+    label: string;
+    help: string;
+    features: string[];
+    args: SetupFormFields;
+    prompt: string;
+}
+export interface SetupPluginAction {
+    label: string;
+    help: string;
+    features: string[];
+    args: SetupFormFields;
+    prompt: string;
+    plugins: string;
+}
+export interface SetupUploadAction {
+    label: string;
+    help: string;
+    features: string[];
+    args: SetupFormFields;
+    tarballPath: string;
+    entrypoint: string;
+    setupScript?: string;
+}
+export interface SetupActions {
+    prompt?: SetupPromptAction;
+    plugin?: SetupPluginAction;
+    upload?: SetupUploadAction;
+}
+export type SetupAction = SetupPromptAction | SetupPluginAction | SetupUploadAction;
 export interface SetupBlock {
     version: typeof SETUP_VERSION;
     mode: SetupMode;
@@ -95,6 +128,8 @@ export interface SetupBlock {
     prompt?: string;
     /** direct only, and the alternative to `prompt`. Exactly one is present. */
     bundle?: SetupBundle;
+    /** direct only, and the alternative to `prompt` or `bundle`. */
+    actions?: SetupActions;
     /** direct only, event trigger only. Which delivered events belong to it. */
     filter?: string;
     /**
@@ -149,7 +184,7 @@ export interface SetupRequestBody {
  * string, including fields whose value is a number to the service - the
  * payload mapping is where a value stops being what was typed.
  */
-export type SetupFormValue = string | string[];
+export type SetupFormValue = string | number | boolean | null | string[] | File;
 export type SetupFormValues = Record<string, SetupFormValue>;
 /** `GET /v1/capabilities` — what this deployment supports. */
 export interface DeploymentCapabilities {