@openhands/agent-canvas 1.8.0 → 1.9.0

package/dist/manifests/automation-interface.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The automation interface seam.
+ *
+ * Every automation-specific datum the host's surfaces render — routes,
+ * navigation and page copy, the settable attributes, the import/export
+ * envelope, endpoint paths, the featured and responder id lists — is served
+ * from here.
+ * The published interface manifest supplies it when the pinned
+ * `@openhands/extensions` ships one and it passes admission; otherwise the
+ * host's own defaults do, which reproduce today's behavior exactly. Copy
+ * defaults are null, meaning "render the host's own translation".
+ */
+import type { AutomationAttributeName, InterfaceEndpointName, InterfaceImportExport } from "./types";
+export interface AttributeSpec {
+    present: boolean;
+    /** Null means "render the host's own translation". */
+    label: string | null;
+    help: string | null;
+    required: boolean;
+    min: number | null;
+    max: number | null;
+}
+export declare function automationListPath(): string;
+export declare function automationSetupPath(id: string): string;
+export declare function automationDetailPath(id: string): string;
+export declare function getAutomationEndpoint(name: InterfaceEndpointName): string;
+/** An id-parameterized endpoint with `{id}` substituted, encoded. */
+export declare function getAutomationIdEndpoint(name: "detail" | "dispatch" | "runs" | "tarball", id: string): string;
+export interface InterfaceCopy {
+    sidebarLabel: string | null;
+    commandMenuTitle: string | null;
+    commandMenuDescription: string | null;
+    commandMenuKeywords: string | null;
+    listTitle: string | null;
+    listSubtitle: string | null;
+    detailBackLabel: string | null;
+    editTitle: string | null;
+}
+export declare function getInterfaceCopy(): InterfaceCopy;
+export declare function getAttributeSpec(name: AutomationAttributeName): AttributeSpec;
+export declare function getImportExportSpec(): InterfaceImportExport;
+export declare function getAutomationsDocsUrl(): string;
+export declare function getFeaturedAutomationIds(): readonly string[];
+export declare function getResponderIntegrationIds(): readonly string[];

package/dist/manifests/automation-interface.js

@@ -0,0 +1,81 @@
+import e from "../node_modules/@openhands/extensions/automations/index.js";
+import { validateInterfaceManifest as t } from "./interface-validation.js";
+import { AUTOMATION_INTERFACE_CANDIDATE as n } from "./manifest-sources.js";
+//#region src/manifests/automation-interface.ts
+var r = {
+	list: "/automations",
+	setup: "/automations/new/:automationId",
+	detail: "/automations/:automationId"
+}, i = {
+	list: "/v1",
+	detail: "/v1/{id}",
+	dispatch: "/v1/{id}/dispatch",
+	runs: "/v1/{id}/runs",
+	tarball: "/v1/{id}/tarball",
+	health: "/health",
+	capabilities: "/v1/capabilities",
+	validate: "/v1/validate",
+	createPrompt: "/v1/preset/prompt",
+	createPlugin: "/v1/preset/plugin"
+}, a = {
+	fileKind: "automation",
+	fileVersion: 1,
+	filenameSuffix: ".automation.json",
+	importDefaults: {
+		repoProvider: "github",
+		placeholderEventSource: "agent-canvas-import"
+	}
+};
+function o(e) {
+	return typeof e == "object" && !!e && !Array.isArray(e);
+}
+function s() {
+	return new Set(e.flatMap((e) => o(e) && typeof e.id == "string" ? [e.id] : []));
+}
+function c(e) {
+	if (e === void 0) return null;
+	let n = t(e, {
+		catalogIds: s(),
+		mountedRoutes: r
+	});
+	return n.valid ? e : (console.warn("Rejected the automation interface manifest:", n.errors.join("; ")), null);
+}
+var l = c(n);
+function u() {
+	return (l?.routes ?? r).list;
+}
+function d(e) {
+	return (l?.endpoints ?? i)[e];
+}
+function f(e, t) {
+	return d(e).replace("{id}", encodeURIComponent(t));
+}
+var p = {
+	sidebarLabel: null,
+	commandMenuTitle: null,
+	commandMenuDescription: null,
+	commandMenuKeywords: null,
+	listTitle: null,
+	listSubtitle: null,
+	detailBackLabel: null,
+	editTitle: null
+};
+function m() {
+	return l ? {
+		sidebarLabel: l.navigation.sidebar.label,
+		commandMenuTitle: l.navigation.commandMenu.title,
+		commandMenuDescription: l.navigation.commandMenu.description,
+		commandMenuKeywords: l.navigation.commandMenu.keywords,
+		listTitle: l.pages.list.title,
+		listSubtitle: l.pages.list.subtitle,
+		detailBackLabel: l.pages.detail.backLabel,
+		editTitle: l.pages.edit.title
+	} : p;
+}
+function h() {
+	return l?.importExport ?? a;
+}
+//#endregion
+export { u as automationListPath, d as getAutomationEndpoint, f as getAutomationIdEndpoint, h as getImportExportSpec, m as getInterfaceCopy };
+
+//# sourceMappingURL=automation-interface.js.map

package/dist/manifests/automation-interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"automation-interface.js","names":[],"sources":["../../src/manifests/automation-interface.ts"],"sourcesContent":["/**\n * The automation interface seam.\n *\n * Every automation-specific datum the host's surfaces render — routes,\n * navigation and page copy, the settable attributes, the import/export\n * envelope, endpoint paths, the featured and responder id lists — is served\n * from here.\n * The published interface manifest supplies it when the pinned\n * `@openhands/extensions` ships one and it passes admission; otherwise the\n * host's own defaults do, which reproduce today's behavior exactly. Copy\n * defaults are null, meaning \"render the host's own translation\".\n */\n\nimport { AUTOMATION_CATALOG } from \"@openhands/extensions/automations\";\nimport { AUTOMATION_TIMEOUT_MAX_SECONDS } from \"#/utils/automation-timeout\";\nimport { validateInterfaceManifest } from \"./interface-validation\";\nimport { AUTOMATION_INTERFACE_CANDIDATE } from \"./manifest-sources\";\nimport type {\n  AutomationAttributeName,\n  InterfaceEndpointName,\n  InterfaceImportExport,\n  InterfaceManifest,\n  InterfaceRoutes,\n} from \"./types\";\n\n/** The routes this host has registrations for, in `src/routes.ts`. */\nconst MOUNTED_ROUTES: InterfaceRoutes = {\n  list: \"/automations\",\n  setup: \"/automations/new/:automationId\",\n  detail: \"/automations/:automationId\",\n};\n\nconst DEFAULT_ENDPOINTS: InterfaceManifest[\"endpoints\"] = {\n  list: \"/v1\",\n  detail: \"/v1/{id}\",\n  dispatch: \"/v1/{id}/dispatch\",\n  runs: \"/v1/{id}/runs\",\n  tarball: \"/v1/{id}/tarball\",\n  health: \"/health\",\n  capabilities: \"/v1/capabilities\",\n  validate: \"/v1/validate\",\n  createPrompt: \"/v1/preset/prompt\",\n  createPlugin: \"/v1/preset/plugin\",\n};\n\nconst DEFAULT_IMPORT_EXPORT: InterfaceImportExport = {\n  fileKind: \"automation\",\n  fileVersion: 1,\n  filenameSuffix: \".automation.json\",\n  importDefaults: {\n    repoProvider: \"github\",\n    placeholderEventSource: \"agent-canvas-import\",\n  },\n};\n\nconst DEFAULT_DOCS_URL =\n  \"https://docs.openhands.dev/openhands/usage/automations/overview\";\n\n/**\n * Proven automations featured above the Beta group. NOT derived from\n * popularityRank (slack-standup-digest@94 outranks slack-channel-monitor@92\n * yet is Beta).\n */\nconst DEFAULT_FEATURED_AUTOMATION_IDS: readonly string[] = [\n  \"github-pr-reviewer\",\n  \"github-repo-monitor\",\n  \"slack-channel-monitor\",\n];\n\n/**\n * Integrations whose automations are treated as event responders that poll\n * continuously, and so get the deployment-choice dialog.\n */\nconst DEFAULT_RESPONDER_INTEGRATION_IDS: readonly string[] = [\n  \"github\",\n  \"slack\",\n];\n\nexport interface AttributeSpec {\n  present: boolean;\n  /** Null means \"render the host's own translation\". */\n  label: string | null;\n  help: string | null;\n  required: boolean;\n  min: number | null;\n  max: number | null;\n}\n\nconst ABSENT_ATTRIBUTE: AttributeSpec = {\n  present: false,\n  label: null,\n  help: null,\n  required: false,\n  min: null,\n  max: null,\n};\n\n/** Today's edit dialog, restated as specs so absence of a manifest changes nothing. */\nconst DEFAULT_ATTRIBUTES: Record<AutomationAttributeName, AttributeSpec> = {\n  name: {\n    present: true,\n    label: null,\n    help: null,\n    required: true,\n    min: null,\n    max: null,\n  },\n  prompt: {\n    present: true,\n    label: null,\n    help: null,\n    required: false,\n    min: null,\n    max: null,\n  },\n  model: {\n    present: true,\n    label: null,\n    help: null,\n    required: false,\n    min: null,\n    max: null,\n  },\n  timeout: {\n    present: true,\n    label: null,\n    help: null,\n    required: false,\n    min: 1,\n    max: AUTOMATION_TIMEOUT_MAX_SECONDS,\n  },\n  schedule: {\n    present: true,\n    label: null,\n    help: null,\n    required: false,\n    min: null,\n    max: null,\n  },\n};\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getCatalogIds(): ReadonlySet<string> {\n  return new Set(\n    (AUTOMATION_CATALOG as readonly unknown[]).flatMap((entry) =>\n      isRecord(entry) && typeof entry.id === \"string\" ? [entry.id] : [],\n    ),\n  );\n}\n\nfunction admitInterfaceManifest(candidate: unknown): InterfaceManifest | null {\n  if (candidate === undefined) return null;\n\n  const result = validateInterfaceManifest(candidate, {\n    catalogIds: getCatalogIds(),\n    mountedRoutes: MOUNTED_ROUTES,\n  });\n  if (!result.valid) {\n    // Mirrors the setup registry: a rejected manifest is skipped loudly, and\n    // the host's defaults stand.\n    console.warn(\n      \"Rejected the automation interface manifest:\",\n      result.errors.join(\"; \"),\n    );\n    return null;\n  }\n  return candidate as InterfaceManifest;\n}\n\nconst ADMITTED = admitInterfaceManifest(AUTOMATION_INTERFACE_CANDIDATE);\n\nfunction substituteRouteParam(pattern: string, id: string): string {\n  return pattern.replace(\":automationId\", encodeURIComponent(id));\n}\n\nexport function automationListPath(): string {\n  return (ADMITTED?.routes ?? MOUNTED_ROUTES).list;\n}\n\nexport function automationSetupPath(id: string): string {\n  return substituteRouteParam((ADMITTED?.routes ?? MOUNTED_ROUTES).setup, id);\n}\n\nexport function automationDetailPath(id: string): string {\n  return substituteRouteParam((ADMITTED?.routes ?? MOUNTED_ROUTES).detail, id);\n}\n\nexport function getAutomationEndpoint(name: InterfaceEndpointName): string {\n  return (ADMITTED?.endpoints ?? DEFAULT_ENDPOINTS)[name];\n}\n\n/** An id-parameterized endpoint with `{id}` substituted, encoded. */\nexport function getAutomationIdEndpoint(\n  name: \"detail\" | \"dispatch\" | \"runs\" | \"tarball\",\n  id: string,\n): string {\n  return getAutomationEndpoint(name).replace(\"{id}\", encodeURIComponent(id));\n}\n\nexport interface InterfaceCopy {\n  sidebarLabel: string | null;\n  commandMenuTitle: string | null;\n  commandMenuDescription: string | null;\n  commandMenuKeywords: string | null;\n  listTitle: string | null;\n  listSubtitle: string | null;\n  detailBackLabel: string | null;\n  editTitle: string | null;\n}\n\nconst HOST_COPY: InterfaceCopy = {\n  sidebarLabel: null,\n  commandMenuTitle: null,\n  commandMenuDescription: null,\n  commandMenuKeywords: null,\n  listTitle: null,\n  listSubtitle: null,\n  detailBackLabel: null,\n  editTitle: null,\n};\n\nexport function getInterfaceCopy(): InterfaceCopy {\n  if (!ADMITTED) return HOST_COPY;\n  return {\n    sidebarLabel: ADMITTED.navigation.sidebar.label,\n    commandMenuTitle: ADMITTED.navigation.commandMenu.title,\n    commandMenuDescription: ADMITTED.navigation.commandMenu.description,\n    commandMenuKeywords: ADMITTED.navigation.commandMenu.keywords,\n    listTitle: ADMITTED.pages.list.title,\n    listSubtitle: ADMITTED.pages.list.subtitle,\n    detailBackLabel: ADMITTED.pages.detail.backLabel,\n    editTitle: ADMITTED.pages.edit.title,\n  };\n}\n\nexport function getAttributeSpec(name: AutomationAttributeName): AttributeSpec {\n  if (!ADMITTED) return DEFAULT_ATTRIBUTES[name];\n\n  const attribute = ADMITTED.attributes[name];\n  if (!attribute) return ABSENT_ATTRIBUTE;\n  return {\n    present: true,\n    label: attribute.label,\n    help: attribute.help ?? null,\n    required: attribute.required,\n    min: attribute.constraints?.min ?? null,\n    max: attribute.constraints?.max ?? null,\n  };\n}\n\nexport function getImportExportSpec(): InterfaceImportExport {\n  return ADMITTED?.importExport ?? DEFAULT_IMPORT_EXPORT;\n}\n\nexport function getAutomationsDocsUrl(): string {\n  return ADMITTED?.docsUrl ?? DEFAULT_DOCS_URL;\n}\n\nexport function getFeaturedAutomationIds(): readonly string[] {\n  return ADMITTED?.featuredAutomationIds ?? DEFAULT_FEATURED_AUTOMATION_IDS;\n}\n\nexport function getResponderIntegrationIds(): readonly string[] {\n  return ADMITTED?.responderIntegrationIds ?? DEFAULT_RESPONDER_INTEGRATION_IDS;\n}\n"],"mappings":";;;;AA0BA,IAAM,IAAkC;CACtC,MAAM;CACN,OAAO;CACP,QAAQ;AACV,GAEM,IAAoD;CACxD,MAAM;CACN,QAAQ;CACR,UAAU;CACV,MAAM;CACN,SAAS;CACT,QAAQ;CACR,cAAc;CACd,UAAU;CACV,cAAc;CACd,cAAc;AAChB,GAEM,IAA+C;CACnD,UAAU;CACV,aAAa;CACb,gBAAgB;CAChB,gBAAgB;EACd,cAAc;EACd,wBAAwB;CAC1B;AACF;AAwFA,SAAS,EAAS,GAAkD;CAClE,OAAO,OAAO,KAAU,cAAY,KAAkB,CAAC,MAAM,QAAQ,CAAK;AAC5E;AAEA,SAAS,IAAqC;CAC5C,OAAO,IAAI,IACR,EAA0C,SAAS,MAClD,EAAS,CAAK,KAAK,OAAO,EAAM,MAAO,WAAW,CAAC,EAAM,EAAE,IAAI,CAAC,CAClE,CACF;AACF;AAEA,SAAS,EAAuB,GAA8C;CAC5E,IAAI,MAAc,KAAA,GAAW,OAAO;CAEpC,IAAM,IAAS,EAA0B,GAAW;EAClD,YAAY,EAAc;EAC1B,eAAe;CACjB,CAAC;CAUD,OATK,EAAO,QASL,KANL,QAAQ,KACN,+CACA,EAAO,OAAO,KAAK,IAAI,CACzB,GACO;AAGX;AAEA,IAAM,IAAW,EAAuB,CAA8B;AAMtE,SAAgB,IAA6B;CAC3C,QAAQ,GAAU,UAAU,GAAgB;AAC9C;AAUA,SAAgB,EAAsB,GAAqC;CACzE,QAAQ,GAAU,aAAa,GAAmB;AACpD;AAGA,SAAgB,EACd,GACA,GACQ;CACR,OAAO,EAAsB,CAAI,EAAE,QAAQ,QAAQ,mBAAmB,CAAE,CAAC;AAC3E;AAaA,IAAM,IAA2B;CAC/B,cAAc;CACd,kBAAkB;CAClB,wBAAwB;CACxB,qBAAqB;CACrB,WAAW;CACX,cAAc;CACd,iBAAiB;CACjB,WAAW;AACb;AAEA,SAAgB,IAAkC;CAEhD,OADK,IACE;EACL,cAAc,EAAS,WAAW,QAAQ;EAC1C,kBAAkB,EAAS,WAAW,YAAY;EAClD,wBAAwB,EAAS,WAAW,YAAY;EACxD,qBAAqB,EAAS,WAAW,YAAY;EACrD,WAAW,EAAS,MAAM,KAAK;EAC/B,cAAc,EAAS,MAAM,KAAK;EAClC,iBAAiB,EAAS,MAAM,OAAO;EACvC,WAAW,EAAS,MAAM,KAAK;CACjC,IAVsB;AAWxB;AAiBA,SAAgB,IAA6C;CAC3D,OAAO,GAAU,gBAAgB;AACnC"}

package/dist/manifests/automation-setup.cjs

@@ -0,0 +1,2 @@
+require("../_virtual/_rolldown/runtime.cjs"),require("../utils/automation-catalog.cjs");var e=require("./automation-interface.cjs").getAutomationEndpoint(`createPrompt`);exports.AUTOMATION_CREATE_ENDPOINT=e;
+//# sourceMappingURL=automation-setup.cjs.map

package/dist/manifests/automation-setup.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"automation-setup.cjs","names":[],"sources":["../../src/manifests/automation-setup.ts"],"sourcesContent":["/**\n * The only module that knows a setup entry configures an *automation*.\n *\n * The published contract states just what varies between entries; everything\n * derivable is the host's to generate. That derivation is here, and nowhere\n * else, so the rest of `src/manifests/` stays about forms rather than about\n * automations.\n *\n * The algorithm mirrors `tests/test_automation_setup.py::_render_payload` in\n * `OpenHands/extensions`, which is the authoritative reference: it produces the\n * request bodies published in that repository's contract fixtures, and those\n * were verified against the live service. The create model is `extra=\"forbid\"`,\n * so any divergence is a hard 422 rather than a dropped field.\n */\n\nimport { findAutomationCommand } from \"#/utils/automation-catalog\";\nimport { getAutomationEndpoint } from \"./automation-interface\";\nimport { collectFields } from \"./manifest-local-validation\";\nimport { interpolateText } from \"./manifest-template\";\nimport type {\n  SetupBlock,\n  SetupEntry,\n  SetupFormValues,\n  SetupRequestBody,\n  SetupTriggerKind,\n} from \"./types\";\n\n/** The creation endpoint a derived draft would be posted to. */\nexport const AUTOMATION_CREATE_ENDPOINT = getAutomationEndpoint(\"createPrompt\");\n\n/**\n * Trigger properties a form field may fill, per trigger kind. A field under a\n * trigger kind whose name is listed here fills the trigger property of the same\n * name; anything else there, such as a phrase to match, is an input to `filter`.\n */\nconst TRIGGER_PROPERTIES: Record<SetupTriggerKind, readonly string[]> = {\n  cron: [\"schedule\", \"timezone\"],\n  event: [\"on\"],\n};\n\n/**\n * Repository properties a form field may fill, read the same way\n * {@link TRIGGER_PROPERTIES} is: a field whose name is listed here fills the\n * `repos[]` property of the same name. `url` and `provider` are absent because\n * neither is answered by a field of its own — they come from the repo-picker's\n * value and from its declared provider.\n *\n * These two lists are the only field names the derivation knows; everything\n * else it reads it finds by field type. An entry that wants a base branch in\n * its request therefore has to name that field `ref`.\n */\nconst REPO_PROPERTIES: readonly string[] = [\"ref\"];\n\nconst FORM_PLACEHOLDER_PATTERN = /\\{\\{form\\.([A-Za-z0-9_.]+)\\}\\}/g;\n\n/** The repository input, which supplies `repos` and an event trigger's source. */\nfunction findRepoPickerField(setup: SetupBlock) {\n  const match = Object.entries(collectFields(setup)).find(\n    ([, field]) => field.type === \"repo-picker\",\n  );\n  return match ? { name: match[0], field: match[1] } : null;\n}\n\n/** The single trigger kind a direct entry declares, with its fields. */\nfunction getTrigger(setup: SetupBlock) {\n  const entries = Object.entries(setup.form.triggers ?? {});\n  if (entries.length === 0) return null;\n  const [kind, fields] = entries[0];\n  return { kind: kind as SetupTriggerKind, fields: fields ?? {} };\n}\n\n/**\n * The create request body these form values produce.\n *\n * No entry declares it: `name` comes from the entry, `repos` from the\n * repo-picker field and its declared provider, and `trigger` from the key and\n * fields under `form.triggers`. Only `prompt` and an event `filter` are\n * declared, because only they cannot be read off the form.\n *\n * Returns null for an assisted entry, which hands setup to a conversation\n * instead of sending a body.\n */\nexport function buildCreatePayload(\n  entry: SetupEntry,\n  values: SetupFormValues,\n): SetupRequestBody | null {\n  const { setup } = entry;\n  if (setup.mode !== \"direct\" || !setup.prompt) return null;\n\n  const scope = { form: values, automation: entry };\n  const repoPicker = findRepoPickerField(setup);\n  const repository = repoPicker ? values[repoPicker.name] : undefined;\n\n  const payload: SetupRequestBody = {\n    name: repository ? `${entry.name} - ${repository}` : entry.name,\n    prompt: interpolateText(setup.prompt, scope),\n  };\n\n  if (repository && repoPicker?.field.provider) {\n    const declared = REPO_PROPERTIES.filter((name) => name in values);\n    payload.repos = [\n      {\n        url: repository,\n        ...Object.fromEntries(declared.map((name) => [name, values[name]])),\n        provider: repoPicker.field.provider,\n      },\n    ];\n  }\n\n  const trigger = getTrigger(setup);\n  if (trigger) {\n    const properties = TRIGGER_PROPERTIES[trigger.kind];\n    const declared = Object.keys(trigger.fields).filter((name) =>\n      properties.includes(name),\n    );\n\n    payload.trigger = {\n      type: trigger.kind,\n      ...Object.fromEntries(declared.map((name) => [name, values[name] ?? \"\"])),\n      ...(trigger.kind === \"event\" && {\n        source: repoPicker?.field.provider ?? \"\",\n        // A filter is optional: an entry that declares none accepts every\n        // delivered event, so the key is left off rather than sent empty.\n        ...(setup.filter && { filter: interpolateText(setup.filter, scope) }),\n      }),\n    };\n  }\n\n  return payload;\n}\n\n/**\n * The preflight body the host sends. The same shape for every entry, so no\n * entry declares it.\n */\nexport function buildPreflightBody(\n  entry: SetupEntry,\n  values: SetupFormValues,\n): SetupRequestBody | null {\n  const draft = buildCreatePayload(entry, values);\n  if (!draft) return null;\n\n  return {\n    automationId: entry.id,\n    endpoint: AUTOMATION_CREATE_ENDPOINT,\n    draft,\n  };\n}\n\n/**\n * What an assisted entry sends into the conversation that finishes setup.\n *\n * The command is not declared either: it lives once, in the owning skill's own\n * `triggers` frontmatter, and the skill defaults to the entry's id. An entry\n * whose skill is invoked by description rather than by command contributes\n * nothing here, and the answers alone open the conversation.\n */\nexport function buildAssistedMessage(\n  entry: SetupEntry,\n  values: SetupFormValues,\n): string {\n  const command = findAutomationCommand(entry);\n  const message = entry.setup.message\n    ? interpolateText(entry.setup.message, { form: values, automation: entry })\n    : \"\";\n\n  return [command, message].filter(Boolean).join(\"\\n\\n\");\n}\n\nfunction collectPlaceholderFields(value: string): string[] {\n  const names = Array.from(\n    value.matchAll(FORM_PLACEHOLDER_PATTERN),\n    (match) => match[1],\n  );\n  return Array.from(new Set(names));\n}\n\n/**\n * Which form fields built each payload path.\n *\n * Preflight and the create endpoint reject a draft by payload path, and the\n * host has to turn that back into a highlighted input. Building the body with\n * each field standing in for its own value recovers the mapping exactly, so an\n * entry does not declare it.\n */\nexport function deriveErrorMap(entry: SetupEntry): Record<string, string[]> {\n  const mapping: Record<string, string[]> = {};\n\n  const standIns = Object.fromEntries(\n    Object.keys(collectFields(entry.setup)).map((name) => [\n      name,\n      `{{form.${name}}}`,\n    ]),\n  );\n  const template = buildCreatePayload(entry, standIns);\n  if (!template) return mapping;\n\n  const walk = (node: unknown, path: string): void => {\n    if (Array.isArray(node)) {\n      node.forEach((item, index) => walk(item, `${path}[${index}]`));\n      return;\n    }\n    if (typeof node === \"object\" && node !== null) {\n      Object.entries(node).forEach(([key, item]) =>\n        walk(item, path ? `${path}.${key}` : key),\n      );\n      return;\n    }\n    if (typeof node === \"string\") {\n      const names = collectPlaceholderFields(node);\n      if (names.length > 0) mapping[path] = names;\n    }\n  };\n\n  walk(template, \"\");\n  return mapping;\n}\n"],"mappings":"wFA4BA,IAAa,sCAA6B,EAAA,sBAAsB,cAAc"}

package/dist/manifests/automation-setup.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The only module that knows a setup entry configures an *automation*.
+ *
+ * The published contract states just what varies between entries; everything
+ * derivable is the host's to generate. That derivation is here, and nowhere
+ * else, so the rest of `src/manifests/` stays about forms rather than about
+ * automations.
+ *
+ * The algorithm mirrors `tests/test_automation_setup.py::_render_payload` in
+ * `OpenHands/extensions`, which is the authoritative reference: it produces the
+ * request bodies published in that repository's contract fixtures, and those
+ * were verified against the live service. The create model is `extra="forbid"`,
+ * so any divergence is a hard 422 rather than a dropped field.
+ */
+import type { SetupEntry, SetupFormValues, SetupRequestBody } from "./types";
+/** The creation endpoint a derived draft would be posted to. */
+export declare const AUTOMATION_CREATE_ENDPOINT: string;
+/**
+ * The create request body these form values produce.
+ *
+ * No entry declares it: `name` comes from the entry, `repos` from the
+ * repo-picker field and its declared provider, and `trigger` from the key and
+ * fields under `form.triggers`. Only `prompt` and an event `filter` are
+ * declared, because only they cannot be read off the form.
+ *
+ * Returns null for an assisted entry, which hands setup to a conversation
+ * instead of sending a body.
+ */
+export declare function buildCreatePayload(entry: SetupEntry, values: SetupFormValues): SetupRequestBody | null;
+/**
+ * The preflight body the host sends. The same shape for every entry, so no
+ * entry declares it.
+ */
+export declare function buildPreflightBody(entry: SetupEntry, values: SetupFormValues): SetupRequestBody | null;
+/**
+ * What an assisted entry sends into the conversation that finishes setup.
+ *
+ * The command is not declared either: it lives once, in the owning skill's own
+ * `triggers` frontmatter, and the skill defaults to the entry's id. An entry
+ * whose skill is invoked by description rather than by command contributes
+ * nothing here, and the answers alone open the conversation.
+ */
+export declare function buildAssistedMessage(entry: SetupEntry, values: SetupFormValues): string;
+/**
+ * Which form fields built each payload path.
+ *
+ * Preflight and the create endpoint reject a draft by payload path, and the
+ * host has to turn that back into a highlighted input. Building the body with
+ * each field standing in for its own value recovers the mapping exactly, so an
+ * entry does not declare it.
+ */
+export declare function deriveErrorMap(entry: SetupEntry): Record<string, string[]>;

package/dist/manifests/automation-setup.js

@@ -0,0 +1,8 @@
+import "../utils/automation-catalog.js";
+import { getAutomationEndpoint as e } from "./automation-interface.js";
+//#region src/manifests/automation-setup.ts
+var t = e("createPrompt");
+//#endregion
+export { t as AUTOMATION_CREATE_ENDPOINT };
+
+//# sourceMappingURL=automation-setup.js.map

package/dist/manifests/automation-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"automation-setup.js","names":[],"sources":["../../src/manifests/automation-setup.ts"],"sourcesContent":["/**\n * The only module that knows a setup entry configures an *automation*.\n *\n * The published contract states just what varies between entries; everything\n * derivable is the host's to generate. That derivation is here, and nowhere\n * else, so the rest of `src/manifests/` stays about forms rather than about\n * automations.\n *\n * The algorithm mirrors `tests/test_automation_setup.py::_render_payload` in\n * `OpenHands/extensions`, which is the authoritative reference: it produces the\n * request bodies published in that repository's contract fixtures, and those\n * were verified against the live service. The create model is `extra=\"forbid\"`,\n * so any divergence is a hard 422 rather than a dropped field.\n */\n\nimport { findAutomationCommand } from \"#/utils/automation-catalog\";\nimport { getAutomationEndpoint } from \"./automation-interface\";\nimport { collectFields } from \"./manifest-local-validation\";\nimport { interpolateText } from \"./manifest-template\";\nimport type {\n  SetupBlock,\n  SetupEntry,\n  SetupFormValues,\n  SetupRequestBody,\n  SetupTriggerKind,\n} from \"./types\";\n\n/** The creation endpoint a derived draft would be posted to. */\nexport const AUTOMATION_CREATE_ENDPOINT = getAutomationEndpoint(\"createPrompt\");\n\n/**\n * Trigger properties a form field may fill, per trigger kind. A field under a\n * trigger kind whose name is listed here fills the trigger property of the same\n * name; anything else there, such as a phrase to match, is an input to `filter`.\n */\nconst TRIGGER_PROPERTIES: Record<SetupTriggerKind, readonly string[]> = {\n  cron: [\"schedule\", \"timezone\"],\n  event: [\"on\"],\n};\n\n/**\n * Repository properties a form field may fill, read the same way\n * {@link TRIGGER_PROPERTIES} is: a field whose name is listed here fills the\n * `repos[]` property of the same name. `url` and `provider` are absent because\n * neither is answered by a field of its own — they come from the repo-picker's\n * value and from its declared provider.\n *\n * These two lists are the only field names the derivation knows; everything\n * else it reads it finds by field type. An entry that wants a base branch in\n * its request therefore has to name that field `ref`.\n */\nconst REPO_PROPERTIES: readonly string[] = [\"ref\"];\n\nconst FORM_PLACEHOLDER_PATTERN = /\\{\\{form\\.([A-Za-z0-9_.]+)\\}\\}/g;\n\n/** The repository input, which supplies `repos` and an event trigger's source. */\nfunction findRepoPickerField(setup: SetupBlock) {\n  const match = Object.entries(collectFields(setup)).find(\n    ([, field]) => field.type === \"repo-picker\",\n  );\n  return match ? { name: match[0], field: match[1] } : null;\n}\n\n/** The single trigger kind a direct entry declares, with its fields. */\nfunction getTrigger(setup: SetupBlock) {\n  const entries = Object.entries(setup.form.triggers ?? {});\n  if (entries.length === 0) return null;\n  const [kind, fields] = entries[0];\n  return { kind: kind as SetupTriggerKind, fields: fields ?? {} };\n}\n\n/**\n * The create request body these form values produce.\n *\n * No entry declares it: `name` comes from the entry, `repos` from the\n * repo-picker field and its declared provider, and `trigger` from the key and\n * fields under `form.triggers`. Only `prompt` and an event `filter` are\n * declared, because only they cannot be read off the form.\n *\n * Returns null for an assisted entry, which hands setup to a conversation\n * instead of sending a body.\n */\nexport function buildCreatePayload(\n  entry: SetupEntry,\n  values: SetupFormValues,\n): SetupRequestBody | null {\n  const { setup } = entry;\n  if (setup.mode !== \"direct\" || !setup.prompt) return null;\n\n  const scope = { form: values, automation: entry };\n  const repoPicker = findRepoPickerField(setup);\n  const repository = repoPicker ? values[repoPicker.name] : undefined;\n\n  const payload: SetupRequestBody = {\n    name: repository ? `${entry.name} - ${repository}` : entry.name,\n    prompt: interpolateText(setup.prompt, scope),\n  };\n\n  if (repository && repoPicker?.field.provider) {\n    const declared = REPO_PROPERTIES.filter((name) => name in values);\n    payload.repos = [\n      {\n        url: repository,\n        ...Object.fromEntries(declared.map((name) => [name, values[name]])),\n        provider: repoPicker.field.provider,\n      },\n    ];\n  }\n\n  const trigger = getTrigger(setup);\n  if (trigger) {\n    const properties = TRIGGER_PROPERTIES[trigger.kind];\n    const declared = Object.keys(trigger.fields).filter((name) =>\n      properties.includes(name),\n    );\n\n    payload.trigger = {\n      type: trigger.kind,\n      ...Object.fromEntries(declared.map((name) => [name, values[name] ?? \"\"])),\n      ...(trigger.kind === \"event\" && {\n        source: repoPicker?.field.provider ?? \"\",\n        // A filter is optional: an entry that declares none accepts every\n        // delivered event, so the key is left off rather than sent empty.\n        ...(setup.filter && { filter: interpolateText(setup.filter, scope) }),\n      }),\n    };\n  }\n\n  return payload;\n}\n\n/**\n * The preflight body the host sends. The same shape for every entry, so no\n * entry declares it.\n */\nexport function buildPreflightBody(\n  entry: SetupEntry,\n  values: SetupFormValues,\n): SetupRequestBody | null {\n  const draft = buildCreatePayload(entry, values);\n  if (!draft) return null;\n\n  return {\n    automationId: entry.id,\n    endpoint: AUTOMATION_CREATE_ENDPOINT,\n    draft,\n  };\n}\n\n/**\n * What an assisted entry sends into the conversation that finishes setup.\n *\n * The command is not declared either: it lives once, in the owning skill's own\n * `triggers` frontmatter, and the skill defaults to the entry's id. An entry\n * whose skill is invoked by description rather than by command contributes\n * nothing here, and the answers alone open the conversation.\n */\nexport function buildAssistedMessage(\n  entry: SetupEntry,\n  values: SetupFormValues,\n): string {\n  const command = findAutomationCommand(entry);\n  const message = entry.setup.message\n    ? interpolateText(entry.setup.message, { form: values, automation: entry })\n    : \"\";\n\n  return [command, message].filter(Boolean).join(\"\\n\\n\");\n}\n\nfunction collectPlaceholderFields(value: string): string[] {\n  const names = Array.from(\n    value.matchAll(FORM_PLACEHOLDER_PATTERN),\n    (match) => match[1],\n  );\n  return Array.from(new Set(names));\n}\n\n/**\n * Which form fields built each payload path.\n *\n * Preflight and the create endpoint reject a draft by payload path, and the\n * host has to turn that back into a highlighted input. Building the body with\n * each field standing in for its own value recovers the mapping exactly, so an\n * entry does not declare it.\n */\nexport function deriveErrorMap(entry: SetupEntry): Record<string, string[]> {\n  const mapping: Record<string, string[]> = {};\n\n  const standIns = Object.fromEntries(\n    Object.keys(collectFields(entry.setup)).map((name) => [\n      name,\n      `{{form.${name}}}`,\n    ]),\n  );\n  const template = buildCreatePayload(entry, standIns);\n  if (!template) return mapping;\n\n  const walk = (node: unknown, path: string): void => {\n    if (Array.isArray(node)) {\n      node.forEach((item, index) => walk(item, `${path}[${index}]`));\n      return;\n    }\n    if (typeof node === \"object\" && node !== null) {\n      Object.entries(node).forEach(([key, item]) =>\n        walk(item, path ? `${path}.${key}` : key),\n      );\n      return;\n    }\n    if (typeof node === \"string\") {\n      const names = collectPlaceholderFields(node);\n      if (names.length > 0) mapping[path] = names;\n    }\n  };\n\n  walk(template, \"\");\n  return mapping;\n}\n"],"mappings":";;;AA4BA,IAAa,IAA6B,EAAsB,cAAc"}

package/dist/manifests/interface-validation.cjs

@@ -0,0 +1,2 @@
+require("../_virtual/_rolldown/runtime.cjs");var e=/<[A-Za-z/!]/,t=/^[a-z0-9]+(-[a-z0-9]+)*$/,n=`https://docs.openhands.dev/`,r=/^[a-z][a-z-]*$/,i=/^\.[a-z][a-z.]*json$/,a=/^[a-z0-9][a-z0-9.-]*$/,o=/^\/[A-Za-z0-9/{}_-]*$/,s=/^[^{}]*\{id\}[^{}]*$/,c=[`github`,`gitlab`,`bitbucket`],l={name:{type:`text`,required:!0},prompt:{type:`textarea`,required:!1},model:{type:`llm-profile`,required:!1},timeout:{type:`number`,required:!1},schedule:{type:`schedule`,required:!1}},u=Object.keys(l),d=[`list`,`health`,`capabilities`,`validate`,`createPrompt`,`createPlugin`],f=[`detail`,`dispatch`,`runs`,`tarball`];function p(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}var m=class{errors=[];fail(e,t){return this.errors.push(`${e}: ${t}`),!1}copy(t,n){return typeof t!=`string`||t.length===0?this.fail(n,`must be a non-empty string`):e.test(t)?this.fail(n,`must not contain markup`):!0}closed(e,t,n){Object.keys(e).filter(e=>!t.includes(e)).forEach(e=>this.fail(`${n}.${e}`,`is not allowed`))}record(e,t){return p(e)?!0:(this.fail(t,`must be an object`),!1)}};function h(e,t,n){e.record(t,`routes`)&&(e.closed(t,[`list`,`setup`,`detail`],`routes`),[`list`,`setup`,`detail`].forEach(r=>{t[r]!==n[r]&&e.fail(`routes.${r}`,`must be "${n[r]}"`)}))}function g(e,t){if(e.record(t,`navigation`)&&(e.closed(t,[`sidebar`,`commandMenu`],`navigation`),e.record(t.sidebar,`navigation.sidebar`)&&(e.closed(t.sidebar,[`label`],`navigation.sidebar`),e.copy(t.sidebar.label,`navigation.sidebar.label`)),e.record(t.commandMenu,`navigation.commandMenu`))){let n=t.commandMenu;e.closed(n,[`title`,`description`,`keywords`],`navigation.commandMenu`),e.copy(n.title,`navigation.commandMenu.title`),e.copy(n.description,`navigation.commandMenu.description`),e.copy(n.keywords,`navigation.commandMenu.keywords`)}}function _(e,t){e.record(t,`pages`)&&(e.closed(t,[`list`,`detail`,`edit`],`pages`),e.record(t.list,`pages.list`)&&(e.closed(t.list,[`title`,`subtitle`],`pages.list`),e.copy(t.list.title,`pages.list.title`),e.copy(t.list.subtitle,`pages.list.subtitle`)),e.record(t.detail,`pages.detail`)&&(e.closed(t.detail,[`backLabel`],`pages.detail`),e.copy(t.detail.backLabel,`pages.detail.backLabel`)),e.record(t.edit,`pages.edit`)&&(e.closed(t.edit,[`title`],`pages.edit`),e.copy(t.edit.title,`pages.edit.title`)))}function v(e,t,n,r){if(!e.record(n,r))return;e.closed(n,[`type`,`label`,`help`,`required`,`constraints`],r);let{type:i,label:a,help:o,required:s,constraints:c}=n;if(i!==t.type&&e.fail(`${r}.type`,`must be "${t.type}", the control this host renders`),e.copy(a,`${r}.label`),o!==void 0&&e.copy(o,`${r}.help`),s!==t.required&&e.fail(`${r}.required`,`must be ${t.required}, what this host enforces`),c!==void 0){if(t.type!==`number`)e.fail(`${r}.constraints`,`is only allowed on a number attribute`);else if(e.record(c,`${r}.constraints`)){e.closed(c,[`min`,`max`],`${r}.constraints`);let{min:t,max:n}=c;t!==void 0&&t!==1&&e.fail(`${r}.constraints.min`,`must be the 1 this host enforces`),n!==void 0&&(!Number.isInteger(n)||n<1)&&e.fail(`${r}.constraints.max`,`must be a positive integer`)}}}function y(e,t){if(!e.record(t,`attributes`))return;let n=Object.keys(t);n.length===0&&e.fail(`attributes`,`must declare at least one attribute`),n.forEach(n=>{if(!u.includes(n)){e.fail(`attributes.${n}`,`is not a settable attribute`);return}v(e,l[n],t[n],`attributes.${n}`)})}function b(e,t){if(!e.record(t,`importExport`))return;e.closed(t,[`fileKind`,`fileVersion`,`filenameSuffix`,`importDefaults`],`importExport`);let{fileKind:n,fileVersion:o,filenameSuffix:s,importDefaults:l}=t;(typeof n!=`string`||!r.test(n))&&e.fail(`importExport.fileKind`,`must be a lowercase slug`),o!==1&&e.fail(`importExport.fileVersion`,`must be 1`),(typeof s!=`string`||!i.test(s))&&e.fail(`importExport.filenameSuffix`,`must be a .json suffix`),e.record(l,`importExport.importDefaults`)&&(e.closed(l,[`repoProvider`,`placeholderEventSource`],`importExport.importDefaults`),(typeof l.repoProvider!=`string`||!c.includes(l.repoProvider))&&e.fail(`importExport.importDefaults.repoProvider`,`is not a supported provider`),(typeof l.placeholderEventSource!=`string`||!a.test(l.placeholderEventSource))&&e.fail(`importExport.importDefaults.placeholderEventSource`,`must be a lowercase event source`))}function x(e,t){if(!e.record(t,`endpoints`))return;let n=[...d,...f];e.closed(t,n,`endpoints`);let r=n=>{let r=t[n];return typeof r!=`string`||!o.test(r)||r.includes(`//`)?(e.fail(`endpoints.${n}`,`must be a rooted service-relative path`),null):r};d.forEach(t=>{let n=r(t);n!==null&&/[{}]/.test(n)&&e.fail(`endpoints.${t}`,`must not carry a substitution`)}),f.forEach(t=>{let n=r(t);n!==null&&!s.test(n)&&e.fail(`endpoints.${t}`,`must carry exactly one {id}`)})}function S(e,n,r){if(!Array.isArray(n)||n.length===0)return e.fail(r,`must be a non-empty array`),[];let i=n.filter(n=>typeof n==`string`&&t.test(n)?!0:(e.fail(r,`must contain only lowercase slugs`),!1));return new Set(i).size!==i.length&&e.fail(r,`must not repeat an id`),i}var C=[`version`,`routes`,`navigation`,`pages`,`docsUrl`,`attributes`,`importExport`,`endpoints`,`featuredAutomationIds`,`responderIntegrationIds`];function w(e,t){if(!p(e))return{valid:!1,errors:[`interface: must be an object`]};if(e.version!==`1.0`)return{valid:!1,errors:[`interface.version: must be "1.0"`]};let r=new m;return r.closed(e,C,`interface`),h(r,e.routes,t.mountedRoutes),g(r,e.navigation),_(r,e.pages),(typeof e.docsUrl!=`string`||!e.docsUrl.startsWith(n))&&r.fail(`docsUrl`,`must start with ${n}`),y(r,e.attributes),b(r,e.importExport),x(r,e.endpoints),S(r,e.featuredAutomationIds,`featuredAutomationIds`).forEach(e=>{t.catalogIds.has(e)||r.fail(`featuredAutomationIds`,`${e} is not a catalog entry`)}),S(r,e.responderIntegrationIds,`responderIntegrationIds`),{valid:r.errors.length===0,errors:r.errors}}exports.validateInterfaceManifest=w;
+//# sourceMappingURL=interface-validation.cjs.map

package/dist/manifests/interface-validation.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-validation.cjs","names":[],"sources":["../../src/manifests/interface-validation.ts"],"sourcesContent":["/**\n * Admission policy for the extension-published Automation interface manifest.\n *\n * Like a setup entry, the interface manifest is data authored in a different\n * repository that instructs this host to render copy, build links, and address\n * requests, so the host decides what it is *permitted* to state. Admission is\n * all-or-nothing: one bad field rejects the whole manifest, and the host falls\n * back to its own defaults rather than rendering a partially-trusted mix.\n */\n\nimport type {\n  AutomationAttributeName,\n  InterfaceAttributeType,\n  InterfaceRoutes,\n} from \"./types\";\nimport { INTERFACE_VERSION } from \"./types\";\n\n/** Copy must never be able to inject markup into the host. */\nconst MARKUP_PATTERN = /<[A-Za-z/!]/;\nconst SLUG_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;\n/** The one URL the manifest may state, pinned to the product documentation. */\nconst DOCS_URL_PREFIX = \"https://docs.openhands.dev/\";\nconst FILE_KIND_PATTERN = /^[a-z][a-z-]*$/;\nconst FILENAME_SUFFIX_PATTERN = /^\\.[a-z][a-z.]*json$/;\nconst EVENT_SOURCE_PATTERN = /^[a-z0-9][a-z0-9.-]*$/;\n/** Service-relative only: rooted, no traversal, no query, no fragment. */\nconst ENDPOINT_PATTERN = /^\\/[A-Za-z0-9/{}_-]*$/;\n/** Exactly one `{id}` substitution and no other braces. */\nconst ID_ENDPOINT_PATTERN = /^[^{}]*\\{id\\}[^{}]*$/;\n\nconst GIT_PROVIDERS = [\"github\", \"gitlab\", \"bitbucket\"] as const;\n/**\n * The attribute semantics this host's edit dialog implements: the control it\n * renders per property and the requiredness it enforces. Admission pins a\n * declared attribute to exactly these, so an admitted manifest can never\n * promise a control, a requiredness, or (below) a minimum the form would\n * silently ignore.\n */\nconst HOST_ATTRIBUTES: Record<\n  AutomationAttributeName,\n  { type: InterfaceAttributeType; required: boolean }\n> = {\n  name: { type: \"text\", required: true },\n  prompt: { type: \"textarea\", required: false },\n  model: { type: \"llm-profile\", required: false },\n  timeout: { type: \"number\", required: false },\n  schedule: { type: \"schedule\", required: false },\n};\nconst ATTRIBUTE_NAMES = Object.keys(HOST_ATTRIBUTES);\nconst PLAIN_ENDPOINT_NAMES = [\n  \"list\",\n  \"health\",\n  \"capabilities\",\n  \"validate\",\n  \"createPrompt\",\n  \"createPlugin\",\n] as const;\nconst ID_ENDPOINT_NAMES = [\"detail\", \"dispatch\", \"runs\", \"tarball\"] as const;\n\nexport interface InterfaceValidationContext {\n  /** Ids of the published automation catalog, for the featured-list check. */\n  catalogIds: ReadonlySet<string>;\n  /** The routes this host has registrations for. A manifest must match them. */\n  mountedRoutes: InterfaceRoutes;\n}\n\nexport interface InterfaceValidationResult {\n  valid: boolean;\n  errors: string[];\n}\n\ntype Rec = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is Rec {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nclass InterfaceChecker {\n  readonly errors: string[] = [];\n\n  fail(path: string, reason: string): false {\n    this.errors.push(`${path}: ${reason}`);\n    return false;\n  }\n\n  /** Literal user-visible copy. Carries no markup. */\n  copy(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    if (MARKUP_PATTERN.test(value)) {\n      return this.fail(path, \"must not contain markup\");\n    }\n    return true;\n  }\n\n  /** A closed object: every present key must be an expected one. */\n  closed(container: Rec, allowed: readonly string[], path: string): void {\n    Object.keys(container)\n      .filter((key) => !allowed.includes(key))\n      .forEach((key) => this.fail(`${path}.${key}`, \"is not allowed\"));\n  }\n\n  record(value: unknown, path: string): value is Rec {\n    if (isRecord(value)) return true;\n    this.fail(path, \"must be an object\");\n    return false;\n  }\n}\n\nfunction checkRoutes(\n  check: InterfaceChecker,\n  routes: unknown,\n  mounted: InterfaceRoutes,\n): void {\n  if (!check.record(routes, \"routes\")) return;\n  check.closed(routes, [\"list\", \"setup\", \"detail\"], \"routes\");\n\n  // The host serves what it has registrations for, so a declared route must be\n  // exactly the mounted shape — the manifest owns link construction, not the\n  // router table.\n  ([\"list\", \"setup\", \"detail\"] as const).forEach((name) => {\n    if (routes[name] !== mounted[name]) {\n      check.fail(`routes.${name}`, `must be \"${mounted[name]}\"`);\n    }\n  });\n}\n\nfunction checkNavigation(check: InterfaceChecker, navigation: unknown): void {\n  if (!check.record(navigation, \"navigation\")) return;\n  check.closed(navigation, [\"sidebar\", \"commandMenu\"], \"navigation\");\n\n  if (check.record(navigation.sidebar, \"navigation.sidebar\")) {\n    check.closed(navigation.sidebar, [\"label\"], \"navigation.sidebar\");\n    check.copy(navigation.sidebar.label, \"navigation.sidebar.label\");\n  }\n  if (check.record(navigation.commandMenu, \"navigation.commandMenu\")) {\n    const menu = navigation.commandMenu;\n    check.closed(\n      menu,\n      [\"title\", \"description\", \"keywords\"],\n      \"navigation.commandMenu\",\n    );\n    check.copy(menu.title, \"navigation.commandMenu.title\");\n    check.copy(menu.description, \"navigation.commandMenu.description\");\n    check.copy(menu.keywords, \"navigation.commandMenu.keywords\");\n  }\n}\n\nfunction checkPages(check: InterfaceChecker, pages: unknown): void {\n  if (!check.record(pages, \"pages\")) return;\n  check.closed(pages, [\"list\", \"detail\", \"edit\"], \"pages\");\n\n  if (check.record(pages.list, \"pages.list\")) {\n    check.closed(pages.list, [\"title\", \"subtitle\"], \"pages.list\");\n    check.copy(pages.list.title, \"pages.list.title\");\n    check.copy(pages.list.subtitle, \"pages.list.subtitle\");\n  }\n  if (check.record(pages.detail, \"pages.detail\")) {\n    check.closed(pages.detail, [\"backLabel\"], \"pages.detail\");\n    check.copy(pages.detail.backLabel, \"pages.detail.backLabel\");\n  }\n  if (check.record(pages.edit, \"pages.edit\")) {\n    check.closed(pages.edit, [\"title\"], \"pages.edit\");\n    check.copy(pages.edit.title, \"pages.edit.title\");\n  }\n}\n\nfunction checkAttribute(\n  check: InterfaceChecker,\n  host: { type: InterfaceAttributeType; required: boolean },\n  attribute: unknown,\n  path: string,\n): void {\n  if (!check.record(attribute, path)) return;\n  check.closed(\n    attribute,\n    [\"type\", \"label\", \"help\", \"required\", \"constraints\"],\n    path,\n  );\n\n  const { type, label, help, required, constraints } = attribute;\n  if (type !== host.type) {\n    check.fail(\n      `${path}.type`,\n      `must be \"${host.type}\", the control this host renders`,\n    );\n  }\n  check.copy(label, `${path}.label`);\n  if (help !== undefined) check.copy(help, `${path}.help`);\n  if (required !== host.required) {\n    check.fail(\n      `${path}.required`,\n      `must be ${host.required}, what this host enforces`,\n    );\n  }\n\n  if (constraints !== undefined) {\n    if (host.type !== \"number\") {\n      check.fail(\n        `${path}.constraints`,\n        \"is only allowed on a number attribute\",\n      );\n    } else if (check.record(constraints, `${path}.constraints`)) {\n      check.closed(constraints, [\"min\", \"max\"], `${path}.constraints`);\n      const { min, max } = constraints;\n      // The form validates a positive integer, i.e. an effective minimum of 1;\n      // any other declared minimum would be a promise it does not keep.\n      if (min !== undefined && min !== 1) {\n        check.fail(\n          `${path}.constraints.min`,\n          \"must be the 1 this host enforces\",\n        );\n      }\n      if (\n        max !== undefined &&\n        (!Number.isInteger(max) || (max as number) < 1)\n      ) {\n        check.fail(`${path}.constraints.max`, \"must be a positive integer\");\n      }\n    }\n  }\n}\n\nfunction checkAttributes(check: InterfaceChecker, attributes: unknown): void {\n  if (!check.record(attributes, \"attributes\")) return;\n  const names = Object.keys(attributes);\n  if (names.length === 0) {\n    check.fail(\"attributes\", \"must declare at least one attribute\");\n  }\n  names.forEach((name) => {\n    if (!ATTRIBUTE_NAMES.includes(name)) {\n      check.fail(`attributes.${name}`, \"is not a settable attribute\");\n      return;\n    }\n    checkAttribute(\n      check,\n      HOST_ATTRIBUTES[name as AutomationAttributeName],\n      attributes[name],\n      `attributes.${name}`,\n    );\n  });\n}\n\nfunction checkImportExport(\n  check: InterfaceChecker,\n  importExport: unknown,\n): void {\n  if (!check.record(importExport, \"importExport\")) return;\n  check.closed(\n    importExport,\n    [\"fileKind\", \"fileVersion\", \"filenameSuffix\", \"importDefaults\"],\n    \"importExport\",\n  );\n\n  const { fileKind, fileVersion, filenameSuffix, importDefaults } =\n    importExport;\n  if (typeof fileKind !== \"string\" || !FILE_KIND_PATTERN.test(fileKind)) {\n    check.fail(\"importExport.fileKind\", \"must be a lowercase slug\");\n  }\n  if (fileVersion !== 1) {\n    check.fail(\"importExport.fileVersion\", \"must be 1\");\n  }\n  if (\n    typeof filenameSuffix !== \"string\" ||\n    !FILENAME_SUFFIX_PATTERN.test(filenameSuffix)\n  ) {\n    check.fail(\"importExport.filenameSuffix\", \"must be a .json suffix\");\n  }\n  if (check.record(importDefaults, \"importExport.importDefaults\")) {\n    check.closed(\n      importDefaults,\n      [\"repoProvider\", \"placeholderEventSource\"],\n      \"importExport.importDefaults\",\n    );\n    if (\n      typeof importDefaults.repoProvider !== \"string\" ||\n      !(GIT_PROVIDERS as readonly string[]).includes(\n        importDefaults.repoProvider,\n      )\n    ) {\n      check.fail(\n        \"importExport.importDefaults.repoProvider\",\n        \"is not a supported provider\",\n      );\n    }\n    if (\n      typeof importDefaults.placeholderEventSource !== \"string\" ||\n      !EVENT_SOURCE_PATTERN.test(importDefaults.placeholderEventSource)\n    ) {\n      check.fail(\n        \"importExport.importDefaults.placeholderEventSource\",\n        \"must be a lowercase event source\",\n      );\n    }\n  }\n}\n\nfunction checkEndpoints(check: InterfaceChecker, endpoints: unknown): void {\n  if (!check.record(endpoints, \"endpoints\")) return;\n  const allowed = [...PLAIN_ENDPOINT_NAMES, ...ID_ENDPOINT_NAMES];\n  check.closed(endpoints, allowed, \"endpoints\");\n\n  const endpointAt = (name: string): string | null => {\n    const value = endpoints[name];\n    if (\n      typeof value !== \"string\" ||\n      !ENDPOINT_PATTERN.test(value) ||\n      value.includes(\"//\")\n    ) {\n      check.fail(`endpoints.${name}`, \"must be a rooted service-relative path\");\n      return null;\n    }\n    return value;\n  };\n\n  PLAIN_ENDPOINT_NAMES.forEach((name) => {\n    const value = endpointAt(name);\n    if (value !== null && /[{}]/.test(value)) {\n      check.fail(`endpoints.${name}`, \"must not carry a substitution\");\n    }\n  });\n  ID_ENDPOINT_NAMES.forEach((name) => {\n    const value = endpointAt(name);\n    if (value !== null && !ID_ENDPOINT_PATTERN.test(value)) {\n      check.fail(`endpoints.${name}`, \"must carry exactly one {id}\");\n    }\n  });\n}\n\nfunction checkSlugList(\n  check: InterfaceChecker,\n  value: unknown,\n  path: string,\n): string[] {\n  if (!Array.isArray(value) || value.length === 0) {\n    check.fail(path, \"must be a non-empty array\");\n    return [];\n  }\n  const slugs = value.filter((item): item is string => {\n    if (typeof item === \"string\" && SLUG_PATTERN.test(item)) return true;\n    check.fail(path, \"must contain only lowercase slugs\");\n    return false;\n  });\n  if (new Set(slugs).size !== slugs.length) {\n    check.fail(path, \"must not repeat an id\");\n  }\n  return slugs;\n}\n\nconst TOP_LEVEL_KEYS = [\n  \"version\",\n  \"routes\",\n  \"navigation\",\n  \"pages\",\n  \"docsUrl\",\n  \"attributes\",\n  \"importExport\",\n  \"endpoints\",\n  \"featuredAutomationIds\",\n  \"responderIntegrationIds\",\n];\n\n/**\n * Decide whether this host will act on a published interface manifest.\n *\n * The version is checked first and fails closed: a format this host does not\n * recognise is refused rather than interpreted with today's rules.\n */\nexport function validateInterfaceManifest(\n  candidate: unknown,\n  context: InterfaceValidationContext,\n): InterfaceValidationResult {\n  if (!isRecord(candidate)) {\n    return { valid: false, errors: [\"interface: must be an object\"] };\n  }\n  if (candidate.version !== INTERFACE_VERSION) {\n    return {\n      valid: false,\n      errors: [`interface.version: must be \"${INTERFACE_VERSION}\"`],\n    };\n  }\n\n  const check = new InterfaceChecker();\n  check.closed(candidate, TOP_LEVEL_KEYS, \"interface\");\n\n  checkRoutes(check, candidate.routes, context.mountedRoutes);\n  checkNavigation(check, candidate.navigation);\n  checkPages(check, candidate.pages);\n  if (\n    typeof candidate.docsUrl !== \"string\" ||\n    !candidate.docsUrl.startsWith(DOCS_URL_PREFIX)\n  ) {\n    check.fail(\"docsUrl\", `must start with ${DOCS_URL_PREFIX}`);\n  }\n  checkAttributes(check, candidate.attributes);\n  checkImportExport(check, candidate.importExport);\n  checkEndpoints(check, candidate.endpoints);\n\n  checkSlugList(\n    check,\n    candidate.featuredAutomationIds,\n    \"featuredAutomationIds\",\n  ).forEach((id) => {\n    if (!context.catalogIds.has(id)) {\n      check.fail(\"featuredAutomationIds\", `${id} is not a catalog entry`);\n    }\n  });\n  checkSlugList(\n    check,\n    candidate.responderIntegrationIds,\n    \"responderIntegrationIds\",\n  );\n\n  return { valid: check.errors.length === 0, errors: check.errors };\n}\n"],"mappings":"6CAkBA,IAAM,EAAiB,cACjB,EAAe,2BAEf,EAAkB,8BAClB,EAAoB,iBACpB,EAA0B,uBAC1B,EAAuB,wBAEvB,EAAmB,wBAEnB,EAAsB,uBAEtB,EAAgB,CAAC,SAAU,SAAU,WAAW,EAQhD,EAGF,CACF,KAAM,CAAE,KAAM,OAAQ,SAAU,EAAK,EACrC,OAAQ,CAAE,KAAM,WAAY,SAAU,EAAM,EAC5C,MAAO,CAAE,KAAM,cAAe,SAAU,EAAM,EAC9C,QAAS,CAAE,KAAM,SAAU,SAAU,EAAM,EAC3C,SAAU,CAAE,KAAM,WAAY,SAAU,EAAM,CAChD,EACM,EAAkB,OAAO,KAAK,CAAe,EAC7C,EAAuB,CAC3B,OACA,SACA,eACA,WACA,eACA,cACF,EACM,EAAoB,CAAC,SAAU,WAAY,OAAQ,SAAS,EAgBlE,SAAS,EAAS,EAA8B,CAC9C,OAAO,OAAO,GAAU,YAAY,GAAkB,CAAC,MAAM,QAAQ,CAAK,CAC5E,CAEA,IAAM,EAAN,KAAuB,CACrB,OAA4B,CAAC,EAE7B,KAAK,EAAc,EAAuB,CAExC,OADA,KAAK,OAAO,KAAK,GAAG,EAAK,IAAI,GAAQ,EAC9B,EACT,CAGA,KAAK,EAAgB,EAAuB,CAO1C,OANI,OAAO,GAAU,UAAY,EAAM,SAAW,EACzC,KAAK,KAAK,EAAM,4BAA4B,EAEjD,EAAe,KAAK,CAAK,EACpB,KAAK,KAAK,EAAM,yBAAyB,EAE3C,EACT,CAGA,OAAO,EAAgB,EAA4B,EAAoB,CACrE,OAAO,KAAK,CAAS,EAClB,OAAQ,GAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,QAAS,GAAQ,KAAK,KAAK,GAAG,EAAK,GAAG,IAAO,gBAAgB,CAAC,CACnE,CAEA,OAAO,EAAgB,EAA4B,CAGjD,OAFI,EAAS,CAAK,EAAU,IAC5B,KAAK,KAAK,EAAM,mBAAmB,EAC5B,GACT,CACF,EAEA,SAAS,EACP,EACA,EACA,EACM,CACD,EAAM,OAAO,EAAQ,QAAQ,IAClC,EAAM,OAAO,EAAQ,CAAC,OAAQ,QAAS,QAAQ,EAAG,QAAQ,EAK1D,CAAE,OAAQ,QAAS,QAAQ,EAAY,QAAS,GAAS,CACnD,EAAO,KAAU,EAAQ,IAC3B,EAAM,KAAK,UAAU,IAAQ,YAAY,EAAQ,GAAM,EAAE,CAE7D,CAAC,EACH,CAEA,SAAS,EAAgB,EAAyB,EAA2B,CACtE,KAAM,OAAO,EAAY,YAAY,IAC1C,EAAM,OAAO,EAAY,CAAC,UAAW,aAAa,EAAG,YAAY,EAE7D,EAAM,OAAO,EAAW,QAAS,oBAAoB,IACvD,EAAM,OAAO,EAAW,QAAS,CAAC,OAAO,EAAG,oBAAoB,EAChE,EAAM,KAAK,EAAW,QAAQ,MAAO,0BAA0B,GAE7D,EAAM,OAAO,EAAW,YAAa,wBAAwB,GAAG,CAClE,IAAM,EAAO,EAAW,YACxB,EAAM,OACJ,EACA,CAAC,QAAS,cAAe,UAAU,EACnC,wBACF,EACA,EAAM,KAAK,EAAK,MAAO,8BAA8B,EACrD,EAAM,KAAK,EAAK,YAAa,oCAAoC,EACjE,EAAM,KAAK,EAAK,SAAU,iCAAiC,CAC7D,CACF,CAEA,SAAS,EAAW,EAAyB,EAAsB,CAC5D,EAAM,OAAO,EAAO,OAAO,IAChC,EAAM,OAAO,EAAO,CAAC,OAAQ,SAAU,MAAM,EAAG,OAAO,EAEnD,EAAM,OAAO,EAAM,KAAM,YAAY,IACvC,EAAM,OAAO,EAAM,KAAM,CAAC,QAAS,UAAU,EAAG,YAAY,EAC5D,EAAM,KAAK,EAAM,KAAK,MAAO,kBAAkB,EAC/C,EAAM,KAAK,EAAM,KAAK,SAAU,qBAAqB,GAEnD,EAAM,OAAO,EAAM,OAAQ,cAAc,IAC3C,EAAM,OAAO,EAAM,OAAQ,CAAC,WAAW,EAAG,cAAc,EACxD,EAAM,KAAK,EAAM,OAAO,UAAW,wBAAwB,GAEzD,EAAM,OAAO,EAAM,KAAM,YAAY,IACvC,EAAM,OAAO,EAAM,KAAM,CAAC,OAAO,EAAG,YAAY,EAChD,EAAM,KAAK,EAAM,KAAK,MAAO,kBAAkB,GAEnD,CAEA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,GAAI,CAAC,EAAM,OAAO,EAAW,CAAI,EAAG,OACpC,EAAM,OACJ,EACA,CAAC,OAAQ,QAAS,OAAQ,WAAY,aAAa,EACnD,CACF,EAEA,GAAM,CAAE,OAAM,QAAO,OAAM,WAAU,eAAgB,EAgBrD,GAfI,IAAS,EAAK,MAChB,EAAM,KACJ,GAAG,EAAK,OACR,YAAY,EAAK,KAAK,iCACxB,EAEF,EAAM,KAAK,EAAO,GAAG,EAAK,OAAO,EAC7B,IAAS,IAAA,IAAW,EAAM,KAAK,EAAM,GAAG,EAAK,MAAM,EACnD,IAAa,EAAK,UACpB,EAAM,KACJ,GAAG,EAAK,WACR,WAAW,EAAK,SAAS,0BAC3B,EAGE,IAAgB,IAAA,OACd,EAAK,OAAS,SAChB,EAAM,KACJ,GAAG,EAAK,cACR,uCACF,OACK,GAAI,EAAM,OAAO,EAAa,GAAG,EAAK,aAAa,EAAG,CAC3D,EAAM,OAAO,EAAa,CAAC,MAAO,KAAK,EAAG,GAAG,EAAK,aAAa,EAC/D,GAAM,CAAE,MAAK,OAAQ,EAGjB,IAAQ,IAAA,IAAa,IAAQ,GAC/B,EAAM,KACJ,GAAG,EAAK,kBACR,kCACF,EAGA,IAAQ,IAAA,KACP,CAAC,OAAO,UAAU,CAAG,GAAM,EAAiB,IAE7C,EAAM,KAAK,GAAG,EAAK,kBAAmB,4BAA4B,CAEtE,EAEJ,CAEA,SAAS,EAAgB,EAAyB,EAA2B,CAC3E,GAAI,CAAC,EAAM,OAAO,EAAY,YAAY,EAAG,OAC7C,IAAM,EAAQ,OAAO,KAAK,CAAU,EAChC,EAAM,SAAW,GACnB,EAAM,KAAK,aAAc,qCAAqC,EAEhE,EAAM,QAAS,GAAS,CACtB,GAAI,CAAC,EAAgB,SAAS,CAAI,EAAG,CACnC,EAAM,KAAK,cAAc,IAAQ,6BAA6B,EAC9D,MACF,CACA,EACE,EACA,EAAgB,GAChB,EAAW,GACX,cAAc,GAChB,CACF,CAAC,CACH,CAEA,SAAS,EACP,EACA,EACM,CACN,GAAI,CAAC,EAAM,OAAO,EAAc,cAAc,EAAG,OACjD,EAAM,OACJ,EACA,CAAC,WAAY,cAAe,iBAAkB,gBAAgB,EAC9D,cACF,EAEA,GAAM,CAAE,WAAU,cAAa,iBAAgB,kBAC7C,GACE,OAAO,GAAa,UAAY,CAAC,EAAkB,KAAK,CAAQ,IAClE,EAAM,KAAK,wBAAyB,0BAA0B,EAE5D,IAAgB,GAClB,EAAM,KAAK,2BAA4B,WAAW,GAGlD,OAAO,GAAmB,UAC1B,CAAC,EAAwB,KAAK,CAAc,IAE5C,EAAM,KAAK,8BAA+B,wBAAwB,EAEhE,EAAM,OAAO,EAAgB,6BAA6B,IAC5D,EAAM,OACJ,EACA,CAAC,eAAgB,wBAAwB,EACzC,6BACF,GAEE,OAAO,EAAe,cAAiB,UACvC,CAAE,EAAoC,SACpC,EAAe,YACjB,IAEA,EAAM,KACJ,2CACA,6BACF,GAGA,OAAO,EAAe,wBAA2B,UACjD,CAAC,EAAqB,KAAK,EAAe,sBAAsB,IAEhE,EAAM,KACJ,qDACA,kCACF,EAGN,CAEA,SAAS,EAAe,EAAyB,EAA0B,CACzE,GAAI,CAAC,EAAM,OAAO,EAAW,WAAW,EAAG,OAC3C,IAAM,EAAU,CAAC,GAAG,EAAsB,GAAG,CAAiB,EAC9D,EAAM,OAAO,EAAW,EAAS,WAAW,EAE5C,IAAM,EAAc,GAAgC,CAClD,IAAM,EAAQ,EAAU,GASxB,OAPE,OAAO,GAAU,UACjB,CAAC,EAAiB,KAAK,CAAK,GAC5B,EAAM,SAAS,IAAI,GAEnB,EAAM,KAAK,aAAa,IAAQ,wCAAwC,EACjE,MAEF,CACT,EAEA,EAAqB,QAAS,GAAS,CACrC,IAAM,EAAQ,EAAW,CAAI,EACzB,IAAU,MAAQ,OAAO,KAAK,CAAK,GACrC,EAAM,KAAK,aAAa,IAAQ,+BAA+B,CAEnE,CAAC,EACD,EAAkB,QAAS,GAAS,CAClC,IAAM,EAAQ,EAAW,CAAI,EACzB,IAAU,MAAQ,CAAC,EAAoB,KAAK,CAAK,GACnD,EAAM,KAAK,aAAa,IAAQ,6BAA6B,CAEjE,CAAC,CACH,CAEA,SAAS,EACP,EACA,EACA,EACU,CACV,GAAI,CAAC,MAAM,QAAQ,CAAK,GAAK,EAAM,SAAW,EAE5C,OADA,EAAM,KAAK,EAAM,2BAA2B,EACrC,CAAC,EAEV,IAAM,EAAQ,EAAM,OAAQ,GACtB,OAAO,GAAS,UAAY,EAAa,KAAK,CAAI,EAAU,IAChE,EAAM,KAAK,EAAM,mCAAmC,EAC7C,GACR,EAID,OAHI,IAAI,IAAI,CAAK,EAAE,OAAS,EAAM,QAChC,EAAM,KAAK,EAAM,uBAAuB,EAEnC,CACT,CAEA,IAAM,EAAiB,CACrB,UACA,SACA,aACA,QACA,UACA,aACA,eACA,YACA,wBACA,yBACF,EAQA,SAAgB,EACd,EACA,EAC2B,CAC3B,GAAI,CAAC,EAAS,CAAS,EACrB,MAAO,CAAE,MAAO,GAAO,OAAQ,CAAC,8BAA8B,CAAE,EAElE,GAAI,EAAU,UAAA,MACZ,MAAO,CACL,MAAO,GACP,OAAQ,CAAC,kCAAmD,CAC9D,EAGF,IAAM,EAAQ,IAAI,EA+BlB,OA9BA,EAAM,OAAO,EAAW,EAAgB,WAAW,EAEnD,EAAY,EAAO,EAAU,OAAQ,EAAQ,aAAa,EAC1D,EAAgB,EAAO,EAAU,UAAU,EAC3C,EAAW,EAAO,EAAU,KAAK,GAE/B,OAAO,EAAU,SAAY,UAC7B,CAAC,EAAU,QAAQ,WAAW,CAAe,IAE7C,EAAM,KAAK,UAAW,mBAAmB,GAAiB,EAE5D,EAAgB,EAAO,EAAU,UAAU,EAC3C,EAAkB,EAAO,EAAU,YAAY,EAC/C,EAAe,EAAO,EAAU,SAAS,EAEzC,EACE,EACA,EAAU,sBACV,uBACF,EAAE,QAAS,GAAO,CACX,EAAQ,WAAW,IAAI,CAAE,GAC5B,EAAM,KAAK,wBAAyB,GAAG,EAAG,wBAAwB,CAEtE,CAAC,EACD,EACE,EACA,EAAU,wBACV,yBACF,EAEO,CAAE,MAAO,EAAM,OAAO,SAAW,EAAG,OAAQ,EAAM,MAAO,CAClE"}

package/dist/manifests/interface-validation.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Admission policy for the extension-published Automation interface manifest.
+ *
+ * Like a setup entry, the interface manifest is data authored in a different
+ * repository that instructs this host to render copy, build links, and address
+ * requests, so the host decides what it is *permitted* to state. Admission is
+ * all-or-nothing: one bad field rejects the whole manifest, and the host falls
+ * back to its own defaults rather than rendering a partially-trusted mix.
+ */
+import type { InterfaceRoutes } from "./types";
+export interface InterfaceValidationContext {
+    /** Ids of the published automation catalog, for the featured-list check. */
+    catalogIds: ReadonlySet<string>;
+    /** The routes this host has registrations for. A manifest must match them. */
+    mountedRoutes: InterfaceRoutes;
+}
+export interface InterfaceValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+/**
+ * Decide whether this host will act on a published interface manifest.
+ *
+ * The version is checked first and fails closed: a format this host does not
+ * recognise is refused rather than interpreted with today's rules.
+ */
+export declare function validateInterfaceManifest(candidate: unknown, context: InterfaceValidationContext): InterfaceValidationResult;

package/dist/manifests/interface-validation.js

@@ -0,0 +1,182 @@
+//#region src/manifests/interface-validation.ts
+var e = /<[A-Za-z/!]/, t = /^[a-z0-9]+(-[a-z0-9]+)*$/, n = "https://docs.openhands.dev/", r = /^[a-z][a-z-]*$/, i = /^\.[a-z][a-z.]*json$/, a = /^[a-z0-9][a-z0-9.-]*$/, o = /^\/[A-Za-z0-9/{}_-]*$/, s = /^[^{}]*\{id\}[^{}]*$/, c = [
+	"github",
+	"gitlab",
+	"bitbucket"
+], l = {
+	name: {
+		type: "text",
+		required: !0
+	},
+	prompt: {
+		type: "textarea",
+		required: !1
+	},
+	model: {
+		type: "llm-profile",
+		required: !1
+	},
+	timeout: {
+		type: "number",
+		required: !1
+	},
+	schedule: {
+		type: "schedule",
+		required: !1
+	}
+}, u = Object.keys(l), d = [
+	"list",
+	"health",
+	"capabilities",
+	"validate",
+	"createPrompt",
+	"createPlugin"
+], f = [
+	"detail",
+	"dispatch",
+	"runs",
+	"tarball"
+];
+function p(e) {
+	return typeof e == "object" && !!e && !Array.isArray(e);
+}
+var m = class {
+	errors = [];
+	fail(e, t) {
+		return this.errors.push(`${e}: ${t}`), !1;
+	}
+	copy(t, n) {
+		return typeof t != "string" || t.length === 0 ? this.fail(n, "must be a non-empty string") : e.test(t) ? this.fail(n, "must not contain markup") : !0;
+	}
+	closed(e, t, n) {
+		Object.keys(e).filter((e) => !t.includes(e)).forEach((e) => this.fail(`${n}.${e}`, "is not allowed"));
+	}
+	record(e, t) {
+		return p(e) ? !0 : (this.fail(t, "must be an object"), !1);
+	}
+};
+function h(e, t, n) {
+	e.record(t, "routes") && (e.closed(t, [
+		"list",
+		"setup",
+		"detail"
+	], "routes"), [
+		"list",
+		"setup",
+		"detail"
+	].forEach((r) => {
+		t[r] !== n[r] && e.fail(`routes.${r}`, `must be "${n[r]}"`);
+	}));
+}
+function g(e, t) {
+	if (e.record(t, "navigation") && (e.closed(t, ["sidebar", "commandMenu"], "navigation"), e.record(t.sidebar, "navigation.sidebar") && (e.closed(t.sidebar, ["label"], "navigation.sidebar"), e.copy(t.sidebar.label, "navigation.sidebar.label")), e.record(t.commandMenu, "navigation.commandMenu"))) {
+		let n = t.commandMenu;
+		e.closed(n, [
+			"title",
+			"description",
+			"keywords"
+		], "navigation.commandMenu"), e.copy(n.title, "navigation.commandMenu.title"), e.copy(n.description, "navigation.commandMenu.description"), e.copy(n.keywords, "navigation.commandMenu.keywords");
+	}
+}
+function _(e, t) {
+	e.record(t, "pages") && (e.closed(t, [
+		"list",
+		"detail",
+		"edit"
+	], "pages"), e.record(t.list, "pages.list") && (e.closed(t.list, ["title", "subtitle"], "pages.list"), e.copy(t.list.title, "pages.list.title"), e.copy(t.list.subtitle, "pages.list.subtitle")), e.record(t.detail, "pages.detail") && (e.closed(t.detail, ["backLabel"], "pages.detail"), e.copy(t.detail.backLabel, "pages.detail.backLabel")), e.record(t.edit, "pages.edit") && (e.closed(t.edit, ["title"], "pages.edit"), e.copy(t.edit.title, "pages.edit.title")));
+}
+function v(e, t, n, r) {
+	if (!e.record(n, r)) return;
+	e.closed(n, [
+		"type",
+		"label",
+		"help",
+		"required",
+		"constraints"
+	], r);
+	let { type: i, label: a, help: o, required: s, constraints: c } = n;
+	if (i !== t.type && e.fail(`${r}.type`, `must be "${t.type}", the control this host renders`), e.copy(a, `${r}.label`), o !== void 0 && e.copy(o, `${r}.help`), s !== t.required && e.fail(`${r}.required`, `must be ${t.required}, what this host enforces`), c !== void 0) {
+		if (t.type !== "number") e.fail(`${r}.constraints`, "is only allowed on a number attribute");
+		else if (e.record(c, `${r}.constraints`)) {
+			e.closed(c, ["min", "max"], `${r}.constraints`);
+			let { min: t, max: n } = c;
+			t !== void 0 && t !== 1 && e.fail(`${r}.constraints.min`, "must be the 1 this host enforces"), n !== void 0 && (!Number.isInteger(n) || n < 1) && e.fail(`${r}.constraints.max`, "must be a positive integer");
+		}
+	}
+}
+function y(e, t) {
+	if (!e.record(t, "attributes")) return;
+	let n = Object.keys(t);
+	n.length === 0 && e.fail("attributes", "must declare at least one attribute"), n.forEach((n) => {
+		if (!u.includes(n)) {
+			e.fail(`attributes.${n}`, "is not a settable attribute");
+			return;
+		}
+		v(e, l[n], t[n], `attributes.${n}`);
+	});
+}
+function b(e, t) {
+	if (!e.record(t, "importExport")) return;
+	e.closed(t, [
+		"fileKind",
+		"fileVersion",
+		"filenameSuffix",
+		"importDefaults"
+	], "importExport");
+	let { fileKind: n, fileVersion: o, filenameSuffix: s, importDefaults: l } = t;
+	(typeof n != "string" || !r.test(n)) && e.fail("importExport.fileKind", "must be a lowercase slug"), o !== 1 && e.fail("importExport.fileVersion", "must be 1"), (typeof s != "string" || !i.test(s)) && e.fail("importExport.filenameSuffix", "must be a .json suffix"), e.record(l, "importExport.importDefaults") && (e.closed(l, ["repoProvider", "placeholderEventSource"], "importExport.importDefaults"), (typeof l.repoProvider != "string" || !c.includes(l.repoProvider)) && e.fail("importExport.importDefaults.repoProvider", "is not a supported provider"), (typeof l.placeholderEventSource != "string" || !a.test(l.placeholderEventSource)) && e.fail("importExport.importDefaults.placeholderEventSource", "must be a lowercase event source"));
+}
+function x(e, t) {
+	if (!e.record(t, "endpoints")) return;
+	let n = [...d, ...f];
+	e.closed(t, n, "endpoints");
+	let r = (n) => {
+		let r = t[n];
+		return typeof r != "string" || !o.test(r) || r.includes("//") ? (e.fail(`endpoints.${n}`, "must be a rooted service-relative path"), null) : r;
+	};
+	d.forEach((t) => {
+		let n = r(t);
+		n !== null && /[{}]/.test(n) && e.fail(`endpoints.${t}`, "must not carry a substitution");
+	}), f.forEach((t) => {
+		let n = r(t);
+		n !== null && !s.test(n) && e.fail(`endpoints.${t}`, "must carry exactly one {id}");
+	});
+}
+function S(e, n, r) {
+	if (!Array.isArray(n) || n.length === 0) return e.fail(r, "must be a non-empty array"), [];
+	let i = n.filter((n) => typeof n == "string" && t.test(n) ? !0 : (e.fail(r, "must contain only lowercase slugs"), !1));
+	return new Set(i).size !== i.length && e.fail(r, "must not repeat an id"), i;
+}
+var C = [
+	"version",
+	"routes",
+	"navigation",
+	"pages",
+	"docsUrl",
+	"attributes",
+	"importExport",
+	"endpoints",
+	"featuredAutomationIds",
+	"responderIntegrationIds"
+];
+function w(e, t) {
+	if (!p(e)) return {
+		valid: !1,
+		errors: ["interface: must be an object"]
+	};
+	if (e.version !== "1.0") return {
+		valid: !1,
+		errors: ["interface.version: must be \"1.0\""]
+	};
+	let r = new m();
+	return r.closed(e, C, "interface"), h(r, e.routes, t.mountedRoutes), g(r, e.navigation), _(r, e.pages), (typeof e.docsUrl != "string" || !e.docsUrl.startsWith(n)) && r.fail("docsUrl", `must start with ${n}`), y(r, e.attributes), b(r, e.importExport), x(r, e.endpoints), S(r, e.featuredAutomationIds, "featuredAutomationIds").forEach((e) => {
+		t.catalogIds.has(e) || r.fail("featuredAutomationIds", `${e} is not a catalog entry`);
+	}), S(r, e.responderIntegrationIds, "responderIntegrationIds"), {
+		valid: r.errors.length === 0,
+		errors: r.errors
+	};
+}
+//#endregion
+export { w as validateInterfaceManifest };
+
+//# sourceMappingURL=interface-validation.js.map

package/dist/manifests/interface-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-validation.js","names":[],"sources":["../../src/manifests/interface-validation.ts"],"sourcesContent":["/**\n * Admission policy for the extension-published Automation interface manifest.\n *\n * Like a setup entry, the interface manifest is data authored in a different\n * repository that instructs this host to render copy, build links, and address\n * requests, so the host decides what it is *permitted* to state. Admission is\n * all-or-nothing: one bad field rejects the whole manifest, and the host falls\n * back to its own defaults rather than rendering a partially-trusted mix.\n */\n\nimport type {\n  AutomationAttributeName,\n  InterfaceAttributeType,\n  InterfaceRoutes,\n} from \"./types\";\nimport { INTERFACE_VERSION } from \"./types\";\n\n/** Copy must never be able to inject markup into the host. */\nconst MARKUP_PATTERN = /<[A-Za-z/!]/;\nconst SLUG_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;\n/** The one URL the manifest may state, pinned to the product documentation. */\nconst DOCS_URL_PREFIX = \"https://docs.openhands.dev/\";\nconst FILE_KIND_PATTERN = /^[a-z][a-z-]*$/;\nconst FILENAME_SUFFIX_PATTERN = /^\\.[a-z][a-z.]*json$/;\nconst EVENT_SOURCE_PATTERN = /^[a-z0-9][a-z0-9.-]*$/;\n/** Service-relative only: rooted, no traversal, no query, no fragment. */\nconst ENDPOINT_PATTERN = /^\\/[A-Za-z0-9/{}_-]*$/;\n/** Exactly one `{id}` substitution and no other braces. */\nconst ID_ENDPOINT_PATTERN = /^[^{}]*\\{id\\}[^{}]*$/;\n\nconst GIT_PROVIDERS = [\"github\", \"gitlab\", \"bitbucket\"] as const;\n/**\n * The attribute semantics this host's edit dialog implements: the control it\n * renders per property and the requiredness it enforces. Admission pins a\n * declared attribute to exactly these, so an admitted manifest can never\n * promise a control, a requiredness, or (below) a minimum the form would\n * silently ignore.\n */\nconst HOST_ATTRIBUTES: Record<\n  AutomationAttributeName,\n  { type: InterfaceAttributeType; required: boolean }\n> = {\n  name: { type: \"text\", required: true },\n  prompt: { type: \"textarea\", required: false },\n  model: { type: \"llm-profile\", required: false },\n  timeout: { type: \"number\", required: false },\n  schedule: { type: \"schedule\", required: false },\n};\nconst ATTRIBUTE_NAMES = Object.keys(HOST_ATTRIBUTES);\nconst PLAIN_ENDPOINT_NAMES = [\n  \"list\",\n  \"health\",\n  \"capabilities\",\n  \"validate\",\n  \"createPrompt\",\n  \"createPlugin\",\n] as const;\nconst ID_ENDPOINT_NAMES = [\"detail\", \"dispatch\", \"runs\", \"tarball\"] as const;\n\nexport interface InterfaceValidationContext {\n  /** Ids of the published automation catalog, for the featured-list check. */\n  catalogIds: ReadonlySet<string>;\n  /** The routes this host has registrations for. A manifest must match them. */\n  mountedRoutes: InterfaceRoutes;\n}\n\nexport interface InterfaceValidationResult {\n  valid: boolean;\n  errors: string[];\n}\n\ntype Rec = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is Rec {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nclass InterfaceChecker {\n  readonly errors: string[] = [];\n\n  fail(path: string, reason: string): false {\n    this.errors.push(`${path}: ${reason}`);\n    return false;\n  }\n\n  /** Literal user-visible copy. Carries no markup. */\n  copy(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    if (MARKUP_PATTERN.test(value)) {\n      return this.fail(path, \"must not contain markup\");\n    }\n    return true;\n  }\n\n  /** A closed object: every present key must be an expected one. */\n  closed(container: Rec, allowed: readonly string[], path: string): void {\n    Object.keys(container)\n      .filter((key) => !allowed.includes(key))\n      .forEach((key) => this.fail(`${path}.${key}`, \"is not allowed\"));\n  }\n\n  record(value: unknown, path: string): value is Rec {\n    if (isRecord(value)) return true;\n    this.fail(path, \"must be an object\");\n    return false;\n  }\n}\n\nfunction checkRoutes(\n  check: InterfaceChecker,\n  routes: unknown,\n  mounted: InterfaceRoutes,\n): void {\n  if (!check.record(routes, \"routes\")) return;\n  check.closed(routes, [\"list\", \"setup\", \"detail\"], \"routes\");\n\n  // The host serves what it has registrations for, so a declared route must be\n  // exactly the mounted shape — the manifest owns link construction, not the\n  // router table.\n  ([\"list\", \"setup\", \"detail\"] as const).forEach((name) => {\n    if (routes[name] !== mounted[name]) {\n      check.fail(`routes.${name}`, `must be \"${mounted[name]}\"`);\n    }\n  });\n}\n\nfunction checkNavigation(check: InterfaceChecker, navigation: unknown): void {\n  if (!check.record(navigation, \"navigation\")) return;\n  check.closed(navigation, [\"sidebar\", \"commandMenu\"], \"navigation\");\n\n  if (check.record(navigation.sidebar, \"navigation.sidebar\")) {\n    check.closed(navigation.sidebar, [\"label\"], \"navigation.sidebar\");\n    check.copy(navigation.sidebar.label, \"navigation.sidebar.label\");\n  }\n  if (check.record(navigation.commandMenu, \"navigation.commandMenu\")) {\n    const menu = navigation.commandMenu;\n    check.closed(\n      menu,\n      [\"title\", \"description\", \"keywords\"],\n      \"navigation.commandMenu\",\n    );\n    check.copy(menu.title, \"navigation.commandMenu.title\");\n    check.copy(menu.description, \"navigation.commandMenu.description\");\n    check.copy(menu.keywords, \"navigation.commandMenu.keywords\");\n  }\n}\n\nfunction checkPages(check: InterfaceChecker, pages: unknown): void {\n  if (!check.record(pages, \"pages\")) return;\n  check.closed(pages, [\"list\", \"detail\", \"edit\"], \"pages\");\n\n  if (check.record(pages.list, \"pages.list\")) {\n    check.closed(pages.list, [\"title\", \"subtitle\"], \"pages.list\");\n    check.copy(pages.list.title, \"pages.list.title\");\n    check.copy(pages.list.subtitle, \"pages.list.subtitle\");\n  }\n  if (check.record(pages.detail, \"pages.detail\")) {\n    check.closed(pages.detail, [\"backLabel\"], \"pages.detail\");\n    check.copy(pages.detail.backLabel, \"pages.detail.backLabel\");\n  }\n  if (check.record(pages.edit, \"pages.edit\")) {\n    check.closed(pages.edit, [\"title\"], \"pages.edit\");\n    check.copy(pages.edit.title, \"pages.edit.title\");\n  }\n}\n\nfunction checkAttribute(\n  check: InterfaceChecker,\n  host: { type: InterfaceAttributeType; required: boolean },\n  attribute: unknown,\n  path: string,\n): void {\n  if (!check.record(attribute, path)) return;\n  check.closed(\n    attribute,\n    [\"type\", \"label\", \"help\", \"required\", \"constraints\"],\n    path,\n  );\n\n  const { type, label, help, required, constraints } = attribute;\n  if (type !== host.type) {\n    check.fail(\n      `${path}.type`,\n      `must be \"${host.type}\", the control this host renders`,\n    );\n  }\n  check.copy(label, `${path}.label`);\n  if (help !== undefined) check.copy(help, `${path}.help`);\n  if (required !== host.required) {\n    check.fail(\n      `${path}.required`,\n      `must be ${host.required}, what this host enforces`,\n    );\n  }\n\n  if (constraints !== undefined) {\n    if (host.type !== \"number\") {\n      check.fail(\n        `${path}.constraints`,\n        \"is only allowed on a number attribute\",\n      );\n    } else if (check.record(constraints, `${path}.constraints`)) {\n      check.closed(constraints, [\"min\", \"max\"], `${path}.constraints`);\n      const { min, max } = constraints;\n      // The form validates a positive integer, i.e. an effective minimum of 1;\n      // any other declared minimum would be a promise it does not keep.\n      if (min !== undefined && min !== 1) {\n        check.fail(\n          `${path}.constraints.min`,\n          \"must be the 1 this host enforces\",\n        );\n      }\n      if (\n        max !== undefined &&\n        (!Number.isInteger(max) || (max as number) < 1)\n      ) {\n        check.fail(`${path}.constraints.max`, \"must be a positive integer\");\n      }\n    }\n  }\n}\n\nfunction checkAttributes(check: InterfaceChecker, attributes: unknown): void {\n  if (!check.record(attributes, \"attributes\")) return;\n  const names = Object.keys(attributes);\n  if (names.length === 0) {\n    check.fail(\"attributes\", \"must declare at least one attribute\");\n  }\n  names.forEach((name) => {\n    if (!ATTRIBUTE_NAMES.includes(name)) {\n      check.fail(`attributes.${name}`, \"is not a settable attribute\");\n      return;\n    }\n    checkAttribute(\n      check,\n      HOST_ATTRIBUTES[name as AutomationAttributeName],\n      attributes[name],\n      `attributes.${name}`,\n    );\n  });\n}\n\nfunction checkImportExport(\n  check: InterfaceChecker,\n  importExport: unknown,\n): void {\n  if (!check.record(importExport, \"importExport\")) return;\n  check.closed(\n    importExport,\n    [\"fileKind\", \"fileVersion\", \"filenameSuffix\", \"importDefaults\"],\n    \"importExport\",\n  );\n\n  const { fileKind, fileVersion, filenameSuffix, importDefaults } =\n    importExport;\n  if (typeof fileKind !== \"string\" || !FILE_KIND_PATTERN.test(fileKind)) {\n    check.fail(\"importExport.fileKind\", \"must be a lowercase slug\");\n  }\n  if (fileVersion !== 1) {\n    check.fail(\"importExport.fileVersion\", \"must be 1\");\n  }\n  if (\n    typeof filenameSuffix !== \"string\" ||\n    !FILENAME_SUFFIX_PATTERN.test(filenameSuffix)\n  ) {\n    check.fail(\"importExport.filenameSuffix\", \"must be a .json suffix\");\n  }\n  if (check.record(importDefaults, \"importExport.importDefaults\")) {\n    check.closed(\n      importDefaults,\n      [\"repoProvider\", \"placeholderEventSource\"],\n      \"importExport.importDefaults\",\n    );\n    if (\n      typeof importDefaults.repoProvider !== \"string\" ||\n      !(GIT_PROVIDERS as readonly string[]).includes(\n        importDefaults.repoProvider,\n      )\n    ) {\n      check.fail(\n        \"importExport.importDefaults.repoProvider\",\n        \"is not a supported provider\",\n      );\n    }\n    if (\n      typeof importDefaults.placeholderEventSource !== \"string\" ||\n      !EVENT_SOURCE_PATTERN.test(importDefaults.placeholderEventSource)\n    ) {\n      check.fail(\n        \"importExport.importDefaults.placeholderEventSource\",\n        \"must be a lowercase event source\",\n      );\n    }\n  }\n}\n\nfunction checkEndpoints(check: InterfaceChecker, endpoints: unknown): void {\n  if (!check.record(endpoints, \"endpoints\")) return;\n  const allowed = [...PLAIN_ENDPOINT_NAMES, ...ID_ENDPOINT_NAMES];\n  check.closed(endpoints, allowed, \"endpoints\");\n\n  const endpointAt = (name: string): string | null => {\n    const value = endpoints[name];\n    if (\n      typeof value !== \"string\" ||\n      !ENDPOINT_PATTERN.test(value) ||\n      value.includes(\"//\")\n    ) {\n      check.fail(`endpoints.${name}`, \"must be a rooted service-relative path\");\n      return null;\n    }\n    return value;\n  };\n\n  PLAIN_ENDPOINT_NAMES.forEach((name) => {\n    const value = endpointAt(name);\n    if (value !== null && /[{}]/.test(value)) {\n      check.fail(`endpoints.${name}`, \"must not carry a substitution\");\n    }\n  });\n  ID_ENDPOINT_NAMES.forEach((name) => {\n    const value = endpointAt(name);\n    if (value !== null && !ID_ENDPOINT_PATTERN.test(value)) {\n      check.fail(`endpoints.${name}`, \"must carry exactly one {id}\");\n    }\n  });\n}\n\nfunction checkSlugList(\n  check: InterfaceChecker,\n  value: unknown,\n  path: string,\n): string[] {\n  if (!Array.isArray(value) || value.length === 0) {\n    check.fail(path, \"must be a non-empty array\");\n    return [];\n  }\n  const slugs = value.filter((item): item is string => {\n    if (typeof item === \"string\" && SLUG_PATTERN.test(item)) return true;\n    check.fail(path, \"must contain only lowercase slugs\");\n    return false;\n  });\n  if (new Set(slugs).size !== slugs.length) {\n    check.fail(path, \"must not repeat an id\");\n  }\n  return slugs;\n}\n\nconst TOP_LEVEL_KEYS = [\n  \"version\",\n  \"routes\",\n  \"navigation\",\n  \"pages\",\n  \"docsUrl\",\n  \"attributes\",\n  \"importExport\",\n  \"endpoints\",\n  \"featuredAutomationIds\",\n  \"responderIntegrationIds\",\n];\n\n/**\n * Decide whether this host will act on a published interface manifest.\n *\n * The version is checked first and fails closed: a format this host does not\n * recognise is refused rather than interpreted with today's rules.\n */\nexport function validateInterfaceManifest(\n  candidate: unknown,\n  context: InterfaceValidationContext,\n): InterfaceValidationResult {\n  if (!isRecord(candidate)) {\n    return { valid: false, errors: [\"interface: must be an object\"] };\n  }\n  if (candidate.version !== INTERFACE_VERSION) {\n    return {\n      valid: false,\n      errors: [`interface.version: must be \"${INTERFACE_VERSION}\"`],\n    };\n  }\n\n  const check = new InterfaceChecker();\n  check.closed(candidate, TOP_LEVEL_KEYS, \"interface\");\n\n  checkRoutes(check, candidate.routes, context.mountedRoutes);\n  checkNavigation(check, candidate.navigation);\n  checkPages(check, candidate.pages);\n  if (\n    typeof candidate.docsUrl !== \"string\" ||\n    !candidate.docsUrl.startsWith(DOCS_URL_PREFIX)\n  ) {\n    check.fail(\"docsUrl\", `must start with ${DOCS_URL_PREFIX}`);\n  }\n  checkAttributes(check, candidate.attributes);\n  checkImportExport(check, candidate.importExport);\n  checkEndpoints(check, candidate.endpoints);\n\n  checkSlugList(\n    check,\n    candidate.featuredAutomationIds,\n    \"featuredAutomationIds\",\n  ).forEach((id) => {\n    if (!context.catalogIds.has(id)) {\n      check.fail(\"featuredAutomationIds\", `${id} is not a catalog entry`);\n    }\n  });\n  checkSlugList(\n    check,\n    candidate.responderIntegrationIds,\n    \"responderIntegrationIds\",\n  );\n\n  return { valid: check.errors.length === 0, errors: check.errors };\n}\n"],"mappings":";AAkBA,IAAM,IAAiB,eACjB,IAAe,4BAEf,IAAkB,+BAClB,IAAoB,kBACpB,IAA0B,wBAC1B,IAAuB,yBAEvB,IAAmB,yBAEnB,IAAsB,wBAEtB,IAAgB;CAAC;CAAU;CAAU;AAAW,GAQhD,IAGF;CACF,MAAM;EAAE,MAAM;EAAQ,UAAU;CAAK;CACrC,QAAQ;EAAE,MAAM;EAAY,UAAU;CAAM;CAC5C,OAAO;EAAE,MAAM;EAAe,UAAU;CAAM;CAC9C,SAAS;EAAE,MAAM;EAAU,UAAU;CAAM;CAC3C,UAAU;EAAE,MAAM;EAAY,UAAU;CAAM;AAChD,GACM,IAAkB,OAAO,KAAK,CAAe,GAC7C,IAAuB;CAC3B;CACA;CACA;CACA;CACA;CACA;AACF,GACM,IAAoB;CAAC;CAAU;CAAY;CAAQ;AAAS;AAgBlE,SAAS,EAAS,GAA8B;CAC9C,OAAO,OAAO,KAAU,cAAY,KAAkB,CAAC,MAAM,QAAQ,CAAK;AAC5E;AAEA,IAAM,IAAN,MAAuB;CACrB,SAA4B,CAAC;CAE7B,KAAK,GAAc,GAAuB;EAExC,OADA,KAAK,OAAO,KAAK,GAAG,EAAK,IAAI,GAAQ,GAC9B;CACT;CAGA,KAAK,GAAgB,GAAuB;EAO1C,OANI,OAAO,KAAU,YAAY,EAAM,WAAW,IACzC,KAAK,KAAK,GAAM,4BAA4B,IAEjD,EAAe,KAAK,CAAK,IACpB,KAAK,KAAK,GAAM,yBAAyB,IAE3C;CACT;CAGA,OAAO,GAAgB,GAA4B,GAAoB;EACrE,OAAO,KAAK,CAAS,EAClB,QAAQ,MAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,SAAS,MAAQ,KAAK,KAAK,GAAG,EAAK,GAAG,KAAO,gBAAgB,CAAC;CACnE;CAEA,OAAO,GAAgB,GAA4B;EAGjD,OAFI,EAAS,CAAK,IAAU,MAC5B,KAAK,KAAK,GAAM,mBAAmB,GAC5B;CACT;AACF;AAEA,SAAS,EACP,GACA,GACA,GACM;CACD,EAAM,OAAO,GAAQ,QAAQ,MAClC,EAAM,OAAO,GAAQ;EAAC;EAAQ;EAAS;CAAQ,GAAG,QAAQ,GAK1D;EAAE;EAAQ;EAAS;CAAQ,EAAY,SAAS,MAAS;EACvD,AAAI,EAAO,OAAU,EAAQ,MAC3B,EAAM,KAAK,UAAU,KAAQ,YAAY,EAAQ,GAAM,EAAE;CAE7D,CAAC;AACH;AAEA,SAAS,EAAgB,GAAyB,GAA2B;CACtE,MAAM,OAAO,GAAY,YAAY,MAC1C,EAAM,OAAO,GAAY,CAAC,WAAW,aAAa,GAAG,YAAY,GAE7D,EAAM,OAAO,EAAW,SAAS,oBAAoB,MACvD,EAAM,OAAO,EAAW,SAAS,CAAC,OAAO,GAAG,oBAAoB,GAChE,EAAM,KAAK,EAAW,QAAQ,OAAO,0BAA0B,IAE7D,EAAM,OAAO,EAAW,aAAa,wBAAwB,IAAG;EAClE,IAAM,IAAO,EAAW;EAQxB,AAPA,EAAM,OACJ,GACA;GAAC;GAAS;GAAe;EAAU,GACnC,wBACF,GACA,EAAM,KAAK,EAAK,OAAO,8BAA8B,GACrD,EAAM,KAAK,EAAK,aAAa,oCAAoC,GACjE,EAAM,KAAK,EAAK,UAAU,iCAAiC;CAC7D;AACF;AAEA,SAAS,EAAW,GAAyB,GAAsB;CAC5D,EAAM,OAAO,GAAO,OAAO,MAChC,EAAM,OAAO,GAAO;EAAC;EAAQ;EAAU;CAAM,GAAG,OAAO,GAEnD,EAAM,OAAO,EAAM,MAAM,YAAY,MACvC,EAAM,OAAO,EAAM,MAAM,CAAC,SAAS,UAAU,GAAG,YAAY,GAC5D,EAAM,KAAK,EAAM,KAAK,OAAO,kBAAkB,GAC/C,EAAM,KAAK,EAAM,KAAK,UAAU,qBAAqB,IAEnD,EAAM,OAAO,EAAM,QAAQ,cAAc,MAC3C,EAAM,OAAO,EAAM,QAAQ,CAAC,WAAW,GAAG,cAAc,GACxD,EAAM,KAAK,EAAM,OAAO,WAAW,wBAAwB,IAEzD,EAAM,OAAO,EAAM,MAAM,YAAY,MACvC,EAAM,OAAO,EAAM,MAAM,CAAC,OAAO,GAAG,YAAY,GAChD,EAAM,KAAK,EAAM,KAAK,OAAO,kBAAkB;AAEnD;AAEA,SAAS,EACP,GACA,GACA,GACA,GACM;CACN,IAAI,CAAC,EAAM,OAAO,GAAW,CAAI,GAAG;CACpC,EAAM,OACJ,GACA;EAAC;EAAQ;EAAS;EAAQ;EAAY;CAAa,GACnD,CACF;CAEA,IAAM,EAAE,SAAM,UAAO,SAAM,aAAU,mBAAgB;CAgBrD,IAfI,MAAS,EAAK,QAChB,EAAM,KACJ,GAAG,EAAK,QACR,YAAY,EAAK,KAAK,iCACxB,GAEF,EAAM,KAAK,GAAO,GAAG,EAAK,OAAO,GAC7B,MAAS,KAAA,KAAW,EAAM,KAAK,GAAM,GAAG,EAAK,MAAM,GACnD,MAAa,EAAK,YACpB,EAAM,KACJ,GAAG,EAAK,YACR,WAAW,EAAK,SAAS,0BAC3B,GAGE,MAAgB,KAAA;MACd,EAAK,SAAS,UAChB,EAAM,KACJ,GAAG,EAAK,eACR,uCACF;OACK,IAAI,EAAM,OAAO,GAAa,GAAG,EAAK,aAAa,GAAG;GAC3D,EAAM,OAAO,GAAa,CAAC,OAAO,KAAK,GAAG,GAAG,EAAK,aAAa;GAC/D,IAAM,EAAE,QAAK,WAAQ;GASrB,AANI,MAAQ,KAAA,KAAa,MAAQ,KAC/B,EAAM,KACJ,GAAG,EAAK,mBACR,kCACF,GAGA,MAAQ,KAAA,MACP,CAAC,OAAO,UAAU,CAAG,KAAM,IAAiB,MAE7C,EAAM,KAAK,GAAG,EAAK,mBAAmB,4BAA4B;EAEtE;;AAEJ;AAEA,SAAS,EAAgB,GAAyB,GAA2B;CAC3E,IAAI,CAAC,EAAM,OAAO,GAAY,YAAY,GAAG;CAC7C,IAAM,IAAQ,OAAO,KAAK,CAAU;CAIpC,AAHI,EAAM,WAAW,KACnB,EAAM,KAAK,cAAc,qCAAqC,GAEhE,EAAM,SAAS,MAAS;EACtB,IAAI,CAAC,EAAgB,SAAS,CAAI,GAAG;GACnC,EAAM,KAAK,cAAc,KAAQ,6BAA6B;GAC9D;EACF;EACA,EACE,GACA,EAAgB,IAChB,EAAW,IACX,cAAc,GAChB;CACF,CAAC;AACH;AAEA,SAAS,EACP,GACA,GACM;CACN,IAAI,CAAC,EAAM,OAAO,GAAc,cAAc,GAAG;CACjD,EAAM,OACJ,GACA;EAAC;EAAY;EAAe;EAAkB;CAAgB,GAC9D,cACF;CAEA,IAAM,EAAE,aAAU,gBAAa,mBAAgB,sBAC7C;CAaF,CAZI,OAAO,KAAa,YAAY,CAAC,EAAkB,KAAK,CAAQ,MAClE,EAAM,KAAK,yBAAyB,0BAA0B,GAE5D,MAAgB,KAClB,EAAM,KAAK,4BAA4B,WAAW,IAGlD,OAAO,KAAmB,YAC1B,CAAC,EAAwB,KAAK,CAAc,MAE5C,EAAM,KAAK,+BAA+B,wBAAwB,GAEhE,EAAM,OAAO,GAAgB,6BAA6B,MAC5D,EAAM,OACJ,GACA,CAAC,gBAAgB,wBAAwB,GACzC,6BACF,IAEE,OAAO,EAAe,gBAAiB,YACvC,CAAE,EAAoC,SACpC,EAAe,YACjB,MAEA,EAAM,KACJ,4CACA,6BACF,IAGA,OAAO,EAAe,0BAA2B,YACjD,CAAC,EAAqB,KAAK,EAAe,sBAAsB,MAEhE,EAAM,KACJ,sDACA,kCACF;AAGN;AAEA,SAAS,EAAe,GAAyB,GAA0B;CACzE,IAAI,CAAC,EAAM,OAAO,GAAW,WAAW,GAAG;CAC3C,IAAM,IAAU,CAAC,GAAG,GAAsB,GAAG,CAAiB;CAC9D,EAAM,OAAO,GAAW,GAAS,WAAW;CAE5C,IAAM,KAAc,MAAgC;EAClD,IAAM,IAAQ,EAAU;EASxB,OAPE,OAAO,KAAU,YACjB,CAAC,EAAiB,KAAK,CAAK,KAC5B,EAAM,SAAS,IAAI,KAEnB,EAAM,KAAK,aAAa,KAAQ,wCAAwC,GACjE,QAEF;CACT;CAQA,AANA,EAAqB,SAAS,MAAS;EACrC,IAAM,IAAQ,EAAW,CAAI;EAC7B,AAAI,MAAU,QAAQ,OAAO,KAAK,CAAK,KACrC,EAAM,KAAK,aAAa,KAAQ,+BAA+B;CAEnE,CAAC,GACD,EAAkB,SAAS,MAAS;EAClC,IAAM,IAAQ,EAAW,CAAI;EAC7B,AAAI,MAAU,QAAQ,CAAC,EAAoB,KAAK,CAAK,KACnD,EAAM,KAAK,aAAa,KAAQ,6BAA6B;CAEjE,CAAC;AACH;AAEA,SAAS,EACP,GACA,GACA,GACU;CACV,IAAI,CAAC,MAAM,QAAQ,CAAK,KAAK,EAAM,WAAW,GAE5C,OADA,EAAM,KAAK,GAAM,2BAA2B,GACrC,CAAC;CAEV,IAAM,IAAQ,EAAM,QAAQ,MACtB,OAAO,KAAS,YAAY,EAAa,KAAK,CAAI,IAAU,MAChE,EAAM,KAAK,GAAM,mCAAmC,GAC7C,GACR;CAID,OAHI,IAAI,IAAI,CAAK,EAAE,SAAS,EAAM,UAChC,EAAM,KAAK,GAAM,uBAAuB,GAEnC;AACT;AAEA,IAAM,IAAiB;CACrB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAQA,SAAgB,EACd,GACA,GAC2B;CAC3B,IAAI,CAAC,EAAS,CAAS,GACrB,OAAO;EAAE,OAAO;EAAO,QAAQ,CAAC,8BAA8B;CAAE;CAElE,IAAI,EAAU,YAAA,OACZ,OAAO;EACL,OAAO;EACP,QAAQ,CAAC,oCAAmD;CAC9D;CAGF,IAAM,IAAQ,IAAI,EAAiB;CA+BnC,OA9BA,EAAM,OAAO,GAAW,GAAgB,WAAW,GAEnD,EAAY,GAAO,EAAU,QAAQ,EAAQ,aAAa,GAC1D,EAAgB,GAAO,EAAU,UAAU,GAC3C,EAAW,GAAO,EAAU,KAAK,IAE/B,OAAO,EAAU,WAAY,YAC7B,CAAC,EAAU,QAAQ,WAAW,CAAe,MAE7C,EAAM,KAAK,WAAW,mBAAmB,GAAiB,GAE5D,EAAgB,GAAO,EAAU,UAAU,GAC3C,EAAkB,GAAO,EAAU,YAAY,GAC/C,EAAe,GAAO,EAAU,SAAS,GAEzC,EACE,GACA,EAAU,uBACV,uBACF,EAAE,SAAS,MAAO;EAChB,AAAK,EAAQ,WAAW,IAAI,CAAE,KAC5B,EAAM,KAAK,yBAAyB,GAAG,EAAG,wBAAwB;CAEtE,CAAC,GACD,EACE,GACA,EAAU,yBACV,yBACF,GAEO;EAAE,OAAO,EAAM,OAAO,WAAW;EAAG,QAAQ,EAAM;CAAO;AAClE"}

package/dist/manifests/manifest-actions.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The action bridge — the only channel through which a manifest can make this
+ * host *do* something.
+ *
+ * A manifest is data from another repository, so it never describes a request.
+ * It chooses between the two outcomes this host offers, and it chooses by
+ * declaring a `mode`: a direct entry produces a create request the host derives,
+ * an assisted entry hands setup to a conversation.
+ */
+import type { SetupEntry, SetupFormValues, SetupRequestBody } from "./types";
+export interface SetupActionResult {
+    /** The created resource, or the conversation that will finish setup. */
+    response: Record<string, unknown>;
+}
+export declare function useSetupAction(): (entry: SetupEntry, values: SetupFormValues, payload: SetupRequestBody | null) => Promise<SetupActionResult>;

package/dist/manifests/manifest-capabilities.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Stage 2 — decide whether a deployment can run what a manifest requires.
+ *
+ * The manifest states what it needs — the features under `requires.features`,
+ * and, implicitly, the trigger kinds its form declares. The deployment states
+ * what it supports. Neither side is interpreted here beyond set membership, so
+ * this stays neutral about what any particular capability means.
+ */
+import type { DeploymentCapabilities, SetupEntry } from "./types";
+/**
+ * "unknown" is a real outcome, not an error: a deployment that cannot be asked
+ * must not be treated as one that answered no.
+ */
+export type SetupCapabilitySupport = boolean | "unknown";
+export interface SetupCapabilityAssessment {
+    supported: boolean;
+    /**
+     * Requirement names the deployment did not report, so a block can say which
+     * ones rather than only that there were some. Empty when a deployment that
+     * reports it is not accepting work blocks the entry, because then no single
+     * requirement is the reason.
+     */
+    unmet: string[];
+}
+export declare function assessCapabilityRequirements(entry: SetupEntry, reported: DeploymentCapabilities): SetupCapabilityAssessment;