@openhands/agent-canvas 1.8.0 → 1.9.0

package/dist/manifests/manifest-error-map.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Translate service-reported errors back to the form field that produced them.
+ *
+ * The host validates and submits the *derived payload*, so errors come back
+ * addressed by payload path (`trigger.schedule`) rather than by form field
+ * (`schedule`). The reverse lookup is derived from the same builder that made
+ * the payload; the mapping is lossy by nature, since one payload value can be
+ * built from several fields.
+ */
+import type { SetupRequestBody } from "./types";
+/** An error the service reported, addressed by payload path where it gave one. */
+export interface ManifestServiceError {
+    path: string;
+    message: string;
+}
+export interface MappedManifestErrors {
+    /** Keyed by form field name. */
+    fieldErrors: Record<string, string>;
+    /** Errors with no field to attach to; shown against the form as a whole. */
+    formErrors: string[];
+}
+/**
+ * Turn a service `loc` array into a path into the payload actually sent.
+ *
+ * A validation framework may address a value through segments that are not keys
+ * of the request body — a discriminated union reports
+ * `["body","trigger","cron","schedule"]` for a body whose trigger has no `cron`
+ * key. Walking the payload and skipping segments that do not resolve reduces
+ * that to `trigger.schedule` without knowing anything about the payload's
+ * meaning.
+ */
+export declare function locToPayloadPath(loc: readonly (string | number)[], payload: unknown): string;
+/**
+ * Read errors out of a service response body, whichever of the two shapes it
+ * uses: a preflight result keyed by field, or a validation failure keyed by
+ * `loc`.
+ */
+export declare function normalizeServiceErrors(body: unknown, payload: SetupRequestBody | null): ManifestServiceError[];
+/** Apply the derived payload-path map, falling back to a form-level error. */
+export declare function mapServiceErrors(errors: readonly ManifestServiceError[], errorMap: Record<string, string[]>): MappedManifestErrors;

package/dist/manifests/manifest-local-validation.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The form model, and the host's own check of what the user typed into it.
+ *
+ * Local validation is a convenience, not the authority: it is instant and needs
+ * no round trip, so it catches empty required fields and obvious typos.
+ * Deployment-specific questions ("is a one-minute schedule allowed here?")
+ * belong to preflight, which is authoritative.
+ *
+ * Errors are returned as codes rather than sentences so the host can render
+ * them through its own translations; only manifest-authored copy is literal.
+ */
+import type { DeploymentCapabilities, SetupBlock, SetupFieldOption, SetupFormField, SetupFormFields, SetupFormValues } from "./types";
+export type SetupFieldError = {
+    code: "required";
+} | {
+    code: "minLength";
+    length: number;
+} | {
+    code: "maxLength";
+    length: number;
+} | {
+    code: "invalidOption";
+} | {
+    code: "unsafeExpressionLiteral";
+};
+export type SetupFieldErrors = Record<string, SetupFieldError>;
+/** Field constraints supplied by the deployment rather than by the manifest. */
+export interface SetupFieldOverride {
+    options?: SetupFieldOption[];
+}
+export type SetupFieldOverrides = Record<string, SetupFieldOverride>;
+/**
+ * Every input the form declares, keyed by name, whichever half it is in.
+ *
+ * Trigger inputs come first so the user is asked when it runs before what it
+ * runs on, and so every derived view of the form keeps that order. Admission
+ * rejects a name declared in both halves, so the merge cannot lose a field.
+ */
+export declare function collectFields(setup: SetupBlock): SetupFormFields;
+/**
+ * Feed deployment values into form field constraints, so the form offers only
+ * what the deployment accepts.
+ *
+ * A `timezone` field is the case that needs it: a manifest declares no options
+ * for one, because the accepted zones belong to the deployment. The cron
+ * interval floor is deliberately left to preflight — the deployment owns that
+ * limit and states it in its own words, and a local approximation would
+ * pre-empt the authoritative message with a worse one.
+ */
+export declare function resolveFieldOverrides(setup: SetupBlock, capabilities: DeploymentCapabilities | null): SetupFieldOverrides;
+/** The options a field offers, after deployment constraints are applied. */
+export declare function getFieldOptions(name: string, field: SetupFormField, overrides?: SetupFieldOverrides): SetupFieldOption[];
+/** Initial form state: every declared field, seeded with its declared default. */
+export declare function getInitialFormValues(setup: SetupBlock): SetupFormValues;
+/** Check every declared field. Returns only the fields that failed. */
+export declare function validateFormValues(setup: SetupBlock, values: SetupFormValues, overrides?: SetupFieldOverrides): SetupFieldErrors;

package/dist/manifests/manifest-registry.cjs

@@ -0,0 +1,2 @@
+require("../_virtual/_rolldown/runtime.cjs");const e=require("./manifest-validation.cjs");function t(t){let n=[],r=new Map;return t.forEach(t=>{if(!e.hasSetupBlock(t))return;let{valid:i,errors:a}=e.validateSetupEntry(t);if(!i){console.warn(`Rejected a setup manifest:`,a.join(`; `));return}let o=t;if(r.has(o.id)){console.warn(`Rejected a setup manifest: id "${o.id}" is already registered`);return}n.push(o),r.set(o.id,o)}),{entries:n,findById:e=>r.get(e)??null}}exports.createSetupRegistry=t;
+//# sourceMappingURL=manifest-registry.cjs.map

package/dist/manifests/manifest-registry.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-registry.cjs","names":[],"sources":["../../src/manifests/manifest-registry.ts"],"sourcesContent":["/**\n * Registry of admitted setup manifests.\n *\n * Stage 1 of the setup flow: load the catalog, decide which entries this host\n * will act on, and index the survivors by id. An entry that fails admission is\n * dropped entirely rather than rendered partially, because everything\n * downstream treats its content as instructions.\n */\n\nimport { hasSetupBlock, validateSetupEntry } from \"./manifest-validation\";\nimport type { SetupEntry } from \"./types\";\n\nexport interface SetupRegistry {\n  /** Entries this host has admitted, in source order. */\n  readonly entries: readonly SetupEntry[];\n  findById(id: string): SetupEntry | null;\n}\n\nexport function createSetupRegistry(\n  candidates: readonly unknown[],\n): SetupRegistry {\n  const entries: SetupEntry[] = [];\n  const byId = new Map<string, SetupEntry>();\n\n  candidates.forEach((candidate) => {\n    // A catalog entry without a setup block is a card, not a setup experience.\n    // That is the normal case, so it is skipped rather than reported.\n    if (!hasSetupBlock(candidate)) return;\n\n    const { valid, errors } = validateSetupEntry(candidate);\n    if (!valid) {\n      console.warn(\"Rejected a setup manifest:\", errors.join(\"; \"));\n      return;\n    }\n\n    const entry = candidate as SetupEntry;\n    if (byId.has(entry.id)) {\n      console.warn(\n        `Rejected a setup manifest: id \"${entry.id}\" is already registered`,\n      );\n      return;\n    }\n\n    entries.push(entry);\n    byId.set(entry.id, entry);\n  });\n\n  return {\n    entries,\n    findById: (id) => byId.get(id) ?? null,\n  };\n}\n"],"mappings":"0FAkBA,SAAgB,EACd,EACe,CACf,IAAM,EAAwB,CAAC,EACzB,EAAO,IAAI,IAyBjB,OAvBA,EAAW,QAAS,GAAc,CAGhC,GAAI,CAAC,EAAA,cAAc,CAAS,EAAG,OAE/B,GAAM,CAAE,QAAO,UAAW,EAAA,mBAAmB,CAAS,EACtD,GAAI,CAAC,EAAO,CACV,QAAQ,KAAK,6BAA8B,EAAO,KAAK,IAAI,CAAC,EAC5D,MACF,CAEA,IAAM,EAAQ,EACd,GAAI,EAAK,IAAI,EAAM,EAAE,EAAG,CACtB,QAAQ,KACN,kCAAkC,EAAM,GAAG,wBAC7C,EACA,MACF,CAEA,EAAQ,KAAK,CAAK,EAClB,EAAK,IAAI,EAAM,GAAI,CAAK,CAC1B,CAAC,EAEM,CACL,UACA,SAAW,GAAO,EAAK,IAAI,CAAE,GAAK,IACpC,CACF"}

package/dist/manifests/manifest-registry.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Registry of admitted setup manifests.
+ *
+ * Stage 1 of the setup flow: load the catalog, decide which entries this host
+ * will act on, and index the survivors by id. An entry that fails admission is
+ * dropped entirely rather than rendered partially, because everything
+ * downstream treats its content as instructions.
+ */
+import type { SetupEntry } from "./types";
+export interface SetupRegistry {
+    /** Entries this host has admitted, in source order. */
+    readonly entries: readonly SetupEntry[];
+    findById(id: string): SetupEntry | null;
+}
+export declare function createSetupRegistry(candidates: readonly unknown[]): SetupRegistry;

package/dist/manifests/manifest-registry.js

@@ -0,0 +1,26 @@
+import { hasSetupBlock as e, validateSetupEntry as t } from "./manifest-validation.js";
+//#region src/manifests/manifest-registry.ts
+function n(n) {
+	let r = [], i = /* @__PURE__ */ new Map();
+	return n.forEach((n) => {
+		if (!e(n)) return;
+		let { valid: a, errors: o } = t(n);
+		if (!a) {
+			console.warn("Rejected a setup manifest:", o.join("; "));
+			return;
+		}
+		let s = n;
+		if (i.has(s.id)) {
+			console.warn(`Rejected a setup manifest: id "${s.id}" is already registered`);
+			return;
+		}
+		r.push(s), i.set(s.id, s);
+	}), {
+		entries: r,
+		findById: (e) => i.get(e) ?? null
+	};
+}
+//#endregion
+export { n as createSetupRegistry };
+
+//# sourceMappingURL=manifest-registry.js.map

package/dist/manifests/manifest-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-registry.js","names":[],"sources":["../../src/manifests/manifest-registry.ts"],"sourcesContent":["/**\n * Registry of admitted setup manifests.\n *\n * Stage 1 of the setup flow: load the catalog, decide which entries this host\n * will act on, and index the survivors by id. An entry that fails admission is\n * dropped entirely rather than rendered partially, because everything\n * downstream treats its content as instructions.\n */\n\nimport { hasSetupBlock, validateSetupEntry } from \"./manifest-validation\";\nimport type { SetupEntry } from \"./types\";\n\nexport interface SetupRegistry {\n  /** Entries this host has admitted, in source order. */\n  readonly entries: readonly SetupEntry[];\n  findById(id: string): SetupEntry | null;\n}\n\nexport function createSetupRegistry(\n  candidates: readonly unknown[],\n): SetupRegistry {\n  const entries: SetupEntry[] = [];\n  const byId = new Map<string, SetupEntry>();\n\n  candidates.forEach((candidate) => {\n    // A catalog entry without a setup block is a card, not a setup experience.\n    // That is the normal case, so it is skipped rather than reported.\n    if (!hasSetupBlock(candidate)) return;\n\n    const { valid, errors } = validateSetupEntry(candidate);\n    if (!valid) {\n      console.warn(\"Rejected a setup manifest:\", errors.join(\"; \"));\n      return;\n    }\n\n    const entry = candidate as SetupEntry;\n    if (byId.has(entry.id)) {\n      console.warn(\n        `Rejected a setup manifest: id \"${entry.id}\" is already registered`,\n      );\n      return;\n    }\n\n    entries.push(entry);\n    byId.set(entry.id, entry);\n  });\n\n  return {\n    entries,\n    findById: (id) => byId.get(id) ?? null,\n  };\n}\n"],"mappings":";;AAkBA,SAAgB,EACd,GACe;CACf,IAAM,IAAwB,CAAC,GACzB,oBAAO,IAAI,IAAwB;CAyBzC,OAvBA,EAAW,SAAS,MAAc;EAGhC,IAAI,CAAC,EAAc,CAAS,GAAG;EAE/B,IAAM,EAAE,UAAO,cAAW,EAAmB,CAAS;EACtD,IAAI,CAAC,GAAO;GACV,QAAQ,KAAK,8BAA8B,EAAO,KAAK,IAAI,CAAC;GAC5D;EACF;EAEA,IAAM,IAAQ;EACd,IAAI,EAAK,IAAI,EAAM,EAAE,GAAG;GACtB,QAAQ,KACN,kCAAkC,EAAM,GAAG,wBAC7C;GACA;EACF;EAGA,AADA,EAAQ,KAAK,CAAK,GAClB,EAAK,IAAI,EAAM,IAAI,CAAK;CAC1B,CAAC,GAEM;EACL;EACA,WAAW,MAAO,EAAK,IAAI,CAAE,KAAK;CACpC;AACF"}

package/dist/manifests/manifest-sources.cjs

@@ -0,0 +1,2 @@
+require("../_virtual/_rolldown/runtime.cjs");const e=require("../node_modules/@openhands/extensions/automations/index.cjs");require("./manifest-registry.cjs").createSetupRegistry(e.default);var t=e.automations_exports,n=`AUTOMATION_INTERFACE`in t?t.AUTOMATION_INTERFACE:void 0;exports.AUTOMATION_INTERFACE_CANDIDATE=n;
+//# sourceMappingURL=manifest-sources.cjs.map

package/dist/manifests/manifest-sources.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-sources.cjs","names":[],"sources":["../../src/manifests/manifest-sources.ts"],"sourcesContent":["/**\n * The one place that decides which manifests this host is offered.\n *\n * Setup manifests are published by `@openhands/extensions` as an optional\n * `setup` block on a catalog entry, so the catalog is the whole source. Entries\n * without one are skipped, which means the pinned package deciding to ship them\n * is the only step left — there is no wiring to add here.\n *\n * The catalog is passed as `unknown[]` on purpose: admission is a trust\n * boundary, so the host validates the published data rather than trusting the\n * types that shipped beside it.\n */\n\nimport * as automationsModule from \"@openhands/extensions/automations\";\nimport { AUTOMATION_CATALOG } from \"@openhands/extensions/automations\";\nimport { createSetupRegistry, type SetupRegistry } from \"./manifest-registry\";\n\nexport const SETUP_REGISTRY: SetupRegistry = createSetupRegistry(\n  AUTOMATION_CATALOG as readonly unknown[],\n);\n\n/**\n * The interface manifest the pinned package publishes, if any. It is read off\n * the module namespace so a package that predates the export yields\n * `undefined` rather than a build error; admission in\n * `automation-interface.ts` decides what to do with it.\n */\nconst automationsExports: object = automationsModule;\nexport const AUTOMATION_INTERFACE_CANDIDATE: unknown =\n  \"AUTOMATION_INTERFACE\" in automationsExports\n    ? automationsExports.AUTOMATION_INTERFACE\n    : undefined;\n"],"mappings":"6JAiB6C,EAAA,oBAC3C,EAAA,OACF,EAQA,IAAM,EAA6B,EAAA,oBACtB,EACX,yBAA0B,EACtB,EAAmB,qBACnB,IAAA"}

package/dist/manifests/manifest-sources.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The one place that decides which manifests this host is offered.
+ *
+ * Setup manifests are published by `@openhands/extensions` as an optional
+ * `setup` block on a catalog entry, so the catalog is the whole source. Entries
+ * without one are skipped, which means the pinned package deciding to ship them
+ * is the only step left — there is no wiring to add here.
+ *
+ * The catalog is passed as `unknown[]` on purpose: admission is a trust
+ * boundary, so the host validates the published data rather than trusting the
+ * types that shipped beside it.
+ */
+import { type SetupRegistry } from "./manifest-registry";
+export declare const SETUP_REGISTRY: SetupRegistry;
+export declare const AUTOMATION_INTERFACE_CANDIDATE: unknown;

package/dist/manifests/manifest-sources.js

@@ -0,0 +1,8 @@
+import e, { automations_exports as t } from "../node_modules/@openhands/extensions/automations/index.js";
+import { createSetupRegistry as n } from "./manifest-registry.js";
+n(e);
+var r = t, i = "AUTOMATION_INTERFACE" in r ? r.AUTOMATION_INTERFACE : void 0;
+//#endregion
+export { i as AUTOMATION_INTERFACE_CANDIDATE };
+
+//# sourceMappingURL=manifest-sources.js.map

package/dist/manifests/manifest-sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-sources.js","names":[],"sources":["../../src/manifests/manifest-sources.ts"],"sourcesContent":["/**\n * The one place that decides which manifests this host is offered.\n *\n * Setup manifests are published by `@openhands/extensions` as an optional\n * `setup` block on a catalog entry, so the catalog is the whole source. Entries\n * without one are skipped, which means the pinned package deciding to ship them\n * is the only step left — there is no wiring to add here.\n *\n * The catalog is passed as `unknown[]` on purpose: admission is a trust\n * boundary, so the host validates the published data rather than trusting the\n * types that shipped beside it.\n */\n\nimport * as automationsModule from \"@openhands/extensions/automations\";\nimport { AUTOMATION_CATALOG } from \"@openhands/extensions/automations\";\nimport { createSetupRegistry, type SetupRegistry } from \"./manifest-registry\";\n\nexport const SETUP_REGISTRY: SetupRegistry = createSetupRegistry(\n  AUTOMATION_CATALOG as readonly unknown[],\n);\n\n/**\n * The interface manifest the pinned package publishes, if any. It is read off\n * the module namespace so a package that predates the export yields\n * `undefined` rather than a build error; admission in\n * `automation-interface.ts` decides what to do with it.\n */\nconst automationsExports: object = automationsModule;\nexport const AUTOMATION_INTERFACE_CANDIDATE: unknown =\n  \"AUTOMATION_INTERFACE\" in automationsExports\n    ? automationsExports.AUTOMATION_INTERFACE\n    : undefined;\n"],"mappings":";;AAiB6C,EAC3C,CACF;AAQA,IAAM,IAA6B,GACtB,IACX,0BAA0B,IACtB,EAAmB,uBACnB,KAAA"}

package/dist/manifests/manifest-template.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Placeholder interpolation for setup copy and request-body strings.
+ *
+ * A setup block declares what the user sees and the two request strings the
+ * host cannot derive as templates over a small set of namespaces. Interpolation
+ * is plain substitution — there is no expression language, so a setup block
+ * cannot express behavior here.
+ */
+import type { SetupEntry, SetupFormValues } from "./types";
+export interface SetupScope {
+    form?: SetupFormValues;
+    /** The catalog entry the setup block belongs to. */
+    automation?: SetupEntry;
+}
+/** Walk a dotted path through plain objects. */
+export declare function getByPath(source: unknown, path: string): unknown;
+/** Substitute placeholders inside a template string. */
+export declare function interpolateText(template: string, scope: SetupScope): string;

package/dist/manifests/manifest-validation.cjs

@@ -0,0 +1,2 @@
+require("../_virtual/_rolldown/runtime.cjs");const e=require("./types.cjs");var t=/^[a-z0-9]+(-[a-z0-9]+)*$/,n=/^[a-z][A-Za-z0-9]*$/,r=/<[A-Za-z/!]/,i=RegExp(`\\{\\{(?!(?:${e.SETUP_PLACEHOLDER_NAMESPACES.join(`|`)})\\.[A-Za-z0-9_.]+\\}\\})`),a=[`direct`,`assisted`],o=[`text`,`textarea`,`select`,`cron`,`timezone`,`repo-picker`],s=[`github`,`gitlab`,`bitbucket`],c=[`cron`,`event`],l=[`safeExpressionLiteral`],u=2e3;function d(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function f(e,t){return typeof e==`string`&&t.includes(e)}function p(e,t){return typeof e==`number`&&Number.isInteger(e)&&e>=t}var m=class{errors=[];fail(e,t){return this.errors.push(`${e}: ${t}`),!1}copy(e,t){return typeof e!=`string`||e.length===0?this.fail(t,`must be a non-empty string`):r.test(e)?this.fail(t,`must not contain markup`):!0}placeholders(e,t){return i.test(e)?this.fail(t,`uses an unknown placeholder namespace`):!0}templateCopy(e,t){return this.copy(e,t)&&this.placeholders(e,t)}templateValue(e,t){return typeof e!=`string`||e.length===0?this.fail(t,`must be a non-empty string`):this.placeholders(e,t)}absent(e,t,n,r){return t in e?this.fail(`${n}.${t}`,r):!0}};function h(e,t){if(!d(t)){e.fail(`requires`,`must be an object`);return}let{integrations:n,features:r}=t;!d(n)||Object.keys(n).length===0?e.fail(`requires.integrations`,`must be a non-empty object`):Object.entries(n).forEach(([t,n])=>{let r=`requires.integrations.${t}`;if(!d(n)){e.fail(r,`must be an object`);return}e.copy(n.message,`${r}.message`),`required`in n&&n.required!==!1&&e.fail(`${r}.required`,`may only be false`);let i=[`message`,`required`];Object.keys(n).filter(e=>!i.includes(e)).forEach(t=>e.fail(`${r}.${t}`,`is not allowed`))}),r!==void 0&&(!Array.isArray(r)||r.length===0?e.fail(`requires.features`,`must be a non-empty array`):r.forEach((t,n)=>{(typeof t!=`string`||t.length===0)&&e.fail(`requires.features[${n}]`,`must be a non-empty string`)}))}function g(e,t,n){if(!d(t)||Object.keys(t).length===0){e.fail(n,`must be a non-empty object`);return}let{minLength:r,maxLength:i,format:a}=t;r!==void 0&&!p(r,0)&&e.fail(`${n}.minLength`,`must be a non-negative integer`),i!==void 0&&!p(i,1)&&e.fail(`${n}.maxLength`,`must be a positive integer`),a!==void 0&&!f(a,l)&&e.fail(`${n}.format`,`is not a supported format`)}function _(e,t,n){if(!d(t)){e.fail(n,`must be an object`);return}let{type:r,label:i,help:a,placeholder:c,required:l,provider:u,options:p}=t;f(r,o)||e.fail(`${n}.type`,`is not a supported field type`),e.copy(i,`${n}.label`),e.copy(a,`${n}.help`),c!==void 0&&e.copy(c,`${n}.placeholder`),t.default!==void 0&&typeof t.default!=`string`&&e.fail(`${n}.default`,`must be a string`),typeof l!=`boolean`&&e.fail(`${n}.required`,`must be a boolean`),u!==void 0&&!f(u,s)&&e.fail(`${n}.provider`,`is not a supported provider`),r===`repo-picker`&&u===void 0&&e.fail(`${n}.provider`,`is required for a repository field`),p!==void 0&&(r===`select`?!Array.isArray(p)||p.length===0?e.fail(`${n}.options`,`must be a non-empty array`):p.forEach((t,r)=>{let i=`${n}.options[${r}]`;if(!d(t)){e.fail(i,`must be an object`);return}(typeof t.value!=`string`||t.value.length===0)&&e.fail(`${i}.value`,`must be a non-empty string`),e.copy(t.label,`${i}.label`)}):e.fail(`${n}.options`,`is only allowed on a select field`)),t.constraints!==void 0&&g(e,t.constraints,`${n}.constraints`)}function v(e,t,r){return!d(t)||Object.keys(t).length===0?(e.fail(r,`must be a non-empty object`),[]):Object.entries(t).map(([t,i])=>(n.test(t)||e.fail(`${r}.${t}`,`is not a valid field name`),_(e,i,`${r}.${t}`),t))}function y(e,t){if(!d(t))return e.fail(`setup.form`,`must be an object`),[];t.note!==void 0&&e.copy(t.note,`setup.form.note`);let n=v(e,t.args,`setup.form.args`),r=[];t.triggers!==void 0&&(!d(t.triggers)||Object.keys(t.triggers).length===0?e.fail(`setup.form.triggers`,`must be a non-empty object`):Object.entries(t.triggers).forEach(([t,i])=>{if(!f(t,c)){e.fail(`setup.form.triggers.${t}`,`is not a trigger kind`);return}r.push(t),n.push(...v(e,i,`setup.form.triggers.${t}`))}));let i=n.filter((e,t)=>n.indexOf(e)!==t);return Array.from(new Set(i)).forEach(t=>e.fail(`setup.form.${t}`,`is declared more than once`)),r}function b(e){return d(e)?[e.args,...Object.values(d(e.triggers)?e.triggers:{})].some(e=>d(e)&&Object.values(e).some(e=>d(e)&&e.type===`repo-picker`)):!1}function x(e,t){e.templateCopy(t,`setup.message`)&&t.length>u&&e.fail(`setup.message`,`must be at most ${u} characters`)}function S(e,t,n){if(!f(t.mode,a)){e.fail(`setup.mode`,`is not a supported mode`);return}if(t.mode===`direct`){e.templateValue(t.prompt,`setup.prompt`),t.message!==void 0&&x(e,t.message),n.length!==1&&e.fail(`setup.form.triggers`,`must declare exactly one trigger kind`),n.includes(`event`)&&!b(t.form)&&e.fail(`setup.form`,`must declare a repository field for an event trigger`),t.filter!==void 0&&(n.includes(`event`)?e.templateValue(t.filter,`setup.filter`):e.fail(`setup.filter`,`is only allowed for an event trigger`));return}x(e,t.message),e.absent(t,`prompt`,`setup`,`is only allowed for direct setup`),e.absent(t,`filter`,`setup`,`is only allowed for direct setup`)}function C(e){return d(e)&&e.setup!==void 0}function w(e){let n=new m;if(!d(e))return{valid:!1,errors:[`manifest: must be an object`]};let{setup:r}=e;return d(r)?r.version===`1.0`?((typeof e.id!=`string`||!t.test(e.id))&&n.fail(`id`,`must be a lowercase slug`),n.copy(e.name,`name`),n.copy(e.description,`description`),e.skill!==void 0&&(typeof e.skill!=`string`||!t.test(e.skill))&&n.fail(`skill`,`must be a lowercase slug`),h(n,e.requires),S(n,r,y(n,r.form)),{valid:n.errors.length===0,errors:n.errors}):{valid:!1,errors:[`setup.version: must be "1.0"`]}:{valid:!1,errors:[`setup: must be an object`]}}exports.hasSetupBlock=C,exports.validateSetupEntry=w;
+//# sourceMappingURL=manifest-validation.cjs.map

package/dist/manifests/manifest-validation.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-validation.cjs","names":[],"sources":["../../src/manifests/manifest-validation.ts"],"sourcesContent":["/**\n * Admission policy for extension-authored catalog manifests.\n *\n * A manifest is data authored in a different repository that instructs this host\n * to render copy and compose a request. The host therefore decides what a\n * manifest is *permitted* to do rather than trusting the file — validation here\n * is a trust boundary, not a convenience check, and it deliberately does not\n * defer to a schema shipped alongside the manifests it would be validating.\n *\n * Beyond mirroring the published schema, this adds the invariants the host's own\n * derivation depends on: a single trigger kind to read, a repository field for\n * an event trigger's source, and field names unique across the form. Without\n * them the derived request body would be silently wrong rather than rejected.\n *\n * A manifest that fails any check is rejected outright. It never renders a\n * partial UI, because everything downstream treats its content as instructions.\n */\n\nimport { SETUP_PLACEHOLDER_NAMESPACES, SETUP_VERSION } from \"./types\";\n\nconst ENTRY_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;\nconst FIELD_NAME_PATTERN = /^[a-z][A-Za-z0-9]*$/;\n/** Copy must never be able to inject markup into the host. */\nconst MARKUP_PATTERN = /<[A-Za-z/!]/;\n/** Every `{{` must open a known namespace and close immediately. */\nconst UNKNOWN_PLACEHOLDER_PATTERN = new RegExp(\n  `\\\\{\\\\{(?!(?:${SETUP_PLACEHOLDER_NAMESPACES.join(\"|\")})\\\\.[A-Za-z0-9_.]+\\\\}\\\\})`,\n);\n\nconst SETUP_MODES = [\"direct\", \"assisted\"] as const;\nconst FIELD_TYPES = [\n  \"text\",\n  \"textarea\",\n  \"select\",\n  \"cron\",\n  \"timezone\",\n  \"repo-picker\",\n] as const;\nconst GIT_PROVIDERS = [\"github\", \"gitlab\", \"bitbucket\"] as const;\nconst TRIGGER_KINDS = [\"cron\", \"event\"] as const;\nconst CONSTRAINT_FORMATS = [\"safeExpressionLiteral\"] as const;\n\n/** Setup context only, so this can never become a channel for runtime instructions. */\nconst MAX_MESSAGE_LENGTH = 2000;\n\nexport interface SetupValidationResult {\n  valid: boolean;\n  errors: string[];\n}\n\ntype Rec = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is Rec {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isOneOf<T extends readonly string[]>(\n  value: unknown,\n  allowed: T,\n): value is T[number] {\n  return (\n    typeof value === \"string\" && (allowed as readonly string[]).includes(value)\n  );\n}\n\nfunction isInteger(value: unknown, minimum: number): boolean {\n  return (\n    typeof value === \"number\" && Number.isInteger(value) && value >= minimum\n  );\n}\n\nclass SetupChecker {\n  readonly errors: string[] = [];\n\n  fail(path: string, reason: string): false {\n    this.errors.push(`${path}: ${reason}`);\n    return false;\n  }\n\n  /** Literal user-visible copy. Carries no markup. */\n  copy(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    if (MARKUP_PATTERN.test(value)) {\n      return this.fail(path, \"must not contain markup\");\n    }\n    return true;\n  }\n\n  placeholders(value: string, path: string): boolean {\n    if (UNKNOWN_PLACEHOLDER_PATTERN.test(value)) {\n      return this.fail(path, \"uses an unknown placeholder namespace\");\n    }\n    return true;\n  }\n\n  /** Copy that may embed `{{namespace.key}}` placeholders. */\n  templateCopy(value: unknown, path: string): boolean {\n    return this.copy(value, path) && this.placeholders(value as string, path);\n  }\n\n  /**\n   * A request-body string that may embed placeholders. Never rendered, so\n   * expression syntax such as a JMESPath filter is allowed through.\n   */\n  templateValue(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    return this.placeholders(value, path);\n  }\n\n  absent(container: Rec, key: string, path: string, reason: string): boolean {\n    if (key in container) return this.fail(`${path}.${key}`, reason);\n    return true;\n  }\n}\n\nfunction checkRequires(check: SetupChecker, requires: unknown): void {\n  if (!isRecord(requires)) {\n    check.fail(\"requires\", \"must be an object\");\n    return;\n  }\n\n  const { integrations, features } = requires;\n  if (!isRecord(integrations) || Object.keys(integrations).length === 0) {\n    check.fail(\"requires.integrations\", \"must be a non-empty object\");\n  } else {\n    Object.entries(integrations).forEach(([id, requirement]) => {\n      const path = `requires.integrations.${id}`;\n      if (!isRecord(requirement)) {\n        check.fail(path, \"must be an object\");\n        return;\n      }\n      check.copy(requirement.message, `${path}.message`);\n      if (\"required\" in requirement && requirement.required !== false) {\n        check.fail(`${path}.required`, \"may only be false\");\n      }\n      const allowed = [\"message\", \"required\"];\n      Object.keys(requirement)\n        .filter((key) => !allowed.includes(key))\n        .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n    });\n  }\n\n  if (features !== undefined) {\n    if (!Array.isArray(features) || features.length === 0) {\n      check.fail(\"requires.features\", \"must be a non-empty array\");\n    } else {\n      features.forEach((feature, index) => {\n        if (typeof feature !== \"string\" || feature.length === 0) {\n          check.fail(\n            `requires.features[${index}]`,\n            \"must be a non-empty string\",\n          );\n        }\n      });\n    }\n  }\n}\n\nfunction checkConstraints(\n  check: SetupChecker,\n  constraints: unknown,\n  path: string,\n): void {\n  if (!isRecord(constraints) || Object.keys(constraints).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return;\n  }\n\n  const { minLength, maxLength, format } = constraints;\n  if (minLength !== undefined && !isInteger(minLength, 0)) {\n    check.fail(`${path}.minLength`, \"must be a non-negative integer\");\n  }\n  if (maxLength !== undefined && !isInteger(maxLength, 1)) {\n    check.fail(`${path}.maxLength`, \"must be a positive integer\");\n  }\n  if (format !== undefined && !isOneOf(format, CONSTRAINT_FORMATS)) {\n    check.fail(`${path}.format`, \"is not a supported format\");\n  }\n}\n\nfunction checkField(check: SetupChecker, field: unknown, path: string): void {\n  if (!isRecord(field)) {\n    check.fail(path, \"must be an object\");\n    return;\n  }\n\n  const { type, label, help, placeholder, required, provider, options } = field;\n\n  if (!isOneOf(type, FIELD_TYPES)) {\n    check.fail(`${path}.type`, \"is not a supported field type\");\n  }\n  check.copy(label, `${path}.label`);\n  check.copy(help, `${path}.help`);\n  if (placeholder !== undefined) check.copy(placeholder, `${path}.placeholder`);\n  if (field.default !== undefined && typeof field.default !== \"string\") {\n    check.fail(`${path}.default`, \"must be a string\");\n  }\n  if (typeof required !== \"boolean\") {\n    check.fail(`${path}.required`, \"must be a boolean\");\n  }\n  if (provider !== undefined && !isOneOf(provider, GIT_PROVIDERS)) {\n    check.fail(`${path}.provider`, \"is not a supported provider\");\n  }\n  if (type === \"repo-picker\" && provider === undefined) {\n    check.fail(`${path}.provider`, \"is required for a repository field\");\n  }\n\n  if (options !== undefined) {\n    if (type !== \"select\") {\n      check.fail(`${path}.options`, \"is only allowed on a select field\");\n    } else if (!Array.isArray(options) || options.length === 0) {\n      check.fail(`${path}.options`, \"must be a non-empty array\");\n    } else {\n      options.forEach((option, index) => {\n        const optionPath = `${path}.options[${index}]`;\n        if (!isRecord(option)) {\n          check.fail(optionPath, \"must be an object\");\n          return;\n        }\n        if (typeof option.value !== \"string\" || option.value.length === 0) {\n          check.fail(`${optionPath}.value`, \"must be a non-empty string\");\n        }\n        check.copy(option.label, `${optionPath}.label`);\n      });\n    }\n  }\n\n  if (field.constraints !== undefined) {\n    checkConstraints(check, field.constraints, `${path}.constraints`);\n  }\n}\n\n/** Returns the declared field names, so the caller can check them for collisions. */\nfunction checkFields(\n  check: SetupChecker,\n  fields: unknown,\n  path: string,\n): string[] {\n  if (!isRecord(fields) || Object.keys(fields).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return [];\n  }\n\n  return Object.entries(fields).map(([name, field]) => {\n    if (!FIELD_NAME_PATTERN.test(name)) {\n      check.fail(`${path}.${name}`, \"is not a valid field name\");\n    }\n    checkField(check, field, `${path}.${name}`);\n    return name;\n  });\n}\n\n/** Returns the trigger kinds declared, in order. */\nfunction checkForm(check: SetupChecker, form: unknown): string[] {\n  if (!isRecord(form)) {\n    check.fail(\"setup.form\", \"must be an object\");\n    return [];\n  }\n\n  if (form.note !== undefined) check.copy(form.note, \"setup.form.note\");\n\n  const names = checkFields(check, form.args, \"setup.form.args\");\n  const kinds: string[] = [];\n\n  if (form.triggers !== undefined) {\n    if (!isRecord(form.triggers) || Object.keys(form.triggers).length === 0) {\n      check.fail(\"setup.form.triggers\", \"must be a non-empty object\");\n    } else {\n      Object.entries(form.triggers).forEach(([kind, fields]) => {\n        if (!isOneOf(kind, TRIGGER_KINDS)) {\n          check.fail(`setup.form.triggers.${kind}`, \"is not a trigger kind\");\n          return;\n        }\n        kinds.push(kind);\n        names.push(\n          ...checkFields(check, fields, `setup.form.triggers.${kind}`),\n        );\n      });\n    }\n  }\n\n  // The host merges both halves into one value map, so a repeated name would\n  // silently shadow a field and misaddress every error reported against it.\n  const duplicates = names.filter(\n    (name, index) => names.indexOf(name) !== index,\n  );\n  Array.from(new Set(duplicates)).forEach((name) =>\n    check.fail(`setup.form.${name}`, \"is declared more than once\"),\n  );\n\n  return kinds;\n}\n\nfunction hasRepoPicker(form: unknown): boolean {\n  if (!isRecord(form)) return false;\n  const groups = [\n    form.args,\n    ...Object.values(isRecord(form.triggers) ? form.triggers : {}),\n  ];\n  return groups.some(\n    (group) =>\n      isRecord(group) &&\n      Object.values(group).some(\n        (field) => isRecord(field) && field.type === \"repo-picker\",\n      ),\n  );\n}\n\nfunction checkMessage(check: SetupChecker, message: unknown): void {\n  if (check.templateCopy(message, \"setup.message\")) {\n    if ((message as string).length > MAX_MESSAGE_LENGTH) {\n      check.fail(\n        \"setup.message\",\n        `must be at most ${MAX_MESSAGE_LENGTH} characters`,\n      );\n    }\n  }\n}\n\nfunction checkMode(check: SetupChecker, setup: Rec, kinds: string[]): void {\n  if (!isOneOf(setup.mode, SETUP_MODES)) {\n    check.fail(\"setup.mode\", \"is not a supported mode\");\n    return;\n  }\n\n  if (setup.mode === \"direct\") {\n    check.templateValue(setup.prompt, \"setup.prompt\");\n    // Optional here: it seeds the fallback conversation offered when the\n    // deployment cannot run the direct path.\n    if (setup.message !== undefined) checkMessage(check, setup.message);\n\n    // The derivation reads a single trigger kind, and an event trigger takes\n    // its source from the repository field's provider.\n    if (kinds.length !== 1) {\n      check.fail(\n        \"setup.form.triggers\",\n        \"must declare exactly one trigger kind\",\n      );\n    }\n    if (kinds.includes(\"event\") && !hasRepoPicker(setup.form)) {\n      check.fail(\n        \"setup.form\",\n        \"must declare a repository field for an event trigger\",\n      );\n    }\n    if (setup.filter !== undefined) {\n      if (!kinds.includes(\"event\")) {\n        check.fail(\"setup.filter\", \"is only allowed for an event trigger\");\n      } else {\n        check.templateValue(setup.filter, \"setup.filter\");\n      }\n    }\n    return;\n  }\n\n  checkMessage(check, setup.message);\n  check.absent(setup, \"prompt\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"filter\", \"setup\", \"is only allowed for direct setup\");\n}\n\n/** Whether a catalog entry ships a setup experience at all. It is optional. */\nexport function hasSetupBlock(candidate: unknown): boolean {\n  return isRecord(candidate) && candidate.setup !== undefined;\n}\n\n/**\n * Decide whether this host will act on a catalog manifest.\n *\n * The version is checked first and fails closed: a format this host does not\n * recognise is refused rather than interpreted with today's rules.\n */\nexport function validateSetupEntry(candidate: unknown): SetupValidationResult {\n  const check = new SetupChecker();\n\n  if (!isRecord(candidate)) {\n    return { valid: false, errors: [\"manifest: must be an object\"] };\n  }\n\n  const { setup } = candidate;\n  if (!isRecord(setup)) {\n    return { valid: false, errors: [\"setup: must be an object\"] };\n  }\n  if (setup.version !== SETUP_VERSION) {\n    return {\n      valid: false,\n      errors: [`setup.version: must be \"${SETUP_VERSION}\"`],\n    };\n  }\n\n  if (\n    typeof candidate.id !== \"string\" ||\n    !ENTRY_ID_PATTERN.test(candidate.id)\n  ) {\n    check.fail(\"id\", \"must be a lowercase slug\");\n  }\n  check.copy(candidate.name, \"name\");\n  check.copy(candidate.description, \"description\");\n  if (\n    candidate.skill !== undefined &&\n    (typeof candidate.skill !== \"string\" ||\n      !ENTRY_ID_PATTERN.test(candidate.skill))\n  ) {\n    check.fail(\"skill\", \"must be a lowercase slug\");\n  }\n\n  checkRequires(check, candidate.requires);\n  const kinds = checkForm(check, setup.form);\n  checkMode(check, setup, kinds);\n\n  return { valid: check.errors.length === 0, errors: check.errors };\n}\n"],"mappings":"4EAoBA,IAAM,EAAmB,2BACnB,EAAqB,sBAErB,EAAiB,cAEjB,EAAkC,OACtC,eAAe,EAAA,6BAA6B,KAAK,GAAG,EAAE,0BACxD,EAEM,EAAc,CAAC,SAAU,UAAU,EACnC,EAAc,CAClB,OACA,WACA,SACA,OACA,WACA,aACF,EACM,EAAgB,CAAC,SAAU,SAAU,WAAW,EAChD,EAAgB,CAAC,OAAQ,OAAO,EAChC,EAAqB,CAAC,uBAAuB,EAG7C,EAAqB,IAS3B,SAAS,EAAS,EAA8B,CAC9C,OAAO,OAAO,GAAU,YAAY,GAAkB,CAAC,MAAM,QAAQ,CAAK,CAC5E,CAEA,SAAS,EACP,EACA,EACoB,CACpB,OACE,OAAO,GAAU,UAAa,EAA8B,SAAS,CAAK,CAE9E,CAEA,SAAS,EAAU,EAAgB,EAA0B,CAC3D,OACE,OAAO,GAAU,UAAY,OAAO,UAAU,CAAK,GAAK,GAAS,CAErE,CAEA,IAAM,EAAN,KAAmB,CACjB,OAA4B,CAAC,EAE7B,KAAK,EAAc,EAAuB,CAExC,OADA,KAAK,OAAO,KAAK,GAAG,EAAK,IAAI,GAAQ,EAC9B,EACT,CAGA,KAAK,EAAgB,EAAuB,CAO1C,OANI,OAAO,GAAU,UAAY,EAAM,SAAW,EACzC,KAAK,KAAK,EAAM,4BAA4B,EAEjD,EAAe,KAAK,CAAK,EACpB,KAAK,KAAK,EAAM,yBAAyB,EAE3C,EACT,CAEA,aAAa,EAAe,EAAuB,CAIjD,OAHI,EAA4B,KAAK,CAAK,EACjC,KAAK,KAAK,EAAM,uCAAuC,EAEzD,EACT,CAGA,aAAa,EAAgB,EAAuB,CAClD,OAAO,KAAK,KAAK,EAAO,CAAI,GAAK,KAAK,aAAa,EAAiB,CAAI,CAC1E,CAMA,cAAc,EAAgB,EAAuB,CAInD,OAHI,OAAO,GAAU,UAAY,EAAM,SAAW,EACzC,KAAK,KAAK,EAAM,4BAA4B,EAE9C,KAAK,aAAa,EAAO,CAAI,CACtC,CAEA,OAAO,EAAgB,EAAa,EAAc,EAAyB,CAEzE,OADI,KAAO,EAAkB,KAAK,KAAK,GAAG,EAAK,GAAG,IAAO,CAAM,EACxD,EACT,CACF,EAEA,SAAS,EAAc,EAAqB,EAAyB,CACnE,GAAI,CAAC,EAAS,CAAQ,EAAG,CACvB,EAAM,KAAK,WAAY,mBAAmB,EAC1C,MACF,CAEA,GAAM,CAAE,eAAc,YAAa,EAC/B,CAAC,EAAS,CAAY,GAAK,OAAO,KAAK,CAAY,EAAE,SAAW,EAClE,EAAM,KAAK,wBAAyB,4BAA4B,EAEhE,OAAO,QAAQ,CAAY,EAAE,SAAS,CAAC,EAAI,KAAiB,CAC1D,IAAM,EAAO,yBAAyB,IACtC,GAAI,CAAC,EAAS,CAAW,EAAG,CAC1B,EAAM,KAAK,EAAM,mBAAmB,EACpC,MACF,CACA,EAAM,KAAK,EAAY,QAAS,GAAG,EAAK,SAAS,EAC7C,aAAc,GAAe,EAAY,WAAa,IACxD,EAAM,KAAK,GAAG,EAAK,WAAY,mBAAmB,EAEpD,IAAM,EAAU,CAAC,UAAW,UAAU,EACtC,OAAO,KAAK,CAAW,EACpB,OAAQ,GAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,QAAS,GAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,IAAO,gBAAgB,CAAC,CACpE,CAAC,EAGC,IAAa,IAAA,KACX,CAAC,MAAM,QAAQ,CAAQ,GAAK,EAAS,SAAW,EAClD,EAAM,KAAK,oBAAqB,2BAA2B,EAE3D,EAAS,SAAS,EAAS,IAAU,EAC/B,OAAO,GAAY,UAAY,EAAQ,SAAW,IACpD,EAAM,KACJ,qBAAqB,EAAM,GAC3B,4BACF,CAEJ,CAAC,EAGP,CAEA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,CAAC,EAAS,CAAW,GAAK,OAAO,KAAK,CAAW,EAAE,SAAW,EAAG,CACnE,EAAM,KAAK,EAAM,4BAA4B,EAC7C,MACF,CAEA,GAAM,CAAE,YAAW,YAAW,UAAW,EACrC,IAAc,IAAA,IAAa,CAAC,EAAU,EAAW,CAAC,GACpD,EAAM,KAAK,GAAG,EAAK,YAAa,gCAAgC,EAE9D,IAAc,IAAA,IAAa,CAAC,EAAU,EAAW,CAAC,GACpD,EAAM,KAAK,GAAG,EAAK,YAAa,4BAA4B,EAE1D,IAAW,IAAA,IAAa,CAAC,EAAQ,EAAQ,CAAkB,GAC7D,EAAM,KAAK,GAAG,EAAK,SAAU,2BAA2B,CAE5D,CAEA,SAAS,EAAW,EAAqB,EAAgB,EAAoB,CAC3E,GAAI,CAAC,EAAS,CAAK,EAAG,CACpB,EAAM,KAAK,EAAM,mBAAmB,EACpC,MACF,CAEA,GAAM,CAAE,OAAM,QAAO,OAAM,cAAa,WAAU,WAAU,WAAY,EAEnE,EAAQ,EAAM,CAAW,GAC5B,EAAM,KAAK,GAAG,EAAK,OAAQ,+BAA+B,EAE5D,EAAM,KAAK,EAAO,GAAG,EAAK,OAAO,EACjC,EAAM,KAAK,EAAM,GAAG,EAAK,MAAM,EAC3B,IAAgB,IAAA,IAAW,EAAM,KAAK,EAAa,GAAG,EAAK,aAAa,EACxE,EAAM,UAAY,IAAA,IAAa,OAAO,EAAM,SAAY,UAC1D,EAAM,KAAK,GAAG,EAAK,UAAW,kBAAkB,EAE9C,OAAO,GAAa,WACtB,EAAM,KAAK,GAAG,EAAK,WAAY,mBAAmB,EAEhD,IAAa,IAAA,IAAa,CAAC,EAAQ,EAAU,CAAa,GAC5D,EAAM,KAAK,GAAG,EAAK,WAAY,6BAA6B,EAE1D,IAAS,eAAiB,IAAa,IAAA,IACzC,EAAM,KAAK,GAAG,EAAK,WAAY,oCAAoC,EAGjE,IAAY,IAAA,KACV,IAAS,SAEF,CAAC,MAAM,QAAQ,CAAO,GAAK,EAAQ,SAAW,EACvD,EAAM,KAAK,GAAG,EAAK,UAAW,2BAA2B,EAEzD,EAAQ,SAAS,EAAQ,IAAU,CACjC,IAAM,EAAa,GAAG,EAAK,WAAW,EAAM,GAC5C,GAAI,CAAC,EAAS,CAAM,EAAG,CACrB,EAAM,KAAK,EAAY,mBAAmB,EAC1C,MACF,EACI,OAAO,EAAO,OAAU,UAAY,EAAO,MAAM,SAAW,IAC9D,EAAM,KAAK,GAAG,EAAW,QAAS,4BAA4B,EAEhE,EAAM,KAAK,EAAO,MAAO,GAAG,EAAW,OAAO,CAChD,CAAC,EAdD,EAAM,KAAK,GAAG,EAAK,UAAW,mCAAmC,GAkBjE,EAAM,cAAgB,IAAA,IACxB,EAAiB,EAAO,EAAM,YAAa,GAAG,EAAK,aAAa,CAEpE,CAGA,SAAS,EACP,EACA,EACA,EACU,CAMV,MALI,CAAC,EAAS,CAAM,GAAK,OAAO,KAAK,CAAM,EAAE,SAAW,GACtD,EAAM,KAAK,EAAM,4BAA4B,EACtC,CAAC,GAGH,OAAO,QAAQ,CAAM,EAAE,KAAK,CAAC,EAAM,MACnC,EAAmB,KAAK,CAAI,GAC/B,EAAM,KAAK,GAAG,EAAK,GAAG,IAAQ,2BAA2B,EAE3D,EAAW,EAAO,EAAO,GAAG,EAAK,GAAG,GAAM,EACnC,EACR,CACH,CAGA,SAAS,EAAU,EAAqB,EAAyB,CAC/D,GAAI,CAAC,EAAS,CAAI,EAEhB,OADA,EAAM,KAAK,aAAc,mBAAmB,EACrC,CAAC,EAGN,EAAK,OAAS,IAAA,IAAW,EAAM,KAAK,EAAK,KAAM,iBAAiB,EAEpE,IAAM,EAAQ,EAAY,EAAO,EAAK,KAAM,iBAAiB,EACvD,EAAkB,CAAC,EAErB,EAAK,WAAa,IAAA,KAChB,CAAC,EAAS,EAAK,QAAQ,GAAK,OAAO,KAAK,EAAK,QAAQ,EAAE,SAAW,EACpE,EAAM,KAAK,sBAAuB,4BAA4B,EAE9D,OAAO,QAAQ,EAAK,QAAQ,EAAE,SAAS,CAAC,EAAM,KAAY,CACxD,GAAI,CAAC,EAAQ,EAAM,CAAa,EAAG,CACjC,EAAM,KAAK,uBAAuB,IAAQ,uBAAuB,EACjE,MACF,CACA,EAAM,KAAK,CAAI,EACf,EAAM,KACJ,GAAG,EAAY,EAAO,EAAQ,uBAAuB,GAAM,CAC7D,CACF,CAAC,GAML,IAAM,EAAa,EAAM,QACtB,EAAM,IAAU,EAAM,QAAQ,CAAI,IAAM,CAC3C,EAKA,OAJA,MAAM,KAAK,IAAI,IAAI,CAAU,CAAC,EAAE,QAAS,GACvC,EAAM,KAAK,cAAc,IAAQ,4BAA4B,CAC/D,EAEO,CACT,CAEA,SAAS,EAAc,EAAwB,CAM7C,OALK,EAAS,CAAI,EAKX,CAHL,EAAK,KACL,GAAG,OAAO,OAAO,EAAS,EAAK,QAAQ,EAAI,EAAK,SAAW,CAAC,CAAC,CAExD,EAAO,KACX,GACC,EAAS,CAAK,GACd,OAAO,OAAO,CAAK,EAAE,KAClB,GAAU,EAAS,CAAK,GAAK,EAAM,OAAS,aAC/C,CACJ,EAX4B,EAY9B,CAEA,SAAS,EAAa,EAAqB,EAAwB,CAC7D,EAAM,aAAa,EAAS,eAAe,GACxC,EAAmB,OAAS,GAC/B,EAAM,KACJ,gBACA,mBAAmB,EAAmB,YACxC,CAGN,CAEA,SAAS,EAAU,EAAqB,EAAY,EAAuB,CACzE,GAAI,CAAC,EAAQ,EAAM,KAAM,CAAW,EAAG,CACrC,EAAM,KAAK,aAAc,yBAAyB,EAClD,MACF,CAEA,GAAI,EAAM,OAAS,SAAU,CAC3B,EAAM,cAAc,EAAM,OAAQ,cAAc,EAG5C,EAAM,UAAY,IAAA,IAAW,EAAa,EAAO,EAAM,OAAO,EAI9D,EAAM,SAAW,GACnB,EAAM,KACJ,sBACA,uCACF,EAEE,EAAM,SAAS,OAAO,GAAK,CAAC,EAAc,EAAM,IAAI,GACtD,EAAM,KACJ,aACA,sDACF,EAEE,EAAM,SAAW,IAAA,KACd,EAAM,SAAS,OAAO,EAGzB,EAAM,cAAc,EAAM,OAAQ,cAAc,EAFhD,EAAM,KAAK,eAAgB,sCAAsC,GAKrE,MACF,CAEA,EAAa,EAAO,EAAM,OAAO,EACjC,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,EACzE,EAAM,OAAO,EAAO,SAAU,QAAS,kCAAkC,CAC3E,CAGA,SAAgB,EAAc,EAA6B,CACzD,OAAO,EAAS,CAAS,GAAK,EAAU,QAAU,IAAA,EACpD,CAQA,SAAgB,EAAmB,EAA2C,CAC5E,IAAM,EAAQ,IAAI,EAElB,GAAI,CAAC,EAAS,CAAS,EACrB,MAAO,CAAE,MAAO,GAAO,OAAQ,CAAC,6BAA6B,CAAE,EAGjE,GAAM,CAAE,SAAU,EA+BlB,OA9BK,EAAS,CAAK,EAGf,EAAM,UAAA,QAQR,OAAO,EAAU,IAAO,UACxB,CAAC,EAAiB,KAAK,EAAU,EAAE,IAEnC,EAAM,KAAK,KAAM,0BAA0B,EAE7C,EAAM,KAAK,EAAU,KAAM,MAAM,EACjC,EAAM,KAAK,EAAU,YAAa,aAAa,EAE7C,EAAU,QAAU,IAAA,KACnB,OAAO,EAAU,OAAU,UAC1B,CAAC,EAAiB,KAAK,EAAU,KAAK,IAExC,EAAM,KAAK,QAAS,0BAA0B,EAGhD,EAAc,EAAO,EAAU,QAAQ,EAEvC,EAAU,EAAO,EADH,EAAU,EAAO,EAAM,IACb,CAAK,EAEtB,CAAE,MAAO,EAAM,OAAO,SAAW,EAAG,OAAQ,EAAM,MAAO,GA1BvD,CACL,MAAO,GACP,OAAQ,CAAC,8BAA2C,CACtD,EANO,CAAE,MAAO,GAAO,OAAQ,CAAC,0BAA0B,CAAE,CA8BhE"}

package/dist/manifests/manifest-validation.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Admission policy for extension-authored catalog manifests.
+ *
+ * A manifest is data authored in a different repository that instructs this host
+ * to render copy and compose a request. The host therefore decides what a
+ * manifest is *permitted* to do rather than trusting the file — validation here
+ * is a trust boundary, not a convenience check, and it deliberately does not
+ * defer to a schema shipped alongside the manifests it would be validating.
+ *
+ * Beyond mirroring the published schema, this adds the invariants the host's own
+ * derivation depends on: a single trigger kind to read, a repository field for
+ * an event trigger's source, and field names unique across the form. Without
+ * them the derived request body would be silently wrong rather than rejected.
+ *
+ * A manifest that fails any check is rejected outright. It never renders a
+ * partial UI, because everything downstream treats its content as instructions.
+ */
+export interface SetupValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+/** Whether a catalog entry ships a setup experience at all. It is optional. */
+export declare function hasSetupBlock(candidate: unknown): boolean;
+/**
+ * Decide whether this host will act on a catalog manifest.
+ *
+ * The version is checked first and fails closed: a format this host does not
+ * recognise is refused rather than interpreted with today's rules.
+ */
+export declare function validateSetupEntry(candidate: unknown): SetupValidationResult;

package/dist/manifests/manifest-validation.js

@@ -0,0 +1,145 @@
+import { SETUP_PLACEHOLDER_NAMESPACES as e } from "./types.js";
+//#region src/manifests/manifest-validation.ts
+var t = /^[a-z0-9]+(-[a-z0-9]+)*$/, n = /^[a-z][A-Za-z0-9]*$/, r = /<[A-Za-z/!]/, i = RegExp(`\\{\\{(?!(?:${e.join("|")})\\.[A-Za-z0-9_.]+\\}\\})`), a = ["direct", "assisted"], o = [
+	"text",
+	"textarea",
+	"select",
+	"cron",
+	"timezone",
+	"repo-picker"
+], s = [
+	"github",
+	"gitlab",
+	"bitbucket"
+], c = ["cron", "event"], l = ["safeExpressionLiteral"], u = 2e3;
+function d(e) {
+	return typeof e == "object" && !!e && !Array.isArray(e);
+}
+function f(e, t) {
+	return typeof e == "string" && t.includes(e);
+}
+function p(e, t) {
+	return typeof e == "number" && Number.isInteger(e) && e >= t;
+}
+var m = class {
+	errors = [];
+	fail(e, t) {
+		return this.errors.push(`${e}: ${t}`), !1;
+	}
+	copy(e, t) {
+		return typeof e != "string" || e.length === 0 ? this.fail(t, "must be a non-empty string") : r.test(e) ? this.fail(t, "must not contain markup") : !0;
+	}
+	placeholders(e, t) {
+		return i.test(e) ? this.fail(t, "uses an unknown placeholder namespace") : !0;
+	}
+	templateCopy(e, t) {
+		return this.copy(e, t) && this.placeholders(e, t);
+	}
+	templateValue(e, t) {
+		return typeof e != "string" || e.length === 0 ? this.fail(t, "must be a non-empty string") : this.placeholders(e, t);
+	}
+	absent(e, t, n, r) {
+		return t in e ? this.fail(`${n}.${t}`, r) : !0;
+	}
+};
+function h(e, t) {
+	if (!d(t)) {
+		e.fail("requires", "must be an object");
+		return;
+	}
+	let { integrations: n, features: r } = t;
+	!d(n) || Object.keys(n).length === 0 ? e.fail("requires.integrations", "must be a non-empty object") : Object.entries(n).forEach(([t, n]) => {
+		let r = `requires.integrations.${t}`;
+		if (!d(n)) {
+			e.fail(r, "must be an object");
+			return;
+		}
+		e.copy(n.message, `${r}.message`), "required" in n && n.required !== !1 && e.fail(`${r}.required`, "may only be false");
+		let i = ["message", "required"];
+		Object.keys(n).filter((e) => !i.includes(e)).forEach((t) => e.fail(`${r}.${t}`, "is not allowed"));
+	}), r !== void 0 && (!Array.isArray(r) || r.length === 0 ? e.fail("requires.features", "must be a non-empty array") : r.forEach((t, n) => {
+		(typeof t != "string" || t.length === 0) && e.fail(`requires.features[${n}]`, "must be a non-empty string");
+	}));
+}
+function g(e, t, n) {
+	if (!d(t) || Object.keys(t).length === 0) {
+		e.fail(n, "must be a non-empty object");
+		return;
+	}
+	let { minLength: r, maxLength: i, format: a } = t;
+	r !== void 0 && !p(r, 0) && e.fail(`${n}.minLength`, "must be a non-negative integer"), i !== void 0 && !p(i, 1) && e.fail(`${n}.maxLength`, "must be a positive integer"), a !== void 0 && !f(a, l) && e.fail(`${n}.format`, "is not a supported format");
+}
+function _(e, t, n) {
+	if (!d(t)) {
+		e.fail(n, "must be an object");
+		return;
+	}
+	let { type: r, label: i, help: a, placeholder: c, required: l, provider: u, options: p } = t;
+	f(r, o) || e.fail(`${n}.type`, "is not a supported field type"), e.copy(i, `${n}.label`), e.copy(a, `${n}.help`), c !== void 0 && e.copy(c, `${n}.placeholder`), t.default !== void 0 && typeof t.default != "string" && e.fail(`${n}.default`, "must be a string"), typeof l != "boolean" && e.fail(`${n}.required`, "must be a boolean"), u !== void 0 && !f(u, s) && e.fail(`${n}.provider`, "is not a supported provider"), r === "repo-picker" && u === void 0 && e.fail(`${n}.provider`, "is required for a repository field"), p !== void 0 && (r === "select" ? !Array.isArray(p) || p.length === 0 ? e.fail(`${n}.options`, "must be a non-empty array") : p.forEach((t, r) => {
+		let i = `${n}.options[${r}]`;
+		if (!d(t)) {
+			e.fail(i, "must be an object");
+			return;
+		}
+		(typeof t.value != "string" || t.value.length === 0) && e.fail(`${i}.value`, "must be a non-empty string"), e.copy(t.label, `${i}.label`);
+	}) : e.fail(`${n}.options`, "is only allowed on a select field")), t.constraints !== void 0 && g(e, t.constraints, `${n}.constraints`);
+}
+function v(e, t, r) {
+	return !d(t) || Object.keys(t).length === 0 ? (e.fail(r, "must be a non-empty object"), []) : Object.entries(t).map(([t, i]) => (n.test(t) || e.fail(`${r}.${t}`, "is not a valid field name"), _(e, i, `${r}.${t}`), t));
+}
+function y(e, t) {
+	if (!d(t)) return e.fail("setup.form", "must be an object"), [];
+	t.note !== void 0 && e.copy(t.note, "setup.form.note");
+	let n = v(e, t.args, "setup.form.args"), r = [];
+	t.triggers !== void 0 && (!d(t.triggers) || Object.keys(t.triggers).length === 0 ? e.fail("setup.form.triggers", "must be a non-empty object") : Object.entries(t.triggers).forEach(([t, i]) => {
+		if (!f(t, c)) {
+			e.fail(`setup.form.triggers.${t}`, "is not a trigger kind");
+			return;
+		}
+		r.push(t), n.push(...v(e, i, `setup.form.triggers.${t}`));
+	}));
+	let i = n.filter((e, t) => n.indexOf(e) !== t);
+	return Array.from(new Set(i)).forEach((t) => e.fail(`setup.form.${t}`, "is declared more than once")), r;
+}
+function b(e) {
+	return d(e) ? [e.args, ...Object.values(d(e.triggers) ? e.triggers : {})].some((e) => d(e) && Object.values(e).some((e) => d(e) && e.type === "repo-picker")) : !1;
+}
+function x(e, t) {
+	e.templateCopy(t, "setup.message") && t.length > u && e.fail("setup.message", `must be at most ${u} characters`);
+}
+function S(e, t, n) {
+	if (!f(t.mode, a)) {
+		e.fail("setup.mode", "is not a supported mode");
+		return;
+	}
+	if (t.mode === "direct") {
+		e.templateValue(t.prompt, "setup.prompt"), t.message !== void 0 && x(e, t.message), n.length !== 1 && e.fail("setup.form.triggers", "must declare exactly one trigger kind"), n.includes("event") && !b(t.form) && e.fail("setup.form", "must declare a repository field for an event trigger"), t.filter !== void 0 && (n.includes("event") ? e.templateValue(t.filter, "setup.filter") : e.fail("setup.filter", "is only allowed for an event trigger"));
+		return;
+	}
+	x(e, t.message), e.absent(t, "prompt", "setup", "is only allowed for direct setup"), e.absent(t, "filter", "setup", "is only allowed for direct setup");
+}
+function C(e) {
+	return d(e) && e.setup !== void 0;
+}
+function w(e) {
+	let n = new m();
+	if (!d(e)) return {
+		valid: !1,
+		errors: ["manifest: must be an object"]
+	};
+	let { setup: r } = e;
+	return d(r) ? r.version === "1.0" ? ((typeof e.id != "string" || !t.test(e.id)) && n.fail("id", "must be a lowercase slug"), n.copy(e.name, "name"), n.copy(e.description, "description"), e.skill !== void 0 && (typeof e.skill != "string" || !t.test(e.skill)) && n.fail("skill", "must be a lowercase slug"), h(n, e.requires), S(n, r, y(n, r.form)), {
+		valid: n.errors.length === 0,
+		errors: n.errors
+	}) : {
+		valid: !1,
+		errors: ["setup.version: must be \"1.0\""]
+	} : {
+		valid: !1,
+		errors: ["setup: must be an object"]
+	};
+}
+//#endregion
+export { C as hasSetupBlock, w as validateSetupEntry };
+
+//# sourceMappingURL=manifest-validation.js.map

package/dist/manifests/manifest-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-validation.js","names":[],"sources":["../../src/manifests/manifest-validation.ts"],"sourcesContent":["/**\n * Admission policy for extension-authored catalog manifests.\n *\n * A manifest is data authored in a different repository that instructs this host\n * to render copy and compose a request. The host therefore decides what a\n * manifest is *permitted* to do rather than trusting the file — validation here\n * is a trust boundary, not a convenience check, and it deliberately does not\n * defer to a schema shipped alongside the manifests it would be validating.\n *\n * Beyond mirroring the published schema, this adds the invariants the host's own\n * derivation depends on: a single trigger kind to read, a repository field for\n * an event trigger's source, and field names unique across the form. Without\n * them the derived request body would be silently wrong rather than rejected.\n *\n * A manifest that fails any check is rejected outright. It never renders a\n * partial UI, because everything downstream treats its content as instructions.\n */\n\nimport { SETUP_PLACEHOLDER_NAMESPACES, SETUP_VERSION } from \"./types\";\n\nconst ENTRY_ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;\nconst FIELD_NAME_PATTERN = /^[a-z][A-Za-z0-9]*$/;\n/** Copy must never be able to inject markup into the host. */\nconst MARKUP_PATTERN = /<[A-Za-z/!]/;\n/** Every `{{` must open a known namespace and close immediately. */\nconst UNKNOWN_PLACEHOLDER_PATTERN = new RegExp(\n  `\\\\{\\\\{(?!(?:${SETUP_PLACEHOLDER_NAMESPACES.join(\"|\")})\\\\.[A-Za-z0-9_.]+\\\\}\\\\})`,\n);\n\nconst SETUP_MODES = [\"direct\", \"assisted\"] as const;\nconst FIELD_TYPES = [\n  \"text\",\n  \"textarea\",\n  \"select\",\n  \"cron\",\n  \"timezone\",\n  \"repo-picker\",\n] as const;\nconst GIT_PROVIDERS = [\"github\", \"gitlab\", \"bitbucket\"] as const;\nconst TRIGGER_KINDS = [\"cron\", \"event\"] as const;\nconst CONSTRAINT_FORMATS = [\"safeExpressionLiteral\"] as const;\n\n/** Setup context only, so this can never become a channel for runtime instructions. */\nconst MAX_MESSAGE_LENGTH = 2000;\n\nexport interface SetupValidationResult {\n  valid: boolean;\n  errors: string[];\n}\n\ntype Rec = Record<string, unknown>;\n\nfunction isRecord(value: unknown): value is Rec {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isOneOf<T extends readonly string[]>(\n  value: unknown,\n  allowed: T,\n): value is T[number] {\n  return (\n    typeof value === \"string\" && (allowed as readonly string[]).includes(value)\n  );\n}\n\nfunction isInteger(value: unknown, minimum: number): boolean {\n  return (\n    typeof value === \"number\" && Number.isInteger(value) && value >= minimum\n  );\n}\n\nclass SetupChecker {\n  readonly errors: string[] = [];\n\n  fail(path: string, reason: string): false {\n    this.errors.push(`${path}: ${reason}`);\n    return false;\n  }\n\n  /** Literal user-visible copy. Carries no markup. */\n  copy(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    if (MARKUP_PATTERN.test(value)) {\n      return this.fail(path, \"must not contain markup\");\n    }\n    return true;\n  }\n\n  placeholders(value: string, path: string): boolean {\n    if (UNKNOWN_PLACEHOLDER_PATTERN.test(value)) {\n      return this.fail(path, \"uses an unknown placeholder namespace\");\n    }\n    return true;\n  }\n\n  /** Copy that may embed `{{namespace.key}}` placeholders. */\n  templateCopy(value: unknown, path: string): boolean {\n    return this.copy(value, path) && this.placeholders(value as string, path);\n  }\n\n  /**\n   * A request-body string that may embed placeholders. Never rendered, so\n   * expression syntax such as a JMESPath filter is allowed through.\n   */\n  templateValue(value: unknown, path: string): boolean {\n    if (typeof value !== \"string\" || value.length === 0) {\n      return this.fail(path, \"must be a non-empty string\");\n    }\n    return this.placeholders(value, path);\n  }\n\n  absent(container: Rec, key: string, path: string, reason: string): boolean {\n    if (key in container) return this.fail(`${path}.${key}`, reason);\n    return true;\n  }\n}\n\nfunction checkRequires(check: SetupChecker, requires: unknown): void {\n  if (!isRecord(requires)) {\n    check.fail(\"requires\", \"must be an object\");\n    return;\n  }\n\n  const { integrations, features } = requires;\n  if (!isRecord(integrations) || Object.keys(integrations).length === 0) {\n    check.fail(\"requires.integrations\", \"must be a non-empty object\");\n  } else {\n    Object.entries(integrations).forEach(([id, requirement]) => {\n      const path = `requires.integrations.${id}`;\n      if (!isRecord(requirement)) {\n        check.fail(path, \"must be an object\");\n        return;\n      }\n      check.copy(requirement.message, `${path}.message`);\n      if (\"required\" in requirement && requirement.required !== false) {\n        check.fail(`${path}.required`, \"may only be false\");\n      }\n      const allowed = [\"message\", \"required\"];\n      Object.keys(requirement)\n        .filter((key) => !allowed.includes(key))\n        .forEach((key) => check.fail(`${path}.${key}`, \"is not allowed\"));\n    });\n  }\n\n  if (features !== undefined) {\n    if (!Array.isArray(features) || features.length === 0) {\n      check.fail(\"requires.features\", \"must be a non-empty array\");\n    } else {\n      features.forEach((feature, index) => {\n        if (typeof feature !== \"string\" || feature.length === 0) {\n          check.fail(\n            `requires.features[${index}]`,\n            \"must be a non-empty string\",\n          );\n        }\n      });\n    }\n  }\n}\n\nfunction checkConstraints(\n  check: SetupChecker,\n  constraints: unknown,\n  path: string,\n): void {\n  if (!isRecord(constraints) || Object.keys(constraints).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return;\n  }\n\n  const { minLength, maxLength, format } = constraints;\n  if (minLength !== undefined && !isInteger(minLength, 0)) {\n    check.fail(`${path}.minLength`, \"must be a non-negative integer\");\n  }\n  if (maxLength !== undefined && !isInteger(maxLength, 1)) {\n    check.fail(`${path}.maxLength`, \"must be a positive integer\");\n  }\n  if (format !== undefined && !isOneOf(format, CONSTRAINT_FORMATS)) {\n    check.fail(`${path}.format`, \"is not a supported format\");\n  }\n}\n\nfunction checkField(check: SetupChecker, field: unknown, path: string): void {\n  if (!isRecord(field)) {\n    check.fail(path, \"must be an object\");\n    return;\n  }\n\n  const { type, label, help, placeholder, required, provider, options } = field;\n\n  if (!isOneOf(type, FIELD_TYPES)) {\n    check.fail(`${path}.type`, \"is not a supported field type\");\n  }\n  check.copy(label, `${path}.label`);\n  check.copy(help, `${path}.help`);\n  if (placeholder !== undefined) check.copy(placeholder, `${path}.placeholder`);\n  if (field.default !== undefined && typeof field.default !== \"string\") {\n    check.fail(`${path}.default`, \"must be a string\");\n  }\n  if (typeof required !== \"boolean\") {\n    check.fail(`${path}.required`, \"must be a boolean\");\n  }\n  if (provider !== undefined && !isOneOf(provider, GIT_PROVIDERS)) {\n    check.fail(`${path}.provider`, \"is not a supported provider\");\n  }\n  if (type === \"repo-picker\" && provider === undefined) {\n    check.fail(`${path}.provider`, \"is required for a repository field\");\n  }\n\n  if (options !== undefined) {\n    if (type !== \"select\") {\n      check.fail(`${path}.options`, \"is only allowed on a select field\");\n    } else if (!Array.isArray(options) || options.length === 0) {\n      check.fail(`${path}.options`, \"must be a non-empty array\");\n    } else {\n      options.forEach((option, index) => {\n        const optionPath = `${path}.options[${index}]`;\n        if (!isRecord(option)) {\n          check.fail(optionPath, \"must be an object\");\n          return;\n        }\n        if (typeof option.value !== \"string\" || option.value.length === 0) {\n          check.fail(`${optionPath}.value`, \"must be a non-empty string\");\n        }\n        check.copy(option.label, `${optionPath}.label`);\n      });\n    }\n  }\n\n  if (field.constraints !== undefined) {\n    checkConstraints(check, field.constraints, `${path}.constraints`);\n  }\n}\n\n/** Returns the declared field names, so the caller can check them for collisions. */\nfunction checkFields(\n  check: SetupChecker,\n  fields: unknown,\n  path: string,\n): string[] {\n  if (!isRecord(fields) || Object.keys(fields).length === 0) {\n    check.fail(path, \"must be a non-empty object\");\n    return [];\n  }\n\n  return Object.entries(fields).map(([name, field]) => {\n    if (!FIELD_NAME_PATTERN.test(name)) {\n      check.fail(`${path}.${name}`, \"is not a valid field name\");\n    }\n    checkField(check, field, `${path}.${name}`);\n    return name;\n  });\n}\n\n/** Returns the trigger kinds declared, in order. */\nfunction checkForm(check: SetupChecker, form: unknown): string[] {\n  if (!isRecord(form)) {\n    check.fail(\"setup.form\", \"must be an object\");\n    return [];\n  }\n\n  if (form.note !== undefined) check.copy(form.note, \"setup.form.note\");\n\n  const names = checkFields(check, form.args, \"setup.form.args\");\n  const kinds: string[] = [];\n\n  if (form.triggers !== undefined) {\n    if (!isRecord(form.triggers) || Object.keys(form.triggers).length === 0) {\n      check.fail(\"setup.form.triggers\", \"must be a non-empty object\");\n    } else {\n      Object.entries(form.triggers).forEach(([kind, fields]) => {\n        if (!isOneOf(kind, TRIGGER_KINDS)) {\n          check.fail(`setup.form.triggers.${kind}`, \"is not a trigger kind\");\n          return;\n        }\n        kinds.push(kind);\n        names.push(\n          ...checkFields(check, fields, `setup.form.triggers.${kind}`),\n        );\n      });\n    }\n  }\n\n  // The host merges both halves into one value map, so a repeated name would\n  // silently shadow a field and misaddress every error reported against it.\n  const duplicates = names.filter(\n    (name, index) => names.indexOf(name) !== index,\n  );\n  Array.from(new Set(duplicates)).forEach((name) =>\n    check.fail(`setup.form.${name}`, \"is declared more than once\"),\n  );\n\n  return kinds;\n}\n\nfunction hasRepoPicker(form: unknown): boolean {\n  if (!isRecord(form)) return false;\n  const groups = [\n    form.args,\n    ...Object.values(isRecord(form.triggers) ? form.triggers : {}),\n  ];\n  return groups.some(\n    (group) =>\n      isRecord(group) &&\n      Object.values(group).some(\n        (field) => isRecord(field) && field.type === \"repo-picker\",\n      ),\n  );\n}\n\nfunction checkMessage(check: SetupChecker, message: unknown): void {\n  if (check.templateCopy(message, \"setup.message\")) {\n    if ((message as string).length > MAX_MESSAGE_LENGTH) {\n      check.fail(\n        \"setup.message\",\n        `must be at most ${MAX_MESSAGE_LENGTH} characters`,\n      );\n    }\n  }\n}\n\nfunction checkMode(check: SetupChecker, setup: Rec, kinds: string[]): void {\n  if (!isOneOf(setup.mode, SETUP_MODES)) {\n    check.fail(\"setup.mode\", \"is not a supported mode\");\n    return;\n  }\n\n  if (setup.mode === \"direct\") {\n    check.templateValue(setup.prompt, \"setup.prompt\");\n    // Optional here: it seeds the fallback conversation offered when the\n    // deployment cannot run the direct path.\n    if (setup.message !== undefined) checkMessage(check, setup.message);\n\n    // The derivation reads a single trigger kind, and an event trigger takes\n    // its source from the repository field's provider.\n    if (kinds.length !== 1) {\n      check.fail(\n        \"setup.form.triggers\",\n        \"must declare exactly one trigger kind\",\n      );\n    }\n    if (kinds.includes(\"event\") && !hasRepoPicker(setup.form)) {\n      check.fail(\n        \"setup.form\",\n        \"must declare a repository field for an event trigger\",\n      );\n    }\n    if (setup.filter !== undefined) {\n      if (!kinds.includes(\"event\")) {\n        check.fail(\"setup.filter\", \"is only allowed for an event trigger\");\n      } else {\n        check.templateValue(setup.filter, \"setup.filter\");\n      }\n    }\n    return;\n  }\n\n  checkMessage(check, setup.message);\n  check.absent(setup, \"prompt\", \"setup\", \"is only allowed for direct setup\");\n  check.absent(setup, \"filter\", \"setup\", \"is only allowed for direct setup\");\n}\n\n/** Whether a catalog entry ships a setup experience at all. It is optional. */\nexport function hasSetupBlock(candidate: unknown): boolean {\n  return isRecord(candidate) && candidate.setup !== undefined;\n}\n\n/**\n * Decide whether this host will act on a catalog manifest.\n *\n * The version is checked first and fails closed: a format this host does not\n * recognise is refused rather than interpreted with today's rules.\n */\nexport function validateSetupEntry(candidate: unknown): SetupValidationResult {\n  const check = new SetupChecker();\n\n  if (!isRecord(candidate)) {\n    return { valid: false, errors: [\"manifest: must be an object\"] };\n  }\n\n  const { setup } = candidate;\n  if (!isRecord(setup)) {\n    return { valid: false, errors: [\"setup: must be an object\"] };\n  }\n  if (setup.version !== SETUP_VERSION) {\n    return {\n      valid: false,\n      errors: [`setup.version: must be \"${SETUP_VERSION}\"`],\n    };\n  }\n\n  if (\n    typeof candidate.id !== \"string\" ||\n    !ENTRY_ID_PATTERN.test(candidate.id)\n  ) {\n    check.fail(\"id\", \"must be a lowercase slug\");\n  }\n  check.copy(candidate.name, \"name\");\n  check.copy(candidate.description, \"description\");\n  if (\n    candidate.skill !== undefined &&\n    (typeof candidate.skill !== \"string\" ||\n      !ENTRY_ID_PATTERN.test(candidate.skill))\n  ) {\n    check.fail(\"skill\", \"must be a lowercase slug\");\n  }\n\n  checkRequires(check, candidate.requires);\n  const kinds = checkForm(check, setup.form);\n  checkMode(check, setup, kinds);\n\n  return { valid: check.errors.length === 0, errors: check.errors };\n}\n"],"mappings":";;AAoBA,IAAM,IAAmB,4BACnB,IAAqB,uBAErB,IAAiB,eAEjB,IAAkC,OACtC,eAAe,EAA6B,KAAK,GAAG,EAAE,0BACxD,GAEM,IAAc,CAAC,UAAU,UAAU,GACnC,IAAc;CAClB;CACA;CACA;CACA;CACA;CACA;AACF,GACM,IAAgB;CAAC;CAAU;CAAU;AAAW,GAChD,IAAgB,CAAC,QAAQ,OAAO,GAChC,IAAqB,CAAC,uBAAuB,GAG7C,IAAqB;AAS3B,SAAS,EAAS,GAA8B;CAC9C,OAAO,OAAO,KAAU,cAAY,KAAkB,CAAC,MAAM,QAAQ,CAAK;AAC5E;AAEA,SAAS,EACP,GACA,GACoB;CACpB,OACE,OAAO,KAAU,YAAa,EAA8B,SAAS,CAAK;AAE9E;AAEA,SAAS,EAAU,GAAgB,GAA0B;CAC3D,OACE,OAAO,KAAU,YAAY,OAAO,UAAU,CAAK,KAAK,KAAS;AAErE;AAEA,IAAM,IAAN,MAAmB;CACjB,SAA4B,CAAC;CAE7B,KAAK,GAAc,GAAuB;EAExC,OADA,KAAK,OAAO,KAAK,GAAG,EAAK,IAAI,GAAQ,GAC9B;CACT;CAGA,KAAK,GAAgB,GAAuB;EAO1C,OANI,OAAO,KAAU,YAAY,EAAM,WAAW,IACzC,KAAK,KAAK,GAAM,4BAA4B,IAEjD,EAAe,KAAK,CAAK,IACpB,KAAK,KAAK,GAAM,yBAAyB,IAE3C;CACT;CAEA,aAAa,GAAe,GAAuB;EAIjD,OAHI,EAA4B,KAAK,CAAK,IACjC,KAAK,KAAK,GAAM,uCAAuC,IAEzD;CACT;CAGA,aAAa,GAAgB,GAAuB;EAClD,OAAO,KAAK,KAAK,GAAO,CAAI,KAAK,KAAK,aAAa,GAAiB,CAAI;CAC1E;CAMA,cAAc,GAAgB,GAAuB;EAInD,OAHI,OAAO,KAAU,YAAY,EAAM,WAAW,IACzC,KAAK,KAAK,GAAM,4BAA4B,IAE9C,KAAK,aAAa,GAAO,CAAI;CACtC;CAEA,OAAO,GAAgB,GAAa,GAAc,GAAyB;EAEzE,OADI,KAAO,IAAkB,KAAK,KAAK,GAAG,EAAK,GAAG,KAAO,CAAM,IACxD;CACT;AACF;AAEA,SAAS,EAAc,GAAqB,GAAyB;CACnE,IAAI,CAAC,EAAS,CAAQ,GAAG;EACvB,EAAM,KAAK,YAAY,mBAAmB;EAC1C;CACF;CAEA,IAAM,EAAE,iBAAc,gBAAa;CAqBnC,AApBI,CAAC,EAAS,CAAY,KAAK,OAAO,KAAK,CAAY,EAAE,WAAW,IAClE,EAAM,KAAK,yBAAyB,4BAA4B,IAEhE,OAAO,QAAQ,CAAY,EAAE,SAAS,CAAC,GAAI,OAAiB;EAC1D,IAAM,IAAO,yBAAyB;EACtC,IAAI,CAAC,EAAS,CAAW,GAAG;GAC1B,EAAM,KAAK,GAAM,mBAAmB;GACpC;EACF;EAEA,AADA,EAAM,KAAK,EAAY,SAAS,GAAG,EAAK,SAAS,GAC7C,cAAc,KAAe,EAAY,aAAa,MACxD,EAAM,KAAK,GAAG,EAAK,YAAY,mBAAmB;EAEpD,IAAM,IAAU,CAAC,WAAW,UAAU;EACtC,OAAO,KAAK,CAAW,EACpB,QAAQ,MAAQ,CAAC,EAAQ,SAAS,CAAG,CAAC,EACtC,SAAS,MAAQ,EAAM,KAAK,GAAG,EAAK,GAAG,KAAO,gBAAgB,CAAC;CACpE,CAAC,GAGC,MAAa,KAAA,MACX,CAAC,MAAM,QAAQ,CAAQ,KAAK,EAAS,WAAW,IAClD,EAAM,KAAK,qBAAqB,2BAA2B,IAE3D,EAAS,SAAS,GAAS,MAAU;EACnC,CAAI,OAAO,KAAY,YAAY,EAAQ,WAAW,MACpD,EAAM,KACJ,qBAAqB,EAAM,IAC3B,4BACF;CAEJ,CAAC;AAGP;AAEA,SAAS,EACP,GACA,GACA,GACM;CACN,IAAI,CAAC,EAAS,CAAW,KAAK,OAAO,KAAK,CAAW,EAAE,WAAW,GAAG;EACnE,EAAM,KAAK,GAAM,4BAA4B;EAC7C;CACF;CAEA,IAAM,EAAE,cAAW,cAAW,cAAW;CAOzC,AANI,MAAc,KAAA,KAAa,CAAC,EAAU,GAAW,CAAC,KACpD,EAAM,KAAK,GAAG,EAAK,aAAa,gCAAgC,GAE9D,MAAc,KAAA,KAAa,CAAC,EAAU,GAAW,CAAC,KACpD,EAAM,KAAK,GAAG,EAAK,aAAa,4BAA4B,GAE1D,MAAW,KAAA,KAAa,CAAC,EAAQ,GAAQ,CAAkB,KAC7D,EAAM,KAAK,GAAG,EAAK,UAAU,2BAA2B;AAE5D;AAEA,SAAS,EAAW,GAAqB,GAAgB,GAAoB;CAC3E,IAAI,CAAC,EAAS,CAAK,GAAG;EACpB,EAAM,KAAK,GAAM,mBAAmB;EACpC;CACF;CAEA,IAAM,EAAE,SAAM,UAAO,SAAM,gBAAa,aAAU,aAAU,eAAY;CAyCxE,AAvCK,EAAQ,GAAM,CAAW,KAC5B,EAAM,KAAK,GAAG,EAAK,QAAQ,+BAA+B,GAE5D,EAAM,KAAK,GAAO,GAAG,EAAK,OAAO,GACjC,EAAM,KAAK,GAAM,GAAG,EAAK,MAAM,GAC3B,MAAgB,KAAA,KAAW,EAAM,KAAK,GAAa,GAAG,EAAK,aAAa,GACxE,EAAM,YAAY,KAAA,KAAa,OAAO,EAAM,WAAY,YAC1D,EAAM,KAAK,GAAG,EAAK,WAAW,kBAAkB,GAE9C,OAAO,KAAa,aACtB,EAAM,KAAK,GAAG,EAAK,YAAY,mBAAmB,GAEhD,MAAa,KAAA,KAAa,CAAC,EAAQ,GAAU,CAAa,KAC5D,EAAM,KAAK,GAAG,EAAK,YAAY,6BAA6B,GAE1D,MAAS,iBAAiB,MAAa,KAAA,KACzC,EAAM,KAAK,GAAG,EAAK,YAAY,oCAAoC,GAGjE,MAAY,KAAA,MACV,MAAS,WAEF,CAAC,MAAM,QAAQ,CAAO,KAAK,EAAQ,WAAW,IACvD,EAAM,KAAK,GAAG,EAAK,WAAW,2BAA2B,IAEzD,EAAQ,SAAS,GAAQ,MAAU;EACjC,IAAM,IAAa,GAAG,EAAK,WAAW,EAAM;EAC5C,IAAI,CAAC,EAAS,CAAM,GAAG;GACrB,EAAM,KAAK,GAAY,mBAAmB;GAC1C;EACF;EAIA,CAHI,OAAO,EAAO,SAAU,YAAY,EAAO,MAAM,WAAW,MAC9D,EAAM,KAAK,GAAG,EAAW,SAAS,4BAA4B,GAEhE,EAAM,KAAK,EAAO,OAAO,GAAG,EAAW,OAAO;CAChD,CAAC,IAdD,EAAM,KAAK,GAAG,EAAK,WAAW,mCAAmC,IAkBjE,EAAM,gBAAgB,KAAA,KACxB,EAAiB,GAAO,EAAM,aAAa,GAAG,EAAK,aAAa;AAEpE;AAGA,SAAS,EACP,GACA,GACA,GACU;CAMV,OALI,CAAC,EAAS,CAAM,KAAK,OAAO,KAAK,CAAM,EAAE,WAAW,KACtD,EAAM,KAAK,GAAM,4BAA4B,GACtC,CAAC,KAGH,OAAO,QAAQ,CAAM,EAAE,KAAK,CAAC,GAAM,QACnC,EAAmB,KAAK,CAAI,KAC/B,EAAM,KAAK,GAAG,EAAK,GAAG,KAAQ,2BAA2B,GAE3D,EAAW,GAAO,GAAO,GAAG,EAAK,GAAG,GAAM,GACnC,EACR;AACH;AAGA,SAAS,EAAU,GAAqB,GAAyB;CAC/D,IAAI,CAAC,EAAS,CAAI,GAEhB,OADA,EAAM,KAAK,cAAc,mBAAmB,GACrC,CAAC;CAGV,AAAI,EAAK,SAAS,KAAA,KAAW,EAAM,KAAK,EAAK,MAAM,iBAAiB;CAEpE,IAAM,IAAQ,EAAY,GAAO,EAAK,MAAM,iBAAiB,GACvD,IAAkB,CAAC;CAEzB,AAAI,EAAK,aAAa,KAAA,MAChB,CAAC,EAAS,EAAK,QAAQ,KAAK,OAAO,KAAK,EAAK,QAAQ,EAAE,WAAW,IACpE,EAAM,KAAK,uBAAuB,4BAA4B,IAE9D,OAAO,QAAQ,EAAK,QAAQ,EAAE,SAAS,CAAC,GAAM,OAAY;EACxD,IAAI,CAAC,EAAQ,GAAM,CAAa,GAAG;GACjC,EAAM,KAAK,uBAAuB,KAAQ,uBAAuB;GACjE;EACF;EAEA,AADA,EAAM,KAAK,CAAI,GACf,EAAM,KACJ,GAAG,EAAY,GAAO,GAAQ,uBAAuB,GAAM,CAC7D;CACF,CAAC;CAML,IAAM,IAAa,EAAM,QACtB,GAAM,MAAU,EAAM,QAAQ,CAAI,MAAM,CAC3C;CAKA,OAJA,MAAM,KAAK,IAAI,IAAI,CAAU,CAAC,EAAE,SAAS,MACvC,EAAM,KAAK,cAAc,KAAQ,4BAA4B,CAC/D,GAEO;AACT;AAEA,SAAS,EAAc,GAAwB;CAM7C,OALK,EAAS,CAAI,IAKX,CAHL,EAAK,MACL,GAAG,OAAO,OAAO,EAAS,EAAK,QAAQ,IAAI,EAAK,WAAW,CAAC,CAAC,CAExD,EAAO,MACX,MACC,EAAS,CAAK,KACd,OAAO,OAAO,CAAK,EAAE,MAClB,MAAU,EAAS,CAAK,KAAK,EAAM,SAAS,aAC/C,CACJ,IAX4B;AAY9B;AAEA,SAAS,EAAa,GAAqB,GAAwB;CACjE,AAAI,EAAM,aAAa,GAAS,eAAe,KACxC,EAAmB,SAAS,KAC/B,EAAM,KACJ,iBACA,mBAAmB,EAAmB,YACxC;AAGN;AAEA,SAAS,EAAU,GAAqB,GAAY,GAAuB;CACzE,IAAI,CAAC,EAAQ,EAAM,MAAM,CAAW,GAAG;EACrC,EAAM,KAAK,cAAc,yBAAyB;EAClD;CACF;CAEA,IAAI,EAAM,SAAS,UAAU;EAoB3B,AAnBA,EAAM,cAAc,EAAM,QAAQ,cAAc,GAG5C,EAAM,YAAY,KAAA,KAAW,EAAa,GAAO,EAAM,OAAO,GAI9D,EAAM,WAAW,KACnB,EAAM,KACJ,uBACA,uCACF,GAEE,EAAM,SAAS,OAAO,KAAK,CAAC,EAAc,EAAM,IAAI,KACtD,EAAM,KACJ,cACA,sDACF,GAEE,EAAM,WAAW,KAAA,MACd,EAAM,SAAS,OAAO,IAGzB,EAAM,cAAc,EAAM,QAAQ,cAAc,IAFhD,EAAM,KAAK,gBAAgB,sCAAsC;EAKrE;CACF;CAIA,AAFA,EAAa,GAAO,EAAM,OAAO,GACjC,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC,GACzE,EAAM,OAAO,GAAO,UAAU,SAAS,kCAAkC;AAC3E;AAGA,SAAgB,EAAc,GAA6B;CACzD,OAAO,EAAS,CAAS,KAAK,EAAU,UAAU,KAAA;AACpD;AAQA,SAAgB,EAAmB,GAA2C;CAC5E,IAAM,IAAQ,IAAI,EAAa;CAE/B,IAAI,CAAC,EAAS,CAAS,GACrB,OAAO;EAAE,OAAO;EAAO,QAAQ,CAAC,6BAA6B;CAAE;CAGjE,IAAM,EAAE,aAAU;CA+BlB,OA9BK,EAAS,CAAK,IAGf,EAAM,YAAA,UAQR,OAAO,EAAU,MAAO,YACxB,CAAC,EAAiB,KAAK,EAAU,EAAE,MAEnC,EAAM,KAAK,MAAM,0BAA0B,GAE7C,EAAM,KAAK,EAAU,MAAM,MAAM,GACjC,EAAM,KAAK,EAAU,aAAa,aAAa,GAE7C,EAAU,UAAU,KAAA,MACnB,OAAO,EAAU,SAAU,YAC1B,CAAC,EAAiB,KAAK,EAAU,KAAK,MAExC,EAAM,KAAK,SAAS,0BAA0B,GAGhD,EAAc,GAAO,EAAU,QAAQ,GAEvC,EAAU,GAAO,GADH,EAAU,GAAO,EAAM,IACb,CAAK,GAEtB;EAAE,OAAO,EAAM,OAAO,WAAW;EAAG,QAAQ,EAAM;CAAO,KA1BvD;EACL,OAAO;EACP,QAAQ,CAAC,gCAA2C;CACtD,IANO;EAAE,OAAO;EAAO,QAAQ,CAAC,0BAA0B;CAAE;AA8BhE"}

package/dist/manifests/types.cjs

@@ -0,0 +1,2 @@
+require("../_virtual/_rolldown/runtime.cjs");var e=[`form`,`automation`];exports.SETUP_PLACEHOLDER_NAMESPACES=e;
+//# sourceMappingURL=types.cjs.map

package/dist/manifests/types.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.cjs","names":[],"sources":["../../src/manifests/types.ts"],"sourcesContent":["/**\n * Host-owned shape of an extension-authored setup experience.\n *\n * A catalog entry is declarative data published by `@openhands/extensions`. Its\n * optional `setup` block says what to ask a user for; everything derivable from\n * that — the request to send, the route, the review screen, the analytics — is\n * this host's to generate, so none of it appears here.\n *\n * The names mirror `@openhands/extensions/automations`' own declarations, so an\n * entry from the published package assigns without an adapter.\n */\n\nexport const SETUP_VERSION = \"1.0\";\n\nexport type SetupMode = \"direct\" | \"assisted\";\n\nexport type SetupFieldType =\n  | \"text\"\n  | \"textarea\"\n  | \"select\"\n  | \"cron\"\n  | \"timezone\"\n  | \"repo-picker\";\n\nexport type SetupGitProvider = \"github\" | \"gitlab\" | \"bitbucket\";\n\nexport type SetupTriggerKind = \"cron\" | \"event\";\n\n/** Placeholder namespaces a setup block may reference inside `{{...}}`. */\nexport const SETUP_PLACEHOLDER_NAMESPACES = [\"form\", \"automation\"] as const;\n\nexport interface SetupFieldOption {\n  value: string;\n  label: string;\n}\n\nexport interface SetupFieldConstraints {\n  minLength?: number;\n  maxLength?: number;\n  /**\n   * A host-implemented check named from a closed set. Entries supply no regex\n   * of their own, so they cannot hand the host a pathological pattern.\n   */\n  format?: \"safeExpressionLiteral\";\n}\n\nexport interface SetupFormField {\n  type: SetupFieldType;\n  label: string;\n  help: string;\n  placeholder?: string;\n  default?: string;\n  required: boolean;\n  provider?: SetupGitProvider;\n  options?: SetupFieldOption[];\n  constraints?: SetupFieldConstraints;\n}\n\n/** Keyed by field name, which is what `{{form.<name>}}` resolves against. */\nexport type SetupFormFields = Record<string, SetupFormField>;\n\nexport interface SetupForm {\n  note?: string;\n  /** Inputs that decide when the automation runs, keyed by trigger kind. */\n  triggers?: Partial<Record<SetupTriggerKind, SetupFormFields>>;\n  /** Every other input: the arguments to the automation itself. */\n  args: SetupFormFields;\n}\n\nexport interface SetupBlock {\n  version: typeof SETUP_VERSION;\n  mode: SetupMode;\n  form: SetupForm;\n  /** direct only. What the automation is told to do. */\n  prompt?: string;\n  /** direct only, event trigger only. Which delivered events belong to it. */\n  filter?: string;\n  /**\n   * Setup context for the conversation that finishes setup. Required for\n   * assisted mode. Optional for direct mode, where it seeds the fallback\n   * conversation offered when the deployment cannot run the direct path.\n   */\n  message?: string;\n}\n\nexport interface SetupIntegrationRequirement {\n  /** Why this entry needs the integration. */\n  message: string;\n  /** Defaults to true. `false` lets setup continue while it is unconnected. */\n  required?: false;\n}\n\nexport interface SetupPrerequisites {\n  /** Keyed by integration catalog id. */\n  integrations: Record<string, SetupIntegrationRequirement>;\n  /** Deployment capabilities this entry cannot run without. */\n  features?: string[];\n}\n\n/**\n * The part of a catalog entry this host reads. An admitted entry always has a\n * `setup` block; entries without one are simply not setup entries.\n */\nexport interface SetupEntry {\n  id: string;\n  name: string;\n  description: string;\n  requires: SetupPrerequisites;\n  /** The skill that owns the launch command. Defaults to `id`. */\n  skill?: string;\n  setup: SetupBlock;\n}\n\nexport type SetupPayloadValue =\n  | string\n  | number\n  | boolean\n  | null\n  | SetupPayloadValue[]\n  | { [key: string]: SetupPayloadValue };\n\nexport interface SetupRequestBody {\n  [key: string]: SetupPayloadValue;\n}\n\n/** Form values are collected as strings; the payload mapping shapes them. */\nexport type SetupFormValues = Record<string, string>;\n\n/** `GET /v1/capabilities` — what this deployment supports. */\nexport interface DeploymentCapabilities {\n  ready: boolean;\n  triggerKinds: string[];\n  eventSources: string[];\n  eventTypes: string[];\n  triggers: {\n    cron?: { minIntervalSeconds: number; timezones: string[] };\n    event?: { filterLanguage: string; filterFunctions: string[] };\n  };\n  features: string[];\n}\n\n/** A single problem with a draft, addressed to the field that caused it. */\nexport interface DraftValidationError {\n  /** Dotted path into the draft. Null when the problem spans the whole draft. */\n  field: string | null;\n  code: string;\n  message: string;\n}\n\n/** `POST /v1/validate` — an invalid draft is still a 200. */\nexport interface ValidateDraftResponse {\n  valid: boolean;\n  errors: DraftValidationError[];\n  sampleEventMatched?: boolean | null;\n}\n\n/**\n * Host-owned shape of the production Automation interface manifest, published\n * by `@openhands/extensions/automations` as `AUTOMATION_INTERFACE`.\n *\n * The catalog states what varies per automation; this states the domain-level\n * facts of the interface itself. As with setup entries, the published data is\n * validated at admission rather than trusted, and a package that predates the\n * manifest simply leaves the host on its own defaults.\n */\n\nexport const INTERFACE_VERSION = \"1.0\";\n\n/** The closed set of runtime-model properties a client may offer for setting. */\nexport type AutomationAttributeName =\n  | \"name\"\n  | \"prompt\"\n  | \"model\"\n  | \"timeout\"\n  | \"schedule\";\n\nexport type InterfaceAttributeType =\n  | \"text\"\n  | \"textarea\"\n  | \"number\"\n  | \"llm-profile\"\n  | \"schedule\";\n\n/** How one settable attribute of an existing Automation is offered. */\nexport interface InterfaceAttribute {\n  type: InterfaceAttributeType;\n  label: string;\n  help?: string;\n  required: boolean;\n  /** Only a `number` attribute carries constraints. */\n  constraints?: { min?: number; max?: number };\n}\n\nexport interface InterfaceRoutes {\n  list: string;\n  /** Carries the `:automationId` segment the host substitutes. */\n  setup: string;\n  /** Carries the `:automationId` segment the host substitutes. */\n  detail: string;\n}\n\n/**\n * Service-relative paths the host calls. The base path, methods, headers, and\n * auth remain the host's. `{id}` marks where the automation id is substituted.\n */\nexport interface InterfaceEndpoints {\n  list: string;\n  detail: string;\n  dispatch: string;\n  runs: string;\n  tarball: string;\n  health: string;\n  capabilities: string;\n  validate: string;\n  createPrompt: string;\n  createPlugin: string;\n}\n\nexport type InterfaceEndpointName = keyof InterfaceEndpoints;\n\nexport interface InterfaceImportExport {\n  fileKind: string;\n  fileVersion: number;\n  filenameSuffix: string;\n  importDefaults: {\n    /** Provider inferred for short owner/repo repository URLs on import. */\n    repoProvider: SetupGitProvider;\n    /** Event source of the placeholder trigger that keeps an import inert. */\n    placeholderEventSource: string;\n  };\n}\n\nexport interface InterfaceManifest {\n  version: typeof INTERFACE_VERSION;\n  routes: InterfaceRoutes;\n  navigation: {\n    sidebar: { label: string };\n    commandMenu: { title: string; description: string; keywords: string };\n  };\n  pages: {\n    list: { title: string; subtitle: string };\n    detail: { backLabel: string };\n    edit: { title: string };\n  };\n  docsUrl: string;\n  /**\n   * The input surface of an existing Automation, keyed by the runtime-model\n   * property the host sends. Rendering it as an edit dialog is this host's\n   * choice, not stated here.\n   */\n  attributes: Partial<Record<AutomationAttributeName, InterfaceAttribute>>;\n  importExport: InterfaceImportExport;\n  endpoints: InterfaceEndpoints;\n  featuredAutomationIds: string[];\n  responderIntegrationIds: string[];\n}\n"],"mappings":"6CA6BA,IAAa,EAA+B,CAAC,OAAQ,YAAY"}