@openkeyai/tool-manifest 0.1.0

package/dist/schema.d.ts

@@ -0,0 +1,69 @@
+import { z } from 'zod';
+export { ZodError } from 'zod';
+
+/** Scopes are the FROZEN set from ARCHITECTURE.md Appendix B. */
+declare const ToolScopeEnum: z.ZodEnum<{
+    "keys.read": "keys.read";
+    "user.read": "user.read";
+    "billing.read": "billing.read";
+}>;
+type ToolScope = z.infer<typeof ToolScopeEnum>;
+/** Provider slugs aligned with the hub vault's `PROVIDERS` registry. */
+declare const ProviderSlugEnum: z.ZodEnum<{
+    openai: "openai";
+    anthropic: "anthropic";
+    google: "google";
+    replicate: "replicate";
+    elevenlabs: "elevenlabs";
+    fal: "fal";
+}>;
+type ProviderSlug = z.infer<typeof ProviderSlugEnum>;
+/** Runtime tier — pick the right template + deploy pipeline. */
+declare const RuntimeTierEnum: z.ZodEnum<{
+    edge: "edge";
+    container: "container";
+}>;
+type RuntimeTier = z.infer<typeof RuntimeTierEnum>;
+/** Owner — at least a name; email + github are nice-to-have for support. */
+declare const ToolOwnerSchema: z.ZodObject<{
+    name: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    github: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type ToolOwner = z.infer<typeof ToolOwnerSchema>;
+/** Top-level schema. */
+declare const ToolManifestSchema: z.ZodObject<{
+    slug: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodDefault<z.ZodString>;
+    version: z.ZodString;
+    runtime: z.ZodEnum<{
+        edge: "edge";
+        container: "container";
+    }>;
+    scopes: z.ZodArray<z.ZodEnum<{
+        "keys.read": "keys.read";
+        "user.read": "user.read";
+        "billing.read": "billing.read";
+    }>>;
+    providers: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        openai: "openai";
+        anthropic: "anthropic";
+        google: "google";
+        replicate: "replicate";
+        elevenlabs: "elevenlabs";
+        fal: "fal";
+    }>>>;
+    homepage: z.ZodOptional<z.ZodString>;
+    callback_url: z.ZodString;
+    owner: z.ZodObject<{
+        name: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        github: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    sdk_version: z.ZodString;
+    category: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type ToolManifest = z.infer<typeof ToolManifestSchema>;
+
+export { type ProviderSlug, ProviderSlugEnum, type RuntimeTier, RuntimeTierEnum, type ToolManifest, ToolManifestSchema, type ToolOwner, ToolOwnerSchema, type ToolScope, ToolScopeEnum };

package/dist/schema.js

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+export { ZodError } from 'zod';
+
+// src/schema.ts
+var slugRegex = /^[a-z][a-z0-9-]{1,38}[a-z0-9]$/;
+var ToolScopeEnum = z.enum(["keys.read", "user.read", "billing.read"]);
+var ProviderSlugEnum = z.enum([
+  "openai",
+  "anthropic",
+  "google",
+  "replicate",
+  "elevenlabs",
+  "fal"
+]);
+var RuntimeTierEnum = z.enum(["edge", "container"]);
+var ToolOwnerSchema = z.object({
+  name: z.string().min(1).max(80),
+  email: z.string().email().optional(),
+  github: z.string().regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,38}[a-zA-Z0-9])?$/, "github handle").optional()
+});
+var ToolManifestSchema = z.object({
+  /** Stable URL-safe identifier. Becomes the JWT's `aud` claim. */
+  slug: z.string().regex(slugRegex, "slug must be lowercase kebab-case, 3\u201340 chars"),
+  /** Human-readable name shown in the catalog and HubHeader. */
+  name: z.string().min(1).max(80),
+  /** One-sentence catalog description. */
+  description: z.string().max(280).default(""),
+  /** Tool version (semver). */
+  version: z.string().regex(/^\d+\.\d+\.\d+(?:-[\w.+-]+)?$/, "semver"),
+  /** Runtime tier — picks template + deploy pipeline. */
+  runtime: RuntimeTierEnum,
+  /** Scopes the tool may request when minting a JWT. Min 1. */
+  scopes: z.array(ToolScopeEnum).min(1),
+  /** API provider slugs the tool may fetch keys for. */
+  providers: z.array(ProviderSlugEnum).default([]),
+  /** Public homepage / docs URL. Surfaced in the hub catalog. */
+  homepage: z.string().url().optional(),
+  /** Where the hub sends users after issuing a token. https only. */
+  callback_url: z.string().url().refine((u) => u.startsWith("https://"), "callback_url must be https://"),
+  /** Tool owner. */
+  owner: ToolOwnerSchema,
+  /** Semver range the tool was built against. Hub uses this for compat warnings. */
+  sdk_version: z.string().min(1),
+  /** Optional category for catalog grouping (e.g. "media", "writing"). */
+  category: z.string().min(1).max(40).optional()
+});
+
+export { ProviderSlugEnum, RuntimeTierEnum, ToolManifestSchema, ToolOwnerSchema, ToolScopeEnum };
+//# sourceMappingURL=schema.js.map
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/schema.ts"],"names":[],"mappings":";;;;AAsBA,IAAM,SAAA,GAAY,gCAAA;AAGX,IAAM,gBAAgB,CAAA,CAAE,IAAA,CAAK,CAAC,WAAA,EAAa,WAAA,EAAa,cAAc,CAAC;AAIvE,IAAM,gBAAA,GAAmB,EAAE,IAAA,CAAK;AAAA,EACrC,QAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,kBAAkB,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,WAAW,CAAC;AAIpD,IAAM,eAAA,GAAkB,EAAE,MAAA,CAAO;AAAA,EACtC,IAAA,EAAM,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EAC9B,OAAO,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,GAAQ,QAAA,EAAS;AAAA,EACnC,MAAA,EAAQ,EACL,MAAA,EAAO,CACP,MAAM,iDAAA,EAAmD,eAAe,EACxE,QAAA;AACL,CAAC;AAIM,IAAM,kBAAA,GAAqB,EAAE,MAAA,CAAO;AAAA;AAAA,EAEzC,MAAM,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,CAAM,WAAW,oDAA+C,CAAA;AAAA;AAAA,EAEjF,IAAA,EAAM,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA;AAAA,EAE9B,WAAA,EAAa,EAAE,MAAA,EAAO,CAAE,IAAI,GAAG,CAAA,CAAE,QAAQ,EAAE,CAAA;AAAA;AAAA,EAE3C,SAAS,CAAA,CAAE,MAAA,EAAO,CAAE,KAAA,CAAM,iCAAiC,QAAQ,CAAA;AAAA;AAAA,EAEnE,OAAA,EAAS,eAAA;AAAA;AAAA,EAET,QAAQ,CAAA,CAAE,KAAA,CAAM,aAAa,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA;AAAA,EAEpC,WAAW,CAAA,CAAE,KAAA,CAAM,gBAAgB,CAAA,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA;AAAA,EAE/C,UAAU,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA,EAAS;AAAA;AAAA,EAEpC,YAAA,EAAc,CAAA,CACX,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAU,GAAG,+BAA+B,CAAA;AAAA;AAAA,EAE1E,KAAA,EAAO,eAAA;AAAA;AAAA,EAEP,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA;AAAA,EAE7B,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,EAAE,CAAA,CAAE,QAAA;AACtC,CAAC","file":"schema.js","sourcesContent":["import { z } from \"zod\";\n\n/**\n * `tool.json` — the manifest every OpenKey AI tool ships at the repo root.\n *\n * This schema is the SOURCE OF TRUTH for the contract. The hub's tool\n * registry sync (Phase 9b, lands in the hub repo) imports\n * `ToolManifestSchema` from this package and rejects any insert that\n * doesn't parse cleanly. The Phase 13 auto-scaffolder uses the same\n * schema to produce a starter `tool.json` for newly-voted tools.\n *\n * Status of fields:\n *   - FROZEN — changing the shape (rename, type swap, required→optional)\n *     is a major version bump with 60-day notice to tool authors\n *   - ADDITIONS — new optional fields are minor version bumps\n *\n * We deliberately keep the schema lean. A field exists here only if either\n * (a) the hub needs it to register the tool, (b) the SDK needs it at\n * runtime, or (c) the scanner needs it to enforce a rule.\n */\n\n/** Slug — lowercase kebab-case, 3–40 chars. Matches the hub's `tools.slug` CHECK. */\nconst slugRegex = /^[a-z][a-z0-9-]{1,38}[a-z0-9]$/;\n\n/** Scopes are the FROZEN set from ARCHITECTURE.md Appendix B. */\nexport const ToolScopeEnum = z.enum([\"keys.read\", \"user.read\", \"billing.read\"]);\nexport type ToolScope = z.infer<typeof ToolScopeEnum>;\n\n/** Provider slugs aligned with the hub vault's `PROVIDERS` registry. */\nexport const ProviderSlugEnum = z.enum([\n  \"openai\",\n  \"anthropic\",\n  \"google\",\n  \"replicate\",\n  \"elevenlabs\",\n  \"fal\",\n]);\nexport type ProviderSlug = z.infer<typeof ProviderSlugEnum>;\n\n/** Runtime tier — pick the right template + deploy pipeline. */\nexport const RuntimeTierEnum = z.enum([\"edge\", \"container\"]);\nexport type RuntimeTier = z.infer<typeof RuntimeTierEnum>;\n\n/** Owner — at least a name; email + github are nice-to-have for support. */\nexport const ToolOwnerSchema = z.object({\n  name: z.string().min(1).max(80),\n  email: z.string().email().optional(),\n  github: z\n    .string()\n    .regex(/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,38}[a-zA-Z0-9])?$/, \"github handle\")\n    .optional(),\n});\nexport type ToolOwner = z.infer<typeof ToolOwnerSchema>;\n\n/** Top-level schema. */\nexport const ToolManifestSchema = z.object({\n  /** Stable URL-safe identifier. Becomes the JWT's `aud` claim. */\n  slug: z.string().regex(slugRegex, \"slug must be lowercase kebab-case, 3–40 chars\"),\n  /** Human-readable name shown in the catalog and HubHeader. */\n  name: z.string().min(1).max(80),\n  /** One-sentence catalog description. */\n  description: z.string().max(280).default(\"\"),\n  /** Tool version (semver). */\n  version: z.string().regex(/^\\d+\\.\\d+\\.\\d+(?:-[\\w.+-]+)?$/, \"semver\"),\n  /** Runtime tier — picks template + deploy pipeline. */\n  runtime: RuntimeTierEnum,\n  /** Scopes the tool may request when minting a JWT. Min 1. */\n  scopes: z.array(ToolScopeEnum).min(1),\n  /** API provider slugs the tool may fetch keys for. */\n  providers: z.array(ProviderSlugEnum).default([]),\n  /** Public homepage / docs URL. Surfaced in the hub catalog. */\n  homepage: z.string().url().optional(),\n  /** Where the hub sends users after issuing a token. https only. */\n  callback_url: z\n    .string()\n    .url()\n    .refine((u) => u.startsWith(\"https://\"), \"callback_url must be https://\"),\n  /** Tool owner. */\n  owner: ToolOwnerSchema,\n  /** Semver range the tool was built against. Hub uses this for compat warnings. */\n  sdk_version: z.string().min(1),\n  /** Optional category for catalog grouping (e.g. \"media\", \"writing\"). */\n  category: z.string().min(1).max(40).optional(),\n});\n\nexport type ToolManifest = z.infer<typeof ToolManifestSchema>;\n\n/** Re-export Zod errors verbatim — consumers can `instanceof` check them. */\nexport { ZodError } from \"zod\";\n"]}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@openkeyai/tool-manifest",
+  "version": "0.1.0",
+  "description": "Schema + AST scanner that enforces the OpenKey AI tool contract.",
+  "license": "MIT",
+  "author": "Scott Goodwin",
+  "homepage": "https://openkeyai.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Scott-Builds-AI/tool-manifest.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Scott-Builds-AI/tool-manifest/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "okai-scan": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs",
+      "types": "./dist/index.d.ts"
+    },
+    "./schema": {
+      "import": "./dist/schema.js",
+      "require": "./dist/schema.cjs",
+      "types": "./dist/schema.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^20",
+    "tsup": "^8.3.0",
+    "typescript": "^5.6.0",
+    "vitest": "^2.1.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "lint": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}