@ossy/app 1.40.2 → 3.0.1

package/cli/manifest-plugin.js

@@ -4,6 +4,21 @@ import { pathToFileURL } from 'node:url'
 
 import { metadataIdFromFile, defaultPageRoute } from './get-platform-files.task.js'
 import { discoverPackageDefinitions } from '../src/manifest/discover-package-definitions.js'
+import { buildActionsSchema } from '../src/manifest/build-actions-schema.js'
+import { buildCapabilities } from '../src/manifest/build-capabilities.js'
+import { extractTaskCatalogEntry, buildTaskCatalogEdges } from '../src/manifest/extract-task-catalog.js'
+import {
+  Schema,
+  isActionId,
+  taskIdFromActionId,
+  CAPABILITY_SCHEMA_ID,
+} from '@ossy/schema'
+import { isCanonicalSchemaId } from '@ossy/schema'
+import {
+  resolvePageLayoutId,
+  resolvePageShellSlots,
+  isCanonicalLayoutId,
+} from '../src/manifest/resolve-page-layout.js'
 
 /**
  * @typedef {import('./get-platform-files.task.js').PlatformEntry} PlatformEntry
@@ -62,16 +77,21 @@ import { discoverPackageDefinitions } from '../src/manifest/discover-package-def
  * @property {string} entry  URL the platform serves the startup bundle from.
  *
  * @typedef {object} EmailManifestEntry
- * @property {string} id     Unique email id (e.g. `'authentication/verify-sign-in'`).
+ * @property {string} id     Unique email id (e.g. `'@ossy/authentication/emails/verify-sign-in'`).
  * @property {string} entry  URL the platform serves the email bundle from.
  *
  * @typedef {object} ActionManifestEntry
- * @property {string} id      Unique action slug (e.g. `'authentication/request-sign-in'`).
+ * @property {string} id      Unique action slug (e.g. `'@ossy/authentication/actions/request-sign-in'`).
  * @property {string} entry   URL the platform serves the action bundle from.
  * @property {string} access  Access level: `'public'` | `'authenticated'` | `'workspace'`.
  *
+ * @typedef {object} FormManifestEntry
+ * @property {string} id           Unique form slug (e.g. `'@ossy/authentication/form/sign-up'`).
+ * @property {string} schemaId   Resource schema id (e.g. `'@ossy/authentication/sign-up'`).
+ * @property {string} entry        URL the platform serves the form bundle from.
+ *
  * @typedef {object} LayoutManifestEntry
- * @property {string} id      Unique layout id (e.g. `'app-shell'`).
+ * @property {string} id      Canonical layout id (e.g. `'@ossy/app/layout/default'`).
  * @property {string} entry   URL the platform serves the layout bundle from.
  * @property {Record<string, string>} [slots]
  *   App-controlled slot map (`slotName` → component `metadata.id`), from `export const slots` in `*.layout.jsx`.
@@ -82,16 +102,24 @@ import { discoverPackageDefinitions } from '../src/manifest/discover-package-def
  * @property {string[]} requires  Runtime dependencies needed (e.g. `['server', 'database']`).
  * @property {string} entry    URL the platform serves the e2e bundle from.
  *
+ * @typedef {object} FlowManifestEntry
+ * @property {string} id       Unique flow id (e.g. `'@ossy/authentication/actions/sign-up'`).
+ * @property {string} feature  Grouping label (e.g. `'authentication'`).
+ * @property {string[]} requires  Runtime dependencies needed (e.g. `['server', 'database']`).
+ * @property {string} entry    URL the platform serves the flow bundle from.
+ *
  * @typedef {object} Manifest
  * @property {ManifestEntry[]} entries              Flat, ordered list of every routable thing.
  * @property {ComponentManifestEntry[]} components  Discovered `*.component.*` entries, keyed by id.
- * @property {object[]} resourceTemplates           Each `*.resource.js` file's default-exported template object.
+ * @property {object[]} schemas           Each `*.schema.js` file's default-exported template object.
  * @property {AggregateManifestEntry[]} aggregates  Discovered `*.aggregate.js` entries from installed packages.
  * @property {IntegrationManifestEntry[]} integrations  Discovered `*.integration.js` entries.
  * @property {StartupManifestEntry[]} startups      Discovered `*.startup.js` entries.
  * @property {EmailManifestEntry[]} emails          Discovered `*.email.{jsx,tsx}` entries.
  * @property {ActionManifestEntry[]} actions        Discovered `*.action.js` entries.
+ * @property {FormManifestEntry[]} forms           Discovered `*.form.js` entries.
  * @property {E2eManifestEntry[]} e2es              Discovered `*.e2e.js` entries from installed packages.
+ * @property {FlowManifestEntry[]} flows            Discovered `*.flow.js` entries from installed packages.
  * @property {LayoutManifestEntry[]} layouts        Discovered `*.layout.{jsx,tsx}` entries (includes app `slots` map).
  * @property {object} config                        Inlined `src/config.js` default export.
  * @property {Record<string, object>} [definitions] Package Definition metadata keyed by slug.
@@ -131,18 +159,37 @@ import { discoverPackageDefinitions } from '../src/manifest/discover-package-def
  * @param {ManifestPluginOptions} options
  * @returns {import('rollup').Plugin}
  */
+function reportValidationError (plugin, result, sourcePath) {
+  if (result.ok) return
+  const message = result.errors?.[0]?.message ?? result.message ?? 'Validation failed'
+  plugin.error(`[@ossy/app][build] ${sourcePath}: ${message}`)
+}
+
 function entryPackage (entryInfo, appPackageName) {
   return entryInfo.packageName || appPackageName
 }
 
+/** Repo-relative path for Storybook / dev tooling (Vite source imports). */
+function manifestSourcePath (entryInfo, projectRoot) {
+  if (!entryInfo?.sourcePath || !projectRoot) return undefined
+  return path.relative(projectRoot, entryInfo.sourcePath).split(path.sep).join('/')
+}
+
+function withSourcePath (obj, entryInfo, projectRoot) {
+  const sourcePath = manifestSourcePath(entryInfo, projectRoot)
+  return sourcePath ? { ...obj, sourcePath } : obj
+}
+
 export function manifestPlugin ({ entriesByStub, srcDir, staticOutDir, configValue, appPackageName = '@ossy/app', manifestPath, projectRoot }) {
   return {
     name: 'ossy-manifest',
     async writeBundle (_, bundle) {
       /** @type {ManifestEntry[]} */
       const entries = []
+      /** @type {Record<string, { path: string, method?: string, query?: string[] }>} */
+      const actionRoutes = {}
       /** @type {object[]} */
-      const resourceTemplates = []
+      const schemas = []
       /** @type {import('./get-platform-files.task.js').ComponentManifestEntry[]} */
       const components = []
       /** @type {AggregateManifestEntry[]} */
@@ -155,6 +202,8 @@ export function manifestPlugin ({ entriesByStub, srcDir, staticOutDir, configVal
       const emails = []
       /** @type {ActionManifestEntry[]} */
       const actions = []
+      /** @type {FormManifestEntry[]} */
+      const forms = []
       const seenIds = { page: new Set(), api: new Set(), task: new Set(), component: new Set() }
       const seenResourceIds = new Set()
       const seenAggregateIds = new Set()
@@ -162,12 +211,20 @@ export function manifestPlugin ({ entriesByStub, srcDir, staticOutDir, configVal
       const seenStartupIds = new Set()
       const seenEmailIds = new Set()
       const seenActionIds = new Set()
+      const seenFormIds = new Set()
       /** @type {E2eManifestEntry[]} */
       const e2es = []
       const seenE2eIds = new Set()
+      /** @type {FlowManifestEntry[]} */
+      const flows = []
+      const seenFlowIds = new Set()
       /** @type {LayoutManifestEntry[]} */
       const layouts = []
       const seenLayoutIds = new Set()
+      /** @type {Map<string, { rawMeta: object, packageName: string }>} */
+      const pageMetaById = new Map()
+      /** @type {Array<{ mod: object, entryInfo: import('./get-platform-files.task.js').PlatformEntry, url: string, pkg: string }>} */
+      const taskPending = []
       for (const fileName of Object.keys(bundle)) {
         const chunk = bundle[fileName]
         if (chunk.type !== 'chunk' || !chunk.isEntry) continue
@@ -217,7 +274,7 @@ export function manifestPlugin ({ entriesByStub, srcDir, staticOutDir, configVal
             this.error(`[@ossy/app][build] Duplicate integration id "${integrationId}"`)
           }
           seenIntegrationIds.add(integrationId)
-          integrations.push({ id: integrationId, entry: url, credentials, package: entryPackage(entryInfo, appPackageName) })
+          integrations.push(withSourcePath({ id: integrationId, entry: url, credentials, package: entryPackage(entryInfo, appPackageName) }, entryInfo, projectRoot))
           continue
         }
 
@@ -240,7 +297,7 @@ export function manifestPlugin ({ entriesByStub, srcDir, staticOutDir, configVal
             this.error(`[@ossy/app][build] Duplicate startup id "${startupId}"`)
           }
           seenStartupIds.add(startupId)
-          startups.push({ id: startupId, entry: url, package: entryPackage(entryInfo, appPackageName) })
+          startups.push(withSourcePath({ id: startupId, entry: url, package: entryPackage(entryInfo, appPackageName) }, entryInfo, projectRoot))
           continue
         }
 
@@ -264,12 +321,12 @@ export function manifestPlugin ({ entriesByStub, srcDir, staticOutDir, configVal
             this.error(`[@ossy/app][build] Duplicate email id "${emailId}"`)
           }
           seenEmailIds.add(emailId)
-          emails.push({ id: emailId, entry: url, package: entryPackage(entryInfo, appPackageName) })
+          emails.push(withSourcePath({ id: emailId, entry: url, package: entryPackage(entryInfo, appPackageName) }, entryInfo, projectRoot))
           continue
         }
 
-        // Actions are intent: `metadata` only (`{ id, access }`). Matching task
-        // with the same id holds `run` (see ADR 0003).
+        // Actions are intent: `metadata` only (`{ id, access }`). Primary implementation
+        // lives in `{feature}/tasks/{intent}` derived from the action id (ADR 0003).
         if (entryInfo.kind === 'action') {
           const actionId = mod?.metadata?.id
           if (typeof actionId !== 'string' || actionId.trim() === '') {
@@ -281,8 +338,44 @@ export function manifestPlugin ({ entriesByStub, srcDir, staticOutDir, configVal
             this.error(`[@ossy/app][build] Duplicate action id "${actionId}"`)
           }
           const access = mod.metadata?.access ?? 'authenticated'
+          reportValidationError(
+            this,
+            Schema.of({ schemas: [] }).validate(
+              CAPABILITY_SCHEMA_ID.ACTION_META,
+              { id: actionId, ...(mod.metadata?.access != null ? { access: mod.metadata.access } : {}) },
+              { sourcePath: entryInfo.sourcePath },
+            ),
+            entryInfo.sourcePath,
+          )
           seenActionIds.add(actionId)
-          actions.push({ id: actionId, entry: url, access, package: entryPackage(entryInfo, appPackageName) })
+          actions.push(withSourcePath({ id: actionId, entry: url, access, package: entryPackage(entryInfo, appPackageName) }, entryInfo, projectRoot))
+          continue
+        }
+
+        // Forms are intent metadata (`metadata` only) referencing a resource template.
+        if (entryInfo.kind === 'form') {
+          const formId = mod?.metadata?.id
+          const schemaId = mod?.metadata?.schemaId
+          if (typeof formId !== 'string' || formId.trim() === '') {
+            this.error(
+              `[@ossy/app][build] form entry ${entryInfo.sourcePath} must export a non-empty string "metadata.id"`,
+            )
+          }
+          if (typeof schemaId !== 'string' || schemaId.trim() === '') {
+            this.error(
+              `[@ossy/app][build] form entry ${entryInfo.sourcePath} must export a non-empty string "metadata.schemaId"`,
+            )
+          }
+          if (seenFormIds.has(formId)) {
+            this.error(`[@ossy/app][build] Duplicate form id "${formId}"`)
+          }
+          seenFormIds.add(formId)
+          forms.push(withSourcePath({
+            id: formId,
+            schemaId,
+            entry: url,
+            package: entryPackage(entryInfo, appPackageName),
+          }, entryInfo, projectRoot))
           continue
         }
 
@@ -306,7 +399,7 @@ export function manifestPlugin ({ entriesByStub, srcDir, staticOutDir, configVal
             this.error(`[@ossy/app][build] Duplicate aggregate id "${aggregateId}"`)
           }
           seenAggregateIds.add(aggregateId)
-          aggregates.push({ id: aggregateId, entry: url, package: entryPackage(entryInfo, appPackageName) })
+          aggregates.push(withSourcePath({ id: aggregateId, entry: url, package: entryPackage(entryInfo, appPackageName) }, entryInfo, projectRoot))
           continue
         }
 
@@ -334,26 +427,66 @@ export function manifestPlugin ({ entriesByStub, srcDir, staticOutDir, configVal
             this.error(`[@ossy/app][build] Duplicate e2e id "${e2eId}"`)
           }
           seenE2eIds.add(e2eId)
-          e2es.push({
+          e2es.push(withSourcePath({
             id: e2eId,
             feature: typeof feature === 'string' ? feature : '',
             requires: Array.isArray(requires) ? requires : [],
             entry: url,
             package: entryPackage(entryInfo, appPackageName),
-          })
+          }, entryInfo, projectRoot))
           continue
         }
 
-        // Layouts wrap every page render. The bundle exports `id` and a default
-        // export (the React component). Only one `*.layout.jsx` per app is
-        // supported. They don't produce routable entries; they accumulate into
-        // `manifest.layouts` so the server can inject them at render time.
+        if (entryInfo.kind === 'flow') {
+          const flowMeta = mod?.metadata ?? mod?.default?.metadata ?? {}
+          const flowId = flowMeta.id ?? mod?.default?.id
+          const feature = flowMeta.feature
+          const requires = flowMeta.requires
+          const flowBody = mod?.default
+          if (typeof flowId !== 'string' || flowId.trim() === '') {
+            this.error(
+              `[@ossy/app][build] flow entry ${entryInfo.sourcePath} must export metadata.id`,
+            )
+          }
+          if (!flowBody || typeof flowBody !== 'object' || !Array.isArray(flowBody.steps)) {
+            this.error(
+              `[@ossy/app][build] flow entry ${entryInfo.sourcePath} must default-export an object with steps[]`,
+            )
+          }
+          if (seenFlowIds.has(flowId)) {
+            this.error(`[@ossy/app][build] Duplicate flow id "${flowId}"`)
+          }
+          seenFlowIds.add(flowId)
+          flows.push(withSourcePath({
+            id: flowId,
+            feature: typeof feature === 'string' ? feature : '',
+            requires: Array.isArray(requires) ? requires : [],
+            entry: url,
+            package: entryPackage(entryInfo, appPackageName),
+          }, entryInfo, projectRoot))
+          continue
+        }
+
+        // Layouts wrap page renders. The bundle exports metadata.id, optional slots,
+        // and a default export (the React component). They accumulate into
+        // `manifest.layouts` so the server can inject them at render time per page.
         if (entryInfo.kind === 'layout') {
-          const layoutId = mod && mod.id
+          const layoutMeta = mod?.metadata ?? {}
+          const layoutId =
+            typeof layoutMeta.id === 'string' && layoutMeta.id.trim()
+              ? layoutMeta.id.trim()
+              : typeof mod?.id === 'string'
+                ? mod.id.trim()
+                : ''
           const component = mod && mod.default
-          if (typeof layoutId !== 'string' || layoutId.trim() === '') {
+          if (!layoutId) {
             this.error(
-              `[@ossy/app][build] layout entry ${entryInfo.sourcePath} must export a non-empty string "id"`,
+              `[@ossy/app][build] layout entry ${entryInfo.sourcePath} must export metadata.id (canonical layout id)`,
+            )
+          }
+          if (!isCanonicalLayoutId(layoutId)) {
+            this.error(
+              `[@ossy/app][build] layout entry ${entryInfo.sourcePath} id must match @{provider}/{feature}/layout/{concept} — got "${layoutId}"`,
             )
           }
           if (typeof component !== 'function') {
@@ -391,36 +524,60 @@ export function manifestPlugin ({ entriesByStub, srcDir, staticOutDir, configVal
               layoutSlots[sk] = cid
             }
           }
-          layouts.push({
+          layouts.push(withSourcePath({
             id: layoutId,
             entry: url,
             package: entryPackage(entryInfo, appPackageName),
             ...(layoutSlots && Object.keys(layoutSlots).length > 0 ? { slots: layoutSlots } : {}),
-          })
+          }, entryInfo, projectRoot))
+          continue
+        }
+
+        if (entryInfo.kind === 'schema') {
+          const schema = mod && mod.default
+          if (!schema || typeof schema !== 'object' || Array.isArray(schema)) {
+            this.error(
+              `[@ossy/app][build] schema entry ${entryInfo.sourcePath} must default-export an object`,
+            )
+          }
+          if (typeof schema.id !== 'string' || schema.id.trim() === '') {
+            this.error(
+              `[@ossy/app][build] schema entry ${entryInfo.sourcePath} default export is missing a non-empty string "id"`,
+            )
+          }
+          if (!isCanonicalSchemaId(schema.id)) {
+            this.error(
+              `[@ossy/app][build] schema entry ${entryInfo.sourcePath} id must match @{provider}/{feature}/schema/{concept} — got "${schema.id}"`,
+            )
+          }
+          if (seenResourceIds.has(schema.id)) {
+            this.error(`[@ossy/app][build] Duplicate schema id "${schema.id}"`)
+          }
+          seenResourceIds.add(schema.id)
+          schemas.push(withSourcePath({ ...schema, package: entryPackage(entryInfo, appPackageName) }, entryInfo, projectRoot))
           continue
         }
 
-        // Resources are pure data — the default export *is* the template.
-        // They don't use `metadata`, don't need a derived id, and don't
-        // produce a routable manifest entry; they accumulate into a separate
-        // `resourceTemplates` array on the manifest.
-        if (entryInfo.kind === 'resource') {
-          const template = mod && mod.default
-          if (!template || typeof template !== 'object' || Array.isArray(template)) {
+        if (entryInfo.kind === 'task') {
+          const taskMeta = mod?.metadata
+          const taskId = taskMeta?.id
+          if (typeof taskId !== 'string' || taskId.trim() === '') {
             this.error(
-              `[@ossy/app][build] resource entry ${entryInfo.sourcePath} must default-export an object`,
+              `[@ossy/app][build] task entry ${entryInfo.sourcePath} must export a non-empty string "metadata.id"`,
             )
           }
-          if (typeof template.id !== 'string' || template.id.trim() === '') {
+          if (isActionId(taskId)) {
             this.error(
-              `[@ossy/app][build] resource entry ${entryInfo.sourcePath} default export is missing a non-empty string "id"`,
+              `[@ossy/app][build] Task "${taskId}" uses /actions/ — use /tasks/ (e.g. "${taskIdFromActionId(taskId)}")`,
             )
           }
-          if (seenResourceIds.has(template.id)) {
-            this.error(`[@ossy/app][build] Duplicate resource template id "${template.id}"`)
+          if (seenIds.task.has(taskId)) {
+            this.error(`[@ossy/app][build] Duplicate task id "${taskId}"`)
           }
-          seenResourceIds.add(template.id)
-          resourceTemplates.push({ ...template, package: entryPackage(entryInfo, appPackageName) })
+          seenIds.task.add(taskId)
+          const pkg = entryPackage(entryInfo, appPackageName)
+          taskPending.push({ mod, entryInfo, url, pkg })
+          entries.push(withSourcePath({ type: 'task', id: taskId, entry: url, package: pkg }, entryInfo, projectRoot))
           continue
         }
 
@@ -438,22 +595,39 @@ export function manifestPlugin ({ entriesByStub, srcDir, staticOutDir, configVal
           if (mod.slot != null) {
             this.error(
               `[@ossy/app][build] component ${entryInfo.sourcePath} must not export \`slot\`. ` +
-              'Assign components to shell slots in `*.layout.jsx` via `export const slots`.',
+              'Assign components to app slots in `*.layout.jsx` via `export const slots`.',
             )
           }
-          components.push({ id, entry: url, package: entryPackage(entryInfo, appPackageName) })
+          components.push(withSourcePath({ id, entry: url, package: entryPackage(entryInfo, appPackageName) }, entryInfo, projectRoot))
           continue
         }
 
         if (entryInfo.kind === 'page') {
           const pagePath = rawMeta.path !== undefined ? rawMeta.path : defaultPageRoute(id)
-          entries.push({
+          reportValidationError(
+            this,
+            Schema.of({ schemas: [] }).validate(
+              CAPABILITY_SCHEMA_ID.PAGE_META,
+              {
+                id,
+                path: pagePath,
+                ...(rawMeta.title != null ? { title: rawMeta.title } : {}),
+              },
+              { sourcePath: entryInfo.sourcePath },
+            ),
+            entryInfo.sourcePath,
+          )
+          entries.push(withSourcePath({
             type: 'page',
             id,
             path: pagePath,
             title: rawMeta.title,
             entry: url,
             package: entryPackage(entryInfo, appPackageName),
+          }, entryInfo, projectRoot))
+          pageMetaById.set(id, {
+            rawMeta,
+            packageName: entryPackage(entryInfo, appPackageName),
           })
         } else if (entryInfo.kind === 'api') {
           // APIs have no sensible default route (unlike pages where we can
@@ -467,40 +641,158 @@ export function manifestPlugin ({ entriesByStub, srcDir, staticOutDir, configVal
               `Add a \`path\` to the metadata or default-export object (e.g. \`path: '/api/${id}'\`).`,
             )
           }
-          entries.push({ type: 'api', id, path: rawMeta.path, entry: url, package: entryPackage(entryInfo, appPackageName) })
-        } else {
-          entries.push({ type: 'task', id, entry: url, package: entryPackage(entryInfo, appPackageName) })
+          const apiEntry = {
+            type: 'api',
+            id,
+            path: rawMeta.path,
+            entry: url,
+            package: entryPackage(entryInfo, appPackageName),
+          }
+          if (typeof rawMeta.action === 'string' && rawMeta.action.trim()) {
+            apiEntry.action = rawMeta.action
+            apiEntry.method = rawMeta.method ?? 'GET'
+            if (Array.isArray(rawMeta.query)) apiEntry.query = rawMeta.query
+            actionRoutes[rawMeta.action] = {
+              path: rawMeta.path,
+              method: rawMeta.method ?? 'GET',
+              ...(Array.isArray(rawMeta.query) && rawMeta.query.length ? { query: rawMeta.query } : {}),
+            }
+          }
+          entries.push(withSourcePath(apiEntry, entryInfo, projectRoot))
         }
       }
 
-      if (layouts.length > 1) {
-        this.error(
-          `[@ossy/app][build] Only one *.layout.jsx per app is allowed (found ${layouts.length}). ` +
-          'Use conditional rendering inside the app layout for route-specific chrome.',
+      const actionIdSet = new Set(actions.map((a) => a.id))
+      const schemaIdSet = new Set(schemas.map((s) => s.id))
+      const taskIdList = taskPending.map(({ mod }) => mod?.metadata?.id).filter(Boolean)
+
+      const schemaEngine = Schema.of(
+        { schemas },
+        { actionIds: [...actionIdSet], taskIds: taskIdList, strictRefs: true },
+      )
+
+      for (const { mod, entryInfo } of taskPending) {
+        reportValidationError(
+          this,
+          schemaEngine.validate(CAPABILITY_SCHEMA_ID.TASK_META, mod?.metadata ?? {}, {
+            strictRefs: true,
+            schemaIds: schemaIdSet,
+            sourcePath: entryInfo.sourcePath,
+          }),
+          entryInfo.sourcePath,
         )
       }
 
+      const taskCatalog = taskPending.map(({ mod, url, pkg }) =>
+        extractTaskCatalogEntry({
+          metadata: mod?.metadata ?? {},
+          package: pkg,
+          entry: url,
+          actionIdsInManifest: actionIdSet,
+        }),
+      )
+
+      for (const entry of taskCatalog) {
+        reportValidationError(
+          this,
+          schemaEngine.validate(CAPABILITY_SCHEMA_ID.TASK_CAPABILITY, entry, {
+            strictRefs: true,
+            schemaIds: schemaIdSet,
+            actionIds: actionIdSet,
+            allowDerived: true,
+            allowUnknownKeys: true,
+            label: entry.id,
+          }),
+          entry.id,
+        )
+      }
+
+      const taskGraphEdges = buildTaskCatalogEdges(taskCatalog)
+
       /** @type {Manifest} */
       const definitions = projectRoot
         ? await discoverPackageDefinitions(projectRoot)
         : {}
 
+      const layoutIdSet = new Set(layouts.map((layout) => layout.id))
+      const componentIdSet = new Set(components.map((component) => component.id))
+
+      for (const entry of entries) {
+        if (entry.type !== 'page') continue
+        const meta = pageMetaById.get(entry.id)
+        const layoutId = resolvePageLayoutId({
+          pageMetadata: meta?.rawMeta ?? {},
+          appConfig: configValue ?? {},
+        })
+        if (!layoutIdSet.has(layoutId)) {
+          this.error(
+            `[@ossy/app][build] page "${entry.id}" references layout "${layoutId}" which is not in manifest.layouts`,
+          )
+        }
+        if (!isCanonicalLayoutId(layoutId)) {
+          this.error(
+            `[@ossy/app][build] page "${entry.id}" layout must match @{provider}/{feature}/layout/{concept} — got "${layoutId}"`,
+          )
+        }
+        entry.layout = layoutId
+        const layoutDef = layouts.find((layout) => layout.id === layoutId)
+        const mergedSlots = resolvePageShellSlots({
+          layoutSlots: layoutDef?.slots,
+          appSlots: configValue?.slots,
+          pageSlots: meta?.rawMeta?.slots,
+        })
+        if (Object.keys(mergedSlots).length > 0) {
+          entry.slots = mergedSlots
+        }
+        for (const [slotKey, spec] of Object.entries(mergedSlots)) {
+          if (spec?.view === null) continue
+          const componentId = typeof spec?.view === 'string' ? spec.view.trim() : ''
+          if (!componentId) continue
+          if (!componentIdSet.has(componentId)) {
+            this.error(
+              `[@ossy/app][build] page "${entry.id}" slot "${slotKey}" references unknown component id "${componentId}"`,
+            )
+          }
+        }
+      }
+
       const manifest = {
         entries,
         components,
-        resourceTemplates,
+        schemas,
         aggregates,
         integrations,
         startups,
         emails,
         actions,
+        forms,
         e2es,
+        flows,
         layouts,
         definitions,
         config: configValue || {},
+        actionRoutes,
+        taskCatalog,
+        taskGraphEdges,
       }
       fs.mkdirSync(path.dirname(manifestPath), { recursive: true })
       fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), 'utf8')
+
+      const buildDirPath = path.dirname(manifestPath)
+      const tasks = taskCatalog.map((t) => ({ id: t.id }))
+      const capabilities = buildCapabilities({
+        actions,
+        tasks,
+        schemas,
+        taskCatalog,
+        taskGraphEdges,
+      })
+      const capabilitiesPath = path.join(buildDirPath, 'capabilities.json')
+      fs.writeFileSync(capabilitiesPath, JSON.stringify(capabilities, null, 2), 'utf8')
+
+      const actionsSchemaPath = path.join(buildDirPath, 'actions.schema.json')
+      const actionsSchema = buildActionsSchema(actions, { schemas, tasks })
+      fs.writeFileSync(actionsSchemaPath, JSON.stringify(actionsSchema, null, 2), 'utf8')
     },
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/app",
-  "version": "1.40.2",
+  "version": "3.0.1",
   "description": "",
   "source": "./src/index.js",
   "main": "./src/index.js",
@@ -9,12 +9,19 @@
     ".": "./src/index.js",
     "./shell": "./src/shell/index.js",
     "./runtime/page-runtime": "./runtime/page-runtime.js",
-    "./runtime/resolve-shell-slots": "./runtime/resolve-shell-slots.js",
+    "./runtime/resolve-app-slots": "./runtime/resolve-app-slots.js",
     "./runtime/api-runtime": "./runtime/api-runtime.js",
     "./runtime/task-runtime": "./runtime/task-runtime.js",
     "./manifest/build-manifest-summary": "./src/manifest/build-manifest-summary.js",
+    "./manifest/build-actions-schema": "./src/manifest/build-actions-schema.js",
+    "./manifest/build-capabilities": "./src/manifest/build-capabilities.js",
     "./manifest/discover-package-definitions": "./src/manifest/discover-package-definitions.js",
-    "./manifest/serialize-package-definition": "./src/manifest/serialize-package-definition.js"
+    "./manifest/serialize-package-definition": "./src/manifest/serialize-package-definition.js",
+    "./manifest/resolve-page-layout": "./src/manifest/resolve-page-layout.js",
+    "./runtime/merge-shell-slots": "./runtime/merge-shell-slots.js"
+  },
+  "ossy": {
+    "src": "./src/shell-registry"
   },
   "bin": {
     "app": "./cli/index.js"
@@ -42,15 +49,20 @@
     "@babel/eslint-parser": "^7.15.8",
     "@babel/preset-react": "^7.26.3",
     "@babel/register": "^7.25.9",
-    "@ossy/design-system": "^1.40.2",
-    "@ossy/locale": "^1.40.2",
-    "@ossy/pages": "^1.23.0",
-    "@ossy/platform": "^1.39.2",
-    "@ossy/router": "^1.40.2",
-    "@ossy/router-react": "^1.40.2",
-    "@ossy/sdk": "^1.40.2",
-    "@ossy/sdk-react": "^1.40.2",
-    "@ossy/themes": "^1.40.2",
+    "@ossy/authentication": "^3.0.1",
+    "@ossy/design-system": "^3.0.1",
+    "@ossy/locale": "^3.0.1",
+    "@ossy/package-catalog": "^3.0.1",
+    "@ossy/pages": "^3.0.1",
+    "@ossy/platform": "^3.0.1",
+    "@ossy/resources": "^3.0.1",
+    "@ossy/router": "^3.0.1",
+    "@ossy/router-react": "^3.0.1",
+    "@ossy/schema": "^3.0.1",
+    "@ossy/sdk": "^3.0.1",
+    "@ossy/sdk-react": "^3.0.1",
+    "@ossy/themes": "^3.0.1",
+    "@ossy/workspaces": "^3.0.1",
     "@rollup/plugin-alias": "^6.0.0",
     "@rollup/plugin-babel": "^7.0.0",
     "@rollup/plugin-commonjs": "^29.0.0",
@@ -84,5 +96,5 @@
     "README.md",
     "tsconfig.json"
   ],
-  "gitHead": "2b8745d57fee8b6c08787e2755b4df489291a5cd"
+  "gitHead": "4a70ec216448680d2fddc57b2a8a0077489720ae"
 }